Raven Scott
071edccfb3
posix matrix/dashboard, and syscalls/process_table schema alignment (v8). Booter: replication_operator_sketch/corestore hints, HRPC allowlist tests, Protomux cap channel 65536-byte bound + export, Wasm posix_profile_peek, swarm-disk and security_posture docs. Coreutils/kernel: pkg-swarm-index pathCapabilityEnvelopeVerify on get; pathcap-verify --trusted failure hint; rebuild bins and sync seeder. Docs: KERNEL_CONTRACT, kernel-extensions, capabilities index, environment appendix (warm-cache tuning, cap channel, Wasm env), handbook observability, vault threat model (multisig), developer-guide ctx/HRPC/Wasm, DOCUMENTATION release-checklist note, release-checklist optional tier1 drift. Changelog maintenance in bare-os-booter and bare-os-protocol.
49 lines
1.6 KiB
JavaScript
49 lines
1.6 KiB
JavaScript
import test from 'brittle'
|
|
import {
|
|
parseBareOsHrpcAllowlistJson,
|
|
bareOsHrpcAllowlistDeniesRoute
|
|
} from './lib/bare-os-hrpc-allowlist.js'
|
|
|
|
test('parseBareOsHrpcAllowlistJson array and object forms', (t) => {
|
|
const a = parseBareOsHrpcAllowlistJson('["kernel.ping","vfs.readText"]')
|
|
t.ok(a.allow)
|
|
t.ok(a.allow.has('kernel.ping'))
|
|
t.ok(a.allow.has('vfs.readText'))
|
|
t.absent(a.parseError)
|
|
const o = parseBareOsHrpcAllowlistJson(
|
|
JSON.stringify({ 'kernel.*': true, 'x.y': false })
|
|
)
|
|
t.ok(o.allow)
|
|
t.ok(o.allow.has('kernel.*'))
|
|
t.absent(o.allow.has('x.y'))
|
|
})
|
|
|
|
test('parseBareOsHrpcAllowlistJson malformed JSON', (t) => {
|
|
const r = parseBareOsHrpcAllowlistJson('{')
|
|
t.ok(r.parseError)
|
|
t.absent(r.allow)
|
|
})
|
|
|
|
test('bareOsHrpcAllowlistDeniesRoute wildcard edges', (t) => {
|
|
const s = new Set(['*'])
|
|
t.absent(bareOsHrpcAllowlistDeniesRoute(s, 'any', 'method'))
|
|
const k = new Set(['kernel.*'])
|
|
t.absent(bareOsHrpcAllowlistDeniesRoute(k, 'kernel', 'ping'))
|
|
t.ok(bareOsHrpcAllowlistDeniesRoute(k, 'vfs', 'readText'))
|
|
const exact = new Set(['vfs.readText'])
|
|
t.absent(bareOsHrpcAllowlistDeniesRoute(exact, 'vfs', 'readText'))
|
|
t.ok(bareOsHrpcAllowlistDeniesRoute(exact, 'vfs', 'other'))
|
|
})
|
|
|
|
test('bareOsHrpcAllowlistDeniesRoute bare_os service wildcard', (t) => {
|
|
const s = new Set(['bare_os.*'])
|
|
t.absent(bareOsHrpcAllowlistDeniesRoute(s, 'bare_os', 'pkg_index_get'))
|
|
t.ok(bareOsHrpcAllowlistDeniesRoute(s, 'kernel', 'ping'))
|
|
})
|
|
|
|
test('parseBareOsHrpcAllowlistJson empty array is null allow', (t) => {
|
|
const r = parseBareOsHrpcAllowlistJson('[]')
|
|
t.absent(r.allow)
|
|
t.absent(r.parseError)
|
|
})
|