Function TestRecipientGate

internal/agent/screening_test.go:27–57

(t *testing.T)

}

func TestRecipientGate(t *testing.T) {
	cases := []struct {
		name      string
		policy    string
		allowlist []string
		domain    string
		req       outbound.SendRequest
		wantFlag  bool
		wantAddr  string
	}{
		{"open never flags", identity.OutboundPolicyOpen, nil, "bot.example.com",
			outbound.SendRequest{To: []string{"stranger@evil.com"}}, false, ""},
		{"allowlist permits listed", identity.OutboundPolicyAllowlist, []string{"ok@friend.com"}, "bot.example.com",
			outbound.SendRequest{To: []string{"ok@friend.com"}}, false, ""},
		{"allowlist flags unlisted", identity.OutboundPolicyAllowlist, []string{"ok@friend.com"}, "bot.example.com",
			outbound.SendRequest{To: []string{"ok@friend.com"}, CC: []string{"who@stranger.com"}}, true, "who@stranger.com"},
		{"domain permits same domain", identity.OutboundPolicyDomain, nil, "bot.example.com",
			outbound.SendRequest{To: []string{"alice@bot.example.com"}}, false, ""},
		{"domain flags foreign", identity.OutboundPolicyDomain, nil, "bot.example.com",
			outbound.SendRequest{To: []string{"alice@bot.example.com"}, BCC: []string{"x@elsewhere.com"}}, true, "x@elsewhere.com"},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			ag := &identity.AgentIdentity{OutboundPolicy: tc.policy, OutboundAllowlist: tc.allowlist, Domain: tc.domain}
			flagged, addr := recipientGate(ag, tc.req)
			if flagged != tc.wantFlag || addr != tc.wantAddr {
				t.Errorf("recipientGate = (%v, %q), want (%v, %q)", flagged, addr, tc.wantFlag, tc.wantAddr)
			}
		})
	}
}

// TestScreenOutbound_GateAction: a flagged recipient escalates to the agent's
// outbound_policy_action; open/allow produces ActionAllow.