Checkpoint web parity through Chromium input tasks

web/tests/unit/script-permission-policy.test.mjs

@@ -0,0 +1,36 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+import test from "node:test";
+import ts from "typescript";
+
+const root = path.resolve(import.meta.dirname, "../../..");
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-permission-policy-"));
+const require = createRequire(import.meta.url);
+for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
+  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
+  const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
+    .replace('require("./asset-path")', 'require("./asset-path.cjs")')
+    .replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
+  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
+}
+const protocol = require(path.join(temporary, "scripting-platform.cjs"));
+const script = (permissions = ["READ_MAIN"]) => ({ id: "clean", name: "clean", entryPath: "scripts/clean.py", sourceByteLength: 128, sourceSha256: "a".repeat(64), publisher: "Team", signature: "b".repeat(128), keyId: "key:new", permissions, dependencies: [], module: false, cpuMs: 1000, memoryBytes: 1024 * 1024, wallMs: 5000, network: false, autorun: false, driverExpressions: false, addonInstall: false });
+const manifest = (permissions) => ({ schemaVersion: 1, scripts: [script(permissions)] });
+
+test("M13-02E grants no undeclared permission by default", () => {
+  assert.deepEqual(protocol.resolveScriptPermissions(manifest(["READ_MAIN"]), "clean"), { status: "ALLOWED", code: "SCRIPT_PERMISSIONS_ALLOWED", scriptId: "clean", declared: ["READ_MAIN"], requested: [], granted: [] });
+  assert.deepEqual(protocol.resolveScriptPermissions(manifest(["WRITE_ASSET", "READ_MAIN"]), "clean", ["READ_MAIN"]), { status: "ALLOWED", code: "SCRIPT_PERMISSIONS_ALLOWED", scriptId: "clean", declared: ["READ_MAIN", "WRITE_ASSET"], requested: ["READ_MAIN"], granted: ["READ_MAIN"] });
+});
+
+test("M13-02E blocks escalation, unknown and duplicate permission requests", () => {
+  assert.equal(protocol.resolveScriptPermissions(manifest(["READ_MAIN"]), "clean", ["WRITE_MAIN"]).code, "SCRIPT_POLICY_DENIED");
+  assert.equal(protocol.resolveScriptPermissions(manifest(["READ_MAIN"]), "clean", ["EXECUTE"]).code, "SCRIPT_POLICY_DENIED");
+  assert.equal(protocol.resolveScriptPermissions(manifest(["READ_MAIN"]), "clean", ["READ_MAIN", "READ_MAIN"]).code, "SCRIPT_POLICY_DENIED");
+  assert.throws(() => protocol.parseScriptingManifest(manifest(["EXECUTE"])), /SCRIPT_POLICY_DENIED/);
+});
+
+test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));