feat(testkit): deterministic fake platform ports + fixtures + replay oracle

Fakes for all 7 IiosPlatformPorts (deny/timeout/ambiguous controls), portal + unknown-email fixtures, replayTwice idempotency oracle. Adds ingest request contract. Vitest alias resolves workspace packages to source. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 21:05:41 +05:30
parent fbea291609
commit 169c1a375c
19 changed files with 414 additions and 0 deletions
@@ -0,0 +1,39 @@
+import type { IiosPlatformPorts, PolicyDecision } from '@insignia/iios-contracts';
+
+type OpaPort = IiosPlatformPorts['opa'];
+
+/** Deterministic OPA fake. Defaults to allow; can be set to deny or timeout. */
+export class FakeOpa implements OpaPort {
+  private decision: PolicyDecision = {
+    decisionRef: 'fake-allow',
+    allow: true,
+    obligations: [],
+    ttlSeconds: 60,
+  };
+  private mode: 'normal' | 'timeout' = 'normal';
+
+  setDecision(d: Partial<PolicyDecision>): this {
+    this.decision = { ...this.decision, ...d };
+    return this;
+  }
+
+  deny(reason = 'denied by fake opa'): this {
+    this.decision = {
+      decisionRef: 'fake-deny',
+      allow: false,
+      obligations: [{ kind: 'AUDIT', reason }],
+      ttlSeconds: 0,
+    };
+    return this;
+  }
+
+  timeout(): this {
+    this.mode = 'timeout';
+    return this;
+  }
+
+  async decide(_input: unknown): Promise<PolicyDecision> {
+    if (this.mode === 'timeout') throw new Error('opa timeout');
+    return this.decision;
+  }
+}