63 lines
3.4 KiB
JavaScript
63 lines
3.4 KiB
JavaScript
"use strict";
|
|
const assert = require("node:assert/strict");
|
|
const crypto = require("node:crypto");
|
|
const test = require("node:test");
|
|
const { canonicalRequest, evaluateWriteAdmission } = require("./write-admission");
|
|
|
|
function rawPublic(key) {
|
|
return key.export({ format: "der", type: "spki" }).subarray(-32).toString("hex");
|
|
}
|
|
|
|
function fixture() {
|
|
const keys = crypto.generateKeyPairSync("ed25519");
|
|
const nodeRegistry = { nodes: [{
|
|
node_id: "TEST-NODE-001", state: "ACTIVE", persona_ids: ["ICE-P-ZY001"],
|
|
allowed_targets: ["BS-TCS-SYSTEM-BODY-ORGAN-MAP-001"], allowed_actions: ["UPDATE_REGISTERED_RULE"],
|
|
transport_keys: [{ key_id: "TEST-KEY-001", state: "ACTIVE", algorithm: "Ed25519", public_key_hex: rawPublic(keys.publicKey) }]
|
|
}] };
|
|
const request = {
|
|
schema: "guanghu.bingshuo-system-node-write-request/v1",
|
|
node_id: "TEST-NODE-001", key_id: "TEST-KEY-001", issued_at_unix: 1786363200,
|
|
nonce: "0123456789abcdef0123456789abcdef", persona_id: "ICE-P-ZY001",
|
|
authorization_receipt_id: "LANG-AUTH-TEST-001", language_event_id: "LANG-EVENT-TEST-001",
|
|
target: "BS-TCS-SYSTEM-BODY-ORGAN-MAP-001", action: "UPDATE_REGISTERED_RULE",
|
|
sealed_payload_sha256: "ab".repeat(32)
|
|
};
|
|
const envelope = {
|
|
schema: "guanghu.bingshuo-system-node-write-envelope/v1",
|
|
request,
|
|
node_signature_base64url: crypto.sign(null, canonicalRequest(request), keys.privateKey).toString("base64url")
|
|
};
|
|
return { envelope, keys, nodeRegistry };
|
|
}
|
|
|
|
test("a registered node signature is the first admission fact", () => {
|
|
const { envelope, nodeRegistry } = fixture();
|
|
const allowed = evaluateWriteAdmission(envelope, { nodeRegistry, nowUnix: 1786363200 });
|
|
assert.equal(allowed.decision, "ENTER_WHOLE_BODY_REVIEW");
|
|
assert.equal(allowed.origin_node_id, "TEST-NODE-001");
|
|
assert.match(allowed.next_gate, /VALIDATE_LANGUAGE_AUTHORIZATION_RECEIPT/);
|
|
assert.equal(evaluateWriteAdmission(envelope, { nodeRegistry: { nodes: [] }, nowUnix: 1786363200 }).error_code, "ORIGIN_NODE_NOT_REGISTERED");
|
|
});
|
|
|
|
test("root-like possession without the node protocol key is noise", () => {
|
|
const { envelope, nodeRegistry } = fixture();
|
|
envelope.node_signature_base64url = "A".repeat(86);
|
|
const decision = evaluateWriteAdmission(envelope, { nodeRegistry, nowUnix: 1786363200 });
|
|
assert.equal(decision.error_code, "ORIGIN_NODE_SIGNATURE_INVALID");
|
|
assert.equal(decision.invoke_model, false);
|
|
assert.equal(decision.activate_protocols, false);
|
|
assert.equal(decision.open_sealed_payload, false);
|
|
assert.equal(decision.persist_request_body, false);
|
|
});
|
|
|
|
test("registered persona, node binding, authorization receipt and replay gate all fail closed", () => {
|
|
const first = fixture();
|
|
first.envelope.request.persona_id = "CHENGLU-AGENT-001";
|
|
first.envelope.node_signature_base64url = crypto.sign(null, canonicalRequest(first.envelope.request), first.keys.privateKey).toString("base64url");
|
|
assert.equal(evaluateWriteAdmission(first.envelope, { nodeRegistry: first.nodeRegistry, nowUnix: 1786363200 }).error_code, "PERSONA_NOT_BOUND_TO_ORIGIN_NODE");
|
|
const second = fixture();
|
|
const replay = new Set();
|
|
assert.equal(evaluateWriteAdmission(second.envelope, { nodeRegistry: second.nodeRegistry, replayCache: replay, nowUnix: 1786363200 }).decision, "ENTER_WHOLE_BODY_REVIEW");
|
|
assert.equal(evaluateWriteAdmission(second.envelope, { nodeRegistry: second.nodeRegistry, replayCache: replay, nowUnix: 1786363200 }).error_code, "NODE_REQUEST_REPLAYED");
|
|
});
|