f22d0a5791
Source commit: 309831e1e021f962c118452336776fd9a94025f9 Public tree identity: sha256:6fa95c1745579bd6256dbeb3d476db0b07c2f24aa9213b0f7783ce1adfc8aca5
107 lines
3.1 KiB
JavaScript
Executable file
107 lines
3.1 KiB
JavaScript
Executable file
#!/usr/bin/env node
|
|
|
|
const assert = require("assert");
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
|
|
const repo = path.resolve(__dirname, "..");
|
|
|
|
function read(file) {
|
|
return fs.readFileSync(path.join(repo, file), "utf8");
|
|
}
|
|
|
|
function extractBalancedBlock(source, marker) {
|
|
const start = source.indexOf(marker);
|
|
assert(start >= 0, `missing marker ${marker}`);
|
|
const open = source.indexOf("{", start);
|
|
assert(open >= 0, `missing opening brace for ${marker}`);
|
|
let depth = 0;
|
|
for (let index = open; index < source.length; index += 1) {
|
|
const char = source[index];
|
|
if (char === "{") depth += 1;
|
|
if (char === "}") {
|
|
depth -= 1;
|
|
if (depth === 0) return source.slice(start, index + 1);
|
|
}
|
|
}
|
|
throw new Error(`missing closing brace for ${marker}`);
|
|
}
|
|
|
|
function extractEnumVariant(source, variant) {
|
|
const marker = ` ${variant} {`;
|
|
return extractBalancedBlock(source, marker);
|
|
}
|
|
|
|
const forbiddenUserSessionCredentials =
|
|
/\b(BrowserSession|CliDeviceSession|BrowserLoginFlow|CliLoginFlow|authorization_url|verification_url|device_code|access_token|refresh_token|provider_token|provider_tokens|session_token|user_token|oauth_token)\b/i;
|
|
|
|
function assertNoUserSessionCredential(surface, text) {
|
|
assert.doesNotMatch(
|
|
text,
|
|
forbiddenUserSessionCredentials,
|
|
`${surface} must not carry user OAuth/browser/session credentials`
|
|
);
|
|
}
|
|
|
|
const coordinatorService = read("crates/disasmer-coordinator/src/service.rs");
|
|
for (const variant of [
|
|
"AttachNode",
|
|
"NodeHeartbeat",
|
|
"ReportNodeCapabilities",
|
|
"RequestRendezvous",
|
|
"RequestSourcePreparation",
|
|
"CompleteSourcePreparation",
|
|
"StartProcess",
|
|
"ReconnectNode",
|
|
"CancelTask",
|
|
"PollTaskControl",
|
|
"TaskCompleted",
|
|
]) {
|
|
assertNoUserSessionCredential(
|
|
`CoordinatorRequest::${variant}`,
|
|
extractEnumVariant(coordinatorService, variant)
|
|
);
|
|
}
|
|
|
|
const nodeRuntime = read("crates/disasmer-node/src/lib.rs");
|
|
for (const marker of [
|
|
"pub struct LinuxCommandRunPlan",
|
|
"pub struct LinuxCommandTaskOutput",
|
|
"pub struct CapturedCommandLogs",
|
|
"pub struct VirtualThreadCommand",
|
|
"pub struct CommandOutput",
|
|
]) {
|
|
assertNoUserSessionCredential(marker, extractBalancedBlock(nodeRuntime, marker));
|
|
}
|
|
|
|
const coreExecution = read("crates/disasmer-core/src/execution.rs");
|
|
assertNoUserSessionCredential(
|
|
"CommandInvocation",
|
|
extractBalancedBlock(coreExecution, "pub struct CommandInvocation")
|
|
);
|
|
|
|
const dapAdapter = read("crates/disasmer-dap/src/main.rs");
|
|
assertNoUserSessionCredential(
|
|
"DAP variables response",
|
|
extractBalancedBlock(dapAdapter, "fn variables_response")
|
|
);
|
|
|
|
const panel = read("crates/disasmer-core/src/operator_panel.rs");
|
|
assertNoUserSessionCredential(
|
|
"PanelEvent",
|
|
extractBalancedBlock(panel, "pub struct PanelEvent")
|
|
);
|
|
|
|
const auth = read("crates/disasmer-core/src/auth.rs");
|
|
assert.match(
|
|
auth,
|
|
/task_credentials_do_not_contain_user_session/,
|
|
"core auth must keep the task credential user-session guard"
|
|
);
|
|
assert.match(
|
|
auth,
|
|
/CredentialKind::BrowserSession \| CredentialKind::CliDeviceSession/,
|
|
"task credential guard must reject browser and CLI sessions"
|
|
);
|
|
|
|
console.log("User session token boundary smoke passed");
|