86 lines
4.6 KiB
JavaScript
86 lines
4.6 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import test from "node:test";
|
|
import ts from "typescript";
|
|
|
|
const root = path.resolve(import.meta.dirname, "../../..");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-manifest-budgets-"));
|
|
const require = createRequire(import.meta.url);
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const output = ts.transpileModule(source, {
|
|
compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
|
|
fileName: `${name}.ts`,
|
|
}).outputText
|
|
.replace('require("./asset-path")', 'require("./asset-path.cjs")')
|
|
.replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
}
|
|
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
|
|
const digest = "a".repeat(64);
|
|
const signature = "b".repeat(128);
|
|
const script = (id, overrides = {}) => ({
|
|
id,
|
|
name: id,
|
|
entryPath: `scripts/${id}.py`,
|
|
sourceByteLength: 128,
|
|
sourceSha256: digest,
|
|
publisher: "local",
|
|
signature,
|
|
keyId: "key:local",
|
|
permissions: ["READ_MAIN"],
|
|
dependencies: [],
|
|
module: false,
|
|
cpuMs: 1000,
|
|
memoryBytes: 1024 * 1024,
|
|
wallMs: 5000,
|
|
network: false,
|
|
autorun: false,
|
|
driverExpressions: false,
|
|
addonInstall: false,
|
|
...overrides,
|
|
});
|
|
const manifest = (scripts = [script("clean")]) => ({ schemaVersion: 1, scripts });
|
|
|
|
test("M13-02A accepts bounded manifest fields and normalizes project paths", () => {
|
|
const parsed = protocol.parseScriptingManifest(manifest([
|
|
script("base", { entryPath: "//scripts/../scripts/base.py" }),
|
|
script("clean", { dependencies: [{ id: "base", sourceSha256: digest, sourcePath: "//deps/base.py" }] }),
|
|
]));
|
|
assert.equal(parsed.scripts.length, 2);
|
|
assert.equal(parsed.scripts[0].entryPath, "scripts/base.py");
|
|
assert.equal(parsed.scripts[1].dependencies[0].sourcePath, "deps/base.py");
|
|
assert.equal(parsed.scripts.reduce((total, item) => total + item.sourceByteLength, 0), 256);
|
|
assert.equal(parsed.scripts.every((item) => item.module === false), true);
|
|
});
|
|
|
|
test("M13-02A rejects text count and aggregate source byte budget overflow", () => {
|
|
assert.throws(
|
|
() => protocol.parseScriptingManifest(manifest(Array.from({ length: protocol.SCRIPTING_BUDGET.maxScripts + 1 }, (_, index) => script(`script-${index}`)))),
|
|
/SCRIPT_BUDGET_EXCEEDED/,
|
|
);
|
|
assert.throws(
|
|
() => protocol.parseScriptingManifest(manifest([script("large", { sourceByteLength: protocol.SCRIPTING_BUDGET.maxSourceBytes }), script("overflow", { sourceByteLength: 1 })])),
|
|
/SCRIPT_BUDGET_EXCEEDED/,
|
|
);
|
|
assert.throws(() => protocol.parseScriptingManifest(manifest([script("missing-bytes", { sourceByteLength: undefined })])), /SCRIPT_BUDGET_EXCEEDED/);
|
|
});
|
|
|
|
test("M13-02A rejects module execution, unsafe paths, and malformed dependencies", () => {
|
|
assert.throws(() => protocol.parseScriptingManifest(manifest([script("module", { module: true })])), /SCRIPT_POLICY_DENIED/);
|
|
assert.throws(() => protocol.parseScriptingManifest(manifest([script("escape", { entryPath: "../escape.py" })])), /SCRIPT_MANIFEST_INVALID/);
|
|
assert.throws(() => protocol.parseScriptingManifest(manifest([script("dependency-escape", { dependencies: [{ id: "base", sourceSha256: digest, sourcePath: "//../escape.py" }] }), script("base")])), /SCRIPT_MANIFEST_INVALID/);
|
|
assert.throws(() => protocol.parseScriptingManifest(manifest([script("duplicate-dependency", { dependencies: [{ id: "base", sourceSha256: digest, sourcePath: "deps/a.py" }, { id: "base", sourceSha256: digest, sourcePath: "deps/b.py" }] }), script("base")])), /SCRIPT_MANIFEST_INVALID/);
|
|
assert.throws(() => protocol.parseScriptingManifest(manifest([script("too-many-dependencies", { dependencies: Array.from({ length: protocol.SCRIPTING_BUDGET.maxDependencies + 1 }, (_, index) => ({ id: `dep-${index}`, sourceSha256: digest, sourcePath: `deps/${index}.py` })) })])), /SCRIPT_BUDGET_EXCEEDED/);
|
|
});
|
|
|
|
test("M13-02A rejects unknown or over-budget permissions", () => {
|
|
assert.throws(() => protocol.parseScriptingManifest(manifest([script("unknown-permission", { permissions: ["EXECUTE"] })])), /SCRIPT_POLICY_DENIED/);
|
|
assert.throws(() => protocol.parseScriptingManifest(manifest([script("permission-budget", { permissions: new Array(protocol.SCRIPTING_BUDGET.maxPermissions + 1).fill("READ_MAIN") })])), /SCRIPT_POLICY_DENIED/);
|
|
});
|
|
|
|
test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));
|