personaEngine2/tests/Configuration/Semantic.Tests.ps1

#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }

<#
    SC-009: every VR-002 condition produces a finding with a code, a severity, and a
    location.

    Layer 3 is exercised directly rather than through Test-PersonaConfiguration. Most
    of these defects are also caught by the JSON Schema, so a full-pipeline test would
    stop at layer 2 and never reach the code under test - it would be asserting that
    the schema works, which LayerOrdering.Tests.ps1 already does.

    The overlap is deliberate (see the note in Test-PersonaConfigurationSemantic):
    layer 2 can be bypassed with -SchemaPath, and V-5a showed an unparseable schema
    passes silently on this build. Anything that can misclassify a privileged account
    is checked twice.
#>

BeforeAll {
    $repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
    . (Join-Path $repoRoot 'tests/TestHelpers.ps1')
    foreach ($file in (Get-PersonaSourceFile -RepoRoot $repoRoot)) { . $file }

    $script:corpus = Join-Path $repoRoot 'tests/TestData/InvalidConfigs'

    function Get-Finding {
        param([string] $Fixture, [string] $Code)

        $document = Get-Content -LiteralPath (Join-Path $script:corpus "$Fixture.json") -Raw | ConvertFrom-Json -Depth 32
        @(Test-PersonaConfigurationSemantic -Document $document | Where-Object Code -EQ $Code)
    }
}

Describe 'Semantic validation, VR-002 conditions (SC-009)' {

    It 'detects duplicate rule IDs' {
        $findings = Get-Finding -Fixture 'PE-SEM-001-duplicate-rule-id' -Code 'PE-SEM-001'

        $findings.Count | Should -BeGreaterThan 0
        $findings[0].Severity | Should -Be 'Error'
        $findings[0].Location | Should -Match 'RULE-0010-GUEST'
    }

    It 'detects duplicate priorities among enabled rules' {
        $findings = Get-Finding -Fixture 'PE-SEM-002-duplicate-priority' -Code 'PE-SEM-002'

        $findings.Count | Should -BeGreaterThan 0
        $findings[0].Severity | Should -Be 'Error'
        $findings[0].Description | Should -Match 'RULE-0010-GUEST'
        $findings[0].Description | Should -Match 'RULE-0900-EMPLOYEE'
    }

    It 'detects a configuration with no enabled rules' {
        $findings = Get-Finding -Fixture 'PE-SEM-003-no-enabled-rules' -Code 'PE-SEM-003'

        $findings.Count | Should -Be 1
        $findings[0].Severity | Should -Be 'Error'
    }

    It 'detects a blank target attribute' {
        $findings = Get-Finding -Fixture 'PE-SEM-004-blank-target-attribute' -Code 'PE-SEM-004'

        $findings.Count | Should -Be 1
        $findings[0].Location | Should -Be 'engine.targetAttribute'
    }

    It 'detects a target attribute absent from the approved list' {
        $findings = Get-Finding -Fixture 'PE-SEM-005-target-not-approved' -Code 'PE-SEM-005'

        $findings.Count | Should -Be 1
        $findings[0].Severity | Should -Be 'Error'
    }

    It 'detects a reference to a disabled data source' {
        $findings = Get-Finding -Fixture 'PE-SEM-006-unavailable-data-source' -Code 'PE-SEM-006'

        $findings.Count | Should -BeGreaterThan 0
        $findings[0].Severity | Should -Be 'Error'
        $findings[0].Description | Should -Match 'EvaluationError'
    }

    It 'detects memberOf with no group Object IDs' {
        $findings = Get-Finding -Fixture 'PE-SEM-007-memberof-without-groups' -Code 'PE-SEM-007'

        $findings.Count | Should -BeGreaterThan 0
        $findings[0].Severity | Should -Be 'Error'
    }

    It 'detects in without a values array' {
        $findings = Get-Finding -Fixture 'PE-SEM-008-in-without-values' -Code 'PE-SEM-008'

        $findings.Count | Should -Be 1
        $findings[0].Severity | Should -Be 'Error'
    }

    It 'detects isNotNull carrying a comparison value' {
        # The value is silently ignored at evaluation time, so the rule does not do
        # what the author plainly intended it to do.
        $findings = Get-Finding -Fixture 'PE-SEM-009-isnull-with-value' -Code 'PE-SEM-009'

        $findings.Count | Should -Be 1
        $findings[0].Severity | Should -Be 'Error'
    }

    It 'detects a persona absent from the declared catalogue' {
        $findings = Get-Finding -Fixture 'PE-SEM-010-undeclared-persona' -Code 'PE-SEM-010'

        $findings.Count | Should -Be 1
        $findings[0].Description | Should -Match 'Undeclared-Persona'
    }

    It 'detects Unclassified used as an ordinary rule persona' {
        $findings = Get-Finding -Fixture 'PE-SEM-011-unclassified-as-persona' -Code 'PE-SEM-011'

        $findings.Count | Should -Be 1
        $findings[0].Severity | Should -Be 'Error'
    }

    It 'detects nesting deeper than the configured maximum' {
        $findings = Get-Finding -Fixture 'PE-SEM-012-depth-over-configured-maximum' -Code 'PE-SEM-012'

        $findings.Count | Should -BeGreaterThan 0
        $findings[0].Severity | Should -Be 'Error'
        $findings[0].Location | Should -Match 'conditions'
    }

    It 'detects a configured maximum above the hard ceiling of 10' {
        $findings = Get-Finding -Fixture 'PE-SEM-013-depth-over-hard-ceiling' -Code 'PE-SEM-013'

        $findings.Count | Should -Be 1
        $findings[0].Location | Should -Be 'engine.maxConditionDepth'
    }

    It 'warns when a condition mode differs from an explicitly pinned global mode' {
        # A Warning, not an Error: the three facets are retrieved independently, so
        # the condition is answered correctly. The cost is an extra call per account,
        # which is worth surfacing but not worth blocking.
        $findings = Get-Finding -Fixture 'PE-SEM-014-mode-not-enabled-globally' -Code 'PE-SEM-014'

        $findings.Count | Should -BeGreaterThan 0
        $findings[0].Severity | Should -Be 'Warning'
    }

    It 'detects an unsupported property name' {
        $findings = Get-Finding -Fixture 'PE-SEM-015-unsupported-property' -Code 'PE-SEM-015'

        $findings.Count | Should -Be 1
        $findings[0].Description | Should -Match 'employeeHireDate'
    }

    It 'detects an invalid regular expression' {
        $findings = Get-Finding -Fixture 'PE-SEM-016-invalid-regex' -Code 'PE-SEM-016'

        $findings.Count | Should -Be 1
        $findings[0].Severity | Should -Be 'Error'
    }
}

Describe 'Semantic findings carry everything VR-004 requires' {

    It 'gives every finding a severity, code, location, description, resolution, and layer' {
        $fixtures = Get-ChildItem -Path $script:corpus -Filter 'PE-SEM-*.json'
        $fixtures.Count | Should -BeGreaterThan 0

        foreach ($fixture in $fixtures) {
            $document = Get-Content -LiteralPath $fixture.FullName -Raw | ConvertFrom-Json -Depth 32

            foreach ($finding in (Test-PersonaConfigurationSemantic -Document $document)) {
                $finding.Severity | Should -BeIn @('Error', 'Warning', 'Information')
                $finding.Code | Should -Match '^PE-SEM-\d{3}$'
                $finding.Location | Should -Not -BeNullOrEmpty
                $finding.Description | Should -Not -BeNullOrEmpty
                $finding.SuggestedResolution | Should -Not -BeNullOrEmpty
                $finding.Layer | Should -Be 'Semantic'
            }
        }
    }

    It 'produces no findings for the valid baseline' {
        # Without this, a validator that flagged everything would pass every test above.
        $document = Get-Content -LiteralPath (Join-Path $script:corpus 'baseline-deployed.json') -Raw | ConvertFrom-Json -Depth 32

        @(Test-PersonaConfigurationSemantic -Document $document) | Should -BeNullOrEmpty
    }

    It 'produces no findings for the shipped example configuration' {
        $document = Get-Content -LiteralPath (Join-Path $repoRoot 'config/persona-engine.example.json') -Raw | ConvertFrom-Json -Depth 32

        @(Test-PersonaConfigurationSemantic -Document $document) | Should -BeNullOrEmpty
    }
}