diff --git a/backend/tests/test_phase3_acceptance_runner.py b/backend/tests/test_phase3_acceptance_runner.py index 1e4bea9..052df56 100644 --- a/backend/tests/test_phase3_acceptance_runner.py +++ b/backend/tests/test_phase3_acceptance_runner.py @@ -55,7 +55,7 @@ def test_config_rejects_personal_vault_plaintext_secrets_and_unconfirmed_roots(t assert (existing / "keep.txt").read_text(encoding="utf-8") == "keep" -def test_missing_driver_is_a_junit_failure_and_never_a_skip(tmp_path): +def test_missing_driver_is_a_junit_failure_and_never_a_skip(tmp_path, monkeypatch): data_root = tmp_path / "isolated" config_path = config(tmp_path / "config.json", data_root) report = tmp_path / "report" @@ -63,6 +63,7 @@ def test_missing_driver_is_a_junit_failure_and_never_a_skip(tmp_path): suite="sidecar", case="A-01", config=str(config_path), report_dir=str(report), list_cases=False, json=False, ) + monkeypatch.setattr(runner, "repository_changes", lambda: ()) assert runner.execute(args, {}) == 1 result = json.loads((report / "cases" / "A-01.json").read_text(encoding="utf-8")) summary = json.loads((report / "summary.json").read_text(encoding="utf-8")) @@ -74,6 +75,18 @@ def test_missing_driver_is_a_junit_failure_and_never_a_skip(tmp_path): assert "skipped=\"0\"" in junit +def test_execution_rejects_uncommitted_non_vault_source(tmp_path, monkeypatch): + config_path = config(tmp_path / "config.json", tmp_path / "isolated") + args = Namespace( + suite="sidecar", case="A-01", config=str(config_path), report_dir=str(tmp_path / "report"), + list_cases=False, json=False, + ) + monkeypatch.setattr(runner, "repository_changes", lambda: ("scripts/changed.py",)) + with pytest.raises(runner.AcceptanceError, match="SOURCE_TREE_DIRTY"): + runner.execute(args, {}) + assert not (tmp_path / "report").exists() + + def test_driver_result_must_supply_assertions_metrics_and_zero_exit(tmp_path): driver = tmp_path / "driver.py" driver.write_text("", encoding="utf-8") diff --git a/docs/architecture/第三阶段生产化工程规划与验收目标.md b/docs/architecture/第三阶段生产化工程规划与验收目标.md index 1b8ba10..536abc2 100644 --- a/docs/architecture/第三阶段生产化工程规划与验收目标.md +++ b/docs/architecture/第三阶段生产化工程规划与验收目标.md @@ -182,7 +182,7 @@ cargo test --manifest-path frontend/src-tauri/Cargo.toml --lib --locked cargo clippy --manifest-path frontend/src-tauri/Cargo.toml --lib --locked -- -D warnings ``` -验收入口已经建立：仓库根执行`python scripts/phase3-production-acceptance.py --suite --config --report-dir `；suite取`sidecar/credentials/sandbox/extensions/sync-client/sync-service/e2e/all`，支持`--case `单例复跑。配置由[隔离模板](../../scripts/phase3-acceptance-config.example.json)产生，含临时数据根、服务URL、安装包路径、平台profile、seed及秘密的环境引用，不能含生产凭据。runner拒绝仓库个人Vault、未标记隔离环境和非空报告目录；缺case driver、依赖/安装包/权限或必测项skip均以非零退出，不能只打印成功。当前各验收 ID 的完整生产 driver 仍须逐项接入，未登记项明确报告 `NOT_IMPLEMENTED`，不因 runner 接口存在而视为已验收；使用和结果契约见[生产验收 Runner](../development/OpenNexus生产验收Runner.md)。 +验收入口已经建立：仓库根执行`python scripts/phase3-production-acceptance.py --suite --config --report-dir `；suite取`sidecar/credentials/sandbox/extensions/sync-client/sync-service/e2e/all`，支持`--case `单例复跑。配置由[隔离模板](../../scripts/phase3-acceptance-config.example.json)产生，含临时数据根、服务URL、安装包路径、平台profile、seed及秘密的环境引用，不能含生产凭据。runner拒绝仓库个人Vault、未标记隔离环境、非空报告目录和未提交的非 Vault 源码；缺case driver、依赖/安装包/权限或必测项skip均以非零退出，不能只打印成功。生产 driver 正逐项接入，未登记项明确报告 `NOT_IMPLEMENTED`，不因 runner 接口存在而视为已验收；使用和结果契约见[生产验收 Runner](../development/OpenNexus生产验收Runner.md)。 runner输出JUnit、逐ID JSON、耗时/峰值内存、进程树/拒绝访问计数、文件摘要与revision清单及脱敏日志。退出0仅表示该suite所有适用ID通过；`all`要求显式平台profile并检查缺失项。下表同一行内所有断言均必测，每类输入保留独立子用例；测试代码硬编码预期协议向量或独立oracle，不能用被测函数自证。P0需生成ID清单并校验报告完整性。 diff --git a/docs/development/OpenNexus生产验收Runner.md b/docs/development/OpenNexus生产验收Runner.md index f0160fa..113f244 100644 --- a/docs/development/OpenNexus生产验收Runner.md +++ b/docs/development/OpenNexus生产验收Runner.md @@ -8,7 +8,7 @@ python scripts/phase3-production-acceptance.py --list-cases --json ``` -复制 `scripts/phase3-acceptance-config.example.json` 到仓库外，设置唯一 `run_id` 和平台 profile。`data_root` 可直接使用绝对路径，也可像模板一样通过环境变量引用。第一次运行只接受不存在或空目录并写入与 `run_id` 绑定的隔离标记；后续只能由同一 run 复用。个人 Vault、仓库或 `.git` 的父目录/子目录、符号链接、含明文密码/令牌的配置均会被拒绝。HTTP 服务只允许在配置中明确标记为测试服务，URL 不得包含用户信息、query 或 fragment。 +复制 `scripts/phase3-acceptance-config.example.json` 到仓库外，将占位值改成唯一 `run_id` 并设置平台 profile。`data_root` 可直接使用绝对路径，也可像模板一样通过环境变量引用。第一次运行只接受不存在或空目录并写入与 `run_id` 绑定的隔离标记；后续只能由同一 run 复用。个人 Vault、仓库或 `.git` 的父目录/子目录、符号链接、含明文密码/令牌的配置均会被拒绝。除用户 Vault 内容外存在未提交源码时也拒绝运行，使 summary 的 commit 可以唯一还原被测代码。HTTP 服务只允许在配置中明确标记为测试服务，URL 不得包含用户信息、query 或 fragment。 执行单例时应使用新的空报告目录： @@ -24,4 +24,4 @@ python scripts/phase3-production-acceptance.py ` 报告目录包含 `summary.json`、`case-manifest.json`、`junit.xml`、`cases/.json` 和脱敏的 `logs/.log`。摘要记录 commit、各锁文件 SHA-256、配置摘要与已提供安装产物摘要。日志将仓库、数据根、报告根、用户主目录和配置声明的秘密值替换为占位符，并限制为 10 MiB。报告目录必须为空，避免单例复跑覆盖原始证据。 -当前 runner 与失败闭合行为已实现，各生产验收 ID 的完整 driver 尚未登记。因此现在运行任一 ID 会生成 `NOT_IMPLEMENTED` 证据并退出 1；这用于阻止误报，不是验收通过。 +当前 runner 与失败闭合行为已实现，B-02 Fernet 迁移 driver 已登记；其余 29 个生产验收 ID 尚未登记，运行时会生成 `NOT_IMPLEMENTED` 证据并退出 1。这用于阻止误报，不是这些用例的验收通过。 diff --git a/frontend/src-tauri/src/credentials.rs b/frontend/src-tauri/src/credentials.rs index e8daada..71d7b71 100644 --- a/frontend/src-tauri/src/credentials.rs +++ b/frontend/src-tauri/src/credentials.rs @@ -807,22 +807,35 @@ mod tests { assert!(!broker.is_locked()); } #[test] - fn python_fernet_migration_is_verified_idempotent_and_preserves_sources() { + fn b02_fernet_migration_matrix_is_atomic_verified_and_idempotent() { let fixture: serde_json::Value = serde_json::from_str(include_str!("../tests/fixtures/fernet-python.json")).unwrap(); let temp = tempfile::tempdir().unwrap(); let old = temp.path().join("legacy"); fs::create_dir(&old).unwrap(); let source = serde_json::to_vec(&fixture["tokens"]).unwrap(); - fs::write(old.join("credentials.json"), &source).unwrap(); - fs::write(old.join("master.key"), fixture["key"].as_str().unwrap()).unwrap(); + let source_path = old.join("credentials.json"); + let key_path = old.join("master.key"); + let legacy_key = fixture["key"].as_str().unwrap(); + fs::write(&source_path, &source).unwrap(); + fs::write(&key_path, legacy_key).unwrap(); let mut broker = CredentialBroker::new(temp.path().join("new/stronghold.v1")); broker.unlock(password()).unwrap(); - assert_eq!(broker.import_fernet(&old, None).unwrap(), 100); - assert_eq!(broker.import_fernet(&old, None).unwrap(), 100); - assert_eq!(broker.list().unwrap().len(), 100); - assert_eq!(fs::read(old.join("credentials.json")).unwrap(), source); - assert!(old.join("master.key").is_file()); + for _ in 0..4 { + assert_eq!(broker.import_fernet(&old, None).unwrap(), 100); + assert_eq!(broker.list().unwrap().len(), 100); + } + assert_eq!(fs::read(&source_path).unwrap(), source); + assert_eq!(fs::read_to_string(&key_path).unwrap(), legacy_key); + let marker: serde_json::Value = + serde_json::from_slice(&fs::read(old.join(".opennexus-owner.json")).unwrap()).unwrap(); + assert_eq!(marker["state"], "switched"); + assert_eq!(marker["count"], 100); + assert_eq!(marker["environment_key"], false); + assert_eq!( + marker["source_sha256"], + format!("{:x}", Sha256::digest(&source)) + ); broker.lock(); broker.unlock(password()).unwrap(); for (id, value) in fixture["values"].as_object().unwrap() { @@ -835,18 +848,129 @@ mod tests { value.as_str().unwrap().as_bytes() ); } - broker + + let environment_source = temp.path().join("environment-source"); + fs::create_dir(&environment_source).unwrap(); + fs::write(environment_source.join("credentials.json"), &source).unwrap(); + let mut environment_broker = + CredentialBroker::new(temp.path().join("environment-target/stronghold.v1")); + environment_broker.unlock(password()).unwrap(); + assert_eq!( + environment_broker + .import_fernet( + &environment_source, + Some(Zeroizing::new(legacy_key.to_string())), + ) + .unwrap(), + 100 + ); + assert_eq!(environment_broker.list().unwrap().len(), 100); + assert!(!environment_source.join("master.key").exists()); + assert_eq!( + fs::read(environment_source.join("credentials.json")).unwrap(), + source + ); + let environment_marker: serde_json::Value = serde_json::from_slice( + &fs::read(environment_source.join(".opennexus-owner.json")).unwrap(), + ) + .unwrap(); + assert_eq!(environment_marker["environment_key"], true); + + let empty_source = temp.path().join("empty-source"); + fs::create_dir(&empty_source).unwrap(); + fs::write(empty_source.join("credentials.json"), b"{}").unwrap(); + fs::write(empty_source.join("master.key"), legacy_key).unwrap(); + let mut empty_broker = + CredentialBroker::new(temp.path().join("empty-target/stronghold.v1")); + empty_broker.unlock(password()).unwrap(); + assert_eq!(empty_broker.import_fernet(&empty_source, None).unwrap(), 0); + assert!(empty_broker.list().unwrap().is_empty()); + assert_eq!( + fs::read(empty_source.join("credentials.json")).unwrap(), + b"{}" + ); + let empty_marker: serde_json::Value = + serde_json::from_slice(&fs::read(empty_source.join(".opennexus-owner.json")).unwrap()) + .unwrap(); + assert_eq!(empty_marker["count"], 0); + assert_eq!(empty_marker["state"], "switched"); + + let missing_key_source = temp.path().join("missing-key-source"); + fs::create_dir(&missing_key_source).unwrap(); + fs::write(missing_key_source.join("credentials.json"), &source).unwrap(); + let mut missing_key_broker = + CredentialBroker::new(temp.path().join("missing-key-target/stronghold.v1")); + missing_key_broker.unlock(password()).unwrap(); + let missing_target_before = fs::read(&missing_key_broker.path).ok(); + assert_eq!( + missing_key_broker + .import_fernet(&missing_key_source, None) + .unwrap_err(), + "MIGRATION_KEY_MISSING" + ); + assert_eq!( + fs::read(&missing_key_broker.path).ok(), + missing_target_before + ); + assert_eq!( + fs::read(missing_key_source.join("credentials.json")).unwrap(), + source + ); + assert!(!missing_key_source.join(".opennexus-owner.json").exists()); + + let bad_source = temp.path().join("bad-token-source"); + fs::create_dir(&bad_source).unwrap(); + let mut bad_tokens = fixture["tokens"].clone(); + bad_tokens["provider-050"] = serde_json::json!("invalid-fernet-token"); + let bad_bytes = serde_json::to_vec(&bad_tokens).unwrap(); + fs::write(bad_source.join("credentials.json"), &bad_bytes).unwrap(); + fs::write(bad_source.join("master.key"), legacy_key).unwrap(); + let mut bad_broker = + CredentialBroker::new(temp.path().join("bad-token-target/stronghold.v1")); + bad_broker.unlock(password()).unwrap(); + let bad_target_before = fs::read(&bad_broker.path).ok(); + assert_eq!( + bad_broker.import_fernet(&bad_source, None).unwrap_err(), + "MIGRATION_DECRYPT_FAILED" + ); + assert_eq!(fs::read(&bad_broker.path).ok(), bad_target_before); + assert_eq!( + fs::read(bad_source.join("credentials.json")).unwrap(), + bad_bytes + ); + assert!(!bad_source.join(".opennexus-owner.json").exists()); + + let conflict_source = temp.path().join("conflict-source"); + fs::create_dir(&conflict_source).unwrap(); + fs::write(conflict_source.join("credentials.json"), &source).unwrap(); + fs::write(conflict_source.join("master.key"), legacy_key).unwrap(); + let mut conflict_broker = + CredentialBroker::new(temp.path().join("conflict-target/stronghold.v1")); + conflict_broker.unlock(password()).unwrap(); + conflict_broker .put( &CredentialId::legacy("provider-000"), Zeroizing::new(b"changed-new-value".to_vec()), ) .unwrap(); + let conflict_target_before = fs::read(&conflict_broker.path).unwrap(); assert_eq!( - broker.import_fernet(&old, None).unwrap_err(), + conflict_broker + .import_fernet(&conflict_source, None) + .unwrap_err(), "MIGRATION_CONFLICT" ); assert_eq!( - broker + fs::read(&conflict_broker.path).unwrap(), + conflict_target_before + ); + assert_eq!( + fs::read(conflict_source.join("credentials.json")).unwrap(), + source + ); + assert!(!conflict_source.join(".opennexus-owner.json").exists()); + assert_eq!( + conflict_broker .resolve(&Scope::Provider, &CredentialId::legacy("provider-000")) .unwrap() .unwrap() diff --git a/scripts/acceptance_cases/b02_credentials.py b/scripts/acceptance_cases/b02_credentials.py new file mode 100644 index 0000000..fd11ce8 --- /dev/null +++ b/scripts/acceptance_cases/b02_credentials.py @@ -0,0 +1,89 @@ +"""B-02 Fernet-to-Stronghold migration acceptance driver.""" + +from __future__ import annotations + +import argparse +import hashlib +import json +import os +import shutil +import subprocess +from pathlib import Path + +ROOT = Path(__file__).resolve().parents[2] +TEST = "credentials::tests::b02_fernet_migration_matrix_is_atomic_verified_and_idempotent" + + +def sha256(path: Path) -> str: + digest = hashlib.sha256() + with path.open("rb") as source: + for chunk in iter(lambda: source.read(1024 * 1024), b""): + digest.update(chunk) + return digest.hexdigest() + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--config", required=True) + parser.add_argument("--output", required=True) + args = parser.parse_args() + case_id = os.environ.get("OPENNEXUS_ACCEPTANCE_CASE_ID", "") + output = Path(args.output) + output.parent.mkdir(parents=True, exist_ok=True) + cargo = shutil.which("cargo") + if case_id != "B-02" or cargo is None: + result = { + "schema": 1, + "case_id": case_id, + "status": "FAILED", + "reason": "B-02 requires the registered case ID and Cargo.", + "assertions": [{"name": "driver prerequisites", "status": "FAILED", "evidence": "case ID or Cargo missing"}], + "metrics": {"peak_rss_bytes": None, "max_process_count": None, "denied_access_count": None}, + "files": [], + "revisions": [], + } + output.write_text(json.dumps(result, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") + return 1 + command = [ + cargo, + "test", + "--manifest-path", + str(ROOT / "frontend" / "src-tauri" / "Cargo.toml"), + "--locked", + "--lib", + TEST, + "--", + "--exact", + "--nocapture", + ] + completed = subprocess.run(command, cwd=ROOT, capture_output=True, text=True, check=False) + print(completed.stdout, end="") + print(completed.stderr, end="") + passed = completed.returncode == 0 and "1 passed; 0 failed" in completed.stdout + status = "PASSED" if passed else "FAILED" + evidence = f"cargo exact test {TEST}" + assertions = [ + {"name": "100 records preserve IDs and decrypted values", "status": status, "evidence": evidence}, + {"name": "local and environment master keys are handled without source mutation", "status": status, "evidence": evidence}, + {"name": "three repeat imports add no records", "status": status, "evidence": evidence}, + {"name": "empty source switches with zero records", "status": status, "evidence": evidence}, + {"name": "missing key and bad token do not switch or mutate source/target", "status": status, "evidence": evidence}, + {"name": "same target ID with a different value rejects the full migration", "status": status, "evidence": evidence}, + ] + fixture = ROOT / "frontend" / "src-tauri" / "tests" / "fixtures" / "fernet-python.json" + result = { + "schema": 1, + "case_id": case_id, + "status": status, + "reason": "" if passed else "The exact Rust B-02 acceptance oracle failed.", + "assertions": assertions, + "metrics": {"peak_rss_bytes": None, "max_process_count": None, "denied_access_count": None}, + "files": [{"path": "frontend/src-tauri/tests/fixtures/fernet-python.json", "sha256": sha256(fixture)}], + "revisions": [], + } + output.write_text(json.dumps(result, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") + return 0 if passed else 1 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/scripts/phase3_acceptance.py b/scripts/phase3_acceptance.py index 840ac6c..2e795b5 100644 --- a/scripts/phase3_acceptance.py +++ b/scripts/phase3_acceptance.py @@ -31,7 +31,13 @@ CASE_SUITES = { ALL_CASES = tuple(case for cases in CASE_SUITES.values() for case in cases) # A case becomes executable only when a repository-owned driver is registered here. # Component/unit test commands are deliberately not treated as production acceptance. -CASE_DRIVERS: dict[str, dict[str, Any]] = {} +CASE_DRIVERS: dict[str, dict[str, Any]] = { + "B-02": { + "driver": "scripts/acceptance_cases/b02_credentials.py", + "timeout_seconds": 900, + "required_metrics": (), + }, +} ENV_NAME = re.compile(r"[A-Z][A-Z0-9_]{2,127}") RUN_ID = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{2,63}") SENSITIVE_KEY = re.compile(r"(?:password|passwd|secret|token|api[_-]?key|credential)", re.I) @@ -122,7 +128,7 @@ def load_config(path: Path, environ: dict[str, str] | None = None) -> dict[str, if config.get("isolated") is not True or config.get("allow_destructive") is not True: raise AcceptanceError("CONFIG_ISOLATION_CONFIRMATION_REQUIRED") run_id = config.get("run_id") - if not isinstance(run_id, str) or not RUN_ID.fullmatch(run_id): + if not isinstance(run_id, str) or not RUN_ID.fullmatch(run_id) or run_id.startswith("replace-"): raise AcceptanceError("CONFIG_RUN_ID_INVALID") profile = config.get("platform_profile") if not isinstance(profile, str) or not profile.strip(): @@ -420,6 +426,26 @@ def _repository_evidence(config: dict[str, Any]) -> dict[str, Any]: return {"commit": commit or None, "lock_sha256": locks, "artifact_sha256": artifacts} +def repository_changes() -> tuple[str, ...]: + paths: set[str] = set() + commands = ( + ["git", "diff", "--name-only", "-z", "--", ".", ":(exclude)backend/data/vault"], + ["git", "diff", "--cached", "--name-only", "-z", "--", ".", ":(exclude)backend/data/vault"], + ["git", "ls-files", "--others", "--exclude-standard", "-z"], + ) + for command in commands: + completed = subprocess.run(command, cwd=ROOT, capture_output=True, check=False) + if completed.returncode != 0: + raise AcceptanceError("SOURCE_STATE_UNAVAILABLE") + for raw in completed.stdout.split(b"\0"): + if not raw: + continue + path = raw.decode("utf-8", errors="replace").replace("\\", "/") + if path != "backend/data/vault" and not path.startswith("backend/data/vault/"): + paths.add(path) + return tuple(sorted(paths)) + + def execute(args: argparse.Namespace, environ: dict[str, str] | None = None) -> int: environ = os.environ if environ is None else environ if args.list_cases: @@ -431,6 +457,10 @@ def execute(args: argparse.Namespace, environ: dict[str, str] | None = None) -> selected = select_cases(args.suite, args.case) config_path = Path(args.config).resolve() config = load_config(config_path, environ) + changes = repository_changes() + if changes: + preview = ",".join(changes[:10]) + raise AcceptanceError(f"SOURCE_TREE_DIRTY: {preview}") if args.suite == "all" and not config.get("platform_profile"): raise AcceptanceError("CONFIG_PLATFORM_PROFILE_REQUIRED") prepare_isolated_root(config)