bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(authz): require email approval for native layout signing

Browse source
This commit is contained in:
冰朔 2026-08-03 00:00:04 +08:00
commit a385249819
5 changed files with 92 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
server-tools/lake-lamp-authz/workorder-manager.test.js
View file

@ -31,6 +31,10 @@ test("approval link is single use and the session is claimed once", () => {
const claimed = manager.claim(created.id, created.claimToken, 104);
assert.equal(claimed.ok, true);
assert.equal(claimed.expiresIn, 3600);
assert.equal(
manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-login", "read-navigation-map", 106).session.approvalChannel,
"email",
);
assert.equal(manager.claim(created.id, created.claimToken, 105).ok, false);
assert.equal(manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-login", "read-navigation-map", 106).ok, true);
assert.equal(manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-login", "inspect-services", 106).ok, true);
@ -169,7 +173,12 @@ test("a broadcast console lists and approves only its bound pending cards", () =
assert.equal(manager.approveById(first.id, "awen", 102).reason, "authorizer_mismatch");
assert.equal(manager.approveById(first.id, "owner", 102).ok, true);
assert.equal(manager.pendingForApprover("owner", 103).length, 0);
assert.equal(manager.claim(first.id, first.claimToken, 104).ok, true);
const claimed = manager.claim(first.id, first.claimToken, 104);
assert.equal(claimed.ok, true);
assert.equal(
manager.verifySession(claimed.sessionToken, persona, "JD-FD-PRIMARY", "server-login", "read-navigation-map", 105).session.approvalChannel,
"guanghu_router",
);
});
test("session cannot switch an approved architecture resource", () => {