memind/health-publish-guard.test.mjs

import assert from 'node:assert/strict';
import test from 'node:test';
import {
  assertHealthPublicationAllowed,
  assertHealthShareDatasetPolicy,
} from './health-publish-guard.mjs';

test('non-health pages skip the gate', () => {
  const result = assertHealthPublicationAllowed({
    categoryCode: 'public',
    publishPolicy: 'security_scan_required',
    accessMode: 'public',
  });
  assert.equal(result.skipped, true);
});

test('health pages cannot publish as public', () => {
  assert.throws(
    () => assertHealthPublicationAllowed({
      categoryCode: 'health',
      publishPolicy: 'password_required',
      accessMode: 'public',
    }),
    (error) => error.code === 'health_public_forbidden',
  );
});

test('health password mode requires a password or existing hash', () => {
  assert.throws(
    () => assertHealthPublicationAllowed({
      categoryCode: 'health',
      publishPolicy: 'password_required',
      accessMode: 'password',
    }),
    (error) => error.code === 'health_password_required',
  );
  const ok = assertHealthPublicationAllowed({
    categoryCode: 'health',
    publishPolicy: 'password_required',
    accessMode: 'password',
    password: '88888888',
  });
  assert.equal(ok.ok, true);
});

test('login_required is allowed without a share password', () => {
  const ok = assertHealthPublicationAllowed({
    categoryCode: 'health',
    publishPolicy: 'password_required',
    accessMode: 'login_required',
  });
  assert.equal(ok.ok, true);
});

test('share snapshots cannot bind raw observation datasets or columns', () => {
  assert.throws(
    () => assertHealthShareDatasetPolicy({ datasetName: 'health_observations' }),
    (error) => error.code === 'health_share_raw_dataset_forbidden',
  );
  assert.throws(
    () => assertHealthShareDatasetPolicy({
      datasetName: 'health_share_snapshots',
      columns: { read: ['payload', 'ocr_text'] },
    }),
    (error) => error.code === 'health_share_column_forbidden',
  );
  const ok = assertHealthShareDatasetPolicy({
    datasetName: 'health_share_snapshots',
    columns: { read: ['payload', 'scope'] },
  });
  assert.equal(ok.ok, true);
});