0pt/tests/document-workbench/tool-selection.test.ts

import { describe, expect, it } from 'vitest';
import { selectDocumentTool, type DocumentTool } from '../../src/document-workbench/tool-selection';

const parser: DocumentTool = {
  id: 'pdf-ocr',
  version: '1',
  installed: true,
  licenseApproved: true,
  supportedMimeTypes: ['application/pdf'],
  supportedDataClasses: ['confidential'],
  externalTransfer: false,
};
const policy = {
  allowedToolIds: [parser.id],
  allowedExternalToolIds: [] as string[],
  dataClass: 'confidential',
};
const base = { proposedToolId: parser.id, detectedMimeType: 'application/pdf', registry: [parser], policy };

describe('document tool admission', () => {
  it('accepts a licensed, installed and explicitly authorized compatible tool', () => {
    expect(selectDocumentTool(base)).toEqual({ allowed: true, tool: parser });
  });
  it('rejects an agent-invented tool and an ambiguous registry', () => {
    expect(selectDocumentTool({ ...base, proposedToolId: 'shell' })).toMatchObject({
      reason: 'unknown_tool',
    });
    expect(selectDocumentTool({ ...base, registry: [parser, parser] })).toMatchObject({
      reason: 'ambiguous_registry',
    });
  });
  it('fails closed for missing authorization, license, installation or version', () => {
    expect(selectDocumentTool({ ...base, policy: { ...policy, allowedToolIds: [] } })).toMatchObject({
      reason: 'not_authorized',
    });
    for (const tool of [
      { ...parser, installed: false },
      { ...parser, licenseApproved: false },
      { ...parser, version: '' },
      { ...parser, externalTransfer: undefined } as unknown as DocumentTool,
    ]) {
      expect(selectDocumentTool({ ...base, registry: [tool] })).toMatchObject({ reason: 'not_ready' });
    }
  });
  it('rejects incorrect content types and unapproved data classes', () => {
    expect(selectDocumentTool({ ...base, detectedMimeType: 'application/zip' })).toMatchObject({
      reason: 'unsupported_format',
    });
    expect(selectDocumentTool({ ...base, policy: { ...policy, dataClass: 'restricted' } })).toMatchObject({
      reason: 'unsupported_data_class',
    });
  });
  it('requires an explicit external-transfer permission even for an otherwise allowed tool', () => {
    const external = { ...parser, externalTransfer: true };
    expect(selectDocumentTool({ ...base, registry: [external] })).toMatchObject({
      reason: 'external_transfer_denied',
    });
    expect(
      selectDocumentTool({
        ...base,
        registry: [external],
        policy: { ...policy, allowedExternalToolIds: [external.id] },
      }).allowed,
    ).toBe(true);
  });
});