50 lines
3.2 KiB
JavaScript
50 lines
3.2 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import test from "node:test";
|
|
import ts from "typescript";
|
|
|
|
const root = path.resolve(import.meta.dirname, "../../..");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-host-call-"));
|
|
const require = createRequire(import.meta.url);
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
|
|
.replace('require("./asset-path")', 'require("./asset-path.cjs")').replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
}
|
|
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
|
|
const digest = "a".repeat(64);
|
|
const permissions = new Set(protocol.SCRIPT_PERMISSIONS);
|
|
const call = (name, parameters) => ({ schemaVersion: 1, requestId: `host:${name.toLowerCase()}`, scriptId: "clean", call: name, permission: name, parameters });
|
|
|
|
test("M13-03C parses all allowlisted host calls with structured parameters", () => {
|
|
const inputs = [
|
|
call("READ_MAIN", { revision: 3 }),
|
|
call("READ_ASSET", { path: "//assets/model.bin", expectedSha256: digest }),
|
|
call("WRITE_MAIN", { revision: 3, operation: "object.transform", payload: { objectId: "obj:1", x: 1 } }),
|
|
call("WRITE_ASSET", { path: "assets/out.bin", byteLength: 4, sha256: digest }),
|
|
call("SUBMIT_SERVER_JOB", { inputBlendSha256: digest, settingsSha256: digest }),
|
|
];
|
|
const parsed = inputs.map((input) => protocol.parseScriptHostCall(input, permissions));
|
|
assert.deepEqual(parsed.map((item) => item.call), ["READ_MAIN", "READ_ASSET", "WRITE_MAIN", "WRITE_ASSET", "SUBMIT_SERVER_JOB"]);
|
|
assert.equal(parsed[1].parameters.path, "assets/model.bin");
|
|
assert.equal(parsed[2].execution, "DISABLED");
|
|
});
|
|
|
|
test("M13-03C rejects non-allowlisted calls, permission confusion and unknown fields", () => {
|
|
assert.throws(() => protocol.parseScriptHostCall(call("EXECUTE", {}), permissions), /SCRIPT_POLICY_DENIED/);
|
|
assert.throws(() => protocol.parseScriptHostCall({ ...call("READ_MAIN", { revision: 3 }), permission: "WRITE_MAIN" }, permissions), /SCRIPT_POLICY_DENIED/);
|
|
assert.throws(() => protocol.parseScriptHostCall(call("READ_MAIN", { revision: 3, extra: true }), permissions), /SCRIPT_MANIFEST_INVALID/);
|
|
assert.throws(() => protocol.parseScriptHostCall(call("READ_ASSET", { path: "../escape", expectedSha256: digest }), permissions), /SCRIPT_MANIFEST_INVALID/);
|
|
assert.throws(() => protocol.parseScriptHostCall(call("WRITE_MAIN", { revision: 3, operation: "x", payload: [] }), permissions), /SCRIPT_MANIFEST_INVALID/);
|
|
});
|
|
|
|
test("M13-03C requires the declared permission set", () => {
|
|
assert.throws(() => protocol.parseScriptHostCall(call("WRITE_MAIN", { revision: 0, operation: "x", payload: {} }), new Set(["READ_MAIN"])), /SCRIPT_POLICY_DENIED/);
|
|
});
|
|
|
|
test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));
|