bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(domain): project verified runtime policy to desktop

Browse source
This commit is contained in:
冰朔 2026-08-10 10:25:25 +08:00
commit 683e135f5e
12 changed files with 224 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

36
product-source/guanghu-knowledge-base/src/domain-entry-state.test.ts
View file

@ -2,7 +2,24 @@ import assert from 'node:assert/strict';
import test from 'node:test';
import { canEnterSelectedDomainRuntime, createDomainEntryTarget, projectDomainRuntimeBoundary } from './domain-entry-state.js';
const ready = (domainId: string, nodeType: 'local-terminal' | 'cloud-resident' = 'local-terminal') => ({ blockers: [], domainId, nodeType, runtimeReady: true, stage: 'runtime-ready' as const });
const validRuntimePolicy = {
allowedSessionScopes: ['domain:enter', 'knowledge:read'],
forbiddenDataScopes: ['private:relationship-core'],
manifestDigest: 'a'.repeat(64),
permissionPolicyRef: 'policy://origin-domain/default',
routeRef: 'domain-route://origin-domain/runtime',
themeOwner: 'fifth-domain' as const,
themePackageRef: 'theme://origin-domain/lake-reflects-stars',
};
const ready = (domainId: string, nodeType: 'local-terminal' | 'cloud-resident' = 'local-terminal') => ({
blockers: [],
domainId,
nodeType,
runtimePolicy: validRuntimePolicy,
runtimeReady: true,
stage: 'runtime-ready' as const,
});
test('a generic login request does not silently target the Fifth Domain', () => {
assert.equal(canEnterSelectedDomainRuntime(null, ready('DOM-FIFTH-0001')), false);
@ -30,3 +47,20 @@ test('the Fifth Domain opens only with matching runtime-ready evidence', () => {
assert.match(projectDomainRuntimeBoundary(fifth, ready('DOM-FIFTH-0001', 'local-terminal')), /另一种节点类型/);
assert.match(projectDomainRuntimeBoundary(fifth, ready('DOM-FIFTH-0001', 'cloud-resident')), /已经匹配/);
});
test('the Fifth Domain stays closed without the exact verified runtime policy projection', () => {
const fifth = createDomainEntryTarget('fifth');
const base = ready('DOM-FIFTH-0001');
assert.equal(canEnterSelectedDomainRuntime(fifth, { ...base, runtimePolicy: undefined }), false);
assert.match(projectDomainRuntimeBoundary(fifth, { ...base, runtimePolicy: undefined }), /可信运行策略缺失或不匹配/);
for (const runtimePolicy of [
{ ...validRuntimePolicy, manifestDigest: 'not-a-digest' },
{ ...validRuntimePolicy, themeOwner: 'domain-team' as const },
{ ...validRuntimePolicy, themePackageRef: 'theme://enterprise/fifth-look' },
{ ...validRuntimePolicy, routeRef: 'domain-route://enterprise/fifth' },
{ ...validRuntimePolicy, allowedSessionScopes: ['knowledge:read'] },
]) {
assert.equal(canEnterSelectedDomainRuntime(fifth, { ...base, runtimePolicy }), false);
}
});