314 lines
22 KiB
JavaScript
314 lines
22 KiB
JavaScript
"use strict";
|
|
|
|
const test = require("node:test");
|
|
const assert = require("node:assert/strict");
|
|
const crypto = require("node:crypto");
|
|
const fs = require("node:fs");
|
|
const os = require("node:os");
|
|
const path = require("node:path");
|
|
const { createApp } = require("./server");
|
|
|
|
async function withServer(run, extra = {}) {
|
|
const mail = [];
|
|
const app = createApp({
|
|
requestToken: "request-only-secret",
|
|
ownerEmail: "owner@example.invalid",
|
|
publicBaseUrl: "https://example.invalid/authz",
|
|
targets: ["JD-FD-PRIMARY", "BS-GZ-006"],
|
|
actions: { "server-login": ["read-navigation-map", "inspect-services"], "server-ops": ["read-navigation-map", "inspect-services"], "repo-push": ["read-navigation-map", "push-repository"] },
|
|
stateFile: "",
|
|
sendEmail: async (message) => { mail.push(message); return true; },
|
|
...extra,
|
|
});
|
|
await new Promise((resolve) => app.listen(0, "127.0.0.1", resolve));
|
|
const base = `http://127.0.0.1:${app.address().port}`;
|
|
try { await run({ base, mail }); } finally { await new Promise((resolve) => app.close(resolve)); }
|
|
}
|
|
|
|
test("work order sends an opaque approval link and can be claimed once", async () => {
|
|
await withServer(async ({ base, mail }) => {
|
|
const recipientFingerprint = crypto.createHash("sha256").update("owner@example.invalid").digest("hex");
|
|
const requested = await fetch(`${base}/api/workorders`, {
|
|
method: "POST",
|
|
headers: { authorization: "Bearer request-only-secret", "content-type": "application/json" },
|
|
body: JSON.stringify({ persona_id: "ICE-GL-ZY001", persona_name: "铸渊", target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map", recipient_fingerprint: recipientFingerprint }),
|
|
});
|
|
assert.equal(requested.status, 201);
|
|
const order = await requested.json();
|
|
assert.equal(mail.length, 1);
|
|
assert.equal(mail[0].to, "owner@example.invalid");
|
|
assert.doesNotMatch(JSON.stringify(order), /approvalToken/i);
|
|
|
|
const approvalPath = new URL(mail[0].approvalUrl).pathname.replace("/authz", "");
|
|
const page = await fetch(`${base}${approvalPath}`);
|
|
assert.equal(page.status, 200);
|
|
assert.match(await page.text(), /JD-FD-PRIMARY/);
|
|
|
|
const approved = await fetch(`${base}${approvalPath}`, { method: "POST" });
|
|
assert.equal(approved.status, 200);
|
|
const claimed = await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, {
|
|
method: "POST",
|
|
headers: { authorization: `Bearer ${order.claim_token}` },
|
|
});
|
|
assert.equal(claimed.status, 200);
|
|
const session = await claimed.json();
|
|
assert.equal(session.expires_in, 3 * 60 * 60);
|
|
|
|
const secondClaim = await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } });
|
|
assert.equal(secondClaim.status, 403);
|
|
});
|
|
});
|
|
|
|
test("cross-device request is powerless until the owner asks for an email and approves it", async () => {
|
|
await withServer(async ({ base, mail }) => {
|
|
const capabilities = await (await fetch(`${base}/api/public/capabilities`)).json();
|
|
assert.deepEqual(capabilities.required_fields, ["persona_id", "target", "scope", "action"]);
|
|
assert.ok(capabilities.scopes["repo-push"].includes("push-repository"));
|
|
assert.equal(capabilities.limits.create_per_network_per_hour, 24);
|
|
assert.equal(capabilities.limits.email_per_network_per_hour, 12);
|
|
assert.doesNotMatch(JSON.stringify(capabilities), /owner@example\.invalid/);
|
|
const requested = await fetch(`${base}/api/public/workorders`, {
|
|
method: "POST",
|
|
headers: { "content-type": "application/json", "x-forwarded-for": "198.51.100.8" },
|
|
body: JSON.stringify({ persona_id: "ICE-GL-ZY001", persona_name: "铸渊", target: "JD-FD-PRIMARY", scope: "repo-push", action: "push-repository", description: "mobile handoff" }),
|
|
});
|
|
assert.equal(requested.status, 201);
|
|
const order = await requested.json();
|
|
assert.equal(order.status, "waiting_for_owner_handoff");
|
|
assert.equal(mail.length, 0);
|
|
assert.match(order.request_url, /\/request\//);
|
|
assert.doesNotMatch(JSON.stringify(order), /approve\//);
|
|
|
|
const requestPath = new URL(order.request_url).pathname.replace("/authz", "");
|
|
const handoffPage = await fetch(`${base}${requestPath}`);
|
|
assert.equal(handoffPage.status, 200);
|
|
assert.match(await handoffPage.text(), /无权限申请单/);
|
|
|
|
const prematureClaim = await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } });
|
|
assert.equal(prematureClaim.status, 202);
|
|
|
|
const sendMail = await fetch(`${base}${requestPath}`, { method: "POST", headers: { "x-forwarded-for": "203.0.113.9" } });
|
|
assert.equal(sendMail.status, 200);
|
|
assert.equal(mail.length, 1);
|
|
assert.match(await sendMail.text(), /请打开邮箱完成批准/);
|
|
|
|
const approvalPath = new URL(mail[0].approvalUrl).pathname.replace("/authz", "");
|
|
const approved = await fetch(`${base}${approvalPath}`, { method: "POST" });
|
|
assert.equal(approved.status, 200);
|
|
const claimed = await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } });
|
|
assert.equal(claimed.status, 200);
|
|
assert.equal((await claimed.json()).expires_in, 3 * 60 * 60);
|
|
});
|
|
});
|
|
|
|
test("cross-device request creation is rate limited without revealing owner identity", async () => {
|
|
await withServer(async ({ base, mail }) => {
|
|
const payload = { persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map" };
|
|
for (let i = 0; i < 3; i += 1) {
|
|
const response = await fetch(`${base}/api/public/workorders`, { method: "POST", headers: { "content-type": "application/json", "x-forwarded-for": "spoofed, 198.51.100.20" }, body: JSON.stringify(payload) });
|
|
assert.equal(response.status, 201);
|
|
assert.doesNotMatch(await response.text(), /owner@example\.invalid/);
|
|
}
|
|
const blocked = await fetch(`${base}/api/public/workorders`, { method: "POST", headers: { "content-type": "application/json", "x-forwarded-for": "different-spoof, 198.51.100.20" }, body: JSON.stringify(payload) });
|
|
assert.equal(blocked.status, 429);
|
|
assert.equal(mail.length, 0);
|
|
}, { publicCreateLimit: 1, publicCreateGlobalLimit: 10 });
|
|
});
|
|
|
|
test("one server-ops approval exposes the full registered three-hour operation scope", async () => {
|
|
const app = createApp({
|
|
requestToken: "request-only-secret",
|
|
ownerEmail: "owner@example.invalid",
|
|
publicBaseUrl: "https://example.invalid/authz",
|
|
stateFile: "",
|
|
sendEmail: async () => true,
|
|
});
|
|
await new Promise(resolve => app.listen(0, "127.0.0.1", resolve));
|
|
try {
|
|
const base = `http://127.0.0.1:${app.address().port}`;
|
|
const capabilities = await (await fetch(`${base}/api/public/capabilities`)).json();
|
|
assert.deepEqual(capabilities.scopes["server-ops"], [
|
|
"read-navigation-map",
|
|
"inspect-services",
|
|
"pull-registered-repo",
|
|
"deploy-registered-service",
|
|
"restart-registered-service",
|
|
"health-check",
|
|
"rollback-registered-service",
|
|
"provision-approved-architecture",
|
|
"push-repository",
|
|
"restore-owner-password-login",
|
|
"restore-code-channel-owner-login",
|
|
]);
|
|
} finally {
|
|
await new Promise(resolve => app.close(resolve));
|
|
}
|
|
});
|
|
|
|
test("mail handoff allows at least three requests per network and refresh does not consume quota", async () => {
|
|
await withServer(async ({ base, mail }) => {
|
|
const source = { "x-forwarded-for": "198.51.100.42" };
|
|
for (let i = 0; i < 3; i += 1) {
|
|
const requested = await fetch(`${base}/api/public/workorders`, {
|
|
method: "POST", headers: { "content-type": "application/json" },
|
|
body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "repo-push", action: "push-repository" }),
|
|
});
|
|
const order = await requested.json();
|
|
const requestPath = new URL(order.request_url).pathname.replace("/authz", "");
|
|
assert.equal((await fetch(`${base}${requestPath}`, { method: "POST", headers: source })).status, 200);
|
|
assert.equal((await fetch(`${base}${requestPath}`, { method: "POST", headers: source })).status, 200);
|
|
}
|
|
assert.equal(mail.length, 3);
|
|
const fourth = await fetch(`${base}/api/public/workorders`, {
|
|
method: "POST", headers: { "content-type": "application/json" },
|
|
body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "repo-push", action: "push-repository" }),
|
|
});
|
|
const fourthOrder = await fourth.json();
|
|
const fourthPath = new URL(fourthOrder.request_url).pathname.replace("/authz", "");
|
|
assert.equal((await fetch(`${base}${fourthPath}`, { method: "POST", headers: source })).status, 429);
|
|
}, { publicMailLimit: 1 });
|
|
});
|
|
|
|
test("navigation map acknowledgement is mandatory before other registered actions", async () => {
|
|
const dir = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-server-map-"));
|
|
const mapsDir = path.join(dir, "maps"); fs.mkdirSync(mapsDir);
|
|
fs.writeFileSync(path.join(mapsDir, "JD-FD-PRIMARY.json"), JSON.stringify({ node_id: "JD-FD-PRIMARY", modules: [{ code: "JD-GTW-01" }] }));
|
|
try {
|
|
await withServer(async ({ base, mail }) => {
|
|
const fingerprint = crypto.createHash("sha256").update("owner@example.invalid").digest("hex");
|
|
const requested = await fetch(`${base}/api/workorders`, { method: "POST", headers: { authorization: "Bearer request-only-secret", "content-type": "application/json" }, body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map", recipient_fingerprint: fingerprint }) });
|
|
const order = await requested.json();
|
|
const approvalPath = new URL(mail[0].approvalUrl).pathname.replace("/authz", "");
|
|
await fetch(`${base}${approvalPath}`, { method: "POST" });
|
|
const claimed = await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } });
|
|
const session = await claimed.json();
|
|
const common = { persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login" };
|
|
const locked = await fetch(`${base}/api/session/verify`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, action: "inspect-services" }) });
|
|
assert.equal(locked.status, 423);
|
|
const mapResponse = await fetch(`${base}/api/navigation-map/read`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify(common) });
|
|
const map = await mapResponse.json();
|
|
const ack = await fetch(`${base}/api/navigation-map/ack`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, map_hash: map.map_hash }) });
|
|
assert.equal(ack.status, 200);
|
|
const unlocked = await fetch(`${base}/api/session/verify`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, action: "inspect-services" }) });
|
|
assert.equal(unlocked.status, 200);
|
|
}, { mapsDir, mapStateFile: path.join(dir, "acks.json") });
|
|
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
|
|
});
|
|
|
|
test("active session renewal preserves target and scope and extends the map acknowledgement", async () => {
|
|
const dir = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-renew-"));
|
|
const mapsDir = path.join(dir, "maps"); fs.mkdirSync(mapsDir);
|
|
fs.writeFileSync(path.join(mapsDir, "JD-FD-PRIMARY.json"), JSON.stringify({ node_id: "JD-FD-PRIMARY" }));
|
|
try {
|
|
await withServer(async ({ base, mail }) => {
|
|
const requested = await fetch(`${base}/api/public/workorders`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map" }) });
|
|
const order = await requested.json();
|
|
await fetch(`${base}${new URL(order.request_url).pathname.replace("/authz", "")}`, { method: "POST" });
|
|
await fetch(`${base}${new URL(mail[0].approvalUrl).pathname.replace("/authz", "")}`, { method: "POST" });
|
|
const session = await (await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } })).json();
|
|
const common = { persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login" };
|
|
const map = await (await fetch(`${base}/api/navigation-map/read`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify(common) })).json();
|
|
await fetch(`${base}/api/navigation-map/ack`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, map_hash: map.map_hash }) });
|
|
const expanded = await fetch(`${base}/api/session/renew`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, action: "health-check" }) });
|
|
assert.equal(expanded.status, 400);
|
|
const renewed = await fetch(`${base}/api/session/renew`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify(common) });
|
|
assert.equal(renewed.status, 200);
|
|
assert.equal((await renewed.json()).authority_expanded, false);
|
|
}, { mapsDir, mapStateFile: path.join(dir, "acks.json"), sessionTtl: 100, maxSessionLifetime: 500 });
|
|
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
|
|
});
|
|
|
|
test("registered action bridge executes only after session and map checks", async () => {
|
|
const dir = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-action-"));
|
|
const mapsDir = path.join(dir, "maps"); fs.mkdirSync(mapsDir);
|
|
fs.writeFileSync(path.join(mapsDir, "JD-FD-PRIMARY.json"), JSON.stringify({ node_id: "JD-FD-PRIMARY" }));
|
|
const calls = [];
|
|
try {
|
|
await withServer(async ({ base, mail }) => {
|
|
const requested = await fetch(`${base}/api/public/workorders`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map" }) });
|
|
const order = await requested.json();
|
|
const requestPath = new URL(order.request_url).pathname.replace("/authz", "");
|
|
await fetch(`${base}${requestPath}`, { method: "POST" });
|
|
const approvalPath = new URL(mail[0].approvalUrl).pathname.replace("/authz", "");
|
|
await fetch(`${base}${approvalPath}`, { method: "POST" });
|
|
const claimed = await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } });
|
|
const session = await claimed.json();
|
|
const common = { persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login", action: "inspect-services" };
|
|
const beforeAck = await fetch(`${base}/api/actions/execute`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify(common) });
|
|
assert.equal(beforeAck.status, 423);
|
|
const map = await (await fetch(`${base}/api/navigation-map/read`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify(common) })).json();
|
|
await fetch(`${base}/api/navigation-map/ack`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, map_hash: map.map_hash }) });
|
|
const forbidden = await fetch(`${base}/api/actions/execute`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify({ ...common, cmd: "id" }) });
|
|
assert.equal(forbidden.status, 400);
|
|
const executed = await fetch(`${base}/api/actions/execute`, { method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" }, body: JSON.stringify(common) });
|
|
assert.equal(executed.status, 200);
|
|
assert.deepEqual(calls, [{ action: "inspect-services", target: "JD-FD-PRIMARY" }]);
|
|
}, { mapsDir, mapStateFile: path.join(dir, "acks.json"), executeAction: async request => { calls.push(request); return { ok: true, stdout: "healthy" }; } });
|
|
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
|
|
});
|
|
|
|
test("request endpoint rejects direct email target switching and unknown actions", async () => {
|
|
await withServer(async ({ base }) => {
|
|
const common = { method: "POST", headers: { authorization: "Bearer request-only-secret", "content-type": "application/json" } };
|
|
const directEmail = await fetch(`${base}/api/workorders`, { ...common, body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login", action: "read-navigation-map", email: "attacker@example.invalid" }) });
|
|
assert.equal(directEmail.status, 400);
|
|
const unknown = await fetch(`${base}/api/workorders`, { ...common, body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-login", action: "shell" }) });
|
|
assert.equal(unknown.status, 400);
|
|
});
|
|
});
|
|
|
|
test("architecture provision request is bound to one immutable manifest and commit", async () => {
|
|
const actions = { "server-ops": ["read-navigation-map", "provision-approved-architecture"] };
|
|
const resource = `GLS-0231-JD-LAN-01-INITIAL-PROVISION-20260720@${"a".repeat(40)}`;
|
|
await withServer(async ({ base, mail }) => {
|
|
const missing = await fetch(`${base}/api/public/workorders`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-ops", action: "provision-approved-architecture" }) });
|
|
assert.equal(missing.status, 400);
|
|
assert.equal((await missing.json()).error, "immutable_architecture_resource_required");
|
|
const requested = await fetch(`${base}/api/public/workorders`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-ops", action: "provision-approved-architecture", resource }) });
|
|
const order = await requested.json();
|
|
await fetch(`${base}${new URL(order.request_url).pathname.replace("/authz", "")}`, { method: "POST" });
|
|
assert.equal(mail[0].order.resource, resource);
|
|
const approvalPath = new URL(mail[0].approvalUrl).pathname.replace("/authz", "");
|
|
assert.match(await (await fetch(`${base}${approvalPath}`)).text(), new RegExp(resource));
|
|
await fetch(`${base}${approvalPath}`, { method: "POST" });
|
|
const session = await (await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } })).json();
|
|
assert.equal(session.resource, resource);
|
|
}, { actions });
|
|
});
|
|
|
|
test("session verification rejects switching servers without new approval", async () => {
|
|
await withServer(async ({ base, mail }) => {
|
|
const fingerprint = crypto.createHash("sha256").update("owner@example.invalid").digest("hex");
|
|
const requested = await fetch(`${base}/api/workorders`, {
|
|
method: "POST", headers: { authorization: "Bearer request-only-secret", "content-type": "application/json" },
|
|
body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "BS-GZ-006", scope: "server-ops", action: "read-navigation-map", recipient_fingerprint: fingerprint }),
|
|
});
|
|
const order = await requested.json();
|
|
const approvalPath = new URL(mail[0].approvalUrl).pathname.replace("/authz", "");
|
|
await fetch(`${base}${approvalPath}`, { method: "POST" });
|
|
const claimed = await fetch(`${base}/api/workorders/${order.workorder_id}/claim`, { method: "POST", headers: { authorization: `Bearer ${order.claim_token}` } });
|
|
const session = await claimed.json();
|
|
const switched = await fetch(`${base}/api/session/verify`, {
|
|
method: "POST", headers: { authorization: `Bearer ${session.session_token}`, "content-type": "application/json" },
|
|
body: JSON.stringify({ persona_id: "ICE-GL-ZY001", target: "JD-FD-PRIMARY", scope: "server-ops", action: "read-navigation-map" }),
|
|
});
|
|
assert.equal(switched.status, 403);
|
|
assert.equal((await switched.json()).error, "target_mismatch");
|
|
});
|
|
});
|
|
|
|
test("server policy selects a member mailbox by persona target and scope", async () => {
|
|
await withServer(async ({ base, mail }) => {
|
|
const requested = await fetch(`${base}/api/public/workorders`, {
|
|
method: "POST", headers: { "content-type": "application/json" },
|
|
body: JSON.stringify({ persona_id: "AWEN-TECH", target: "JD-FD-PRIMARY", scope: "server-ops", action: "read-navigation-map" }),
|
|
});
|
|
const order = await requested.json();
|
|
const requestPath = new URL(order.request_url).pathname.replace("/authz", "");
|
|
assert.equal((await fetch(`${base}${requestPath}`, { method: "POST" })).status, 200);
|
|
assert.equal(mail[0].to, "awen@example.invalid");
|
|
}, { approvers: [
|
|
{ id: "owner", email: "owner@example.invalid", default: true, persona_ids: ["ICE-GL-ZY001"], targets: ["*"], scopes: ["*"] },
|
|
{ id: "awen", email: "awen@example.invalid", default: false, persona_ids: ["AWEN-TECH"], targets: ["JD-FD-PRIMARY"], scopes: ["server-ops"] },
|
|
] });
|
|
});
|