gstack/test/gbrain-repo-policy-client.test.ts

/**
 * lib/gbrain-repo-policy-client — batch trust-tier lookup (#2392).
 *
 * Covers the `get --batch` verb of bin/gstack-gbrain-repo-policy (bash level:
 * multiple urls in, per-line verdicts out, input order preserved) and the
 * TypeScript client `repoPolicyTierBatch` (ONE spawn, dedup, fast paths, and
 * the whole-batch `unreadable` classification on a corrupt store).
 *
 * Each test uses a temp GSTACK_HOME so nothing leaks into the user's real
 * ~/.gstack. The client is exercised against the REAL bash script — the
 * script owns URL normalization, so stub stores are seeded through its own
 * `set` verb.
 */

import { describe, test, expect, beforeEach, afterEach } from "bun:test";
import * as fs from "fs";
import * as path from "path";
import * as os from "os";
import { spawnSync } from "child_process";

import { repoPolicyTierBatch } from "../lib/gbrain-repo-policy-client";

const ROOT = path.resolve(import.meta.dir, "..");
const BIN = path.join(ROOT, "bin", "gstack-gbrain-repo-policy");

let tmpHome: string;

function env(): NodeJS.ProcessEnv {
  return { ...process.env, GSTACK_HOME: tmpHome };
}

function run(args: string[], input?: string) {
  const res = spawnSync(BIN, args, { env: env(), encoding: "utf-8", input });
  return {
    stdout: res.stdout || "",
    stderr: res.stderr || "",
    status: res.status ?? -1,
  };
}

function policyFile(): string {
  return path.join(tmpHome, "gbrain-repo-policy.json");
}

beforeEach(() => {
  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "gbrain-policy-client-"));
});

afterEach(() => {
  fs.rmSync(tmpHome, { recursive: true, force: true });
});

describe("bin/gstack-gbrain-repo-policy get --batch (bash level)", () => {
  test("multiple urls in, per-line verdicts out, input order preserved", () => {
    expect(run(["set", "https://github.com/foo/bar.git", "deny"]).status).toBe(0);
    expect(run(["set", "git@github.com:baz/qux.git", "read-only"]).status).toBe(0);
    expect(run(["set", "https://github.com/rw/repo", "read-write"]).status).toBe(0);

    const r = run(
      ["get", "--batch"],
      // Mixed URL forms — the script's normalize() collapses them to the
      // stored keys. `nope/never` has no entry → none.
      "git@github.com:foo/bar.git\nhttps://github.com/nope/never\nhttps://github.com/baz/qux\nhttps://github.com/rw/repo.git\n",
    );
    expect(r.status).toBe(0);
    expect(r.stdout).toBe("deny\nnone\nread-only\nread-write\n");
  });

  test("no store on disk: every line is none, and no file is created", () => {
    const r = run(["get", "--batch"], "https://github.com/a/a\nhttps://github.com/b/b\n");
    expect(r.status).toBe(0);
    expect(r.stdout).toBe("none\nnone\n");
    expect(fs.existsSync(policyFile())).toBe(false);
  });

  test("corrupt store: hard error (exit 2), NOT quarantined, names recovery", () => {
    fs.writeFileSync(policyFile(), "not valid json{", { mode: 0o600 });
    const r = run(["get", "--batch"], "https://github.com/foo/bar\n");
    expect(r.status).toBe(2);
    expect(r.stderr).toContain("corrupt");
    expect(r.stderr).toContain("gstack-gbrain-repo-policy list");
    // Unlike interactive `get`, batch must never quarantine-and-proceed —
    // that would bypass a set deny policy on an unattended ingest run.
    expect(fs.readFileSync(policyFile(), "utf-8")).toBe("not valid json{");
    expect(
      fs.readdirSync(tmpHome).find((f) => f.includes(".corrupt-")),
    ).toBeUndefined();
  });

  test("legacy allow entries migrate to read-write on batch read", () => {
    fs.writeFileSync(
      policyFile(),
      JSON.stringify({ "github.com/foo/bar": "allow" }),
      { mode: 0o600 },
    );
    const r = run(["get", "--batch"], "https://github.com/foo/bar\n");
    expect(r.status).toBe(0);
    expect(r.stdout).toBe("read-write\n");
  });
});

describe("repoPolicyTierBatch (TypeScript client)", () => {
  test("maps each input url to its verdict, dedup included", () => {
    expect(run(["set", "https://github.com/foo/bar", "deny"]).status).toBe(0);
    expect(run(["set", "https://github.com/baz/qux", "read-only"]).status).toBe(0);

    const verdicts = repoPolicyTierBatch(
      [
        "github.com/foo/bar", // canonical form, as memory-ingest passes it
        "github.com/baz/qux",
        "github.com/nope/never",
        "github.com/foo/bar", // duplicate — dedup keeps ONE map entry
      ],
      env(),
    );
    expect(verdicts.size).toBe(3);
    expect(verdicts.get("github.com/foo/bar")).toEqual({ tier: "deny" });
    expect(verdicts.get("github.com/baz/qux")).toEqual({ tier: "read-only" });
    expect(verdicts.get("github.com/nope/never")).toEqual({ tier: "none" });
  });

  test("no store on disk: every url is tier none with no error (fast path)", () => {
    const verdicts = repoPolicyTierBatch(["github.com/a/a", "github.com/b/b"], env());
    expect(verdicts.get("github.com/a/a")).toEqual({ tier: "none" });
    expect(verdicts.get("github.com/b/b")).toEqual({ tier: "none" });
    expect(fs.existsSync(policyFile())).toBe(false);
  });

  test("empty url list returns an empty map without spawning", () => {
    const verdicts = repoPolicyTierBatch([], env());
    expect(verdicts.size).toBe(0);
  });

  test("corrupt store: EVERY url maps to { tier: none, error: unreadable }", () => {
    fs.writeFileSync(policyFile(), "not valid json{", { mode: 0o600 });
    const verdicts = repoPolicyTierBatch(["github.com/foo/bar", "github.com/baz/qux"], env());
    expect(verdicts.get("github.com/foo/bar")).toEqual({ tier: "none", error: "unreadable" });
    expect(verdicts.get("github.com/baz/qux")).toEqual({ tier: "none", error: "unreadable" });
  });

  test("store unreadable on disk (chmod 000): whole batch classified unreadable", () => {
    if (process.platform === "win32" || process.getuid?.() === 0) return; // chmod semantics differ
    expect(run(["set", "https://github.com/foo/bar", "deny"]).status).toBe(0);
    fs.chmodSync(policyFile(), 0o000);
    try {
      const verdicts = repoPolicyTierBatch(["github.com/foo/bar"], env());
      expect(verdicts.get("github.com/foo/bar")).toEqual({ tier: "none", error: "unreadable" });
    } finally {
      fs.chmodSync(policyFile(), 0o600);
    }
  });
});