1. 1#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
2. 2
3. 3use std::sync::Arc;
4. 4
5. 5use serde_json::json;
6. 6use tempfile::tempdir;
7. 7use tokio_util::sync::CancellationToken;
8. 8
9. 9use vak_hooks::{HookDef, HookEvent, HookOutcome, run_hooks};
10. 10
11. 11fn hook(command: &str) -> Arc<Vec<HookDef>> {
12. 12 Arc::new(vec![HookDef {
13. 13 event: HookEvent::PreToolUse,
14. 14 matcher: None,
15. 15 command: command.to_string(),
16. 16 timeout_ms: 5000,
17. 17 failure_mode: vak_hooks::HookFailureMode::Open,
18. 18 refusal: None,
19. 19 }])
20. 20}
21. 21
22. 22#[tokio::test]
23. 23async fn silent_exit_zero_is_no_opinion() {
24. 24 let dir = tempdir().unwrap();
25. 25 let out = run_hooks(
26. 26 hook("exit 0"),
27. 27 HookEvent::PreToolUse,
28. 28 "s",
29. 29 dir.path(),
30. 30 Some(("bash", &json!({"command": "ls"}))),
31. 31 None,
32. 32 &CancellationToken::new(),
33. 33 )
34. 34 .await;
35. 35 assert_eq!(out, HookOutcome::default());
36. 36}
37. 37
38. 38#[tokio::test]
39. 39async fn json_block_decision_blocks_with_reason() {
40. 40 let dir = tempdir().unwrap();
41. 41 let out = run_hooks(
42. 42 hook(r#"echo '{"decision":"block","reason":"no rm allowed"}'"#),
43. 43 HookEvent::PreToolUse,
44. 44 "s",
45. 45 dir.path(),
46. 46 Some(("bash", &json!({"command": "rm -rf /"}))),
47. 47 None,
48. 48 &CancellationToken::new(),
49. 49 )
50. 50 .await;
51. 51 assert!(out.blocked);
52. 52 assert_eq!(out.reason.as_deref(), Some("no rm allowed"));
53. 53}
54. 54
55. 55#[tokio::test]
56. 56async fn exit_two_blocks_with_stderr_reason() {
57. 57 let dir = tempdir().unwrap();
58. 58 let out = run_hooks(
59. 59 hook("echo policy-violation >&2; exit 2"),
60. 60 HookEvent::PreToolUse,
61. 61 "s",
62. 62 dir.path(),
63. 63 Some(("bash", &json!({"command": "x"}))),
64. 64 None,
65. 65 &CancellationToken::new(),
66. 66 )
67. 67 .await;
68. 68 assert!(out.blocked);
69. 69 assert_eq!(out.reason.as_deref(), Some("policy-violation"));
70. 70}
71. 71
72. 72#[tokio::test]
73. 73async fn handler_receives_event_json_on_stdin() {
74. 74 let dir = tempdir().unwrap();
75. 75 let capture = dir.path().join("captured.json");
76. 76 let cmd = format!("cat > {}", capture.display());
77. 77 let out = run_hooks(
78. 78 hook(&cmd),
79. 79 HookEvent::PreToolUse,
80. 80 "sess-1",
81. 81 dir.path(),
82. 82 Some(("edit", &json!({"path": "a.txt"}))),
83. 83 None,
84. 84 &CancellationToken::new(),
85. 85 )
86. 86 .await;
87. 87 assert!(!out.blocked);
88. 88 let captured: serde_json::Value =
89. 89 serde_json::from_str(&std::fs::read_to_string(&capture).unwrap()).unwrap();
90. 90 assert_eq!(captured["event"], "pre_tool_use");
91. 91 assert_eq!(captured["session_id"], "sess-1");
92. 92 assert_eq!(captured["tool"]["name"], "edit");
93. 93 assert_eq!(captured["tool"]["input"]["path"], "a.txt");
94. 94}
95. 95
96. 96#[tokio::test]
97. 97async fn matcher_filters_by_tool_and_args() {
98. 98 let dir = tempdir().unwrap();
99. 99 let hooks = Arc::new(vec![HookDef {
100. 100 event: HookEvent::PreToolUse,
101. 101 matcher: Some(vak_permission::Rule::parse("Bash(git push *)").unwrap()),
102. 102 command: r#"echo '{"decision":"block","reason":"push blocked"}'"#.to_string(),
103. 103 timeout_ms: 5000,
104. 104 failure_mode: vak_hooks::HookFailureMode::Open,
105. 105 refusal: None,
106. 106 }]);
107. 107
108. 108 let hit = run_hooks(
109. 109 hooks.clone(),
110. 110 HookEvent::PreToolUse,
111. 111 "s",
112. 112 dir.path(),
113. 113 Some(("bash", &json!({"command": "git push origin main"}))),
114. 114 None,
115. 115 &CancellationToken::new(),
116. 116 )
117. 117 .await;
118. 118 assert!(hit.blocked);
119. 119
120. 120 let miss = run_hooks(
121. 121 hooks,
122. 122 HookEvent::PreToolUse,
123. 123 "s",
124. 124 dir.path(),
125. 125 Some(("bash", &json!({"command": "git status"}))),
126. 126 None,
127. 127 &CancellationToken::new(),
128. 128 )
129. 129 .await;
130. 130 assert!(!miss.blocked);
131. 131}
132. 132
133. 133#[tokio::test]
134. 134async fn timeout_kills_hook_and_reports() {
135. 135 let dir = tempdir().unwrap();
136. 136 let hooks = Arc::new(vec![HookDef {
137. 137 event: HookEvent::PreToolUse,
138. 138 matcher: None,
139. 139 command: "sleep 30".to_string(),
140. 140 timeout_ms: 800,
141. 141 failure_mode: vak_hooks::HookFailureMode::Open,
142. 142 refusal: None,
143. 143 }]);
144. 144 let start = std::time::Instant::now();
145. 145 let out = run_hooks(
146. 146 hooks,
147. 147 HookEvent::PreToolUse,
148. 148 "s",
149. 149 dir.path(),
150. 150 Some(("bash", &json!({}))),
151. 151 None,
152. 152 &CancellationToken::new(),
153. 153 )
154. 154 .await;
155. 155 assert!(!out.blocked);
156. 156 assert!(start.elapsed() < std::time::Duration::from_secs(10));
157. 157}
158. 158
159. 159#[tokio::test]
160. 160async fn closed_failure_mode_blocks_on_timeout_and_nonzero_exit() {
161. 161 let dir = tempdir().unwrap();
162. 162 let timeout = Arc::new(vec![HookDef {
163. 163 event: HookEvent::PreToolUse,
164. 164 matcher: None,
165. 165 command: "sleep 30".to_string(),
166. 166 timeout_ms: 50,
167. 167 failure_mode: vak_hooks::HookFailureMode::Closed,
168. 168 refusal: None,
169. 169 }]);
170. 170 let timed_out = run_hooks(
171. 171 timeout,
172. 172 HookEvent::PreToolUse,
173. 173 "s",
174. 174 dir.path(),
175. 175 Some(("bash", &json!({}))),
176. 176 None,
177. 177 &CancellationToken::new(),
178. 178 )
179. 179 .await;
180. 180 assert!(timed_out.blocked);
181. 181
182. 182 let nonzero = Arc::new(vec![HookDef {
183. 183 event: HookEvent::PreToolUse,
184. 184 matcher: None,
185. 185 command: "exit 1".to_string(),
186. 186 timeout_ms: 5000,
187. 187 failure_mode: vak_hooks::HookFailureMode::Closed,
188. 188 refusal: None,
189. 189 }]);
190. 190 let failed = run_hooks(
191. 191 nonzero,
192. 192 HookEvent::PreToolUse,
193. 193 "s",
194. 194 dir.path(),
195. 195 Some(("bash", &json!({}))),
196. 196 None,
197. 197 &CancellationToken::new(),
198. 198 )
199. 199 .await;
200. 200 assert!(failed.blocked);
201. 201}
202. 202
203. 203#[tokio::test]
204. 204async fn non_matching_event_skips_handler() {
205. 205 let dir = tempdir().unwrap();
206. 206 let out = run_hooks(
207. 207 hook(r#"echo '{"decision":"block"}'"#),
208. 208 HookEvent::Stop,
209. 209 "s",
210. 210 dir.path(),
211. 211 None,
212. 212 None,
213. 213 &CancellationToken::new(),
214. 214 )
215. 215 .await;
216. 216 assert!(
217. 217 !out.blocked,
218. 218 "hook defined for PreToolUse must not fire on Stop"
219. 219 );
220. 220}
221. 221