fix: separate Fifth Domain source deployment identities

server-tools/lake-lamp-authz/deployment-event.test.js

@@ -5,6 +5,29 @@ const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
 const { enqueueDeploymentEvent } = require("./deployment-event");
+const personalSource = {
+  repository_id: "REPO-008",
+  channel_id: "HLP-CHANNEL-0001",
+  distribution: "personal",
+  owner_id: "ICE-GL∞",
+};
+const registry = {
+  "bingshuo/hololake-platform": {
+    repo_url: "https://example.invalid/hololake-platform.git",
+    deployment_policy: {
+      profiles: [{
+        repository_id: "REPO-008",
+        channel_id: "HLP-CHANNEL-0001",
+        distribution: "personal",
+        source_owner_id: "ICE-GL∞",
+        allowed_authorizers: ["ICE-GL∞"],
+        allowed_personas: ["ICE-GL-ZY001"],
+        allowed_execution_runtimes: ["SYS-GLW-ZY-EXEC-0001"],
+        allowed_targets: ["JD-FD-PRIMARY"],
+      }],
+    },
+  },
+};
 test("only an immutable deployment intent creates a resident-agent event", () => {
   const queue = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-deploy-events-"));
   const sha = "a".repeat(40), push = { repo: "bingshuo/guanghu-ice-heart", branch: "main", commit_sha: sha };
@@ -15,3 +38,47 @@ test("only an immutable deployment intent creates a resident-agent event", () =>
     assert.equal(enqueueDeploymentEvent({ schema: "guanghu.deployment-intent/v1", repo: push.repo, branch: "main", commit_sha: sha, resource: `GLS-0239-DEPLOY@${"b".repeat(40)}`, manifest: "deployment/requests/GLS-0239.json" }, push, queue).diagnostic_code, "deployment_intent_resource_invalid");
   } finally { fs.rmSync(queue, { recursive: true, force: true }); }
 });
+test("team personas cannot dispatch Ice Shuo personal source", () => {
+  const queue = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-personal-source-"));
+  const sha = "a".repeat(40);
+  const push = { repo: "bingshuo/hololake-platform", branch: "main", commit_sha: sha };
+  const intent = {
+    schema: "guanghu.deployment-intent/v1",
+    repo: push.repo,
+    branch: push.branch,
+    commit_sha: sha,
+    resource: `HLP-PERSONAL-DEPLOY@${sha}`,
+    manifest: "deployment/requests/HLP-PERSONAL.json",
+    deployment_source: personalSource,
+  };
+  try {
+    const rejected = enqueueDeploymentEvent(intent, push, queue, {
+      persona_id: "AGE-TEAM-001",
+      authorizer_id: "ICE-GL∞",
+      execution_runtime_id: "SYS-GLW-ZY-EXEC-0001",
+      target: "JD-FD-PRIMARY",
+      registry,
+    });
+    assert.equal(rejected.state, "rejected");
+    assert.equal(rejected.diagnostic_code, "deployment_persona_not_allowed");
+    assert.equal(fs.readdirSync(queue).length, 0);
+
+    const allowed = enqueueDeploymentEvent(intent, push, queue, {
+      authorizer_id: "ICE-GL∞",
+      persona_id: "ICE-GL-ZY001",
+      execution_runtime_id: "SYS-GLW-ZY-EXEC-0001",
+      target: "JD-FD-PRIMARY",
+      registry,
+    });
+    assert.equal(allowed.state, "queued_for_resident_agent");
+
+    const humanCannotPoseAsPersona = enqueueDeploymentEvent(intent, push, queue, {
+      authorizer_id: "ICE-GL∞",
+      persona_id: "ICE-GL∞",
+      execution_runtime_id: "SYS-GLW-ZY-EXEC-0001",
+      target: "JD-FD-PRIMARY",
+      registry,
+    });
+    assert.equal(humanCannotPoseAsPersona.diagnostic_code, "deployment_persona_not_allowed");
+  } finally { fs.rmSync(queue, { recursive: true, force: true }); }
+});