paseo/packages/cli/tests/13-permit-allow-deny.test.ts

#!/usr/bin/env npx tsx

/**
 * Permit Allow/Deny Command Tests
 *
 * Tests the permit allow and deny commands.
 * Since daemon may not be running, we test:
 * - Help and argument parsing
 * - Graceful error handling when daemon not running
 * - Flag acceptance
 *
 * Tests:
 * - permit allow --help shows options
 * - permit deny --help shows options
 * - permit allow handles daemon not running
 * - permit deny handles daemon not running
 * - permit allow --all flag is accepted
 * - permit deny --all flag is accepted
 * - permit deny --message flag is accepted
 * - permit deny --interrupt flag is accepted
 * - permit allow --input flag is accepted
 */

import assert from "node:assert";
import { $ } from "zx";
import { mkdtemp, rm } from "fs/promises";
import { tmpdir } from "os";
import { join } from "path";

$.verbose = false;

console.log("=== Permit Allow/Deny Command Tests ===\n");

// Get random port that's definitely not in use (never 6767)
const port = 10000 + Math.floor(Math.random() * 50000);
const paseoHome = await mkdtemp(join(tmpdir(), "paseo-test-home-"));

try {
  // Test 1: permit allow --help shows options
  {
    console.log("Test 1: permit allow --help shows options");
    const result = await $`npx paseo permit allow --help`.nothrow();
    assert.strictEqual(result.exitCode, 0, "permit allow --help should exit 0");
    assert(result.stdout.includes("--all"), "help should mention --all flag");
    assert(result.stdout.includes("--input"), "help should mention --input option");
    assert(result.stdout.includes("--host"), "help should mention --host option");
    assert(result.stdout.includes("<agent>"), "help should mention agent argument");
    console.log("✓ permit allow --help shows options\n");
  }

  // Test 2: permit deny --help shows options
  {
    console.log("Test 2: permit deny --help shows options");
    const result = await $`npx paseo permit deny --help`.nothrow();
    assert.strictEqual(result.exitCode, 0, "permit deny --help should exit 0");
    assert(result.stdout.includes("--all"), "help should mention --all flag");
    assert(result.stdout.includes("--message"), "help should mention --message option");
    assert(result.stdout.includes("--interrupt"), "help should mention --interrupt flag");
    assert(result.stdout.includes("--host"), "help should mention --host option");
    assert(result.stdout.includes("<agent>"), "help should mention agent argument");
    console.log("✓ permit deny --help shows options\n");
  }

  // Test 3: permit allow handles daemon not running
  {
    console.log("Test 3: permit allow handles daemon not running");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit allow abc123 req456`.nothrow();
    // Should fail because daemon not running
    assert.notStrictEqual(result.exitCode, 0, "should fail when daemon not running");
    const output = result.stdout + result.stderr;
    const hasError =
      output.toLowerCase().includes("daemon") ||
      output.toLowerCase().includes("connect") ||
      output.toLowerCase().includes("cannot");
    assert(hasError, "error message should mention connection issue");
    console.log("✓ permit allow handles daemon not running\n");
  }

  // Test 4: permit deny handles daemon not running
  {
    console.log("Test 4: permit deny handles daemon not running");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit deny abc123 req456`.nothrow();
    // Should fail because daemon not running
    assert.notStrictEqual(result.exitCode, 0, "should fail when daemon not running");
    const output = result.stdout + result.stderr;
    const hasError =
      output.toLowerCase().includes("daemon") ||
      output.toLowerCase().includes("connect") ||
      output.toLowerCase().includes("cannot");
    assert(hasError, "error message should mention connection issue");
    console.log("✓ permit deny handles daemon not running\n");
  }

  // Test 5: permit allow --all flag is accepted
  {
    console.log("Test 5: permit allow --all flag is accepted");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit allow abc123 --all`.nothrow();
    const output = result.stdout + result.stderr;
    assert(!output.includes("unknown option"), "should accept --all flag");
    assert(!output.includes("error: option"), "should not have option parsing error");
    console.log("✓ permit allow --all flag is accepted\n");
  }

  // Test 6: permit deny --all flag is accepted
  {
    console.log("Test 6: permit deny --all flag is accepted");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit deny abc123 --all`.nothrow();
    const output = result.stdout + result.stderr;
    assert(!output.includes("unknown option"), "should accept --all flag");
    assert(!output.includes("error: option"), "should not have option parsing error");
    console.log("✓ permit deny --all flag is accepted\n");
  }

  // Test 7: permit deny --message flag is accepted
  {
    console.log("Test 7: permit deny --message flag is accepted");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit deny abc123 req456 --message "Not allowed"`.nothrow();
    const output = result.stdout + result.stderr;
    assert(!output.includes("unknown option"), "should accept --message flag");
    assert(!output.includes("error: option"), "should not have option parsing error");
    console.log("✓ permit deny --message flag is accepted\n");
  }

  // Test 8: permit deny --interrupt flag is accepted
  {
    console.log("Test 8: permit deny --interrupt flag is accepted");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit deny abc123 req456 --interrupt`.nothrow();
    const output = result.stdout + result.stderr;
    assert(!output.includes("unknown option"), "should accept --interrupt flag");
    assert(!output.includes("error: option"), "should not have option parsing error");
    console.log("✓ permit deny --interrupt flag is accepted\n");
  }

  // Test 9: permit allow --input flag is accepted
  {
    console.log("Test 9: permit allow --input flag is accepted");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit allow abc123 req456 --input '{"key":"value"}'`.nothrow();
    const output = result.stdout + result.stderr;
    assert(!output.includes("unknown option"), "should accept --input flag");
    assert(!output.includes("error: option"), "should not have option parsing error");
    console.log("✓ permit allow --input flag is accepted\n");
  }

  // Test 10: permit allow without req_id and without --all fails gracefully
  {
    console.log("Test 10: permit allow requires req_id or --all");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit allow abc123`.nothrow();
    // This might fail due to daemon not running first, or due to missing argument
    // The important thing is it doesn't crash with an unhandled error
    assert.notStrictEqual(result.exitCode, 0, "should fail without req_id or --all");
    console.log("✓ permit allow requires req_id or --all\n");
  }

  // Test 11: permit deny without req_id and without --all fails gracefully
  {
    console.log("Test 11: permit deny requires req_id or --all");
    const result =
      await $`PASEO_HOST=localhost:${port} PASEO_HOME=${paseoHome} npx paseo permit deny abc123`.nothrow();
    assert.notStrictEqual(result.exitCode, 0, "should fail without req_id or --all");
    console.log("✓ permit deny requires req_id or --all\n");
  }
} finally {
  // Clean up temp directory
  await rm(paseoHome, { recursive: true, force: true });
}

console.log("=== All permit allow/deny tests passed ===");