michel/clusterflux-public
1
0
Fork 0
Code Issues Pull requests Projects Releases 21 Packages Wiki Activity Actions

Public dry run dryrun-1714a9eedd5b

Browse source 
Source commit: 1714a9eedd5b1e30c6c9aceb7a999f2f695ba83c

Public tree identity: sha256:e5daffad23fa7c7f1822adccd3c3b4ee0bc7f1a45e0d321eb9a6fb8282b269db
This commit is contained in:
Disasmer release dry run 2026-07-03 17:31:04 +02:00
commit 20c72e6066
102 changed files with 32054 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

179
scripts/tenant-isolation-contract-smoke.js Normal file
View file

@ -0,0 +1,179 @@
#!/usr/bin/env node
const assert = require("assert");
const fs = require("fs");
const path = require("path");
const repo = path.resolve(__dirname, "..");
function read(relativePath) {
return fs.readFileSync(path.join(repo, relativePath), "utf8");
}
function maybeRead(segments) {
const fullPath = path.join(repo, ...segments);
if (!fs.existsSync(fullPath)) return null;
return fs.readFileSync(fullPath, "utf8");
}
function expect(source, name, pattern) {
assert.match(source, pattern, `missing tenant-isolation evidence: ${name}`);
}
function expectGate(script, gateName) {
assert(
script.includes("node scripts/tenant-isolation-contract-smoke.js"),
`${gateName} must run tenant-isolation-contract-smoke.js`
);
}
const auth = read("crates/disasmer-core/src/auth.rs");
const artifact = read("crates/disasmer-core/src/artifact.rs");
const operatorPanel = read("crates/disasmer-core/src/operator_panel.rs");
const source = read("crates/disasmer-core/src/source.rs");
const coordinatorService = read("crates/disasmer-coordinator/src/service.rs");
const artifactDownloadSmoke = read("scripts/artifact-download-smoke.js");
const operatorPanelSmoke = read("scripts/operator-panel-smoke.js");
const schedulerSmoke = read("scripts/scheduler-placement-smoke.js");
const sourcePreparationSmoke = read("scripts/source-preparation-smoke.js");
const releaseBlockerSmoke = read("scripts/release-blocker-smoke.js");
const publicAcceptance = read("scripts/acceptance-public.sh");
const publicSplit = read("scripts/verify-public-split.sh");
const privateAcceptance = read("scripts/acceptance-private.sh");
for (const [name, pattern] of [
["auth contexts carry tenant and project", /pub struct AuthContext[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["enrollment grants carry tenant and project", /pub struct EnrollmentGrant[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["node credentials carry tenant and project", /pub struct NodeCredential[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["same tenant/project denies tenant mismatch", /pub fn same_tenant_project[\s\S]*tenant mismatch/],
["same tenant/project denies project mismatch", /pub fn same_tenant_project[\s\S]*project mismatch/],
["auth unit denies cross-tenant access", /fn tenant_project_scope_denies_cross_tenant_access\(\)/],
]) {
expect(auth, name, pattern);
}
for (const [name, pattern] of [
["artifact metadata carries tenant and project", /pub struct ArtifactMetadata[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["download links carry tenant project process and actor", /pub struct DownloadLink[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId[\s\S]*pub process: ProcessId[\s\S]*pub actor: Actor/],
["downloads authorize against scoped metadata", /let authz = same_tenant_project\(context, &scope\)/],
["artifact test denies cross-tenant download", /fn cross_tenant_download_is_denied_even_with_known_artifact_id\(\)/],
["artifact test denies cross-project download", /fn cross_project_download_is_denied_even_with_known_artifact_id\(\)/],
]) {
expect(artifact, name, pattern);
}
for (const [name, pattern] of [
["panel state carries tenant project and process", /pub struct PanelState[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId[\s\S]*pub process: ProcessId/],
["panel events carry tenant project and process", /pub struct PanelEvent[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId[\s\S]*pub process: ProcessId/],
["panel events reject scope mismatch", /PanelError::ScopeMismatch/],
["panel scope validation compares tenant project process", /self\.tenant != event\.tenant[\s\S]*self\.project != event\.project[\s\S]*self\.process != event\.process/],
]) {
expect(operatorPanel, name, pattern);
}
expect(
source,
"source preparation carries tenant and project",
/pub struct SourcePreparation[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/
);
for (const [name, pattern] of [
["project creation rejects foreign tenant reuse", /project id is outside the signed-in tenant scope/],
["project selection rejects foreign tenant", /project is outside the signed-in tenant scope/],
["project listing uses tenant-scoped context", /CoordinatorRequest::ListProjects[\s\S]*list_projects\(&context\)/],
["node capability reports check enrollment tenant scope", /node capability report is outside the enrolled tenant\/project scope/],
["operator panel stop state is tenant/project/process keyed", /type PanelStopKey = \(TenantId, ProjectId, ProcessId\)/],
["download service tests tenant mismatch", /cross_tenant\.to_string\(\)\.contains\("tenant mismatch"\)/],
["download service tests project mismatch", /cross_project\.to_string\(\)\.contains\("project mismatch"\)/],
["node capability test rejects cross-scope report", /fn service_rejects_node_capability_report_outside_enrollment_scope\(\)/],
["source preparation test rejects cross-scope completion", /fn service_rejects_source_preparation_completion_outside_node_scope\(\)/],
]) {
expect(coordinatorService, name, pattern);
}
for (const [name, sourceText, patterns] of [
[
"artifact download smoke",
artifactDownloadSmoke,
[
/const crossTenant = await send/,
/const crossProject = await send/,
/const crossTenantOpen = await send/,
/const crossProjectOpen = await send/,
/tenant mismatch/,
/project mismatch/,
/token is invalid/,
],
],
[
"operator panel smoke",
operatorPanelSmoke,
[/const crossTenant = await send/, /render_operator_panel/, /scope\|tenant\|project/],
],
[
"scheduler and capability smoke",
schedulerSmoke,
[
/const crossScopeInspection = await send/,
/assert\.strictEqual\(crossScopeInspection\.descriptors\.length, 0\)/,
/const crossTenantReport = await send/,
/tenant\\\/project scope/,
],
],
[
"source preparation smoke",
sourcePreparationSmoke,
[/const crossTenantCompletion = await send/, /complete_source_preparation/, /tenant\\\/project scope/i],
],
]) {
for (const pattern of patterns) {
expect(sourceText, name, pattern);
}
}
expect(releaseBlockerSmoke, "release blockers list tenant-isolation failure", /cross-tenant access is listed as a release blocker/);
expectGate(publicAcceptance, "public acceptance");
expectGate(publicSplit, "public split acceptance");
expectGate(privateAcceptance, "private acceptance");
const hostedLib = maybeRead(["private", "hosted-policy", "src", "lib.rs"]);
const hostedSmoke = maybeRead([
"private",
"hosted-policy",
"scripts",
"hosted-community-smoke.js",
]);
if (hostedLib && hostedSmoke) {
for (const [name, pattern] of [
["hosted agent keys are tenant/project keyed", /agent_public_keys: BTreeMap<\(TenantId, ProjectId, AgentId\), AgentPublicKeyRecord>/],
["hosted agent records carry tenant and project", /pub struct AgentPublicKeyRecord[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["hosted node statuses carry tenant and project", /pub struct HostedNodeStatus[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["hosted process statuses carry tenant and project", /pub struct HostedProcessStatus[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["hosted log entries carry tenant and project", /pub struct HostedLogEntry[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["hosted debug statuses carry tenant and project", /pub struct HostedDebugSessionStatus[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["hosted observability snapshots carry tenant and project", /pub struct HostedObservabilitySnapshot[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId/],
["hosted observability filters nodes by tenant/project", /node_statuses[\s\S]*filter\(\|status\| status\.tenant == context\.tenant && status\.project == context\.project\)/],
["hosted observability filters logs by tenant/project", /log_entries[\s\S]*filter\(\|entry\| entry\.tenant == context\.tenant && entry\.project == context\.project\)/],
["hosted observability filters artifacts by tenant/project", /metadata\.tenant == context\.tenant && metadata\.project == context\.project/],
["hosted observability filters debug by tenant/project", /debug_sessions[\s\S]*filter\(\|status\| status\.tenant == context\.tenant && status\.project == context\.project\)/],
["hosted artifact metadata inspection authorizes scoped metadata", /artifact_metadata_for_context[\s\S]*self\.authorize\(context, &scope, Action::Inspect/],
["hosted scheduling rejects foreign nodes", /hosted scheduling targets only authorized user-attached project nodes/],
]) {
expect(hostedLib, name, pattern);
}
for (const [name, pattern] of [
["foreign agent list is empty", /const foreignAgentList = await send[\s\S]*records, \[\]/],
["foreign start is denied", /const foreignStart = await send[\s\S]*authorized user-attached project nodes\|tenant mismatch/],
["cross-project debug is denied", /const crossProjectDebug = await send[\s\S]*tenant\|project\|debug/],
["cross-actor debug is denied", /const crossActorDebug = await send[\s\S]*debug\|permission\|actor\|user/],
["cross-tenant metadata is denied", /const crossTenantMetadata = await send[\s\S]*tenant mismatch/],
["foreign snapshot reveals no objects", /foreignSnapshot[\s\S]*snapshot\.nodes, \[\][\s\S]*snapshot\.processes, \[\][\s\S]*snapshot\.logs, \[\][\s\S]*snapshot\.artifacts, \[\][\s\S]*snapshot\.debug_sessions, \[\]/],
["cross-tenant download is denied", /const crossTenantDownload = await send[\s\S]*tenant mismatch/],
]) {
expect(hostedSmoke, name, pattern);
}
}
console.log("Tenant isolation contract smoke passed");