Build the agent-native compute CRM platform

packages/core/test/permissions.test.ts

@@ -0,0 +1,48 @@
+import { strict as assert } from 'node:assert';
+import { describe, it } from 'node:test';
+import { permissionGranted, resolvePermissionGrants } from '../src/permissions';
+
+describe('role permissions', () => {
+  it('keeps deal writes on the side where the person is a member', () => {
+    const grants = resolvePermissionGrants({
+      isPlatformAdmin: false,
+      teams: [{ team: 'demand', role: 'member' }],
+    });
+
+    assert.equal(permissionGranted(grants, 'deal:write', 'demand'), true);
+    assert.equal(permissionGranted(grants, 'deal:write', 'supply'), false);
+    assert.equal(permissionGranted(grants, 'commitment:write', 'demand'), false);
+  });
+
+  it('allows supply leads to commit capacity without letting them sign contracts', () => {
+    const grants = resolvePermissionGrants({
+      isPlatformAdmin: false,
+      teams: [{ team: 'supply', role: 'lead' }],
+    });
+
+    assert.equal(permissionGranted(grants, 'commitment:write', 'supply'), true);
+    assert.equal(permissionGranted(grants, 'contract:sign', 'supply'), false);
+  });
+
+  it('keeps signing and bulk import at team-admin level', () => {
+    const grants = resolvePermissionGrants({
+      isPlatformAdmin: false,
+      teams: [{ team: 'demand', role: 'admin' }],
+    });
+
+    assert.equal(permissionGranted(grants, 'contract:sign', 'demand'), true);
+    assert.equal(permissionGranted(grants, 'contract:sign', 'supply'), false);
+    assert.equal(permissionGranted(grants, 'data:import', 'demand'), true);
+    assert.equal(permissionGranted(grants, 'data:import', 'research'), false);
+    assert.equal(permissionGranted(grants, 'settings:admin'), false);
+  });
+
+  it('gives platform admins global grants without synthetic team memberships', () => {
+    const grants = resolvePermissionGrants({ isPlatformAdmin: true, teams: [] });
+
+    assert.equal(permissionGranted(grants, 'deal:write', 'demand'), true);
+    assert.equal(permissionGranted(grants, 'commitment:write', 'supply'), true);
+    assert.equal(permissionGranted(grants, 'data:import', 'research'), true);
+    assert.equal(permissionGranted(grants, 'settings:admin'), true);
+  });
+});

packages/core/test/security-tier.test.ts

@@ -0,0 +1,24 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { SECURITY_TIERS, securityTierSatisfies } from '../src/index';
+
+test('security tiers form a deliberate minimum-requirement ordering', () => {
+  const expected: Record<(typeof SECURITY_TIERS)[number], (typeof SECURITY_TIERS)[number][]> = {
+    community_cloud: ['community_cloud', 'secure_cloud', 'government'],
+    secure_cloud: ['secure_cloud', 'government'],
+    government: ['government'],
+  };
+
+  for (const required of SECURITY_TIERS) {
+    const eligible = SECURITY_TIERS.filter((available) =>
+      securityTierSatisfies(available, required),
+    );
+    assert.deepEqual(eligible.sort(), expected[required].sort());
+  }
+});
+
+test('a sovereign requirement is never satisfied by community capacity', () => {
+  assert.equal(securityTierSatisfies('community_cloud', 'government'), false);
+  assert.equal(securityTierSatisfies('secure_cloud', 'government'), false);
+  assert.equal(securityTierSatisfies('government', 'government'), true);
+});