326 lines
11 KiB
TypeScript
326 lines
11 KiB
TypeScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { createHash, generateKeyPairSync, sign } from 'node:crypto';
|
|
import {
|
|
domainManifestSigningBytes,
|
|
evaluateDomainAccess,
|
|
parseDomainAccessHandoff,
|
|
verifyDomainAccessHandoffFromSnapshot,
|
|
} from './domain-access.js';
|
|
import {
|
|
parseTrustedManifestSignerRegistry,
|
|
resolveTrustedManifestSigner,
|
|
type TrustedManifestSigner,
|
|
} from './trusted-signer-registry.js';
|
|
import { TrustedSignerSnapshotLoader } from './trusted-signer-snapshot.js';
|
|
|
|
const NOW = 1_786_291_200_000;
|
|
const COMMIT = 'b'.repeat(40);
|
|
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
|
|
function trustedSignerFromRegistry(overrides: Record<string, unknown> = {}): TrustedManifestSigner {
|
|
const parsed = parseTrustedManifestSignerRegistry({
|
|
registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
|
|
schema: 'gh-aios.trusted-domain-manifest-signers/v1',
|
|
signers: [{
|
|
algorithm: 'Ed25519',
|
|
domainIds: ['DOM-FIFTH-0001'],
|
|
publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
status: 'ACTIVE',
|
|
...overrides,
|
|
}],
|
|
state: 'CURRENT',
|
|
version: '1.0.0',
|
|
}, {
|
|
repositoryId: 'REPO-012',
|
|
sourceCommit: 'a'.repeat(40),
|
|
sourceUrl: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
|
|
});
|
|
const signer = resolveTrustedManifestSigner(parsed, {
|
|
domainId: 'DOM-FIFTH-0001',
|
|
repositoryId: String(overrides.repositoryId ?? 'REPO-014'),
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
});
|
|
if (!signer) throw new Error('test_trusted_signer_missing');
|
|
return signer;
|
|
}
|
|
const trustedSigner = trustedSignerFromRegistry();
|
|
const manifestPayload = {
|
|
domainId: 'DOM-FIFTH-0001',
|
|
repositoryId: 'REPO-014',
|
|
schema: 'gh-aios.domain-manifest/v1',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
sourceCommit: COMMIT,
|
|
} as const;
|
|
const signedBytes = domainManifestSigningBytes(manifestPayload);
|
|
const DIGEST = createHash('sha256').update(signedBytes).digest('hex');
|
|
|
|
const validHandoff = {
|
|
connectionReceipt: {
|
|
connectionId: 'CONN-001',
|
|
domainId: 'DOM-FIFTH-0001',
|
|
manifestDigest: DIGEST,
|
|
nodeId: 'LOCAL-001',
|
|
receiptId: 'RECEIPT-001',
|
|
state: 'online',
|
|
},
|
|
manifest: {
|
|
digest: DIGEST,
|
|
...manifestPayload,
|
|
signature: sign(null, signedBytes, privateKey).toString('base64'),
|
|
},
|
|
sessionCapability: {
|
|
capabilityId: 'CAP-001',
|
|
domainId: 'DOM-FIFTH-0001',
|
|
expiresAt: NOW + 60_000,
|
|
nodeId: 'LOCAL-001',
|
|
scopes: ['domain:enter'],
|
|
},
|
|
} as const;
|
|
const verifiedHandoff = parseDomainAccessHandoff(
|
|
validHandoff,
|
|
'DOM-FIFTH-0001',
|
|
'LOCAL-001',
|
|
trustedSigner,
|
|
NOW,
|
|
);
|
|
|
|
const SNAPSHOT_COMMIT = 'a'.repeat(40);
|
|
const SNAPSHOT_ANCHOR_URL = 'https://guanghulab.com/api/ai/v1/anchor';
|
|
const SNAPSHOT_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${SNAPSHOT_COMMIT}/routing/trusted-domain-manifest-signers.json`;
|
|
|
|
function snapshotAnchor() {
|
|
return {
|
|
schema: 'guanghu.public-navigation-anchor/v1',
|
|
anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
|
|
state: 'CURRENT_CANONICAL',
|
|
repository_id: 'REPO-012',
|
|
branch: 'main',
|
|
public_entry: SNAPSHOT_ANCHOR_URL,
|
|
code_entry: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
|
|
maps: {
|
|
trusted_domain_manifest_signers: {
|
|
path: 'routing/trusted-domain-manifest-signers.json',
|
|
id: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
|
|
version: '1.0.0',
|
|
},
|
|
},
|
|
navigation_source: {
|
|
anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
|
|
source_commit: SNAPSHOT_COMMIT,
|
|
source_mode: 'REPO-012_MAIN_GIT_SNAPSHOT',
|
|
source_degraded: false,
|
|
},
|
|
};
|
|
}
|
|
|
|
function snapshotRegistry(signers: unknown[] = [{
|
|
algorithm: 'Ed25519',
|
|
domainIds: ['DOM-FIFTH-0001'],
|
|
publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
status: 'ACTIVE',
|
|
}]) {
|
|
return {
|
|
registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
|
|
schema: 'gh-aios.trusted-domain-manifest-signers/v1',
|
|
signers,
|
|
state: 'CURRENT',
|
|
version: '1.0.0',
|
|
};
|
|
}
|
|
|
|
function snapshotLoader(readRegistry: () => unknown) {
|
|
return new TrustedSignerSnapshotLoader({
|
|
async fetchJson(url) {
|
|
if (url === SNAPSHOT_ANCHOR_URL) return snapshotAnchor();
|
|
if (url === SNAPSHOT_REGISTRY_URL) return readRegistry();
|
|
throw new Error('unexpected_url');
|
|
},
|
|
});
|
|
}
|
|
|
|
test('a local workspace remains available without claiming domain runtime access', () => {
|
|
const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '' }, NOW);
|
|
assert.equal(status.localWorkspaceAllowed, true);
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.equal(status.stage, 'login-required');
|
|
});
|
|
|
|
test('a verified Forgejo account is not a domain runtime session', () => {
|
|
const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY' }, NOW);
|
|
assert.equal(status.stage, 'identity-verified');
|
|
assert.deepEqual(status.blockers, [
|
|
'verified_domain_manifest_missing',
|
|
'scoped_session_capability_missing',
|
|
'matching_connection_receipt_missing',
|
|
]);
|
|
});
|
|
|
|
test('runtime access requires matching manifest, scoped capability and online receipt', () => {
|
|
const handoff = parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW);
|
|
const status = evaluateDomainAccess({
|
|
accountVerified: true,
|
|
domainId: 'DOM-FIFTH-0001',
|
|
nodeId: 'LOCAL-001',
|
|
...handoff,
|
|
}, NOW);
|
|
assert.equal(status.runtimeReady, true);
|
|
assert.equal(status.stage, 'runtime-ready');
|
|
assert.deepEqual(status.blockers, []);
|
|
});
|
|
|
|
test('the runtime handoff entry resolves its signer only from a loaded snapshot', async () => {
|
|
const snapshot = await snapshotLoader(() => snapshotRegistry()).refresh();
|
|
const verified = verifyDomainAccessHandoffFromSnapshot(
|
|
validHandoff,
|
|
'DOM-FIFTH-0001',
|
|
'LOCAL-001',
|
|
{ repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
|
|
snapshot,
|
|
NOW,
|
|
);
|
|
|
|
assert.equal(verified.trustSource.status, 'CURRENT');
|
|
assert.equal(verified.trustSource.sourceCommit, SNAPSHOT_COMMIT);
|
|
assert.equal(evaluateDomainAccess({
|
|
accountVerified: true,
|
|
domainId: 'DOM-FIFTH-0001',
|
|
nodeId: 'LOCAL-001',
|
|
...verified.handoff,
|
|
}, NOW).runtimeReady, true);
|
|
});
|
|
|
|
test('an empty, forged or mismatched snapshot cannot open the runtime handoff', async () => {
|
|
const empty = await snapshotLoader(() => snapshotRegistry([])).refresh();
|
|
assert.throws(() => verifyDomainAccessHandoffFromSnapshot(
|
|
validHandoff,
|
|
'DOM-FIFTH-0001',
|
|
'LOCAL-001',
|
|
{ repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
|
|
empty,
|
|
NOW,
|
|
), /domain_access_handoff_invalid/);
|
|
|
|
const loaded = await snapshotLoader(() => snapshotRegistry()).refresh();
|
|
assert.throws(() => verifyDomainAccessHandoffFromSnapshot(
|
|
validHandoff,
|
|
'DOM-FIFTH-0001',
|
|
'LOCAL-001',
|
|
{ repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
|
|
{ ...loaded },
|
|
NOW,
|
|
), /domain_access_handoff_invalid/);
|
|
assert.throws(() => verifyDomainAccessHandoffFromSnapshot(
|
|
validHandoff,
|
|
'DOM-FIFTH-0001',
|
|
'LOCAL-001',
|
|
{ repositoryId: 'REPO-OTHER', signerId: 'GH-LIGHTHOUSE-001' },
|
|
loaded,
|
|
NOW,
|
|
), /domain_access_handoff_invalid/);
|
|
});
|
|
|
|
test('a clearly degraded last-known-good snapshot remains usable without claiming freshness', async () => {
|
|
let registry: unknown = snapshotRegistry();
|
|
const loader = snapshotLoader(() => registry);
|
|
await loader.refresh();
|
|
registry = { ...snapshotRegistry(), version: 'invalid' };
|
|
const degraded = await loader.refresh();
|
|
|
|
const verified = verifyDomainAccessHandoffFromSnapshot(
|
|
validHandoff,
|
|
'DOM-FIFTH-0001',
|
|
'LOCAL-001',
|
|
{ repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
|
|
degraded,
|
|
NOW,
|
|
);
|
|
assert.equal(verified.trustSource.status, 'DEGRADED_LAST_KNOWN_GOOD');
|
|
assert.equal(verified.trustSource.reason, 'REGISTRY_INVALID');
|
|
assert.equal(verified.trustSource.sourceCommit, SNAPSHOT_COMMIT);
|
|
});
|
|
|
|
test('mismatched or expired evidence fails closed', () => {
|
|
const status = evaluateDomainAccess({
|
|
accountVerified: true,
|
|
connectionReceipt: { connectionId: 'CONN-001', domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', receiptId: 'RECEIPT-001', state: 'online' },
|
|
domainId: 'DOM-FIFTH-0001',
|
|
manifest: verifiedHandoff.manifest,
|
|
nodeId: 'LOCAL-001',
|
|
sessionCapability: { capabilityId: 'CAP-001', domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
|
|
}, NOW);
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.ok(status.blockers.includes('scoped_session_capability_missing'));
|
|
assert.ok(status.blockers.includes('matching_connection_receipt_missing'));
|
|
});
|
|
|
|
test('the input cannot supply its own verifier receipt', () => {
|
|
assert.throws(() => parseDomainAccessHandoff({
|
|
...validHandoff,
|
|
manifest: {
|
|
...validHandoff.manifest,
|
|
verifierReceipt: { state: 'verified' },
|
|
},
|
|
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
|
|
});
|
|
|
|
test('unknown fields and malformed digests fail closed', () => {
|
|
assert.throws(() => parseDomainAccessHandoff({
|
|
...validHandoff,
|
|
manifest: { ...validHandoff.manifest, digest: 'not-a-digest' },
|
|
trusted: true,
|
|
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
|
|
});
|
|
|
|
test('the handoff is bound to the requested domain, node and manifest digest', () => {
|
|
assert.throws(() => parseDomainAccessHandoff({
|
|
...validHandoff,
|
|
connectionReceipt: { ...validHandoff.connectionReceipt, manifestDigest: 'c'.repeat(64) },
|
|
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
|
|
assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'OTHER-NODE', trustedSigner, NOW), /domain_access_handoff_invalid/);
|
|
});
|
|
|
|
test('manifest tampering and signatures from another key fail closed', () => {
|
|
assert.throws(() => parseDomainAccessHandoff({
|
|
...validHandoff,
|
|
manifest: { ...validHandoff.manifest, sourceCommit: 'c'.repeat(40) },
|
|
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
|
|
|
|
const other = generateKeyPairSync('ed25519');
|
|
assert.throws(() => parseDomainAccessHandoff({
|
|
...validHandoff,
|
|
manifest: {
|
|
...validHandoff.manifest,
|
|
signature: sign(null, signedBytes, other.privateKey).toString('base64'),
|
|
},
|
|
}, 'DOM-FIFTH-0001', 'LOCAL-001', trustedSigner, NOW), /domain_access_handoff_invalid/);
|
|
});
|
|
|
|
test('trusted signer identity and repository are external inputs, not payload authority', () => {
|
|
assert.throws(() => parseDomainAccessHandoff(
|
|
validHandoff,
|
|
'DOM-FIFTH-0001',
|
|
'LOCAL-001',
|
|
trustedSignerFromRegistry({ repositoryId: 'REPO-OTHER' }),
|
|
NOW,
|
|
), /domain_access_handoff_invalid/);
|
|
});
|
|
|
|
test('copying verified-looking fields cannot bypass the in-process verifier boundary', () => {
|
|
const status = evaluateDomainAccess({
|
|
accountVerified: true,
|
|
connectionReceipt: verifiedHandoff.connectionReceipt,
|
|
domainId: 'DOM-FIFTH-0001',
|
|
manifest: {
|
|
...verifiedHandoff.manifest,
|
|
verifierReceipt: { ...verifiedHandoff.manifest.verifierReceipt },
|
|
},
|
|
nodeId: 'LOCAL-001',
|
|
sessionCapability: verifiedHandoff.sessionCapability,
|
|
}, NOW);
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.ok(status.blockers.includes('verified_domain_manifest_missing'));
|
|
});
|