Files
aml/pkg/screen/published_test.go
T
zeekayandHanzo Dev 644d8be410 wire the engine to one screening store, and serve the catalog
The refresh filled a Base-backed sanctions store and the search endpoint queried
a separate empty in-memory one. Neither was reachable from the other, so
/v1/aml/sanctions/search returned no matches for every name, permanently, and
nothing in the system reported it. There is now one store, shared by the
endpoints and by the engine's screening term.

Screening refuses rather than reports clean. An unloaded or stale list set, a
list that parsed to zero entries, or a class the deployment cannot answer all
produce an error, which the engine turns into a review. Political exposure is
refused outright: there is no authoritative public list of politically exposed
persons and none of the four sanctions publishers is one, so answering from
sanctions data would report every customer as not politically exposed.

Each publisher is fetched and parsed by its own parser, and a failure for one
leaves the other three loaded rather than clearing them.

Transactions carry a direction and the customer's name and jurisdiction. The
previous ingestion path synthesised a customer from the identifier alone, so
every screening and jurisdiction rule evaluated against an empty name and an
empty country and could not fire whatever the engine did.

Case events check that the case belongs to the requesting organisation. A case
identifier is returned to whoever submitted the transaction, so possession of it
was authority to write on another tenant's investigation.

Health reports function rather than process: whether the lists are ready, which
loaded when, and how many terms this deployment can answer. Currency rates and
the higher-risk jurisdiction listing are loaded, never compiled in.

/v1/aml/catalog publishes the rules with their citations, the obligations claimed,
and the obligations outstanding.

Screening 31,338 real designations across the four published lists produced two
false positives, both a one-word list entry matching an unrelated three-part name
on a shared prefix. Raising the threshold could not separate them from genuine
transliterations, which score lower; the asymmetry could. A single-token name now
has to match a multi-token name near-exactly. Zero false positives after.

Co-authored-by: Hanzo Dev <[email protected]>
2026-07-29 11:17:45 -07:00

102 lines
3.1 KiB
Go

package screen
import (
"context"
"os"
"path/filepath"
"testing"
"time"
"github.com/luxfi/aml/pkg/engine"
"github.com/luxfi/aml/pkg/sanctions"
)
// TestScreenAgainstPublishedLists loads the real published files into the store and
// screens against them, which is the only way to show that the whole path works:
// parse, load, readiness, match.
func TestScreenAgainstPublishedLists(t *testing.T) {
dir := os.Getenv("AML_LISTS")
if dir == "" {
t.Skip("set AML_LISTS to a directory of published list files to run")
}
s := New(0, nil)
for _, c := range []struct {
file string
src string
parse func([]byte) ([]sanctions.Entry, error)
}{
{"sdn.xml", sanctions.OFAC, sanctions.ParseOFAC},
{"un.xml", sanctions.UN, sanctions.ParseUN},
{"eu.xml", sanctions.EU, sanctions.ParseEU},
{"ofsi.csv", sanctions.OFSI, sanctions.ParseOFSI},
} {
data, err := os.ReadFile(filepath.Join(dir, c.file))
if err != nil {
t.Skipf("%v", err)
}
entries, err := c.parse(data)
if err != nil {
t.Fatalf("%s: %v", c.file, err)
}
if err := s.Load(c.src, entries); err != nil {
t.Fatalf("%s: %v", c.src, err)
}
}
if err := s.Ready(); err != nil {
t.Fatalf("the store must be ready with four lists loaded: %v", err)
}
t.Logf("loaded %d designated subjects across %d lists", s.Len(), len(s.Sources()))
// A designated subject must be found. This name is on the UN consolidated list
// and is the case the previous engine could not detect under any circumstances.
hit, err := s.Hit(context.Background(), "Eric Badege", engine.ClassSanctions)
if err != nil {
t.Fatalf("screening failed: %v", err)
}
if !hit.Matched {
t.Fatal("a designated subject must be found in the loaded lists")
}
t.Logf("designated subject matched: list=%s ref=%s score=%.3f name=%q",
hit.List, hit.EntryID, hit.Score, hit.Name)
// A name that is not designated must not match, across the whole loaded set.
for _, clean := range []string{"Jonathan Micklethwaite Harbourne", "Priya Venkataraman Rao"} {
hit, err := s.Hit(context.Background(), clean, engine.ClassSanctions)
if err != nil {
t.Fatalf("screening %q failed: %v", clean, err)
}
if hit.Matched {
t.Errorf("%q matched %q on %s at %.3f — a false positive against the full list set",
clean, hit.Name, hit.List, hit.Score)
}
}
// A designated blockchain address must be found by exact match.
var probe sanctions.Document
s.mu.RLock()
for _, e := range s.entries {
if ch := e.Chains(); len(ch) > 0 {
probe = ch[0]
break
}
}
s.mu.RUnlock()
if probe.Number == "" {
t.Fatal("the loaded lists must carry at least one designated blockchain address")
}
m, err := s.Chain(probe.Number)
if err != nil || len(m) == 0 {
t.Fatalf("designated address %s (%s) must match: %d matches, err %v", probe.Number, probe.Chain, len(m), err)
}
t.Logf("designated address matched: chain=%s subject=%q", probe.Chain, m[0].Entry.PrimaryName())
// And a nearby address must not.
altered := probe.Number[:len(probe.Number)-1] + "Z"
if m, _ := s.Chain(altered); len(m) != 0 {
t.Errorf("an altered address must not match: %s", altered)
}
_ = time.Now
}