Verify signed node registration claims
This commit is contained in:
parent
f45113b861
commit
2bfede2376
9 changed files with 965 additions and 54 deletions
|
|
@ -3,16 +3,21 @@ import assert from 'node:assert/strict';
|
|||
import { createHash, generateKeyPairSync, sign } from 'node:crypto';
|
||||
import { domainManifestSigningBytes } from './domain-access.js';
|
||||
import { DomainAccessOrchestrator } from './domain-access-orchestrator.js';
|
||||
import { nodeRegistrationClaimSigningBytes } from './node-registration.js';
|
||||
import { NodeRegistrationSnapshotLoader } from './node-registration-snapshot.js';
|
||||
import { TrustedSignerSnapshotLoader } from './trusted-signer-snapshot.js';
|
||||
|
||||
const NOW = 1_786_291_200_000;
|
||||
const DOMAIN_ID = 'DOM-FIFTH-0001';
|
||||
const NODE_ID = 'LOCAL-001';
|
||||
const NODE_TYPE = 'local-terminal' as const;
|
||||
const ACCOUNT_ID = 'bingshuo';
|
||||
const COMMIT = 'a'.repeat(40);
|
||||
const ANCHOR_URL = 'https://guanghulab.com/api/ai/v1/anchor';
|
||||
const REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/trusted-domain-manifest-signers.json`;
|
||||
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
|
||||
const SIGNER_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/trusted-domain-manifest-signers.json`;
|
||||
const NODE_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/node-registration-endpoints.json`;
|
||||
const manifestKeys = generateKeyPairSync('ed25519');
|
||||
const registrationKeys = generateKeyPairSync('ed25519');
|
||||
|
||||
function anchor() {
|
||||
return {
|
||||
|
|
@ -29,6 +34,11 @@ function anchor() {
|
|||
id: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
|
||||
version: '1.0.0',
|
||||
},
|
||||
node_registration_endpoints: {
|
||||
path: 'routing/node-registration-endpoints.json',
|
||||
id: 'GH-AIOS-NODE-REGISTRATION-ENDPOINTS-001',
|
||||
version: '1.0.0',
|
||||
},
|
||||
},
|
||||
navigation_source: {
|
||||
anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
|
||||
|
|
@ -39,7 +49,7 @@ function anchor() {
|
|||
};
|
||||
}
|
||||
|
||||
function registry(signers: unknown[] = []) {
|
||||
function signerRegistry(signers: unknown[] = []) {
|
||||
return {
|
||||
registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
|
||||
schema: 'gh-aios.trusted-domain-manifest-signers/v1',
|
||||
|
|
@ -53,23 +63,72 @@ function activeSigner() {
|
|||
return {
|
||||
algorithm: 'Ed25519',
|
||||
domainIds: [DOMAIN_ID],
|
||||
publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
|
||||
publicKeyPem: manifestKeys.publicKey.export({ format: 'pem', type: 'spki' }).toString(),
|
||||
repositoryId: 'REPO-014',
|
||||
signerId: 'GH-LIGHTHOUSE-001',
|
||||
status: 'ACTIVE',
|
||||
};
|
||||
}
|
||||
|
||||
function loader(readRegistry: () => unknown = () => registry()) {
|
||||
function nodeRegistry(version = '1.0.0') {
|
||||
return {
|
||||
endpoints: [{
|
||||
algorithm: 'Ed25519',
|
||||
domainIds: [DOMAIN_ID],
|
||||
endpointId: 'GH-NODE-REG-001',
|
||||
nodeTypes: [NODE_TYPE],
|
||||
publicKeyPem: registrationKeys.publicKey.export({ format: 'pem', type: 'spki' }).toString(),
|
||||
signerId: 'GH-NODE-REG-SIGNER-001',
|
||||
status: 'ACTIVE',
|
||||
url: 'https://guanghulab.com/api/ai/v1/node-registrations/claims',
|
||||
}],
|
||||
registryId: 'GH-AIOS-NODE-REGISTRATION-ENDPOINTS-001',
|
||||
schema: 'gh-aios.node-registration-endpoints/v1',
|
||||
state: 'CURRENT',
|
||||
version,
|
||||
};
|
||||
}
|
||||
|
||||
function signerLoader(readRegistry: () => unknown = () => signerRegistry()) {
|
||||
return new TrustedSignerSnapshotLoader({
|
||||
async fetchJson(url) {
|
||||
if (url === ANCHOR_URL) return anchor();
|
||||
if (url === REGISTRY_URL) return readRegistry();
|
||||
if (url === SIGNER_REGISTRY_URL) return readRegistry();
|
||||
throw new Error('unexpected_url');
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
function registrationLoader(readRegistry: () => unknown = () => nodeRegistry()) {
|
||||
return new NodeRegistrationSnapshotLoader({
|
||||
async fetchJson(url) {
|
||||
if (url === ANCHOR_URL) return anchor();
|
||||
if (url === NODE_REGISTRY_URL) return readRegistry();
|
||||
throw new Error('unexpected_url');
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
function validRegistrationClaim() {
|
||||
const payload = {
|
||||
accountId: ACCOUNT_ID,
|
||||
claimId: 'NODE-CLAIM-001',
|
||||
domainId: DOMAIN_ID,
|
||||
endpointId: 'GH-NODE-REG-001',
|
||||
expiresAt: NOW + 60_000,
|
||||
issuedAt: NOW - 1_000,
|
||||
nodeId: NODE_ID,
|
||||
nodeKeyFingerprint: 'c'.repeat(64),
|
||||
nodeType: NODE_TYPE,
|
||||
schema: 'gh-aios.node-registration-claim/v1' as const,
|
||||
signerId: 'GH-NODE-REG-SIGNER-001',
|
||||
};
|
||||
return {
|
||||
...payload,
|
||||
signature: sign(null, nodeRegistrationClaimSigningBytes(payload), registrationKeys.privateKey).toString('base64'),
|
||||
};
|
||||
}
|
||||
|
||||
function validHandoff() {
|
||||
const payload = {
|
||||
domainId: DOMAIN_ID,
|
||||
|
|
@ -93,7 +152,7 @@ function validHandoff() {
|
|||
manifest: {
|
||||
digest,
|
||||
...payload,
|
||||
signature: sign(null, bytes, privateKey).toString('base64'),
|
||||
signature: sign(null, bytes, manifestKeys.privateKey).toString('base64'),
|
||||
},
|
||||
sessionCapability: {
|
||||
capabilityId: 'CAP-001',
|
||||
|
|
@ -106,32 +165,37 @@ function validHandoff() {
|
|||
};
|
||||
}
|
||||
|
||||
test('projects public trust health without asking for a handoff before login', async () => {
|
||||
const loggedOutIdentity = { async read() { return { accountId: '', accountVerified: false, nodeId: '' }; } };
|
||||
const loggedInIdentity = { async read() { return { accountId: ACCOUNT_ID, accountVerified: true, nodeId: NODE_ID }; } };
|
||||
const validRegistrationSource = { async read() { return validRegistrationClaim(); } };
|
||||
|
||||
test('projects both trust-source states without asking for claims or handoff before login', async () => {
|
||||
let claimReads = 0;
|
||||
let handoffReads = 0;
|
||||
const orchestrator = new DomainAccessOrchestrator(
|
||||
loader(),
|
||||
{ async read() { return { accountVerified: false, nodeId: '', nodeRegistrationVerified: false }; } },
|
||||
signerLoader(),
|
||||
registrationLoader(),
|
||||
loggedOutIdentity,
|
||||
{ async read() { claimReads += 1; return null; } },
|
||||
{ async read() { handoffReads += 1; return null; } },
|
||||
);
|
||||
|
||||
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
||||
|
||||
assert.equal(claimReads, 0);
|
||||
assert.equal(handoffReads, 0);
|
||||
assert.equal(status.stage, 'login-required');
|
||||
assert.equal(status.runtimeReady, false);
|
||||
assert.equal(status.localWorkspaceAllowed, true);
|
||||
assert.deepEqual(status.trustSource, {
|
||||
status: 'CURRENT',
|
||||
sourceCommit: COMMIT,
|
||||
registryVersion: '1.0.0',
|
||||
signerCount: 0,
|
||||
});
|
||||
assert.equal(status.nodeRegistrationSource.status, 'CURRENT');
|
||||
assert.equal(status.trustSource.status, 'CURRENT');
|
||||
});
|
||||
|
||||
test('an authenticated node without a verified handoff remains identity-only', async () => {
|
||||
test('a signed node registration without a handoff remains identity-only', async () => {
|
||||
const orchestrator = new DomainAccessOrchestrator(
|
||||
loader(),
|
||||
{ async read() { return { accountVerified: true, nodeId: NODE_ID, nodeRegistrationVerified: true }; } },
|
||||
signerLoader(),
|
||||
registrationLoader(),
|
||||
loggedInIdentity,
|
||||
validRegistrationSource,
|
||||
{ async read() { return null; } },
|
||||
);
|
||||
|
||||
|
|
@ -139,14 +203,17 @@ test('an authenticated node without a verified handoff remains identity-only', a
|
|||
|
||||
assert.equal(status.stage, 'identity-verified');
|
||||
assert.equal(status.runtimeReady, false);
|
||||
assert.equal(status.blockers.includes('verified_node_registration_missing'), false);
|
||||
assert.ok(status.blockers.includes('verified_domain_manifest_missing'));
|
||||
});
|
||||
|
||||
test('a code-channel account without node registration never contacts a domain handoff route', async () => {
|
||||
test('a code-channel account cannot supply registration and never contacts a handoff route', async () => {
|
||||
let handoffReads = 0;
|
||||
const orchestrator = new DomainAccessOrchestrator(
|
||||
loader(),
|
||||
{ async read() { return { accountVerified: true, nodeId: NODE_ID, nodeRegistrationVerified: false }; } },
|
||||
signerLoader(),
|
||||
registrationLoader(),
|
||||
loggedInIdentity,
|
||||
{ async read() { return null; } },
|
||||
{ async read() { handoffReads += 1; return validHandoff() as never; } },
|
||||
);
|
||||
|
||||
|
|
@ -157,10 +224,12 @@ test('a code-channel account without node registration never contacts a domain h
|
|||
assert.ok(status.blockers.includes('verified_node_registration_missing'));
|
||||
});
|
||||
|
||||
test('a loaded signer snapshot and verified handoff project runtime-ready', async () => {
|
||||
test('current registries, signed node claim and verified handoff project runtime-ready', async () => {
|
||||
const orchestrator = new DomainAccessOrchestrator(
|
||||
loader(() => registry([activeSigner()])),
|
||||
{ async read() { return { accountVerified: true, nodeId: NODE_ID, nodeRegistrationVerified: true }; } },
|
||||
signerLoader(() => signerRegistry([activeSigner()])),
|
||||
registrationLoader(),
|
||||
loggedInIdentity,
|
||||
validRegistrationSource,
|
||||
{ async read() {
|
||||
return {
|
||||
handoff: validHandoff(),
|
||||
|
|
@ -174,33 +243,38 @@ test('a loaded signer snapshot and verified handoff project runtime-ready', asyn
|
|||
assert.equal(status.stage, 'runtime-ready');
|
||||
assert.equal(status.runtimeReady, true);
|
||||
assert.deepEqual(status.blockers, []);
|
||||
assert.equal(status.trustSource.status, 'CURRENT');
|
||||
});
|
||||
|
||||
test('source and handoff failures are reduced to safe status without raw details', async () => {
|
||||
test('source failures are reduced to safe status without raw details', async () => {
|
||||
const unavailableSigner = new TrustedSignerSnapshotLoader({ async fetchJson() { throw new Error('secret signer detail'); } });
|
||||
const unavailableRegistration = new NodeRegistrationSnapshotLoader({ async fetchJson() { throw new Error('secret registration detail'); } });
|
||||
const orchestrator = new DomainAccessOrchestrator(
|
||||
new TrustedSignerSnapshotLoader({ async fetchJson() { throw new Error('secret source detail'); } }),
|
||||
{ async read() { return { accountVerified: true, nodeId: NODE_ID, nodeRegistrationVerified: true }; } },
|
||||
unavailableSigner,
|
||||
unavailableRegistration,
|
||||
loggedInIdentity,
|
||||
{ async read() { throw new Error('secret claim detail'); } },
|
||||
{ async read() { throw new Error('secret handoff detail'); } },
|
||||
);
|
||||
|
||||
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
||||
|
||||
assert.equal(status.stage, 'identity-verified');
|
||||
assert.equal(status.stage, 'login-required');
|
||||
assert.equal(status.runtimeReady, false);
|
||||
assert.equal(status.nodeRegistrationSource.status, 'UNAVAILABLE');
|
||||
assert.equal(status.trustSource.status, 'UNAVAILABLE');
|
||||
assert.equal(status.trustSource.reason, 'SOURCE_UNAVAILABLE');
|
||||
assert.equal(JSON.stringify(status).includes('secret'), false);
|
||||
});
|
||||
|
||||
test('a last-known-good signer can project access while preserving degraded health', async () => {
|
||||
let currentRegistry: unknown = registry([activeSigner()]);
|
||||
const signerLoader = loader(() => currentRegistry);
|
||||
await signerLoader.refresh();
|
||||
currentRegistry = { ...registry([activeSigner()]), version: 'invalid' };
|
||||
test('a degraded signer may preserve handoff verification while node registration must be current', async () => {
|
||||
let currentSignerRegistry: unknown = signerRegistry([activeSigner()]);
|
||||
const currentSignerLoader = signerLoader(() => currentSignerRegistry);
|
||||
await currentSignerLoader.refresh();
|
||||
currentSignerRegistry = { ...signerRegistry([activeSigner()]), version: 'invalid' };
|
||||
const orchestrator = new DomainAccessOrchestrator(
|
||||
signerLoader,
|
||||
{ async read() { return { accountVerified: true, nodeId: NODE_ID, nodeRegistrationVerified: true }; } },
|
||||
currentSignerLoader,
|
||||
registrationLoader(),
|
||||
loggedInIdentity,
|
||||
validRegistrationSource,
|
||||
{ async read() {
|
||||
return {
|
||||
handoff: validHandoff(),
|
||||
|
|
@ -210,8 +284,30 @@ test('a last-known-good signer can project access while preserving degraded heal
|
|||
);
|
||||
|
||||
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
||||
|
||||
assert.equal(status.runtimeReady, true);
|
||||
assert.equal(status.trustSource.status, 'DEGRADED_LAST_KNOWN_GOOD');
|
||||
assert.equal(status.trustSource.reason, 'REGISTRY_INVALID');
|
||||
assert.equal(status.nodeRegistrationSource.status, 'CURRENT');
|
||||
});
|
||||
|
||||
test('a degraded node-registration registry cannot authorize a claim', async () => {
|
||||
let currentNodeRegistry: unknown = nodeRegistry();
|
||||
const currentNodeLoader = registrationLoader(() => currentNodeRegistry);
|
||||
await currentNodeLoader.refresh();
|
||||
currentNodeRegistry = nodeRegistry('2.0.0');
|
||||
let claimReads = 0;
|
||||
let handoffReads = 0;
|
||||
const orchestrator = new DomainAccessOrchestrator(
|
||||
signerLoader(() => signerRegistry([activeSigner()])),
|
||||
currentNodeLoader,
|
||||
loggedInIdentity,
|
||||
{ async read() { claimReads += 1; return validRegistrationClaim(); } },
|
||||
{ async read() { handoffReads += 1; return null; } },
|
||||
);
|
||||
|
||||
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
||||
assert.equal(status.nodeRegistrationSource.status, 'DEGRADED_LAST_KNOWN_GOOD');
|
||||
assert.equal(status.runtimeReady, false);
|
||||
assert.ok(status.blockers.includes('verified_node_registration_missing'));
|
||||
assert.equal(claimReads, 0);
|
||||
assert.equal(handoffReads, 0);
|
||||
});
|
||||
|
|
|
|||
Loading…
Reference in a new issue