93 lines
6.9 KiB
JavaScript
93 lines
6.9 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { createHash } from 'node:crypto';
|
|
import fs from 'node:fs/promises';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { spawnSync } from 'node:child_process';
|
|
import test from 'node:test';
|
|
import { prepareResourcePlan, serializeResourcePlan } from './deploy-portal-resources.mjs';
|
|
|
|
const digest = (value) => createHash('sha256').update(value).digest('hex');
|
|
const sha = 'a'.repeat(40);
|
|
const scriptSource = path.join(path.dirname(fileURLToPath(import.meta.url)), 'portal-resource-install.sh');
|
|
|
|
async function fixture(prefix = 'aia-resource-plan-') {
|
|
const root = await fs.mkdtemp(path.join(os.tmpdir(), prefix));
|
|
const privateRoot = path.join(root, 'private');
|
|
const hubfs = path.join(privateRoot, 'hubfs');
|
|
const stage = path.join(root, 'staging', `portal-resources-${sha}`);
|
|
await fs.mkdir(hubfs, { recursive: true });
|
|
await fs.mkdir(path.join(root, 'secure-resources', 'staff'), { recursive: true });
|
|
await fs.mkdir(path.join(root, 'secure-resources', 'management'), { recursive: true });
|
|
return { root, privateRoot, hubfs, stage };
|
|
}
|
|
|
|
async function writeApprovedResource(privateRoot, hubfs, bytes = Buffer.from('synthetic non-phi document')) {
|
|
const localFile = 'a'.repeat(64);
|
|
await fs.writeFile(path.join(hubfs, localFile), bytes, { mode: 0o600 });
|
|
await fs.writeFile(path.join(privateRoot, 'manifest.json'), JSON.stringify({ resources: [{
|
|
classification: 'STAFF-INTERNAL', deliveryPath: '/staff-resources/guide.pdf', mappingApproved: true, accessPolicyApproved: true, rewriteApproved: true, destinationInstalled: false, destinationHashVerified: false, destinationPermissionsVerified: false, destinationAccessVerified: false, localFile, sha256: digest(bytes), size: bytes.length,
|
|
}] }));
|
|
return { localFile, bytes };
|
|
}
|
|
|
|
test('resource plan copies only hash-verified approved protected resources', async () => {
|
|
const { root, privateRoot, hubfs, stage } = await fixture();
|
|
try {
|
|
const { localFile, bytes } = await writeApprovedResource(privateRoot, hubfs);
|
|
const plan = await prepareResourcePlan(privateRoot, stage, sha);
|
|
assert.equal(plan.files.length, 1);
|
|
assert.equal((await fs.readFile(path.join(stage, 'staff', localFile))).toString(), bytes.toString());
|
|
assert.match(serializeResourcePlan(plan), /^AIA_PORTAL_RESOURCE_PLAN_V1\nsourceCommit=a{40}\nfile\tstaff\tguide\.pdf\t/);
|
|
await fs.writeFile(path.join(privateRoot, 'manifest.json'), JSON.stringify({ resources: [{ classification: 'STAFF-INTERNAL', deliveryPath: '/staff-resources/../bad', mappingApproved: true, accessPolicyApproved: true, rewriteApproved: true, localFile, sha256: digest(bytes), size: bytes.length }] }));
|
|
await assert.rejects(prepareResourcePlan(privateRoot, path.join(root, 'second'), sha), /approved for installation/);
|
|
} finally { await fs.rm(root, { recursive: true, force: true }); }
|
|
});
|
|
|
|
test('one verified source may be installed into both protected role namespaces', async () => {
|
|
const { root, privateRoot, hubfs, stage } = await fixture();
|
|
try {
|
|
const localFile = 'b'.repeat(64), bytes = Buffer.from('synthetic shared non-phi document');
|
|
await fs.writeFile(path.join(hubfs, localFile), bytes, { mode: 0o600 });
|
|
const mapping = (role) => ({ role, classification: role === 'staff' ? 'STAFF-INTERNAL' : 'MANAGEMENT-INTERNAL', deliveryPath: `/${role}-resources/shared.pdf`, mappingApproved: true, accessPolicyApproved: true, rewriteApproved: true, destinationInstalled: false, destinationHashVerified: false, destinationPermissionsVerified: false, destinationAccessVerified: false });
|
|
await fs.writeFile(path.join(privateRoot, 'manifest.json'), JSON.stringify({ resources: [{ classification: 'UNRESOLVED', installMappings: [mapping('staff'), mapping('management')], localFile, sha256: digest(bytes), size: bytes.length }] }));
|
|
const plan = await prepareResourcePlan(privateRoot, stage, sha);
|
|
assert.deepEqual(plan.files.map(({ role }) => role), ['management', 'staff']);
|
|
assert.equal((await fs.readFile(path.join(stage, 'staff', localFile))).toString(), bytes.toString());
|
|
assert.equal((await fs.readFile(path.join(stage, 'management', localFile))).toString(), bytes.toString());
|
|
} finally { await fs.rm(root, { recursive: true, force: true }); }
|
|
});
|
|
|
|
test('portable shell installer executes the reviewed staged-plan interface with synthetic files', async () => {
|
|
const { root, privateRoot, hubfs, stage } = await fixture('aia-portal-install-');
|
|
try {
|
|
const { bytes } = await writeApprovedResource(privateRoot, hubfs);
|
|
const plan = await prepareResourcePlan(privateRoot, stage, sha);
|
|
await fs.mkdir(path.join(stage, 'management'), { recursive: true });
|
|
const planFile = path.join(root, 'approved-plan.tsv');
|
|
await fs.writeFile(planFile, serializeResourcePlan(plan), { mode: 0o600 });
|
|
const fakeBin = path.join(root, 'fake-bin');
|
|
const log = path.join(root, 'ownership.log');
|
|
await fs.mkdir(fakeBin);
|
|
await fs.writeFile(path.join(fakeBin, 'id'), '#!/bin/sh\n[ "$1" = -u ] && { echo 0; exit 0; }\nexec /usr/bin/id "$@"\n', { mode: 0o755 });
|
|
await fs.writeFile(path.join(fakeBin, 'getent'), '#!/bin/sh\n[ "$1" = group ] && [ "$2" = nginx ] && { echo "nginx:x:999:"; exit 0; }\nexec /run/current-system/sw/bin/getent "$@"\n', { mode: 0o755 });
|
|
await fs.writeFile(path.join(fakeBin, 'install'), `#!/bin/sh\nprintf '%s\\n' "$*" >> ${JSON.stringify(log)}\nwhile [ "$#" -gt 0 ]; do\n case "$1" in -o|-g|-m) shift 2 ;; *) break ;; esac\ndone\nexec /usr/bin/install -m 0640 "$@"\n`, { mode: 0o755 });
|
|
const script = path.join(root, 'portal-resource-install.sh');
|
|
const source = await fs.readFile(scriptSource, 'utf8');
|
|
assert.ok(!source.includes('node '));
|
|
await fs.writeFile(script, source.replace('ROOT=/srv/www/azinstitute4autism.com', `ROOT=${root}`), { mode: 0o755 });
|
|
const result = spawnSync('/bin/sh', [script, stage, planFile], { encoding: 'utf8', env: { ...process.env, PATH: process.env.PATH, AIA_PORTAL_INSTALL_TEST_PATH: fakeBin } });
|
|
assert.equal(result.status, 0, result.stderr);
|
|
assert.equal((await fs.readFile(path.join(root, 'secure-resources/staff/guide.pdf'))).toString(), bytes.toString());
|
|
assert.match(await fs.readFile(log, 'utf8'), /-o root -g nginx -m 0640/);
|
|
const nonRoot = spawnSync('/bin/sh', [script, stage, planFile], { encoding: 'utf8', env: { ...process.env, PATH: process.env.PATH } });
|
|
assert.notEqual(nonRoot.status, 0);
|
|
assert.match(nonRoot.stderr, /requires root/);
|
|
await fs.writeFile(path.join(stage, 'staff', 'unexpected.pdf'), 'unexpected');
|
|
const rejected = spawnSync('/bin/sh', [script, stage, planFile], { encoding: 'utf8', env: { ...process.env, PATH: process.env.PATH, AIA_PORTAL_INSTALL_TEST_PATH: fakeBin } });
|
|
assert.notEqual(rejected.status, 0);
|
|
assert.match(rejected.stderr, /Unexpected staged resource/);
|
|
} finally { await fs.rm(root, { recursive: true, force: true }); }
|
|
});
|