37 lines
3.4 KiB
JavaScript
37 lines
3.4 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import crypto from "node:crypto";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import { fileURLToPath } from "node:url";
|
|
import ts from "../../web/node_modules/typescript/lib/typescript.js";
|
|
|
|
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
|
const reportPath = path.join(root, "tests/golden/M13-01C/policy-codes-report.json");
|
|
const manifestPath = path.join(root, "tests/golden/M13-01C/manifest.json");
|
|
const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
|
|
assert.deepEqual({ schemaVersion: manifest.schemaVersion, task: manifest.task, parentTask: manifest.parentTask, nextTask: manifest.nextTask }, { schemaVersion: 1, task: "M13-01C", parentTask: "M13-01B", nextTask: "M13-01D" });
|
|
const hashFile = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
|
|
for (const artifact of Object.values(manifest.artifacts)) assert.equal(hashFile(path.join(root, artifact.path)), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "m13-01c-policy-"));
|
|
const require = createRequire(import.meta.url);
|
|
try {
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText.replace('require("./asset-path")', 'require("./asset-path.cjs")').replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
}
|
|
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
|
|
const base = { schemaVersion: 1, scripts: [{ id: "demo", name: "Demo", entryPath: "scripts/demo.py", sourceByteLength: 128, sourceSha256: "a".repeat(64), publisher: "local", signature: "b".repeat(128), keyId: "key", permissions: ["READ_MAIN"], dependencies: [], module: false, cpuMs: 1000, memoryBytes: 64 * 1024 * 1024, wallMs: 2000, network: false, autorun: false, driverExpressions: false, addonInstall: false }] };
|
|
const codes = [];
|
|
for (const [field, expected] of [["autorun", "SCRIPT_POLICY_DENIED"], ["driverExpressions", "DRIVER_EXECUTION_BLOCKED"], ["addonInstall", "ADDON_INSTALL_BLOCKED"]]) {
|
|
assert.throws(() => protocol.parseScriptingManifest({ ...base, scripts: [{ ...base.scripts[0], [field]: true }] }), new RegExp(expected)); codes.push(expected);
|
|
}
|
|
const gate = protocol.gateScriptExecution(base, "demo", new Set(["key"])); assert.equal(gate.status, "BLOCKED"); assert.equal(gate.issues[0].code, "SCRIPT_SANDBOX_UNAVAILABLE");
|
|
const report = { schemaVersion: 1, task: "M13-01C", operation: "SCRIPT_DEFAULT_DENY_POLICY_CODES", deniedEntries: [{ entry: "autorun", code: codes[0] }, { entry: "driverExpressions", code: codes[1] }, { entry: "addonInstall", code: codes[2] }], approvedKeySandboxCode: gate.issues[0].code, nextTask: "M13-01D" };
|
|
fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n");
|
|
process.stdout.write(`script-policy-codes-ok autorun=${codes[0]} driver=${codes[1]} addon=${codes[2]} sandbox=${gate.issues[0].code} next=M13-01D\n`);
|
|
}
|
|
finally { fs.rmSync(temporary, { recursive: true, force: true }); }
|