bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

Bind domain access to registered node type

Browse source
This commit is contained in:
冰朔 2026-08-10 06:28:47 +08:00
commit 8807b99d98
15 changed files with 168 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

6
product-source/hololake-platform/src/lib/domainRuntimeContract.test.ts
View file

@ -65,6 +65,7 @@ function session(overrides: Partial<DomainSessionCapability> = {}): DomainSessio
domainId: 'DOM-FIFTH-0001',
expiresAt: NOW + 60_000,
nodeId: 'LOCAL-NODE-001',
nodeType: 'LOCAL_TERMINAL_NODE',
scopes: ['domain:enter'],
...overrides,
}
@ -76,6 +77,7 @@ function receipt(overrides: Partial<DomainConnectionReceipt> = {}): DomainConnec
domainId: 'DOM-FIFTH-0001',
manifestDigest: DIGEST,
nodeId: 'LOCAL-NODE-001',
nodeType: 'LOCAL_TERMINAL_NODE',
receiptId: 'RECEIPT-001',
state: 'online',
...overrides,
@ -141,10 +143,14 @@ describe('domain runtime contract', () => {
expect(() => acceptDomainSession(access, session({ domainId: 'DOMAIN-OTHER' }), NOW))
.toThrow('domain_session_domain_mismatch')
expect(() => acceptDomainSession(access, session({ nodeType: 'CLOUD_RESIDENT_NODE' }), NOW))
.toThrow('domain_session_node_type_mismatch')
const withSession = acceptDomainSession(access, session(), NOW)
expect(() => acceptDomainConnectionReceipt(withSession, receipt({ domainId: 'DOMAIN-OTHER' })))
.toThrow('domain_connection_domain_mismatch')
expect(() => acceptDomainConnectionReceipt(withSession, receipt({ nodeType: 'CLOUD_RESIDENT_NODE' })))
.toThrow('domain_connection_node_type_mismatch')
})
it('drops execution authority and keeps an explicit read-only scene after disconnect', () => {

8
product-source/hololake-platform/src/lib/domainRuntimeContract.ts
View file

@ -55,6 +55,7 @@ export interface DomainSessionCapability {
domainId: string
expiresAt: number
nodeId: string
nodeType: DomainNodeType
scopes: string[]
}
@ -63,6 +64,7 @@ export interface DomainConnectionReceipt {
domainId: string
manifestDigest: string
nodeId: string
nodeType: DomainNodeType
receiptId: string
state: 'online'
}
@ -217,6 +219,9 @@ export function acceptDomainSession(
if (session.expiresAt <= now) {
throw new DomainContractError('domain_session_expired')
}
if (session.nodeType !== state.nodeType) {
throw new DomainContractError('domain_session_node_type_mismatch')
}
if (!session.scopes.includes(REQUIRED_ENTER_SCOPE)) {
throw new DomainContractError('domain_session_enter_scope_missing')
}
@ -238,6 +243,9 @@ export function acceptDomainConnectionReceipt(
if (receipt.nodeId !== state.session.nodeId) {
throw new DomainContractError('domain_connection_node_mismatch')
}
if (receipt.nodeType !== state.nodeType || receipt.nodeType !== state.session.nodeType) {
throw new DomainContractError('domain_connection_node_type_mismatch')
}
if (receipt.manifestDigest !== state.manifest.provenance.digest) {
throw new DomainContractError('domain_connection_manifest_mismatch')
}