fix: fail closed without a repo push transport

server-tools/lake-lamp-authz/authorize-repo-push.test.js

@@ -8,6 +8,13 @@ const path = require("node:path");
 const { createApp } = require("./server");
 const { authorizeRepoPush } = require("./authorize-repo-push");
 
+function response(status, body) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
 test("repo-push helper stops with a server receipt when no safe transport is deployed", async () => {
   const mail = [];
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-repo-push-"));
@@ -56,3 +63,41 @@ test("repo-push helper stops with a server receipt when no safe transport is dep
     fs.rmSync(directory, { recursive: true, force: true });
   }
 });
+
+test("repo-push helper fails closed when an older server omits transport state", async () => {
+  const calls = [];
+  const grantPromise = authorizeRepoPush({
+    url: "https://example.invalid/authz",
+    persona: "ICE-GL-ZY001",
+    repo: "bingshuo/guanghu-ice-heart",
+    poll: 1,
+  }, {
+    sleep: async () => {},
+    output: line => calls.push(line),
+    fetch: async url => {
+      if (url.endsWith("/api/public/workorders")) {
+        return response(200, {
+          request_url: "https://example.invalid/authz/request/opaque",
+          workorder_id: "workorder",
+          claim_token: "claim",
+          expires_in: 60,
+        });
+      }
+      if (url.endsWith("/claim")) return response(200, { session_token: "session" });
+      if (url.endsWith("/api/navigation-map/read")) return response(200, { map_hash: "map" });
+      if (url.endsWith("/api/navigation-map/ack")) return response(200, { ok: true });
+      if (url.endsWith("/api/repo-push/grant")) {
+        return response(200, {
+          ok: true,
+          repo: "bingshuo/guanghu-ice-heart",
+          receipt: { diagnostic_code: "repo_push_transport_unavailable" },
+        });
+      }
+      throw new Error(`unexpected URL: ${url}`);
+    },
+  });
+
+  await assert.rejects(grantPromise, /repo_push_transport_unavailable/);
+  assert.ok(calls.some(line => line.includes("LL-REPO-PUSH-TRANSPORT-BLOCKED")));
+  assert.ok(calls.some(line => line.includes("禁止重试裸 git push")));
+});