113 lines
4.1 KiB
TypeScript
113 lines
4.1 KiB
TypeScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { evaluateDomainAccess, parseDomainAccessHandoff } from './domain-access.js';
|
|
|
|
const NOW = 1_786_291_200_000;
|
|
const DIGEST = 'a'.repeat(64);
|
|
const COMMIT = 'b'.repeat(40);
|
|
|
|
const validHandoff = {
|
|
connectionReceipt: {
|
|
connectionId: 'CONN-001',
|
|
domainId: 'DOM-FIFTH-0001',
|
|
manifestDigest: DIGEST,
|
|
nodeId: 'LOCAL-001',
|
|
receiptId: 'RECEIPT-001',
|
|
state: 'online',
|
|
},
|
|
manifest: {
|
|
digest: DIGEST,
|
|
domainId: 'DOM-FIFTH-0001',
|
|
schema: 'gh-aios.domain-manifest/v1',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
sourceCommit: COMMIT,
|
|
verifierReceipt: {
|
|
manifestDigest: DIGEST,
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
state: 'verified',
|
|
verifiedAt: NOW - 1_000,
|
|
verifierId: 'GH-MANIFEST-VERIFIER-001',
|
|
},
|
|
},
|
|
sessionCapability: {
|
|
capabilityId: 'CAP-001',
|
|
domainId: 'DOM-FIFTH-0001',
|
|
expiresAt: NOW + 60_000,
|
|
nodeId: 'LOCAL-001',
|
|
scopes: ['domain:enter'],
|
|
},
|
|
} as const;
|
|
|
|
test('a local workspace remains available without claiming domain runtime access', () => {
|
|
const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '' }, NOW);
|
|
assert.equal(status.localWorkspaceAllowed, true);
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.equal(status.stage, 'login-required');
|
|
});
|
|
|
|
test('a verified Forgejo account is not a domain runtime session', () => {
|
|
const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY' }, NOW);
|
|
assert.equal(status.stage, 'identity-verified');
|
|
assert.deepEqual(status.blockers, [
|
|
'verified_domain_manifest_missing',
|
|
'scoped_session_capability_missing',
|
|
'matching_connection_receipt_missing',
|
|
]);
|
|
});
|
|
|
|
test('runtime access requires matching manifest, scoped capability and online receipt', () => {
|
|
const handoff = parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', NOW);
|
|
const status = evaluateDomainAccess({
|
|
accountVerified: true,
|
|
domainId: 'DOM-FIFTH-0001',
|
|
nodeId: 'LOCAL-001',
|
|
...handoff,
|
|
}, NOW);
|
|
assert.equal(status.runtimeReady, true);
|
|
assert.equal(status.stage, 'runtime-ready');
|
|
assert.deepEqual(status.blockers, []);
|
|
});
|
|
|
|
test('mismatched or expired evidence fails closed', () => {
|
|
const status = evaluateDomainAccess({
|
|
accountVerified: true,
|
|
connectionReceipt: { connectionId: 'CONN-001', domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', receiptId: 'RECEIPT-001', state: 'online' },
|
|
domainId: 'DOM-FIFTH-0001',
|
|
manifest: validHandoff.manifest,
|
|
nodeId: 'LOCAL-001',
|
|
sessionCapability: { capabilityId: 'CAP-001', domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
|
|
}, NOW);
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.ok(status.blockers.includes('scoped_session_capability_missing'));
|
|
assert.ok(status.blockers.includes('matching_connection_receipt_missing'));
|
|
});
|
|
|
|
test('a verified boolean cannot substitute for an external verifier receipt', () => {
|
|
assert.throws(() => parseDomainAccessHandoff({
|
|
...validHandoff,
|
|
manifest: {
|
|
digest: DIGEST,
|
|
domainId: 'DOM-FIFTH-0001',
|
|
schema: 'gh-aios.domain-manifest/v1',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
sourceCommit: COMMIT,
|
|
verified: true,
|
|
},
|
|
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
|
|
});
|
|
|
|
test('unknown fields and malformed digests fail closed', () => {
|
|
assert.throws(() => parseDomainAccessHandoff({
|
|
...validHandoff,
|
|
manifest: { ...validHandoff.manifest, digest: 'not-a-digest' },
|
|
trusted: true,
|
|
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
|
|
});
|
|
|
|
test('the handoff is bound to the requested domain, node and manifest digest', () => {
|
|
assert.throws(() => parseDomainAccessHandoff({
|
|
...validHandoff,
|
|
connectionReceipt: { ...validHandoff.connectionReceipt, manifestDigest: 'c'.repeat(64) },
|
|
}, 'DOM-FIFTH-0001', 'LOCAL-001', NOW), /domain_access_handoff_invalid/);
|
|
assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'OTHER-NODE', NOW), /domain_access_handoff_invalid/);
|
|
});
|