功能修改

2026-07-20 16:42:33 +08:00
parent 48b8ad8d6c
commit a0e69417db
224 changed files with 22015 additions and 884 deletions
@@ -0,0 +1,69 @@
+package dto
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"browser.local/platform/domain"
+)
+
+func TestClientManagerLifecycleInputProjectsRunOnlyCompanionConfigWithoutRawMaterial(t *testing.T) {
+	response := ClientManagerLifecycleInputFromDomain(domain.ClientManagerLifecycleInput{
+		InstallationID:       "installation-1",
+		ServerInstanceID:     "server-1",
+		ProfileKey:           "scum-client-manager",
+		Operation:            domain.ClientManagerOperationDeploy,
+		DeploymentGeneration: 2,
+		CompanionConfig: &domain.ClientManagerCompanionConfigInput{
+			SchemaVersion:              1,
+			ConfigTemplateKey:          "client-config",
+			ConfigTemplateRef:          "config.yaml.example",
+			ConfigOutputRef:            "config.yaml",
+			ConfigSchemaRef:            "schemas/companion/config.schema.json",
+			ConfigFormat:               "yaml",
+			PlatformBaseURLSource:      "run-control",
+			InstallationID:             "installation-1",
+			ServerInstanceID:           "server-1",
+			PluginID:                   "game.scum",
+			ProfileKey:                 "scum-client-manager",
+			ArtifactID:                 "artifact-1",
+			Version:                    "1.0.0",
+			SourceRevision:             "revision-1",
+			TargetOS:                   "windows",
+			TargetArch:                 "amd64",
+			KeyGeneration:              3,
+			DeploymentGeneration:       2,
+			Capabilities:               []string{"component.register", "component.heartbeat", "component.health", "game-client.bridge"},
+			RegistrationProof:          "hmac-sha256",
+			ProofMaterialSource:        "component-package",
+			ProofMaterialEnv:           "SCUM_COMPONENT_PROOF",
+			SessionMode:                "component-session",
+			TLSPolicy:                  "verify-system-roots",
+			HeartbeatIntervalSeconds:   30,
+			CommandPollIntervalSeconds: 5,
+			RequestTimeoutSeconds:      15,
+		},
+	})
+	if response.CompanionConfig == nil || response.CompanionConfig.ProofMaterialEnv != "SCUM_COMPONENT_PROOF" {
+		t.Fatalf("expected run-only companion projection, got %+v", response.CompanionConfig)
+	}
+	encoded, err := json.Marshal(response)
+	if err != nil {
+		t.Fatalf("marshal lifecycle input: %v", err)
+	}
+	serialized := string(encoded)
+	for _, forbidden := range []string{`"proofMaterial":`, `"authKey":`, `"componentKey":`, `"sessionToken":`, `"secretRef":`, "/Users/", "run.socket"} {
+		if strings.Contains(serialized, forbidden) {
+			t.Fatalf("run lifecycle input leaked %q: %s", forbidden, serialized)
+		}
+	}
+
+	browserProjection, err := json.Marshal(ClientManagerLifecycleViewFromDomain(domain.ClientManagerLifecycleView{Installation: domain.ClientManagerInstallation{ID: "installation-1"}}))
+	if err != nil {
+		t.Fatalf("marshal browser lifecycle projection: %v", err)
+	}
+	if strings.Contains(string(browserProjection), "companionConfig") || strings.Contains(string(browserProjection), "proofMaterialEnv") {
+		t.Fatalf("browser lifecycle projection exposed run-only config: %s", browserProjection)
+	}
+}