Checkpoint web parity through Chromium input tasks

tools/web/check-server-job-network-policy.mjs

@@ -0,0 +1,24 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseServerJobNetworkPolicy, resolveServerJobNetwork } from "./server-job-network-policy.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const reportPath = path.join(root, "tests/golden/M13-04D/server-job-network-policy-report.json");
+const manifestPath = path.join(root, "tests/golden/M13-04D/manifest.json");
+const hashFile = async (file) => crypto.createHash("sha256").update(await fs.readFile(file)).digest("hex");
+const policy = parseServerJobNetworkPolicy({ schemaVersion: 1, allowedOrigins: ["https://example.com", "http://127.0.0.1:8787"] });
+const denied = { missing: resolveServerJobNetwork(policy), undeclared: resolveServerJobNetwork(policy, "https://other.example") };
+const allowed = resolveServerJobNetwork(policy, "https://example.com");
+assert.equal(allowed.status, "ALLOWED");
+assert.equal(denied.missing.code, "SERVER_NETWORK_DENIED");
+assert.equal(denied.undeclared.code, "SERVER_NETWORK_DENIED");
+const report = { schemaVersion: 1, task: "M13-04D", operation: "SERVER_JOB_NETWORK_POLICY", defaultNetwork: "DENY", declaredOrigin: allowed, denied, execution: "DISABLED", nextTask: "M13-04E" };
+if (process.env.UPDATE_M13_04D_REPORT === "1") { await fs.mkdir(path.dirname(reportPath), { recursive: true }); await fs.writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`); }
+assert.deepEqual(JSON.parse(await fs.readFile(reportPath, "utf8")), report);
+const manifest = JSON.parse(await fs.readFile(manifestPath, "utf8"));
+assert.deepEqual({ schemaVersion: manifest.schemaVersion, task: manifest.task, parentTask: manifest.parentTask, nextTask: manifest.nextTask }, { schemaVersion: 1, task: "M13-04D", parentTask: "M13-04C", nextTask: "M13-04E" });
+for (const artifact of Object.values(manifest.artifacts)) assert.equal(await hashFile(path.join(root, artifact.path)), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
+process.stdout.write(`server-job-network-ok default=DENY declaredOrigin=ALLOWED missing=SERVER_NETWORK_DENIED undeclared=SERVER_NETWORK_DENIED execution=DISABLED next=${manifest.nextTask}\n`);