109 lines
4.6 KiB
TypeScript
109 lines
4.6 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import {
|
|
ExploitEngine,
|
|
ScannerOrchestrator,
|
|
BrowserAutomation,
|
|
BenchmarkRunner,
|
|
PersistenceController,
|
|
SwarmController,
|
|
CloudSecurityEngine,
|
|
ProtocolHandler,
|
|
WorkflowOrchestrator,
|
|
WorkflowBuilder,
|
|
} from '../stubs/index.js';
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// STUB HONESTY — placeholder engines must never fabricate success.
|
|
//
|
|
// Several "advanced modules" are interface-only stubs (see src/stubs/index.ts).
|
|
// The launch risk is a stub that RETURNS something that looks like a real result:
|
|
// a { success: true }, a deployed implant, an "Executed X" node result. A caller
|
|
// (or the UI) then believes work happened that never did. This test locks in the
|
|
// honest contract: stub methods return not-implemented / failure shapes, never a
|
|
// fabricated success or real-looking data.
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
describe('stub honesty (no fabricated success)', () => {
|
|
it('ExploitEngine.exploit reports failure, not a fake exploited target', async () => {
|
|
const result = await new ExploitEngine().exploit('10.0.0.1', {
|
|
name: 'stub',
|
|
targetService: 'http',
|
|
});
|
|
expect(result.success).toBe(false);
|
|
expect(String(result.output || '')).toMatch(/not implemented/i);
|
|
});
|
|
|
|
it('ScannerOrchestrator.scan returns no fabricated findings', async () => {
|
|
const result = await new ScannerOrchestrator().scan('10.0.0.1');
|
|
expect(result.findings).toEqual([]);
|
|
});
|
|
|
|
it('BrowserAutomation.navigate does not fake a loaded page', async () => {
|
|
const state = await new BrowserAutomation().navigate('http://example.com');
|
|
// No real navigation happened: no live URL, an honest "Not implemented" title.
|
|
expect(state.url).toBe('');
|
|
expect(state.title).toMatch(/not implemented/i);
|
|
});
|
|
|
|
it('BenchmarkRunner.run does not fabricate a passing score', async () => {
|
|
const metrics = await new BenchmarkRunner().run([]);
|
|
expect(metrics.score).toBe(0);
|
|
});
|
|
|
|
it('PersistenceController.deploy returns an honest failure, not a fake implant', async () => {
|
|
const result = await new PersistenceController().deploy('10.0.0.1', {
|
|
type: 'scheduled_task',
|
|
location: 'stub',
|
|
});
|
|
const asRecord = result as unknown as Record<string, unknown>;
|
|
// Must NOT look like a real deployed implant (no fabricated id/implant object).
|
|
expect(asRecord.id).toBeUndefined();
|
|
expect(asRecord.implant).toBeUndefined();
|
|
// And it must never claim success.
|
|
expect(asRecord.success).not.toBe(true);
|
|
expect(result.success).toBe(false);
|
|
expect(result.error).toMatch(/not implemented/i);
|
|
});
|
|
|
|
it('SwarmController.initialize spawns no fabricated agents', async () => {
|
|
const agents = await new SwarmController().initialize({
|
|
agentCount: 5,
|
|
behavior: 'exploration',
|
|
});
|
|
expect(agents).toEqual([]);
|
|
});
|
|
|
|
it('CloudSecurityEngine.scan discovers no fabricated resources', async () => {
|
|
const resources = await new CloudSecurityEngine().scan({ provider: 'aws' });
|
|
expect(resources).toEqual([]);
|
|
});
|
|
|
|
it('ProtocolHandler.http does not fabricate a real HTTP response', async () => {
|
|
const response = await new ProtocolHandler().http({ method: 'GET', url: 'http://example.com' });
|
|
expect(response.status).toBe(0);
|
|
expect(response.body).toMatch(/not implemented/i);
|
|
});
|
|
|
|
it('WorkflowOrchestrator.execute never reports fabricated node successes', async () => {
|
|
const workflow = new WorkflowBuilder()
|
|
.addNode({ id: 'a', type: 'recon', action: { type: 'noop', params: {} } })
|
|
.addNode({ id: 'b', type: 'scan', action: { type: 'noop', params: {} } })
|
|
.addEdge({ from: 'a', to: 'b' })
|
|
.build();
|
|
|
|
const report = await new WorkflowOrchestrator(undefined).execute(workflow);
|
|
|
|
// The topological walk is real, but NO node actually executes.
|
|
expect(report.results.length).toBe(2);
|
|
for (const nodeResult of report.results) {
|
|
expect(nodeResult.success).toBe(false);
|
|
expect(nodeResult.notExecuted).toBe(true);
|
|
// No fabricated "Executed ..." claim.
|
|
expect(String(nodeResult.output || '')).not.toMatch(/^Executed /);
|
|
}
|
|
// The overall execution must NOT be reported as completed.
|
|
expect(report.execution.status).not.toBe('completed');
|
|
expect(report.execution.status).toBe('failed');
|
|
});
|
|
});
|