92 lines
4 KiB
TypeScript
92 lines
4 KiB
TypeScript
export type DomainAccessStage = 'checking' | 'login-required' | 'identity-verified' | 'runtime-ready';
|
|
|
|
export interface DomainAccessProjection {
|
|
blockers: string[];
|
|
domainId?: string;
|
|
nodeId?: string;
|
|
nodeType?: 'local-terminal' | 'cloud-resident';
|
|
runtimeReady: boolean;
|
|
stage: DomainAccessStage;
|
|
trustSource?: {
|
|
reason?: 'ANCHOR_INVALID' | 'REGISTRY_INVALID' | 'SOURCE_UNAVAILABLE';
|
|
registryVersion: string | null;
|
|
signerCount: number;
|
|
sourceCommit: string | null;
|
|
status: 'CURRENT' | 'DEGRADED_LAST_KNOWN_GOOD' | 'UNAVAILABLE';
|
|
};
|
|
}
|
|
|
|
export interface DomainConnectionStep {
|
|
id: 'identity' | 'manifest' | 'capability' | 'receipt';
|
|
label: string;
|
|
state: 'checking' | 'blocked' | 'verified';
|
|
detail: string;
|
|
}
|
|
|
|
const blockerToStep: Record<string, DomainConnectionStep['id']> = {
|
|
account_identity_missing: 'identity',
|
|
verified_node_registration_missing: 'identity',
|
|
verified_domain_manifest_missing: 'manifest',
|
|
scoped_session_capability_missing: 'capability',
|
|
matching_connection_receipt_missing: 'receipt',
|
|
desktop_runtime_required: 'identity',
|
|
domain_access_probe_failed: 'identity',
|
|
};
|
|
|
|
const stepCopy: Record<DomainConnectionStep['id'], { label: string; pending: string; verified: string }> = {
|
|
identity: {
|
|
label: '账户与登记节点',
|
|
pending: '需要由已登记的本地终端节点或云常驻节点完成身份证明',
|
|
verified: '账户声明和节点编号已经验证',
|
|
},
|
|
manifest: {
|
|
label: '目标域签名清单',
|
|
pending: '等待目标域可信签名人签发并验证域 manifest',
|
|
verified: '目标域 manifest 与可信签名来源一致',
|
|
},
|
|
capability: {
|
|
label: '域会话能力',
|
|
pending: '等待签发仅允许进入当前域的短期会话能力',
|
|
verified: '当前节点持有有效的 domain:enter 能力',
|
|
},
|
|
receipt: {
|
|
label: '在线连接回执',
|
|
pending: '等待目标域运行体返回与节点、清单一致的在线回执',
|
|
verified: '连接回执已回读并与当前会话一致',
|
|
},
|
|
};
|
|
|
|
export function projectDomainConnectionSteps(access: DomainAccessProjection): DomainConnectionStep[] {
|
|
const blockers = new Set(access.blockers.map(blocker => blockerToStep[blocker]).filter(Boolean));
|
|
const ordered: DomainConnectionStep['id'][] = ['identity', 'manifest', 'capability', 'receipt'];
|
|
return ordered.map(id => {
|
|
const copy = stepCopy[id];
|
|
const verified = access.runtimeReady || (!blockers.has(id) && access.stage !== 'checking');
|
|
let detail = verified ? copy.verified : copy.pending;
|
|
if (!verified && id === 'manifest' && access.trustSource) {
|
|
if (access.trustSource.status === 'UNAVAILABLE') {
|
|
detail = '当前无法回读灯塔的可信签名人登记表；系统保持关闭，不使用缓存猜测域权限';
|
|
} else if (access.trustSource.status === 'DEGRADED_LAST_KNOWN_GOOD') {
|
|
detail = '当前只能回读上一次可信签名人快照；实时来源恢复前不签发新的域权限';
|
|
} else if (access.trustSource.signerCount === 0) {
|
|
detail = '灯塔登记表已回读为当前版本，但尚未登记任何目标域签名人';
|
|
}
|
|
}
|
|
return {
|
|
id,
|
|
label: copy.label,
|
|
state: access.stage === 'checking' ? 'checking' : verified ? 'verified' : 'blocked',
|
|
detail: access.stage === 'checking' ? '正在核对当前接入证据' : detail,
|
|
};
|
|
});
|
|
}
|
|
|
|
export function projectDomainTrustSource(access: DomainAccessProjection): string {
|
|
const source = access.trustSource;
|
|
if (!source) return '可信清单来源尚未由桌面运行时回读';
|
|
if (source.status === 'UNAVAILABLE') return '可信清单来源不可用 · 域入口保持关闭';
|
|
const commit = source.sourceCommit ? source.sourceCommit.slice(0, 8) : '未知提交';
|
|
const version = source.registryVersion ?? '未知版本';
|
|
const health = source.status === 'CURRENT' ? '当前' : '上次可信快照';
|
|
return `可信清单 ${health} · v${version} · ${commit} · 已登记签名人 ${source.signerCount}`;
|
|
}
|