bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat(hlcc): dispatch approved deployments by explicit signal

Browse source
This commit is contained in:
冰朔 2026-07-26 15:36:14 +08:00
commit 5897eb6850
13 changed files with 270 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

39
server-tools/lake-lamp-authz/server.test.js
View file

@ -102,6 +102,21 @@ test("cross-device request is powerless until the owner asks for an email and ap
});
});
test("declared Work/mobile instance can notify the registered owner without a local credential", async () => {
await withServer(async ({ base, mail }) => {
const requested = await fetch(`${base}/api/public/workorders`, {
method: "POST", headers: { "content-type": "application/json" },
body: JSON.stringify({ system_entry: "光湖语言人格系统当前实例", origin_software: "Work", origin_model: "语言模型", origin_instance: "mobile-1", owner_notify: true, persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-ops", action: "dispatch-approved-deployment", resource: `GLS-0239-DEPLOY@${"a".repeat(40)}` }),
});
assert.equal(requested.status, 201);
const order = await requested.json();
assert.equal(order.status, "waiting_for_owner");
assert.equal(order.email_status, "sent");
assert.equal(mail.length, 1);
assert.match(mail[0].approvalUrl, /\/approve\//);
}, { actions: { "server-ops": ["read-navigation-map", "dispatch-approved-deployment"] } });
});
test("cross-device request creation is rate limited without revealing owner identity", async () => {
await withServer(async ({ base, mail }) => {
const payload = { persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map" };
@ -140,6 +155,7 @@ test("one server-ops approval exposes the full registered three-hour operation s
"push-repository",
"restore-owner-password-login",
"restore-code-channel-owner-login",
"dispatch-approved-deployment",
]);
} finally {
await new Promise(resolve => app.close(resolve));
@ -279,6 +295,29 @@ test("failed server actions return a durable diagnosis instead of making a perso
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
test("deployment is dispatched only by an explicit approved second signal", async () => {
const dir = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-deploy-dispatch-"));
const mapsDir = path.join(dir, "maps"); fs.mkdirSync(mapsDir);
fs.writeFileSync(path.join(mapsDir, "JD-FD-PRIMARY.json"), JSON.stringify({ node_id: "JD-FD-PRIMARY" }));
const sha = "a".repeat(40), resource = `GLS-0239-DEPLOY@${sha}`;
try {
await withServer(async ({ base, mail }) => {
const requested = await fetch(`${base}/api/public/workorders`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-ops", action: "dispatch-approved-deployment", resource }) });
const order = await requested.json();
await fetch(`${base}${new URL(order.request_url).pathname.replace("/authz", "")}`, { method: "POST" });
await fetch(`${base}${new URL(mail[0].approvalUrl).pathname.replace("/authz", "")}`, { method: "POST" });
const session = await (await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } })).json();
const common = { persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-ops" };
const map = await (await fetch(`${base}/api/navigation-map/read`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify(common) })).json();
await fetch(`${base}/api/navigation-map/ack`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, map_hash: map.map_hash }) });
const dispatch = await fetch(`${base}/api/deployment/dispatch`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, repo: "bingshuo/guanghu-ice-heart", branch: "main", commit_sha: sha, resource, manifest: "deployment/requests/GLS-0239.json" }) });
assert.equal(dispatch.status, 202);
assert.equal((await dispatch.json()).receipt.state, "queued");
assert.equal(fs.readdirSync(path.join(dir, "queue")).length, 1);
}, { mapsDir, mapStateFile: path.join(dir, "acks.json"), deploymentQueueDir: path.join(dir, "queue"), actions: { "server-ops": ["read-navigation-map", "dispatch-approved-deployment"] } });
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
test("request endpoint rejects direct email target switching and unknown actions", async () => {
await withServer(async ({ base }) => {
const common = { method: "POST", headers: { authorization: "Bearer request-only-secret", "content-type": "application/json" } };