Name	Size	Mode	Actions
idempotency.test.js	1714	0644	editdlrm
integration-service.test.js	4496	0644	editdlrm
live-pm-clients.test.js	5731	0644	editdlrm
local-server.test.js	5687	0644	editdlrm
metrics.test.js	1691	0644	editdlrm
oidc.test.js	2367	0644	editdlrm
rate-limit.test.js	1414	0644	editdlrm
saas-domain.test.js	3137	0644	editdlrm
tenant-security.test.js	1184	0644	editdlrm

const assert = require("assert"); const { hasPermission, canAccessWorkspace, canMutateRisk } = require("../src/domain/permissions"); const { subscriptionAllowsAccess } = require("../src/domain/entitlements"); assert.strictEqual(canAccessWorkspace({ status: "ACTIVE", workspaceScope: [] }, "workspace-a"), true); assert.strictEqual(canAccessWorkspace({ status: "ACTIVE", workspaceScope: ["workspace-b"] }, "workspace-a"), false); assert.strictEqual(canAccessWorkspace({ status: "DISABLED", workspaceScope: [] }, "workspace-a"), false); assert.strictEqual(canMutateRisk({ status: "ACTIVE", workspaceScope: [], permissions: ["risk:read"] }), false); assert.strictEqual(canMutateRisk({ status: "ACTIVE", workspaceScope: [], permissions: ["risk:write"] }), true); assert.strictEqual(subscriptionAllowsAccess({ status: "ACTIVE", adminOverride: false }, { status: "ACTIVE" }), true); assert.strictEqual(subscriptionAllowsAccess({ status: "ACTIVE", adminOverride: false }, { status: "SUSPENDED" }), false); assert.strictEqual(subscriptionAllowsAccess({ status: "PAST_DUE", adminOverride: true }, { status: "ACTIVE" }), true); console.log("All COSMIC SaaS tenant security tests passed.");