bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

Bind domain access to registered node type

Browse source
This commit is contained in:
冰朔 2026-08-10 06:28:47 +08:00
commit 8807b99d98
15 changed files with 168 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

50
product-source/guanghu-knowledge-base/server/domain-access.test.ts
View file

@ -16,6 +16,7 @@ import { TrustedSignerSnapshotLoader } from './trusted-signer-snapshot.js';
const NOW = 1_786_291_200_000;
const COMMIT = 'b'.repeat(40);
const NODE_TYPE = 'local-terminal' as const;
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
function trustedSignerFromRegistry(overrides: Record<string, unknown> = {}): TrustedManifestSigner {
const parsed = parseTrustedManifestSignerRegistry({
@ -62,6 +63,7 @@ const validHandoff = {
domainId: 'DOM-FIFTH-0001',
manifestDigest: DIGEST,
nodeId: 'LOCAL-001',
nodeType: NODE_TYPE,
receiptId: 'RECEIPT-001',
state: 'online',
},
@ -75,6 +77,7 @@ const validHandoff = {
domainId: 'DOM-FIFTH-0001',
expiresAt: NOW + 60_000,
nodeId: 'LOCAL-001',
nodeType: NODE_TYPE,
scopes: ['domain:enter'],
},
} as const;
@ -82,6 +85,7 @@ const verifiedHandoff = parseDomainAccessHandoff(
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
NODE_TYPE,
trustedSigner,
NOW,
);
@ -143,14 +147,21 @@ function snapshotLoader(readRegistry: () => unknown) {
}
test('a local workspace remains available without claiming domain runtime access', () => {
const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '' }, NOW);
const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '', nodeRegistrationVerified: false, nodeType: NODE_TYPE }, NOW);
assert.equal(status.localWorkspaceAllowed, true);
assert.equal(status.runtimeReady, false);
assert.equal(status.stage, 'login-required');
});
test('a verified Forgejo account is not a domain runtime session', () => {
const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY' }, NOW);
test('a code-channel account cannot substitute for verified node registration', () => {
const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY', nodeRegistrationVerified: false, nodeType: NODE_TYPE }, NOW);
assert.equal(status.stage, 'login-required');
assert.equal(status.blockers.includes('account_identity_missing'), false);
assert.ok(status.blockers.includes('verified_node_registration_missing'));
});
test('a separately verified node is still not a domain runtime session', () => {
const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY', nodeRegistrationVerified: true, nodeType: NODE_TYPE }, NOW);
assert.equal(status.stage, 'identity-verified');
assert.deepEqual(status.blockers, [
'verified_domain_manifest_missing',
@ -160,11 +171,13 @@ test('a verified Forgejo account is not a domain runtime session', () => {
});
test('runtime access requires matching manifest, scoped capability and online receipt', () => {
const handoff = parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW);
const handoff = parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW);
const status = evaluateDomainAccess({
accountVerified: true,
domainId: 'DOM-FIFTH-0001',
nodeId: 'LOCAL-001',
nodeRegistrationVerified: true,
nodeType: NODE_TYPE,
...handoff,
}, NOW);
assert.equal(status.runtimeReady, true);
@ -178,6 +191,7 @@ test('the runtime handoff entry resolves its signer only from a loaded snapshot'
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
NODE_TYPE,
{ repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
snapshot,
NOW,
@ -189,6 +203,8 @@ test('the runtime handoff entry resolves its signer only from a loaded snapshot'
accountVerified: true,
domainId: 'DOM-FIFTH-0001',
nodeId: 'LOCAL-001',
nodeRegistrationVerified: true,
nodeType: NODE_TYPE,
...verified.handoff,
}, NOW).runtimeReady, true);
});
@ -199,6 +215,7 @@ test('an empty, forged or mismatched snapshot cannot open the runtime handoff',
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
NODE_TYPE,
{ repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
empty,
NOW,
@ -209,6 +226,7 @@ test('an empty, forged or mismatched snapshot cannot open the runtime handoff',
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
NODE_TYPE,
{ repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
{ ...loaded },
NOW,
@ -217,6 +235,7 @@ test('an empty, forged or mismatched snapshot cannot open the runtime handoff',
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
NODE_TYPE,
{ repositoryId: 'REPO-OTHER', signerId: 'GH-LIGHTHOUSE-001' },
loaded,
NOW,
@ -234,6 +253,7 @@ test('a clearly degraded last-known-good snapshot remains usable without claimin
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
NODE_TYPE,
{ repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
degraded,
NOW,
@ -246,11 +266,13 @@ test('a clearly degraded last-known-good snapshot remains usable without claimin
test('mismatched or expired evidence fails closed', () => {
const status = evaluateDomainAccess({
accountVerified: true,
connectionReceipt: { connectionId: 'CONN-001', domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', receiptId: 'RECEIPT-001', state: 'online' },
connectionReceipt: { connectionId: 'CONN-001', domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', nodeType: NODE_TYPE, receiptId: 'RECEIPT-001', state: 'online' },
domainId: 'DOM-FIFTH-0001',
manifest: verifiedHandoff.manifest,
nodeId: 'LOCAL-001',
sessionCapability: { capabilityId: 'CAP-001', domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
nodeRegistrationVerified: true,
nodeType: NODE_TYPE,
sessionCapability: { capabilityId: 'CAP-001', domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', nodeType: NODE_TYPE, scopes: ['domain:enter'] },
}, NOW);
assert.equal(status.runtimeReady, false);
assert.ok(status.blockers.includes('scoped_session_capability_missing'));
@ -264,7 +286,7 @@ test('the input cannot supply its own verifier receipt', () => {
...validHandoff.manifest,
verifierReceipt: { state: 'verified' },
},
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('unknown fields and malformed digests fail closed', () => {
@ -272,22 +294,23 @@ test('unknown fields and malformed digests fail closed', () => {
...validHandoff,
manifest: { ...validHandoff.manifest, digest: 'not-a-digest' },
trusted: true,
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('the handoff is bound to the requested domain, node and manifest digest', () => {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
connectionReceipt: { ...validHandoff.connectionReceipt, manifestDigest: 'c'.repeat(64) },
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'OTHER-NODE', trustedSigner, NOW), /domain_access_handoff_invalid/);
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'OTHER-NODE', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', 'cloud-resident', trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('manifest tampering and signatures from another key fail closed', () => {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: { ...validHandoff.manifest, sourceCommit: 'c'.repeat(40) },
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
const other = generateKeyPairSync('ed25519');
assert.throws(() => parseDomainAccessHandoff({
@ -296,7 +319,7 @@ test('manifest tampering and signatures from another key fail closed', () => {
...validHandoff.manifest,
signature: sign(null, signedBytes, other.privateKey).toString('base64'),
},
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('trusted signer identity and repository are external inputs, not payload authority', () => {
@ -304,6 +327,7 @@ test('trusted signer identity and repository are external inputs, not payload au
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
NODE_TYPE,
trustedSignerFromRegistry({ repositoryId: 'REPO-OTHER' }),
NOW,
), /domain_access_handoff_invalid/);
@ -319,6 +343,8 @@ test('copying verified-looking fields cannot bypass the in-process verifier boun
verifierReceipt: { ...verifiedHandoff.manifest.verifierReceipt },
},
nodeId: 'LOCAL-001',
nodeRegistrationVerified: true,
nodeType: NODE_TYPE,
sessionCapability: verifiedHandoff.sessionCapability,
}, NOW);
assert.equal(status.runtimeReady, false);