[HLCC-ICE-000001][ZY-CONTRIB-20260723-001] feat: 以来光者贡献链启用冰朔第五域个人子频道
This commit is contained in:
光湖代码频道 · 铸渊
commit
5615453e4e
660 changed files with 122355 additions and 0 deletions
158
server-tools/lake-lamp-authz/workorder-manager.test.js
Normal file
158
server-tools/lake-lamp-authz/workorder-manager.test.js
Normal file
|
|
@ -0,0 +1,158 @@
|
|||
"use strict";
|
||||
|
||||
const test = require("node:test");
|
||||
const assert = require("node:assert/strict");
|
||||
const fs = require("node:fs");
|
||||
const os = require("node:os");
|
||||
const path = require("node:path");
|
||||
const { WorkOrderManager } = require("./workorder-manager");
|
||||
|
||||
const persona = { pid: "ICE-GL-ZY001", name: "铸渊" };
|
||||
|
||||
test("defaults keep approval links and sessions alive for three hours", () => {
|
||||
const manager = new WorkOrderManager();
|
||||
assert.equal(manager.approvalTtl, 3 * 60 * 60);
|
||||
assert.equal(manager.sessionTtl, 3 * 60 * 60);
|
||||
assert.equal(manager.maxSessionLifetime, 24 * 60 * 60);
|
||||
});
|
||||
|
||||
test("approval link is single use and the session is claimed once", () => {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-authz-"));
|
||||
try {
|
||||
const manager = new WorkOrderManager({ stateFile: path.join(dir, "state.json"), sessionTtl: 3600 });
|
||||
const created = manager.request({ persona, target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map", allowedActions: ["read-navigation-map", "inspect-services"] }, 100);
|
||||
assert.equal(manager.inspectHandoff(created.handoffToken, 101).ok, true);
|
||||
const issued = manager.issueApproval(created.handoffToken, 101);
|
||||
assert.equal(issued.ok, true);
|
||||
assert.equal(manager.inspectApproval(issued.approvalToken, 101).ok, true);
|
||||
assert.equal(manager.approve(issued.approvalToken, 102).ok, true);
|
||||
assert.equal(manager.approve(issued.approvalToken, 103).ok, false);
|
||||
|
||||
const claimed = manager.claim(created.id, created.claimToken, 104);
|
||||
assert.equal(claimed.ok, true);
|
||||
assert.equal(claimed.expiresIn, 3600);
|
||||
assert.equal(manager.claim(created.id, created.claimToken, 105).ok, false);
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-login", "read-navigation-map", 106).ok, true);
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-login", "inspect-services", 106).ok, true);
|
||||
} finally {
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test("session is bound to one persona target scope and action", () => {
|
||||
const manager = new WorkOrderManager({ sessionTtl: 3600 });
|
||||
const created = manager.request({ persona, target: "BS-GZ-006", scope: "server-ops", action: "read-navigation-map" }, 100);
|
||||
const issued = manager.issueApproval(created.handoffToken, 101);
|
||||
manager.approve(issued.approvalToken, 101);
|
||||
const claimed = manager.claim(created.id, created.claimToken, 102);
|
||||
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "BS-GZ-006", "server-ops", "read-navigation-map", 103).ok, true);
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-ops", "read-navigation-map", 103).reason, "target_mismatch");
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, { pid: "OTHER" }, "BS-GZ-006", "server-ops", "read-navigation-map", 103).reason, "persona_mismatch");
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "BS-GZ-006", "repo-push", "read-navigation-map", 103).reason, "scope_mismatch");
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "BS-GZ-006", "server-ops", "push-repository", 103).reason, "action_mismatch");
|
||||
});
|
||||
|
||||
test("plaintext approval claim and session tokens are never persisted", () => {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-authz-"));
|
||||
try {
|
||||
const stateFile = path.join(dir, "state.json");
|
||||
const manager = new WorkOrderManager({ stateFile });
|
||||
const created = manager.request({ persona, target: "JD-FD-PRIMARY", scope: "repo-push", action: "push-repository" }, 100);
|
||||
const issued = manager.issueApproval(created.handoffToken, 101);
|
||||
manager.approve(issued.approvalToken, 101);
|
||||
const claimed = manager.claim(created.id, created.claimToken, 102);
|
||||
const state = fs.readFileSync(stateFile, "utf8");
|
||||
for (const secret of [created.handoffToken, issued.approvalToken, created.claimToken, claimed.sessionToken]) assert.equal(state.includes(secret), false);
|
||||
} finally {
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test("expired work orders and sessions fail closed", () => {
|
||||
const manager = new WorkOrderManager({ approvalTtl: 10, sessionTtl: 20 });
|
||||
const created = manager.request({ persona, target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map" }, 100);
|
||||
assert.equal(manager.issueApproval(created.handoffToken, 111).reason, "request_expired");
|
||||
|
||||
const fresh = manager.request({ persona, target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map" }, 200);
|
||||
const issued = manager.issueApproval(fresh.handoffToken, 201);
|
||||
manager.approve(issued.approvalToken, 201);
|
||||
const claimed = manager.claim(fresh.id, fresh.claimToken, 202);
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-login", "read-navigation-map", 223).reason, "session_expired");
|
||||
});
|
||||
|
||||
test("an active session renews without changing target scope or actions", () => {
|
||||
const manager = new WorkOrderManager({ sessionTtl: 100, maxSessionLifetime: 500 });
|
||||
const created = manager.request({ persona, target: "BS-SG-001", scope: "server-ops", action: "read-navigation-map", allowedActions: ["read-navigation-map", "health-check"] }, 100);
|
||||
const issued = manager.issueApproval(created.handoffToken, 101);
|
||||
manager.approve(issued.approvalToken, 101);
|
||||
const claimed = manager.claim(created.id, created.claimToken, 102);
|
||||
const renewed = manager.renewSession(claimed.sessionToken, persona, "BS-SG-001", "server-ops", 150);
|
||||
assert.equal(renewed.ok, true);
|
||||
assert.equal(renewed.expiresAt, 250);
|
||||
assert.equal(manager.renewSession(claimed.sessionToken, persona, "BS-SG-002", "server-ops", 160).reason, "target_mismatch");
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "BS-SG-001", "server-ops", "health-check", 249).ok, true);
|
||||
});
|
||||
|
||||
test("verified bound activity automatically renews without expanding authority", () => {
|
||||
const resource = `HLCC-STAGE@${"d".repeat(40)}`;
|
||||
const manager = new WorkOrderManager({ sessionTtl: 100, maxSessionLifetime: 500 });
|
||||
const created = manager.request({
|
||||
persona,
|
||||
target: "JD-FD-PRIMARY",
|
||||
scope: "server-ops",
|
||||
action: "provision-approved-architecture",
|
||||
resource,
|
||||
}, 100);
|
||||
const issued = manager.issueApproval(created.handoffToken, 101);
|
||||
manager.approve(issued.approvalToken, 101);
|
||||
const claimed = manager.claim(created.id, created.claimToken, 102);
|
||||
|
||||
const active = manager.verifySession(
|
||||
claimed.sessionToken,
|
||||
persona,
|
||||
"JD-FD-PRIMARY",
|
||||
"server-ops",
|
||||
"provision-approved-architecture",
|
||||
150,
|
||||
resource,
|
||||
);
|
||||
assert.equal(active.ok, true);
|
||||
assert.equal(active.autoRenewed, true);
|
||||
assert.equal(active.session.expiresAt, 250);
|
||||
assert.equal(manager.verifySession(
|
||||
claimed.sessionToken,
|
||||
persona,
|
||||
"JD-FD-PRIMARY",
|
||||
"server-ops",
|
||||
"provision-approved-architecture",
|
||||
160,
|
||||
`OTHER@${"e".repeat(40)}`,
|
||||
).reason, "resource_mismatch");
|
||||
});
|
||||
|
||||
test("public handoff can send one approval email and can recover from mail failure", () => {
|
||||
const manager = new WorkOrderManager({ approvalTtl: 60 });
|
||||
const created = manager.request({ persona, target: "JD-FD-PRIMARY", scope: "repo-push", action: "push-repository" }, 100);
|
||||
const first = manager.issueApproval(created.handoffToken, 101);
|
||||
assert.equal(first.ok, true);
|
||||
assert.equal(manager.issueApproval(created.handoffToken, 102).reason, "approval_email_already_sent");
|
||||
assert.equal(manager.failApprovalEmail(created.handoffToken), true);
|
||||
const retry = manager.issueApproval(created.handoffToken, 103);
|
||||
assert.equal(retry.ok, true);
|
||||
assert.notEqual(retry.approvalToken, first.approvalToken);
|
||||
assert.equal(manager.inspectApproval(first.approvalToken, 104).ok, false);
|
||||
assert.equal(manager.inspectApproval(retry.approvalToken, 104).ok, true);
|
||||
});
|
||||
|
||||
test("session cannot switch an approved architecture resource", () => {
|
||||
const resource = `GLS-0231-JD-LAN-01-INITIAL-PROVISION-20260720@${"b".repeat(40)}`;
|
||||
const manager = new WorkOrderManager({ sessionTtl: 3600 });
|
||||
const created = manager.request({ persona, target: "JD-FD-PRIMARY", scope: "server-ops", action: "provision-approved-architecture", resource }, 100);
|
||||
const issued = manager.issueApproval(created.handoffToken, 101);
|
||||
manager.approve(issued.approvalToken, 101);
|
||||
const claimed = manager.claim(created.id, created.claimToken, 102);
|
||||
assert.equal(claimed.resource, resource);
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-ops", "provision-approved-architecture", 103, resource).ok, true);
|
||||
assert.equal(manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-ops", "provision-approved-architecture", 103, `OTHER@${"c".repeat(40)}`).reason, "resource_mismatch");
|
||||
});
|
||||
Loading…
Reference in a new issue