89 lines
2.9 KiB
JavaScript
89 lines
2.9 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import test from "node:test";
|
|
import {
|
|
ExecutionObserver,
|
|
REQUIRED_PROTOCOL_CHAIN,
|
|
} from "./execution-observer.mjs";
|
|
|
|
test("observes allowlisted Linux services through typed read-only requests", async () => {
|
|
const stateRoot = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "guanghu-execution-observer-"),
|
|
);
|
|
const calls = [];
|
|
const observer = new ExecutionObserver({
|
|
binaryPath: "/opt/guanghu/execution-bridge/current/guanghu-execution-bridge",
|
|
policyPath: "/opt/guanghu/execution-bridge/current/policy.json",
|
|
stateRoot,
|
|
services: ["guanghu-ai-discovery.service", "lake-lamp-authz.service"],
|
|
execute: async (program, argv) => {
|
|
const request = JSON.parse(
|
|
fs.readFileSync(argv[1], "utf8"),
|
|
);
|
|
calls.push({ program, argv, request });
|
|
return {
|
|
stdout: JSON.stringify({
|
|
schema: "guanghu.execution-receipt/v1",
|
|
request_id: request.request_id,
|
|
subject_id: request.subject_id,
|
|
target_node_id: request.target_node_id,
|
|
policy_id: "JD-FD-PRIMARY-READONLY-20260807",
|
|
action: request.action,
|
|
adapter: "LINUX_SYSTEMD_V1",
|
|
accepted: true,
|
|
command_exit_code: 0,
|
|
target_state_verified: true,
|
|
final_state: "PASS_100",
|
|
stdout: "active",
|
|
stderr: "",
|
|
rollback_checkpoint_id: null,
|
|
}),
|
|
stderr: "",
|
|
};
|
|
},
|
|
});
|
|
|
|
const projection = await observer.observe();
|
|
assert.equal(projection.state, "PASS_100");
|
|
assert.equal(projection.bridge_bound, 100);
|
|
assert.equal(projection.target_state_verified, 100);
|
|
assert.equal(projection.restart_allowed, false);
|
|
assert.equal(projection.arbitrary_shell, false);
|
|
assert.equal(calls.length, 2);
|
|
assert.equal(calls[0].argv[0], "execute");
|
|
assert.deepEqual(calls[0].request.protocol_chain, REQUIRED_PROTOCOL_CHAIN);
|
|
assert.equal(calls[0].request.action.kind, "service_status");
|
|
assert.equal(calls[0].request.authorization, null);
|
|
assert.equal(calls[0].request.rollback, null);
|
|
});
|
|
|
|
test("fails closed when the native receipt does not match the requested service", async () => {
|
|
const stateRoot = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "guanghu-execution-observer-"),
|
|
);
|
|
const observer = new ExecutionObserver({
|
|
binaryPath: "/bridge",
|
|
policyPath: "/policy",
|
|
stateRoot,
|
|
services: ["guanghu-ai-discovery.service"],
|
|
execute: async () => ({
|
|
stdout: JSON.stringify({
|
|
schema: "guanghu.execution-receipt/v1",
|
|
target_node_id: "JD-FD-PRIMARY",
|
|
action: {
|
|
kind: "service_status",
|
|
resource: "different.service",
|
|
},
|
|
adapter: "LINUX_SYSTEMD_V1",
|
|
}),
|
|
stderr: "",
|
|
}),
|
|
});
|
|
|
|
await assert.rejects(
|
|
() => observer.observe(),
|
|
/execution_receipt_contract_mismatch/,
|
|
);
|
|
});
|