48 lines
2.6 KiB
TypeScript
48 lines
2.6 KiB
TypeScript
import { getPublicDomainVestibule, type DomainRouteId, type PublicDomainVestibule } from './public-domain-directory.js';
|
|
import type { DomainAccessProjection } from './domain-connection.js';
|
|
|
|
export type DomainNodeType = 'local-terminal' | 'cloud-resident';
|
|
|
|
export interface DomainEntryTarget {
|
|
domain: PublicDomainVestibule;
|
|
nodeType: DomainNodeType;
|
|
}
|
|
|
|
export function createDomainEntryTarget(routeId: DomainRouteId, nodeType: DomainNodeType = 'local-terminal'): DomainEntryTarget {
|
|
const domain = getPublicDomainVestibule(routeId);
|
|
if (!domain.supportedNodeTypes.includes(nodeType)) throw new Error('DOMAIN_NODE_TYPE_NOT_SUPPORTED');
|
|
return Object.freeze({ domain, nodeType });
|
|
}
|
|
|
|
export function canEnterSelectedDomainRuntime(target: DomainEntryTarget | null, access: DomainAccessProjection): boolean {
|
|
if (!target || !access.runtimeReady) return false;
|
|
if (access.domainId !== target.domain.stableDomainId) return false;
|
|
if (access.nodeType !== target.nodeType) return false;
|
|
// The present desktop bundle contains only the Fifth Domain renderer. The four
|
|
// enterprise domains must provide their own signed runtime package and endpoint.
|
|
if (target.domain.routeId !== 'fifth') return false;
|
|
const policy = access.runtimePolicy;
|
|
return Boolean(policy
|
|
&& /^[a-f0-9]{64}$/.test(policy.manifestDigest)
|
|
&& policy.themeOwner === 'fifth-domain'
|
|
&& policy.themePackageRef.startsWith('theme://origin-domain/')
|
|
&& policy.routeRef.startsWith('domain-route://origin-domain/')
|
|
&& policy.allowedSessionScopes.includes('domain:enter'));
|
|
}
|
|
|
|
export function projectDomainRuntimeBoundary(target: DomainEntryTarget | null, access: DomainAccessProjection): string {
|
|
if (!target) return '请先选择目标域；系统不会把通用登录请求默认路由到第五域。';
|
|
if (access.domainId && access.domainId !== target.domain.stableDomainId) {
|
|
return '回读证据属于另一个域；当前入口保持关闭。';
|
|
}
|
|
if (access.nodeType && access.nodeType !== target.nodeType) {
|
|
return '回读证据属于另一种节点类型；当前入口保持关闭并重新核验。';
|
|
}
|
|
if (target.domain.routeId !== 'fifth') {
|
|
return `${target.domain.displayName}的独立运行端点与主题包尚未登记；当前只能查看公开门厅。`;
|
|
}
|
|
if (!access.runtimeReady) return '第五域入口保持关闭，直到四项真实接入证据全部匹配。';
|
|
return canEnterSelectedDomainRuntime(target, access)
|
|
? '第五域运行端点、签名清单、主题策略、会话能力与在线回执已经匹配。'
|
|
: '域接入证据声称已就绪，但可信运行策略缺失或不匹配；第五域入口保持关闭。';
|
|
}
|