Sasedev/khadhroony-solana-project
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.3.7-pre.007

Browse Source
This commit is contained in:
SinuS von SifriduS
2026-09-02 16:07:57 +02:00
parent 6fc5b5b607
commit 9c4469248a
21 changed files with 1518 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
crates/ksp-app-backfill-desk/tests/desktop_security.rs
View File

@@ -1,5 +1,5 @@
// file: crates/ksp-app-backfill-desk/tests/desktop_security.rs
// version: 6
// version: 7
//! Security and dependency-boundary checks for the Backfill Desk scaffold.
@@ -43,7 +43,7 @@ fn read_text(path: &std::path::Path) -> String {
}
#[test]
fn capability_surface_remains_core_plus_tracing_while_transport_and_store_are_backend_only() {
fn capability_surface_remains_core_plus_tracing_while_backfill_runtime_stays_backend_only() {
let root = app_root();
let capability = read_text(root.join("capabilities/default.json").as_path());
assert!(capability.contains("\"core:default\""));
@@ -53,10 +53,12 @@ fn capability_surface_remains_core_plus_tracing_while_transport_and_store_are_ba
}
let manifest = read_text(root.join("Cargo.toml").as_path());
assert!(manifest.contains("tauri-plugin-tracing.workspace = true"));
assert!(manifest.contains("ksp-job-api = { path = \"../ksp-job-api\" }"));
assert!(manifest.contains("ksp-job-backfill-lib = { path = \"../ksp-job-backfill-lib\" }"));
assert!(manifest.contains("ksp-onchain-transport-lib = { path = \"../ksp-onchain-transport-lib\" }"));
assert!(manifest.contains("ksp-store-lib = { path = \"../ksp-store-lib\" }"));
for forbidden in ["ksp-job-backfill-lib", "ksp-store-api", "ksp-store-postgres-lib", "reqwest", "tokio-postgres"] {
assert!(!manifest.contains(forbidden), "current Backfill Desk opens a forbidden dependency: {forbidden}");
for forbidden in ["ksp-store-api", "ksp-store-postgres-lib", "reqwest", "tokio-postgres", "tonic", "yellowstone-grpc"] {
assert!(!manifest.contains(forbidden), "current Backfill Desk opens a forbidden direct dependency: {forbidden}");
}
}
@@ -89,7 +91,7 @@ fn pre_002_tauri_commands_remain_centralized() {
assert_eq!(count, 0, "{} declares a Tauri command outside tauri.rs", path.display());
}
}
assert_eq!(command_count, 4);
assert_eq!(command_count, 5);
}
#[test]
@@ -109,21 +111,23 @@ fn pre_002_frontend_instrumentation_avoids_business_or_secret_payloads() {
assert!(main.contains(required));
}
}
for forbidden in ["JSON.stringify(status)", "signature", "address", "apiKey", "authorization", "database_url"] {
assert!(!main.contains(forbidden));
for forbidden in [
"JSON.stringify(status)",
"apiKey",
"authorization",
"database_url",
"campaign validation requested\", {\n address",
"campaign validation requested\", {\n anchorSignature",
"campaign validation requested\", {\n explicitSignatures",
"campaign validation requested\", {\n minContextSlot",
] {
assert!(!main.contains(forbidden), "frontend tracing includes forbidden request payload marker {forbidden}");
}
}
#[test]
fn pre_005_opens_store_facade_without_backend_or_job_dependencies() {
fn pre_005_store_runtime_remains_backend_neutral_after_job_mapping_opens() {
let root = app_root();
let manifest = read_text(root.join("Cargo.toml").as_path());
assert!(manifest.contains("ksp-config-lib = { path = \"../ksp-config-lib\" }"));
assert!(manifest.contains("ksp-onchain-transport-lib = { path = \"../ksp-onchain-transport-lib\" }"));
assert!(manifest.contains("ksp-store-lib = { path = \"../ksp-store-lib\" }"));
for forbidden in ["ksp-job-backfill-lib", "ksp-store-api", "ksp-store-postgres-lib", "reqwest", "tokio-postgres"] {
assert!(!manifest.contains(forbidden), "pre.005 opens a forbidden direct dependency: {forbidden}");
}
let bootstrap = read_text(root.join("src/bootstrap.rs").as_path());
assert!(bootstrap.contains("LogFilterLevel::Trace"));
assert!(!bootstrap.contains("HttpTransportPool"));
@@ -132,8 +136,8 @@ fn pre_005_opens_store_facade_without_backend_or_job_dependencies() {
assert!(store.contains("ksp_store_lib::Store::open"));
assert!(store.contains("store.health().await"));
assert!(store.contains("store.close().await"));
for forbidden in ["connection_uri", "postgres", "database_url", "provider()", "endpoint_url"] {
assert!(!store.contains(forbidden), "Store runtime leaks or depends on forbidden physical metadata marker {forbidden}");
for forbidden in ["ksp_job_", "BackfillRequest", "connection_uri", "postgres", "database_url", "provider()", "endpoint_url"] {
assert!(!store.contains(forbidden), "Store runtime leaks or absorbs another responsibility: {forbidden}");
}
let dto = read_text(root.join("src/dto_common.rs").as_path());
assert!(dto.contains("BackfillDeskOptionsDto"));
@@ -157,3 +161,46 @@ fn pre_006_frontend_receives_only_safe_http_route_metadata_and_no_endpoint_mater
assert!(!frontend.contains(forbidden), "frontend embeds forbidden provider material marker {forbidden}");
}
}
#[test]
fn pre_007_request_mapping_keeps_network_endpoint_and_payload_secrets_backend_owned() {
let root = app_root();
let dto = read_text(root.join("src/dto_backfill.rs").as_path());
let request_start = dto.find("pub(crate) struct BackfillStartRequestDto");
let preview_start = dto.find("pub(crate) struct BackfillRequestPreviewDto");
assert!(request_start.is_some());
assert!(preview_start.is_some());
let request_source = match (request_start, preview_start) {
(std::option::Option::Some(start), std::option::Option::Some(end)) if start < end => &dto[start..end],
_ => "",
};
for forbidden in [
"pub(crate) network:",
"pub(crate) provider",
"pub(crate) endpoint",
"pub(crate) url",
"pub(crate) job_id",
"pub(crate) credential",
"pub(crate) token",
] {
assert!(!request_source.contains(forbidden), "frontend request DTO owns forbidden field marker {forbidden}");
}
let mapping = read_text(root.join("src/backfill_request.rs").as_path());
assert!(mapping.contains("options.store_network.as_deref()"));
assert!(mapping.contains("options.http_routes.iter().any"));
assert!(mapping.contains("BackfillRequest::new"));
assert!(!mapping.contains("HttpTransportPool::new"));
assert!(!mapping.contains("Store::open"));
let state = read_text(root.join("src/app_state.rs").as_path());
assert!(state.contains("backfill-desk-validation"));
assert!(state.contains("validated Backfill Desk campaign request without starting a Job"));
for forbidden in [
"preview.address",
"preview.anchor_signature",
"preview.explicit_signatures",
"request.address.as_str()",
"request.anchor_signature.as_str()",
] {
assert!(!state.contains(forbidden), "request validation logging includes forbidden payload marker {forbidden}");
}
}