mathiasandClaude Opus 4.8
98cfae595c
Implements the I1-prerequisite from #49/#50: the classification taxonomy and the per-wing / per-repo tagging the capture server reads to derive a target's sensitivity. - Levels public < internal < confidential, ordered so "stricter wins" (spec §4.1 model C) is a plain max via Stricter(). - Tags read from an optional classification.yaml at the brain root (wings:/repos: maps). Absent file → defaults-only, not an error. - Defaulting: client-* → confidential; hyperguild/homelab → internal; everything else → confidential. Fail-safe-to-strictest is the load-bearing property: a missing tag never silently downgrades. - Config.Derive(Target) is the function the use-case calls; Wing/Repo are the per-kind helpers. ParseLevel rejects unknown tokens; a bad level in the config file is a hard load error. Central classification.yaml (not _index.md frontmatter, not gitea repo topics): classifying a repo needs no live Gitea client, so #50 has no dependency on the tracker work (#52); it's auditable in one place; and it avoids BuildWingIndex clobbering a wing's regenerated _index.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
113 lines
3.9 KiB
Go
113 lines
3.9 KiB
Go
package classification
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestLevelOrderingAndString(t *testing.T) {
|
|
assert.True(t, Public < Internal)
|
|
assert.True(t, Internal < Confidential)
|
|
assert.Equal(t, "public", Public.String())
|
|
assert.Equal(t, "internal", Internal.String())
|
|
assert.Equal(t, "confidential", Confidential.String())
|
|
}
|
|
|
|
func TestParseLevel(t *testing.T) {
|
|
for s, want := range map[string]Level{
|
|
"public": Public, "internal": Internal, "confidential": Confidential,
|
|
"PUBLIC": Public, " Confidential ": Confidential,
|
|
} {
|
|
got, err := ParseLevel(s)
|
|
require.NoError(t, err, s)
|
|
assert.Equal(t, want, got, s)
|
|
}
|
|
_, err := ParseLevel("secret")
|
|
require.Error(t, err, "unknown level must error, not silently default")
|
|
_, err = ParseLevel("")
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestStricterReturnsMax(t *testing.T) {
|
|
assert.Equal(t, Confidential, Stricter(Internal, Confidential))
|
|
assert.Equal(t, Confidential, Stricter(Confidential, Public))
|
|
assert.Equal(t, Internal, Stricter(Public, Internal))
|
|
assert.Equal(t, Public, Stricter(Public, Public))
|
|
}
|
|
|
|
func TestLoadAbsentFileIsDefaultsOnly(t *testing.T) {
|
|
cfg, err := Load(t.TempDir())
|
|
require.NoError(t, err, "absent classification.yaml must not be an error — defaults apply")
|
|
require.NotNil(t, cfg)
|
|
// Pure defaulting still works.
|
|
assert.Equal(t, Internal, cfg.Wing("hyperguild"))
|
|
assert.Equal(t, Confidential, cfg.Wing("anything-unknown"))
|
|
}
|
|
|
|
func TestLoadParsesExplicitTags(t *testing.T) {
|
|
dir := t.TempDir()
|
|
require.NoError(t, os.WriteFile(filepath.Join(dir, "classification.yaml"), []byte(
|
|
"wings:\n research-public: public\n hyperguild: confidential\nrepos:\n infra: internal\n research-public: public\n",
|
|
), 0o644))
|
|
|
|
cfg, err := Load(dir)
|
|
require.NoError(t, err)
|
|
// Explicit tag wins over the built-in default (hyperguild default is internal).
|
|
assert.Equal(t, Confidential, cfg.Wing("hyperguild"))
|
|
// Explicit public is honoured.
|
|
assert.Equal(t, Public, cfg.Wing("research-public"))
|
|
assert.Equal(t, Internal, cfg.Repo("infra"))
|
|
assert.Equal(t, Public, cfg.Repo("research-public"))
|
|
}
|
|
|
|
func TestLoadRejectsUnknownLevelInFile(t *testing.T) {
|
|
dir := t.TempDir()
|
|
require.NoError(t, os.WriteFile(filepath.Join(dir, "classification.yaml"),
|
|
[]byte("wings:\n x: top-secret\n"), 0o644))
|
|
_, err := Load(dir)
|
|
require.Error(t, err, "an unparseable level in the config must fail loud, not be ignored")
|
|
}
|
|
|
|
func TestWingDefaulting(t *testing.T) {
|
|
cfg, err := Load(t.TempDir())
|
|
require.NoError(t, err)
|
|
cases := map[string]Level{
|
|
"client-seb": Confidential, // client-* → confidential
|
|
"client-mastercard": Confidential,
|
|
"hyperguild": Internal,
|
|
"homelab": Internal,
|
|
"jepa-fx": Confidential, // unknown → fail safe to strictest
|
|
"": Confidential, // empty → fail safe
|
|
}
|
|
for wing, want := range cases {
|
|
assert.Equal(t, want, cfg.Wing(wing), "wing %q", wing)
|
|
}
|
|
}
|
|
|
|
func TestRepoDefaulting(t *testing.T) {
|
|
cfg, err := Load(t.TempDir())
|
|
require.NoError(t, err)
|
|
assert.Equal(t, Confidential, cfg.Repo("client-seb-pipeline"))
|
|
assert.Equal(t, Internal, cfg.Repo("hyperguild"))
|
|
assert.Equal(t, Confidential, cfg.Repo("some-unknown-repo"), "untagged repo → confidential (fail safe)")
|
|
}
|
|
|
|
func TestDeriveUnifiedTarget(t *testing.T) {
|
|
cfg, err := Load(t.TempDir())
|
|
require.NoError(t, err)
|
|
assert.Equal(t, Internal, cfg.Derive(Target{Kind: WingTarget, Name: "homelab"}))
|
|
assert.Equal(t, Confidential, cfg.Derive(Target{Kind: RepoTarget, Name: "client-x"}))
|
|
assert.Equal(t, Confidential, cfg.Derive(Target{Kind: WingTarget, Name: "untagged"}))
|
|
}
|
|
|
|
func TestCaseInsensitiveMatching(t *testing.T) {
|
|
cfg, err := Load(t.TempDir())
|
|
require.NoError(t, err)
|
|
assert.Equal(t, Confidential, cfg.Wing("Client-SEB"), "client- prefix match is case-insensitive")
|
|
assert.Equal(t, Internal, cfg.Wing("HyperGuild"))
|
|
}
|