124 lines
4.8 KiB
JavaScript
124 lines
4.8 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { spawnSync } from "node:child_process";
|
|
import { readFile } from "node:fs/promises";
|
|
import { fileURLToPath } from "node:url";
|
|
import test from "node:test";
|
|
|
|
const contractUrl = new URL(
|
|
"../../../deployment/device-edge-core-channel-v1.json",
|
|
import.meta.url,
|
|
);
|
|
const freezeUrl = new URL(
|
|
"../../../deployment/superseded-vps-initiated-transport-v1.json",
|
|
import.meta.url,
|
|
);
|
|
const sourceAcceptanceUrl = new URL(
|
|
"../../../deployment/device-edge-core-channel-source-v1.json",
|
|
import.meta.url,
|
|
);
|
|
const edgeBuilder = fileURLToPath(new URL(
|
|
"../../../../infra/deploy-runner/build-device-edge-vps-artifact.mjs",
|
|
import.meta.url,
|
|
));
|
|
const enrollmentBuilder = fileURLToPath(new URL(
|
|
"../../../../infra/deploy-runner/build-device-plane-backhaul-vps-enrollment-artifact.mjs",
|
|
import.meta.url,
|
|
));
|
|
|
|
async function readJson(url) {
|
|
return JSON.parse(await readFile(url, "utf8"));
|
|
}
|
|
|
|
test("pins a Core-initiated mutually authenticated Edge channel", async () => {
|
|
const contract = await readJson(contractUrl);
|
|
|
|
assert.equal(contract.status, "accepted-design");
|
|
assert.equal(contract.direction, "device-gateway-core-initiated");
|
|
assert.equal(contract.transport.tls, "TLSv1.3-mutual-authentication");
|
|
assert.equal(contract.transport.genericTcpForwarding, "forbidden");
|
|
assert.equal(contract.networkBoundary.synologyPublicIngress, false);
|
|
assert.equal(contract.networkBoundary.vpsInitiatedSynologyConnection, false);
|
|
assert.equal(contract.networkBoundary.subnetRoutes, false);
|
|
assert.equal(contract.networkBoundary.exitNode, false);
|
|
assert.equal(contract.identity.privateKeysInArtifacts, false);
|
|
});
|
|
|
|
test("requires Core acceptance before acknowledging tracker packages", async () => {
|
|
const contract = await readJson(contractUrl);
|
|
|
|
assert.equal(
|
|
contract.acknowledgement.trackerPackageAck,
|
|
"only-after-bounded-core-acceptance",
|
|
);
|
|
assert.equal(
|
|
contract.acknowledgement.coreUnavailable,
|
|
"do-not-acknowledge-tracker-package",
|
|
);
|
|
assert.equal(contract.acknowledgement.deliverySemantics, "at-least-once");
|
|
assert.equal(contract.pilotLimits.durableEdgeSpool, false);
|
|
assert.ok(contract.pilotLimits.maxBufferedBytesPerTrackerSession <= 262144);
|
|
assert.ok(contract.pilotLimits.maxAggregateBufferedBytes <= 33554432);
|
|
assert.equal(contract.pilotSlo.trackerAckBeforeDurableCoreAcceptance, 0);
|
|
assert.equal(contract.pilotSlo.lossOfCoreAcceptedPackages, 0);
|
|
assert.ok(
|
|
contract.pilotSlo.edgeReceiveToCoreAcceptanceP99Milliseconds <= 5000,
|
|
);
|
|
assert.ok(contract.pilotSlo.deadCoreDetectionHardCeilingSeconds <= 45);
|
|
});
|
|
|
|
test("records source acceptance without opening an Edge or tracker port", async () => {
|
|
const acceptance = await readJson(sourceAcceptanceUrl);
|
|
|
|
assert.equal(acceptance.status, "source-accepted");
|
|
assert.equal(acceptance.transport.initiator, "device-gateway-core");
|
|
assert.equal(acceptance.transport.tls, "TLSv1.3-mutual-authentication");
|
|
assert.equal(acceptance.identity.privateKeysInSource, false);
|
|
assert.equal(acceptance.identity.privateKeysInArtifact, false);
|
|
assert.equal(
|
|
acceptance.identity.rotation,
|
|
"one-active-plus-one-staged-generation",
|
|
);
|
|
assert.equal(acceptance.identity.retiredFingerprint, "reject");
|
|
assert.equal(acceptance.runtime.mutationInThisTransition, false);
|
|
assert.equal(acceptance.runtime.edgePort8443Published, false);
|
|
assert.equal(acceptance.runtime.trackerPort9921Published, false);
|
|
assert.equal(acceptance.runtime.synologyPublicIngress, false);
|
|
assert.equal(acceptance.runtime.commandTransport, "disabled");
|
|
assert.equal(acceptance.runtime.gelios, "untouched");
|
|
});
|
|
|
|
test("freezes the VPS-initiated Tailscale and SSH backhaul", async () => {
|
|
const freeze = await readJson(freezeUrl);
|
|
|
|
assert.equal(freeze.status, "frozen");
|
|
assert.equal(freeze.successor, "nodedc.device-edge.core-channel.v1");
|
|
assert.equal(freeze.runtimeMutationInPhase0, false);
|
|
assert.ok(freeze.forbiddenForNewPlanOrApply.includes(
|
|
"nodedc.device-plane.backhaul-vps-enrollment.v1",
|
|
));
|
|
assert.ok(freeze.forbiddenForNewPlanOrApply.includes(
|
|
"tailscale-userspace-key-only-ssh-local-forward",
|
|
));
|
|
});
|
|
|
|
test("superseded artifact builders fail closed outside test-only reconstruction", () => {
|
|
const environment = { ...process.env };
|
|
delete environment.NODEDC_ALLOW_SUPERSEDED_TRANSPORT;
|
|
|
|
const edge = spawnSync(
|
|
process.execPath,
|
|
[edgeBuilder, "backhaul", "superseded-backhaul-unit"],
|
|
{ encoding: "utf8", env: environment },
|
|
);
|
|
assert.notEqual(edge.status, 0);
|
|
assert.match(edge.stderr, /vps_initiated_transport_frozen:ADR-0001/);
|
|
|
|
const enrollment = spawnSync(
|
|
process.execPath,
|
|
[enrollmentBuilder, "superseded-enrollment-unit"],
|
|
{ encoding: "utf8", env: environment },
|
|
);
|
|
assert.notEqual(enrollment.status, 0);
|
|
assert.match(enrollment.stderr, /vps_initiated_transport_frozen:ADR-0001/);
|
|
});
|