1. 1#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
2. 2
3. 3use serde_json::json;
4. 4use vak_permission::engine::Decision;
5. 5use vak_permission::{Mode, PermissionEngine, Rule};
6. 6
7. 7fn bash(cmd: &str) -> serde_json::Value {
8. 8 json!({"command": cmd})
9. 9}
10. 10
11. 11#[test]
12. 12fn rule_parsing_forms() {
13. 13 let r = Rule::parse("Bash(git *)").unwrap();
14. 14 assert_eq!(r.tool, "Bash");
15. 15 assert_eq!(r.decision, vak_permission::RuleDecision::Allow);
16. 16 assert!(r.arg_glob.is_some());
17. 17
18. 18 let r = Rule::parse("-Bash(rm *)").unwrap();
19. 19 assert_eq!(r.decision, vak_permission::RuleDecision::Deny);
20. 20
21. 21 let r = Rule::parse("?Edit(src/**)").unwrap();
22. 22 assert_eq!(r.decision, vak_permission::RuleDecision::Ask);
23. 23
24. 24 let r = Rule::parse("read").unwrap();
25. 25 assert_eq!(r.tool, "read");
26. 26 assert!(r.arg_glob.is_none());
27. 27
28. 28 assert!(Rule::parse("Bash(git").is_err());
29. 29 assert!(Rule::parse("(x)").is_err());
30. 30 assert!(Rule::parse("Bad Tool(x)").is_err());
31. 31}
32. 32
33. 33#[test]
34. 34fn allow_rule_beats_mode_default() {
35. 35 let eng = PermissionEngine::from_rule_strings(&["Bash(git *)".to_string()]).unwrap();
36. 36 let d = eng.evaluate(
37. 37 "bash",
38. 38 &bash("git push"),
39. 39 Mode::WorkspaceWrite,
40. 40 std::path::Path::new("/tmp"),
41. 41 );
42. 42 assert_eq!(d, Decision::Allow);
43. 43}
44. 44
45. 45#[test]
46. 46fn deny_rule_wins_over_allow_mode() {
47. 47 let eng =
48. 48 PermissionEngine::from_rule_strings(&["-Bash(rm *)".to_string(), "Bash(*)".to_string()])
49. 49 .unwrap();
50. 50 let d = eng.evaluate(
51. 51 "bash",
52. 52 &bash("rm -rf /tmp/x"),
53. 53 Mode::FullAccess,
54. 54 std::path::Path::new("/tmp"),
55. 55 );
56. 56 assert!(matches!(d, Decision::Deny { .. }));
57. 57
58. 58 let d = eng.evaluate(
59. 59 "bash",
60. 60 &bash("ls -la"),
61. 61 Mode::FullAccess,
62. 62 std::path::Path::new("/tmp"),
63. 63 );
64. 64 assert_eq!(d, Decision::Allow);
65. 65}
66. 66
67. 67#[test]
68. 68fn bash_subcommand_matching() {
69. 69 let eng = PermissionEngine::from_rule_strings(&["Bash(git push *)".to_string()]).unwrap();
70. 70 let d = eng.evaluate(
71. 71 "bash",
72. 72 &bash("npm test && git push origin main"),
73. 73 Mode::WorkspaceWrite,
74. 74 std::path::Path::new("/tmp"),
75. 75 );
76. 76 assert!(
77. 77 matches!(d, Decision::Ask { .. }),
78. 78 "`npm test` is not covered by `Bash(git push *)`; one covered segment \
79. 79 must not authorize its neighbours"
80. 80 );
81. 81
82. 82 let d = eng.evaluate(
83. 83 "bash",
84. 84 &bash("git push origin main && git push --tags"),
85. 85 Mode::WorkspaceWrite,
86. 86 std::path::Path::new("/tmp"),
87. 87 );
88. 88 assert_eq!(d, Decision::Allow, "every segment is covered");
89. 89
90. 90 let d = eng.evaluate(
91. 91 "bash",
92. 92 &bash("FOO=bar git push origin main"),
93. 93 Mode::WorkspaceWrite,
94. 94 std::path::Path::new("/tmp"),
95. 95 );
96. 96 assert_eq!(d, Decision::Allow, "leading env assignments are stripped");
97. 97}
98. 98
99. 99#[test]
100. 100fn read_only_mode_allows_reads_denies_writes() {
101. 101 let eng = PermissionEngine::default();
102. 102 let d = eng.evaluate(
103. 103 "read",
104. 104 &json!({"path": "a.txt"}),
105. 105 Mode::ReadOnly,
106. 106 std::path::Path::new("/tmp"),
107. 107 );
108. 108 assert_eq!(d, Decision::Allow);
109. 109 let d = eng.evaluate(
110. 110 "glob",
111. 111 &json!({"pattern": "**"}),
112. 112 Mode::ReadOnly,
113. 113 std::path::Path::new("/tmp"),
114. 114 );
115. 115 assert_eq!(d, Decision::Allow);
116. 116 let d = eng.evaluate(
117. 117 "write",
118. 118 &json!({"path": "a.txt"}),
119. 119 Mode::ReadOnly,
120. 120 std::path::Path::new("/tmp"),
121. 121 );
122. 122 assert!(matches!(d, Decision::Deny { .. }));
123. 123 let d = eng.evaluate(
124. 124 "bash",
125. 125 &bash("echo hi"),
126. 126 Mode::ReadOnly,
127. 127 std::path::Path::new("/tmp"),
128. 128 );
129. 129 assert!(matches!(d, Decision::Deny { .. }));
130. 130}
131. 131
132. 132#[test]
133. 133fn restricted_modes_deny_reads_outside_workspace() {
134. 134 let cwd = std::env::temp_dir().join("vak-perm-read-scope");
135. 135 std::fs::create_dir_all(&cwd).unwrap();
136. 136 let outside = cwd.parent().unwrap().join("vak-perm-secret.txt");
137. 137 std::fs::write(&outside, "secret").unwrap();
138. 138 let eng = PermissionEngine::default();
139. 139
140. 140 for mode in [Mode::ReadOnly, Mode::WorkspaceWrite] {
141. 141 for tool in ["read", "glob", "grep"] {
142. 142 let d = eng.evaluate(tool, &json!({"path": outside}), mode, &cwd);
143. 143 assert!(
144. 144 matches!(d, Decision::Deny { .. }),
145. 145 "{tool} escaped in {mode:?}"
146. 146 );
147. 147 }
148. 148 }
149. 149
150. 150 let d = eng.evaluate("read", &json!({"path": outside}), Mode::FullAccess, &cwd);
151. 151 assert_eq!(d, Decision::Allow);
152. 152
153. 153 let _ = std::fs::remove_dir_all(&cwd);
154. 154 let _ = std::fs::remove_file(&outside);
155. 155}
156. 156
157. 157#[test]
158. 158fn restricted_read_scope_resolves_symlinks() {
159. 159 #[cfg(unix)]
160. 160 {
161. 161 let cwd = std::env::temp_dir().join("vak-perm-read-symlink");
162. 162 let outside = std::env::temp_dir().join("vak-perm-read-symlink-secret.txt");
163. 163 // Fixed paths: a previously failed run leaves both behind, and
164. 164 // `symlink` on an existing name is an error, so start from clean.
165. 165 let _ = std::fs::remove_dir_all(&cwd);
166. 166 let _ = std::fs::remove_file(&outside);
167. 167 std::fs::create_dir_all(&cwd).unwrap();
168. 168 std::fs::write(&outside, "secret").unwrap();
169. 169 std::os::unix::fs::symlink(&outside, cwd.join("looks-safe")).unwrap();
170. 170
171. 171 let d = PermissionEngine::default().evaluate(
172. 172 "read",
173. 173 &json!({"path": "looks-safe"}),
174. 174 Mode::WorkspaceWrite,
175. 175 &cwd,
176. 176 );
177. 177 assert!(matches!(d, Decision::Deny { .. }));
178. 178
179. 179 let _ = std::fs::remove_dir_all(&cwd);
180. 180 let _ = std::fs::remove_file(&outside);
181. 181 }
182. 182}
183. 183
184. 184#[test]
185. 185fn workspace_write_scopes_file_tools() {
186. 186 let cwd = std::env::temp_dir().join("vak-perm-test");
187. 187 std::fs::create_dir_all(&cwd).unwrap();
188. 188 let eng = PermissionEngine::default();
189. 189
190. 190 let inside = cwd.join("sub/inner.txt");
191. 191 std::fs::create_dir_all(inside.parent().unwrap()).unwrap();
192. 192 std::fs::write(&inside, "x").unwrap();
193. 193 let d = eng.evaluate(
194. 194 "write",
195. 195 &json!({"path": inside}),
196. 196 Mode::WorkspaceWrite,
197. 197 &cwd,
198. 198 );
199. 199 assert_eq!(d, Decision::Allow, "absolute path inside workspace allowed");
200. 200
201. 201 let outside = std::env::temp_dir().join("vak-perm-outside.txt");
202. 202 std::fs::write(&outside, "x").unwrap();
203. 203 let d = eng.evaluate(
204. 204 "edit",
205. 205 &json!({"path": outside}),
206. 206 Mode::WorkspaceWrite,
207. 207 &cwd,
208. 208 );
209. 209 assert!(matches!(d, Decision::Ask { .. }), "outside workspace asks");
210. 210
211. 211 let d = eng.evaluate(
212. 212 "write",
213. 213 &json!({"path": "relative/new.txt"}),
214. 214 Mode::WorkspaceWrite,
215. 215 &cwd,
216. 216 );
217. 217 assert_eq!(
218. 218 d,
219. 219 Decision::Allow,
220. 220 "relative paths resolve into the workspace"
221. 221 );
222. 222
223. 223 let _ = std::fs::remove_dir_all(&cwd);
224. 224 let _ = std::fs::remove_file(&outside);
225. 225}
226. 226
227. 227#[test]
228. 228fn bash_asks_in_workspace_write_by_default() {
229. 229 let eng = PermissionEngine::default();
230. 230 let d = eng.evaluate(
231. 231 "bash",
232. 232 &bash("cargo test"),
233. 233 Mode::WorkspaceWrite,
234. 234 std::path::Path::new("/tmp"),
235. 235 );
236. 236 match d {
237. 237 Decision::Ask { reason, .. } => assert!(reason.contains("cargo test")),
238. 238 other => panic!("expected ask, got {other:?}"),
239. 239 }
240. 240}
241. 241
242. 242#[test]
243. 243fn first_matching_rule_wins_in_order() {
244. 244 let eng = PermissionEngine::from_rule_strings(&[
245. 245 "?Bash(npm *)".to_string(),
246. 246 "Bash(npm *)".to_string(),
247. 247 ])
248. 248 .unwrap();
249. 249 let d = eng.evaluate(
250. 250 "bash",
251. 251 &bash("npm run build"),
252. 252 Mode::FullAccess,
253. 253 std::path::Path::new("/tmp"),
254. 254 );
255. 255 assert!(
256. 256 matches!(d, Decision::Ask { .. }),
257. 257 "earlier ? rule wins over later allow"
258. 258 );
259. 259}
260. 260
261. 261#[test]
262. 262fn deny_beats_allow_regardless_of_registration_order() {
263. 263 // Deny registered AFTER the allow: severity aggregation must still
264. 264 // pick Deny. Under first-match-wins this silently allowed.
265. 265 let eng = PermissionEngine::from_rule_strings(&[
266. 266 "Bash(git *)".to_string(),
267. 267 "-Bash(git push *)".to_string(),
268. 268 ])
269. 269 .unwrap();
270. 270 let d = eng.evaluate(
271. 271 "bash",
272. 272 &bash("git push origin main"),
273. 273 Mode::WorkspaceWrite,
274. 274 std::path::Path::new("/tmp"),
275. 275 );
276. 276 assert!(matches!(d, Decision::Deny { .. }));
277. 277
278. 278 let d = eng.evaluate(
279. 279 "bash",
280. 280 &bash("git status"),
281. 281 Mode::WorkspaceWrite,
282. 282 std::path::Path::new("/tmp"),
283. 283 );
284. 284 assert_eq!(d, Decision::Allow);
285. 285}
286. 286
287. 287#[test]
288. 288fn substitution_and_newline_commands_are_opaque_to_allow_patterns() {
289. 289 let eng = PermissionEngine::from_rule_strings(&[
290. 290 "Bash(git *)".to_string(),
291. 291 "-Bash(rm *)".to_string(),
292. 292 ])
293. 293 .unwrap();
294. 294
295. 295 for cmd in [
296. 296 "git status\nrm -rf ~",
297. 297 "git log --format=$(rm -rf ~)",
298. 298 "git log `rm -rf ~`",
299. 299 ] {
300. 300 let d = eng.evaluate(
301. 301 "bash",
302. 302 &bash(cmd),
303. 303 Mode::WorkspaceWrite,
304. 304 std::path::Path::new("/tmp"),
305. 305 );
306. 306 assert!(
307. 307 !matches!(d, Decision::Allow),
308. 308 "'{cmd}' must not match a patterned allow rule"
309. 309 );
310. 310 }
311. 311}
312. 312
313. 313#[test]
314. 314fn blanket_rules_still_cover_opaque_commands() {
315. 315 let eng = PermissionEngine::from_rule_strings(&["Bash(*)".to_string()]).unwrap();
316. 316 let d = eng.evaluate(
317. 317 "bash",
318. 318 &bash("git status\necho hi"),
319. 319 Mode::WorkspaceWrite,
320. 320 std::path::Path::new("/tmp"),
321. 321 );
322. 322 assert_eq!(d, Decision::Allow);
323. 323}
324. 324
325. 325#[test]
326. 326fn mcp_calls_match_server_tool_candidates() {
327. 327 let eng = PermissionEngine::from_rule_strings(&[
328. 328 "-Mcp(evil-server/*)".to_string(),
329. 329 "Mcp(docs/*)".to_string(),
330. 330 ])
331. 331 .unwrap();
332. 332 let args = json!({"action": "call", "server": "docs", "tool": "search", "arguments": {}});
333. 333 let d = eng.evaluate(
334. 334 "mcp",
335. 335 &args,
336. 336 Mode::WorkspaceWrite,
337. 337 std::path::Path::new("/tmp"),
338. 338 );
339. 339 assert_eq!(d, Decision::Allow);
340. 340
341. 341 let args = json!({"action": "call", "server": "evil-server", "tool": "wipe"});
342. 342 let d = eng.evaluate(
343. 343 "mcp",
344. 344 &args,
345. 345 Mode::WorkspaceWrite,
346. 346 std::path::Path::new("/tmp"),
347. 347 );
348. 348 assert!(matches!(d, Decision::Deny { .. }));
349. 349}
350. 350
351. 351#[test]
352. 352fn declared_write_scope_denies_other_direct_file_mutations_before_rules() {
353. 353 let cwd = std::env::temp_dir().join("vak-permission-write-scope-test");
354. 354 let engine = PermissionEngine::default()
355. 355 .restrict_write_paths(&cwd, &[std::path::PathBuf::from("app.py")]);
356. 356
357. 357 let allowed = engine.evaluate(
358. 358 "write",
359. 359 &json!({"path": "app.py", "content": "ok"}),
360. 360 Mode::FullAccess,
361. 361 &cwd,
362. 362 );
363. 363 assert_eq!(allowed, Decision::Allow);
364. 364
365. 365 let denied = engine.evaluate(
366. 366 "edit",
367. 367 &json!({"path": "test_app.py", "old_text": "x", "new_text": "y"}),
368. 368 Mode::FullAccess,
369. 369 &cwd,
370. 370 );
371. 371 assert!(matches!(denied, Decision::Deny { .. }));
372. 372}
373. 373
374. 374#[test]
375. 375fn task_tool_scope_beats_full_access_and_explicit_allow() {
376. 376 let engine = PermissionEngine::from_rule_strings(&["+remember".into(), "+write".into()])
377. 377 .unwrap()
378. 378 .restrict_tools(&["read", "write", "edit"]);
379. 379 let cwd = std::env::temp_dir();
380. 380 assert!(matches!(
381. 381 engine.evaluate(
382. 382 "remember",
383. 383 &json!({"text": "secret"}),
384. 384 Mode::FullAccess,
385. 385 &cwd
386. 386 ),
387. 387 Decision::Deny { .. }
388. 388 ));
389. 389 assert_eq!(
390. 390 engine.evaluate(
391. 391 "write",
392. 392 &json!({"path": "draft.txt"}),
393. 393 Mode::FullAccess,
394. 394 &cwd
395. 395 ),
396. 396 Decision::Allow
397. 397 );
398. 398}
399. 399