bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(domain): bind runtime policy into signed manifests

Browse source
This commit is contained in:
冰朔 2026-08-10 10:04:51 +08:00
commit fbff657d88
4 changed files with 189 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

83
product-source/guanghu-knowledge-base/server/domain-access.test.ts
View file

@ -19,6 +19,9 @@ const COMMIT = 'b'.repeat(40);
const NODE_TYPE = 'local-terminal' as const;
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
function trustedSignerFromRegistry(overrides: Record<string, unknown> = {}): TrustedManifestSigner {
const domainId = Array.isArray(overrides.domainIds) && typeof overrides.domainIds[0] === 'string'
? overrides.domainIds[0]
: 'DOM-FIFTH-0001';
const parsed = parseTrustedManifestSignerRegistry({
registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
schema: 'gh-aios.trusted-domain-manifest-signers/v1',
@ -39,7 +42,7 @@ function trustedSignerFromRegistry(overrides: Record<string, unknown> = {}): Tru
sourceUrl: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
});
const signer = resolveTrustedManifestSigner(parsed, {
domainId: 'DOM-FIFTH-0001',
domainId,
repositoryId: String(overrides.repositoryId ?? 'REPO-014'),
signerId: 'GH-LIGHTHOUSE-001',
});
@ -50,6 +53,14 @@ const trustedSigner = trustedSignerFromRegistry();
const manifestPayload = {
domainId: 'DOM-FIFTH-0001',
repositoryId: 'REPO-014',
runtimePolicy: {
allowedSessionScopes: ['domain:enter', 'knowledge:read'],
forbiddenDataScopes: ['private:relationship-core'],
permissionPolicyRef: 'policy://origin-domain/default',
routeRef: 'domain-route://origin-domain/runtime',
themeOwner: 'fifth-domain',
themePackageRef: 'theme://origin-domain/lake-reflects-stars',
},
schema: 'gh-aios.domain-manifest/v1',
signerId: 'GH-LIGHTHOUSE-001',
sourceCommit: COMMIT,
@ -338,6 +349,76 @@ test('manifest tampering and signatures from another key fail closed', () => {
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('the signed runtime policy rejects theme ownership, unknown fields and scope escalation', () => {
assert.equal(Object.isFrozen(verifiedHandoff.manifest.runtimePolicy), true);
assert.equal(Object.isFrozen(verifiedHandoff.manifest.runtimePolicy.allowedSessionScopes), true);
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: {
...validHandoff.manifest,
runtimePolicy: { ...validHandoff.manifest.runtimePolicy, themeOwner: 'domain-team' },
},
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: {
...validHandoff.manifest,
runtimePolicy: { ...validHandoff.manifest.runtimePolicy, decorativeOverride: true },
},
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
sessionCapability: { ...validHandoff.sessionCapability, scopes: ['domain:enter', 'relationship:private'] },
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('runtime policy lists must be explicit, unique and bound by the signature', () => {
for (const runtimePolicy of [
{ ...validHandoff.manifest.runtimePolicy, allowedSessionScopes: [] },
{ ...validHandoff.manifest.runtimePolicy, allowedSessionScopes: ['domain:enter', 'domain:enter'] },
{ ...validHandoff.manifest.runtimePolicy, forbiddenDataScopes: [] },
]) {
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: { ...validHandoff.manifest, runtimePolicy },
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
}
assert.throws(() => parseDomainAccessHandoff({
...validHandoff,
manifest: {
...validHandoff.manifest,
runtimePolicy: { ...validHandoff.manifest.runtimePolicy, routeRef: 'domain-route://origin-domain/other' },
},
}, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});
test('an enterprise domain cannot reuse the Fifth Domain theme namespace', () => {
const enterpriseSigner = trustedSignerFromRegistry({ domainIds: ['DOM-PRIMARY-0001'] });
const enterprisePayload = {
...manifestPayload,
domainId: 'DOM-PRIMARY-0001',
runtimePolicy: {
...manifestPayload.runtimePolicy,
themeOwner: 'domain-team' as const,
},
};
const enterpriseBytes = domainManifestSigningBytes(enterprisePayload);
const enterpriseDigest = createHash('sha256').update(enterpriseBytes).digest('hex');
assert.throws(() => parseDomainAccessHandoff({
connectionReceipt: { ...validHandoff.connectionReceipt, domainId: enterprisePayload.domainId, manifestDigest: enterpriseDigest },
manifest: {
digest: enterpriseDigest,
...enterprisePayload,
signature: sign(null, enterpriseBytes, privateKey).toString('base64'),
},
sessionCapability: { ...validHandoff.sessionCapability, domainId: enterprisePayload.domainId },
}, enterprisePayload.domainId, 'LOCAL-001', NODE_TYPE, enterpriseSigner, NOW), /domain_access_handoff_invalid/);
});
test('trusted signer identity and repository are external inputs, not payload authority', () => {
assert.throws(() => parseDomainAccessHandoff(
validHandoff,