361 lines
13 KiB
TypeScript
361 lines
13 KiB
TypeScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { createHash, generateKeyPairSync, sign } from 'node:crypto';
|
|
import { domainManifestSigningBytes } from './domain-access.js';
|
|
import { DomainAccessOrchestrator } from './domain-access-orchestrator.js';
|
|
import { nodeRegistrationClaimSigningBytes } from './node-registration.js';
|
|
import { nodePossessionChallengeSigningBytes } from './node-possession-proof.js';
|
|
import { NodeRegistrationSnapshotLoader } from './node-registration-snapshot.js';
|
|
import { TrustedSignerSnapshotLoader } from './trusted-signer-snapshot.js';
|
|
|
|
const NOW = 1_786_291_200_000;
|
|
const DOMAIN_ID = 'DOM-FIFTH-0001';
|
|
const NODE_ID = 'LOCAL-001';
|
|
const NODE_TYPE = 'local-terminal' as const;
|
|
const ACCOUNT_ID = 'bingshuo';
|
|
const COMMIT = 'a'.repeat(40);
|
|
const ANCHOR_URL = 'https://guanghulab.com/api/ai/v1/anchor';
|
|
const SIGNER_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/trusted-domain-manifest-signers.json`;
|
|
const NODE_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/node-registration-endpoints.json`;
|
|
const manifestKeys = generateKeyPairSync('ed25519');
|
|
const registrationKeys = generateKeyPairSync('ed25519');
|
|
const nodeKeys = generateKeyPairSync('ed25519');
|
|
const nodePublicKeyPem = nodeKeys.publicKey.export({ format: 'pem', type: 'spki' }).toString();
|
|
const nodeKeyFingerprint = createHash('sha256')
|
|
.update(nodeKeys.publicKey.export({ format: 'der', type: 'spki' }))
|
|
.digest('hex');
|
|
|
|
function anchor() {
|
|
return {
|
|
schema: 'guanghu.public-navigation-anchor/v1',
|
|
anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
|
|
state: 'CURRENT_CANONICAL',
|
|
repository_id: 'REPO-012',
|
|
branch: 'main',
|
|
public_entry: ANCHOR_URL,
|
|
code_entry: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
|
|
maps: {
|
|
trusted_domain_manifest_signers: {
|
|
path: 'routing/trusted-domain-manifest-signers.json',
|
|
id: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
|
|
version: '1.0.0',
|
|
},
|
|
node_registration_endpoints: {
|
|
path: 'routing/node-registration-endpoints.json',
|
|
id: 'GH-AIOS-NODE-REGISTRATION-ENDPOINTS-001',
|
|
version: '1.0.0',
|
|
},
|
|
},
|
|
navigation_source: {
|
|
anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
|
|
source_commit: COMMIT,
|
|
source_mode: 'REPO-012_MAIN_GIT_SNAPSHOT',
|
|
source_degraded: false,
|
|
},
|
|
};
|
|
}
|
|
|
|
function signerRegistry(signers: unknown[] = []) {
|
|
return {
|
|
registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
|
|
schema: 'gh-aios.trusted-domain-manifest-signers/v1',
|
|
signers,
|
|
state: 'CURRENT',
|
|
version: '1.0.0',
|
|
};
|
|
}
|
|
|
|
function activeSigner() {
|
|
return {
|
|
algorithm: 'Ed25519',
|
|
domainIds: [DOMAIN_ID],
|
|
publicKeyPem: manifestKeys.publicKey.export({ format: 'pem', type: 'spki' }).toString(),
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
status: 'ACTIVE',
|
|
};
|
|
}
|
|
|
|
function nodeRegistry(version = '1.0.0') {
|
|
return {
|
|
endpoints: [{
|
|
algorithm: 'Ed25519',
|
|
domainIds: [DOMAIN_ID],
|
|
endpointId: 'GH-NODE-REG-001',
|
|
nodeTypes: [NODE_TYPE],
|
|
publicKeyPem: registrationKeys.publicKey.export({ format: 'pem', type: 'spki' }).toString(),
|
|
signerId: 'GH-NODE-REG-SIGNER-001',
|
|
status: 'ACTIVE',
|
|
url: 'https://guanghulab.com/api/ai/v1/node-registrations/claims',
|
|
}],
|
|
registryId: 'GH-AIOS-NODE-REGISTRATION-ENDPOINTS-001',
|
|
schema: 'gh-aios.node-registration-endpoints/v1',
|
|
state: 'CURRENT',
|
|
version,
|
|
};
|
|
}
|
|
|
|
function signerLoader(readRegistry: () => unknown = () => signerRegistry()) {
|
|
return new TrustedSignerSnapshotLoader({
|
|
async fetchJson(url) {
|
|
if (url === ANCHOR_URL) return anchor();
|
|
if (url === SIGNER_REGISTRY_URL) return readRegistry();
|
|
throw new Error('unexpected_url');
|
|
},
|
|
});
|
|
}
|
|
|
|
function registrationLoader(readRegistry: () => unknown = () => nodeRegistry()) {
|
|
return new NodeRegistrationSnapshotLoader({
|
|
async fetchJson(url) {
|
|
if (url === ANCHOR_URL) return anchor();
|
|
if (url === NODE_REGISTRY_URL) return readRegistry();
|
|
throw new Error('unexpected_url');
|
|
},
|
|
});
|
|
}
|
|
|
|
function validRegistrationClaim() {
|
|
const payload = {
|
|
accountId: ACCOUNT_ID,
|
|
claimId: 'NODE-CLAIM-001',
|
|
domainId: DOMAIN_ID,
|
|
endpointId: 'GH-NODE-REG-001',
|
|
expiresAt: NOW + 60_000,
|
|
issuedAt: NOW - 1_000,
|
|
nodeId: NODE_ID,
|
|
nodeKeyFingerprint,
|
|
nodeType: NODE_TYPE,
|
|
schema: 'gh-aios.node-registration-claim/v1' as const,
|
|
signerId: 'GH-NODE-REG-SIGNER-001',
|
|
};
|
|
return {
|
|
...payload,
|
|
signature: sign(null, nodeRegistrationClaimSigningBytes(payload), registrationKeys.privateKey).toString('base64'),
|
|
};
|
|
}
|
|
|
|
function validHandoff() {
|
|
const payload = {
|
|
domainId: DOMAIN_ID,
|
|
repositoryId: 'REPO-014',
|
|
schema: 'gh-aios.domain-manifest/v1',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
sourceCommit: 'b'.repeat(40),
|
|
} as const;
|
|
const bytes = domainManifestSigningBytes(payload);
|
|
const digest = createHash('sha256').update(bytes).digest('hex');
|
|
return {
|
|
connectionReceipt: {
|
|
connectionId: 'CONN-001',
|
|
domainId: DOMAIN_ID,
|
|
manifestDigest: digest,
|
|
nodeId: NODE_ID,
|
|
nodeType: NODE_TYPE,
|
|
receiptId: 'RECEIPT-001',
|
|
state: 'online',
|
|
},
|
|
manifest: {
|
|
digest,
|
|
...payload,
|
|
signature: sign(null, bytes, manifestKeys.privateKey).toString('base64'),
|
|
},
|
|
sessionCapability: {
|
|
capabilityId: 'CAP-001',
|
|
domainId: DOMAIN_ID,
|
|
expiresAt: NOW + 60_000,
|
|
nodeId: NODE_ID,
|
|
nodeType: NODE_TYPE,
|
|
scopes: ['domain:enter'],
|
|
},
|
|
};
|
|
}
|
|
|
|
const loggedOutIdentity = { async read() { return { accountId: '', accountVerified: false, nodeId: '' }; } };
|
|
const loggedInIdentity = { async read() { return { accountId: ACCOUNT_ID, accountVerified: true, nodeId: NODE_ID }; } };
|
|
const validRegistrationSource = { async read() { return validRegistrationClaim(); } };
|
|
const validPossessionSource = {
|
|
async prove(challenge: Parameters<typeof nodePossessionChallengeSigningBytes>[0]) {
|
|
return {
|
|
challengeId: challenge.challengeId,
|
|
publicKeyPem: nodePublicKeyPem,
|
|
schema: 'gh-aios.node-possession-response/v1',
|
|
signature: sign(null, nodePossessionChallengeSigningBytes(challenge), nodeKeys.privateKey).toString('base64'),
|
|
};
|
|
},
|
|
};
|
|
|
|
test('projects both trust-source states without asking for claims or handoff before login', async () => {
|
|
let claimReads = 0;
|
|
let handoffReads = 0;
|
|
const orchestrator = new DomainAccessOrchestrator(
|
|
signerLoader(),
|
|
registrationLoader(),
|
|
loggedOutIdentity,
|
|
{ async read() { claimReads += 1; return null; } },
|
|
validPossessionSource,
|
|
{ async read() { handoffReads += 1; return null; } },
|
|
);
|
|
|
|
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
|
|
|
assert.equal(claimReads, 0);
|
|
assert.equal(handoffReads, 0);
|
|
assert.equal(status.stage, 'login-required');
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.equal(status.nodeRegistrationSource.status, 'CURRENT');
|
|
assert.equal(status.trustSource.status, 'CURRENT');
|
|
});
|
|
|
|
test('a signed node registration without a handoff remains identity-only', async () => {
|
|
let observedEndpointId = '';
|
|
const orchestrator = new DomainAccessOrchestrator(
|
|
signerLoader(),
|
|
registrationLoader(),
|
|
loggedInIdentity,
|
|
{ async read(request) {
|
|
observedEndpointId = request.endpoint.endpointId;
|
|
return validRegistrationClaim();
|
|
} },
|
|
validPossessionSource,
|
|
{ async read() { return null; } },
|
|
);
|
|
|
|
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
|
|
|
assert.equal(status.stage, 'identity-verified');
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.equal(observedEndpointId, 'GH-NODE-REG-001');
|
|
assert.equal(status.blockers.includes('verified_node_registration_missing'), false);
|
|
assert.ok(status.blockers.includes('verified_domain_manifest_missing'));
|
|
});
|
|
|
|
test('a signed registration without a fresh node-key proof cannot reach the handoff route', async () => {
|
|
let handoffReads = 0;
|
|
const orchestrator = new DomainAccessOrchestrator(
|
|
signerLoader(),
|
|
registrationLoader(),
|
|
loggedInIdentity,
|
|
validRegistrationSource,
|
|
{ async prove() { return null; } },
|
|
{ async read() { handoffReads += 1; return null; } },
|
|
);
|
|
|
|
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
|
|
|
assert.equal(status.stage, 'login-required');
|
|
assert.ok(status.blockers.includes('verified_node_possession_missing'));
|
|
assert.equal(handoffReads, 0);
|
|
});
|
|
|
|
test('a code-channel account cannot supply registration and never contacts a handoff route', async () => {
|
|
let handoffReads = 0;
|
|
const orchestrator = new DomainAccessOrchestrator(
|
|
signerLoader(),
|
|
registrationLoader(),
|
|
loggedInIdentity,
|
|
{ async read() { return null; } },
|
|
validPossessionSource,
|
|
{ async read() { handoffReads += 1; return validHandoff() as never; } },
|
|
);
|
|
|
|
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
|
|
|
assert.equal(handoffReads, 0);
|
|
assert.equal(status.stage, 'login-required');
|
|
assert.ok(status.blockers.includes('verified_node_registration_missing'));
|
|
});
|
|
|
|
test('current registries, signed node claim and verified handoff project runtime-ready', async () => {
|
|
const orchestrator = new DomainAccessOrchestrator(
|
|
signerLoader(() => signerRegistry([activeSigner()])),
|
|
registrationLoader(),
|
|
loggedInIdentity,
|
|
validRegistrationSource,
|
|
validPossessionSource,
|
|
{ async read() {
|
|
return {
|
|
handoff: validHandoff(),
|
|
signerLookup: { repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
|
|
};
|
|
} },
|
|
);
|
|
|
|
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
|
|
|
assert.equal(status.stage, 'runtime-ready');
|
|
assert.equal(status.runtimeReady, true);
|
|
assert.deepEqual(status.blockers, []);
|
|
});
|
|
|
|
test('source failures are reduced to safe status without raw details', async () => {
|
|
let claimReads = 0;
|
|
const unavailableSigner = new TrustedSignerSnapshotLoader({ async fetchJson() { throw new Error('secret signer detail'); } });
|
|
const unavailableRegistration = new NodeRegistrationSnapshotLoader({ async fetchJson() { throw new Error('secret registration detail'); } });
|
|
const orchestrator = new DomainAccessOrchestrator(
|
|
unavailableSigner,
|
|
unavailableRegistration,
|
|
loggedInIdentity,
|
|
{ async read() { claimReads += 1; throw new Error('secret claim detail'); } },
|
|
{ async prove() { throw new Error('secret possession detail'); } },
|
|
{ async read() { throw new Error('secret handoff detail'); } },
|
|
);
|
|
|
|
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
|
|
|
assert.equal(status.stage, 'login-required');
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.equal(status.nodeRegistrationSource.status, 'UNAVAILABLE');
|
|
assert.equal(status.trustSource.status, 'UNAVAILABLE');
|
|
assert.equal(claimReads, 0);
|
|
assert.equal(JSON.stringify(status).includes('secret'), false);
|
|
});
|
|
|
|
test('a degraded signer may preserve handoff verification while node registration must be current', async () => {
|
|
let currentSignerRegistry: unknown = signerRegistry([activeSigner()]);
|
|
const currentSignerLoader = signerLoader(() => currentSignerRegistry);
|
|
await currentSignerLoader.refresh();
|
|
currentSignerRegistry = { ...signerRegistry([activeSigner()]), version: 'invalid' };
|
|
const orchestrator = new DomainAccessOrchestrator(
|
|
currentSignerLoader,
|
|
registrationLoader(),
|
|
loggedInIdentity,
|
|
validRegistrationSource,
|
|
validPossessionSource,
|
|
{ async read() {
|
|
return {
|
|
handoff: validHandoff(),
|
|
signerLookup: { repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
|
|
};
|
|
} },
|
|
);
|
|
|
|
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
|
assert.equal(status.runtimeReady, true);
|
|
assert.equal(status.trustSource.status, 'DEGRADED_LAST_KNOWN_GOOD');
|
|
assert.equal(status.nodeRegistrationSource.status, 'CURRENT');
|
|
});
|
|
|
|
test('a degraded node-registration registry cannot authorize a claim', async () => {
|
|
let currentNodeRegistry: unknown = nodeRegistry();
|
|
const currentNodeLoader = registrationLoader(() => currentNodeRegistry);
|
|
await currentNodeLoader.refresh();
|
|
currentNodeRegistry = nodeRegistry('2.0.0');
|
|
let claimReads = 0;
|
|
let handoffReads = 0;
|
|
const orchestrator = new DomainAccessOrchestrator(
|
|
signerLoader(() => signerRegistry([activeSigner()])),
|
|
currentNodeLoader,
|
|
loggedInIdentity,
|
|
{ async read() { claimReads += 1; return validRegistrationClaim(); } },
|
|
validPossessionSource,
|
|
{ async read() { handoffReads += 1; return null; } },
|
|
);
|
|
|
|
const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
|
|
assert.equal(status.nodeRegistrationSource.status, 'DEGRADED_LAST_KNOWN_GOOD');
|
|
assert.equal(status.runtimeReady, false);
|
|
assert.ok(status.blockers.includes('verified_node_registration_missing'));
|
|
assert.equal(claimReads, 0);
|
|
assert.equal(handoffReads, 0);
|
|
});
|