mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-09 00:40:45 +08:00
oliver
c26dc68f77
Replace auto-grant-on-env with AES-GCM box + passphrase unlock, rebuild fallback sessions after restart, and document seal script usage. Co-authored-by: Cursor <cursoragent@cursor.com>
53 lines
1.8 KiB
JavaScript
53 lines
1.8 KiB
JavaScript
import { describe, it, after } from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import {
|
|
LOCAL_ADMIN_BOX_ENV,
|
|
LOCAL_ADMIN_ENV,
|
|
sealLocalAdminBox,
|
|
openLocalAdminBox,
|
|
isLocalAdminBoxConfigured,
|
|
readLocalAdminBox,
|
|
} from '../lib/local-admin.js'
|
|
|
|
describe('local-admin sealed box', () => {
|
|
const prevBox = process.env[LOCAL_ADMIN_BOX_ENV]
|
|
const prevKey = process.env[LOCAL_ADMIN_ENV]
|
|
|
|
after(() => {
|
|
if (prevBox === undefined) delete process.env[LOCAL_ADMIN_BOX_ENV]
|
|
else process.env[LOCAL_ADMIN_BOX_ENV] = prevBox
|
|
if (prevKey === undefined) delete process.env[LOCAL_ADMIN_ENV]
|
|
else process.env[LOCAL_ADMIN_ENV] = prevKey
|
|
})
|
|
|
|
it('seal + open with correct passphrase', () => {
|
|
const passphrase = 'my-local-secret-key'
|
|
const box = sealLocalAdminBox(passphrase)
|
|
assert.ok(box.length > 40)
|
|
const ok = openLocalAdminBox(box, passphrase)
|
|
assert.equal(ok.ok, true)
|
|
assert.equal(ok.empNo, 'administrator')
|
|
})
|
|
|
|
it('wrong passphrase fails decrypt', () => {
|
|
const box = sealLocalAdminBox('correct-passphrase-xx')
|
|
const bad = openLocalAdminBox(box, 'wrong-passphrase-yyy')
|
|
assert.equal(bad.ok, false)
|
|
assert.equal(bad.reason, 'decrypt_failed')
|
|
})
|
|
|
|
it('env box alone does not imply auto-login; only configures unlock', () => {
|
|
delete process.env[LOCAL_ADMIN_BOX_ENV]
|
|
assert.equal(isLocalAdminBoxConfigured(), false)
|
|
|
|
const box = sealLocalAdminBox('another-strong-key')
|
|
process.env[LOCAL_ADMIN_BOX_ENV] = box
|
|
assert.equal(isLocalAdminBoxConfigured(), true)
|
|
assert.equal(readLocalAdminBox(), box)
|
|
|
|
// Old KEY env must not unlock without decrypt
|
|
process.env[LOCAL_ADMIN_ENV] = 'aaaaaaaaaaaaaaaa'
|
|
const stillNeedDecrypt = openLocalAdminBox(box, process.env[LOCAL_ADMIN_ENV])
|
|
assert.equal(stillNeedDecrypt.ok, false)
|
|
})
|
|
})
|