personaEngine2/tests/RuleEngine/UnknownNotFalse.Tests.ps1

#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }

<#
    Regression suite for the single most dangerous defect this system can have.

    If a failed membership lookup is ever treated as "not a member", then:

        notMemberOf <break-glass group>  -> True
        notMemberOf <tier 0 group>       -> True

    and a privileged account silently classifies as an ordinary user during a
    transient Graph outage. The write then persists that downgrade to the
    directory. Every assertion here exists to make that regression fail loudly.
#>

BeforeAll {
    $repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
    foreach ($f in @(
            'src/Normalization/New-PersonaMembershipRecord.ps1'
            'src/Normalization/New-PersonaUserRecord.ps1'
            'src/RuleEngine/Test-PersonaCondition.ps1'
            'src/RuleEngine/Test-PersonaConditionGroup.ps1'
            'src/RuleEngine/Test-PersonaRule.ps1'
            'src/RuleEngine/Resolve-UserPersona.ps1'
        )) { . (Join-Path $repoRoot $f) }

    $script:tier0 = '00000000-0000-0000-0000-0000000000a0'

    $script:failedLookupUser = New-PersonaUserRecord `
        -AccountObjectId '00000000-0000-0000-0000-000000000001' `
        -UserPrincipalName 'emergency-access-01@example.invalid' `
        -Properties @{ Department = 'IT' } `
        -StoredPersona 'Tier0-Admin' `
        -Membership (New-PersonaMembershipRecord -DirectFailureReason 'Graph 503 after 5 attempts')
}

Describe 'A failed membership lookup is never a non-match (FR-013)' {

    It 'does not satisfy notMemberOf' {
        $result = Test-PersonaCondition -UserRecord $failedLookupUser -Condition ([pscustomobject]@{
                type = 'membership'; operator = 'notMemberOf'; groupObjectIds = @($tier0)
            })

        $result | Should -Be 'Unknown'
        $result | Should -Not -Be 'True' -Because 'treating unknown membership as "not a member" silently downgrades privileged accounts'
    }

    It 'does not satisfy memberOf either' {
        Test-PersonaCondition -UserRecord $failedLookupUser -Condition ([pscustomobject]@{
                type = 'membership'; operator = 'memberOf'; groupObjectIds = @($tier0)
            }) | Should -Be 'Unknown'
    }

    It 'does not satisfy a role condition' {
        Test-PersonaCondition -UserRecord $failedLookupUser -Condition ([pscustomobject]@{
                type = 'role'; operator = 'memberOf'; roleIds = @('<TIER0-ROLE-TEMPLATE-ID>')
            }) | Should -Be 'Unknown'
    }

    It 'prevents a notMemberOf rule from classifying a privileged account as ordinary' {
        # The end-to-end version of the hazard: a "restricted user" rule defined as
        # "not in the admin group" must not capture an account whose membership is
        # simply unknown.
        $restrictedRule = [pscustomobject]@{
            id = 'R-100'; priority = 100; persona = 'Restricted-User'; enabled = $true
            match = [pscustomobject]@{
                operator = 'all'
                conditions = @([pscustomobject]@{ type = 'membership'; operator = 'notMemberOf'; groupObjectIds = @($tier0) })
            }
        }

        $result = Resolve-UserPersona -UserRecord $failedLookupUser -Rules @($restrictedRule)

        $result.CalculatedPersona | Should -Not -Be 'Restricted-User'
        $result.Outcome | Should -Be 'EvaluationError'
        $result.StoredPersona | Should -Be 'Tier0-Admin'
    }
}

Describe 'An empty successful lookup IS a legitimate non-match' {

    BeforeAll {
        # "Member of nothing" is a real, knowable answer and must evaluate normally.
        # Over-applying the fail-safe would make every unaffiliated account an error.
        $script:noGroupsUser = New-PersonaUserRecord `
            -AccountObjectId '00000000-0000-0000-0000-000000000104' `
            -UserPrincipalName 'drew.sparse@example.invalid' `
            -Membership (New-PersonaMembershipRecord -DirectGroupObjectIds @() -DirectRetrieved)
    }

    It 'satisfies notMemberOf' {
        Test-PersonaCondition -UserRecord $noGroupsUser -Condition ([pscustomobject]@{
                type = 'membership'; operator = 'notMemberOf'; groupObjectIds = @($tier0)
            }) | Should -Be 'True'
    }

    It 'does not satisfy memberOf' {
        Test-PersonaCondition -UserRecord $noGroupsUser -Condition ([pscustomobject]@{
                type = 'membership'; operator = 'memberOf'; groupObjectIds = @($tier0)
            }) | Should -Be 'False'
    }

    It 'produces a normal Matched outcome, not an error' {
        $restrictedRule = [pscustomobject]@{
            id = 'R-100'; priority = 100; persona = 'Restricted-User'; enabled = $true
            match = [pscustomobject]@{
                operator = 'all'
                conditions = @([pscustomobject]@{ type = 'membership'; operator = 'notMemberOf'; groupObjectIds = @($tier0) })
            }
        }

        $result = Resolve-UserPersona -UserRecord $noGroupsUser -Rules @($restrictedRule)
        $result.Outcome | Should -Be 'Matched'
        $result.CalculatedPersona | Should -Be 'Restricted-User'
    }
}