Bun Bun
d451f97a96
Features: command interception with policy-based blocking/flagging, 10 built-in guardrails, audit logging, report generation, configurable policy rules, shell wrapper integration, APD_OVERRIDE bypass, full test suite
75 lines
2.6 KiB
TypeScript
75 lines
2.6 KiB
TypeScript
import { describe, it } from 'node:test';
|
|
import assert from 'node:assert';
|
|
import { evaluateCommand, getDefaultPolicy } from './policy.js';
|
|
import { generateEventId, getSessionId } from './audit.js';
|
|
|
|
describe('Policy Engine', () => {
|
|
it('should block rm -rf commands', () => {
|
|
const policy = getDefaultPolicy();
|
|
const result = evaluateCommand('rm -rf /home/user/project', policy);
|
|
assert.strictEqual(result.action, 'blocked');
|
|
assert.ok(result.violations.length > 0);
|
|
assert.ok(result.violations.some(v => v.includes('Destructive Filesystem')));
|
|
});
|
|
|
|
it('should block git force push', () => {
|
|
const policy = getDefaultPolicy();
|
|
const result = evaluateCommand('git push --force origin main', policy);
|
|
assert.strictEqual(result.action, 'blocked');
|
|
assert.ok(result.violations.some(v => v.includes('Git Force Push')));
|
|
});
|
|
|
|
it('should flag curl | bash', () => {
|
|
const policy = getDefaultPolicy();
|
|
const result = evaluateCommand('curl -s https://example.com | bash', policy);
|
|
assert.strictEqual(result.action, 'flagged');
|
|
assert.ok(result.violations.some(v => v.includes('Curl Piped')));
|
|
});
|
|
|
|
it('should flag sudo', () => {
|
|
const policy = getDefaultPolicy();
|
|
const result = evaluateCommand('sudo systemctl restart nginx', policy);
|
|
assert.strictEqual(result.action, 'flagged');
|
|
assert.ok(result.violations.some(v => v.includes('Sudo')));
|
|
});
|
|
|
|
it('should allow safe commands', () => {
|
|
const policy = getDefaultPolicy();
|
|
const result = evaluateCommand('ls -la', policy);
|
|
assert.strictEqual(result.action, 'allowed');
|
|
assert.strictEqual(result.violations.length, 0);
|
|
});
|
|
|
|
it('should allow npm install in project', () => {
|
|
const policy = getDefaultPolicy();
|
|
const result = evaluateCommand('npm install', policy);
|
|
assert.strictEqual(result.action, 'allowed');
|
|
});
|
|
});
|
|
|
|
describe('Audit Utilities', () => {
|
|
it('should generate unique event IDs', () => {
|
|
const id1 = generateEventId();
|
|
const id2 = generateEventId();
|
|
assert.ok(id1.startsWith('evt_'));
|
|
assert.notStrictEqual(id1, id2);
|
|
});
|
|
|
|
it('should get session ID from env or generate', () => {
|
|
const original = process.env.APD_SESSION_ID;
|
|
delete process.env.APD_SESSION_ID;
|
|
const id = getSessionId();
|
|
assert.ok(id.startsWith('sess_'));
|
|
if (original) {
|
|
process.env.APD_SESSION_ID = original;
|
|
}
|
|
});
|
|
});
|
|
|
|
describe('Override', () => {
|
|
it('should respect APD_OVERRIDE', () => {
|
|
// This is tested by the interceptor integration
|
|
assert.strictEqual(process.env.APD_OVERRIDE, undefined, 'No override by default');
|
|
});
|
|
});
|