hololake-system-architecture/product-source/guanghu-knowledge-base/src/domain-connection.test.ts

101 lines
4 KiB
TypeScript

import assert from 'node:assert/strict';
import test from 'node:test';
import { projectDomainConnectionSteps, projectDomainRuntimePolicyReceipt, projectDomainTrustSource } from './domain-connection.js';
const verifiedRuntimePolicy = {
allowedSessionScopes: ['domain:enter', 'knowledge:read'],
forbiddenDataScopes: ['private:relationship-core'],
manifestDigest: 'a'.repeat(64),
permissionPolicyRef: 'policy://origin-domain/default',
routeRef: 'domain-route://origin-domain/runtime',
themeOwner: 'fifth-domain' as const,
themePackageRef: 'theme://origin-domain/lake-reflects-stars',
};
test('code-channel account absence cannot be projected as a domain runtime login', () => {
const steps = projectDomainConnectionSteps({
blockers: [
'account_identity_missing',
'verified_node_registration_missing',
'verified_domain_manifest_missing',
'scoped_session_capability_missing',
'matching_connection_receipt_missing',
],
runtimeReady: false,
stage: 'login-required',
});
assert.deepEqual(steps.map(step => step.state), ['blocked', 'blocked', 'blocked', 'blocked']);
assert.match(steps[0].detail, /登记的本地终端节点或云常驻节点/);
});
test('verified account and node remain identity-only without domain handoff evidence', () => {
const steps = projectDomainConnectionSteps({
blockers: [
'verified_domain_manifest_missing',
'scoped_session_capability_missing',
'matching_connection_receipt_missing',
],
runtimeReady: false,
stage: 'identity-verified',
});
assert.deepEqual(steps.map(step => step.state), ['verified', 'blocked', 'blocked', 'blocked']);
});
test('runtime-ready requires all four verified steps', () => {
const steps = projectDomainConnectionSteps({ blockers: [], runtimePolicy: verifiedRuntimePolicy, runtimeReady: true, stage: 'runtime-ready' });
assert.ok(steps.every(step => step.state === 'verified'));
});
test('a runtime-ready access projects only a compact verified policy receipt', () => {
const rows = projectDomainRuntimePolicyReceipt({
blockers: [],
runtimePolicy: verifiedRuntimePolicy,
runtimeReady: true,
stage: 'runtime-ready',
});
assert.deepEqual(rows.map(row => row.label), ['主题包', '运行路线', '权限策略', '允许会话', '禁止数据', '清单摘要']);
assert.match(rows[0].value, /^theme:\/\/origin-domain\//);
assert.match(rows.at(-1)?.value ?? '', /^a{12}…a{8}$/);
assert.doesNotMatch(JSON.stringify(rows), /signature|signer|repository|publicKey/i);
assert.deepEqual(projectDomainRuntimePolicyReceipt({
blockers: ['matching_connection_receipt_missing'],
runtimePolicy: verifiedRuntimePolicy,
runtimeReady: false,
stage: 'identity-verified',
}), []);
});
test('a current empty signer registry is projected as a real manifest blocker', () => {
const access = {
blockers: ['verified_domain_manifest_missing'],
runtimeReady: false,
stage: 'identity-verified' as const,
trustSource: {
registryVersion: '1.0.0',
signerCount: 0,
sourceCommit: '34e1949a113be8d4871e61c094f2ae06e0bc5a45',
status: 'CURRENT' as const,
},
};
const manifest = projectDomainConnectionSteps(access)[1];
assert.equal(manifest.state, 'blocked');
assert.match(manifest.detail, /尚未登记任何目标域签名人/);
assert.match(projectDomainTrustSource(access), /当前.*v1\.0\.0.*34e1949a.*已登记签名人 0/);
});
test('an unavailable trust source remains closed without leaking raw transport details', () => {
const access = {
blockers: ['verified_domain_manifest_missing'],
runtimeReady: false,
stage: 'identity-verified' as const,
trustSource: {
reason: 'SOURCE_UNAVAILABLE' as const,
registryVersion: null,
signerCount: 0,
sourceCommit: null,
status: 'UNAVAILABLE' as const,
},
};
assert.match(projectDomainConnectionSteps(access)[1].detail, /系统保持关闭/);
assert.equal(projectDomainTrustSource(access), '可信清单来源不可用 · 域入口保持关闭');
});