77 lines
5.4 KiB
JavaScript
77 lines
5.4 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import crypto from "node:crypto";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import { fileURLToPath } from "node:url";
|
|
import ts from "../../web/node_modules/typescript/lib/typescript.js";
|
|
|
|
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
|
const reportPath = path.join(root, "tests/golden/M13-02A/manifest-budget-report.json");
|
|
const manifestPath = path.join(root, "tests/golden/M13-02A/manifest.json");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "m13-02a-manifest-"));
|
|
const digest = "a".repeat(64);
|
|
const signature = "b".repeat(128);
|
|
const hashFile = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
|
|
const script = (id, overrides = {}) => ({
|
|
id, name: id, entryPath: `scripts/${id}.py`, sourceByteLength: 128, sourceSha256: digest,
|
|
publisher: "local", signature, keyId: "key:local", permissions: ["READ_MAIN"], dependencies: [],
|
|
module: false, cpuMs: 1000, memoryBytes: 1024 * 1024, wallMs: 5000, network: false,
|
|
autorun: false, driverExpressions: false, addonInstall: false, ...overrides,
|
|
});
|
|
const manifest = (scripts = [script("clean")]) => ({ schemaVersion: 1, scripts });
|
|
const transpile = (name) => {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
|
|
.replace('require("./asset-path")', 'require("./asset-path.cjs")')
|
|
.replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
};
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) transpile(name);
|
|
const require = createRequire(import.meta.url);
|
|
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
|
|
const denied = (value) => {
|
|
try { protocol.parseScriptingManifest(value); return "ACCEPTED"; }
|
|
catch (error) { return error instanceof Error ? error.message : String(error); }
|
|
};
|
|
try {
|
|
const valid = protocol.parseScriptingManifest(manifest([
|
|
script("base", { entryPath: "//scripts/../scripts/base.py" }),
|
|
script("clean", { dependencies: [{ id: "base", sourceSha256: digest, sourcePath: "//deps/base.py" }] }),
|
|
]));
|
|
const cases = {
|
|
count: denied(manifest(Array.from({ length: protocol.SCRIPTING_BUDGET.maxScripts + 1 }, (_, index) => script(`script-${index}`)))),
|
|
totalBytes: denied(manifest([script("large", { sourceByteLength: protocol.SCRIPTING_BUDGET.maxSourceBytes }), script("overflow", { sourceByteLength: 1 })])),
|
|
module: denied(manifest([script("module", { module: true })])),
|
|
path: denied(manifest([script("escape", { entryPath: "../escape.py" })])),
|
|
dependency: denied(manifest([script("duplicate", { dependencies: [{ id: "base", sourceSha256: digest, sourcePath: "deps/a.py" }, { id: "base", sourceSha256: digest, sourcePath: "deps/b.py" }] }), script("base")])),
|
|
permission: denied(manifest([script("unknown", { permissions: ["EXECUTE"] })])),
|
|
};
|
|
assert.equal(valid.scripts[0].entryPath, "scripts/base.py");
|
|
assert.equal(valid.scripts[1].dependencies[0].sourcePath, "deps/base.py");
|
|
assert.equal(valid.scripts.reduce((total, item) => total + item.sourceByteLength, 0), 256);
|
|
assert.match(cases.count, /SCRIPT_BUDGET_EXCEEDED/);
|
|
assert.match(cases.totalBytes, /SCRIPT_BUDGET_EXCEEDED/);
|
|
assert.match(cases.module, /SCRIPT_POLICY_DENIED/);
|
|
assert.match(cases.path, /SCRIPT_MANIFEST_INVALID/);
|
|
assert.match(cases.dependency, /SCRIPT_MANIFEST_INVALID/);
|
|
assert.match(cases.permission, /SCRIPT_POLICY_DENIED/);
|
|
const report = {
|
|
schemaVersion: 1,
|
|
task: "M13-02A",
|
|
operation: "SCRIPT_MANIFEST_BUDGETS",
|
|
accepted: { scriptCount: valid.scripts.length, canonicalEntryPath: valid.scripts[0].entryPath, canonicalDependencyPath: valid.scripts[1].dependencies[0].sourcePath, totalSourceBytes: 256, module: false },
|
|
denied: Object.fromEntries(Object.entries(cases).map(([name, message]) => [name, { status: "BLOCKED", code: message.split(":", 1)[0] }])),
|
|
budgets: { maxScripts: protocol.SCRIPTING_BUDGET.maxScripts, maxSourceBytes: protocol.SCRIPTING_BUDGET.maxSourceBytes, maxDependencies: protocol.SCRIPTING_BUDGET.maxDependencies, maxPermissions: protocol.SCRIPTING_BUDGET.maxPermissions },
|
|
nextTask: "M13-02B",
|
|
};
|
|
if (process.env.UPDATE_M13_02A_REPORT === "1") { fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n"); }
|
|
assert.deepEqual(JSON.parse(fs.readFileSync(reportPath, "utf8")), report);
|
|
const manifestValue = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
|
|
assert.deepEqual({ schemaVersion: manifestValue.schemaVersion, task: manifestValue.task, parentTask: manifestValue.parentTask, nextTask: manifestValue.nextTask }, { schemaVersion: 1, task: "M13-02A", parentTask: "M13-01F", nextTask: "M13-02B" });
|
|
for (const artifact of Object.values(manifestValue.artifacts)) assert.equal(hashFile(path.join(root, artifact.path)), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
|
|
process.stdout.write(`script-manifest-budgets-ok accepted=${valid.scripts.length} totalSourceBytes=256 blocked=${Object.keys(cases).length} deterministic=true next=${manifestValue.nextTask}\n`);
|
|
}
|
|
finally { fs.rmSync(temporary, { recursive: true, force: true }); }
|