bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(domain-access): load trusted signer registry

Browse source
This commit is contained in:
冰朔 2026-08-10 02:34:05 +08:00
commit 6bd95c76e9
7 changed files with 318 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

42
product-source/guanghu-knowledge-base/server/domain-access.test.ts
View file

@ -6,16 +6,44 @@ import {
evaluateDomainAccess,
parseDomainAccessHandoff,
} from './domain-access.js';
import {
parseTrustedManifestSignerRegistry,
resolveTrustedManifestSigner,
type TrustedManifestSigner,
} from './trusted-signer-registry.js';
const NOW = 1_786_291_200_000;
const COMMIT = 'b'.repeat(40);
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
const trustedSigner = {
algorithm: 'Ed25519',
publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
repositoryId: 'REPO-014',
signerId: 'GH-LIGHTHOUSE-001',
} as const;
function trustedSignerFromRegistry(overrides: Record<string, unknown> = {}): TrustedManifestSigner {
const parsed = parseTrustedManifestSignerRegistry({
registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
schema: 'gh-aios.trusted-domain-manifest-signers/v1',
signers: [{
algorithm: 'Ed25519',
domainIds: ['DOM-FIFTH-0001'],
publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
repositoryId: 'REPO-014',
signerId: 'GH-LIGHTHOUSE-001',
status: 'ACTIVE',
...overrides,
}],
state: 'CURRENT',
version: '1.0.0',
}, {
repositoryId: 'REPO-012',
sourceCommit: 'a'.repeat(40),
sourceUrl: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
});
const signer = resolveTrustedManifestSigner(parsed, {
domainId: 'DOM-FIFTH-0001',
repositoryId: String(overrides.repositoryId ?? 'REPO-014'),
signerId: 'GH-LIGHTHOUSE-001',
});
if (!signer) throw new Error('test_trusted_signer_missing');
return signer;
}
const trustedSigner = trustedSignerFromRegistry();
const manifestPayload = {
domainId: 'DOM-FIFTH-0001',
repositoryId: 'REPO-014',
@ -147,7 +175,7 @@ test('trusted signer identity and repository are external inputs, not payload au
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
{ ...trustedSigner, repositoryId: 'REPO-OTHER' },
trustedSignerFromRegistry({ repositoryId: 'REPO-OTHER' }),
NOW,
), /domain_access_handoff_invalid/);
});