功能修改

2026-07-20 16:42:33 +08:00
parent 48b8ad8d6c
commit a0e69417db
224 changed files with 22015 additions and 884 deletions
@@ -154,6 +154,68 @@ func ValidateClientManagerLifecycleInputRequest(value domain.ClientManagerLifecy
 	return finish(violations)
 }

+func ValidateClientManagerCompanionConfigInput(value domain.ClientManagerCompanionConfigInput) error {
+	var violations []string
+	if value.SchemaVersion != domain.ClientManagerCompanionConfigSchemaVersion {
+		violations = append(violations, "schemaVersion is invalid")
+	}
+	for field, content := range map[string]string{
+		"configTemplateKey": value.ConfigTemplateKey, "configTemplateRef": value.ConfigTemplateRef, "configOutputRef": value.ConfigOutputRef,
+		"configSchemaRef": value.ConfigSchemaRef, "installationId": value.InstallationID, "serverInstanceId": value.ServerInstanceID,
+		"pluginId": value.PluginID, "profileKey": value.ProfileKey, "artifactId": value.ArtifactID, "version": value.Version,
+		"sourceRevision": value.SourceRevision, "targetOs": value.TargetOS, "targetArch": value.TargetArch, "proofMaterialEnv": value.ProofMaterialEnv,
+	} {
+		violations = appendRequired(violations, field, content)
+	}
+	if !clientManagerIdentifierPattern.MatchString(value.ConfigTemplateKey) {
+		violations = append(violations, "configTemplateKey is invalid")
+	}
+	violations = append(violations, validateSafeRelativeRuntimePath("configTemplateRef", value.ConfigTemplateRef)...)
+	if value.ConfigOutputRef != "config.yaml" {
+		violations = append(violations, "configOutputRef must be config.yaml")
+	}
+	if !safeRelativeJSONRef(value.ConfigSchemaRef) {
+		violations = append(violations, "configSchemaRef must be a safe relative JSON reference")
+	}
+	if value.ConfigFormat != "yaml" || value.PlatformBaseURLSource != "run-control" || value.RegistrationProof != "hmac-sha256" || value.ProofMaterialSource != "component-package" || value.SessionMode != "component-session" || value.TLSPolicy != "verify-system-roots" {
+		violations = append(violations, "companion bootstrap security policy is invalid")
+	}
+	if !validCompanionProofEnvironment(value.ProofMaterialEnv) {
+		violations = append(violations, "proofMaterialEnv is invalid")
+	}
+	for field, identifier := range map[string]string{"installationId": value.InstallationID, "serverInstanceId": value.ServerInstanceID, "pluginId": value.PluginID, "profileKey": value.ProfileKey, "artifactId": value.ArtifactID} {
+		if !clientManagerIdentifierPattern.MatchString(identifier) {
+			violations = append(violations, field+" is invalid")
+		}
+	}
+	violations = appendDistributionTargetViolations(violations, value.TargetOS, value.TargetArch)
+	if value.KeyGeneration <= 0 || value.DeploymentGeneration <= 0 {
+		violations = append(violations, "keyGeneration and deploymentGeneration must be positive")
+	}
+	if len(value.Capabilities) == 0 || len(value.Capabilities) > 32 {
+		violations = append(violations, "capabilities must be bounded")
+	}
+	capabilities := make(map[string]struct{}, len(value.Capabilities))
+	for _, capability := range value.Capabilities {
+		if !clientManagerIdentifierPattern.MatchString(capability) {
+			violations = append(violations, "capability is invalid")
+		}
+		if _, exists := capabilities[capability]; exists {
+			violations = append(violations, "capabilities must be unique")
+		}
+		capabilities[capability] = struct{}{}
+	}
+	for _, required := range []string{"component.register", "component.heartbeat", "component.health", "game-client.bridge"} {
+		if _, exists := capabilities[required]; !exists {
+			violations = append(violations, "capabilities must include "+required)
+		}
+	}
+	if value.HeartbeatIntervalSeconds < 5 || value.HeartbeatIntervalSeconds > 300 || value.CommandPollIntervalSeconds < 1 || value.CommandPollIntervalSeconds > 60 || value.RequestTimeoutSeconds < 1 || value.RequestTimeoutSeconds > 60 {
+		violations = append(violations, "companion timing policy is invalid")
+	}
+	return finish(violations)
+}
+
 func ValidateClientManagerRegisterRequest(value domain.ClientManagerRegisterRequest) error {
 	var violations []string
 	for field, content := range map[string]string{"installationId": value.InstallationID, "serverInstanceId": value.ServerInstanceID, "profileKey": value.ProfileKey, "artifactId": value.ArtifactID, "version": value.Version, "sourceRevision": value.SourceRevision, "targetOs": value.TargetOS, "targetArch": value.TargetArch, "nonce": value.Nonce, "signature": value.Signature} {