bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix(authz): allow registered AI discovery updates

Browse source
This commit is contained in:
冰朔 2026-08-06 12:43:34 +08:00
commit 91e7a17032
2 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
View file

@ -9,6 +9,10 @@ const source = fs.readFileSync(
path.join(__dirname, "install-architecture-provisioner.sh"), path.join(__dirname, "install-architecture-provisioner.sh"),
"utf8", "utf8",
); );
const architectureProvisionUnit = fs.readFileSync(
path.join(__dirname, "lake-lamp-architecture-provision.service"),
"utf8",
);
test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => { test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => {
for (const file of [ for (const file of [
@ -47,3 +51,10 @@ test("provider migration writes only a private registry and never prints API key
assert.doesNotMatch(source, /echo .*API_KEY/); assert.doesNotMatch(source, /echo .*API_KEY/);
assert.doesNotMatch(source, /printf .*API_KEY/); assert.doesNotMatch(source, /printf .*API_KEY/);
}); });
test("architecture provision broker can update the registered AI discovery service", () => {
assert.match(
architectureProvisionUnit,
/^ReadWritePaths=.*\/opt\/guanghu\/ai-discovery(?:\s|$)/m,
);
});

2
server-tools/lake-lamp-authz/lake-lamp-architecture-provision.service
View file

@ -15,7 +15,7 @@ NoNewPrivileges=true
PrivateTmp=true PrivateTmp=true
ProtectSystem=strict ProtectSystem=strict
ProtectHome=true ProtectHome=true
ReadWritePaths=/var/lib/guanghu/architecture-provision /opt/guanghu/architecture-releases /etc/systemd/system ReadWritePaths=/var/lib/guanghu/architecture-provision /opt/guanghu/architecture-releases /opt/guanghu/ai-discovery /etc/systemd/system
RuntimeDirectory=guanghu-architecture-provision RuntimeDirectory=guanghu-architecture-provision
RuntimeDirectoryMode=0755 RuntimeDirectoryMode=0755
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6