bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix: add bounded JD code-channel auth inspection

Browse source
This commit is contained in:
冰朔 2026-07-26 14:23:47 +08:00
commit 928a6ddb2c
4 changed files with 50 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

25
server-tools/lake-lamp-authz/action-broker.js
View file

@ -7,14 +7,29 @@ const { execFile } = require("node:child_process");
const SOCKET_PATH = process.env.LAKE_LAMP_ACTION_SOCKET || "/run/guanghu/action-broker.sock";
const SSH_CONFIG = process.env.LAKE_LAMP_SSH_CONFIG || "/etc/guanghu/action-broker-ssh-config";
const ACTIONS = Object.freeze({
"JD-FD-PRIMARY:inspect-services": () => run("/usr/bin/ssh", [
const REMOTE_COMMANDS = Object.freeze({
"JD-FD-PRIMARY:inspect-services":
"printf 'HOST='; hostname; printf 'SSH='; systemctl is-active ssh 2>/dev/null || systemctl is-active sshd 2>/dev/null; printf 'LIGHTHOUSE='; systemctl is-active guanghu-enterprise-lighthouse.service 2>/dev/null || true",
"JD-FD-PRIMARY:health-check":
"set -u; printf 'HOST='; hostname; printf 'HLCC='; systemctl is-active hlcc-jd-candidate.service 2>/dev/null || true; printf 'HLCC_HTTP='; curl -fsS --max-time 5 http://127.0.0.1:3340/api/healthz 2>/dev/null || printf 'unavailable\\n'; printf 'LIGHTHOUSE='; systemctl is-active guanghu-enterprise-lighthouse.service 2>/dev/null || true",
"JD-FD-PRIMARY:inspect-code-channel-owner-auth":
"set -eu; state=/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1; db=\"$state/data/hlcc.db\"; config=\"$state/config/app.ini\"; printf 'HOST='; hostname; printf 'HLCC='; systemctl is-active hlcc-jd-candidate.service 2>/dev/null || true; printf 'DB_PRESENT='; test -f \"$db\" && printf 'yes\\n' || printf 'no\\n'; printf 'CONFIG_PRESENT='; test -f \"$config\" && printf 'yes\\n' || printf 'no\\n'; test -f \"$db\"; /usr/bin/sqlite3 -readonly -header -separator '|' \"$db\" \"select lower_name,is_active,is_admin,prohibit_login,login_type,passwd_hash_algo,length(passwd) as passwd_length,length(salt) as salt_length,updated_unix from user where lower_name='bingshuo';\"; /usr/bin/sqlite3 -readonly -header -separator '|' \"$db\" \"select lower_name,name,website,is_private,is_empty,default_branch,updated_unix from repository where lower_name in ('fifth-domain','guanghu-ice-heart') order by lower_name;\""
});
function remoteAction(command) {
return () => run("/usr/bin/ssh", [
"-F", SSH_CONFIG,
"-o", "BatchMode=yes",
"-o", "ConnectTimeout=10",
"enterprise-lighthouse",
"printf 'HOST='; hostname; printf 'SSH='; systemctl is-active ssh 2>/dev/null || systemctl is-active sshd 2>/dev/null; printf 'LIGHTHOUSE='; systemctl is-active guanghu-enterprise-lighthouse.service 2>/dev/null || true"
])
command,
]);
}
const ACTIONS = Object.freeze({
"JD-FD-PRIMARY:inspect-services": remoteAction(REMOTE_COMMANDS["JD-FD-PRIMARY:inspect-services"]),
"JD-FD-PRIMARY:health-check": remoteAction(REMOTE_COMMANDS["JD-FD-PRIMARY:health-check"]),
"JD-FD-PRIMARY:inspect-code-channel-owner-auth": remoteAction(REMOTE_COMMANDS["JD-FD-PRIMARY:inspect-code-channel-owner-auth"]),
});
function run(file, args) {
@ -50,4 +65,4 @@ if (require.main === module) {
});
}
module.exports = { ACTIONS };
module.exports = { ACTIONS, REMOTE_COMMANDS };

23
server-tools/lake-lamp-authz/action-broker.test.js Normal file
View file

@ -0,0 +1,23 @@
"use strict";
const test = require("node:test");
const assert = require("node:assert/strict");
const { ACTIONS, REMOTE_COMMANDS } = require("./action-broker");
test("the JD action broker implements every read-only server-login action", () => {
assert.equal(typeof ACTIONS["JD-FD-PRIMARY:inspect-services"], "function");
assert.equal(typeof ACTIONS["JD-FD-PRIMARY:health-check"], "function");
assert.equal(typeof ACTIONS["JD-FD-PRIMARY:inspect-code-channel-owner-auth"], "function");
});
test("owner authentication inspection exposes state but never password material", () => {
const command = REMOTE_COMMANDS["JD-FD-PRIMARY:inspect-code-channel-owner-auth"];
assert.match(command, /is_active/);
assert.match(command, /prohibit_login/);
assert.match(command, /passwd_hash_algo/);
assert.match(command, /length\(passwd\)/);
assert.match(command, /length\(salt\)/);
assert.doesNotMatch(command, /select\s+passwd(?:\s|,)/i);
assert.doesNotMatch(command, /select\s+salt(?:\s|,)/i);
assert.doesNotMatch(command, /access_token|authorization|secret_key/i);
});

7
server-tools/lake-lamp-authz/server.js
View file

@ -10,7 +10,12 @@ const { sendSmtpMail } = require("./smtp-mailer");
const { executeRegisteredAction } = require("./action-client");
const DEFAULT_ACTIONS = Object.freeze({
"server-login": ["read-navigation-map", "inspect-services", "health-check"],
"server-login": [
"read-navigation-map",
"inspect-services",
"health-check",
"inspect-code-channel-owner-auth",
],
"server-ops": [
"read-navigation-map",
"inspect-services",