luajitos

test_orbit_manifest.lua (4997B)

---

 -- Test file for OrbitManager.newFromManifest
 
 local OrbitManager = require("OrbitManager")
 
 print("=== OrbitManager.newFromManifest Test Suite ===\n")
 
 -- Create a sandboxed environment
 local sandbox = {
     io = {
         open = function(path, mode)
             print("REAL io.open called with:", path, mode)
             return "file_handle_mock"
         end,
     },
     os = {
         clock = function()
             print("REAL os.clock called")
             return 12345.67
         end,
         execute = function(cmd)
             print("REAL os.execute called with:", cmd)
             return true
         end,
     }
 }
 
 -- Test manifest string
 local manifestString = [[
 return {
     name = "myapp";
     dev = "devname";
     perms = {
         fs = true,
         os = false,
         network = true
     };
     allowedPaths = {
         "/tmp/*",
         "/home/user/myapp/*"
     };
     allowedDomains = {
         "api.myapp.io",
         "*.example.com"
     }
 }
 ]]
 
 -- Test 1: Create instance from manifest
 print("1. Creating OrbitManager from manifest string...")
 local orbit = OrbitManager.newFromManifest(sandbox, manifestString)
 print("   ✓ OrbitManager created from manifest\n")
 
 -- Test 2: Verify manifest metadata
 print("2. Checking manifest metadata...")
 local manifestData = orbit:getManifestData()
 print("   App name:", manifestData.name)
 print("   Developer:", manifestData.dev)
 print("   ✓ Manifest metadata accessible\n")
 
 -- Test 3: Test permissions were loaded correctly
 print("3. Testing loaded permissions...")
 local canRun, reason = orbit:canRun("io.open", "/tmp/test.txt")
 print("   canRun('io.open', '/tmp/test.txt'):", canRun, reason)
 
 canRun, reason = orbit:canRun("os.execute")
 print("   canRun('os.execute'):", canRun, reason)
 print()
 
 -- Test 4: Test filesystem access with allowed path
 print("4. Testing filesystem access with allowed paths...")
 local success, err = pcall(function()
     local result = sandbox.io.open("/tmp/test.txt", "r")
     print("   ✓ io.open('/tmp/test.txt') succeeded, returned:", result)
 end)
 if not success then
     print("   ✗ FAILED:", err)
 end
 
 success, err = pcall(function()
     sandbox.io.open("/etc/passwd", "r")
 end)
 if not success then
     print("   ✓ Blocked access to /etc/passwd:", err)
 else
     print("   ✗ FAILED: Should have blocked /etc/passwd")
 end
 print()
 
 -- Test 5: Test path matching with wildcards
 print("5. Testing wildcard path matching...")
 canRun, reason = orbit:canRun("io.open", "/home/user/myapp/config.txt")
 print("   canRun('io.open', '/home/user/myapp/config.txt'):", canRun, reason)
 
 canRun, reason = orbit:canRun("io.open", "/home/user/other/file.txt")
 print("   canRun('io.open', '/home/user/other/file.txt'):", canRun, reason)
 print()
 
 -- Test 6: Test OS permission (should be denied)
 print("6. Testing OS permissions (should be denied)...")
 success, err = pcall(function()
     sandbox.os.execute("ls")
 end)
 if not success then
     print("   ✓ Blocked os.execute (perms.os = false):", err)
 else
     print("   ✗ FAILED: Should have blocked os.execute")
 end
 print()
 
 -- Test 7: Test metatable protection
 print("7. Testing metatable protection...")
 success, err = pcall(function()
     local x = orbit.map
 end)
 if not success then
     print("   ✓ Direct access to orbit.map blocked:", err)
 else
     print("   ✗ FAILED: Should not be able to access orbit.map")
 end
 
 success, err = pcall(function()
     orbit.manifestData = {}
 end)
 if not success then
     print("   ✓ Direct write to orbit.manifestData blocked:", err)
 else
     print("   ✗ FAILED: Should not be able to modify orbit.manifestData")
 end
 print()
 
 -- Test 8: Test another manifest with different perms
 print("8. Testing another manifest with different permissions...")
 local manifest2 = [[
 return {
     name = "systemtool";
     dev = "admin";
     perms = {
         fs = false,
         os = true
     };
     allowedPaths = {};
     allowedDomains = {}
 }
 ]]
 
 local orbit2 = OrbitManager.newFromManifest(nil, manifest2)
 local data2 = orbit2:getManifestData()
 print("   App name:", data2.name)
 print("   Developer:", data2.dev)
 
 canRun, reason = orbit2:canRun("os.clock")
 print("   canRun('os.clock'):", canRun, reason)
 
 canRun, reason = orbit2:canRun("io.open", "/tmp/test.txt")
 print("   canRun('io.open', '/tmp/test.txt'):", canRun, reason)
 print()
 
 -- Test 9: Test invalid manifest handling
 print("9. Testing invalid manifest handling...")
 success, err = pcall(function()
     local badOrbit = OrbitManager.newFromManifest(nil, "return 'not a table'")
 end)
 if not success then
     print("   ✓ Rejected invalid manifest:", err)
 else
     print("   ✗ FAILED: Should have rejected manifest that doesn't return a table")
 end
 
 success, err = pcall(function()
     local badOrbit = OrbitManager.newFromManifest(nil, "this is not valid lua")
 end)
 if not success then
     print("   ✓ Rejected unparseable manifest:", err)
 else
     print("   ✗ FAILED: Should have rejected invalid Lua")
 end
 print()
 
 print("=== All Tests Complete ===")