33 lines
1.6 KiB
JavaScript
33 lines
1.6 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import fs from 'node:fs'
|
|
import path from 'node:path'
|
|
import test from 'node:test'
|
|
import { fileURLToPath } from 'node:url'
|
|
|
|
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
|
|
const audit = JSON.parse(fs.readFileSync(path.join(root, 'audit/donor-audit.json'), 'utf8'))
|
|
|
|
test('all donors remain read-only and source copying stays blocked', () => {
|
|
assert.equal(audit.complete, false)
|
|
assert.equal(audit.donors.length, 3)
|
|
for (const donor of audit.donors) {
|
|
assert.match(donor.role, /^READ_ONLY_/)
|
|
assert.match(donor.code_reuse, /^BLOCKED_/)
|
|
}
|
|
})
|
|
|
|
test('audit preserves security and secret migration prohibitions', () => {
|
|
assert.ok(audit.prohibited_transplants.includes('UNAUTHENTICATED_LOOPBACK_CONTROL_API_OR_NULL_ORIGIN_CORS'))
|
|
assert.ok(audit.prohibited_transplants.includes('ELECTRON_PRIVILEGED_PRELOAD_WITHOUT_NAVIGATION_AND_SENDER_ORIGIN_LOCK'))
|
|
const secretData = audit.data_classes.find((entry) => entry.class === 'MODEL_AND_SERVER_CREDENTIALS')
|
|
assert.match(secretData.migration, /NEVER_COPY_AS_PLAIN_DATA/)
|
|
})
|
|
|
|
test('visual implementation cannot start while audit gates remain open', () => {
|
|
assert.ok(audit.open_gates.includes('VISUAL_DIRECTION_SELECTION'))
|
|
assert.ok(!audit.open_gates.includes('LEGACY_TAURI_SECURITY_SCAN'))
|
|
const legacyTauri = audit.donors.find((entry) => entry.path === '../hololake-platform')
|
|
assert.match(legacyTauri.security_scan, /REVIEW_COMPLETE/)
|
|
assert.ok(legacyTauri.validated_security_findings.includes('MODEL_TOOL_MUTATIONS_WITHOUT_EXACT_HUMAN_CONFIRMATION'))
|
|
assert.ok(audit.open_gates.includes('REVERSIBLE_DATA_MIGRATION_REHEARSAL'))
|
|
})
|