489 lines
14 KiB
TypeScript
489 lines
14 KiB
TypeScript
declare const Deno: {
|
|
test(name: string, fn: () => void | Promise<void>): void;
|
|
};
|
|
|
|
import {
|
|
createRemoteRuntime,
|
|
parseRuntimeRemovalOperationResponse,
|
|
parseRuntimeTrustConflict,
|
|
parseRuntimeTrustKeyRevealResponse,
|
|
parseWorkspaceRuntimeDetail,
|
|
parseWorkspaceRuntimeList,
|
|
previewRuntimePublicKeyFingerprint,
|
|
removeRemoteRuntime,
|
|
revokeRuntimeTrustKey,
|
|
RuntimeRemovalAttempt,
|
|
RuntimeTrustConflictError,
|
|
RuntimeTrustRouteFence,
|
|
updateRemoteRuntime,
|
|
} from "../src/lib/workspace/api/runtime-management.ts";
|
|
|
|
function assert(condition: unknown, message: string): asserts condition {
|
|
if (!condition) throw new Error(message);
|
|
}
|
|
|
|
function assertThrows(operation: () => unknown, expected: string): void {
|
|
try {
|
|
operation();
|
|
} catch (error) {
|
|
const message = error instanceof Error ? error.message : String(error);
|
|
if (message.includes(expected)) return;
|
|
throw new Error(
|
|
`expected error containing ${expected}, received ${message}`,
|
|
);
|
|
}
|
|
throw new Error("expected operation to throw");
|
|
}
|
|
|
|
function runtime() {
|
|
return {
|
|
management: {
|
|
built_in: false,
|
|
config_managed: true,
|
|
removable: false,
|
|
endpoint_configured: true,
|
|
token_ref_configured: false,
|
|
binding: {
|
|
state: "verified",
|
|
connection_state: "verified",
|
|
revision: 3,
|
|
workspace_key_id: "WK-1",
|
|
workspace_key_generation: 1,
|
|
verification: {
|
|
verified_at: "2026-09-01T13:00:00Z",
|
|
last_checked_at: "2026-09-01T13:00:00Z",
|
|
last_outcome: "verified",
|
|
binding_revision: 3,
|
|
workspace_key_id: "WK-1",
|
|
workspace_identity_revision: 1,
|
|
workspace_trust_generation: 1,
|
|
runtime_public_key_fingerprint: "SHA256:current",
|
|
runtime_identity_revision: 1,
|
|
},
|
|
},
|
|
},
|
|
runtime_id: "arcadia",
|
|
label: "Arcadia",
|
|
kind: "remote",
|
|
status: "started",
|
|
source: {
|
|
kind: "remote_http",
|
|
status: "active",
|
|
identity_authority: "server_runtime_configuration",
|
|
note: "Configured by Server authority",
|
|
},
|
|
host_ids: ["host-a"],
|
|
worker_creation_available: true,
|
|
os: "linux",
|
|
arch: "x86_64",
|
|
diagnostics: [],
|
|
};
|
|
}
|
|
|
|
function detail() {
|
|
return {
|
|
workspace_id: "workspace-a",
|
|
runtime: runtime(),
|
|
endpoint: "https://runtime.example.test",
|
|
trust_key: {
|
|
status: "active",
|
|
fingerprint: "SHA256:current",
|
|
revision: 3,
|
|
created_at: "2026-09-01T12:00:00Z",
|
|
updated_at: "2026-09-01T13:00:00Z",
|
|
revoked_at: null,
|
|
},
|
|
recent_audit: [{
|
|
action: "created",
|
|
actor_account_id: "account-a",
|
|
old_fingerprint: null,
|
|
new_fingerprint: "SHA256:current",
|
|
revision: 3,
|
|
at: "2026-09-01T13:00:00Z",
|
|
}],
|
|
};
|
|
}
|
|
|
|
Deno.test("Runtime list and detail parsers return generated Runtime DTO shapes", () => {
|
|
const list = parseWorkspaceRuntimeList({
|
|
workspace_id: "workspace-a",
|
|
limit: 200,
|
|
items: [runtime()],
|
|
source: "workspace-control-plane",
|
|
diagnostics: [],
|
|
});
|
|
assert(
|
|
list.items[0]?.runtime_id === "arcadia",
|
|
"Runtime ID was not preserved",
|
|
);
|
|
|
|
assert(
|
|
list.items[0]?.management.binding?.state === "verified",
|
|
"binding state was not preserved",
|
|
);
|
|
|
|
const parsed = parseWorkspaceRuntimeDetail(detail());
|
|
assert(
|
|
parsed.trust_key.revision === 3,
|
|
"revision was not preserved as a safe integer",
|
|
);
|
|
assert(
|
|
parsed.recent_audit[0]?.revision === 3,
|
|
"audit revision was not normalized",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime list parser accepts the built-in Runtime's internal binding", () => {
|
|
const embedded = runtime();
|
|
embedded.runtime_id = "embedded";
|
|
embedded.label = "Embedded Runtime";
|
|
embedded.kind = "embedded";
|
|
embedded.management.built_in = true;
|
|
embedded.management.endpoint_configured = false;
|
|
const binding = embedded.management.binding as Partial<
|
|
typeof embedded.management.binding
|
|
>;
|
|
delete binding.workspace_key_id;
|
|
delete binding.workspace_key_generation;
|
|
delete binding.verification;
|
|
|
|
const list = parseWorkspaceRuntimeList({
|
|
workspace_id: "workspace-a",
|
|
limit: 200,
|
|
items: [embedded],
|
|
source: "workspace-control-plane",
|
|
diagnostics: [],
|
|
});
|
|
assert(
|
|
list.items[0]?.management.binding?.connection_state === "verified",
|
|
"built-in Runtime binding was not preserved",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime management parser rejects Workspace identity bindings without key metadata", () => {
|
|
const payload = detail();
|
|
const binding = payload.runtime.management.binding as Partial<
|
|
typeof payload.runtime.management.binding
|
|
>;
|
|
delete binding.workspace_key_id;
|
|
delete binding.workspace_key_generation;
|
|
binding.state = "configured";
|
|
assertThrows(
|
|
() => parseWorkspaceRuntimeDetail(payload),
|
|
"requires Workspace signing key identity metadata",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime validators reject unknown object keys and enum variants", () => {
|
|
assertThrows(
|
|
() => parseWorkspaceRuntimeDetail({ ...detail(), head_tree: "stale" }),
|
|
"head_tree is not part",
|
|
);
|
|
|
|
const futureSource = structuredClone(detail());
|
|
futureSource.runtime.source.kind = "future_transport";
|
|
assertThrows(
|
|
() => parseWorkspaceRuntimeDetail(futureSource),
|
|
"contains an unknown enum value",
|
|
);
|
|
|
|
assertThrows(
|
|
() =>
|
|
parseRuntimeTrustConflict({
|
|
error: "future_conflict",
|
|
message: "conflict",
|
|
current_revision: 4,
|
|
current_fingerprint: "SHA256:new",
|
|
}),
|
|
"contains an unknown enum value",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime validators reject unsafe revisions and bounded collection overflow", () => {
|
|
const unsafeRevision = structuredClone(detail());
|
|
unsafeRevision.trust_key.revision = Number.MAX_SAFE_INTEGER + 1;
|
|
assertThrows(
|
|
() => parseWorkspaceRuntimeDetail(unsafeRevision),
|
|
"must be a safe integer",
|
|
);
|
|
|
|
const tooMuchAudit = structuredClone(detail());
|
|
tooMuchAudit.recent_audit = Array.from(
|
|
{ length: 21 },
|
|
() => structuredClone(detail().recent_audit[0]),
|
|
);
|
|
assertThrows(
|
|
() => parseWorkspaceRuntimeDetail(tooMuchAudit),
|
|
"must contain at most 20 items",
|
|
);
|
|
|
|
const tooManyItems = Array.from({ length: 201 }, () => runtime());
|
|
assertThrows(
|
|
() =>
|
|
parseWorkspaceRuntimeList({
|
|
workspace_id: "workspace-a",
|
|
limit: 200,
|
|
items: tooManyItems,
|
|
source: "workspace-control-plane",
|
|
diagnostics: [],
|
|
}),
|
|
"must contain at most 200 items",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime detail rejects unbounded strings and incoherent trust state", () => {
|
|
assertThrows(
|
|
() =>
|
|
parseRuntimeTrustKeyRevealResponse({
|
|
public_key: "x".repeat(16 * 1024 + 1),
|
|
}),
|
|
"must be at most 16384 UTF-8 bytes",
|
|
);
|
|
|
|
const activeWithoutFingerprint = structuredClone(detail()) as Record<
|
|
string,
|
|
unknown
|
|
>;
|
|
(activeWithoutFingerprint.trust_key as Record<string, unknown>).fingerprint =
|
|
null;
|
|
assertThrows(
|
|
() => parseWorkspaceRuntimeDetail(activeWithoutFingerprint),
|
|
"must include fingerprint",
|
|
);
|
|
});
|
|
|
|
Deno.test("mismatched revoke fingerprint never sends a request", async () => {
|
|
let requests = 0;
|
|
const fetchImpl: typeof fetch = () => {
|
|
requests += 1;
|
|
return Promise.reject(new Error("request must not be sent"));
|
|
};
|
|
let rejected = false;
|
|
try {
|
|
await revokeRuntimeTrustKey(
|
|
"workspace-a",
|
|
"runtime-a",
|
|
{ expected_revision: 3 },
|
|
"sha256:current",
|
|
"sha256:different",
|
|
fetchImpl,
|
|
);
|
|
} catch (error) {
|
|
rejected = error instanceof Error &&
|
|
error.message.includes("current fingerprint exactly");
|
|
}
|
|
assert(rejected, "mismatched fingerprint should be rejected locally");
|
|
assert(requests === 0, "mismatched fingerprint sent a revoke request");
|
|
});
|
|
|
|
Deno.test("Runtime metadata update never sends public key authority", async () => {
|
|
let requestedUrl = "";
|
|
let requestedMethod = "";
|
|
let requestedBody: unknown = null;
|
|
const fetchImpl = ((input: string | URL | Request, init?: RequestInit) => {
|
|
requestedUrl = String(input);
|
|
requestedMethod = init?.method ?? "GET";
|
|
requestedBody = JSON.parse(String(init?.body));
|
|
return Promise.resolve(Response.json(detail()));
|
|
}) as typeof fetch;
|
|
|
|
await updateRemoteRuntime(
|
|
"workspace-a",
|
|
"arcadia",
|
|
{
|
|
display_name: "Updated Runtime",
|
|
endpoint: "https://runtime.example.test/v2",
|
|
},
|
|
fetchImpl,
|
|
);
|
|
|
|
assert(
|
|
requestedUrl === "/api/w/workspace-a/runtimes/arcadia",
|
|
`unexpected update URL: ${requestedUrl}`,
|
|
);
|
|
assert(requestedMethod === "POST", "Runtime update must use POST");
|
|
assert(
|
|
JSON.stringify(requestedBody) ===
|
|
JSON.stringify({
|
|
display_name: "Updated Runtime",
|
|
endpoint: "https://runtime.example.test/v2",
|
|
}),
|
|
`unexpected update body: ${JSON.stringify(requestedBody)}`,
|
|
);
|
|
const body = requestedBody as Record<string, unknown>;
|
|
assert(!("public_bundle" in body), "metadata update sent public_bundle");
|
|
assert(!("public_key" in body), "metadata update sent public_key");
|
|
});
|
|
|
|
Deno.test("Runtime removal attempt retains its id across response-loss retry", async () => {
|
|
const attempt = new RuntimeRemovalAttempt();
|
|
const operationIds: string[] = [];
|
|
let calls = 0;
|
|
const submit = async () => {
|
|
const operationId = attempt.operationId(() => "stable-removal-operation");
|
|
operationIds.push(operationId);
|
|
const operation = await removeRemoteRuntime(
|
|
"workspace-a",
|
|
"runtime-a",
|
|
{ operation_id: operationId, expected_binding_revision: 4 },
|
|
() => {
|
|
calls += 1;
|
|
if (calls === 1) return Promise.reject(new Error("response lost"));
|
|
return Promise.resolve(Response.json({
|
|
operation_id: operationId,
|
|
workspace_id: "workspace-a",
|
|
runtime_id: "runtime-a",
|
|
state: "succeeded",
|
|
binding_removed: true,
|
|
runtime_registration_removed: true,
|
|
created_at: "2026-01-01T00:00:00Z",
|
|
updated_at: "2026-01-01T00:00:01Z",
|
|
completed_at: "2026-01-01T00:00:01Z",
|
|
}));
|
|
},
|
|
);
|
|
attempt.complete(operation.operation_id);
|
|
};
|
|
|
|
try {
|
|
await submit();
|
|
throw new Error("expected response-loss retry to fail");
|
|
} catch (error) {
|
|
assert(
|
|
error instanceof Error && error.message.includes("response lost"),
|
|
`unexpected response-loss error: ${String(error)}`,
|
|
);
|
|
}
|
|
await submit();
|
|
assert(
|
|
operationIds.length === 2 &&
|
|
operationIds.every((id) => id === "stable-removal-operation"),
|
|
`response-loss retry changed operation id: ${operationIds.join(",")}`,
|
|
);
|
|
assert(
|
|
attempt.operationId(() => "next-removal-operation") ===
|
|
"next-removal-operation",
|
|
"authoritative success did not clear the completed operation id",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime removal uses the Workspace-scoped operation route", async () => {
|
|
let requestedUrl = "";
|
|
let requestedMethod = "";
|
|
let requestedBody: unknown = null;
|
|
const fetchImpl = ((input: string | URL | Request, init?: RequestInit) => {
|
|
requestedUrl = String(input);
|
|
requestedMethod = init?.method ?? "GET";
|
|
requestedBody = JSON.parse(String(init?.body));
|
|
return Promise.resolve(Response.json({
|
|
operation_id: "remove-runtime-a",
|
|
workspace_id: "workspace a",
|
|
runtime_id: "runtime/a",
|
|
state: "succeeded",
|
|
binding_removed: true,
|
|
runtime_registration_removed: true,
|
|
created_at: "2026-01-01T00:00:00Z",
|
|
updated_at: "2026-01-01T00:00:01Z",
|
|
completed_at: "2026-01-01T00:00:01Z",
|
|
}));
|
|
}) as typeof fetch;
|
|
|
|
const operation = await removeRemoteRuntime(
|
|
"workspace a",
|
|
"runtime/a",
|
|
{ operation_id: "remove-runtime-a", expected_binding_revision: 7 },
|
|
fetchImpl,
|
|
);
|
|
|
|
assert(
|
|
requestedUrl === "/api/w/workspace%20a/runtimes/runtime%2Fa",
|
|
`unexpected removal URL: ${requestedUrl}`,
|
|
);
|
|
assert(requestedMethod === "DELETE", "Runtime removal must use DELETE");
|
|
assert(
|
|
JSON.stringify(requestedBody) === JSON.stringify({
|
|
operation_id: "remove-runtime-a",
|
|
expected_binding_revision: 7,
|
|
}),
|
|
"Runtime removal request body drifted",
|
|
);
|
|
assert(operation.state === "succeeded", "Runtime removal did not complete");
|
|
|
|
assertThrows(
|
|
() =>
|
|
parseRuntimeRemovalOperationResponse({
|
|
...operation,
|
|
unknown: "rejected",
|
|
}),
|
|
"not part of the wire contract",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime route fence rejects a delayed reveal from the prior Runtime", async () => {
|
|
const fence = new RuntimeTrustRouteFence();
|
|
fence.enter("runtime-a");
|
|
const operation = fence.capture("runtime-a");
|
|
let renderedKey: string | null = null;
|
|
let resolveReveal!: (key: string) => void;
|
|
const delayedReveal = new Promise<string>((resolve) => {
|
|
resolveReveal = resolve;
|
|
}).then((key) => {
|
|
if (fence.isCurrent(operation, "runtime-b")) renderedKey = key;
|
|
});
|
|
|
|
fence.enter("runtime-b");
|
|
resolveReveal("runtime-a-public-key");
|
|
await delayedReveal;
|
|
assert(
|
|
renderedKey === null,
|
|
"Runtime A key rendered after navigating to Runtime B",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime public key preview matches the Server fingerprint contract", async () => {
|
|
const fingerprint = await previewRuntimePublicKeyFingerprint(
|
|
"yoi-ed25519-pub:v1:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
|
|
);
|
|
assert(
|
|
fingerprint ===
|
|
"sha256:66687aadf862bd776c8fc18b8e9f8e20089714856ee233b3902a591d0d5f2925",
|
|
"fingerprint preview drifted from the Server SHA-256 contract",
|
|
);
|
|
});
|
|
|
|
Deno.test("Runtime create surfaces bounded Settings error details", async () => {
|
|
const fetchImpl = (() =>
|
|
Promise.resolve(
|
|
new Response(
|
|
JSON.stringify({
|
|
error: "remote_runtime_endpoint_not_allowed",
|
|
details: "Runtime endpoint must use public https egress",
|
|
}),
|
|
{ status: 400, headers: { "content-type": "application/json" } },
|
|
),
|
|
)) as typeof fetch;
|
|
|
|
try {
|
|
await createRemoteRuntime(
|
|
"workspace-a",
|
|
{
|
|
public_bundle: {
|
|
identity_id: "runtime-a",
|
|
public_key: "yoi-ed25519-pub:v1:test",
|
|
},
|
|
display_name: null,
|
|
endpoint: "https://runtime.example",
|
|
expected_revision: null,
|
|
},
|
|
fetchImpl,
|
|
);
|
|
throw new Error("expected create to reject");
|
|
} catch (error) {
|
|
const message = error instanceof Error ? error.message : String(error);
|
|
assert(
|
|
message === "Runtime endpoint must use public https egress",
|
|
`unexpected create error: ${message}`,
|
|
);
|
|
}
|
|
});
|