aaronrene / knowtation public
release-macos-caller-policy.test.mjs
50 lines 2.3 KB
Raw
sha256:c88bf098b52c796e46edc39ec71f9f0627d305439b73972d3fada73cefde0da9 fix: put release binaries before lipo architecture checks Human minor ⚠ breaking 25 days ago
1 import assert from 'node:assert/strict';
2 import fs from 'node:fs';
3 import test from 'node:test';
4
5 test('custody authenticates the XPC message sender and admits only fixed signed identifiers', () => {
6 const identity = fs.readFileSync(
7 'companion/macos/Sources/KnowtationSecurity/CallerIdentity.swift',
8 'utf8'
9 );
10 const contract = fs.readFileSync(
11 'companion/macos/Sources/KnowtationSecurity/ReleaseContract.swift',
12 'utf8'
13 );
14 assert.match(identity, /SecCodeCreateWithXPCMessage/);
15 assert.match(identity, /SecCodeCheckValidity/);
16 assert.doesNotMatch(identity, /processIdentifier/);
17 for (const id of ['store.knowtation.companion', 'store.knowtation.cli', 'store.knowtation.mcp']) {
18 assert.match(contract, new RegExp(id.replaceAll('.', '\\.')));
19 }
20 });
21
22 test('runtime launcher fixes app, Node, and entrypoint paths and strips injection variables', () => {
23 const launcher = fs.readFileSync(
24 'companion/macos/Sources/KnowtationSecurity/RuntimeLauncher.swift',
25 'utf8'
26 );
27 assert.match(launcher, /\/Applications\/Knowtation\.app/);
28 assert.match(launcher, /appendingPathComponent\("runtime"/);
29 assert.match(launcher, /appendingPathComponent\("node\/bin\/node"/);
30 assert.match(launcher, /companion\/runtime\/main\.mjs/);
31 assert.match(launcher, /expectedIdentifier: KnowtationReleaseContract\.appIdentifier/);
32 assert.match(launcher, /expectedIdentifier: KnowtationReleaseContract\.nodeIdentifier/);
33 assert.match(launcher, /NODE_OPTIONS/);
34 assert.match(launcher, /KNOWTATION_HUB_TOKEN/);
35 assert.match(launcher, /NODE_EXTRA_CA_CERTS/);
36 assert.match(launcher, /HTTPS_PROXY/);
37 assert.match(launcher, /\/usr\/bin:\/bin:\/usr\/sbin:\/sbin:\/usr\/local\/bin:\/opt\/homebrew\/bin/);
38 assert.match(launcher, /DYLD_/);
39 assert.doesNotMatch(launcher, /--script|scriptPath/);
40 });
41
42 test('custody uses device-bound Keychain storage and never logs values', () => {
43 const agent = fs.readFileSync('companion/macos/Sources/KnowtationCustodyAgent/main.swift', 'utf8');
44 assert.match(agent, /kSecAttrAccessibleWhenUnlockedThisDeviceOnly/);
45 assert.match(agent, /kSecUseDataProtectionKeychain/);
46 assert.match(agent, /kSecAttrAccessGroup/);
47 assert.match(agent, /allowedAccounts\.contains/);
48 assert.doesNotMatch(agent, /print\(/);
49 assert.doesNotMatch(agent, /NSLog/);
50 });
File History 1 commit
sha256:c88bf098b52c796e46edc39ec71f9f0627d305439b73972d3fada73cefde0da9 fix: put release binaries before lipo architecture checks Human minor ⚠ 25 days ago