53 lines
6.0 KiB
JavaScript
53 lines
6.0 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import crypto from "node:crypto";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import { fileURLToPath } from "node:url";
|
|
import ts from "../../web/node_modules/typescript/lib/typescript.js";
|
|
|
|
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
|
const reportPath = path.join(root, "tests/golden/M13-03G/sandbox-recovery-report.json");
|
|
const manifestPath = path.join(root, "tests/golden/M13-03G/manifest.json");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "m13-03g-recovery-"));
|
|
const hashFile = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
|
|
|
|
try {
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
|
|
.replace('require("./asset-path")', 'require("./asset-path.cjs")').replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
}
|
|
const source = fs.readFileSync(path.join(root, "web/app/src/testing/script-sandbox-recovery.ts"), "utf8");
|
|
fs.writeFileSync(path.join(temporary, "script-sandbox-recovery.cjs"), ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: "script-sandbox-recovery.ts" }).outputText);
|
|
const protocol = createRequire(import.meta.url)(path.join(temporary, "scripting-platform.cjs"));
|
|
const recovery = createRequire(import.meta.url)(path.join(temporary, "script-sandbox-recovery.cjs"));
|
|
const sourceSha256 = "a".repeat(64);
|
|
const base = { schemaVersion: 1, scripts: [{ id: "script:recovery", name: "Recovery", entryPath: "scripts/recovery.py", sourceByteLength: 128, sourceSha256, publisher: "Team", signature: "b".repeat(128), keyId: "key:trusted", permissions: ["READ_MAIN"], dependencies: [], module: false, cpuMs: 1000, memoryBytes: 1024 * 1024, wallMs: 5000, network: false, autorun: false, driverExpressions: false, addonInstall: false }] };
|
|
const parsed = protocol.parseScriptingManifest(base);
|
|
const firstAudit = await protocol.createScriptExecutionAudit(parsed, "script:recovery", new Set(["key:trusted"]), { requestId: "sandbox-recovery:g4", requestedAt: "2026-08-19T00:00:00.000Z" });
|
|
const firstLog = await protocol.appendScriptExecutionAudit({ schemaVersion: 1, entries: [] }, firstAudit);
|
|
const secondAudit = await protocol.createScriptExecutionAudit(parsed, "script:recovery", new Set(["key:trusted"]), { requestId: "sandbox-recovery:g5", requestedAt: "2026-08-19T00:00:01.000Z" });
|
|
const checked = await protocol.parseScriptExecutionAuditLog(await protocol.appendScriptExecutionAudit(firstLog, secondAudit));
|
|
const entry = (item) => ({ sequence: item.sequence, requestId: item.audit.requestId, previousEntrySha256: item.previousEntrySha256, entrySha256: item.entrySha256, sourceSha256: item.audit.sourceSha256, manifestSha256: item.audit.manifestSha256 });
|
|
const receipt = recovery.createScriptSandboxRecoveryReceipt({ previousGeneration: 4, nextGeneration: 5, mainRevisionBefore: 11, mainRevisionAfter: 11, sourceSha256, manifestSha256: checked.entries[0].audit.manifestSha256, audit: { entries: 2, first: entry(checked.entries[0]), second: entry(checked.entries[1]) } });
|
|
let replayError = "ACCEPTED";
|
|
try { await protocol.appendScriptExecutionAudit(checked, secondAudit); } catch (error) { replayError = error instanceof Error ? error.message.split(":", 1)[0] : String(error); }
|
|
let tamperError = "ACCEPTED";
|
|
try { await protocol.parseScriptExecutionAuditLog({ ...checked, entries: checked.entries.map((item, index) => index === 0 ? { ...item, audit: { ...item.audit, sourceSha256: "c".repeat(64) } } : item) }); } catch (error) { tamperError = error instanceof Error ? error.message.split(":", 1)[0] : String(error); }
|
|
assert.equal(replayError, "SCRIPT_MANIFEST_INVALID");
|
|
assert.equal(tamperError, "SCRIPT_MANIFEST_INVALID");
|
|
assert.equal(receipt.audit.second.previousEntrySha256, receipt.audit.first.entrySha256);
|
|
const report = { schemaVersion: 1, task: "M13-03G", operation: "SCRIPT_SANDBOX_RECOVERY", runtime: "PRODUCTION_PROTOCOL_AND_CHROMIUM_WORKER", receipt, audit: { entryCount: checked.entries.length, firstEntrySha256: checked.entries[0].entrySha256, secondPreviousEntrySha256: checked.entries[1].previousEntrySha256, secondEntrySha256: checked.entries[1].entrySha256, requestIds: checked.entries.map((item) => item.audit.requestId), sourceSha256, manifestSha256: checked.entries[0].audit.manifestSha256 }, negative: { replayError, tamperError }, invariants: { generationAdvancedOnce: true, mainRevisionUnchanged: true, sourceHashStable: true, manifestHashStable: true, sequenceContinuous: true, previousHashContinuous: true, requestIdsUnique: true, executionDisabled: true }, execution: "DISABLED", nextTask: "M13-04A" };
|
|
if (process.env.UPDATE_M13_03G_REPORT === "1") { fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n"); }
|
|
assert.deepEqual(JSON.parse(fs.readFileSync(reportPath, "utf8")), report);
|
|
const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
|
|
assert.deepEqual({ schemaVersion: manifest.schemaVersion, task: manifest.task, parentTask: manifest.parentTask, nextTask: manifest.nextTask }, { schemaVersion: 1, task: "M13-03G", parentTask: "M13-03F", nextTask: "M13-04A" });
|
|
for (const artifact of Object.values(manifest.artifacts)) assert.equal(hashFile(path.join(root, artifact.path)), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
|
|
process.stdout.write(`script-sandbox-recovery-ok generation=4->5 revision=11 sourceStable=true manifestStable=true sequence=1,2 chain=true replay=${replayError} tamper=${tamperError} next=${manifest.nextTask}\n`);
|
|
} finally {
|
|
fs.rmSync(temporary, { recursive: true, force: true });
|
|
}
|