2bef715211
Source commit: 20b59dc46b72103c2f8a516c692b5cc3d54fab19 Public tree identity: sha256:aaa5ac7b58b2a0d23c6b11e5f76324bf3839ca1f62653a83deb736932adcfbd9
77 lines
4.5 KiB
JavaScript
77 lines
4.5 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
const assert = require("assert");
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
|
|
const repo = path.resolve(__dirname, "..");
|
|
const infraRepo = path.resolve(repo, "..", "michelpaulissen.com");
|
|
|
|
function read(relativePath, base = repo) {
|
|
return fs.readFileSync(path.join(base, relativePath), "utf8");
|
|
}
|
|
|
|
function expect(source, name, pattern) {
|
|
assert.match(source, pattern, `missing public browser login evidence: ${name}`);
|
|
}
|
|
|
|
const cliSource = [
|
|
read("crates/disasmer-cli/src/main.rs"),
|
|
read("crates/disasmer-cli/src/dispatch.rs"),
|
|
read("crates/disasmer-cli/src/auth.rs"),
|
|
].join("\n");
|
|
const cliSmoke = read("scripts/cli-browser-login-flow-smoke.js");
|
|
const publicAcceptance = read("scripts/acceptance-public.sh");
|
|
const phase2 = read("acceptance_criteria_phase2.md");
|
|
const base = read("acceptance_criteria.md");
|
|
|
|
for (const [name, source] of [
|
|
["base acceptance", base],
|
|
["phase 2 acceptance", phase2],
|
|
]) {
|
|
expect(source, `${name} released binary browser criterion`, /Public released binaries[\s\S]*(?:human |server-owned )browser\/account flow/);
|
|
}
|
|
|
|
expect(cliSource, "diagnostic plan flag", /plan: bool/);
|
|
expect(cliSource, "interactive browser branch", /else if !args\.plan[\s\S]*execute_interactive_browser_login/);
|
|
expect(cliSource, "browser command override", /DISASMER_BROWSER_OPEN_COMMAND/);
|
|
expect(cliSource, "server-owned login start", /"type": "begin_oidc_browser_login"[\s\S]*requested_project/);
|
|
expect(cliSource, "opaque login polling", /"type": "poll_oidc_browser_login"[\s\S]*transaction_id[\s\S]*polling_secret/);
|
|
expect(cliSource, "server-owned state nonce and PKCE", /server_owns_state: true[\s\S]*server_owns_nonce: true[\s\S]*pkce_required: true/);
|
|
expect(cliSource, "CLI receives no provider code or claims", /cli_receives_provider_authorization_code: false[\s\S]*cli_submits_identity_claims: false/);
|
|
assert.doesNotMatch(cliSource, /TcpListener::bind|authorization_code.*issuer_url.*client_id/s);
|
|
expect(cliSmoke, "smoke uses fake browser opener", /DISASMER_BROWSER_OPEN_COMMAND/);
|
|
expect(cliSmoke, "smoke verifies server-owned browser transaction", /server-owned browser transaction/);
|
|
expect(cliSmoke, "smoke rejects client OIDC authority", /assert\.deepStrictEqual\(request,[\s\S]*begin_oidc_browser_login[\s\S]*requested_project/);
|
|
expect(cliSmoke, "smoke verifies coordinator completion", /scoped_cli_session_received/);
|
|
expect(publicAcceptance, "public acceptance runs browser flow smoke", /node scripts\/cli-browser-login-flow-smoke\.js/);
|
|
|
|
if (fs.existsSync(infraRepo)) {
|
|
const stack = read("modules/stack.nix", infraRepo);
|
|
const hypervisor = read("hosts/hypervisor/default.nix", infraRepo);
|
|
const oauth = read("modules/oauth-bootstrap.nix", infraRepo);
|
|
const site = read("disasmer-site/index.html", infraRepo);
|
|
|
|
expect(stack, "Disasmer public host", /publicHost = "disasmer\.michelpaulissen\.com"/);
|
|
expect(stack, "Disasmer loopback API port", /apiPort = 9080/);
|
|
expect(hypervisor, "nginx Disasmer vhost", /\$\{stack\.hosts\.disasmer\.publicHost\}/);
|
|
expect(hypervisor, "nginx Disasmer site root", /root = \.\.\/\.\.\/disasmer-site/);
|
|
expect(hypervisor, "nginx control API proxy", /locations\."= \/api\/v1\/control"[\s\S]*proxyPass/);
|
|
expect(hypervisor, "nginx hosted callback proxy", /locations\."= \/auth\/callback"[\s\S]*proxyPass/);
|
|
assert.doesNotMatch(hypervisor, /locations\."= \/auth\/browser\/start"/);
|
|
expect(hypervisor, "hosted service uses configured API port", /stack\.hosts\.disasmer\.apiPort/);
|
|
expect(oauth, "Disasmer Authentik provider", /name: disasmer-provider/);
|
|
expect(oauth, "Disasmer public OIDC client", /client_type: public/);
|
|
expect(oauth, "Disasmer client id", /client_id: \${disasmerClientId}/);
|
|
expect(oauth, "Disasmer hosted callback", /https:\/\/disasmer\.michelpaulissen\.com\/auth\/callback/);
|
|
expect(oauth, "Disasmer Authentik application", /slug: disasmer/);
|
|
expect(site, "site describes CLI login", /disasmer login --browser/);
|
|
expect(site, "site describes hosted callback authority", /hosted service processes the callback/);
|
|
expect(site, "site explains attached-node execution", /placed on a node you attach and explicitly authorize/);
|
|
expect(site, "site labels pre-release status", /pre-release deployment under active verification/);
|
|
assert.doesNotMatch(site, /local callback|provider codes and tokens are returned to the CLI/i);
|
|
} else {
|
|
console.warn("Skipping VPS config checks because ../michelpaulissen.com is not present");
|
|
}
|
|
|
|
console.log("Public browser login contract smoke passed");
|