polyc-controller 2026.8.3

#![allow(clippy::pedantic, clippy::nursery, missing_docs)]

use super::*;

fn owned(names: &[&str]) -> Vec<String> {
    names.iter().map(|&n| n.to_owned()).collect()
}

/// The shared probe universe both exhaustive proofs below run over — one
/// definition so "the same universe" is structural, not a copy that can
/// drift.
const UNIVERSE: [&str; 4] = ["a", "b", "c", "d"];

/// Every subset of [`UNIVERSE`], as owned name lists — the allow / deny /
/// ceiling inputs the exhaustive proofs enumerate.
fn universe_subsets() -> impl Iterator<Item = Vec<String>> {
    (0u32..16).map(|bits| {
        UNIVERSE
            .iter()
            .enumerate()
            .filter(|&(i, _)| bits & (1 << i) != 0)
            .map(|(_, &n)| n.to_owned())
            .collect::<Vec<String>>()
    })
}

/// With no conversation configuration and no agent, only broadcast
/// connectors are granted — the shared-Service path's behavior.
#[test]
fn broadcast_only_admits_exactly_the_default_enabled() {
    let grant = EffectiveGrant::broadcast_only();
    assert!(grant.admits("scaffold", true));
    assert!(!grant.admits("scaffold", false));
}

/// The conversation allowlist admits a connector the operator did not
/// broadcast.
#[test]
fn allowlist_admits_a_non_broadcast_connector() {
    let grant = EffectiveGrant::new(&owned(&["standup"]), &[], &[]);
    assert!(grant.admits("standup", false));
    assert!(!grant.admits("payments", false));
}

/// The deny list wins over both broadcast and the allowlist — the
/// asymmetry #488 exposed (an additive-only grant) is closed.
#[test]
fn deny_wins_over_broadcast_and_allowlist() {
    let grant = EffectiveGrant::new(&owned(&["standup"]), &owned(&["standup", "scaffold"]), &[]);
    assert!(!grant.admits("standup", false), "deny beats the allowlist");
    assert!(
        !grant.admits("scaffold", true),
        "deny beats the broadcast flag"
    );
}

/// A non-empty agent ceiling restricts the grant; an empty ceiling is no
/// restriction.
#[test]
fn ceiling_restricts_when_non_empty() {
    let ceiled = EffectiveGrant::new(&owned(&["standup", "payments"]), &[], &owned(&["standup"]));
    assert!(ceiled.admits("standup", false));
    assert!(!ceiled.admits("payments", false), "outside the ceiling");
    assert!(
        !ceiled.admits("scaffold", true),
        "broadcast outside the ceiling"
    );

    let unceiled = EffectiveGrant::new(&owned(&["payments"]), &[], &[]);
    assert!(
        unceiled.admits("payments", false),
        "empty ceiling = no restriction"
    );
}

/// The tool dimension leaves every tool on an admitted connector
/// unrestricted.
#[test]
fn open_grant_admits_every_tool_on_an_admitted_connector() {
    let grant = EffectiveGrant::new(&owned(&["scaffold"]), &[], &[]);
    assert!(grant.admits_tool("scaffold", "anything", false));
    assert!(grant.admits_tool("broadcast", "anything", true));
    assert!(
        !grant.admits_tool("denied", "anything", false),
        "a connector outside the grant admits no tool"
    );
}

/// Namespaced grammar handles and bare resource names refer to the same
/// connector in every list.
#[test]
fn handles_normalize_to_their_trailing_segment() {
    let grant = EffectiveGrant::new(
        &owned(&["toolservice:polychrome/scaffold"]),
        &owned(&["toolservice:polychrome/payments"]),
        &owned(&["polychrome/scaffold", "toolservice:polychrome/payments"]),
    );
    assert!(grant.admits("scaffold", false));
    assert!(
        !grant.admits("payments", true),
        "namespaced deny matches the bare name"
    );
}

/// `retains` filters already-resolved descriptors by deny + ceiling only.
#[test]
fn retains_applies_deny_and_ceiling_without_membership() {
    let grant = EffectiveGrant::new(
        &[],
        &owned(&["payments"]),
        &owned(&["scaffold", "payments"]),
    );
    assert!(grant.retains("scaffold"));
    assert!(!grant.retains("payments"), "denied");
    assert!(!grant.retains("standup"), "outside the ceiling");
    assert!(
        EffectiveGrant::broadcast_only().retains("anything"),
        "no deny, no ceiling: everything already resolved is retained"
    );
}

/// `ceiling_only` is exactly the ceiling dimension of the grant: it never
/// admits (no membership path) but retains precisely the ceiling's names.
#[test]
fn ceiling_only_retains_exactly_the_ceiling() {
    let grant = EffectiveGrant::ceiling_only(&owned(&["standup"]));
    assert!(grant.retains("standup"));
    assert!(!grant.retains("payments"), "outside the ceiling");
    assert!(
        !grant.admits("standup", false),
        "no membership path: ceiling_only only ever retains"
    );

    let unrestricted = EffectiveGrant::ceiling_only(&[]);
    assert!(
        unrestricted.retains("anything"),
        "empty ceiling restricts nothing"
    );
}

/// An allowlisted connector is [`Admission::Direct`] even when the
/// operator also broadcasts it — allow beats broadcast, so a connector a
/// conversation named explicitly is never demoted to the deferred pool.
#[test]
fn allowlist_beats_broadcast_for_admission() {
    let grant = EffectiveGrant::new(&owned(&["scaffold"]), &[], &[]);
    assert_eq!(grant.admission("scaffold", true), Admission::Direct);
    assert_eq!(grant.admission("scaffold", false), Admission::Direct);
}

/// A grant never has a closed set of tool names to name — empty on
/// every connector, matching the wire's "empty means no restriction"
/// convention.
#[test]
fn open_grant_has_no_admitted_tool_names() {
    let grant = EffectiveGrant::new(&owned(&["scaffold"]), &[], &[]);
    assert!(grant.admitted_tool_names("scaffold").is_empty());
    assert!(
        EffectiveGrant::broadcast_only()
            .admitted_tool_names("anything")
            .is_empty()
    );
}

/// With no conversation configuration, a broadcast connector enters the
/// deferred pool ([`Admission::Broadcast`]) and everything else is denied.
#[test]
fn broadcast_only_admission_is_broadcast_or_denied() {
    let grant = EffectiveGrant::broadcast_only();
    assert_eq!(grant.admission("scaffold", true), Admission::Broadcast);
    assert_eq!(grant.admission("scaffold", false), Admission::Denied);
}

/// Deny and ceiling exclusion produce [`Admission::Denied`] even for a
/// connector that is both allowlisted and broadcast — no membership path
/// survives [`EffectiveGrant::retains`].
#[test]
fn denied_and_ceiling_excluded_connectors_are_denied() {
    let denied = EffectiveGrant::new(&owned(&["scaffold"]), &owned(&["scaffold"]), &[]);
    assert_eq!(denied.admission("scaffold", true), Admission::Denied);

    let ceiled = EffectiveGrant::new(&owned(&["scaffold"]), &[], &owned(&["standup"]));
    assert_eq!(ceiled.admission("scaffold", true), Admission::Denied);
}

/// [`EffectiveGrant::admits`] and [`EffectiveGrant::admission`] are one
/// membership decision, exhaustively over the same universe as
/// [`zero_leakage_holds_exhaustively`]: `admits()` is exactly
/// "`admission()` is not [`Admission::Denied`]", and the Direct/Broadcast
/// split is exactly the allowlist-membership line.
#[test]
fn admission_agrees_with_admits_exhaustively() {
    for allow in universe_subsets() {
        for deny in universe_subsets() {
            for ceiling in universe_subsets() {
                let grant = EffectiveGrant::new(&allow, &deny, &ceiling);
                for name in UNIVERSE {
                    for broadcast in [false, true] {
                        let adm = grant.admission(name, broadcast);
                        assert_eq!(
                            grant.admits(name, broadcast),
                            adm != Admission::Denied,
                            "admits() and admission() disagree for {name} \
                             (broadcast={broadcast}, allow={allow:?}, \
                             deny={deny:?}, ceiling={ceiling:?})"
                        );
                        if adm == Admission::Direct {
                            assert!(
                                allow.iter().any(|a| a == name),
                                "Direct admission without allowlist membership: {name}"
                            );
                        }
                        if adm == Admission::Broadcast {
                            assert!(
                                broadcast && !allow.iter().any(|a| a == name),
                                "Broadcast admission must be defaultEnabled-only: {name}"
                            );
                        }
                    }
                }
            }
        }
    }
}

/// Zero-leakage properties, exhaustively over a small universe: every
/// combination of allowlist, deny list, ceiling, probe name, and
/// broadcast flag. The invariants are #582's invariant 1 stated against
/// the one function every resolution site consumes:
///
/// 1. an admitted connector was broadcast or allowlisted (nothing enters
///    a grant it was never given a path into);
/// 2. a denied connector is never admitted;
/// 3. under a non-empty ceiling, an admitted connector is in the ceiling;
/// 4. two agents with disjoint non-empty ceilings can never both be
///    admitted the same connector (zero cross-agent leakage).
#[test]
fn zero_leakage_holds_exhaustively() {
    for allow in universe_subsets() {
        for deny in universe_subsets() {
            for ceiling in universe_subsets() {
                let grant = EffectiveGrant::new(&allow, &deny, &ceiling);
                for name in UNIVERSE {
                    for broadcast in [false, true] {
                        let admitted = grant.admits(name, broadcast);
                        if admitted {
                            assert!(
                                broadcast || allow.iter().any(|a| a == name),
                                "leak: {name} admitted with no membership path"
                            );
                            assert!(
                                !deny.iter().any(|d| d == name),
                                "leak: {name} admitted despite deny"
                            );
                            assert!(
                                ceiling.is_empty() || ceiling.iter().any(|c| c == name),
                                "leak: {name} admitted outside the ceiling"
                            );
                        }
                    }
                }
                // Cross-agent: a second agent with a ceiling disjoint from
                // this one can never share an admitted connector.
                let complement: Vec<String> = UNIVERSE
                    .iter()
                    .filter(|n| !ceiling.iter().any(|c| c == **n))
                    .map(|&n| n.to_owned())
                    .collect();
                if ceiling.is_empty() || complement.is_empty() {
                    continue;
                }
                let other = EffectiveGrant::new(&allow, &deny, &complement);
                for name in UNIVERSE {
                    assert!(
                        !(grant.admits(name, true) && other.admits(name, true)),
                        "cross-agent leak: {name} admitted under disjoint ceilings"
                    );
                }
            }
        }
    }
}