feat: publish HoloLake model-native living system source

product-source/hololake-platform/scripts/deployment-source-guard.test.mjs

@@ -0,0 +1,104 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { validateDeploymentSource } from './deployment-source-guard.mjs'
+
+const policy = {
+  schema: 'hololake.source-route-policy/v1',
+  routes: [
+    {
+      distribution: 'personal',
+      repository_id: 'REPO-008',
+      channel_id: 'HLP-CHANNEL-0001',
+      source_node: 'JD-FD-PRIMARY',
+      source_owner_id: 'ICE-GL∞',
+      allowed_authorizers: ['ICE-GL∞'],
+      allowed_personas: ['ICE-GL-ZY001'],
+      allowed_execution_runtimes: ['SYS-GLW-ZY-EXEC-0001'],
+      allowed_targets: ['JD-FD-PRIMARY'],
+      deployment_enabled: true,
+    },
+    {
+      distribution: 'team',
+      repository_id: null,
+      channel_id: null,
+      source_node: 'AW-GZ-001',
+      allowed_personas: [],
+      allowed_targets: ['AW-GZ-001'],
+      deployment_enabled: false,
+    },
+    {
+      distribution: 'public-module',
+      repository_id: null,
+      channel_id: null,
+      source_node: null,
+      allowed_personas: [],
+      allowed_targets: [],
+      deployment_enabled: false,
+    },
+  ],
+}
+
+test('allows Ice Shuo authorization plus Zhuyuan main control to package the personal distribution', () => {
+  assert.deepEqual(validateDeploymentSource(policy, {
+    distribution: 'personal',
+    repositoryId: 'REPO-008',
+    channelId: 'HLP-CHANNEL-0001',
+    sourceOwnerId: 'ICE-GL∞',
+    authorizerId: 'ICE-GL∞',
+    personaId: 'ICE-GL-ZY001',
+    executionRuntimeId: 'SYS-GLW-ZY-EXEC-0001',
+    target: 'JD-FD-PRIMARY',
+  }), { ok: true })
+})
+
+test('rejects a team persona using Ice Shuo personal source', () => {
+  assert.deepEqual(validateDeploymentSource(policy, {
+    distribution: 'personal',
+    repositoryId: 'REPO-008',
+    channelId: 'HLP-CHANNEL-0001',
+    sourceOwnerId: 'ICE-GL∞',
+    authorizerId: 'ICE-GL∞',
+    personaId: 'AGE-TEAM-001',
+    executionRuntimeId: 'SYS-GLW-ZY-EXEC-0001',
+    target: 'JD-FD-PRIMARY',
+  }), { ok: false, reason: 'deployment_persona_not_allowed' })
+})
+
+test('blocks team deployment until its enterprise repository route is registered', () => {
+  assert.deepEqual(validateDeploymentSource(policy, {
+    distribution: 'team',
+    repositoryId: 'REPO-008',
+    channelId: 'HLP-CHANNEL-0001',
+    sourceOwnerId: 'ICE-GL∞',
+    authorizerId: 'ICE-GL∞',
+    personaId: 'AGE-TEAM-001',
+    executionRuntimeId: 'SYS-GLW-ZY-EXEC-0001',
+    target: 'AW-GZ-001',
+  }), { ok: false, reason: 'deployment_source_route_inactive' })
+})
+
+test('public modules are reusable source and never an application deployment target', () => {
+  assert.deepEqual(validateDeploymentSource(policy, {
+    distribution: 'public-module',
+    repositoryId: 'REPO-008',
+    channelId: 'HLP-CHANNEL-0001',
+    sourceOwnerId: 'ICE-GL∞',
+    authorizerId: 'ICE-GL∞',
+    personaId: 'ICE-GL-ZY001',
+    executionRuntimeId: 'SYS-GLW-ZY-EXEC-0001',
+    target: 'JD-FD-PRIMARY',
+  }), { ok: false, reason: 'deployment_source_route_inactive' })
+})
+
+test('rejects a human identity presented as the executing persona', () => {
+  assert.deepEqual(validateDeploymentSource(policy, {
+    distribution: 'personal',
+    repositoryId: 'REPO-008',
+    channelId: 'HLP-CHANNEL-0001',
+    sourceOwnerId: 'ICE-GL∞',
+    authorizerId: 'ICE-GL∞',
+    personaId: 'ICE-GL∞',
+    executionRuntimeId: 'SYS-GLW-ZY-EXEC-0001',
+    target: 'JD-FD-PRIMARY',
+  }), { ok: false, reason: 'deployment_persona_not_allowed' })
+})