af3016fe27
Forked from OpenCode v1.17.4 with multi-agent system: - 5 agents: aircoding, scheduler, worker, architect, reviewer - Deterministic DAG scheduling engine (coordinator_tick) - Tool whitelists as hard enforcement - AirCoding validation plugin - System prompt injection for routing - V1 requirements: C4 docs, ADR, AGENTS.md, debug-log.md - Design documents in docs/
84 lines
2.5 KiB
TypeScript
84 lines
2.5 KiB
TypeScript
import { describe, expect } from "bun:test"
|
|
import { Effect, Layer } from "effect"
|
|
import { Location } from "@opencode-ai/core/location"
|
|
import { Policy } from "@opencode-ai/core/policy"
|
|
import { AbsolutePath } from "@opencode-ai/core/schema"
|
|
import { location } from "./fixture/location"
|
|
import { testEffect } from "./lib/effect"
|
|
|
|
const it = testEffect(
|
|
Policy.locationLayer.pipe(
|
|
Layer.provide(
|
|
Layer.succeed(Location.Service, Location.Service.of(location({ directory: AbsolutePath.make("test") }))),
|
|
),
|
|
),
|
|
)
|
|
|
|
describe("Policy", () => {
|
|
it.effect("returns the caller's fallback when no statement matches", () =>
|
|
Effect.gen(function* () {
|
|
const policy = yield* Policy.Service
|
|
|
|
expect(yield* policy.evaluate("provider.use", "anthropic", "allow")).toBe("allow")
|
|
expect(yield* policy.evaluate("provider.use", "anthropic", "deny")).toBe("deny")
|
|
}),
|
|
)
|
|
|
|
it.effect("evaluates wildcard provider rules in written order", () =>
|
|
Effect.gen(function* () {
|
|
const policy = yield* Policy.Service
|
|
yield* policy.load([
|
|
new Policy.Info({
|
|
effect: "deny",
|
|
action: "provider.*",
|
|
resource: "*",
|
|
}),
|
|
new Policy.Info({
|
|
effect: "allow",
|
|
action: "provider.use",
|
|
resource: "anthropic",
|
|
}),
|
|
])
|
|
|
|
expect(yield* policy.evaluate("provider.use", "anthropic", "allow")).toBe("allow")
|
|
expect(yield* policy.evaluate("provider.use", "openai", "allow")).toBe("deny")
|
|
}),
|
|
)
|
|
|
|
it.effect("matches action and resource independently", () =>
|
|
Effect.gen(function* () {
|
|
const policy = yield* Policy.Service
|
|
yield* policy.load([
|
|
new Policy.Info({
|
|
effect: "deny",
|
|
action: "provider.*",
|
|
resource: "company-*",
|
|
}),
|
|
])
|
|
|
|
expect(yield* policy.evaluate("provider.use", "company-stable", "allow")).toBe("deny")
|
|
expect(yield* policy.evaluate("plugin.load", "company-stable", "allow")).toBe("allow")
|
|
}),
|
|
)
|
|
|
|
it.effect("uses the last matching loaded statement", () =>
|
|
Effect.gen(function* () {
|
|
const policy = yield* Policy.Service
|
|
yield* policy.load([
|
|
new Policy.Info({
|
|
effect: "allow",
|
|
action: "provider.use",
|
|
resource: "openai",
|
|
}),
|
|
new Policy.Info({
|
|
effect: "deny",
|
|
action: "provider.use",
|
|
resource: "openai",
|
|
}),
|
|
])
|
|
|
|
expect(yield* policy.evaluate("provider.use", "openai", "allow")).toBe("deny")
|
|
}),
|
|
)
|
|
})
|