test(permissions): pin update_plan purge migration for approval stores

Author: TheGreatAxios

src/permission/approval-store-migration.test.ts

@@ -0,0 +1,194 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { generateSessionId, sessionDir } from "../session/index.js";
+import { loadSeededApprovals } from "../session/runtime-assembly.js";
+import { normalizeSeededApprovals } from "./authz-grants.js";
+import { migratePersistedApprovalStores } from "./approval-store-migration.js";
+
+let cwd = "";
+let home = "";
+let sessionId = "";
+
+const sessionStorePath = (): string =>
+  join(sessionDir(cwd, sessionId, home), "permissions.json");
+const projectStorePath = (): string => join(cwd, ".corbits", "permissions.json");
+const globalStorePath = (): string => join(home, ".corbits", "permissions.json");
+const backupPath = (path: string): string => `${path}.bak`;
+
+async function readJson(path: string): Promise<unknown> {
+  return JSON.parse(await readFile(path, "utf-8")) as unknown;
+}
+
+beforeEach(async () => {
+  cwd = await mkdtemp(join(tmpdir(), "approval-migration-"));
+  home = await mkdtemp(join(tmpdir(), "approval-migration-home-"));
+  sessionId = generateSessionId();
+  await mkdir(sessionDir(cwd, sessionId, home), { recursive: true });
+});
+
+afterEach(async () => {
+  await rm(cwd, { recursive: true, force: true });
+  await rm(home, { recursive: true, force: true });
+});
+
+describe("migratePersistedApprovalStores", () => {
+  test("purges update_plan keys from every store, backs up, and re-runs as a no-op", async () => {
+    const sessionOriginal = {
+      approvals: [
+        { tool: "update_plan", pattern: "plan *" },
+        { tool: "run_shell", pattern: "npm *" },
+        { tool: "bash", pattern: "git *" },
+      ],
+    };
+    const projectOriginal = {
+      approvals: [
+        { tool: "update_plan", pattern: "plan *" },
+        { tool: "manage_tasks", pattern: "tasks *" },
+      ],
+    };
+    const globalOriginal = {
+      approvals: [
+        { tool: "update_plan", pattern: "plan *" },
+        { tool: "run_shell", pattern: "git *" },
+      ],
+      providerModels: {
+        "openai:gpt-5": [
+          { tool: "update_plan", pattern: "plan *" },
+          { tool: "run_shell", pattern: "npm *" },
+        ],
+        "anthropic:opus": [{ tool: "run_shell", pattern: "ls *" }],
+      },
+    };
+    await writeFile(sessionStorePath(), JSON.stringify(sessionOriginal));
+    await mkdir(join(cwd, ".corbits"), { recursive: true });
+    await writeFile(projectStorePath(), JSON.stringify(projectOriginal));
+    await mkdir(join(home, ".corbits"), { recursive: true });
+    await writeFile(globalStorePath(), JSON.stringify(globalOriginal));
+
+    const first = await migratePersistedApprovalStores(cwd, sessionId, home);
+
+    expect(first.purged).toBe(4);
+    expect(first.backups).toHaveLength(3);
+
+    expect(await readJson(sessionStorePath())).toEqual({
+      approvals: [
+        { tool: "run_shell", pattern: "npm *" },
+        { tool: "bash", pattern: "git *" },
+      ],
+    });
+    expect(await readJson(projectStorePath())).toEqual({
+      approvals: [{ tool: "manage_tasks", pattern: "tasks *" }],
+    });
+    expect(await readJson(globalStorePath())).toEqual({
+      approvals: [{ tool: "run_shell", pattern: "git *" }],
+      providerModels: {
+        "openai:gpt-5": [{ tool: "run_shell", pattern: "npm *" }],
+        "anthropic:opus": [{ tool: "run_shell", pattern: "ls *" }],
+      },
+    });
+
+    for (const [path, original] of [
+      [sessionStorePath(), sessionOriginal],
+      [projectStorePath(), projectOriginal],
+      [globalStorePath(), globalOriginal],
+    ] as const) {
+      expect(await readJson(backupPath(path))).toEqual(original);
+    }
+
+    const sessionAfterFirst = await readFile(sessionStorePath(), "utf-8");
+    const second = await migratePersistedApprovalStores(cwd, sessionId, home);
+    expect(second.purged).toBe(0);
+    expect(second.backups).toEqual([]);
+    expect(await readFile(sessionStorePath(), "utf-8")).toBe(sessionAfterFirst);
+  });
+
+  test("leaves clean stores untouched with no backup written", async () => {
+    const sessionOriginal = {
+      approvals: [{ tool: "run_shell", pattern: "npm *" }],
+    };
+    await writeFile(sessionStorePath(), JSON.stringify(sessionOriginal));
+
+    const result = await migratePersistedApprovalStores(cwd, sessionId, home);
+
+    expect(result.purged).toBe(0);
+    expect(result.backups).toEqual([]);
+    expect(await readJson(sessionStorePath())).toEqual(sessionOriginal);
+    await expect(
+      readFile(backupPath(sessionStorePath()), "utf-8"),
+    ).rejects.toThrow();
+  });
+
+  test("treats missing and corrupt stores as no-ops", async () => {
+    await mkdir(join(cwd, ".corbits"), { recursive: true });
+    await writeFile(projectStorePath(), "not json{{{");
+
+    const result = await migratePersistedApprovalStores(cwd, sessionId, home);
+
+    expect(result.purged).toBe(0);
+    expect(result.backups).toEqual([]);
+    expect(await readFile(projectStorePath(), "utf-8")).toBe("not json{{{");
+  });
+
+  test("purges exactly the keys the load-time normalizer drops", async () => {
+    const tools = [
+      "update_plan",
+      "Update_Plan",
+      "default.update_plan",
+      "manage_tasks",
+      "run_shell",
+    ];
+    await writeFile(
+      sessionStorePath(),
+      JSON.stringify({
+        approvals: tools.map((tool) => ({ tool, pattern: "x *" })),
+      }),
+    );
+
+    const result = await migratePersistedApprovalStores(cwd, sessionId, home);
+
+    const seeded = tools.map((tool) => ({ tool, pattern: "x *" }));
+    const droppedByNormalizer = seeded.filter(
+      (approval) =>
+        !normalizeSeededApprovals([approval]).some(
+          (kept: { tool: string }) => kept.tool === approval.tool,
+        ),
+    );
+    expect(result.purged).toBe(droppedByNormalizer.length);
+    expect(result.purged).toBe(3);
+    const remaining = (
+      (await readJson(sessionStorePath())) as {
+        approvals: { tool: string }[];
+      }
+    ).approvals.map((approval) => approval.tool);
+    expect(remaining).toEqual(["manage_tasks", "run_shell"]);
+  });
+
+  test("seed loading purges on-disk update_plan keys while the normalizer still drops them in memory", async () => {
+    await writeFile(
+      sessionStorePath(),
+      JSON.stringify({
+        approvals: [
+          { tool: "update_plan", pattern: "plan *" },
+          { tool: "run_shell", pattern: "npm *" },
+        ],
+      }),
+    );
+    await mkdir(join(cwd, ".corbits"), { recursive: true });
+    await writeFile(
+      projectStorePath(),
+      JSON.stringify({
+        approvals: [{ tool: "update_plan", pattern: "plan *" }],
+      }),
+    );
+
+    const seeded = await loadSeededApprovals(cwd, sessionId, home);
+
+    expect(seeded).toEqual([{ tool: "run_shell", pattern: "npm *" }]);
+    expect(await readJson(sessionStorePath())).toEqual({
+      approvals: [{ tool: "run_shell", pattern: "npm *" }],
+    });
+    expect(await readJson(projectStorePath())).toEqual({ approvals: [] });
+  });
+});