298 lines
13 KiB
Rust
298 lines
13 KiB
Rust
// file: crates/ksp-app-backfill-desk/tests/desktop_security.rs
|
|
// version: 13
|
|
|
|
//! Security and dependency-boundary checks for the Backfill Desk scaffold.
|
|
|
|
#![forbid(unsafe_code)]
|
|
#![deny(unreachable_pub)]
|
|
#![warn(missing_docs)]
|
|
|
|
fn app_root() -> std::path::PathBuf {
|
|
return std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
|
|
}
|
|
|
|
fn struct_source<'a>(source: &'a str, marker: &str) -> &'a str {
|
|
let start = match source.find(marker) {
|
|
std::option::Option::Some(value) => value,
|
|
std::option::Option::None => return "",
|
|
};
|
|
let tail = &source[start..];
|
|
let end = match tail.find("\n}") {
|
|
std::option::Option::Some(value) => value + 2,
|
|
std::option::Option::None => return "",
|
|
};
|
|
return &tail[..end];
|
|
}
|
|
|
|
fn collect_files(directory: &std::path::Path, extension: &str, files: &mut std::vec::Vec<std::path::PathBuf>) {
|
|
let entries = std::fs::read_dir(directory);
|
|
let entries = match entries {
|
|
std::result::Result::Ok(value) => value,
|
|
std::result::Result::Err(_) => return,
|
|
};
|
|
for entry in entries {
|
|
let entry = match entry {
|
|
std::result::Result::Ok(value) => value,
|
|
std::result::Result::Err(_) => continue,
|
|
};
|
|
let path = entry.path();
|
|
if path.is_dir() {
|
|
collect_files(path.as_path(), extension, files);
|
|
continue;
|
|
}
|
|
if path.extension().and_then(std::ffi::OsStr::to_str) == std::option::Option::Some(extension) {
|
|
files.push(path);
|
|
}
|
|
}
|
|
}
|
|
|
|
fn read_text(path: &std::path::Path) -> String {
|
|
let source = std::fs::read_to_string(path);
|
|
assert!(source.is_ok(), "unable to read {}", path.display());
|
|
return match source {
|
|
std::result::Result::Ok(value) => value,
|
|
std::result::Result::Err(_) => String::new(),
|
|
};
|
|
}
|
|
|
|
#[test]
|
|
fn capability_surface_remains_core_plus_tracing_while_backfill_runtime_stays_backend_only() {
|
|
let root = app_root();
|
|
let capability = read_text(root.join("capabilities/default.json").as_path());
|
|
assert!(capability.contains("\"core:default\""));
|
|
assert!(capability.contains("\"tracing:default\""));
|
|
for forbidden in ["dialog:", "fs:", "http:", "shell:"] {
|
|
assert!(!capability.contains(forbidden));
|
|
}
|
|
let manifest = read_text(root.join("Cargo.toml").as_path());
|
|
assert!(manifest.contains("tauri-plugin-tracing.workspace = true"));
|
|
assert!(manifest.contains("ksp-job-api = { path = \"../ksp-job-api\" }"));
|
|
assert!(manifest.contains("ksp-job-backfill-lib = { path = \"../ksp-job-backfill-lib\" }"));
|
|
assert!(manifest.contains("ksp-onchain-transport-lib = { path = \"../ksp-onchain-transport-lib\" }"));
|
|
assert!(manifest.contains("ksp-store-lib = { path = \"../ksp-store-lib\" }"));
|
|
for forbidden in ["ksp-store-api", "ksp-store-postgres-lib", "reqwest", "tokio-postgres", "tonic", "yellowstone-grpc"] {
|
|
assert!(!manifest.contains(forbidden), "current Backfill Desk opens a forbidden direct dependency: {forbidden}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn pre_002_frontend_has_no_network_persistence_or_native_dialog_surface() {
|
|
let root = app_root();
|
|
let mut typescript = std::vec::Vec::new();
|
|
collect_files(root.join("frontend/ts").as_path(), "ts", &mut typescript);
|
|
assert!(!typescript.is_empty());
|
|
for path in typescript {
|
|
let source = read_text(path.as_path());
|
|
for forbidden in ["fetch(", "XMLHttpRequest", "localStorage", "sessionStorage", "window.alert(", "window.confirm(", "window.prompt("] {
|
|
assert!(!source.contains(forbidden), "{} contains forbidden scaffold surface {forbidden}", path.display());
|
|
}
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn pre_002_tauri_commands_remain_centralized() {
|
|
let root = app_root();
|
|
let mut rust_files = std::vec::Vec::new();
|
|
collect_files(root.join("src").as_path(), "rs", &mut rust_files);
|
|
let mut command_count = 0usize;
|
|
for path in rust_files {
|
|
let source = read_text(path.as_path());
|
|
let count = source.matches("#[tauri::command]").count();
|
|
if path.file_name().and_then(std::ffi::OsStr::to_str) == std::option::Option::Some("tauri.rs") {
|
|
command_count += count;
|
|
} else {
|
|
assert_eq!(count, 0, "{} declares a Tauri command outside tauri.rs", path.display());
|
|
}
|
|
}
|
|
assert_eq!(command_count, 8);
|
|
}
|
|
|
|
#[test]
|
|
fn pre_002_frontend_instrumentation_avoids_business_or_secret_payloads() {
|
|
let root = app_root();
|
|
let main = read_text(root.join("frontend/ts/main.ts").as_path());
|
|
for required in [
|
|
"Backfill Desk frontend control clicked",
|
|
"Backfill Desk navigation tab clicked",
|
|
"Backfill Desk runtime status refresh button clicked",
|
|
"Frontend IPC command requested",
|
|
] {
|
|
if required == "Frontend IPC command requested" {
|
|
let invoke = read_text(root.join("frontend/ts/invoke.ts").as_path());
|
|
assert!(invoke.contains(required));
|
|
} else {
|
|
assert!(main.contains(required));
|
|
}
|
|
}
|
|
for forbidden in [
|
|
"JSON.stringify(status)",
|
|
"apiKey",
|
|
"authorization",
|
|
"database_url",
|
|
"campaign validation requested\", {\n address",
|
|
"campaign validation requested\", {\n anchorSignature",
|
|
"campaign validation requested\", {\n explicitSignatures",
|
|
"campaign validation requested\", {\n minContextSlot",
|
|
] {
|
|
assert!(!main.contains(forbidden), "frontend tracing includes forbidden request payload marker {forbidden}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn pre_005_store_runtime_remains_backend_neutral_after_job_mapping_opens() {
|
|
let root = app_root();
|
|
let bootstrap = read_text(root.join("src/bootstrap.rs").as_path());
|
|
assert!(bootstrap.contains("LogFilterLevel::Trace"));
|
|
assert!(!bootstrap.contains("HttpTransportPool"));
|
|
assert!(!bootstrap.contains("Store::open"));
|
|
let store = read_text(root.join("src/store_runtime.rs").as_path());
|
|
assert!(store.contains("ksp_store_lib::Store::open"));
|
|
assert!(store.contains("store.health().await"));
|
|
assert!(store.contains("store.close().await"));
|
|
for forbidden in ["ksp_job_", "BackfillRequest", "connection_uri", "postgres", "database_url", "provider()", "endpoint_url"] {
|
|
assert!(!store.contains(forbidden), "Store runtime leaks or absorbs another responsibility: {forbidden}");
|
|
}
|
|
let dto = read_text(root.join("src/dto_common.rs").as_path());
|
|
assert!(dto.contains("BackfillDeskOptionsDto"));
|
|
for forbidden in ["endpoint_url", "pub(crate) url", "pub(crate) credential", "pub(crate) token", "connection_uri"] {
|
|
assert!(!dto.contains(forbidden), "readiness options DTO source contains forbidden field marker {forbidden}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn pre_006_frontend_receives_only_safe_http_route_metadata_and_no_endpoint_material() {
|
|
let root = app_root();
|
|
let dto = read_text(root.join("src/dto_common.rs").as_path());
|
|
assert!(dto.contains("BackfillHttpRouteOptionDto"));
|
|
assert!(dto.contains("pub(crate) providers"));
|
|
assert!(dto.contains("pub(crate) role"));
|
|
for forbidden in ["endpoint_url", "pub(crate) url", "pub(crate) credential", "pub(crate) api_key", "pub(crate) authorization"] {
|
|
assert!(!dto.contains(forbidden), "route DTO leaks forbidden endpoint material marker {forbidden}");
|
|
}
|
|
let frontend = read_text(root.join("frontend/ts/main.ts").as_path());
|
|
for forbidden in ["http://", "https://", "apiKey", "authorization", "token"] {
|
|
assert!(!frontend.contains(forbidden), "frontend embeds forbidden provider material marker {forbidden}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn pre_007_request_mapping_keeps_network_endpoint_and_payload_secrets_backend_owned() {
|
|
let root = app_root();
|
|
let dto = read_text(root.join("src/dto_backfill.rs").as_path());
|
|
let request_source = struct_source(dto.as_str(), "pub(crate) struct BackfillStartRequestDto");
|
|
assert!(!request_source.is_empty());
|
|
for forbidden in [
|
|
"pub(crate) network:",
|
|
"pub(crate) provider",
|
|
"pub(crate) endpoint",
|
|
"pub(crate) url",
|
|
"pub(crate) job_id",
|
|
"pub(crate) credential",
|
|
"pub(crate) token",
|
|
] {
|
|
assert!(!request_source.contains(forbidden), "frontend request DTO owns forbidden field marker {forbidden}");
|
|
}
|
|
let mapping = read_text(root.join("src/backfill_request.rs").as_path());
|
|
assert!(mapping.contains("options.store_network.as_deref()"));
|
|
assert!(mapping.contains("options.http_routes.iter().any"));
|
|
assert!(mapping.contains("BackfillRequest::new"));
|
|
assert!(!mapping.contains("HttpTransportPool::new"));
|
|
assert!(!mapping.contains("Store::open"));
|
|
let state = read_text(root.join("src/app_state.rs").as_path());
|
|
assert!(state.contains("backfill-desk-validation"));
|
|
assert!(state.contains("validated Backfill Desk campaign request without starting a Job"));
|
|
for forbidden in [
|
|
"preview.address",
|
|
"preview.anchor_signature",
|
|
"preview.explicit_signatures",
|
|
"request.address.as_str()",
|
|
"request.anchor_signature.as_str()",
|
|
] {
|
|
assert!(!state.contains(forbidden), "request validation logging includes forbidden payload marker {forbidden}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn pre_008_start_surface_keeps_payload_and_physical_resources_backend_owned() {
|
|
let root = app_root();
|
|
let dto = read_text(root.join("src/dto_backfill.rs").as_path());
|
|
let response_source = struct_source(dto.as_str(), "pub(crate) struct BackfillStartResponseDto");
|
|
assert!(!response_source.is_empty());
|
|
assert!(response_source.contains("pub(crate) job_id: String"));
|
|
assert!(response_source.contains("pub(crate) state: String"));
|
|
for forbidden in ["address", "signature", "provider", "endpoint", "url", "credential", "token", "network"] {
|
|
assert!(!response_source.contains(forbidden), "Start acknowledgement leaks forbidden marker {forbidden}");
|
|
}
|
|
let run = read_text(root.join("src/backfill_run.rs").as_path());
|
|
assert!(run.contains("BackfillJobHandle"));
|
|
assert!(run.contains("ERROR_CODE_BACKFILL_RUN_ACTIVE"));
|
|
assert!(!run.contains("reqwest"));
|
|
assert!(!run.contains("tokio_postgres"));
|
|
let frontend = read_text(root.join("frontend/ts/main.ts").as_path());
|
|
let start_marker = frontend.find("Backfill Desk campaign Start requested");
|
|
assert!(start_marker.is_some());
|
|
let start_source = match start_marker {
|
|
std::option::Option::Some(index) => &frontend[index..std::cmp::min(index + 420, frontend.len())],
|
|
std::option::Option::None => "",
|
|
};
|
|
for forbidden in ["address:", "anchorSignature:", "explicitSignatures:", "minContextSlot:"] {
|
|
assert!(!start_source.contains(forbidden), "Start tracing includes forbidden request payload marker {forbidden}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn pre_009_monitoring_projection_exposes_counters_and_codes_without_checkpoint_or_business_payloads() {
|
|
let root = app_root();
|
|
let status = read_text(root.join("src/backfill_status.rs").as_path());
|
|
let dto = struct_source(status.as_str(), "BackfillRunStatusDto");
|
|
for required in ["checkpoint_present", "contiguous_completed", "failure_code", "failure_domain", "sequence", "scope_kind"] {
|
|
assert!(dto.contains(required), "monitoring DTO missing required safe marker {required}");
|
|
}
|
|
for forbidden in [
|
|
"pub(crate) address:",
|
|
"pub(crate) signature:",
|
|
"pub(crate) endpoint:",
|
|
"pub(crate) provider:",
|
|
"pub(crate) credential:",
|
|
"pub(crate) token:",
|
|
"pub(crate) checkpoint:",
|
|
"pub(crate) payload:",
|
|
"pub(crate) raw_transaction:",
|
|
] {
|
|
assert!(!dto.contains(forbidden), "monitoring DTO leaks forbidden field marker {forbidden}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn pre_010_cancel_surface_targets_backend_job_identity_without_business_payloads() {
|
|
let root = app_root();
|
|
let dto_source = read_text(root.join("src/dto_backfill.rs").as_path());
|
|
let dto = struct_source(dto_source.as_str(), "BackfillCancelResponseDto");
|
|
for required in ["accepted", "job_id", "state"] {
|
|
assert!(dto.contains(required), "Cancel acknowledgement missing safe field {required}");
|
|
}
|
|
for forbidden in [
|
|
"pub(crate) address:",
|
|
"pub(crate) signature:",
|
|
"pub(crate) endpoint:",
|
|
"pub(crate) provider:",
|
|
"pub(crate) credential:",
|
|
"pub(crate) token:",
|
|
"pub(crate) checkpoint:",
|
|
"pub(crate) payload:",
|
|
] {
|
|
assert!(!dto.contains(forbidden), "Cancel acknowledgement leaks forbidden field marker {forbidden}");
|
|
}
|
|
let frontend = read_text(root.join("frontend/ts/main.ts").as_path());
|
|
let cancel_marker = frontend.find("Backfill Desk cooperative cancellation requested");
|
|
assert!(cancel_marker.is_some());
|
|
let cancel_source = match cancel_marker {
|
|
std::option::Option::Some(index) => &frontend[index..std::cmp::min(index + 700, frontend.len())],
|
|
std::option::Option::None => "",
|
|
};
|
|
assert!(cancel_source.contains("jobId: status.jobId"));
|
|
for forbidden in ["address:", "anchorSignature:", "explicitSignatures:", "minContextSlot:"] {
|
|
assert!(!cancel_source.contains(forbidden), "Cancel tracing includes forbidden campaign payload marker {forbidden}");
|
|
}
|
|
}
|