bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-14 23:07:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Clamp non-finite account risk scores

Browse source
This commit is contained in:
Codex Microtask Operator 2026-06-12 18:18:19 +02:00
parent 8f4691584c
commit d43019714d
2 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

17
packages/account-core/src/index.test.ts
View file

@ -41,6 +41,23 @@ describe("account-core", () => {
expect(result.decision).toBe("approval_required"); expect(result.decision).toBe("approval_required");
}); });
it("treats non-finite risk scores as critical", () => {
const result = evaluateAccountPolicy({
action: "social:profile:read",
riskScore: Number.NaN,
grant: {
id: "grant_1",
accountId: "account_1",
principal: { type: "agent", id: "marketing-agent" },
permissions: ["social:profile:read"],
policy: [],
createdAt: new Date(0).toISOString()
}
});
expect(result).toMatchObject({ decision: "deny", riskScore: 1 });
});
it("redacts secret-like audit previews", () => { it("redacts secret-like audit previews", () => {
const event = createAccountAuditEvent({ const event = createAccountAuditEvent({
provider: "gmail", provider: "gmail",

3
packages/account-core/src/policy.ts
View file

@ -51,7 +51,8 @@ export function scoreAccountActionRisk(input: {
} }
export function evaluateAccountPolicy(input: LogicSrcPolicyEvaluationInput): LogicSrcPolicyEvaluationResult { export function evaluateAccountPolicy(input: LogicSrcPolicyEvaluationInput): LogicSrcPolicyEvaluationResult {
const riskScore = Math.min(1, Math.max(0, input.riskScore ?? scoreAccountActionRisk({ action: input.action }))); const rawRiskScore = input.riskScore ?? scoreAccountActionRisk({ action: input.action });
const riskScore = Number.isFinite(rawRiskScore) ? Math.min(1, Math.max(0, rawRiskScore)) : 1;
const grantActive = input.grant && !input.grant.revokedAt && (!input.grant.expiresAt || Date.parse(input.grant.expiresAt) > Date.now()); const grantActive = input.grant && !input.grant.revokedAt && (!input.grant.expiresAt || Date.parse(input.grant.expiresAt) > Date.now());
const hasPermission = Boolean(grantActive && input.grant?.permissions.includes(input.action)); const hasPermission = Boolean(grantActive && input.grant?.permissions.includes(input.action));