jkooe
f4c605cc6d
单元测试（新增，node:test 零依赖）： - tests/unit/: ulid / hmac / ed25519 / acl / validate 共 26 项用例 - 覆盖最关键的安全函数：签名验签、ACL 授权、参数校验 - 新增 pnpm test:unit；CI 增加单元测试步骤 细节修复： 1. screen.info 的 scale 硬编码为 1 → 改读注册表 HKCU AppliedDPI， 真实反映 Windows DPI 缩放（100% -> 1.0, 150% -> 1.5） 2. verify.mjs 升级：支持多设备配置（resolveTarget）+ ed25519 模式 + Hub 中转 （此前直接用旧的扁平配置 + 仅 psk，配了多设备会取不到 host） 验证：构建 + 类型检查全绿；单元 26/26；E2E 21/21；verify.mjs 13/0/3
59 lines
2.2 KiB
JavaScript
59 lines
2.2 KiB
JavaScript
import { test } from 'node:test';
|
||
import assert from 'node:assert/strict';
|
||
import { authorize, matchPattern, authorizedCapabilities } from '../../packages/protocol/dist/index.js';
|
||
|
||
const policy = {
|
||
default_effect: 'deny',
|
||
clients: [
|
||
{ client_id: 'alice', pubkey: 'x', allow: ['system.*', 'screen.*'], deny: ['input.*'] },
|
||
{ client_id: 'bob', pubkey: 'y', allow: ['*'] },
|
||
{ client_id: 'carol', pubkey: 'z', allow: [] },
|
||
],
|
||
};
|
||
|
||
test('acl：deny 优先于 allow', () => {
|
||
const r = authorize(policy, 'alice', 'input.mouse.move');
|
||
assert.equal(r.allowed, false);
|
||
assert.equal(r.matched, 'deny');
|
||
});
|
||
|
||
test('acl：allow 命中即放行', () => {
|
||
const r = authorize(policy, 'alice', 'system.info');
|
||
assert.equal(r.allowed, true);
|
||
assert.equal(r.matched, 'allow');
|
||
});
|
||
|
||
test('acl：未命中规则按默认策略（deny）', () => {
|
||
const r = authorize(policy, 'alice', 'fs.read');
|
||
assert.equal(r.allowed, false);
|
||
assert.equal(r.matched, 'default');
|
||
});
|
||
|
||
test('acl：未注册调用方按默认策略', () => {
|
||
assert.equal(authorize(policy, 'ghost', 'system.info').allowed, false);
|
||
});
|
||
|
||
test('acl：allow:["*"] 全量放行', () => {
|
||
assert.equal(authorize(policy, 'bob', 'fs.write').allowed, true);
|
||
assert.equal(authorize(policy, 'bob', 'input.key.press').allowed, true);
|
||
});
|
||
|
||
test('acl：allow:[] 空列表则全拒', () => {
|
||
assert.equal(authorize(policy, 'carol', 'system.info').allowed, false);
|
||
});
|
||
|
||
test('matchPattern：精确 / 通配 / 全匹配 / 不匹配', () => {
|
||
assert.equal(matchPattern('system.info', 'system.info'), true);
|
||
assert.equal(matchPattern('system.*', 'system.info'), true);
|
||
assert.equal(matchPattern('system.*', 'system.process.list'), true);
|
||
assert.equal(matchPattern('*', 'anything'), true);
|
||
assert.equal(matchPattern('system.*', 'fs.read'), false);
|
||
assert.equal(matchPattern('system.info', 'system.status'), false);
|
||
});
|
||
|
||
test('authorizedCapabilities：只返回被授权的子集', () => {
|
||
const all = ['system.info', 'system.status', 'fs.read', 'input.mouse.move', 'screen.capture'];
|
||
const ok = authorizedCapabilities(policy, 'alice', all);
|
||
assert.deepEqual(ok, ['system.info', 'system.status', 'screen.capture'], '应只含 allow 且未被 deny 的项');
|
||
});
|