mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-23 03:18:09 +08:00
feat(ql3): add secure console task editing
This commit is contained in:
whyour
@@ -0,0 +1,355 @@
|
||||
const assert = require('node:assert/strict');
|
||||
const fs = require('node:fs');
|
||||
const os = require('node:os');
|
||||
const path = require('node:path');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const {
|
||||
createTaskDefinitionRecord,
|
||||
} = require('@qinglong/runtime-core/task-definition');
|
||||
const {
|
||||
createLocalPresenceProofManager,
|
||||
} = require('../dist/authentication/localPresenceProof.js');
|
||||
const {
|
||||
createLocalApiTaskAuthoringRoute,
|
||||
} = require('../dist/task/taskAuthoringRoute.js');
|
||||
|
||||
const PRINCIPAL = Object.freeze({
|
||||
subject: Object.freeze({ type: 'user', id: 'owner' }),
|
||||
authenticationId: 'local_credential:owner-console:1',
|
||||
authenticatedAtMs: 9_000,
|
||||
expiresAtMs: 1_000_000,
|
||||
assurance: 'single_factor',
|
||||
});
|
||||
|
||||
const FENCE = Object.freeze({
|
||||
credentialId: 'owner-console',
|
||||
credentialVersion: 1,
|
||||
pepperKeyId: 'owner-v1',
|
||||
materialDigest: 'a'.repeat(64),
|
||||
subjectType: 'user',
|
||||
subjectId: 'owner',
|
||||
secretDigest: 'b'.repeat(64),
|
||||
notBeforeAtMs: 1,
|
||||
expiresAtMs: 1_000_000,
|
||||
});
|
||||
|
||||
function uuidFactory() {
|
||||
let sequence = 400;
|
||||
return () => {
|
||||
sequence += 1;
|
||||
return `019fa000-0000-4000-8000-${String(sequence).padStart(12, '0')}`;
|
||||
};
|
||||
}
|
||||
|
||||
function definition(revision = 3) {
|
||||
const first = createTaskDefinitionRecord(
|
||||
{
|
||||
projectId: 'default',
|
||||
taskId: 'task-console',
|
||||
expectedRevision: null,
|
||||
mutationId: '019fa000-0000-4000-8000-000000000101',
|
||||
name: 'Editable Task',
|
||||
description: 'Full definition stays behind strong authoring read',
|
||||
kind: 'command',
|
||||
spec: Object.freeze({
|
||||
schema: 'qinglong/command@v1',
|
||||
config: Object.freeze({
|
||||
command: Object.freeze({
|
||||
kind: 'argv',
|
||||
file: '/bin/echo',
|
||||
args: Object.freeze(['before']),
|
||||
}),
|
||||
}),
|
||||
}),
|
||||
labels: Object.freeze({ 'qinglong.source': 'local-console' }),
|
||||
enabled: true,
|
||||
occurredAtMs: 10_000,
|
||||
},
|
||||
10_000,
|
||||
);
|
||||
return Object.freeze({ ...first, revision });
|
||||
}
|
||||
|
||||
function fixture(t, overrides = {}) {
|
||||
const deploymentRoot = fs.mkdtempSync(
|
||||
path.join(os.tmpdir(), 'ql3-task-authoring-'),
|
||||
);
|
||||
fs.chmodSync(deploymentRoot, 0o700);
|
||||
t.after(() => fs.rmSync(deploymentRoot, { recursive: true, force: true }));
|
||||
let now = 10_000;
|
||||
let current = definition();
|
||||
const calls = [];
|
||||
const presenceProof = createLocalPresenceProofManager({
|
||||
deploymentRoot,
|
||||
profile: 'edge',
|
||||
now: () => now,
|
||||
randomUuid: uuidFactory(),
|
||||
randomSecret: () => Buffer.alloc(32, 17),
|
||||
});
|
||||
t.after(() => presenceProof.close());
|
||||
const projectPolicy = {
|
||||
async resolve(projectId, subject) {
|
||||
calls.push(['policy', projectId, subject]);
|
||||
return {
|
||||
project: {
|
||||
id: projectId,
|
||||
name: 'Default',
|
||||
slug: 'default',
|
||||
status: 'active',
|
||||
version: 3,
|
||||
createdAtMs: 1,
|
||||
updatedAtMs: 2,
|
||||
},
|
||||
binding: {
|
||||
projectId,
|
||||
subject,
|
||||
version: 5,
|
||||
state: 'active',
|
||||
role: 'owner',
|
||||
mutationId: 'owner-binding',
|
||||
changedBy: { type: 'user', id: 'bootstrap-owner' },
|
||||
createdAtMs: 2,
|
||||
},
|
||||
};
|
||||
},
|
||||
async append() {
|
||||
throw new Error('not used');
|
||||
},
|
||||
};
|
||||
const route = createLocalApiTaskAuthoringRoute({
|
||||
profile: 'edge',
|
||||
projectPolicy,
|
||||
taskDefinitions: {
|
||||
async findCurrentTaskDefinition() {
|
||||
calls.push(['read']);
|
||||
return current;
|
||||
},
|
||||
},
|
||||
securityAudit: {
|
||||
async record(record) {
|
||||
calls.push(['audit', record]);
|
||||
},
|
||||
},
|
||||
presenceProof,
|
||||
now: () => now,
|
||||
randomUuid: uuidFactory(),
|
||||
randomSecret: () => Buffer.alloc(32, 19),
|
||||
...overrides,
|
||||
});
|
||||
t.after(() => route.close());
|
||||
const authenticated = Object.freeze({
|
||||
principal: PRINCIPAL,
|
||||
credentialFence: FENCE,
|
||||
async confirm() {
|
||||
calls.push(['confirm']);
|
||||
},
|
||||
});
|
||||
return {
|
||||
route,
|
||||
calls,
|
||||
deploymentRoot,
|
||||
authenticated,
|
||||
current: () => current,
|
||||
setCurrent(value) {
|
||||
current = value;
|
||||
},
|
||||
setNow(value) {
|
||||
now = value;
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function request(state, overrides = {}) {
|
||||
return Object.freeze({
|
||||
requestId: 'local:019fa000-0000-4000-8000-000000000301',
|
||||
projectId: 'default',
|
||||
taskId: 'task-console',
|
||||
presence: null,
|
||||
authenticated: state.authenticated,
|
||||
signal: new AbortController().signal,
|
||||
...overrides,
|
||||
});
|
||||
}
|
||||
|
||||
function proof(state, challenge) {
|
||||
return JSON.parse(
|
||||
fs.readFileSync(
|
||||
path.join(
|
||||
state.deploymentRoot,
|
||||
'console-presence',
|
||||
challenge.body.proofFileName,
|
||||
),
|
||||
'utf8',
|
||||
),
|
||||
).proof;
|
||||
}
|
||||
|
||||
function leaseBinding(state, overrides = {}) {
|
||||
const task = state.current();
|
||||
return Object.freeze({
|
||||
projectId: 'default',
|
||||
taskId: 'task-console',
|
||||
revision: task.revision,
|
||||
contentDigest: task.contentDigest,
|
||||
credentialId: FENCE.credentialId,
|
||||
credentialVersion: FENCE.credentialVersion,
|
||||
subjectType: 'user',
|
||||
subjectId: FENCE.subjectId,
|
||||
...overrides,
|
||||
});
|
||||
}
|
||||
|
||||
async function openAuthoring(state) {
|
||||
const challenge = await state.route.handle(request(state));
|
||||
assert.equal(challenge.statusCode, 428);
|
||||
return state.route.handle(
|
||||
request(state, { presence: proof(state, challenge) }),
|
||||
);
|
||||
}
|
||||
|
||||
test('returns the full exact definition only after local presence and issues one credential-bound lease', async (t) => {
|
||||
const state = fixture(t);
|
||||
const value = await openAuthoring(state);
|
||||
assert.equal(value.statusCode, 200);
|
||||
assert.deepEqual(value.body.task.spec, state.current().spec);
|
||||
assert.deepEqual(value.body.task.labels, state.current().labels);
|
||||
assert.equal(value.body.task.description, state.current().description);
|
||||
assert.equal(value.body.authoring.revision, state.current().revision);
|
||||
assert.equal(
|
||||
value.body.authoring.contentDigest,
|
||||
state.current().contentDigest,
|
||||
);
|
||||
assert.match(value.body.authoring.lease, /^ql3a_[A-Za-z0-9_-]+$/);
|
||||
assert.equal(state.calls.filter(([kind]) => kind === 'confirm').length, 2);
|
||||
assert.deepEqual(
|
||||
state.calls
|
||||
.filter(([kind]) => kind === 'audit')
|
||||
.map(([, record]) => [
|
||||
record.operationId,
|
||||
record.outcome,
|
||||
record.reasons[0],
|
||||
]),
|
||||
[
|
||||
['task.authoring.read', 'approval_required', 'local_presence_required'],
|
||||
['task.authoring.read', 'allowed', 'role_grant'],
|
||||
],
|
||||
);
|
||||
assert.equal(
|
||||
state.route.leases.inspect(value.body.authoring.lease, leaseBinding(state)),
|
||||
true,
|
||||
);
|
||||
assert.equal(
|
||||
state.route.leases.inspect(
|
||||
value.body.authoring.lease,
|
||||
leaseBinding(state, { credentialVersion: 2 }),
|
||||
),
|
||||
false,
|
||||
);
|
||||
assert.equal(
|
||||
state.route.leases.consume(value.body.authoring.lease, leaseBinding(state)),
|
||||
true,
|
||||
);
|
||||
assert.equal(
|
||||
state.route.leases.consume(value.body.authoring.lease, leaseBinding(state)),
|
||||
false,
|
||||
);
|
||||
});
|
||||
|
||||
test('binds a lease to the exact revision/content and expires it without a timer', async (t) => {
|
||||
const state = fixture(t);
|
||||
const value = await openAuthoring(state);
|
||||
const lease = value.body.authoring.lease;
|
||||
assert.equal(
|
||||
state.route.leases.inspect(
|
||||
lease,
|
||||
leaseBinding(state, { contentDigest: 'f'.repeat(64) }),
|
||||
),
|
||||
false,
|
||||
);
|
||||
state.setNow(value.body.authoring.expiresAtMs);
|
||||
assert.equal(state.route.leases.inspect(lease, leaseBinding(state)), false);
|
||||
});
|
||||
|
||||
test('rejects non-User and unauthorized requests before publishing a proof', async (t) => {
|
||||
const state = fixture(t, {
|
||||
projectPolicy: {
|
||||
async resolve(projectId, subject) {
|
||||
return {
|
||||
project: {
|
||||
id: projectId,
|
||||
name: 'Default',
|
||||
slug: 'default',
|
||||
status: 'active',
|
||||
version: 3,
|
||||
createdAtMs: 1,
|
||||
updatedAtMs: 2,
|
||||
},
|
||||
binding: {
|
||||
projectId,
|
||||
subject,
|
||||
version: 5,
|
||||
state: 'active',
|
||||
role: 'viewer',
|
||||
mutationId: 'viewer-binding',
|
||||
changedBy: { type: 'user', id: 'bootstrap-owner' },
|
||||
createdAtMs: 2,
|
||||
},
|
||||
};
|
||||
},
|
||||
async append() {
|
||||
throw new Error('not used');
|
||||
},
|
||||
},
|
||||
});
|
||||
assert.deepEqual(await state.route.handle(request(state)), {
|
||||
statusCode: 403,
|
||||
body: { code: 'forbidden' },
|
||||
});
|
||||
assert.deepEqual(
|
||||
fs.readdirSync(path.join(state.deploymentRoot, 'console-presence')),
|
||||
[],
|
||||
);
|
||||
|
||||
const system = Object.freeze({
|
||||
...state.authenticated,
|
||||
principal: Object.freeze({
|
||||
...PRINCIPAL,
|
||||
subject: Object.freeze({ type: 'system', id: 'runtime' }),
|
||||
assurance: 'service',
|
||||
}),
|
||||
credentialFence: Object.freeze({
|
||||
...FENCE,
|
||||
subjectType: 'system',
|
||||
subjectId: 'runtime',
|
||||
}),
|
||||
});
|
||||
assert.deepEqual(
|
||||
await state.route.handle(request(state, { authenticated: system })),
|
||||
{ statusCode: 403, body: { code: 'forbidden' } },
|
||||
);
|
||||
});
|
||||
|
||||
test('bounds Edge authoring leases to eight and clears them on close', async (t) => {
|
||||
const state = fixture(t);
|
||||
const leases = [];
|
||||
for (let index = 0; index < 8; index += 1) {
|
||||
const value = await openAuthoring(state);
|
||||
assert.equal(value.statusCode, 200);
|
||||
leases.push(value.body.authoring.lease);
|
||||
}
|
||||
const exhausted = await state.route.handle(request(state));
|
||||
assert.deepEqual(exhausted, {
|
||||
statusCode: 503,
|
||||
body: { code: 'task_authoring_unavailable' },
|
||||
});
|
||||
state.route.close();
|
||||
assert.equal(
|
||||
state.route.leases.inspect(leases[0], leaseBinding(state)),
|
||||
false,
|
||||
);
|
||||
assert.deepEqual(await state.route.handle(request(state)), {
|
||||
statusCode: 503,
|
||||
body: { code: 'request_unavailable' },
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user