[HLCC-ICE-000001][ZY-CONTRIB-20260723-001] feat: 以来光者贡献链启用冰朔第五域个人子频道

server-tools/deployment-receiver/test/receiver.test.js

@@ -0,0 +1,29 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const crypto = require("node:crypto");
+const test = require("node:test");
+const { collectChangedFiles, validManifestPath, validRequest, verifySignature } = require("../receiver");
+
+test("verifies Forgejo HMAC signatures", () => {
+  const secret = "a".repeat(32);
+  const body = Buffer.from('{"ok":true}');
+  const signature = crypto.createHmac("sha256", secret).update(body).digest("hex");
+  assert.equal(verifySignature(secret, body, signature), true);
+  assert.equal(verifySignature(secret, body, "0".repeat(64)), false);
+});
+
+test("accepts only safe manifest paths", () => {
+  assert.equal(validManifestPath("deployment/requests/REQ-001.json", "deployment/requests/"), true);
+  assert.equal(validManifestPath("deployment/requests/../../secret.json", "deployment/requests/"), false);
+  assert.equal(validManifestPath("deployment/requests/REQ 001.json", "deployment/requests/"), false);
+});
+
+test("rejects arbitrary command fields", () => {
+  assert.equal(validRequest({ request_id: "REQ-20260713-001", module: "gatekeeper", action: "inspect-gatekeeper", approved: true }), true);
+  assert.equal(validRequest({ request_id: "REQ-20260713-001", module: "gatekeeper", action: "inspect-gatekeeper", approved: true, cmd: "rm -rf /" }), false);
+});
+
+test("collects only added and modified files", () => {
+  assert.deepEqual(collectChangedFiles({ commits: [{ added: ["a"], modified: ["b"], removed: ["c"] }] }).sort(), ["a", "b"]);
+});