Verify signed node registration claims

product-source/hololake-desktop/electron/main.ts

@@ -20,6 +20,7 @@ import fs from 'fs';
 import { importKnowledgeFolder } from './folder-import.js';
 import { DomainAccessOrchestrator } from '../../guanghu-knowledge-base/server/domain-access-orchestrator.js';
 import { TrustedSignerSnapshotLoader } from '../../guanghu-knowledge-base/server/trusted-signer-snapshot.js';
+import { NodeRegistrationSnapshotLoader } from '../../guanghu-knowledge-base/server/node-registration-snapshot.js';
 
 // ─── 配置 ───
 
@@ -324,22 +325,45 @@ const trustedSignerSnapshots = new TrustedSignerSnapshotLoader({
   },
 });
 
+const nodeRegistrationSnapshots = new NodeRegistrationSnapshotLoader({
+  async fetchJson(url: string): Promise<unknown> {
+    const response = await fetch(url, {
+      headers: { Accept: 'application/json' },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!response.ok) throw new Error(`node_registration_source_http_${response.status}`);
+    return response.json();
+  },
+});
+
 const domainAccessOrchestrator = new DomainAccessOrchestrator(
   trustedSignerSnapshots,
+  nodeRegistrationSnapshots,
   {
     async read() {
       const stored = applyStoredServerAuth();
-      if (!stored) return { accountVerified: false, nodeId: '', nodeRegistrationVerified: false };
+      if (!stored) return { accountId: '', accountVerified: false, nodeId: '' };
       try {
-        const { response } = await forgejoRequest(stored.nodeId, '/api/v1/user', {}, { token: stored.token });
-        // Forgejo proves only the account part. A dedicated node-registration
-        // verifier must independently supply nodeRegistrationVerified.
-        return { accountVerified: response.ok, nodeId: stored.nodeId, nodeRegistrationVerified: false };
+        const { response, data } = await forgejoRequest(stored.nodeId, '/api/v1/user', {}, { token: stored.token });
+        // Forgejo proves only the account part. It cannot submit a node-registration
+        // boolean; a separately anchored signed claim is required below.
+        return {
+          accountId: response.ok && typeof data?.login === 'string' ? data.login : '',
+          accountVerified: response.ok,
+          nodeId: stored.nodeId,
+        };
       } catch {
-        return { accountVerified: false, nodeId: stored.nodeId, nodeRegistrationVerified: false };
+        return { accountId: '', accountVerified: false, nodeId: stored.nodeId };
       }
     },
   },
+  {
+    async read() {
+      // Current REPO-012 does not yet register a node-registration endpoint.
+      // Keep this transport absent until that public registry and service exist.
+      return null;
+    },
+  },
   {
     async read() {
       // 当前灯塔尚未发布签名运行体交接端点。保持关闭，不从账号身份推导运行体权限。