bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[HLCC-ICE-000003] fix: recover code-channel owner login safely

Browse source
This commit is contained in:
冰朔 2026-07-26 15:02:01 +08:00
commit 100848e9e4
12 changed files with 235 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

16
server-tools/lake-lamp-authz/owner-access-broker.test.js
View file

@ -2,13 +2,25 @@
const assert = require("node:assert/strict");
const test = require("node:test");
const { execute, RESTORE_OWNER_PASSWORD_LOGIN } = require("./owner-access-broker");
const {
execute,
RESTORE_OWNER_PASSWORD_LOGIN,
RESTORE_CODE_CHANNEL_OWNER_LOGIN,
} = require("./owner-access-broker");
test("owner-access executor exposes one bounded recovery action", async () => {
test("owner-access executor keeps SSH and code-channel recovery distinct", async () => {
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /PasswordAuthentication yes/);
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /sshd -t/);
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /systemctl reload ssh/);
assert.doesNotMatch(RESTORE_OWNER_PASSWORD_LOGIN, /PermitRootLogin yes/);
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /legacy owner credential unavailable/);
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /pragma wal_checkpoint\(truncate\)/);
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /channel\.backup\(snapshot\)/);
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /prohibit_login=0/);
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /hlcc-jd-candidate\.service/);
assert.doesNotMatch(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /PasswordAuthentication/);
assert.match(require("node:fs").readFileSync(require.resolve("./owner-access-broker"), "utf8"), /150000/);
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "unknown" }), { ok: false, error: "action_not_registered" });
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-owner-password-login", cmd: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-code-channel-owner-login", shell: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
});