Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/companion-worker-service.test.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const test = require('node:test');
+const { createCompanionWorkerService } = require('../../src/services/companion-worker-service');
+
+function fixture() {
+  const values = new Map(); const secretValues = new Map();
+  const settings = { get: (key, fallback) => values.has(key) ? values.get(key) : fallback, set: (key, value) => values.set(key, value) };
+  const secrets = { has: key => secretValues.has(key), get: key => secretValues.get(key) || '', set: (key, value) => value ? secretValues.set(key, value) : secretValues.delete(key) };
+  return { settings, secrets, secretValues };
+}
+
+test('companion workers require HTTPS and never accept shell or arbitrary path jobs', () => {
+  const f = fixture(); const service = createCompanionWorkerService(f);
+  assert.throws(() => service.save({ id: 'win-one', endpoint: 'http://worker.local:9443' }), /HTTPS/);
+  service.save({ id: 'win-one', endpoint: 'https://worker.local:9443' });
+  const pairing = service.pair('win-one');
+  assert.equal(pairing.shownOnce, true);
+  assert.equal(pairing.pairingKey.length, 64);
+  const key = Buffer.from(pairing.pairingKey, 'hex');
+  assert.throws(() => service.signedJob(key, 'win-one', { type: 'shell', artifactId: 'game:1', outputSlot: 'exports' }), /workertype/);
+  assert.throws(() => service.signedJob(key, 'win-one', { type: 'exfat', artifactId: '../../etc', outputSlot: 'exports' }), /uitsluitend/);
+  const job = service.signedJob(key, 'win-one', { type: 'exfat', artifactId: 'game:1', outputSlot: 'exports' });
+  assert.equal(job.job.type, 'exfat');
+  assert.equal(Object.prototype.hasOwnProperty.call(job.job, 'path'), false);
+  assert.equal(Object.prototype.hasOwnProperty.call(job.job, 'command'), false);
+});
+
+test('capability response must be nonce-bound, HMAC-authenticated and allowlisted', async () => {
+  const f = fixture(); let key;
+  const fetchImpl = async (_url, options) => {
+    const nonce = options.headers['X-Chimera-Nonce'];
+    const payload = Buffer.from(JSON.stringify({ version: '1.0.0', capabilities: ['exfat', 'shell'], slots: ['exports', '../../bad'], limits: { maxInputBytes: 123 } })).toString('base64');
+    const transcript = `capabilities|win-one|${nonce}|${payload}`;
+    return { ok: true, json: async () => ({ schema: 1, workerId: 'win-one', nonce, payload, hmac: crypto.createHmac('sha256', key).update(transcript).digest('hex') }) };
+  };
+  const service = createCompanionWorkerService({ ...f, fetchImpl });
+  service.save({ id: 'win-one', endpoint: 'https://worker.local:9443' });
+  key = Buffer.from(service.pair('win-one').pairingKey, 'hex');
+  const result = await service.capabilities('win-one');
+  assert.deepEqual(result.capabilities, ['exfat']);
+  assert.deepEqual(result.slots, ['exports']);
+  assert.equal(result.shell, false);
+  assert.equal(result.arbitraryPaths, false);
+});