feat: fail closed before domain runtime entry

product-source/guanghu-knowledge-base/server/domain-access.test.ts

@@ -0,0 +1,51 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { evaluateDomainAccess } from './domain-access.js';
+
+const NOW = 1_786_291_200_000;
+const DIGEST = 'a'.repeat(64);
+
+test('a local workspace remains available without claiming domain runtime access', () => {
+  const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '' }, NOW);
+  assert.equal(status.localWorkspaceAllowed, true);
+  assert.equal(status.runtimeReady, false);
+  assert.equal(status.stage, 'login-required');
+});
+
+test('a verified Forgejo account is not a domain runtime session', () => {
+  const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY' }, NOW);
+  assert.equal(status.stage, 'identity-verified');
+  assert.deepEqual(status.blockers, [
+    'verified_domain_manifest_missing',
+    'scoped_session_capability_missing',
+    'matching_connection_receipt_missing',
+  ]);
+});
+
+test('runtime access requires matching manifest, scoped capability and online receipt', () => {
+  const status = evaluateDomainAccess({
+    accountVerified: true,
+    connectionReceipt: { domainId: 'DOM-FIFTH-0001', manifestDigest: DIGEST, nodeId: 'LOCAL-001', state: 'online' },
+    domainId: 'DOM-FIFTH-0001',
+    manifest: { digest: DIGEST, domainId: 'DOM-FIFTH-0001', verified: true },
+    nodeId: 'LOCAL-001',
+    sessionCapability: { domainId: 'DOM-FIFTH-0001', expiresAt: NOW + 60_000, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
+  }, NOW);
+  assert.equal(status.runtimeReady, true);
+  assert.equal(status.stage, 'runtime-ready');
+  assert.deepEqual(status.blockers, []);
+});
+
+test('mismatched or expired evidence fails closed', () => {
+  const status = evaluateDomainAccess({
+    accountVerified: true,
+    connectionReceipt: { domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', state: 'online' },
+    domainId: 'DOM-FIFTH-0001',
+    manifest: { digest: DIGEST, domainId: 'DOM-FIFTH-0001', verified: true },
+    nodeId: 'LOCAL-001',
+    sessionCapability: { domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
+  }, NOW);
+  assert.equal(status.runtimeReady, false);
+  assert.ok(status.blockers.includes('scoped_session_capability_missing'));
+  assert.ok(status.blockers.includes('matching_connection_receipt_missing'));
+});

product-source/guanghu-knowledge-base/server/domain-access.ts

@@ -0,0 +1,50 @@
+export interface DomainAccessEvidence {
+  accountVerified: boolean;
+  connectionReceipt?: { domainId: string; manifestDigest: string; nodeId: string; state: 'online' };
+  domainId: string;
+  manifest?: { digest: string; domainId: string; verified: boolean };
+  nodeId: string;
+  sessionCapability?: { domainId: string; expiresAt: number; nodeId: string; scopes: string[] };
+}
+
+export interface DomainAccessStatus {
+  blockers: string[];
+  domainId: string;
+  localWorkspaceAllowed: true;
+  nodeId: string;
+  runtimeReady: boolean;
+  stage: 'login-required' | 'identity-verified' | 'runtime-ready';
+}
+
+export function evaluateDomainAccess(evidence: DomainAccessEvidence, now = Date.now()): DomainAccessStatus {
+  const blockers: string[] = [];
+  if (!evidence.accountVerified || !evidence.nodeId) blockers.push('account_node_identity_missing');
+  if (!evidence.manifest?.verified || evidence.manifest.domainId !== evidence.domainId || !evidence.manifest.digest) {
+    blockers.push('verified_domain_manifest_missing');
+  }
+  const capability = evidence.sessionCapability;
+  if (!capability
+    || capability.domainId !== evidence.domainId
+    || capability.nodeId !== evidence.nodeId
+    || capability.expiresAt <= now
+    || !capability.scopes.includes('domain:enter')) {
+    blockers.push('scoped_session_capability_missing');
+  }
+  const receipt = evidence.connectionReceipt;
+  if (!receipt
+    || receipt.state !== 'online'
+    || receipt.domainId !== evidence.domainId
+    || receipt.nodeId !== evidence.nodeId
+    || receipt.manifestDigest !== evidence.manifest?.digest) {
+    blockers.push('matching_connection_receipt_missing');
+  }
+  const runtimeReady = blockers.length === 0;
+  return {
+    blockers,
+    domainId: evidence.domainId,
+    localWorkspaceAllowed: true,
+    nodeId: evidence.nodeId,
+    runtimeReady,
+    stage: runtimeReady ? 'runtime-ready' : evidence.accountVerified && Boolean(evidence.nodeId) ? 'identity-verified' : 'login-required',
+  };
+}