guanghu-ice-heart/server-tools/lake-lamp-authz/deployment-event-worker.test.js

"use strict";
const test = require("node:test");
const assert = require("node:assert/strict");
const fs = require("node:fs");
const os = require("node:os");
const path = require("node:path");
const { processOne } = require("./deployment-event-worker");
test("resident deployment agent consumes only an explicit immutable event and writes a receipt", async () => {
  const root = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-deploy-worker-")), queue = path.join(root, "queue"), receipts = path.join(root, "receipts"), sha = "a".repeat(40);
  fs.mkdirSync(queue); fs.writeFileSync(path.join(queue, "event.json"), JSON.stringify({ schema: "guanghu.deployment-event/v1", event_id: "event-1", state: "queued_for_resident_agent", repo: "bingshuo/guanghu-ice-heart", branch: "main", commit_sha: sha, workorder_id: "order-1", resource: `GLS-0239-DEPLOY@${sha}`, manifest: "deployment/requests/GLS-0239.json" }));
  try {
    const result = await processOne({ queueDir: queue, receiptsDir: receipts, registry: { "bingshuo/guanghu-ice-heart": { repo_url: "https://example.invalid/code.git" } }, provisionFn: async request => { assert.equal(request.resource, `GLS-0239-DEPLOY@${sha}`); return { ok: true, unit: "example.service" }; } });
    assert.equal(result.state, "DEPLOYED_AND_VERIFIED");
    assert.equal(JSON.parse(fs.readFileSync(path.join(receipts, "event-1.json"))).diagnostic_code, "deployment_succeeded");
  } finally { fs.rmSync(root, { recursive: true, force: true }); }
});
test("resident agent rechecks source ownership before deployment", async () => {
  const root = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-source-policy-"));
  const queue = path.join(root, "queue"), receipts = path.join(root, "receipts"), sha = "b".repeat(40);
  fs.mkdirSync(queue);
  fs.writeFileSync(path.join(queue, "event.json"), JSON.stringify({
    schema: "guanghu.deployment-event/v1",
    event_id: "event-personal-source",
    state: "queued_for_resident_agent",
    repo: "bingshuo/hololake-platform",
    branch: "main",
    commit_sha: sha,
    workorder_id: "order-2",
    resource: `HLP-PERSONAL-DEPLOY@${sha}`,
    manifest: "deployment/requests/HLP-PERSONAL.json",
    authorizer_id: "ICE-GL∞",
    persona_id: "AGE-TEAM-001",
    execution_runtime_id: "SYS-GLW-ZY-EXEC-0001",
    target: "JD-FD-PRIMARY",
    deployment_source: {
      repository_id: "REPO-008",
      channel_id: "HLP-CHANNEL-0001",
      distribution: "personal",
      owner_id: "ICE-GL∞",
    },
  }));
  let provisioned = false;
  try {
    const result = await processOne({
      queueDir: queue,
      receiptsDir: receipts,
      registry: {
        "bingshuo/hololake-platform": {
          repo_url: "https://example.invalid/hololake-platform.git",
          deployment_policy: {
            profiles: [{
              repository_id: "REPO-008",
              channel_id: "HLP-CHANNEL-0001",
              distribution: "personal",
              source_owner_id: "ICE-GL∞",
              allowed_authorizers: ["ICE-GL∞"],
              allowed_personas: ["ICE-GL-ZY001"],
              allowed_execution_runtimes: ["SYS-GLW-ZY-EXEC-0001"],
              allowed_targets: ["JD-FD-PRIMARY"],
            }],
          },
        },
      },
      provisionFn: async () => {
        provisioned = true;
        return { ok: true };
      },
    });
    assert.equal(result.state, "REJECTED");
    assert.equal(result.receipt.diagnostic_code, "deployment_persona_not_allowed");
    assert.equal(provisioned, false);
  } finally { fs.rmSync(root, { recursive: true, force: true }); }
});