test(conformance): the index matcher was pinned to one spelling (apcore#112)

The driver read the refused rule index with `/Rule (\d+)/`. The two axis
families are raised from different code paths and need not word the index
identically — this SDK's per-rule validator says `Rule 0 has invalid
effect`, while apcore-rust's loader-only key axis says `ACL rule 1 in
'<file>' carries 'priority' unrecognised` — and a matcher pinned to one
spelling reads the other as naming NO rule. That is a silent pass on
`lowest_indexed_bad_rule_wins_over_a_loader_only_axis`, the case built to
catch a real bug.

**This SDK's spellings do not differ**: every rejection it raises, the
rule-key closure included, opens with `Rule N` — measured across all seven
loader messages. So nothing was passing falsely here. The driver is
hardened anyway, because its job is to detect a divergence rather than to
encode this implementation's current phrasing, and a message reworded later
would have degraded to a false pass rather than a failure.

`ruleIndicesNamed()` now matches `\brules?\s+(\d+)\b` case-insensitively and
returns every index found, and the assertion requires the whole set to be
exactly the expected one — so "names no rule", "names the wrong rule" and
"names two rules" all fail rather than the first two passing. Prose about
"the rule" is not a hit: a digit must follow the word, or this SDK's own
pattern-shape message ("makes the rule inert") would read as naming rule 0.

`default_effect_is_judged_before_any_rule` asserts the index set is EMPTY
rather than that a regex failed to match, so a wording the driver does not
recognise cannot read as "no index present" — the same trap pointing the
other way. A driver self-test pins the matcher against both spellings, the
two-index case and the two prose non-hits, so this cannot come back
silently.

The SDK-local suite gets the same treatment where it asserts an index is
absent, plus a test that both of this SDK's axis families word the index the
same way — the thing that would have to change for the trap to matter here.

Refs: apcore#112
Signed-off-by: tercel <tercel.yi@gmail.com>

Author: tercel

tests/acl-pattern-arity_spec.test.ts

@@ -601,7 +601,12 @@ describe('§6.2.1 point 2: rule index dominates effect -> approval -> patterns',
     ];
     for (const message of messages) {
       expect(message).toMatch(/Invalid default_effect 'Allow'/);
-      expect(message).not.toMatch(/Rule \d+/);
+      // No rule index in ANY spelling: its presence would mean a rule was
+      // judged ahead of the file's own effect. Case-insensitive because the
+      // check is about whether a rule was reached, not about this SDK's
+      // capitalisation — the two axis families are raised from different code
+      // paths and need not word the index identically.
+      expect(message).not.toMatch(/\brules?\s+\d+\b/i);
     }
   });
 
@@ -622,9 +627,27 @@ describe('§6.2.1 point 2: rule index dominates effect -> approval -> patterns',
     );
     const message = messageFrom(() => ACL.load(file));
     expect(message).toMatch(/Rule 0 has invalid effect 'Allow'/);
-    expect(message).not.toMatch(/Rule 1/);
+    expect(message).not.toMatch(/\brules?\s+1\b/i);
     expect(message).not.toMatch(/priority/);
   });
+
+  it('words the rule index the same way on the loader-only axis', () => {
+    // The two axis families are raised from different code paths — the
+    // rule-key closure (#107, loader-only) and the per-rule validator — and an
+    // implementation whose spellings differ makes a driver reading the index
+    // off the message miss one of them entirely. Here both say `Rule N`, and
+    // this is the test that notices if one of them stops.
+    const unknownKey = messageFrom(() =>
+      ACL.load(
+        writeRawAclFile([{ callers: ['*'], targets: ['*'], effect: 'allow', priority: 3 }], 'deny'),
+      ),
+    );
+    expect(unknownKey).toMatch(/^Rule 0 carries 'priority'/);
+    const badEffect = messageFrom(() =>
+      ACL.load(writeRawAclFile([{ callers: ['*'], targets: ['*'], effect: 'Allow' }], 'deny')),
+    );
+    expect(badEffect).toMatch(/^Rule 0 has invalid effect/);
+  });
 });
 
 // ---------------------------------------------------------------------------

tests/conformance-acl-pattern-arity.test.ts

@@ -266,7 +266,14 @@ function assertRefusedAxis(caseId: string, axis: string, message: string): void
       expect(message, `${caseId}: refusal did not name default_effect: ${message}`).toMatch(
         /Invalid default_effect/,
       );
-      expect(message, `${caseId}: a rule was judged first: ${message}`).not.toMatch(/Rule \d+/);
+      // No rule index, in ANY spelling — its presence would mean a rule was
+      // judged ahead of the file's own effect. Asserted as an empty set rather
+      // than as a failed match, so a wording this driver does not recognise
+      // cannot read as "no index present".
+      expect(
+        ruleIndicesNamed(message),
+        `${caseId}: a rule was judged before default_effect: ${message}`,
+      ).toEqual([]);
       return;
     case 'effect':
       expect(message, `${caseId}: refusal did not name the effect: ${message}`).toMatch(
@@ -304,19 +311,40 @@ function assertRefusedAxis(caseId: string, axis: string, message: string): void
 }
 
 /**
- * Assert that a refusal names the rule the case declares (§6.2.1 point 2).
+ * Every rule index a refusal names, in any spelling a door might use.
+ *
+ * Deliberately case-insensitive and tolerant of a prefix: the axis families are
+ * raised from different code paths and need not word the index identically —
+ * this SDK's per-rule validator says `Rule 0 has invalid effect`, while another
+ * implementation's loader-only key axis says `ACL rule 1 in '<file>' carries
+ * 'priority' unrecognised`. A matcher pinned to one spelling reads the other as
+ * naming NO rule, which is a silent pass on exactly the case built to catch a
+ * real bug (measured in apcore-rust on
+ * `lowest_indexed_bad_rule_wins_over_a_loader_only_axis`).
  *
- * Every rejection message in this SDK opens with `Rule <index>`, so the index
- * is read back off the message rather than inferred. The index chooses the
- * rule and the axis order then chooses the fault inside it: a driver asserting
- * only the axis passes a rule set refused for the wrong rule on the right axis,
- * which is exactly the shape of the loader/constructor divergence these cases
- * were written for.
+ * A digit must follow the word, so the prose in this SDK's own pattern-shape
+ * message — "makes the rule inert", "an inert deny rule under…" — is not a hit.
+ */
+function ruleIndicesNamed(message: string): number[] {
+  return [...message.matchAll(/\brules?\s+(\d+)\b/gi)].map((m) => Number(m[1]));
+}
+
+/**
+ * Assert that a refusal names the rule the case declares, and only that rule
+ * (§6.2.1 point 2).
+ *
+ * The index chooses the rule and the axis order then chooses the fault inside
+ * it, so a driver asserting only the axis passes a rule set refused for the
+ * WRONG rule on the right axis — the shape of the loader/constructor divergence
+ * these cases were written for. Asserting the whole set rather than the first
+ * match also catches a message naming no rule at all and one naming two.
  */
 function assertRefusedRuleIndex(caseId: string, index: number, message: string): void {
-  const named = /Rule (\d+)/.exec(message);
-  expect(named, `${caseId}: refusal named no rule index: ${message}`).not.toBeNull();
-  expect(Number(named?.[1]), `${caseId}: refusal named the wrong rule: ${message}`).toBe(index);
+  const named = new Set(ruleIndicesNamed(message));
+  expect(
+    [...named],
+    `${caseId}: refusal should name rule ${index} and no other: ${message}`,
+  ).toEqual([index]);
 }
 
 /** The mutations a backstop case declares, as a list whatever its shape. */
@@ -339,6 +367,23 @@ describeIfPresent("Conformance: a pattern array's arity is closed (§6.2.1, spec
     }
   });
 
+  it('reads a rule index in every spelling a door might use', () => {
+    // The driver's own guard. The axis families are raised from different code
+    // paths and need not word the index the same way; a matcher pinned to one
+    // spelling reads the others as naming NO rule, which is a silent pass on
+    // the very cases that pin the ordering. This is the shape that bit
+    // apcore-rust, whose loader-only key axis says `ACL rule 1 in '<file>'`.
+    expect(ruleIndicesNamed("Rule 0 has invalid effect 'Allow'")).toEqual([0]);
+    expect(ruleIndicesNamed("ACL rule 1 in '/tmp/acl.yaml' carries 'priority'")).toEqual([1]);
+    expect(ruleIndicesNamed('rules 2 and Rule 3')).toEqual([2, 3]);
+    expect(ruleIndicesNamed("Invalid default_effect 'Allow', must be 'allow' or 'deny'")).toEqual(
+      [],
+    );
+    // Prose about "the rule" is not an index, or every pattern-shape message in
+    // this SDK — "makes the rule inert" — would read as naming one.
+    expect(ruleIndicesNamed('a shape that can never match makes the rule inert')).toEqual([]);
+  });
+
   it('exercises every case the fixture declares', () => {
     // "N skipped" and "N satisfied by construction" are different claims. This
     // SDK reaches every door and the installed-rule mutation route, so the