bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix(authz): allow approved deployment dispatch

Browse source
This commit is contained in:
冰朔 2026-08-06 12:54:13 +08:00
commit 3acf4a1504
3 changed files with 17 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
server-tools/lake-lamp-authz/install-architecture-provisioner.sh
View file

@ -103,7 +103,7 @@ install -m 0644 "$script_dir/lake-lamp-authz.service" /etc/systemd/system/lake-l
install -m 0644 "$script_dir/lake-lamp-architecture-provision.service" /etc/systemd/system/lake-lamp-architecture-provision.service install -m 0644 "$script_dir/lake-lamp-architecture-provision.service" /etc/systemd/system/lake-lamp-architecture-provision.service
install -m 0644 "$script_dir/lake-lamp-deployment-event-worker.service" /etc/systemd/system/lake-lamp-deployment-event-worker.service install -m 0644 "$script_dir/lake-lamp-deployment-event-worker.service" /etc/systemd/system/lake-lamp-deployment-event-worker.service
install -d -m 0700 "$state_root" install -d -m 0700 "$state_root"
install -d -m 0750 /var/lib/guanghu/deployment-events install -d -m 0770 -o root -g guanghu-authz /var/lib/guanghu/deployment-events
install -d -m 0700 /var/lib/guanghu/deployment-events/receipts install -d -m 0700 /var/lib/guanghu/deployment-events/receipts
install -d -m 0755 /opt/guanghu/architecture-releases install -d -m 0755 /opt/guanghu/architecture-releases
install -d -m 0755 /etc/guanghu/lake-lamp install -d -m 0755 /etc/guanghu/lake-lamp

15
server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
View file

@ -13,6 +13,10 @@ const architectureProvisionUnit = fs.readFileSync(
path.join(__dirname, "lake-lamp-architecture-provision.service"), path.join(__dirname, "lake-lamp-architecture-provision.service"),
"utf8", "utf8",
); );
const authorizationUnit = fs.readFileSync(
path.join(__dirname, "lake-lamp-authz.service"),
"utf8",
);
test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => { test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => {
for (const file of [ for (const file of [
@ -58,3 +62,14 @@ test("architecture provision broker can update the registered AI discovery servi
/^ReadWritePaths=.*\/opt\/guanghu\/ai-discovery(?:\s|$)/m, /^ReadWritePaths=.*\/opt\/guanghu\/ai-discovery(?:\s|$)/m,
); );
}); });
test("authorization service can enqueue an approved deployment event", () => {
assert.match(
authorizationUnit,
/^ReadWritePaths=.*\/var\/lib\/guanghu\/deployment-events(?:\s|$)/m,
);
assert.match(
source,
/install -d -m 0770 -o root -g guanghu-authz \/var\/lib\/guanghu\/deployment-events/,
);
});

2
server-tools/lake-lamp-authz/lake-lamp-authz.service
View file

@ -16,7 +16,7 @@ NoNewPrivileges=true
PrivateTmp=true PrivateTmp=true
ProtectSystem=strict ProtectSystem=strict
ProtectHome=true ProtectHome=true
ReadWritePaths=/var/lib/guanghu/lake-lamp-authz /var/lib/guanghu/repo-authorizations /var/lib/guanghu/repo-push-uploads /var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git -/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/hololake-knowledge-base.git ReadWritePaths=/var/lib/guanghu/lake-lamp-authz /var/lib/guanghu/repo-authorizations /var/lib/guanghu/repo-push-uploads /var/lib/guanghu/deployment-events /var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git -/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/hololake-knowledge-base.git
ReadOnlyPaths=-/etc/guanghu/secrets/hololake-ai-providers.json ReadOnlyPaths=-/etc/guanghu/secrets/hololake-ai-providers.json
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
LockPersonality=true LockPersonality=true