63 lines
5.2 KiB
JavaScript
63 lines
5.2 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import crypto from "node:crypto";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import { fileURLToPath } from "node:url";
|
|
import ts from "../../web/node_modules/typescript/lib/typescript.js";
|
|
|
|
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
|
const reportPath = path.join(root, "tests/golden/M13-02C/trust-policy-report.json");
|
|
const manifestPath = path.join(root, "tests/golden/M13-02C/manifest.json");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "m13-02c-trust-"));
|
|
const digest = "a".repeat(64);
|
|
const signature = "b".repeat(128);
|
|
const hashFile = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
|
|
const script = (id = "clean", overrides = {}) => ({ id, name: id, entryPath: `scripts/${id}.py`, sourceByteLength: 128, sourceSha256: digest, publisher: "Team", signature, keyId: "key:new", permissions: ["READ_MAIN"], dependencies: [], module: false, cpuMs: 1000, memoryBytes: 1024 * 1024, wallMs: 5000, network: false, autorun: false, driverExpressions: false, addonInstall: false, ...overrides });
|
|
const key = (keyId, overrides = {}) => ({ keyId, publisher: "Team", algorithm: "ED25519", publicKey: "c".repeat(64), status: "ACTIVE", notBefore: "2026-01-01T00:00:00.000Z", notAfter: "2027-01-01T00:00:00.000Z", ...overrides });
|
|
const policy = (keys = [key("key:new")], overrides = {}) => ({ schemaVersion: 1, issuer: "web-trust", issuedAt: "2026-01-01T00:00:00.000Z", expiresAt: "2027-01-01T00:00:00.000Z", maxClockSkewMs: 300000, keys, ...overrides });
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
|
|
.replace('require("./asset-path")', 'require("./asset-path.cjs")')
|
|
.replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
}
|
|
const require = createRequire(import.meta.url);
|
|
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
|
|
const manifest = { schemaVersion: 1, scripts: [script()] };
|
|
try {
|
|
const rotated = policy([key("key:new", { replaces: "key:old" }), key("key:old", { status: "REVOKED", revokedAt: "2026-06-01T00:00:00.000Z" })]);
|
|
const parsed = protocol.parseScriptTrustPolicy(rotated);
|
|
const eligible = protocol.resolveScriptSigner(manifest, "clean", parsed, "2026-08-18T12:00:00.000Z");
|
|
const revoked = protocol.resolveScriptSigner(manifest, "clean", policy([key("key:new", { status: "REVOKED", revokedAt: "2026-06-01T00:00:00.000Z" })]), "2026-08-18T12:00:00.000Z");
|
|
const policyExpired = protocol.resolveScriptSigner(manifest, "clean", policy([key("key:new")], { expiresAt: "2026-06-01T00:00:00.000Z" }), "2026-08-18T12:00:00.000Z");
|
|
let crossPublisher = "ACCEPTED";
|
|
try { protocol.parseScriptTrustPolicy(policy([key("key:new", { replaces: "key:old" }), key("key:old", { publisher: "Other" })])); }
|
|
catch (error) { crossPublisher = error instanceof Error ? error.message.split(":", 1)[0] : String(error); }
|
|
assert.equal(eligible.status, "ELIGIBLE");
|
|
assert.equal(eligible.cryptographicVerification, "REQUIRED");
|
|
assert.equal(revoked.trust, "REVOKED");
|
|
assert.equal(policyExpired.trust, "POLICY_EXPIRED");
|
|
assert.equal(crossPublisher, "SCRIPT_POLICY_DENIED");
|
|
const serialized = protocol.serializeScriptTrustPolicy(parsed);
|
|
const report = {
|
|
schemaVersion: 1,
|
|
task: "M13-02C",
|
|
operation: "SCRIPT_TRUST_POLICY",
|
|
identity: { algorithm: "ED25519", publisher: "Team", activeKey: "key:new", predecessor: "key:old", predecessorStatus: "REVOKED" },
|
|
timestampPolicy: { issuedAt: parsed.issuedAt, expiresAt: parsed.expiresAt, maxClockSkewMs: parsed.maxClockSkewMs },
|
|
decisions: { eligible: eligible.status, cryptographicVerification: eligible.cryptographicVerification, revoked: revoked.trust, crossPublisher: crossPublisher, policyExpired: policyExpired.trust },
|
|
policySha256: crypto.createHash("sha256").update(serialized).digest("hex"),
|
|
nextTask: "M13-02D",
|
|
};
|
|
if (process.env.UPDATE_M13_02C_REPORT === "1") { fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n"); }
|
|
assert.deepEqual(JSON.parse(fs.readFileSync(reportPath, "utf8")), report);
|
|
const manifestValue = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
|
|
assert.deepEqual({ schemaVersion: manifestValue.schemaVersion, task: manifestValue.task, parentTask: manifestValue.parentTask, nextTask: manifestValue.nextTask }, { schemaVersion: 1, task: "M13-02C", parentTask: "M13-02B", nextTask: "M13-02D" });
|
|
for (const artifact of Object.values(manifestValue.artifacts)) assert.equal(hashFile(path.join(root, artifact.path)), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
|
|
process.stdout.write(`script-trust-policy-ok active=key:new revoked=REVOKED crossPublisher=SCRIPT_POLICY_DENIED policyExpired=POLICY_EXPIRED crypto=REQUIRED next=${manifestValue.nextTask}\n`);
|
|
}
|
|
finally { fs.rmSync(temporary, { recursive: true, force: true }); }
|