bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(domain-access): verify manifest signatures

Browse source
This commit is contained in:
冰朔 2026-08-10 02:07:25 +08:00
commit fa2c868e0a
2 changed files with 153 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

108
product-source/guanghu-knowledge-base/server/domain-access.test.ts
View file

@ -1,10 +1,30 @@
import test from 'node:test';
import assert from 'node:assert/strict';
import { evaluateDomainAccess, parseDomainAccessHandoff } from './domain-access.js';
import { createHash, generateKeyPairSync, sign } from 'node:crypto';
import {
domainManifestSigningBytes,
evaluateDomainAccess,
parseDomainAccessHandoff,
} from './domain-access.js';
const NOW = 1_786_291_200_000;
const DIGEST = 'a'.repeat(64);
const COMMIT = 'b'.repeat(40);
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
const trustedSigner = {
algorithm: 'Ed25519',
publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
repositoryId: 'REPO-014',
signerId: 'GH-LIGHTHOUSE-001',
} as const;
const manifestPayload = {
domainId: 'DOM-FIFTH-0001',
repositoryId: 'REPO-014',
schema: 'gh-aios.domain-manifest/v1',
signerId: 'GH-LIGHTHOUSE-001',
sourceCommit: COMMIT,
} as const;
const signedBytes = domainManifestSigningBytes(manifestPayload);
const DIGEST = createHash('sha256').update(signedBytes).digest('hex');
const validHandoff = {
connectionReceipt: {
@ -17,17 +37,8 @@ const validHandoff = {
},
manifest: {
digest: DIGEST,
domainId: 'DOM-FIFTH-0001',
schema: 'gh-aios.domain-manifest/v1',
signerId: 'GH-LIGHTHOUSE-001',
sourceCommit: COMMIT,
verifierReceipt: {
manifestDigest: DIGEST,
signerId: 'GH-LIGHTHOUSE-001',
state: 'verified',
verifiedAt: NOW - 1_000,
verifierId: 'GH-MANIFEST-VERIFIER-001',
},
...manifestPayload,
signature: sign(null, signedBytes, privateKey).toString('base64'),
},
sessionCapability: {
capabilityId: 'CAP-001',
@ -37,6 +48,13 @@ const validHandoff = {
scopes: ['domain:enter'],
},
} as const;
const verifiedHandoff = parseDomainAccessHandoff(
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
trustedSigner,
NOW,
);
test('a local workspace remains available without claiming domain runtime access', () => {
const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '' }, NOW);
@ -56,7 +74,7 @@ test('a verified Forgejo account is not a domain runtime session', () => {
});
test('runtime access requires matching manifest, scoped capability and online receipt', () => {
const handoff = parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', NOW);
const handoff = parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW);
const status = evaluateDomainAccess({
accountVerified: true,
domainId: 'DOM-FIFTH-0001',
@ -73,7 +91,7 @@ test('mismatched or expired evidence fails closed', () => {
accountVerified: true,
connectionReceipt: { connectionId: 'CONN-001', domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', receiptId: 'RECEIPT-001', state: 'online' },
domainId: 'DOM-FIFTH-0001',
manifest: validHandoff.manifest,
manifest: verifiedHandoff.manifest,
nodeId: 'LOCAL-001',
sessionCapability: { capabilityId: 'CAP-001', domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
}, NOW);
@ -82,18 +100,14 @@ test('mismatched or expired evidence fails closed', () => {
assert.ok(status.blockers.includes('matching_connection_receipt_missing'));
});
test('a verified boolean cannot substitute for an external verifier receipt', () => {
test('the input cannot supply its own verifier receipt', () => {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: {
digest: DIGEST,
domainId: 'DOM-FIFTH-0001',
schema: 'gh-aios.domain-manifest/v1',
signerId: 'GH-LIGHTHOUSE-001',
sourceCommit: COMMIT,
verified: true,
...validHandoff.manifest,
verifierReceipt: { state: 'verified' },
},
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('unknown fields and malformed digests fail closed', () => {
@ -101,13 +115,55 @@ test('unknown fields and malformed digests fail closed', () => {
...validHandoff,
manifest: { ...validHandoff.manifest, digest: 'not-a-digest' },
trusted: true,
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('the handoff is bound to the requested domain, node and manifest digest', () => {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
connectionReceipt: { ...validHandoff.connectionReceipt, manifestDigest: 'c'.repeat(64) },
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'OTHER-NODE', NOW), /domain_access_handoff_invalid/);
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'OTHER-NODE', trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('manifest tampering and signatures from another key fail closed', () => {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: { ...validHandoff.manifest, sourceCommit: 'c'.repeat(40) },
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
const other = generateKeyPairSync('ed25519');
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: {
...validHandoff.manifest,
signature: sign(null, signedBytes, other.privateKey).toString('base64'),
},
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('trusted signer identity and repository are external inputs, not payload authority', () => {
assert.throws(() => parseDomainAccessHandoff(
validHandoff,
'DOM-FIFTH-0001',
'LOCAL-001',
{ ...trustedSigner, repositoryId: 'REPO-OTHER' },
NOW,
), /domain_access_handoff_invalid/);
});
test('copying verified-looking fields cannot bypass the in-process verifier boundary', () => {
const status = evaluateDomainAccess({
accountVerified: true,
connectionReceipt: verifiedHandoff.connectionReceipt,
domainId: 'DOM-FIFTH-0001',
manifest: {
...verifiedHandoff.manifest,
verifierReceipt: { ...verifiedHandoff.manifest.verifierReceipt },
},
nodeId: 'LOCAL-001',
sessionCapability: verifiedHandoff.sessionCapability,
}, NOW);
assert.equal(status.runtimeReady, false);
assert.ok(status.blockers.includes('verified_domain_manifest_missing'));
});