feat: add node-signed system body write admission

server-tools/bingshuo-system-write-admission/write-admission.test.js

@@ -0,0 +1,63 @@
+"use strict";
+const assert = require("node:assert/strict");
+const crypto = require("node:crypto");
+const test = require("node:test");
+const { canonicalRequest, evaluateWriteAdmission } = require("./write-admission");
+
+function rawPublic(key) {
+  return key.export({ format: "der", type: "spki" }).subarray(-32).toString("hex");
+}
+
+function fixture() {
+  const keys = crypto.generateKeyPairSync("ed25519");
+  const nodeRegistry = { nodes: [{
+    node_id: "TEST-NODE-001", state: "ACTIVE", persona_ids: ["ICE-P-ZY001"],
+    allowed_targets: ["BS-TCS-SYSTEM-BODY-ORGAN-MAP-001"], allowed_actions: ["UPDATE_REGISTERED_RULE"],
+    transport_keys: [{ key_id: "TEST-KEY-001", state: "ACTIVE", algorithm: "Ed25519", public_key_hex: rawPublic(keys.publicKey) }]
+  }] };
+  const request = {
+    schema: "guanghu.bingshuo-system-node-write-request/v1",
+    node_id: "TEST-NODE-001", key_id: "TEST-KEY-001", issued_at_unix: 1786363200,
+    nonce: "0123456789abcdef0123456789abcdef", persona_id: "ICE-P-ZY001",
+    authorization_receipt_id: "LANG-AUTH-TEST-001", language_event_id: "LANG-EVENT-TEST-001",
+    target: "BS-TCS-SYSTEM-BODY-ORGAN-MAP-001", action: "UPDATE_REGISTERED_RULE",
+    sealed_payload_sha256: "ab".repeat(32)
+  };
+  const envelope = {
+    schema: "guanghu.bingshuo-system-node-write-envelope/v1",
+    request,
+    node_signature_base64url: crypto.sign(null, canonicalRequest(request), keys.privateKey).toString("base64url")
+  };
+  return { envelope, keys, nodeRegistry };
+}
+
+test("a registered node signature is the first admission fact", () => {
+  const { envelope, nodeRegistry } = fixture();
+  const allowed = evaluateWriteAdmission(envelope, { nodeRegistry, nowUnix: 1786363200 });
+  assert.equal(allowed.decision, "ENTER_WHOLE_BODY_REVIEW");
+  assert.equal(allowed.origin_node_id, "TEST-NODE-001");
+  assert.match(allowed.next_gate, /VALIDATE_LANGUAGE_AUTHORIZATION_RECEIPT/);
+  assert.equal(evaluateWriteAdmission(envelope, { nodeRegistry: { nodes: [] }, nowUnix: 1786363200 }).error_code, "ORIGIN_NODE_NOT_REGISTERED");
+});
+
+test("root-like possession without the node protocol key is noise", () => {
+  const { envelope, nodeRegistry } = fixture();
+  envelope.node_signature_base64url = "A".repeat(86);
+  const decision = evaluateWriteAdmission(envelope, { nodeRegistry, nowUnix: 1786363200 });
+  assert.equal(decision.error_code, "ORIGIN_NODE_SIGNATURE_INVALID");
+  assert.equal(decision.invoke_model, false);
+  assert.equal(decision.activate_protocols, false);
+  assert.equal(decision.open_sealed_payload, false);
+  assert.equal(decision.persist_request_body, false);
+});
+
+test("registered persona, node binding, authorization receipt and replay gate all fail closed", () => {
+  const first = fixture();
+  first.envelope.request.persona_id = "CHENGLU-AGENT-001";
+  first.envelope.node_signature_base64url = crypto.sign(null, canonicalRequest(first.envelope.request), first.keys.privateKey).toString("base64url");
+  assert.equal(evaluateWriteAdmission(first.envelope, { nodeRegistry: first.nodeRegistry, nowUnix: 1786363200 }).error_code, "PERSONA_NOT_BOUND_TO_ORIGIN_NODE");
+  const second = fixture();
+  const replay = new Set();
+  assert.equal(evaluateWriteAdmission(second.envelope, { nodeRegistry: second.nodeRegistry, replayCache: replay, nowUnix: 1786363200 }).decision, "ENTER_WHOLE_BODY_REVIEW");
+  assert.equal(evaluateWriteAdmission(second.envelope, { nodeRegistry: second.nodeRegistry, replayCache: replay, nowUnix: 1786363200 }).error_code, "NODE_REQUEST_REPLAYED");
+});