bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix(deploy): allow declared Guanghu service state

Browse source
This commit is contained in:
冰朔 2026-08-06 13:38:31 +08:00
commit b00ef1f5fb
4 changed files with 71 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

25
server-tools/lake-lamp-authz/architecture-provision-broker.test.js
View file

@ -52,6 +52,31 @@ test("unit permits a declared persona user, shared secret and state directory",
assert.throws(() => validateUnit(unit.replaceAll("kezhou", "root"), "root", policy), /dedicated_service_user_required/);
});
test("existing service update permits only declared Guanghu state and secret paths", () => {
const unit = `[Service]
User=guanghu-authz
Group=guanghu-authz
WorkingDirectory=/opt/guanghu/lake-lamp-authz
ExecStart=/usr/bin/node /opt/guanghu/lake-lamp-authz/server.js
EnvironmentFile=/etc/guanghu/secrets/lake-lamp/authorization.env
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/opt/guanghu/lake-lamp-authz
ReadWritePaths=/var/lib/guanghu/lake-lamp-authz -/var/lib/guanghu/deployment-events
`;
const policy = {
environment_files: ["/etc/guanghu/secrets/lake-lamp/authorization.env"],
writable_paths: ["/var/lib/guanghu/lake-lamp-authz", "/var/lib/guanghu/deployment-events"],
};
assert.equal(validateUpdateUnit(unit, "guanghu-authz", "/opt/guanghu/lake-lamp-authz", policy), unit);
assert.throws(
() => validateUpdateUnit(unit.replace("/var/lib/guanghu/lake-lamp-authz", "/etc/systemd/system"), "guanghu-authz", "/opt/guanghu/lake-lamp-authz", policy),
/writable_path_not_declared/,
);
});
test("AI discovery update package declares all four route maps and passes the existing-service policy", () => {
const root = path.resolve(__dirname, "../..");
const request = JSON.parse(fs.readFileSync(path.join(root, "deployment", "requests", "AI-DISCOVERY-ICE-P-ROUTE-20260727.json")));