bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(domain-access): validate signed handoff evidence

Browse source
This commit is contained in:
冰朔 2026-08-10 01:52:42 +08:00
commit b68a6bfe14
2 changed files with 195 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

76
product-source/guanghu-knowledge-base/server/domain-access.test.ts
View file

@ -1,9 +1,42 @@
import test from 'node:test';
import assert from 'node:assert/strict';
import { evaluateDomainAccess } from './domain-access.js';
import { evaluateDomainAccess, parseDomainAccessHandoff } from './domain-access.js';
const NOW = 1_786_291_200_000;
const DIGEST = 'a'.repeat(64);
const COMMIT = 'b'.repeat(40);
const validHandoff = {
connectionReceipt: {
connectionId: 'CONN-001',
domainId: 'DOM-FIFTH-0001',
manifestDigest: DIGEST,
nodeId: 'LOCAL-001',
receiptId: 'RECEIPT-001',
state: 'online',
},
manifest: {
digest: DIGEST,
domainId: 'DOM-FIFTH-0001',
schema: 'gh-aios.domain-manifest/v1',
signerId: 'GH-LIGHTHOUSE-001',
sourceCommit: COMMIT,
verifierReceipt: {
manifestDigest: DIGEST,
signerId: 'GH-LIGHTHOUSE-001',
state: 'verified',
verifiedAt: NOW - 1_000,
verifierId: 'GH-MANIFEST-VERIFIER-001',
},
},
sessionCapability: {
capabilityId: 'CAP-001',
domainId: 'DOM-FIFTH-0001',
expiresAt: NOW + 60_000,
nodeId: 'LOCAL-001',
scopes: ['domain:enter'],
},
} as const;
test('a local workspace remains available without claiming domain runtime access', () => {
const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '' }, NOW);
@ -23,13 +56,12 @@ test('a verified Forgejo account is not a domain runtime session', () => {
});
test('runtime access requires matching manifest, scoped capability and online receipt', () => {
const handoff = parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', NOW);
const status = evaluateDomainAccess({
accountVerified: true,
connectionReceipt: { domainId: 'DOM-FIFTH-0001', manifestDigest: DIGEST, nodeId: 'LOCAL-001', state: 'online' },
domainId: 'DOM-FIFTH-0001',
manifest: { digest: DIGEST, domainId: 'DOM-FIFTH-0001', verified: true },
nodeId: 'LOCAL-001',
sessionCapability: { domainId: 'DOM-FIFTH-0001', expiresAt: NOW + 60_000, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
...handoff,
}, NOW);
assert.equal(status.runtimeReady, true);
assert.equal(status.stage, 'runtime-ready');
@ -39,13 +71,43 @@ test('runtime access requires matching manifest, scoped capability and online re
test('mismatched or expired evidence fails closed', () => {
const status = evaluateDomainAccess({
accountVerified: true,
connectionReceipt: { domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', state: 'online' },
connectionReceipt: { connectionId: 'CONN-001', domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', receiptId: 'RECEIPT-001', state: 'online' },
domainId: 'DOM-FIFTH-0001',
manifest: { digest: DIGEST, domainId: 'DOM-FIFTH-0001', verified: true },
manifest: validHandoff.manifest,
nodeId: 'LOCAL-001',
sessionCapability: { domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
sessionCapability: { capabilityId: 'CAP-001', domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
}, NOW);
assert.equal(status.runtimeReady, false);
assert.ok(status.blockers.includes('scoped_session_capability_missing'));
assert.ok(status.blockers.includes('matching_connection_receipt_missing'));
});
test('a verified boolean cannot substitute for an external verifier receipt', () => {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: {
digest: DIGEST,
domainId: 'DOM-FIFTH-0001',
schema: 'gh-aios.domain-manifest/v1',
signerId: 'GH-LIGHTHOUSE-001',
sourceCommit: COMMIT,
verified: true,
},
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
});
test('unknown fields and malformed digests fail closed', () => {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: { ...validHandoff.manifest, digest: 'not-a-digest' },
trusted: true,
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
});
test('the handoff is bound to the requested domain, node and manifest digest', () => {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
connectionReceipt: { ...validHandoff.connectionReceipt, manifestDigest: 'c'.repeat(64) },
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'OTHER-NODE', NOW), /domain_access_handoff_invalid/);
});