personaEngine2/tests/RuleEngine/UnknownPropagation.Tests.ps1

#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }

BeforeAll {
    $repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
    foreach ($f in @(
            'src/Normalization/New-PersonaMembershipRecord.ps1'
            'src/Normalization/New-PersonaUserRecord.ps1'
            'src/RuleEngine/Test-PersonaCondition.ps1'
            'src/RuleEngine/Test-PersonaConditionGroup.ps1'
        )) { . (Join-Path $repoRoot $f) }

    # A user whose membership lookup failed: any membership condition against this
    # record yields Unknown, which is how these tests inject the tri-state.
    $script:user = New-PersonaUserRecord `
        -AccountObjectId '00000000-0000-0000-0000-000000000101' `
        -UserPrincipalName 'alex.employee@example.invalid' `
        -Properties @{ Department = 'Finance' } `
        -Membership (New-PersonaMembershipRecord -DirectFailureReason 'Graph 503 after 5 attempts')

    $script:TRUE_COND = [pscustomobject]@{ type = 'property'; property = 'Department'; operator = 'equals'; value = 'Finance' }
    $script:FALSE_COND = [pscustomobject]@{ type = 'property'; property = 'Department'; operator = 'equals'; value = 'Legal' }
    $script:UNKNOWN_COND = [pscustomobject]@{ type = 'membership'; operator = 'memberOf'; groupObjectIds = @('00000000-0000-0000-0000-0000000000a0') }

    function Eval {
        param([string] $Operator, [object[]] $Conditions)
        Test-PersonaConditionGroup -Group ([pscustomobject]@{ operator = $Operator; conditions = $Conditions }) -UserRecord $user
    }
}

Describe 'Unknown propagation table (data-model.md)' {

    Context 'the injected conditions behave as intended' {
        It 'TRUE_COND is True' { Test-PersonaCondition -Condition $TRUE_COND -UserRecord $user | Should -Be 'True' }
        It 'FALSE_COND is False' { Test-PersonaCondition -Condition $FALSE_COND -UserRecord $user | Should -Be 'False' }
        It 'UNKNOWN_COND is Unknown' { Test-PersonaCondition -Condition $UNKNOWN_COND -UserRecord $user | Should -Be 'Unknown' }
    }

    Context 'row 1: all + any False -> False' {
        It 'a definite non-match decides the group despite an unknown sibling' {
            # The rule cannot match either way, so degrading to Unknown here would
            # manufacture EvaluationErrors for rules that were never going to match.
            Eval 'all' @($FALSE_COND, $UNKNOWN_COND) | Should -Be 'False'
        }
        It 'holds regardless of sibling order' {
            Eval 'all' @($UNKNOWN_COND, $FALSE_COND) | Should -Be 'False'
        }
    }

    Context 'row 2: all + only True and Unknown -> Unknown' {
        It 'cannot confirm a match' {
            Eval 'all' @($TRUE_COND, $UNKNOWN_COND) | Should -Be 'Unknown'
        }
        It 'holds regardless of sibling order' {
            Eval 'all' @($UNKNOWN_COND, $TRUE_COND) | Should -Be 'Unknown'
        }
    }

    Context 'row 3: any + any True -> True' {
        It 'a definite match decides the group despite an unknown sibling' {
            Eval 'any' @($TRUE_COND, $UNKNOWN_COND) | Should -Be 'True'
        }
        It 'holds regardless of sibling order' {
            Eval 'any' @($UNKNOWN_COND, $TRUE_COND) | Should -Be 'True'
        }
    }

    Context 'row 4: any + only False and Unknown -> Unknown' {
        It 'cannot rule out a match' {
            Eval 'any' @($FALSE_COND, $UNKNOWN_COND) | Should -Be 'Unknown'
        }
        It 'holds regardless of sibling order' {
            Eval 'any' @($UNKNOWN_COND, $FALSE_COND) | Should -Be 'Unknown'
        }
    }

    Context 'no-unknown baselines' {
        It 'all with only True is True' { Eval 'all' @($TRUE_COND, $TRUE_COND) | Should -Be 'True' }
        It 'all with a False is False' { Eval 'all' @($TRUE_COND, $FALSE_COND) | Should -Be 'False' }
        It 'any with a True is True' { Eval 'any' @($FALSE_COND, $TRUE_COND) | Should -Be 'True' }
        It 'any with only False is False' { Eval 'any' @($FALSE_COND, $FALSE_COND) | Should -Be 'False' }
    }

    Context 'propagation through nesting' {
        It 'carries Unknown up from a nested group' {
            $inner = [pscustomobject]@{ operator = 'all'; conditions = @($TRUE_COND, $UNKNOWN_COND) }
            Eval 'all' @($TRUE_COND, $inner) | Should -Be 'Unknown'
        }

        It 'lets a definite False at the outer level still decide the group' {
            $inner = [pscustomobject]@{ operator = 'all'; conditions = @($TRUE_COND, $UNKNOWN_COND) }
            Eval 'all' @($FALSE_COND, $inner) | Should -Be 'False'
        }

        It 'lets a definite True at the outer level still decide an any group' {
            $inner = [pscustomobject]@{ operator = 'any'; conditions = @($FALSE_COND, $UNKNOWN_COND) }
            Eval 'any' @($TRUE_COND, $inner) | Should -Be 'True'
        }
    }
}