Complete platform management workflows

2026-07-14 16:39:37 +08:00
parent 7e05d0a4e7
commit 4f33f761a3
106 changed files with 11313 additions and 460 deletions
@@ -44,3 +44,81 @@ func TestValidateRunJobAssignmentScopedReadDoesNotRequireInputRef(t *testing.T)
 		t.Fatalf("expected valid file read assignment: %v", err)
 	}
 }
+
+func TestValidateRunJobAssignmentRemoteCapabilitiesAreBounded(t *testing.T) {
+	assignment := RunJobAssignment{
+		JobID:            "job-remote-rcon",
+		ServerInstanceID: "server-1",
+		RunEndpointID:    "run-local",
+		Capability:       RunCapabilityRemoteRunRCONCommand,
+		TargetKey:        "rcon/command",
+		InputRef:         "input://server-1/rcon/command/1",
+		IdempotencyKey:   "idem-rcon",
+	}
+	if err := ValidateRunJobAssignment(assignment); err != nil {
+		t.Fatalf("expected valid remote rcon assignment: %v", err)
+	}
+
+	assignment.InputRef = "password=raw"
+	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "inputRef") {
+		t.Fatalf("expected unsafe inputRef rejection, got %v", err)
+	}
+
+	assignment.InputRef = "input://server-1/rcon/command/1"
+	assignment.TargetKey = "/Users/tasia/server.db"
+	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "targetKey") {
+		t.Fatalf("expected unsafe targetKey rejection, got %v", err)
+	}
+}
+
+func TestValidateRunJobAssignmentDistributionCapabilitiesAreBounded(t *testing.T) {
+	selfUpdate := RunJobAssignment{
+		JobID:            "job-update",
+		ServerInstanceID: "server-1",
+		RunEndpointID:    "run-local",
+		Capability:       RunCapabilityRunSelfUpdate,
+		TargetKey:        "run/update",
+		InputRef:         "artifact://artifact-run-latest",
+		IdempotencyKey:   "idem-update",
+	}
+	if err := ValidateRunJobAssignment(selfUpdate); err != nil {
+		t.Fatalf("expected valid self-update assignment: %v", err)
+	}
+	selfUpdate.InputRef = "input://not-an-artifact"
+	if err := ValidateRunJobAssignment(selfUpdate); err == nil || !strings.Contains(err.Error(), "artifact") {
+		t.Fatalf("expected non-artifact self-update ref rejection, got %v", err)
+	}
+
+	check := RunJobAssignment{
+		JobID:            "job-dependency-check",
+		ServerInstanceID: "server-1",
+		RunEndpointID:    "run-local",
+		Capability:       RunCapabilityDependenciesCheck,
+		TargetKey:        "dependencies/java-21",
+		IdempotencyKey:   "idem-dep-check",
+	}
+	if err := ValidateRunJobAssignment(check); err != nil {
+		t.Fatalf("expected valid dependency check assignment: %v", err)
+	}
+	check.TargetKey = "dependencies/install/java;rm"
+	if err := ValidateRunJobAssignment(check); err == nil || !strings.Contains(err.Error(), "targetKey") {
+		t.Fatalf("expected shell-like dependency target rejection, got %v", err)
+	}
+
+	backfill := RunJobAssignment{
+		JobID:            "job-log-backfill",
+		ServerInstanceID: "server-1",
+		RunEndpointID:    "run-local",
+		Capability:       RunCapabilityLogsBackfill,
+		TargetKey:        "logs/latest-log",
+		InputRef:         "artifact://logs/checkpoint/1",
+		IdempotencyKey:   "idem-log-backfill",
+	}
+	if err := ValidateRunJobAssignment(backfill); err != nil {
+		t.Fatalf("expected valid log backfill assignment: %v", err)
+	}
+	backfill.InputRef = "password=raw"
+	if err := ValidateRunJobAssignment(backfill); err == nil || !strings.Contains(err.Error(), "inputRef") {
+		t.Fatalf("expected unsafe log checkpoint rejection, got %v", err)
+	}
+}