bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

Bind domain access to registered node type

Browse source
This commit is contained in:
冰朔 2026-08-10 06:28:47 +08:00
commit 8807b99d98
15 changed files with 168 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

25
product-source/guanghu-knowledge-base/server/domain-access.ts
View file

@ -16,6 +16,8 @@ const SHA256_PATTERN = /^[a-f0-9]{64}$/;
const COMMIT_PATTERN = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/;
const cryptographicallyVerifiedManifests = new WeakSet<object>();
export type DomainNodeType = 'local-terminal' | 'cloud-resident';
export interface DomainManifestEvidence {
digest: string;
domainId: string;
@ -46,6 +48,7 @@ export interface DomainSessionCapability {
domainId: string;
expiresAt: number;
nodeId: string;
nodeType: DomainNodeType;
scopes: string[];
}
@ -54,6 +57,7 @@ export interface DomainConnectionReceipt {
domainId: string;
manifestDigest: string;
nodeId: string;
nodeType: DomainNodeType;
receiptId: string;
state: 'online';
}
@ -75,6 +79,8 @@ export interface DomainAccessEvidence {
domainId: string;
manifest?: DomainManifestEvidence;
nodeId: string;
nodeRegistrationVerified: boolean;
nodeType: DomainNodeType;
sessionCapability?: DomainSessionCapability;
}
@ -83,6 +89,7 @@ export interface DomainAccessStatus {
domainId: string;
localWorkspaceAllowed: true;
nodeId: string;
nodeType: DomainNodeType;
runtimeReady: boolean;
stage: 'login-required' | 'identity-verified' | 'runtime-ready';
}
@ -123,6 +130,7 @@ export function parseDomainAccessHandoff(
input: unknown,
expectedDomainId: string,
expectedNodeId: string,
expectedNodeType: DomainNodeType,
trustedSigner: TrustedManifestSigner,
now = Date.now(),
): DomainAccessHandoff {
@ -132,8 +140,8 @@ export function parseDomainAccessHandoff(
const capability = input.sessionCapability;
const connection = input.connectionReceipt;
if (!isRecord(manifest) || !hasExactKeys(manifest, ['digest', 'domainId', 'repositoryId', 'schema', 'signature', 'signerId', 'sourceCommit'])) invalidHandoff();
if (!isRecord(capability) || !hasExactKeys(capability, ['capabilityId', 'domainId', 'expiresAt', 'nodeId', 'scopes'])) invalidHandoff();
if (!isRecord(connection) || !hasExactKeys(connection, ['connectionId', 'domainId', 'manifestDigest', 'nodeId', 'receiptId', 'state'])) invalidHandoff();
if (!isRecord(capability) || !hasExactKeys(capability, ['capabilityId', 'domainId', 'expiresAt', 'nodeId', 'nodeType', 'scopes'])) invalidHandoff();
if (!isRecord(connection) || !hasExactKeys(connection, ['connectionId', 'domainId', 'manifestDigest', 'nodeId', 'nodeType', 'receiptId', 'state'])) invalidHandoff();
const digest = manifest.digest;
if (manifest.schema !== MANIFEST_SCHEMA
@ -167,6 +175,7 @@ export function parseDomainAccessHandoff(
if (!isIdentifier(capability.capabilityId)
|| capability.domainId !== expectedDomainId
|| capability.nodeId !== expectedNodeId
|| capability.nodeType !== expectedNodeType
|| typeof capability.expiresAt !== 'number' || !Number.isSafeInteger(capability.expiresAt) || capability.expiresAt <= now
|| !Array.isArray(capability.scopes)
|| capability.scopes.some((scope) => !isIdentifier(scope))
@ -176,6 +185,7 @@ export function parseDomainAccessHandoff(
|| !isIdentifier(connection.receiptId)
|| connection.domainId !== expectedDomainId
|| connection.nodeId !== expectedNodeId
|| connection.nodeType !== expectedNodeType
|| connection.manifestDigest !== digest
|| connection.state !== 'online') invalidHandoff();
@ -201,6 +211,7 @@ export function verifyDomainAccessHandoffFromSnapshot(
input: unknown,
expectedDomainId: string,
expectedNodeId: string,
expectedNodeType: DomainNodeType,
signerLookup: Omit<TrustedSignerLookup, 'domainId'>,
snapshot: TrustedSignerSnapshotResult,
now = Date.now(),
@ -221,7 +232,7 @@ export function verifyDomainAccessHandoffFromSnapshot(
});
if (!trustedSigner) invalidHandoff();
return Object.freeze({
handoff: parseDomainAccessHandoff(input, expectedDomainId, expectedNodeId, trustedSigner, now),
handoff: parseDomainAccessHandoff(input, expectedDomainId, expectedNodeId, expectedNodeType, trustedSigner, now),
trustSource: source,
});
} catch {
@ -231,7 +242,8 @@ export function verifyDomainAccessHandoffFromSnapshot(
export function evaluateDomainAccess(evidence: DomainAccessEvidence, now = Date.now()): DomainAccessStatus {
const blockers: string[] = [];
if (!evidence.accountVerified || !evidence.nodeId) blockers.push('account_node_identity_missing');
if (!evidence.accountVerified) blockers.push('account_identity_missing');
if (!evidence.nodeRegistrationVerified || !evidence.nodeId) blockers.push('verified_node_registration_missing');
const manifest = evidence.manifest;
const verifier = manifest?.verifierReceipt;
if (!manifest
@ -249,6 +261,7 @@ export function evaluateDomainAccess(evidence: DomainAccessEvidence, now = Date.
|| !capability.capabilityId
|| capability.domainId !== evidence.domainId
|| capability.nodeId !== evidence.nodeId
|| capability.nodeType !== evidence.nodeType
|| capability.expiresAt <= now
|| !capability.scopes.includes('domain:enter')) {
blockers.push('scoped_session_capability_missing');
@ -260,6 +273,7 @@ export function evaluateDomainAccess(evidence: DomainAccessEvidence, now = Date.
|| receipt.state !== 'online'
|| receipt.domainId !== evidence.domainId
|| receipt.nodeId !== evidence.nodeId
|| receipt.nodeType !== evidence.nodeType
|| receipt.manifestDigest !== evidence.manifest?.digest) {
blockers.push('matching_connection_receipt_missing');
}
@ -269,7 +283,8 @@ export function evaluateDomainAccess(evidence: DomainAccessEvidence, now = Date.
domainId: evidence.domainId,
localWorkspaceAllowed: true,
nodeId: evidence.nodeId,
nodeType: evidence.nodeType,
runtimeReady,
stage: runtimeReady ? 'runtime-ready' : evidence.accountVerified && Boolean(evidence.nodeId) ? 'identity-verified' : 'login-required',
stage: runtimeReady ? 'runtime-ready' : evidence.accountVerified && evidence.nodeRegistrationVerified && Boolean(evidence.nodeId) ? 'identity-verified' : 'login-required',
};
}