89 lines
4.7 KiB
TypeScript
89 lines
4.7 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import { test } from "node:test";
|
|
import { mkdtemp, mkdir, writeFile, symlink, rm } from "node:fs/promises";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createHash } from "node:crypto";
|
|
import {
|
|
compileExecutionPlan,
|
|
artifactFileReader,
|
|
loadArtifactWorld,
|
|
BrowserArtifactGateway,
|
|
implementationDigest,
|
|
} from "../src/execution-world/index.js";
|
|
import { loadReaderWorkspace } from "./reader-fixture.js";
|
|
import { buildArtifactFixture } from "./artifact-fixture.js";
|
|
|
|
test("immutable-output loading rejects traversal, links, and files larger than the declared bound", async () => {
|
|
const root = await mkdtemp(path.join(os.tmpdir(), "camino-artifact-read-"));
|
|
try {
|
|
await mkdir(path.join(root, "output"));
|
|
await writeFile(path.join(root, "outside"), "secret");
|
|
await writeFile(path.join(root, "output", "file"), "data");
|
|
await symlink(path.join(root, "outside"), path.join(root, "output", "linked-file"));
|
|
await symlink(root, path.join(root, "output", "linked-dir"));
|
|
const read = await artifactFileReader({ package: path.join(root, "output") });
|
|
assert.equal(new TextDecoder().decode(await read("package", "file", 4)), "data");
|
|
await assert.rejects(read("package", "file", 3), /exceeds its declared bound/);
|
|
await assert.rejects(read("package", "linked-file", 100), /Only real directories/);
|
|
await assert.rejects(read("package", "linked-dir/outside", 100), /Only real directories/);
|
|
await assert.rejects(read("package", "../outside", 100), /normalized relative/);
|
|
await assert.rejects(read("unknown", "file", 100), /Unknown package output/);
|
|
await assert.rejects(read("package", "file", Infinity), /Invalid file byte limit/);
|
|
await assert.rejects(
|
|
artifactFileReader({ package: path.join(root, "output", "linked-dir") }),
|
|
/canonical absolute/,
|
|
);
|
|
} finally {
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
test("gateway serves only declared browser assets with correct Wasm MIME and content identity", async () => {
|
|
const root = await mkdtemp(path.join(os.tmpdir(), "camino-artifact-world-"));
|
|
try {
|
|
const plan = compileExecutionPlan(await loadReaderWorkspace()),
|
|
fixture = buildArtifactFixture(plan);
|
|
const wasm = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0]);
|
|
const browser = fixture.manifest.implementations.find((i) => i.target === "browser")!;
|
|
browser.files.push({
|
|
path: "portable/browser/assets/café.wasm",
|
|
bytes: wasm.length,
|
|
digest: createHash("sha256").update(wasm).digest("hex"),
|
|
mediaType: "application/wasm",
|
|
});
|
|
const { contentDigest, ...body } = browser;
|
|
browser.contentDigest = implementationDigest(body);
|
|
for (const implementation of fixture.manifest.implementations)
|
|
for (const file of implementation.files) {
|
|
const target = path.join(root, file.path);
|
|
await mkdir(path.dirname(target), { recursive: true });
|
|
await writeFile(target, file.mediaType === "application/wasm" ? wasm : fixture.bytes);
|
|
}
|
|
await mkdir(path.join(root, "share/quixos"), { recursive: true });
|
|
await writeFile(path.join(root, "share/quixos/package-artifacts.json"), JSON.stringify(fixture.manifest));
|
|
const loaded = await loadArtifactWorld(plan, { [fixture.manifest.packageRevisionId]: root });
|
|
const gateway = new BrowserArtifactGateway(loaded);
|
|
assert.equal(gateway.entries.length, 1);
|
|
const entry = gateway.entries[0]!;
|
|
const response = await gateway.response(entry.url);
|
|
assert.equal(response?.status, 200);
|
|
assert.equal(response?.headers["content-type"], "text/javascript");
|
|
assert.equal(response?.headers["cache-control"], "private, max-age=31536000, immutable");
|
|
assert.deepEqual(response?.body, Buffer.from(fixture.bytes));
|
|
assert.equal((await gateway.response(entry.url, response?.headers.etag))?.status, 304);
|
|
const wasmUrl = entry.url.replace("module.mjs", "assets/caf%C3%A9.wasm");
|
|
const wasmResponse = await gateway.response(wasmUrl);
|
|
assert.equal(wasmResponse?.headers["content-type"], "application/wasm");
|
|
assert.deepEqual(wasmResponse?.body, Buffer.from(wasm));
|
|
assert.equal(await gateway.response(entry.url.replace("portable/browser/module.mjs", "bin/service")), undefined);
|
|
assert.equal(await gateway.response("/nix/store/secret"), undefined);
|
|
assert.equal(await gateway.response(entry.url.replace(loaded.digest, "0".repeat(64))), undefined);
|
|
await writeFile(path.join(root, browser.path), "x".repeat(fixture.bytes.length));
|
|
await assert.rejects(gateway.response(entry.url), /changed after world validation/);
|
|
await assert.rejects(loadArtifactWorld(plan, { [fixture.manifest.packageRevisionId]: root }), /Artifact bytes/);
|
|
} finally {
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|