b23e4e5bff
Source commit: f70e47af061d8f7ba27cd769c8cd2e2f8707dc72 Public tree identity: sha256:03a43db60d295811688bedaa5ad6460df0dbde27fbf37033997f4d8100f83ab2
120 lines
3.5 KiB
JavaScript
Executable file
120 lines
3.5 KiB
JavaScript
Executable file
#!/usr/bin/env node
|
|
|
|
const assert = require("assert");
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
|
|
const repo = path.resolve(__dirname, "..");
|
|
|
|
function read(file) {
|
|
return fs.readFileSync(path.join(repo, file), "utf8");
|
|
}
|
|
|
|
function extractBalancedBlock(source, marker) {
|
|
const start = source.indexOf(marker);
|
|
assert(start >= 0, `missing marker ${marker}`);
|
|
const open = source.indexOf("{", start);
|
|
assert(open >= 0, `missing opening brace for ${marker}`);
|
|
let depth = 0;
|
|
for (let index = open; index < source.length; index += 1) {
|
|
const char = source[index];
|
|
if (char === "{") depth += 1;
|
|
if (char === "}") {
|
|
depth -= 1;
|
|
if (depth === 0) return source.slice(start, index + 1);
|
|
}
|
|
}
|
|
throw new Error(`missing closing brace for ${marker}`);
|
|
}
|
|
|
|
function extractEnumVariant(source, variant) {
|
|
const marker = ` ${variant} {`;
|
|
return extractBalancedBlock(source, marker);
|
|
}
|
|
|
|
const forbiddenUserSessionCredentials =
|
|
/\b(BrowserSession|CliDeviceSession|BrowserLoginFlow|CliLoginFlow|authorization_url|verification_url|device_code|access_token|refresh_token|provider_token|provider_tokens|session_token|user_token|oauth_token)\b/i;
|
|
|
|
function assertNoUserSessionCredential(surface, text) {
|
|
assert.doesNotMatch(
|
|
text,
|
|
forbiddenUserSessionCredentials,
|
|
`${surface} must not carry user OAuth/browser/session credentials`
|
|
);
|
|
}
|
|
|
|
const coordinatorService = `${read("crates/clusterflux-coordinator/src/service/protocol.rs")}\n${read("crates/clusterflux-coordinator/src/service/protocol/responses.rs")}`;
|
|
for (const variant of [
|
|
"AdminStatus",
|
|
"SuspendTenant",
|
|
"AttachNode",
|
|
"RegisterAgentPublicKey",
|
|
"ListAgentPublicKeys",
|
|
"RotateAgentPublicKey",
|
|
"RevokeAgentPublicKey",
|
|
"NodeHeartbeat",
|
|
"ReportNodeCapabilities",
|
|
"RevokeNodeCredential",
|
|
"RequestRendezvous",
|
|
"RequestSourcePreparation",
|
|
"CompleteSourcePreparation",
|
|
"StartProcess",
|
|
"ReconnectNode",
|
|
"CancelTask",
|
|
"CancelProcess",
|
|
"PollTaskControl",
|
|
"RestartTask",
|
|
"DebugAttach",
|
|
"TaskCompleted",
|
|
]) {
|
|
assertNoUserSessionCredential(
|
|
`CoordinatorRequest::${variant}`,
|
|
extractEnumVariant(coordinatorService, variant)
|
|
);
|
|
}
|
|
|
|
const nodeRuntime = [
|
|
read("crates/clusterflux-node/src/lib.rs"),
|
|
read("crates/clusterflux-node/src/command_runner.rs"),
|
|
].join("\n");
|
|
for (const marker of [
|
|
"pub struct LinuxCommandRunPlan",
|
|
"pub struct LinuxCommandTaskOutput",
|
|
"pub struct CapturedCommandLogs",
|
|
"pub struct VirtualThreadCommand",
|
|
"pub struct CommandOutput",
|
|
]) {
|
|
assertNoUserSessionCredential(marker, extractBalancedBlock(nodeRuntime, marker));
|
|
}
|
|
|
|
const coreExecution = read("crates/clusterflux-core/src/execution.rs");
|
|
assertNoUserSessionCredential(
|
|
"CommandInvocation",
|
|
extractBalancedBlock(coreExecution, "pub struct CommandInvocation")
|
|
);
|
|
|
|
const dapAdapter = read("crates/clusterflux-dap/src/variables.rs");
|
|
assertNoUserSessionCredential(
|
|
"DAP variables response",
|
|
extractBalancedBlock(dapAdapter, "fn variables_response")
|
|
);
|
|
|
|
const panel = read("crates/clusterflux-core/src/operator_panel.rs");
|
|
assertNoUserSessionCredential(
|
|
"PanelEvent",
|
|
extractBalancedBlock(panel, "pub struct PanelEvent")
|
|
);
|
|
|
|
const auth = read("crates/clusterflux-core/src/auth.rs");
|
|
assert.match(
|
|
auth,
|
|
/task_credentials_do_not_contain_user_session/,
|
|
"core auth must keep the task credential user-session guard"
|
|
);
|
|
assert.match(
|
|
auth,
|
|
/CredentialKind::BrowserSession \| CredentialKind::CliDeviceSession/,
|
|
"task credential guard must reject browser and CLI sessions"
|
|
);
|
|
|
|
console.log("User session token boundary smoke passed");
|