fix: enforce snapshot admission through owner facts

Author: thymikee

scripts/layering/runtime-command-cutover-snapshot.test.ts

@@ -2,122 +2,63 @@ import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { snapshotPlatformPolicyBranchViolations } from './runtime-command-cutover-snapshot.ts';
 
-const SNAPSHOT_RUNTIME_BINDING_FILE = 'src/daemon/snapshot-runtime-binding.ts';
-const SNAPSHOT_FACTS_FIRST_ADMISSION = `
-  const facts = await requireRuntimeFacts(params.inspectFacts)(device);
-  const plan = resolveSnapshotRuntimePlan({
-    customActions: params.req.flags?.snapshotCustomActions === true,
-    hasActiveApp: session?.appBundleId !== undefined,
-  });
-  for (const operation of plan.use.required) {
-    const fact = facts.operations[operation];
-    if (fact.available) continue;
-  }
-`;
+const ROUTE = 'src/daemon/snapshot-runtime.ts';
+const BINDING = 'src/daemon/snapshot-runtime-binding.ts';
 
-function violationsFor(extraAdmission = ''): string[] {
+function violationsFor(route: string, binding = ''): string[] {
   return snapshotPlatformPolicyBranchViolations(
     new Map([
-      [
-        SNAPSHOT_RUNTIME_BINDING_FILE,
-        `
-          function inspectSnapshotCaptureAdmission(params, device, session) {
-            ${SNAPSHOT_FACTS_FIRST_ADMISSION}
-            ${extraAdmission}
-          }
-        `,
-      ],
+      [ROUTE, route],
+      [BINDING, binding],
     ]),
-  ).map(({ file, message }) => `${file}: ${message}`);
+  ).map(({ message }) => message);
 }
 
-test('R32 snapshot accepts only the normalized plan and selected operation facts seam', () => {
-  assert.deepEqual(violationsFor(), []);
-});
-
-test('R32 snapshot rejects a direct device-leaf branch in daemon admission', () => {
-  assert.deepEqual(
-    violationsFor("if (device.platform === 'apple' && device.kind === 'simulator') return plan;"),
-    [
-      'src/daemon/snapshot-runtime-binding.ts: snapshot admission reads device-owner identity instead of selected operation facts',
-    ],
-  );
-});
-
-test('R32 snapshot rejects a provider-mode branch in daemon admission', () => {
-  assert.deepEqual(
-    violationsFor("if (facts.device.providerMode === 'provider-runtime') return plan;"),
-    [
-      'src/daemon/snapshot-runtime-binding.ts: snapshot admission reads device-owner identity instead of selected operation facts',
-    ],
-  );
-});
-
-test('R32 snapshot rejects device-owner policy through chained aliases', () => {
-  assert.deepEqual(
-    violationsFor(`
-      const identity = device;
-      const owner = identity;
-      if (owner.platform === 'apple') return plan;
-    `),
-    [
-      'src/daemon/snapshot-runtime-binding.ts: snapshot admission reads device-owner identity instead of selected operation facts',
-    ],
-  );
-});
-
-test('R32 snapshot rejects destructured provider-owner policy', () => {
-  assert.deepEqual(
-    violationsFor(`
-      const { providerMode } = facts.device;
-      if (providerMode === 'provider-runtime') return plan;
-    `),
-    [
-      'src/daemon/snapshot-runtime-binding.ts: snapshot admission reads device-owner identity instead of selected operation facts',
-    ],
-  );
-});
+const FACTS_FIRST_ROUTE = `
+  async function dispatchSnapshotViaRuntime(params) {
+    const plan = resolveSnapshotRuntimePlan(normalizedIntent);
+    const admission = await inspectRequiredRuntimeUse({
+      device,
+      use: plan.use,
+      inspectFacts: params.inspectFacts,
+    });
+    if (!admission.admitted) return unavailable(admission);
+    return bindSnapshotCaptureRuntime(params.bindDevice, device, plan);
+  }
+`;
 
-test('R32 snapshot rejects nested device-leaf destructuring from admission params', () => {
-  assert.deepEqual(
-    violationsFor(`
-      const { device: selectedDevice } = params;
-      const { kind } = selectedDevice;
-      if (kind === 'simulator') return plan;
-    `),
-    [
-      'src/daemon/snapshot-runtime-binding.ts: snapshot admission reads device-owner identity instead of selected operation facts',
-    ],
-  );
+test('R32 accepts the normalized plan through the shared facts-first seam', () => {
+  assert.deepEqual(violationsFor(FACTS_FIRST_ROUTE), []);
 });
 
-test('R32 snapshot rejects device-owner policy through an assigned alias', () => {
+test('R32 rejects a locally reimplemented admission policy, including object-wrapped identity', () => {
   assert.deepEqual(
-    violationsFor(`
-      let identity;
-      identity = device;
-      if (identity.kind === 'simulator') return plan;
-    `),
+    violationsFor(
+      `
+        async function dispatchSnapshotViaRuntime(params) {
+          const plan = resolveSnapshotRuntimePlan(normalizedIntent);
+          return inspectSnapshotCaptureAdmission(params, plan);
+        }
+      `,
+      `
+        function inspectSnapshotCaptureAdmission(device) {
+          const wrapped = { device };
+          if (wrapped.device.platform === 'apple') return { admitted: true };
+        }
+      `,
+    ),
     [
-      'src/daemon/snapshot-runtime-binding.ts: snapshot admission reads device-owner identity instead of selected operation facts',
+      'snapshot route must admit exactly once through inspectRequiredRuntimeUse(device, plan.use, inspectFacts)',
+      'snapshot admission must not be reimplemented beside the shared facts seam',
     ],
   );
 });
 
-test('R32 snapshot rejects device-owner policy delegated to a renamed helper', () => {
-  assert.deepEqual(violationsFor('if (supportsIosSimulator(device)) return plan;'), [
-    'src/daemon/snapshot-runtime-binding.ts: snapshot admission reads device-owner identity instead of selected operation facts',
-  ]);
-});
-
-test('R32 snapshot rejects device-owner policy through object-rest identity', () => {
+test('R32 rejects an admission call not coupled to the selected plan use', () => {
   assert.deepEqual(
-    violationsFor(`
-      const { ...identity } = device;
-      if (identity.platform === 'apple') return plan;
-    `),
+    violationsFor(FACTS_FIRST_ROUTE.replace('use: plan.use', 'use: captureSnapshotUse')),
     [
-      'src/daemon/snapshot-runtime-binding.ts: snapshot admission reads device-owner identity instead of selected operation facts',
+      'snapshot route must admit exactly once through inspectRequiredRuntimeUse(device, plan.use, inspectFacts)',
     ],
   );
 });