bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(desktop): isolate private data by account

Browse source
This commit is contained in:
冰朔 2026-08-16 18:25:57 +08:00
commit 1d2a8a2f63
12 changed files with 143 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

18
product-source/hololake-native-desktop/scripts/knowledge-code-channel.test.mjs
View file

@ -8,19 +8,31 @@ const codeContract = JSON.parse(read('contracts/code-channel.json'))
const provenance = JSON.parse(read('audit/knowledge-workspace-migration-provenance.json'))
const knowledgeRust = read('src-tauri/src/knowledge_base.rs')
const codeRust = read('src-tauri/src/code_channel.rs')
const authenticatedStorageRust = read('src-tauri/src/authenticated_storage.rs')
const lib = read('src-tauri/src/lib.rs')
const ui = read('src/main.tsx')
test('knowledge workspace is HoloLake-owned and keeps the legacy source read-only', () => {
test('knowledge workspace is HoloLake-owned, account-scoped, and never auto-projects legacy data', () => {
assert.equal(knowledgeContract.native_storage.owner, 'HOLOLAKE_NATIVE_RUST_CORE')
assert.equal(knowledgeContract.legacy_compatibility.mode, 'READ_ONLY_SEPARATE_ROOT')
assert.equal(knowledgeContract.native_storage.authenticated_account_required, true)
assert.equal(knowledgeContract.native_storage.cross_account_projection_allowed, false)
assert.equal(knowledgeContract.legacy_compatibility.mode, 'NOT_AUTO_PROJECTED_EXPLICIT_OWNER_MIGRATION_ONLY')
assert.equal(knowledgeContract.legacy_compatibility.in_place_migration, false)
assert.equal(knowledgeContract.legacy_compatibility.tolaria_surface_used, false)
assert.equal(provenance.legacy_data_boundary.modified, false)
assert.match(knowledgeRust, /join\("knowledge-v1"\)/)
assert.match(knowledgeRust, /account_storage_root\(app, "knowledge-v1"\)/)
assert.match(authenticatedStorageRust, /HOLOLAKE_AUTHENTICATED_ACCOUNT_REQUIRED/)
assert.match(authenticatedStorageRust, /accounts-v1/)
assert.doesNotMatch(authenticatedStorageRust, /join\(&session\.username\)/)
assert.match(knowledgeRust, /source_docs_root/)
})
test('code channel uses the same authenticated account boundary', () => {
assert.equal(codeContract.registry.authenticated_account_required, true)
assert.equal(codeContract.registry.cross_account_projection_allowed, false)
assert.match(codeRust, /account_storage_root\(app, "code-channel-v1"\)/)
})
test('folder import is bounded, idempotent, conflict-safe and creates a local Git receipt', () => {
assert.equal(knowledgeContract.folder_import.maximum_files, 1000)
assert.equal(knowledgeContract.folder_import.symlinks_followed, false)