127 lines
8.9 KiB
PowerShell
127 lines
8.9 KiB
PowerShell
param([string]$DockerContext = "docker-prod")
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$coreContainer = "assistant-core-runtime-1"
|
|
$commitContainer = "assistant-commit-runtime-1"
|
|
$continuityContainer = "assistant-continuity-runtime-1"
|
|
$receiverContainer = "assistant-notification-receiver-1"
|
|
|
|
function Post-Json([string]$container, [string]$url, [object]$body) {
|
|
$json = $body | ConvertTo-Json -Depth 10 -Compress
|
|
$local = New-TemporaryFile
|
|
$remote = "/tmp/domovoy-$([guid]::NewGuid().ToString('N')).json"
|
|
try {
|
|
[IO.File]::WriteAllText($local, $json, [Text.UTF8Encoding]::new($false))
|
|
docker --context $DockerContext cp $local "${container}:$remote" | Out-Null
|
|
$result = docker --context $DockerContext exec $container wget -qO- --header "Content-Type: application/json" --post-file $remote $url
|
|
if ($LASTEXITCODE -ne 0) { throw "POST $url failed" }
|
|
return ($result -join "`n")
|
|
} finally {
|
|
docker --context $DockerContext exec --user root $container rm -f $remote 2>$null
|
|
Remove-Item -LiteralPath $local -Force
|
|
}
|
|
}
|
|
|
|
function Creator-Post([string]$url, [object]$body, [string]$token) {
|
|
$json = $body | ConvertTo-Json -Depth 10 -Compress
|
|
$local = New-TemporaryFile
|
|
$remote = "/tmp/domovoy-$([guid]::NewGuid().ToString('N')).json"
|
|
try {
|
|
[IO.File]::WriteAllText($local, $json, [Text.UTF8Encoding]::new($false))
|
|
docker --context $DockerContext cp $local "${commitContainer}:$remote" | Out-Null
|
|
$result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -qO- --header=Content-Type:application/json --header=$auth --post-file=$1 $2' sh $remote $url
|
|
if ($LASTEXITCODE -ne 0) { throw "Creator POST $url failed" }
|
|
return ($result -join "`n")
|
|
} finally {
|
|
docker --context $DockerContext exec --user root $commitContainer rm -f $remote 2>$null
|
|
Remove-Item -LiteralPath $local -Force
|
|
}
|
|
}
|
|
|
|
function Creator-Get([string]$url, [string]$token) {
|
|
$result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -qO- --header=$auth $1' sh $url
|
|
if ($LASTEXITCODE -ne 0) { throw "Creator GET $url failed" }
|
|
return ($result -join "`n")
|
|
}
|
|
|
|
function Expect-CreatorStatus([string]$url, [object]$body, [string]$token, [int]$status) {
|
|
$json = $body | ConvertTo-Json -Depth 10 -Compress
|
|
$local = New-TemporaryFile
|
|
$remote = "/tmp/domovoy-$([guid]::NewGuid().ToString('N')).json"
|
|
try {
|
|
[IO.File]::WriteAllText($local, $json, [Text.UTF8Encoding]::new($false))
|
|
docker --context $DockerContext cp $local "${commitContainer}:$remote" | Out-Null
|
|
$previous = $ErrorActionPreference
|
|
$ErrorActionPreference = "Continue"
|
|
$result = (docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -S -O /dev/null --header=Content-Type:application/json --header=$auth --post-file=$1 $2' sh $remote $url 2>&1) -join "`n"
|
|
$ErrorActionPreference = $previous
|
|
if ($result -notmatch "HTTP/1\.[01] $status") { throw "Creator POST $url did not return $status" }
|
|
} finally {
|
|
docker --context $DockerContext exec --user root $commitContainer rm -f $remote 2>$null
|
|
Remove-Item -LiteralPath $local -Force
|
|
}
|
|
}
|
|
|
|
$sessionResponse = docker --context $DockerContext exec $coreContainer sh -c 'token=$CREATOR_BOOTSTRAP_TOKEN; if test x$CREATOR_BOOTSTRAP_TOKEN_FILE != x; then token=$(cat $CREATOR_BOOTSTRAP_TOKEN_FILE); fi; if test x$token = x; then exit 7; fi; header=Authorization:\ Bearer\ $token; IFS=; wget -qO- --header=$header --post-data={} http://localhost:8080/v1/creator/sessions'
|
|
if ($LASTEXITCODE -ne 0) { throw "Creator session issuance failed" }
|
|
$creatorSession = ($sessionResponse | ConvertFrom-Json).Token
|
|
|
|
$suffix = [guid]::NewGuid().ToString("N")
|
|
$scope = "domovoy-global-scope"
|
|
$goal = "goal-creator-command-$suffix"
|
|
$task = "task-creator-command-$suffix"
|
|
$prospective = "prospective-creator-command-$suffix"
|
|
Post-Json $coreContainer http://localhost:8080/v1/tasks @{TaskID=$task;GoalID=$goal;ScopeID=$scope;Revision=1} | Out-Null
|
|
Post-Json $continuityContainer http://localhost:8081/v1/prospective-items @{
|
|
ID=$prospective;CommitmentID="commitment-$suffix";OwnerPrincipalID="domovoy-creator-principal"
|
|
ScopeID=$scope;GoalID=$goal;TriggerAtUnixMillis=1800000000000;State="DELIVERED";Revision=1
|
|
} | Out-Null
|
|
$command = @{
|
|
Target=@{TaskID=$task;GoalID=$goal;ScopeID=$scope;Revision=1}
|
|
ProspectiveItemID=$prospective;ExpectedRevision=1;EvidenceRef="artifact://creator-command/$suffix"
|
|
}
|
|
Expect-CreatorStatus http://localhost:8082/v1/creator/continuity/satisfy-delivered $command "invalid" 401
|
|
$action = Creator-Post http://localhost:8082/v1/creator/continuity/satisfy-delivered $command $creatorSession | ConvertFrom-Json
|
|
if ($action.State -ne "SUCCEEDED" -or -not $action.AuthorizedActionID -or -not $action.ActionIntentID -or -not $action.ActionAttemptID) {
|
|
throw "Creator command response is incomplete"
|
|
}
|
|
$historyRaw = Creator-Get 'http://localhost:8082/v1/creator/authorized-actions?limit=50' $creatorSession
|
|
$history = $historyRaw | ConvertFrom-Json
|
|
$historyItem = @($history.Items | Where-Object { $_.AuthorizedActionID -eq $action.AuthorizedActionID })
|
|
if ($historyItem.Count -ne 1 -or $historyItem[0].ActionAttemptID -ne $action.ActionAttemptID -or $historyItem[0].State -ne 'SUCCEEDED') {
|
|
throw "Creator action history does not contain the committed outcome"
|
|
}
|
|
if ($historyRaw -match 'EvidenceRef|GrantID') { throw "Creator action history exposed restricted envelope fields" }
|
|
$updated = docker --context $DockerContext exec $continuityContainer wget -qO- "http://localhost:8081/v1/prospective-items/$prospective" | ConvertFrom-Json
|
|
if ($updated.State -ne "SATISFIED" -or $updated.Revision -ne 2) { throw "Creator command did not satisfy item exactly once" }
|
|
Expect-CreatorStatus http://localhost:8082/v1/creator/continuity/satisfy-delivered $command $creatorSession 409
|
|
Expect-CreatorStatus "http://localhost:8082/v1/creator/authorized-actions/$($action.AuthorizedActionID)/reconcile" @{} $creatorSession 409
|
|
|
|
$notificationProspective = "prospective-notification-$suffix"
|
|
Post-Json $continuityContainer http://localhost:8081/v1/prospective-items @{
|
|
ID=$notificationProspective;CommitmentID="commitment-notification-$suffix";OwnerPrincipalID="domovoy-creator-principal"
|
|
ScopeID=$scope;GoalID=$goal;TriggerAtUnixMillis=1800000000000;State="DELIVERED";Revision=1
|
|
} | Out-Null
|
|
$notificationCommand = @{
|
|
Target=@{TaskID=$task;GoalID=$goal;ScopeID=$scope;Revision=1}
|
|
ProspectiveItemID=$notificationProspective;ExpectedRevision=1;Confirm=$true
|
|
}
|
|
Expect-CreatorStatus http://localhost:8082/v1/creator/continuity/notify-delivered $notificationCommand "invalid" 401
|
|
$hostileNotification = $notificationCommand.Clone()
|
|
$hostileNotification.URL = 'https://example.invalid'
|
|
$hostileNotification.Body = 'arbitrary'
|
|
Expect-CreatorStatus http://localhost:8082/v1/creator/continuity/notify-delivered $hostileNotification $creatorSession 400
|
|
$notificationAction = Creator-Post http://localhost:8082/v1/creator/continuity/notify-delivered $notificationCommand $creatorSession | ConvertFrom-Json
|
|
if ($notificationAction.State -ne 'SUCCEEDED' -or -not $notificationAction.ActionIntentID) { throw 'Creator notification did not produce a successful receipt' }
|
|
$notificationItem = docker --context $DockerContext exec $continuityContainer wget -qO- "http://localhost:8081/v1/prospective-items/$notificationProspective" | ConvertFrom-Json
|
|
if ($notificationItem.State -ne 'DELIVERED' -or $notificationItem.Revision -ne 1) { throw 'Notification changed Continuity canonical state' }
|
|
$receiptRaw = docker --context $DockerContext exec $receiverContainer sh -c 'token=$(cat /run/notification-reader/token); auth=Authorization:\ Bearer\ $token; IFS=; wget -qO- --header=$auth $1' sh "http://localhost:8085/delivery/v1/receipts/$($notificationAction.ActionIntentID)"
|
|
if ($LASTEXITCODE -ne 0) { throw 'Notification receipt lookup failed' }
|
|
$receipt = ($receiptRaw -join "`n") | ConvertFrom-Json
|
|
if ($receipt.action_intent_id -ne $notificationAction.ActionIntentID -or $receipt.request_digest -notmatch '^[0-9a-f]{64}$') { throw 'Notification receipt evidence mismatch' }
|
|
$notificationHistory = Creator-Get 'http://localhost:8082/v1/creator/authorized-actions?limit=50' $creatorSession | ConvertFrom-Json
|
|
$notificationHistoryItem = @($notificationHistory.Items | Where-Object { $_.AuthorizedActionID -eq $notificationAction.AuthorizedActionID })
|
|
if ($notificationHistoryItem.Count -ne 1 -or $notificationHistoryItem[0].Operation -ne 'deliver-prospective-notification-v1' -or $notificationHistoryItem[0].State -ne 'SUCCEEDED') { throw 'Notification action history is incomplete' }
|
|
|
|
Write-Output "Creator Commit command verification: PASS"
|