Checkpoint web parity through Chromium input tasks

tools/web/check-script-permission-policy.mjs

@@ -0,0 +1,46 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import ts from "../../web/node_modules/typescript/lib/typescript.js";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const reportPath = path.join(root, "tests/golden/M13-02E/permission-policy-report.json");
+const manifestPath = path.join(root, "tests/golden/M13-02E/manifest.json");
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "m13-02e-permission-"));
+const hashFile = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+const script = (permissions, overrides = {}) => ({ id: "clean", name: "clean", entryPath: "scripts/clean.py", sourceByteLength: 128, sourceSha256: "a".repeat(64), publisher: "Team", signature: "b".repeat(128), keyId: "key:new", permissions, dependencies: [], module: false, cpuMs: 1000, memoryBytes: 1024 * 1024, wallMs: 5000, network: false, autorun: false, driverExpressions: false, addonInstall: false, ...overrides });
+const manifest = (permissions) => ({ schemaVersion: 1, scripts: [script(permissions)] });
+for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
+  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
+  const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
+    .replace('require("./asset-path")', 'require("./asset-path.cjs")')
+    .replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
+  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
+}
+const protocol = createRequire(import.meta.url)(path.join(temporary, "scripting-platform.cjs"));
+try {
+  const defaultGrant = protocol.resolveScriptPermissions(manifest(["READ_MAIN"]), "clean");
+  const declaredGrant = protocol.resolveScriptPermissions(manifest(["WRITE_ASSET", "READ_MAIN"]), "clean", ["READ_MAIN"]);
+  const escalation = protocol.resolveScriptPermissions(manifest(["READ_MAIN"]), "clean", ["WRITE_MAIN"]);
+  const unknownRequest = protocol.resolveScriptPermissions(manifest(["READ_MAIN"]), "clean", ["EXECUTE"]);
+  const duplicateRequest = protocol.resolveScriptPermissions(manifest(["READ_MAIN"]), "clean", ["READ_MAIN", "READ_MAIN"]);
+  let unknownDeclaration = "ACCEPTED";
+  try { protocol.parseScriptingManifest(manifest(["EXECUTE"])); } catch (error) { unknownDeclaration = error instanceof Error ? error.message.split(":", 1)[0] : String(error); }
+  assert.deepEqual(defaultGrant.granted, []);
+  assert.deepEqual(declaredGrant.granted, ["READ_MAIN"]);
+  assert.equal(escalation.code, "SCRIPT_POLICY_DENIED");
+  assert.equal(unknownRequest.code, "SCRIPT_POLICY_DENIED");
+  assert.equal(duplicateRequest.code, "SCRIPT_POLICY_DENIED");
+  assert.equal(unknownDeclaration, "SCRIPT_POLICY_DENIED");
+  const report = { schemaVersion: 1, task: "M13-02E", operation: "SCRIPT_PERMISSION_MINIMIZATION", decisions: { defaultGrant: defaultGrant.status, declaredGrant: declaredGrant.status, escalation: escalation.code, unknownRequest: unknownRequest.code, duplicateRequest: duplicateRequest.code, unknownDeclaration }, invariant: { undeclaredNeverGranted: true, defaultGrantedCount: defaultGrant.granted.length, declaredGranted: declaredGrant.granted }, nextTask: "M13-02F" };
+  if (process.env.UPDATE_M13_02E_REPORT === "1") { fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n"); }
+  assert.deepEqual(JSON.parse(fs.readFileSync(reportPath, "utf8")), report);
+  const manifestValue = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  assert.deepEqual({ schemaVersion: manifestValue.schemaVersion, task: manifestValue.task, parentTask: manifestValue.parentTask, nextTask: manifestValue.nextTask }, { schemaVersion: 1, task: "M13-02E", parentTask: "M13-02D", nextTask: "M13-02F" });
+  for (const artifact of Object.values(manifestValue.artifacts)) assert.equal(hashFile(path.join(root, artifact.path)), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
+  process.stdout.write(`script-permission-policy-ok defaultGranted=0 declared=READ_MAIN escalation=SCRIPT_POLICY_DENIED unknown=SCRIPT_POLICY_DENIED next=${manifestValue.nextTask}\n`);
+} finally { fs.rmSync(temporary, { recursive: true, force: true }); }