70 lines
3.0 KiB
JavaScript
70 lines
3.0 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import { fileURLToPath } from "node:url";
|
|
import ts from "../../web/node_modules/typescript/lib/typescript.js";
|
|
|
|
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "scripting-isolation-"));
|
|
const require = createRequire(import.meta.url);
|
|
|
|
try {
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const result = ts.transpileModule(source, {
|
|
compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
|
|
fileName: `${name}.ts`,
|
|
});
|
|
const output = result.outputText
|
|
.replace('require("./asset-path")', 'require("./asset-path.cjs")')
|
|
.replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
}
|
|
|
|
const { createScriptExecutionAudit, gateScriptExecution, gateServerScriptJob } = require(path.join(temporary, "scripting-platform.cjs"));
|
|
const digest = "a".repeat(64);
|
|
const manifest = {
|
|
schemaVersion: 1,
|
|
scripts: [{
|
|
id: "clean",
|
|
name: "Clean",
|
|
entryPath: "scripts/clean.py",
|
|
sourceSha256: digest,
|
|
publisher: "local",
|
|
signature: "b".repeat(128),
|
|
keyId: "approved-key",
|
|
permissions: ["READ_MAIN"],
|
|
dependencies: [],
|
|
cpuMs: 1000,
|
|
memoryBytes: 64 * 1024 * 1024,
|
|
wallMs: 2000,
|
|
network: false,
|
|
autorun: false,
|
|
driverExpressions: false,
|
|
addonInstall: false,
|
|
}],
|
|
};
|
|
|
|
const unsigned = gateScriptExecution(manifest, "clean", new Set());
|
|
const approved = gateScriptExecution(manifest, "clean", new Set(["approved-key"]));
|
|
const server = gateServerScriptJob({ scriptId: "clean", sourceSha256: digest }, manifest, digest);
|
|
assert.equal(unsigned.status, "BLOCKED");
|
|
assert.equal(unsigned.issues[0]?.code, "SCRIPT_SIGNATURE_INVALID");
|
|
assert.equal(approved.status, "BLOCKED");
|
|
assert.equal(approved.issues[0]?.code, "SCRIPT_SANDBOX_UNAVAILABLE");
|
|
assert.equal(server.status, "BLOCKED");
|
|
assert.equal(server.issues[0]?.code, "SERVER_JOB_UNAVAILABLE");
|
|
const audit = await createScriptExecutionAudit(manifest, "clean", new Set(["approved-key"]), { requestId: "isolation-check", requestedAt: "2026-08-12T12:00:00.000Z" });
|
|
assert.equal(audit.decision, "DENY");
|
|
assert.equal(audit.reason, "SCRIPT_SANDBOX_UNAVAILABLE");
|
|
assert.equal(audit.approvedKey, true);
|
|
assert.match(audit.manifestSha256, /^[a-f0-9]{64}$/);
|
|
assert.match(audit.requestSha256, /^[a-f0-9]{64}$/);
|
|
process.stdout.write("scripting-isolation-ok status=BLOCKED audit=DENY approved-key=sandbox-unavailable server=unavailable execution=disabled\n");
|
|
}
|
|
finally {
|
|
fs.rmSync(temporary, { recursive: true, force: true });
|
|
}
|