feat: add custom errors

tests/captra.rs

@@ -0,0 +1,176 @@
+use base64::{Engine, engine::general_purpose::STANDARD};
+use captra::{
+    host::{CapError, HostState, init_tracing},
+    manifest::{ManifestError, load_manifest},
+    trace::{EventType, TraceEvent, load_trace},
+};
+use claims::{assert_err, assert_matches, assert_ok, assert_some};
+use ed25519_dalek::SigningKey;
+use rand::rngs::OsRng;
+use std::{fs::File, io::Write};
+use tempfile::tempdir;
+
+#[test]
+fn tracing_init() {
+    init_tracing();
+}
+
+#[test]
+fn manifest_loader() {
+    let manifest = assert_ok!(load_manifest("examples/manifest.json"), "Load failed");
+    assert_eq!(manifest.plugin, "formatter-v1");
+    assert_eq!(manifest.version, "0.1");
+    assert_eq!(manifest.issued_by, "dev-team");
+
+    let caps = manifest.capabilities;
+    let fs_cap = assert_some!(caps.fs);
+    let read_patterns = assert_some!(fs_cap.read);
+    assert_eq!(read_patterns, vec!["./workspace/*"]);
+    let write_patterns = assert_some!(fs_cap.write);
+    assert!(write_patterns.is_empty());
+}
+
+#[test]
+fn manifest_validation_invalid() {
+    // Mock invalid manifest (empty plugin).
+    let invalid_json = r#"
+        {
+          "plugin": "",
+          "version": "0.1",
+          "capabilities": {
+            "fs": {
+              "read": []
+            }
+          },
+          "issued_by": "dev"
+        }
+    "#;
+    let tmp_dir = tempdir().expect("Temp dir failed");
+    let tmp_path = tmp_dir.as_ref().join("invalid.json");
+    {
+        let mut file = File::create(&tmp_path).expect("File creation failed");
+        file.write_all(invalid_json.as_bytes())
+            .expect("Write failed");
+    }
+
+    assert_err!(load_manifest(tmp_path), "Expected validation error");
+
+    let glob_invalid_json = r#"
+        {
+          "plugin": "test",
+          "version": "0.1",
+          "capabilities": {
+            "fs": {
+              "read": [
+                "["
+              ]
+            }
+          },
+          "issued_by": "dev"
+        }
+    "#;
+    let tmp_path2 = tmp_dir.as_ref().join("invalid.json");
+    {
+        let mut file = File::create(&tmp_path2).expect("File creation failed");
+        file.write_all(glob_invalid_json.as_bytes())
+            .expect("Write failed");
+    }
+    let err = assert_err!(load_manifest(tmp_path2), "Expected validation error");
+    assert_matches!(
+        &err,
+        ManifestError::InvalidGlob { .. },
+        "Expected InvalidGlob, got: {err:?}"
+    );
+}
+
+#[test]
+fn host_enforcement_with_trace() {
+    init_tracing();
+
+    let manifest = assert_ok!(load_manifest("examples/manifest.json"), "Load failed");
+    let fixed_seed = 12345;
+    let mut csprng = OsRng;
+    let keypair = SigningKey::generate(&mut csprng);
+    let mut host = HostState::new(manifest, fixed_seed, keypair);
+
+    assert_eq!(host.run_id(), "captra-run-12345");
+
+    // allowed - expect a tracing event
+    let out1 = assert_ok!(host.execute_plugin("./workspace/config.toml"));
+    assert!(out1);
+    // denied - event + entry
+    let out2 = assert_err!(host.execute_plugin("/etc/passwd"));
+    assert_eq!(out2, CapError::GlobMismatch);
+
+    {
+        assert_eq!(host.trace().len(), 2); // Both allowed/denied log to trace.
+
+        let trace1 = assert_some!(host.trace().get(0));
+        assert_eq!(trace1.seq, 1);
+        assert_eq!(trace1.event_type, EventType::CapCall);
+        assert_eq!(trace1.input, "./workspace/config.toml");
+        assert!(trace1.outcome);
+        assert_eq!(trace1.ts_seed, 8_166_419_713_379_829_776);
+        assert_ne!(trace1.ts_seed, 0);
+
+        let trace2 = assert_some!(host.trace().get(1));
+        assert_eq!(trace2.run_id, "captra-run-12345");
+        assert_eq!(trace2.seq, 2);
+        assert_eq!(trace2.event_type, EventType::CapCall);
+        assert!(!trace2.outcome);
+        assert!(trace2.input.starts_with("glob_mismatch: "));
+        assert_eq!(trace2.ts_seed, 10_553_447_931_939_622_718);
+        assert_ne!(trace1.ts_seed, trace2.ts_seed);
+    }
+
+    let signed = assert_ok!(host.sign_current_trace());
+    assert_eq!(signed.run_id, "captra-run-12345");
+
+    let sig_bytes = STANDARD.decode(&signed.signature).expect("Base64 decode");
+    assert_eq!(sig_bytes.len(), 64);
+    assert!(!signed.trace_json.is_empty()); // Nonempty JSON
+
+    // Save/load roundtrip
+    let tmp_dir = tempdir().expect("Temp dir failed");
+    let tmp_path = tmp_dir.as_ref().join("trace.json");
+    assert_ok!(host.save_current_trace(&tmp_path), "Save failed");
+
+    let loaded_trace = assert_ok!(load_trace(tmp_path), "Load failed");
+    assert_eq!(loaded_trace.len(), 2);
+
+    let trace1_refetched = assert_some!(host.trace().get(0));
+    let trace2_refetched = assert_some!(host.trace().get(1));
+    let loaded_trace1 = assert_some!(loaded_trace.get(0));
+    let loaded_trace2 = assert_some!(loaded_trace.get(1));
+
+    assert_eq!(trace1_refetched, loaded_trace1);
+    assert_eq!(trace2_refetched, loaded_trace2);
+}
+
+#[test]
+fn trace_reproducibility() {
+    init_tracing();
+
+    let manifest = assert_ok!(load_manifest("examples/manifest.json"), "Load failed");
+
+    let fixed_seed = 12345;
+    let mut csprng1 = OsRng;
+    let keypair1 = SigningKey::generate(&mut csprng1);
+
+    let mut host1 = HostState::new(manifest.clone(), fixed_seed, keypair1);
+    let out1 = assert_err!(host1.execute_plugin("./allowed.txt"));
+    assert_eq!(out1, CapError::GlobMismatch);
+    let trace1 = host1.get_trace_json();
+
+    let mut csprng2 = OsRng;
+    let keypair2 = SigningKey::generate(&mut csprng2);
+    let mut host2 = HostState::new(manifest, fixed_seed, keypair2);
+    let out2 = assert_err!(host2.execute_plugin("./allowed.txt"));
+    assert_eq!(out2, CapError::GlobMismatch);
+    let trace2 = host2.get_trace_json();
+
+    let parsed1 = assert_ok!(serde_json::from_str::<Vec<TraceEvent>>(&trace1));
+    let parsed2 = assert_ok!(serde_json::from_str::<Vec<TraceEvent>>(&trace2));
+    assert_eq!(parsed1, parsed2);
+    assert_eq!(parsed1[0].ts_seed, parsed2[0].ts_seed);
+}