55 lines
2.3 KiB
JavaScript
55 lines
2.3 KiB
JavaScript
|
#!/usr/bin/env node
|
||
|
|
|
||
|
|
import { readFile } from 'node:fs/promises'
|
||
|
|
|
||
|
|
export function validateDeploymentSource(policy, context) {
|
||
|
|
const route = policy.routes?.find(candidate => candidate.distribution === context.distribution)
|
||
|
|
if (!route || route.deployment_enabled !== true) {
|
||
|
|
return { ok: false, reason: 'deployment_source_route_inactive' }
|
||
|
|
}
|
||
|
|
if (route.repository_id !== context.repositoryId || route.channel_id !== context.channelId) {
|
||
|
|
return { ok: false, reason: 'deployment_source_binding_mismatch' }
|
||
|
|
}
|
||
|
|
if (route.source_owner_id !== context.sourceOwnerId) {
|
||
|
|
return { ok: false, reason: 'deployment_source_owner_mismatch' }
|
||
|
|
}
|
||
|
|
if (!route.allowed_authorizers?.includes(context.authorizerId)) {
|
||
|
|
return { ok: false, reason: 'deployment_authorizer_not_allowed' }
|
||
|
|
}
|
||
|
|
if (!route.allowed_personas?.includes(context.personaId)) {
|
||
|
|
return { ok: false, reason: 'deployment_persona_not_allowed' }
|
||
|
|
}
|
||
|
|
if (!route.allowed_execution_runtimes?.includes(context.executionRuntimeId)) {
|
||
|
|
return { ok: false, reason: 'deployment_execution_runtime_not_allowed' }
|
||
|
|
}
|
||
|
|
if (!route.allowed_targets?.includes(context.target)) {
|
||
|
|
return { ok: false, reason: 'deployment_target_not_allowed' }
|
||
|
|
}
|
||
|
|
return { ok: true }
|
||
|
|
}
|
||
|
|
|
||
|
|
async function run() {
|
||
|
|
const policyFile = process.env.HOLOLAKE_SOURCE_POLICY || 'research/source-route-policy.json'
|
||
|
|
const policy = JSON.parse(await readFile(policyFile, 'utf8'))
|
||
|
|
const context = {
|
||
|
|
distribution: process.env.HOLOLAKE_DISTRIBUTION || '',
|
||
|
|
repositoryId: process.env.HOLOLAKE_SOURCE_REPOSITORY_ID || '',
|
||
|
|
channelId: process.env.HOLOLAKE_SOURCE_CHANNEL_ID || '',
|
||
|
|
sourceOwnerId: process.env.HOLOLAKE_SOURCE_OWNER_ID || '',
|
||
|
|
authorizerId: process.env.HOLOLAKE_HUMAN_AUTHORIZER_ID || '',
|
||
|
|
personaId: process.env.HOLOLAKE_PERSONA_ID || '',
|
||
|
|
executionRuntimeId: process.env.HOLOLAKE_EXECUTION_RUNTIME_ID || '',
|
||
|
|
target: process.env.HOLOLAKE_DEPLOY_TARGET || '',
|
||
|
|
}
|
||
|
|
const result = validateDeploymentSource(policy, context)
|
||
|
|
if (!result.ok) {
|
||
|
|
console.error(`HoloLake deployment source rejected: ${result.reason}`)
|
||
|
|
process.exitCode = 77
|
||
|
|
return
|
||
|
|
}
|
||
|
|
console.log(`HoloLake deployment source verified: ${context.distribution} · ${context.channelId} · ${context.target}`)
|
||
|
|
}
|
||
|
|
|
||
|
|
if (import.meta.url === `file://${process.argv[1]}`) {
|
||
|
|
await run()
|
||
|
|
}
|