pmg/config/sandbox_policy_for_test.go

package config

import (
	"testing"

	"github.com/stretchr/testify/assert"
)

func TestSandboxConfigPolicyFor(t *testing.T) {
	tests := []struct {
		name            string
		policies        map[string]SandboxPolicyRef
		policyTemplates map[string]SandboxPolicyTemplate
		pmName          string
		wantProfile     string
		wantExists      bool
	}{
		{
			name:        "legacy default re-mapped for npm",
			policies:    map[string]SandboxPolicyRef{"npm": {Enabled: true, Profile: "npm-restrictive"}},
			pmName:      "npm",
			wantProfile: "npm",
			wantExists:  true,
		},
		{
			name:        "legacy default re-mapped for yarn",
			policies:    map[string]SandboxPolicyRef{"yarn": {Enabled: true, Profile: "npm-restrictive"}},
			pmName:      "yarn",
			wantProfile: "yarn",
			wantExists:  true,
		},
		{
			name:        "legacy default re-mapped for bun",
			policies:    map[string]SandboxPolicyRef{"bun": {Enabled: true, Profile: "npm-restrictive"}},
			pmName:      "bun",
			wantProfile: "bun",
			wantExists:  true,
		},
		{
			name:        "custom profile kept verbatim",
			policies:    map[string]SandboxPolicyRef{"npm": {Enabled: true, Profile: "my-corp-npm"}},
			pmName:      "npm",
			wantProfile: "my-corp-npm",
			wantExists:  true,
		},
		{
			name:        "legacy pnpm-restrictive re-mapped for pnpm",
			policies:    map[string]SandboxPolicyRef{"pnpm": {Enabled: true, Profile: "pnpm-restrictive"}},
			pmName:      "pnpm",
			wantProfile: "pnpm",
			wantExists:  true,
		},
		{
			name:        "legacy profile for unrelated package manager kept verbatim",
			policies:    map[string]SandboxPolicyRef{"pip": {Enabled: true, Profile: "npm-restrictive"}},
			pmName:      "pip",
			wantProfile: "npm-restrictive",
			wantExists:  true,
		},
		{
			name:        "legacy pypi-restrictive re-mapped for pip",
			policies:    map[string]SandboxPolicyRef{"pip": {Enabled: true, Profile: "pypi-restrictive"}},
			pmName:      "pip",
			wantProfile: "pip",
			wantExists:  true,
		},
		{
			name:        "legacy pypi-restrictive re-mapped for pip3",
			policies:    map[string]SandboxPolicyRef{"pip3": {Enabled: true, Profile: "pypi-restrictive"}},
			pmName:      "pip3",
			wantProfile: "pip",
			wantExists:  true,
		},
		{
			name:        "legacy pypi-restrictive re-mapped for pipx",
			policies:    map[string]SandboxPolicyRef{"pipx": {Enabled: true, Profile: "pypi-restrictive"}},
			pmName:      "pipx",
			wantProfile: "pipx",
			wantExists:  true,
		},
		{
			name:        "legacy pypi-restrictive re-mapped for poetry",
			policies:    map[string]SandboxPolicyRef{"poetry": {Enabled: true, Profile: "pypi-restrictive"}},
			pmName:      "poetry",
			wantProfile: "poetry",
			wantExists:  true,
		},
		{
			name:        "legacy pypi-restrictive re-mapped for uv",
			policies:    map[string]SandboxPolicyRef{"uv": {Enabled: true, Profile: "pypi-restrictive"}},
			pmName:      "uv",
			wantProfile: "uv",
			wantExists:  true,
		},
		{
			name:        "legacy pypi-restrictive re-mapped for uvx",
			policies:    map[string]SandboxPolicyRef{"uvx": {Enabled: true, Profile: "pypi-restrictive"}},
			pmName:      "uvx",
			wantProfile: "uvx",
			wantExists:  true,
		},
		{
			name:     "template override disables re-mapping",
			policies: map[string]SandboxPolicyRef{"npm": {Enabled: true, Profile: "npm-restrictive"}},
			policyTemplates: map[string]SandboxPolicyTemplate{
				"npm-restrictive": {Path: "./custom-npm.yml"},
			},
			pmName:      "npm",
			wantProfile: "npm-restrictive",
			wantExists:  true,
		},
		{
			name:       "missing package manager",
			policies:   map[string]SandboxPolicyRef{},
			pmName:     "npm",
			wantExists: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cfg := SandboxConfig{Policies: tt.policies, PolicyTemplates: tt.policyTemplates}

			ref, exists := cfg.PolicyFor(tt.pmName)
			assert.Equal(t, tt.wantExists, exists)
			if tt.wantExists {
				assert.Equal(t, tt.wantProfile, ref.Profile)
			}
		})
	}
}

func TestSandboxConfigPolicyForDoesNotMutateConfig(t *testing.T) {
	cfg := SandboxConfig{
		Policies: map[string]SandboxPolicyRef{"npm": {Enabled: true, Profile: "npm-restrictive"}},
	}

	_, _ = cfg.PolicyFor("npm")

	assert.Equal(t, "npm-restrictive", cfg.Policies["npm"].Profile)
}