absec-assert

Production test assertions for authz, cookies, and security headers — by Agent Breach.

Encode “user B cannot read user A’s order” as a failing unit test. Complements Agent Breach DAST. No account required.

60-second win

npm i -D @agentbreach/absec-assert

import { expectAccessMatrix, expectNoIdor, expectSecureCookies } from "@agentbreach/absec-assert";

const alice = { name: "alice", request: (path) => apiAs("alice", path) };
const bob = { name: "bob", request: (path) => apiAs("bob", path) };

await expectAccessMatrix({
  actors: [alice, bob],
  cases: [
    { actor: "alice", action: "read", path: "/orders/1", expect: "allow" },
    { actor: "bob", action: "read", path: "/orders/1", expect: "deny" },
  ],
});

await expectNoIdor({
  ownerClient: alice,
  otherClient: bob,
  resourceId: "1",
  urlForId: (id) => `/orders/${id}`,
});

API

• expectAccessMatrix — actor × action table
• expectNoIdor — owner vs other on same id
• expectSecureCookies — HttpOnly / Secure / SameSite
• expectSecurityHeaders — baseline or strict (via @agentbreach/absec-core)
• expectWeakPasswordRejected — registration probe
• AbsecAssertionError — ruleId, expected, received for CI logs

Adapters: fetch-like and Supertest/superagent response shapes.

Safety

Use only against local / staging apps you own. Do not point at production with real credentials.

License

Apache-2.0 © Agent Breach