81 lines
3.4 KiB
JavaScript
81 lines
3.4 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import test from "node:test";
|
|
import ts from "typescript";
|
|
|
|
const root = path.resolve(import.meta.dirname, "../../..");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-manifest-canonical-"));
|
|
const require = createRequire(import.meta.url);
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const output = ts.transpileModule(source, {
|
|
compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
|
|
fileName: `${name}.ts`,
|
|
}).outputText
|
|
.replace('require("./asset-path")', 'require("./asset-path.cjs")')
|
|
.replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
}
|
|
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
|
|
const digest = "a".repeat(64);
|
|
const signature = "b".repeat(128);
|
|
const script = (id, overrides = {}) => ({
|
|
id,
|
|
name: id,
|
|
entryPath: `scripts/${id}.py`,
|
|
sourceByteLength: 128,
|
|
sourceSha256: digest,
|
|
publisher: "local",
|
|
signature,
|
|
keyId: "key:local",
|
|
permissions: ["READ_MAIN"],
|
|
dependencies: [],
|
|
module: false,
|
|
cpuMs: 1000,
|
|
memoryBytes: 1024 * 1024,
|
|
wallMs: 5000,
|
|
network: false,
|
|
autorun: false,
|
|
driverExpressions: false,
|
|
addonInstall: false,
|
|
...overrides,
|
|
});
|
|
|
|
test("M13-02B canonical serialization is invariant to manifest/script array order", () => {
|
|
const base = {
|
|
schemaVersion: 1,
|
|
scripts: [
|
|
script("zeta", { permissions: ["WRITE_ASSET", "READ_MAIN"], dependencies: [{ id: "alpha", sourceSha256: digest, sourcePath: "deps/alpha.py" }, { id: "beta", sourceSha256: digest, sourcePath: "deps/beta.py" }] }),
|
|
script("alpha", { permissions: ["SUBMIT_SERVER_JOB", "READ_ASSET"] }),
|
|
script("beta"),
|
|
],
|
|
};
|
|
const reordered = {
|
|
schemaVersion: 1,
|
|
scripts: [
|
|
{ ...base.scripts[1], permissions: [...base.scripts[1].permissions].reverse(), ignored: "removed" },
|
|
{ ...base.scripts[0], permissions: [...base.scripts[0].permissions].reverse(), dependencies: [...base.scripts[0].dependencies].reverse() },
|
|
base.scripts[2],
|
|
],
|
|
};
|
|
const first = protocol.serializeScriptingManifest(base);
|
|
const second = protocol.serializeScriptingManifest(reordered);
|
|
assert.equal(first, second);
|
|
assert.match(first, /^\{"schemaVersion":1,"scripts":\[/);
|
|
assert.equal(Object.keys(protocol.canonicalizeScriptingManifest(reordered).scripts[0]).includes("ignored"), false);
|
|
});
|
|
|
|
test("M13-02B canonical serialization includes security-relevant declaration fields", () => {
|
|
const base = { schemaVersion: 1, scripts: [script("clean")] };
|
|
const changedBytes = { schemaVersion: 1, scripts: [script("clean", { sourceByteLength: 129 })] };
|
|
const changedPermission = { schemaVersion: 1, scripts: [script("clean", { permissions: ["READ_ASSET"] })] };
|
|
assert.notEqual(protocol.serializeScriptingManifest(base), protocol.serializeScriptingManifest(changedBytes));
|
|
assert.notEqual(protocol.serializeScriptingManifest(base), protocol.serializeScriptingManifest(changedPermission));
|
|
assert.throws(() => protocol.serializeScriptingManifest({ ...base, schemaVersion: 2 }), /PROTOCOL_MISMATCH/);
|
|
});
|
|
|
|
test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));
|