53 lines
5.2 KiB
JavaScript
53 lines
5.2 KiB
JavaScript
'use strict';
|
|
|
|
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const { parseDpiResponse, createShimSimulator, createPinnedShim, createGuardedInstaller } = require('../../src/services/etahen-link-shim-installer');
|
|
|
|
const manifest = { shimId: 'shim_12345678', abiVersion: 'chimera-etahen-link-1', etahenVersion: '2.5B', etahenRevision: '5'.repeat(40), etahenBinarySha256: 'a'.repeat(64), shimBinarySha256: 'b'.repeat(64), firmwares: ['10.01'] };
|
|
const runtime = { version: '2.5B', binarySha256: 'a'.repeat(64), firmware: '10.01', runtimeEpoch: 'runtime_12345678' };
|
|
function setup(response, options = {}) { const broker = createShimSimulator({ manifest, response }); const shim = createPinnedShim({ manifest, broker }); return { broker, shim, installer: createGuardedInstaller({ shim, now: () => 5000, ...options }) }; }
|
|
function proposal(installer) { return installer.propose({ consoleId: 'console_12345678', consoleProfileId: 'profile_12345678', titleId: 'PPSA12345', expectedVersion: '1.00', runtime, artifact: { artifactId: 'artifact_12345678', ticketId: 'ticket_12345678', contentId: 'UP0000-PPSA12345_00-TEST000000000001', size: 100, sha256: 'c'.repeat(64), status: 'staged', installed: false }, recovery: { verified: true, receiptId: 'recovery_12345678' } }); }
|
|
|
|
test('shim accepts only exact pinned ABI, etaHEN build and firmware', () => {
|
|
const { shim } = setup('{"res":"0"}'); assert.equal(shim.probe(runtime).available, true);
|
|
assert.equal(shim.probe({ ...runtime, binarySha256: 'd'.repeat(64) }).available, false);
|
|
assert.throws(() => createPinnedShim({ manifest: { ...manifest, etahenRevision: '5061a85' }, broker: createShimSimulator({ manifest }) }), /full etaHEN revision/i);
|
|
assert.throws(() => createPinnedShim({ manifest: { ...manifest, abiVersion: 'unknown-abi' }, broker: createShimSimulator({ manifest }) }), /ABI/i);
|
|
});
|
|
|
|
test('DPI parser rejects hostile, oversized and ambiguous responses', () => {
|
|
assert.deepEqual(parseDpiResponse('{"res":"0"}'), { acknowledged: true, resultCode: '0', installed: false, postScanRequired: true });
|
|
for (const value of ['not json', '{"res":0}', '{"res":"0","extra":true}', 'x'.repeat(257)]) assert.throws(() => parseDpiResponse(value));
|
|
});
|
|
|
|
test('broker receives only semantic ticket data and acknowledgement is not installation evidence', () => {
|
|
const checkpoints = []; const audits = []; const { broker, installer } = setup('{"res":"0"}', { checkpoint: value => checkpoints.push(value.status), audit: value => audits.push(value.type) }); const plan = proposal(installer);
|
|
const confirmed = installer.confirm(plan, { runtimeEpoch: runtime.runtimeEpoch, confirmation: plan.confirmation, localIntent: true });
|
|
const applied = installer.apply(confirmed, { runtimeEpoch: runtime.runtimeEpoch });
|
|
assert.equal(applied.status, 'acknowledged'); assert.equal(applied.installed, false); assert.equal(applied.postScanRequired, true);
|
|
const request = broker.requests()[0]; assert.equal(request.operation, 'dpi.install-ticket'); assert.equal('url' in request, false); assert.equal('host' in request, false); assert.equal('port' in request, false);
|
|
assert.deepEqual(checkpoints, ['applying', 'acknowledged']); assert.deepEqual(audits, ['etahen.install.preflighted', 'etahen.install.confirmed', 'etahen.install.acknowledgement']);
|
|
});
|
|
|
|
test('stale confirmation and runtime loss fail closed', () => {
|
|
const { installer } = setup('{"res":"0"}'); const plan = proposal(installer);
|
|
assert.throws(() => installer.confirm(plan, { runtimeEpoch: 'runtime_stale001', confirmation: plan.confirmation, localIntent: true }), /fresh exact/i);
|
|
const confirmed = installer.confirm(plan, { runtimeEpoch: runtime.runtimeEpoch, confirmation: plan.confirmation, localIntent: true });
|
|
const applied = installer.apply(confirmed, { runtimeEpoch: runtime.runtimeEpoch });
|
|
assert.equal(installer.runtimeLost(applied).status, 'outcome_unknown'); assert.equal(installer.runtimeLost(applied).installed, false);
|
|
});
|
|
|
|
test('only a fresh complete matching post-scan creates installed evidence', () => {
|
|
const { installer } = setup('{"res":"0"}'); const plan = proposal(installer); const applied = installer.apply(installer.confirm(plan, { runtimeEpoch: runtime.runtimeEpoch, confirmation: plan.confirmation, localIntent: true }), { runtimeEpoch: runtime.runtimeEpoch });
|
|
const base = { consoleId: 'console_12345678', consoleProfileId: 'profile_12345678', titleId: 'PPSA12345', installState: 'observed', installedVersion: '1.00', observedAt: 6000, scanRunId: 'scanrun_12345678' };
|
|
assert.equal(installer.verify(applied, { ...base, coverage: 'partial' }).installed, false);
|
|
const verified = installer.verify(applied, { ...base, coverage: 'complete' }); assert.equal(verified.status, 'verified'); assert.equal(verified.installed, true); assert.equal(verified.installEvidence.source, 'complete-console-post-scan');
|
|
});
|
|
|
|
test('raw network and execution fields never cross the shim contract', () => {
|
|
const { shim, installer } = setup('{"res":"0"}');
|
|
assert.throws(() => shim.submitArtifact({ ticketId: 'ticket_12345678', artifactId: 'artifact_12345678', size: 1, sha256: 'c'.repeat(64), url: 'http://example.invalid' }, runtime), /forbidden/i);
|
|
assert.throws(() => installer.propose({ runtime, host: 'console.local' }), /forbidden/i);
|
|
});
|