personaEngine2/tests/RuleEngine/Determinism.Tests.ps1

#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }

BeforeAll {
    $repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
    foreach ($f in @(
            'src/Normalization/New-PersonaMembershipRecord.ps1'
            'src/Normalization/New-PersonaUserRecord.ps1'
            'src/RuleEngine/Test-PersonaCondition.ps1'
            'src/RuleEngine/Test-PersonaConditionGroup.ps1'
            'src/RuleEngine/Test-PersonaRule.ps1'
            'src/RuleEngine/Resolve-UserPersona.ps1'
        )) { . (Join-Path $repoRoot $f) }

    $script:fixtures = (Get-Content (Join-Path $repoRoot 'tests/TestData/Users/users.json') -Raw | ConvertFrom-Json).users

    $script:users = foreach ($f in $fixtures) {
        $props = @{}
        foreach ($p in $f.properties.PSObject.Properties) { $props[$p.Name] = $p.Value }

        New-PersonaUserRecord `
            -AccountObjectId $f.accountObjectId `
            -UserPrincipalName $f.userPrincipalName `
            -DisplayName $f.displayName `
            -UserType $f.userType `
            -AccountEnabled $f.accountEnabled `
            -Properties $props `
            -StoredPersona $f.storedPersona
    }

    $script:rules = @(
        [pscustomobject]@{
            id = 'R-020'; priority = 20; persona = 'Guest'; enabled = $true
            match = [pscustomobject]@{ operator = 'all'; conditions = @([pscustomobject]@{ type = 'property'; property = 'UserType'; operator = 'equals'; value = 'Guest' }) }
        }
        [pscustomobject]@{
            id = 'R-040'; priority = 40; persona = 'Service-Account'; enabled = $true
            match = [pscustomobject]@{ operator = 'all'; conditions = @([pscustomobject]@{ type = 'property'; property = 'UserPrincipalName'; operator = 'startsWith'; value = 'svc-' }) }
        }
        [pscustomobject]@{
            id = 'R-900'; priority = 900; persona = 'Employee'; enabled = $true
            match = [pscustomobject]@{ operator = 'all'; conditions = @([pscustomobject]@{ type = 'property'; property = 'Department'; operator = 'isNotNull' }) }
        }
    )

    function Get-DecisionSignature {
        param([object[]] $Users, [object[]] $RuleSet)
        # Deliberately excludes DurationMs: timing is telemetry, not part of the
        # decision, and including it would make this test measure the clock.
        ($Users | ForEach-Object {
            $r = Resolve-UserPersona -UserRecord $_ -Rules $RuleSet
            '{0}|{1}|{2}|{3}' -f $r.AccountObjectId, $r.Outcome, $r.CalculatedPersona, $r.MatchedRuleId
        } | Sort-Object) -join "`n"
    }
}

Describe 'Determinism (SC-003)' {

    It 'produces identical results across repeated runs' {
        $first = Get-DecisionSignature -Users $users -RuleSet $rules
        $second = Get-DecisionSignature -Users $users -RuleSet $rules
        $second | Should -Be $first
    }

    It 'produces identical results when the user collection is shuffled' {
        $ordered = Get-DecisionSignature -Users $users -RuleSet $rules

        foreach ($seed in 1..5) {
            $shuffled = $users | Sort-Object { ($_.AccountObjectId + $seed).GetHashCode() }
            Get-DecisionSignature -Users $shuffled -RuleSet $rules | Should -Be $ordered
        }
    }

    It 'produces identical results when the rule collection is shuffled' {
        $ordered = Get-DecisionSignature -Users $users -RuleSet $rules

        foreach ($seed in 1..5) {
            $shuffled = $rules | Sort-Object { ($_.id + $seed).GetHashCode() }
            Get-DecisionSignature -Users $users -RuleSet $shuffled | Should -Be $ordered
        }
    }

    It 'assigns exactly one outcome to every fixture (SC-001)' {
        foreach ($u in $users) {
            $r = Resolve-UserPersona -UserRecord $u -Rules $rules
            $r.Outcome | Should -BeIn @('Matched', 'Unclassified', 'EvaluationError')
        }
    }
}

Describe 'Offline execution (SC-008)' {

    It 'evaluates every fixture without any network-capable command in the engine' {
        # The structural guarantee is enforced by tests/Test-EnginePurity.ps1. This
        # asserts the practical consequence: the engine runs with nothing loaded but
        # its own files.
        $results = $users | ForEach-Object { Resolve-UserPersona -UserRecord $_ -Rules $rules }
        $results | Should -HaveCount $users.Count
    }

    It 'has not loaded the Graph authentication module' {
        (Get-Module -Name 'Microsoft.Graph.Authentication') | Should -BeNullOrEmpty
    }
}