fix(mcp): довести базовые сценарии и проверку маршрутизации
This commit is contained in:
Codex committed
1 parent
1f0704add0
commit
04225886e0
101 files changed
+6118
-329
No files matched your search
+10
-1
@@ -1,7 +1,16 @@
|
||||
@import "tailwindcss";
|
||||
@import "tailwindcss" source(none);
|
||||
@import "tw-animate-css";
|
||||
@import "shadcn/tailwind.css";
|
||||
|
||||
/* Scan application sources only; local test archives and generated bundles
|
||||
must not become utility classes in the production stylesheet. */
|
||||
@source "./";
|
||||
@source "../components";
|
||||
@source "../entities";
|
||||
@source "../hooks";
|
||||
@source "../lib";
|
||||
@source "../shared";
|
||||
|
||||
/* SVG focus follows the object shape, never the text/foreignObject bounding box. */
|
||||
.network-map-focusable {
|
||||
outline: none;
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
-- Keep the live charge and intent fences in sync with recovery action v8.
|
||||
-- Existing authenticated v6/v7 history remains unchanged.
|
||||
BEGIN;
|
||||
CREATE OR REPLACE FUNCTION public.mcp_routing_manual_inverse_charge_source() RETURNS trigger LANGUAGE plpgsql AS $$
|
||||
BEGIN
|
||||
IF NOT EXISTS(
|
||||
SELECT 1 FROM public.mcp_operations o
|
||||
JOIN public.mcp_plans p ON p.id=o.plan_id AND p.connection_id=o.connection_id
|
||||
JOIN public.mcp_routing_profiles r ON r.id=NEW.profile_id AND r.connection_id=o.connection_id
|
||||
JOIN public.mcp_operations source ON source.id=NEW.source_operation_id AND source.connection_id=o.connection_id
|
||||
JOIN public.mcp_plans sp ON sp.id=source.plan_id AND sp.connection_id=source.connection_id
|
||||
JOIN public.mcp_connections c ON c.id=o.connection_id
|
||||
WHERE o.id=NEW.recovery_operation_id AND p.id=NEW.recovery_plan_id
|
||||
AND o.connection_id=NEW.connection_id AND c.owner_id=NEW.owner_id
|
||||
AND r.version=NEW.profile_version AND o.state='pending' AND p.state='executing'
|
||||
AND p.operation_id='operations.recover' AND p.operation_version=8
|
||||
AND sp.id=NEW.source_plan_id AND sp.operation_id='routing.community.switch' AND sp.operation_version=7
|
||||
AND source.state IN('applied','partial')
|
||||
) THEN RAISE EXCEPTION 'manual inverse charge differs from pending admission'; END IF;
|
||||
RETURN NEW;
|
||||
END $$;
|
||||
CREATE OR REPLACE FUNCTION public.mcp_scoped_recovery_manual_version() RETURNS trigger LANGUAGE plpgsql AS $$
|
||||
BEGIN
|
||||
IF NEW.mode='manual' AND NOT pg_try_advisory_xact_lock(hashtextextended('mcp-runner-admission',0))
|
||||
THEN RAISE EXCEPTION 'manual intent admission snapshot busy'; END IF;
|
||||
IF NEW.mode='manual' AND NOT EXISTS(
|
||||
SELECT 1 FROM public.mcp_operations o
|
||||
JOIN public.mcp_plans p ON p.id=o.plan_id AND p.connection_id=o.connection_id
|
||||
JOIN public.mcp_operation_steps s ON s.operation_id=o.id AND s.step_index=0
|
||||
JOIN public.mcp_operations source ON source.id=NEW.source_operation_id AND source.connection_id=o.connection_id
|
||||
WHERE o.id=NEW.recovery_operation_id AND o.state='running'
|
||||
AND p.state='executing' AND p.operation_id='operations.recover' AND p.operation_version=8
|
||||
AND NEW.source_step_index=0 AND s.state='intent'
|
||||
AND s.intended_state->>'kind'='service'
|
||||
AND s.intended_state->>'service'='routing.community.scoped.recover'
|
||||
AND s.intended_state->'input'->>'mode'='manual'
|
||||
AND s.intended_state->'input'->>'sourceOperationId'=NEW.source_operation_id::text
|
||||
AND s.intended_state->'input'->>'receiptId'=NEW.recovery_receipt_id::text
|
||||
) THEN RAISE EXCEPTION 'manual inverse requires current exact running recovery'; END IF;
|
||||
RETURN NEW;
|
||||
END $$;
|
||||
INSERT INTO public.schema_migrations(id) VALUES('0056_mcp_manual_inverse_recovery_v8') ON CONFLICT(id) DO NOTHING;
|
||||
COMMIT;
|
||||
@@ -597,6 +597,13 @@
|
||||
"operations": [],
|
||||
"reason": "Управление самим MCP, транспорт или машинная авторизация: отдельного AI-инструмента нет."
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "/api/mcp/devices/:serverId/bridge-vlan/configuration",
|
||||
"status": "mediated",
|
||||
"operations": ["network.bridge-vlan.read"],
|
||||
"reason": "Чтение связанной конфигурации bridge/VLAN через общую типизированную модель и проверку доступа MCP."
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "/api/mcp/drift",
|
||||
@@ -1611,6 +1618,13 @@
|
||||
"operations": [],
|
||||
"reason": "Управление самим MCP, транспорт или машинная авторизация: отдельного AI-инструмента нет."
|
||||
},
|
||||
{
|
||||
"method": "POST",
|
||||
"path": "/api/mcp/devices/:serverId/bridge-vlan/configuration/plan",
|
||||
"status": "mediated",
|
||||
"operations": ["network.bridge-vlan.configure"],
|
||||
"reason": "Подготовка связанного плана bridge/VLAN через тот же MCP-инструмент; выполнение требует человеческого подтверждения."
|
||||
},
|
||||
{
|
||||
"method": "POST",
|
||||
"path": "/api/mcp/management-channels",
|
||||
|
||||
@@ -0,0 +1,73 @@
|
||||
/** External SDK consumer. No application/store/runtime/database imports. */
|
||||
import assert from 'node:assert/strict'
|
||||
import { randomUUID } from 'node:crypto'
|
||||
import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client'
|
||||
|
||||
const endpoint = new URL(process.env.OWN_MCP_ENDPOINT)
|
||||
assert.equal(process.env.OWN_EXTERNAL_CLIENT, 'true')
|
||||
assert.equal(endpoint.hostname, '127.0.0.1')
|
||||
assert.notEqual(process.pid, Number(process.env.OWN_SERVER_PID))
|
||||
const client = new Client({ name: 'owned-linked-bridge-vlan-sdk', version: '1.0.0' })
|
||||
const boundedFetch = async (input, init) => {
|
||||
const url = new URL(typeof input === 'string' || input instanceof URL ? input : input.url)
|
||||
assert.equal(url.origin, endpoint.origin)
|
||||
return fetch(input, { ...init, redirect: 'manual', signal: AbortSignal.timeout(10000) })
|
||||
}
|
||||
const payload = result => {
|
||||
const text = result.content.find(item => item.type === 'text')?.text
|
||||
assert(text && Buffer.byteLength(text) < 131072)
|
||||
return JSON.parse(text)
|
||||
}
|
||||
const call = async (name, args) => {
|
||||
const result = await client.callTool({ name, arguments: args }, undefined, { timeout: 10000 })
|
||||
assert(!result.isError, JSON.stringify(payload(result)))
|
||||
return payload(result)
|
||||
}
|
||||
try {
|
||||
await client.connect(new StreamableHTTPClientTransport(endpoint, {
|
||||
requestInit: { headers: { authorization: 'Bearer ' + process.env.OWN_MCP_TOKEN } }, fetch: boundedFetch,
|
||||
}), { timeout: 10000 })
|
||||
const tools = (await client.listTools({}, { timeout: 10000 })).tools
|
||||
const read = tools.find(tool => tool.name === 'mm_bridge_vlan_configuration_get')
|
||||
const configure = tools.find(tool => tool.name === 'mm_bridge_vlan_configuration_plan')
|
||||
assert(read && configure)
|
||||
assert.match(read.description, /Полная конфигурация bridge VLAN/)
|
||||
assert.match(read.description, /Возвращает данные только из разрешённой области/)
|
||||
assert.match(configure.description, /Связанный план VLAN membership, PVID и bridge filtering/)
|
||||
assert.match(configure.description, /Подготавливает неизменяемый план/)
|
||||
assert.equal(read.annotations.readOnlyHint, true)
|
||||
assert.equal(configure.annotations.readOnlyHint, false)
|
||||
assert.deepEqual(read.inputSchema.required, ['serverId'])
|
||||
assert.deepEqual(configure.inputSchema.required, ['serverId', 'bridgeId', 'desired'])
|
||||
const desiredSchema = configure.inputSchema.properties.desired
|
||||
for (const name of ['ports', 'vlans', 'removePortIds', 'removeVlanIds']) assert(desiredSchema.properties[name])
|
||||
const serverId = Number(process.env.OWN_ALLOWED_SERVER)
|
||||
const state = (await call(read.name, { serverId })).state
|
||||
assert.equal(state.bridges[0]['.id'], '*1')
|
||||
assert(state.interfaces.some(item => item.resource === 'ethernet' && item.id === '*3' && item.name === 'ether3'))
|
||||
assert.equal(state.vlans[0]['vlan-ids'], '10')
|
||||
const cpu = { resource: 'bridge', id: '*1' }, access = { resource: 'ethernet', id: '*2' }, trunk = { resource: 'ethernet', id: '*3' }
|
||||
const plan = await call(configure.name, { serverId, bridgeId: '*1', desired: {
|
||||
filtering: true, pvid: 1,
|
||||
ports: [{ id: '*10', interface: access, pvid: 10, ingressFiltering: true, frameTypes: 'admit-all', disabled: false },
|
||||
{ interface: trunk, pvid: 1, ingressFiltering: true, frameTypes: 'admit-only-vlan-tagged', disabled: false }],
|
||||
vlans: [{ id: '*11', vlanIds: '10', tagged: [cpu], untagged: [access], disabled: false },
|
||||
{ vlanIds: '20', tagged: [cpu, trunk], untagged: [], disabled: false }], removePortIds: [], removeVlanIds: [],
|
||||
} })
|
||||
assert.equal(plan.state, 'awaiting-approval')
|
||||
assert.equal(typeof plan.planId, 'string')
|
||||
assert.equal(plan.changes.requiresHuman, true)
|
||||
assert.deepEqual(plan.changes.steps.map(item => [item.step.resource, item.step.action]),
|
||||
[['bridge_vlan', 'create'], ['bridge_port', 'create'], ['bridge', 'update']])
|
||||
const denied = await client.callTool({ name: 'mm_change_apply', arguments: { planId: plan.planId, idempotencyKey: randomUUID() } }, undefined, { timeout: 10000 })
|
||||
assert.equal(denied.isError, true)
|
||||
const deniedPayload = payload(denied)
|
||||
assert(JSON.stringify(deniedPayload).includes('APPROVAL_REQUIRED'))
|
||||
const readback = (await call(read.name, { serverId })).state
|
||||
assert.deepEqual(readback, state)
|
||||
process.send({ kind: 'result', result: { externalSdkProcess: true, transport: 'streamable-http', clientPid: process.pid,
|
||||
listedTools: [read, configure], state, plan, applyDenial: deniedPayload, unchangedReadback: true } })
|
||||
} finally {
|
||||
await client.close()
|
||||
process.disconnect?.()
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
import assert from 'node:assert/strict'
|
||||
import { spawn } from 'node:child_process'
|
||||
import { createServer } from 'node:http'
|
||||
import { writeFile } from 'node:fs/promises'
|
||||
import { fileURLToPath, pathToFileURL } from 'node:url'
|
||||
import { isAbsolute, resolve } from 'node:path'
|
||||
|
||||
assert.equal(process.env.OWN_EXTERNAL_PROCESS_PG, 'true')
|
||||
assert.equal(process.env.NODE_ENV, 'test')
|
||||
assert(isAbsolute(process.env.OWN_EXTERNAL_SOURCE_ROOT!))
|
||||
assert(isAbsolute(process.env.OWN_EXTERNAL_RESULT_FILE!))
|
||||
const database = new URL(process.env.DATABASE_URL!)
|
||||
assert.equal(database.hostname, '127.0.0.1'); assert.equal(database.username, 'mcp_test')
|
||||
assert.equal(database.pathname, '/postgres'); assert.notEqual(database.port, '5432')
|
||||
const source = (path: string) => pathToFileURL(resolve(process.env.OWN_EXTERNAL_SOURCE_ROOT!, 'backend/src', path)).href
|
||||
const rows: Record<string, Record<string, string>[]> = {
|
||||
'/interface/ethernet': [{ '.id': '*2', name: 'ether2', disabled: 'false' }, { '.id': '*3', name: 'ether3', disabled: 'false' }, { '.id': '*4', name: 'ether-mgmt', disabled: 'false' }],
|
||||
'/interface/bridge': [{ '.id': '*1', name: 'br-users', pvid: '1', 'vlan-filtering': 'false', 'frame-types': 'admit-all', 'ingress-filtering': 'true', mvrp: 'false', disabled: 'false' }],
|
||||
'/interface/bridge/port': [{ '.id': '*10', bridge: 'br-users', interface: 'ether2', pvid: '10', 'ingress-filtering': 'true', 'frame-types': 'admit-all', disabled: 'false' }],
|
||||
'/interface/bridge/vlan': [{ '.id': '*11', bridge: 'br-users', 'vlan-ids': '10', tagged: 'br-users', untagged: 'ether2', disabled: 'false', dynamic: 'false' }],
|
||||
'/interface/vlan': [], '/interface/gre': [], '/interface/wireguard': [], '/interface/vxlan': [],
|
||||
'/ip/address': [{ '.id': '*20', interface: 'ether-mgmt', address: '127.0.0.1/8', disabled: 'false', dynamic: 'false' }], '/ipv6/address': [],
|
||||
}
|
||||
const requests: string[] = []
|
||||
let writeAttempts = 0
|
||||
const router = createServer((req, res) => {
|
||||
res.setHeader('content-type', 'application/json')
|
||||
const path = decodeURIComponent(new URL(req.url!, 'http://127.0.0.1').pathname.replace(/^\/rest/, ''))
|
||||
requests.push(req.method + ' ' + path)
|
||||
if (req.method !== 'GET') { writeAttempts++; res.writeHead(405); res.end('{}'); return }
|
||||
if (req.headers.authorization !== 'Basic ' + Buffer.from('fixture:fixture-only').toString('base64')) { res.writeHead(401); res.end('{}'); return }
|
||||
if (!Object.hasOwn(rows, path)) { res.writeHead(404); res.end('{}'); return }
|
||||
res.end(JSON.stringify(rows[path]))
|
||||
})
|
||||
await new Promise<void>(done => router.listen(0, '127.0.0.1', done))
|
||||
const { pool, closePool } = await import(source('db/index.js'))
|
||||
const { applySqlMigrations } = await import(source('db/migrate.js'))
|
||||
const { mcpConnectionCreateSchema } = await import('@mmapp/contracts/mcp')
|
||||
const { createMcpConnection, updateMcpSettings } = await import(source('modules/mcp/store.js'))
|
||||
const { buildApp } = await import(source('index.js'))
|
||||
const actor = { id: 'owned-bridge-vlan-sdk-owner', email: 'bridge-sdk@example.invalid', name: 'Owned bridge VLAN SDK owner', apps: ['mm'], permissions: ['mm:settings:admin', 'mm:mcp:admin', 'mm:network:admin', 'mm:servers:admin'], expiresAt: Date.now() + 3600000, issuedAt: Date.now() - 1000 }
|
||||
let app: Awaited<ReturnType<typeof buildApp>> | undefined
|
||||
let child: ReturnType<typeof spawn> | undefined
|
||||
let childExit: Promise<number> | undefined
|
||||
try {
|
||||
await applySqlMigrations(pool)
|
||||
const serverId = (await pool.query("INSERT INTO servers(name,host,port,use_ssl,enabled,username,password) VALUES('owned bridge VLAN SDK','127.0.0.1',$1,false,true,'fixture','fixture-only') RETURNING id", [(router.address() as { port: number }).port])).rows[0].id
|
||||
await updateMcpSettings({ enabled: true }, actor)
|
||||
app = await buildApp({ startScheduler: false, logger: false })
|
||||
await app.listen({ host: '127.0.0.1', port: 0 })
|
||||
const endpoint = `http://127.0.0.1:${(app.server.address() as { port: number }).port}/mcp`
|
||||
const issued = await createMcpConnection(mcpConnectionCreateSchema.parse({ name: 'Owned bridge VLAN external SDK', mode: 'autonomous',
|
||||
expiresAt: new Date(Date.now() + 1200000).toISOString(), permissions: ['mm:network:write'],
|
||||
scope: { serverIds: [serverId], operationIds: ['network.bridge-vlan.read', 'network.bridge-vlan.configure', 'changes.apply'], allowGlobal: false },
|
||||
limits: { callsPerMinute: 120, mutationsPerHour: 100 } }), actor)
|
||||
let result: unknown, stdout = '', stderr = ''
|
||||
child = spawn(process.execPath, [fileURLToPath(new URL('./bridge-vlan-client.mjs', import.meta.url))], { cwd: process.cwd(), windowsHide: true,
|
||||
stdio: ['ignore', 'pipe', 'pipe', 'ipc'], env: { ...Object.fromEntries(['SystemRoot', 'WINDIR', 'TEMP', 'TMP', 'PATH', 'Path'].filter(k => process.env[k]).map(k => [k, process.env[k]!])),
|
||||
OWN_EXTERNAL_CLIENT: 'true', OWN_MCP_ENDPOINT: endpoint, OWN_MCP_TOKEN: issued.token, OWN_SERVER_PID: String(process.pid), OWN_ALLOWED_SERVER: String(serverId) } })
|
||||
child.on('message', (message: { kind: string; result?: unknown }) => { if (message.kind === 'result') result = message.result })
|
||||
child.stdout?.on('data', chunk => { stdout += String(chunk); if (stdout.length > 1048576) child?.kill() })
|
||||
child.stderr?.on('data', chunk => { stderr += String(chunk); if (stderr.length > 1048576) child?.kill() })
|
||||
childExit = new Promise<number>((done, reject) => { child!.once('exit', code => done(code ?? 1)); child!.once('error', reject) })
|
||||
const timeout = setTimeout(() => child?.kill(), 60000)
|
||||
const code = await childExit; clearTimeout(timeout)
|
||||
assert.equal(code, 0, stderr.slice(0, 3000)); assert(result)
|
||||
assert.equal(writeAttempts, 0)
|
||||
assert.equal((await pool.query('SELECT count(*)::int AS count FROM mcp_operations')).rows[0].count, 0)
|
||||
const plans = (await pool.query('SELECT operation_id,state,approved_by FROM mcp_plans')).rows
|
||||
assert.equal(plans.length, 1); assert.equal(plans[0].operation_id, 'network.bridge-vlan.configure')
|
||||
assert.equal(plans[0].state, 'awaiting-approval'); assert.equal(plans[0].approved_by, null)
|
||||
const audit = (await pool.query('SELECT tool,status,error_code FROM mcp_requests ORDER BY created_at')).rows
|
||||
assert(audit.some(row => row.error_code === 'APPROVAL_REQUIRED'))
|
||||
const serialized = JSON.stringify({ result, stdout, stderr, audit })
|
||||
assert(!serialized.includes(issued.token)); assert(!serialized.includes('fixture-only'))
|
||||
const final = { ...(result as object), actualOwnPg: true, actualProductionHttpServer: true, serverFixturePid: process.pid,
|
||||
connectionMode: 'autonomous', plans, audit, nativeReadRequests: requests, nativeWriteAttempts: writeAttempts,
|
||||
appliedOperations: 0, syntheticRouterOnly: true, productionDatabaseTouched: false, portalContacted: false }
|
||||
await writeFile(process.env.OWN_EXTERNAL_RESULT_FILE!, JSON.stringify(final, null, 2))
|
||||
console.log('Owned bridge VLAN SDK passed:', JSON.stringify({ listedTools: 2, planState: plans[0].state, nativeReadRequests: requests.length, nativeWriteAttempts: writeAttempts }))
|
||||
} finally {
|
||||
if (child && child.exitCode === null && child.signalCode === null) { child.kill(); await childExit }
|
||||
try { await app?.close() } finally { try { await closePool() } finally { router.closeIdleConnections(); await new Promise<void>((done, reject) => router.close(error => error ? reject(error) : done())) } }
|
||||
}
|
||||
@@ -6,10 +6,14 @@ import { randomBytes, createHash } from 'node:crypto'
|
||||
import { createServer } from 'node:net'
|
||||
import { spawn } from 'node:child_process'
|
||||
const sourceRoot = resolve(process.argv[2] ?? fileURLToPath(new URL('../../../', import.meta.url)))
|
||||
const output = resolve(sourceRoot, 'tmp/mcp-external-process-acceptance'); await mkdir(output, { recursive: true })
|
||||
const scenario = process.argv[3] ?? 'acceptance'
|
||||
if (!['acceptance', 'bridge-vlan'].includes(scenario)) throw Error('Unsupported owned external scenario')
|
||||
const output = resolve(sourceRoot, scenario === 'bridge-vlan' ? 'tmp/mcp-bridge-vlan-sdk-20261105' : 'tmp/mcp-external-process-acceptance'); await mkdir(output, { recursive: true })
|
||||
const paths = ['backend/src/scripts/mcp-stdio.ts', 'backend/src/routes/mcp-transport.ts', 'backend/src/routes/mcp-oauth.ts', 'backend/src/modules/mcp/store.ts',
|
||||
'backend/src/modules/mcp/runtime.ts', 'backend/src/modules/mcp/actions.ts', 'backend/src/modules/mcp/security.ts', 'backend/src/modules/mcp/protocol-limits.ts',
|
||||
'backend/src/modules/mcp/portal-revocation.ts', 'backend/src/plugins/auth.ts', 'backend/src/index.ts', 'node_modules/@modelcontextprotocol/client/package.json', 'node_modules/@modelcontextprotocol/server/package.json']
|
||||
if (scenario === 'bridge-vlan') paths.push('backend/scripts/mcp-external-process/bridge-vlan-client.mjs', 'backend/scripts/mcp-external-process/bridge-vlan-fixture.ts',
|
||||
'backend/src/modules/mcp/bridge-vlan-actions.ts', 'backend/src/services/bridge-vlan-configuration.ts', 'packages/contracts/src/bridge-vlan.ts')
|
||||
async function pins() { const result = []; for (const path of paths) result.push({ path, sha256: createHash('sha256').update(await readFile(resolve(sourceRoot, path))).digest('hex') }); return result }
|
||||
const before = await pins(), directory = await mkdtemp(join(resolve(sourceRoot, 'tmp'), 'mm-mcp-external-')), state = join(directory, 'state'); await mkdir(state)
|
||||
const listener = createServer(); await new Promise(resolve => listener.listen(0, '127.0.0.1', resolve)); const port = listener.address().port; await new Promise(resolve => listener.close(resolve))
|
||||
@@ -19,7 +23,7 @@ const postgres = new EmbeddedPostgres({ databaseDir: join(directory, 'pg'), port
|
||||
try {
|
||||
await postgres.initialise(); await postgres.start()
|
||||
process.exitCode = await new Promise((done, reject) => {
|
||||
const child = spawn(process.execPath, ['--import', import.meta.resolve('tsx'), fileURLToPath(new URL('./server-fixture.ts', import.meta.url))], { cwd: directory,
|
||||
const child = spawn(process.execPath, ['--import', import.meta.resolve('tsx'), fileURLToPath(new URL(scenario === 'bridge-vlan' ? './bridge-vlan-fixture.ts' : './server-fixture.ts', import.meta.url))], { cwd: directory,
|
||||
windowsHide: true, stdio: 'inherit', env: { ...Object.fromEntries(['SystemRoot', 'WINDIR', 'TEMP', 'TMP', 'PATH', 'Path'].filter(k => process.env[k]).map(k => [k, process.env[k]])),
|
||||
OWN_EXTERNAL_CLEANUP_FAULT: process.env.OWN_EXTERNAL_CLEANUP_FAULT, OWN_EXTERNAL_SOURCE_ROOT: sourceRoot, OWN_EXTERNAL_RESULT_FILE: join(output, 'result.json'), NODE_ENV: 'test', OWN_EXTERNAL_PROCESS_PG: 'true', DATABASE_URL: `postgresql://mcp_test:${password}@127.0.0.1:${port}/postgres`, DATABASE_PATH: join(directory, 'no-legacy.sqlite'),
|
||||
MCP_STATE_DIR: state, AUTH_REQUIRED: 'true', AUTH_JWT_SECRET: 'owned-external-synthetic-issuer-test-only', AUTH_ISSUER: 'https://synthetic-portal.invalid', AUTH_PORTAL_URL: 'https://synthetic-portal.invalid' } })
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { createHash } from "node:crypto"
|
||||
import { spawn } from "node:child_process"
|
||||
import { createServer } from "node:net"
|
||||
import { fileURLToPath, pathToFileURL } from "node:url"
|
||||
@@ -49,6 +50,61 @@ try {
|
||||
await updateMcpSettings({ enabled: true }, actor)
|
||||
app = await buildApp({ startScheduler: false, logger: false }); await app.listen({ port, host: "127.0.0.1" })
|
||||
const jwt = await new SignJWT({ sub: actor.id, apps: actor.apps, permissions: actor.permissions }).setProtectedHeader({ alg: "HS256" }).setIssuer(env.authIssuer).setIssuedAt().setExpirationTime("1h").sign(new TextEncoder().encode(env.jwtSecret))
|
||||
const portalHeaders = { authorization: `Bearer ${jwt}`, "content-type": "application/json" }
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS count FROM mcp_connections WHERE owner_id=$1", [actor.id])).rows[0].count, 0)
|
||||
const callback = "http://localhost:45678/callback?registered=1"
|
||||
const registration = await fetch(origin + "/api/mcp/oauth/clients", { method: "POST", headers: portalHeaders,
|
||||
body: JSON.stringify({ name: "Owned denial fixture", redirectUris: [callback] }) })
|
||||
assert.equal(registration.status, 200)
|
||||
const { clientId } = await registration.json() as { clientId: string }
|
||||
const consent = (payload: Record<string, unknown>, headers = portalHeaders) => fetch(origin + "/api/mcp/oauth/consent", { method: "POST", headers, body: JSON.stringify(payload) })
|
||||
const authorize = async (state: string) => {
|
||||
const parameters = new URLSearchParams({ client_id: clientId, redirect_uri: callback, response_type: "code", resource: endpoint,
|
||||
code_challenge_method: "S256", code_challenge: createHash("sha256").update("v".repeat(64)).digest("base64url"), state })
|
||||
const response = await fetch(`${origin}/oauth/authorize?${parameters}`, { redirect: "manual" })
|
||||
assert.equal(response.status, 302)
|
||||
const requestId = new URL(response.headers.get("location")!).searchParams.get("oauthRequest")
|
||||
assert.ok(requestId)
|
||||
return requestId
|
||||
}
|
||||
const requestId = await authorize("deny-without-connection")
|
||||
assert.equal((await consent({ requestId, approve: false }, { ...portalHeaders, authorization: "" })).status, 401)
|
||||
assert.equal((await consent({ requestId, approve: true })).status, 400)
|
||||
const refusals = await Promise.all([consent({ requestId, approve: false }), consent({ requestId, approve: false })])
|
||||
assert.deepEqual(refusals.map(response => response.status).sort(), [200, 404])
|
||||
const { redirectUrl } = await refusals.find(response => response.status === 200)!.json() as { redirectUrl: string }
|
||||
const redirect = new URL(redirectUrl)
|
||||
const expected = new URL(callback)
|
||||
expected.searchParams.set("state", "deny-without-connection")
|
||||
expected.searchParams.set("iss", origin)
|
||||
expected.searchParams.set("error", "access_denied")
|
||||
assert.equal(redirect.href, expected.href)
|
||||
const otherOwner = { ...actor, id: "owned-external-process-other-owner" }
|
||||
const unrelated = await createMcpConnection(mcpConnectionCreateSchema.parse({ name: "Unrelated paused connection", mode: "observer",
|
||||
expiresAt: new Date(Date.now() + 600000).toISOString(), permissions: ["mm:servers:read"],
|
||||
scope: { serverIds: [Number(allowed)], operationIds: ["servers.list"], allowGlobal: false } }), otherOwner)
|
||||
await setConnectionStatus(unrelated.connection.id, "paused", otherOwner)
|
||||
const legacyRequestId = await authorize("legacy-denial")
|
||||
const legacy = await consent({ requestId: legacyRequestId, connectionId: unrelated.connection.id, approve: false })
|
||||
assert.equal(legacy.status, 200)
|
||||
assert.equal((await consent({ requestId: legacyRequestId, connectionId: unrelated.connection.id, approve: false })).status, 404)
|
||||
const expired = await createMcpConnection(mcpConnectionCreateSchema.parse({ name: "Expired connection", mode: "observer",
|
||||
expiresAt: new Date(Date.now() + 600000).toISOString(), permissions: ["mm:servers:read"],
|
||||
scope: { serverIds: [Number(allowed)], operationIds: ["servers.list"], allowGlobal: false } }), actor)
|
||||
await pool.query("UPDATE mcp_connections SET policy=jsonb_set(policy,'{expiresAt}',to_jsonb($2::text)) WHERE id=$1", [expired.connection.id, "2000-01-01T00:00:00Z"])
|
||||
const expiredRequestId = await authorize("expired-approval")
|
||||
assert.equal((await consent({ requestId: expiredRequestId, connectionId: expired.connection.id, approve: true })).status, 403)
|
||||
const expiredRequest = (await pool.query("SELECT consumed_at,code_digest,connection_id FROM mcp_oauth_requests WHERE id=$1", [expiredRequestId])).rows[0]
|
||||
assert.deepEqual(expiredRequest, { consumed_at: null, code_digest: null, connection_id: null })
|
||||
assert.equal((await consent({ requestId: expiredRequestId, approve: false })).status, 200)
|
||||
const deniedRows = (await pool.query("SELECT consumed_at,code_digest,connection_id FROM mcp_oauth_requests WHERE client_id=$1", [clientId])).rows
|
||||
assert.equal(deniedRows.length, 3)
|
||||
assert(deniedRows.every(row => row.consumed_at instanceof Date && row.code_digest === null && row.connection_id === null))
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS count FROM mcp_credentials WHERE client_id=$1", [clientId])).rows[0].count, 0)
|
||||
const denialAudit = (await pool.query("SELECT actor_id,connection_id,payload FROM mcp_audit WHERE action='oauth.consent' AND payload->>'clientId'=$1", [clientId])).rows
|
||||
assert.equal(denialAudit.length, 3)
|
||||
assert(denialAudit.every(row => row.actor_id === actor.id && row.connection_id === null && row.payload.approved === false))
|
||||
console.log("OAuth consent: expired approval refused before code issuance, denial uses exact redirect and one-use request without credentials")
|
||||
const transcript: unknown[] = []; let failure: unknown, result: unknown
|
||||
child = spawn(process.execPath, [fileURLToPath(new URL("./client.mjs", import.meta.url))], { cwd: process.cwd(), windowsHide: true, stdio: ["ignore", "pipe", "pipe", "ipc"],
|
||||
env: { ...Object.fromEntries(["SystemRoot", "WINDIR", "TEMP", "TMP", "PATH", "Path"].filter(k => process.env[k]).map(k => [k, process.env[k]!])),
|
||||
@@ -90,7 +146,8 @@ try {
|
||||
const logs = JSON.stringify((await pool.query("SELECT tool,input,result,error_code FROM mcp_requests ORDER BY created_at")).rows)
|
||||
for (const token of [...credentials, jwt, secret]) { assert(!logs.includes(token)); assert(!stdout.includes(token)); assert(!stderr.includes(token)) }
|
||||
const final = { ...(result as object), actualOwnPg: true, actualProductionHttpServer: true, serverFixturePid: process.pid,
|
||||
controlTransitions: transcript, auditCredentialLeakAbsent: true, nativeRouterCalls: 0, productionDatabaseTouched: false }
|
||||
controlTransitions: transcript, auditCredentialLeakAbsent: true, denialWithoutConnection: true,
|
||||
legacyDenialIgnoresPausedForeignConnection: true, nativeRouterCalls: 0, productionDatabaseTouched: false }
|
||||
await writeFile(process.env.OWN_EXTERNAL_RESULT_FILE!, JSON.stringify(final, null, 2))
|
||||
console.log("Owned external process SDK result:", JSON.stringify(final))
|
||||
} finally {
|
||||
|
||||
@@ -38,6 +38,7 @@ export function projectVrfDiagnostics(log, privateValues = [], expectedSlice = n
|
||||
if (Array.isArray(value.accepted)) { row.finalCaseCount = value.accepted.length; if (expectedSlice !== null && value.slice === expectedSlice) finalComponentPresent = true }
|
||||
if (['planned','queued','running','applied','failed','cancelled','unknown','expired','rejected','unconfirmed'].includes(value.operationState)) row.operationState = value.operationState
|
||||
for (const key of ['phase', 'elapsedMs', 'nativeReads', 'nativeWrites', 'roundTrips', 'lastSqlMs', 'totalSqlMs', 'maxSqlMs']) if (Number.isSafeInteger(value[key]) && value[key] >= 0) row[key] = value[key]
|
||||
if (Number.isSafeInteger(value.wireguardPeerTelemetryTicks) && value.wireguardPeerTelemetryTicks > 0 && value.wireguardPeerTelemetryTicks <= 10000) row.wireguardPeerTelemetryTicks = value.wireguardPeerTelemetryTicks
|
||||
if (value.diagnosticWaitSql === true) row.diagnosticWaitSql = true
|
||||
if (value.diagnosticError === true) { row.diagnosticError = true; row.safeName = diagnosticNames.has(value.safeName) ? value.safeName : 'other'; row.safeCode = diagnosticCodes.has(value.safeCode) ? value.safeCode : 'other' }
|
||||
if (!Object.keys(row).length) { omittedLines++; continue }
|
||||
@@ -47,10 +48,10 @@ export function projectVrfDiagnostics(log, privateValues = [], expectedSlice = n
|
||||
}
|
||||
export function vrfSliceDiagnostic(result, log, childBudgetMs, privateValues = []) {
|
||||
assert(result && typeof result === 'object')
|
||||
assert(['baseline','physical','vlan','disabled','mixed','reconcile','sql-journal','guards','coexistence','alias'].includes(result.slice))
|
||||
assert(['baseline','physical','vlan','disabled','mixed','reconcile','sql-journal','guards','coexistence','alias','gre'].includes(result.slice))
|
||||
assert(Number.isSafeInteger(result.code) && typeof result.childExitConfirmed === 'boolean')
|
||||
assert(Number.isSafeInteger(result.caseCount) && result.caseCount >= 0)
|
||||
assert.equal(childBudgetMs, result.slice === 'baseline' ? 240000 : 120000)
|
||||
assert.equal(childBudgetMs, result.slice === 'baseline' ? 240000 : result.slice === 'disabled' ? 180000 : 120000)
|
||||
assert(result.failure === null || ['child-deadline','child-log-limit','child-signal','child-error','child-error-after-pid','child-exit-unconfirmed','missing-component-receipt'].includes(result.failure))
|
||||
assert(result.accepted === (result.code === 0 && result.failure === null && result.childExitConfirmed))
|
||||
return { ...result, capMs: childBudgetMs, diagnostics: projectVrfDiagnostics(log, privateValues, result.slice), scope: 'same-owned-PG-test-only', actualRouter: false, forwardingVerified: false }
|
||||
@@ -88,10 +89,14 @@ export async function runOwnedVrfProductionProfile({ directory, database, databa
|
||||
const report = fileURLToPath(new URL('../../docs/mcp-chr-vrf-companion-native-v5.json', import.meta.url))
|
||||
const loader = pathToFileURL(createRequire(import.meta.url).resolve('tsx')).href
|
||||
const safe = Object.fromEntries(['SystemRoot', 'WINDIR', 'TEMP', 'TMP', 'LANG', 'LC_ALL'].filter(key => typeof process.env[key] === 'string').map(key => [key, process.env[key]]))
|
||||
for (const slice of ['baseline', 'physical', 'vlan', 'disabled', 'mixed', 'reconcile', 'sql-journal', 'guards', 'coexistence', 'alias']) {
|
||||
// Diagnose the disabled lifecycle first, then the synthetic GRE extension.
|
||||
// Every original case remains required by the same full74 gate and caps.
|
||||
for (const slice of ['disabled', 'gre', 'baseline', 'physical', 'vlan', 'mixed', 'reconcile', 'sql-journal', 'guards', 'coexistence', 'alias']) {
|
||||
currentSlice = slice; currentChildExitConfirmed = false; lastSliceResult = null
|
||||
await persist(slice + '-started.json', { version: 1, slice, status: 'running', accepted: false, childExitConfirmed: false })
|
||||
const childBudgetMs = slice === 'baseline' ? 240000 : 120000
|
||||
// Nine disabled lifecycle operations need their own aggregate child cap;
|
||||
// measured seven operations alone consumed 105.5s under the original120s.
|
||||
const childBudgetMs = slice === 'baseline' ? 240000 : slice === 'disabled' ? 180000 : 120000
|
||||
const cwd = join(owned, 'vrf-production-' + slice), rel = relative(owned, cwd)
|
||||
assert(rel && !rel.startsWith('..') && !isAbsolute(rel)); await mkdir(cwd)
|
||||
assert.equal(await realpath(cwd), cwd); assert(!(await lstat(cwd)).isSymbolicLink())
|
||||
@@ -121,9 +126,10 @@ export async function runOwnedVrfProductionProfile({ directory, database, databa
|
||||
unknownTimer = setTimeout(() => { if (!exited) { stop('child-exit-unconfirmed'); resolveExit(1) } }, childBudgetMs + 15000)
|
||||
})
|
||||
clearTimeout(deadline); clearTimeout(stopTimer); clearTimeout(unknownTimer)
|
||||
const expectedCases = { baseline: 11, physical: 7, vlan: 9, disabled: 9, mixed: 7, reconcile: 6, 'sql-journal': 1, guards: 11, coexistence: 3, alias: 4 }
|
||||
const expectedCases = { baseline: 11, physical: 7, vlan: 9, disabled: 9, mixed: 7, reconcile: 6, 'sql-journal': 1, guards: 11, coexistence: 3, alias: 4, gre: 6 }
|
||||
const component = log.trim().split(/\r?\n/).flatMap(line => { try { return [JSON.parse(line)] } catch { return [] } }).findLast(value => value.slice === slice && Array.isArray(value.accepted))
|
||||
if (!component || component.accepted.length !== expectedCases[slice] || component.actualSql !== true || component.actualCrypto !== true || component.actualAuthPolicyApprovalRuntime !== true || component.fakeVerifier !== false || component.actualRouter !== false || component.forwardingVerified !== false) failure ??= 'missing-component-receipt'
|
||||
if (slice === 'gre' && (!Number.isSafeInteger(component?.wireguardPeerTelemetryTicks) || component.wireguardPeerTelemetryTicks <= 6 || component.wireguardPeerTelemetryTicks > 10000)) failure ??= 'missing-component-receipt'
|
||||
const result = { slice, accepted: code === 0 && !failure && exited, caseCount: component?.accepted?.length ?? 0, code, failure, childPid: child.pid ?? null, childExitConfirmed: exited }
|
||||
lastSliceResult = result; currentChildExitConfirmed = exited
|
||||
const diagnostic = vrfSliceDiagnostic(result, log, childBudgetMs, [databaseUrl, target.password, decodeURIComponent(target.password), authSecret])
|
||||
@@ -135,8 +141,8 @@ export async function runOwnedVrfProductionProfile({ directory, database, databa
|
||||
console.log(JSON.stringify({ profile: 'test:vrf:production', ...result }))
|
||||
if (!result.accepted) break
|
||||
}
|
||||
const receipt = { accepted: results.length === 10 && results.every(result => result.accepted), childExitConfirmed: results.every(result => result.childExitConfirmed), sameOwnedPg: true, actualRouter: false, forwardingVerified: false, results }
|
||||
await persist('terminal.json', { version: 1, status: 'terminal', ...receipt, requiredCases: 68, completedCases: results.reduce((sum, value) => sum + value.caseCount, 0), diagnosticDirectory: diagnosticPath })
|
||||
const receipt = { accepted: results.length === 11 && results.every(result => result.accepted), childExitConfirmed: results.every(result => result.childExitConfirmed), sameOwnedPg: true, actualRouter: false, forwardingVerified: false, results }
|
||||
await persist('terminal.json', { version: 1, status: 'terminal', ...receipt, requiredCases: 74, completedCases: results.reduce((sum, value) => sum + value.caseCount, 0), diagnosticDirectory: diagnosticPath })
|
||||
await writeFile(join(owned, 'vrf-production-acceptance.json'), JSON.stringify(receipt, null, 2))
|
||||
return receipt
|
||||
} catch {
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
import assert from 'node:assert/strict'
|
||||
import { test } from 'node:test'
|
||||
import { vrfSliceDiagnostic } from './vrf-production-profile.mjs'
|
||||
|
||||
test('only the nine-operation disabled slice receives its measured aggregate budget', () => {
|
||||
for (const [slice, capMs] of [['disabled', 180000], ['gre', 120000], ['baseline', 240000]]) {
|
||||
const result = { slice, accepted: false, caseCount: 0, code: 1, failure: 'child-deadline', childExitConfirmed: true }
|
||||
assert.equal(vrfSliceDiagnostic(result, '', capMs).capMs, capMs)
|
||||
for (const otherCap of [120000, 180000, 240000].filter(value => value !== capMs)) assert.throws(() => vrfSliceDiagnostic(result, '', otherCap))
|
||||
}
|
||||
})
|
||||
|
||||
test('GRE lifecycle diagnostic retains the six-case receipt with existing privacy bounds', () => {
|
||||
const accepted = ['vrf-create', 'vrf-rename', 'vrf-disable', 'vrf-reenable', 'vrf-membership-transfer-a-to-b', 'vrf-delete-addresses-remain']
|
||||
const result = { slice: 'gre', accepted: true, caseCount: 6, code: 0, failure: null, childExitConfirmed: true }
|
||||
const log = accepted.map((acceptedCase, index) => JSON.stringify({ slice: 'gre', acceptedCase, nativeWrites: 1, wireguardPeerTelemetryTicks: (index + 1) * 4, password: 'fixture-private-value' }))
|
||||
log.push(JSON.stringify({ slice: 'gre', accepted, wireguardPeerTelemetryTicks: 24, rawShape: 'synthetic GRE lifecycle', password: 'fixture-private-value' }))
|
||||
const diagnostic = vrfSliceDiagnostic(result, log.join('\n'), 120000, ['fixture-private-value'])
|
||||
assert.deepEqual(diagnostic.diagnostics.acceptedCaseSequence, accepted)
|
||||
assert.equal(diagnostic.diagnostics.finalComponentPresent, true)
|
||||
assert.equal(diagnostic.diagnostics.rawLogRetained, false)
|
||||
assert.deepEqual(diagnostic.diagnostics.records.map(row => row.wireguardPeerTelemetryTicks), [4, 8, 12, 16, 20, 24, 24])
|
||||
assert.equal(diagnostic.actualRouter, false)
|
||||
assert.equal(diagnostic.forwardingVerified, false)
|
||||
assert.equal(JSON.stringify(diagnostic).includes('fixture-private-value'), false)
|
||||
assert.throws(() => vrfSliceDiagnostic(result, '', 240000))
|
||||
})
|
||||
|
||||
test('peer telemetry diagnostic rejects nonnumeric and out-of-budget values', () => {
|
||||
const result = { slice: 'gre', accepted: false, caseCount: 0, code: 1, failure: 'missing-component-receipt', childExitConfirmed: true }
|
||||
for (const wireguardPeerTelemetryTicks of [0, -1, 10001, 1.5, 'private-raw-value', { secret: 'private-raw-value' }]) {
|
||||
const diagnostic = vrfSliceDiagnostic(result, JSON.stringify({ slice: 'gre', wireguardPeerTelemetryTicks }), 120000)
|
||||
assert.equal(diagnostic.diagnostics.records.some(row => Object.hasOwn(row, 'wireguardPeerTelemetryTicks')), false)
|
||||
assert.equal(JSON.stringify(diagnostic).includes('private-raw-value'), false)
|
||||
}
|
||||
})
|
||||
|
||||
test('a partial GRE lifecycle is diagnostic evidence without a final component receipt', () => {
|
||||
const result = { slice: 'gre', accepted: false, caseCount: 0, code: 1, failure: 'child-deadline', childExitConfirmed: true }
|
||||
const diagnostic = vrfSliceDiagnostic(result, JSON.stringify({ slice: 'gre', acceptedCase: 'vrf-create' }), 120000)
|
||||
assert.equal(diagnostic.accepted, false)
|
||||
assert.equal(diagnostic.diagnostics.finalComponentPresent, false)
|
||||
assert.equal(diagnostic.diagnostics.lastAcceptedCase, 'vrf-create')
|
||||
assert.equal(diagnostic.capMs, 120000)
|
||||
})
|
||||
@@ -12,10 +12,10 @@ const reviewed = (source: string, extra: Partial<MigrationReview> = {}) => {
|
||||
const bytes = Buffer.from(source), file = "9000_fixture.sql"
|
||||
return () => analyzeMigration(file, bytes, { file, sha256: createHash("sha256").update(bytes).digest("hex"), transaction: "owner-transaction", selfMarker: false, opaqueBodies: 0, bodyReview: [], effects: ["Explicit inert fixture review"], ...extra })
|
||||
}
|
||||
await test("all 55 exact file pins and every top-level schema operation are inventoried", () => {
|
||||
assert.equal(inventory.length, 55); assert.equal(MIGRATION_MANIFEST.length, 55)
|
||||
await test("all 56 exact file pins and every top-level schema operation are inventoried", () => {
|
||||
assert.equal(inventory.length, 56); assert.equal(MIGRATION_MANIFEST.length, 56)
|
||||
assert.equal(inventory.filter(file => file.transaction === "owner-transaction").length, 17)
|
||||
assert.equal(inventory.filter(file => file.transaction === "self-managed-single-transaction").length, 38)
|
||||
assert.equal(inventory.filter(file => file.transaction === "self-managed-single-transaction").length, 39)
|
||||
assert(inventory.every(file => file.operations.length === file.statementCount && file.effects.length > 0))
|
||||
let tables = new Set<string>()
|
||||
for (const file of inventory) {
|
||||
@@ -32,8 +32,8 @@ await test("DO BEGIN and stored function BEGIN are never transaction boundaries"
|
||||
assert.equal(endpoint.topLevelTransactionControls.length, 2); assert.equal(endpoint.opaqueBodies.length, 2)
|
||||
assert.deepEqual(endpoint.opaqueBodies.map(body => body.kind), ["stored-function-body", "executed-do-body"])
|
||||
})
|
||||
await test("0035 through 0055 have exact atomic file-owned terminal markers", () => {
|
||||
assert.deepEqual(inventory.filter(file => file.selfMarker).map(file => file.id), ["0035_server_probe_journal", "0036_diagnostic_cancellations", "0037_server_probe_storage_v2", "0038_server_poll_journal_and_writer_guards", "0039_server_poll_storage", "0040_mcp_routing_reservations", "0041_server_poll_terminal_archives", "0042_server_poll_settings_epoch", "0043_mcp_routing_forward_charges", "0044_mcp_routing_manual_inverse_charges", "0045_mcp_operation_replay_tombstones", "0046_server_poll_operation_retirement", "0047_server_poll_retirement_claims", "0048_mcp_ordinary_retirement_claims", "0049_mcp_ordinary_telemetry_retirement", "0050_server_probe_retired_sources", "0051_server_probe_retirement_claims", "0052_server_probe_retired_gc", "0053_server_probe_terminal_proofs", "0054_mcp_geoip_retirement", "0055_mcp_backup_schedule_retirement"])
|
||||
await test("0035 through 0056 have exact atomic file-owned terminal markers", () => {
|
||||
assert.deepEqual(inventory.filter(file => file.selfMarker).map(file => file.id), ["0035_server_probe_journal", "0036_diagnostic_cancellations", "0037_server_probe_storage_v2", "0038_server_poll_journal_and_writer_guards", "0039_server_poll_storage", "0040_mcp_routing_reservations", "0041_server_poll_terminal_archives", "0042_server_poll_settings_epoch", "0043_mcp_routing_forward_charges", "0044_mcp_routing_manual_inverse_charges", "0045_mcp_operation_replay_tombstones", "0046_server_poll_operation_retirement", "0047_server_poll_retirement_claims", "0048_mcp_ordinary_retirement_claims", "0049_mcp_ordinary_telemetry_retirement", "0050_server_probe_retired_sources", "0051_server_probe_retirement_claims", "0052_server_probe_retired_gc", "0053_server_probe_terminal_proofs", "0054_mcp_geoip_retirement", "0055_mcp_backup_schedule_retirement", "0056_mcp_manual_inverse_recovery_v8"])
|
||||
for (const file of inventory.filter(file => file.selfMarker)) { assert.equal(file.selfMarker!.atomicWithAllFileEffects, true); assert.equal(file.selfMarker!.statement, file.statementCount - 2); assert.equal(file.currentOuterMarkerGap, false) }
|
||||
assert.equal(inventory.filter(file => file.currentOuterMarkerGap).length, 34)
|
||||
})
|
||||
@@ -228,4 +228,20 @@ await test("0044 adds only a fixed manual inverse ledger and current-version int
|
||||
assert(!pin.operations.some(operation => operation.command === "UPDATE" || operation.command === "DELETE"))
|
||||
})
|
||||
|
||||
await test("0056 changes only live manual inverse recovery version guards", async () => {
|
||||
const migration = inventory.find(file => file.id === "0056_mcp_manual_inverse_recovery_v8")!
|
||||
assert.equal(migration.statementCount, 5)
|
||||
assert.equal(migration.opaqueBodies.length, 2)
|
||||
assert.equal(migration.selfMarker?.atomicWithAllFileEffects, true)
|
||||
const oldSql = await readFile(new URL("../../drizzle/0044_mcp_routing_manual_inverse_charges.sql", import.meta.url), "utf8")
|
||||
const newSql = await readFile(new URL("../../drizzle/0056_mcp_manual_inverse_recovery_v8.sql", import.meta.url), "utf8")
|
||||
for (const name of ["mcp_routing_manual_inverse_charge_source", "mcp_scoped_recovery_manual_version"]) {
|
||||
const definition = new RegExp(`CREATE(?: OR REPLACE)? FUNCTION public\\.${name}\\(\\)[\\s\\S]*?END \\$\\$;`)
|
||||
const original = oldSql.match(definition)?.[0]?.replaceAll("\r\n", "\n")
|
||||
assert.ok(original)
|
||||
assert.equal(newSql.match(definition)?.[0]?.replaceAll("\r\n", "\n"), original.replace("CREATE FUNCTION", "CREATE OR REPLACE FUNCTION")
|
||||
.replace("p.operation_id='operations.recover' AND p.operation_version=7", "p.operation_id='operations.recover' AND p.operation_version=8"))
|
||||
}
|
||||
})
|
||||
|
||||
console.log(`migration-manifest: ${cases} inert parser/inventory/baseline scenarios passed; ${inventory.length} exact files`)
|
||||
@@ -854,6 +854,20 @@ const classifiedMigrationPins: readonly MigrationReview[] = [
|
||||
"effects": [
|
||||
"Replaces the ordinary claim guard function without changing backup settings, metadata or entries during migration."
|
||||
]
|
||||
},
|
||||
{
|
||||
"file": "0056_mcp_manual_inverse_recovery_v8.sql",
|
||||
"sha256": "1dece1d9c5a9cf69e51336f35f868561dad9da6d21556ea31ef5b102634ed9ee",
|
||||
"transaction": "self-managed-single-transaction",
|
||||
"selfMarker": true,
|
||||
"opaqueBodies": 2,
|
||||
"bodyReview": [
|
||||
"The manual inverse charge-source guard requires recovery version 8 and preserves its pending operation, source version, owner and profile checks.",
|
||||
"The manual inverse intent guard requires recovery version 8 and preserves its advisory lock and exact running service intent checks."
|
||||
],
|
||||
"effects": [
|
||||
"Replaces the two live version guard functions and preserves existing charges, intents, and plans."
|
||||
]
|
||||
}
|
||||
]
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@ import { hasPermission } from "../../lib/permissions.js"
|
||||
import { assertOperationReplayScope, findOperationReplayTombstone, operationHistoryExpired } from "./operation-replay-tombstones.js"
|
||||
import { pool } from "../../db/index.js"
|
||||
import { getServerReadById } from "../servers/service/servers-service.js"
|
||||
import { listUsers, getUserById, listInterfaceCatalog, getInterfaceCatalogState } from "../users/service/users-service.js"
|
||||
import { listUsers, getUserById, listInterfaceCatalog, getInterfaceCatalogState, validateUserBindingCreate, UsersServiceError } from "../users/service/users-service.js"
|
||||
import { getLogSettings } from "../../services/router-logs-collector.js"
|
||||
import { readLogPage, readLogSummary, readLogContext, readLogEntry } from "../../services/router-logs-query.js"
|
||||
import { logWhere } from "../../services/router-logs-model.js"
|
||||
@@ -106,6 +106,7 @@ import { registerRecursiveRecovery } from "./recursive-recovery.js"
|
||||
import { registerNetworkHostActions } from "./network-host-actions.js"
|
||||
import { registerBgpFilterBindingActions } from "./bgp-filter-binding-actions.js"
|
||||
import { registerBgpCommunityPolicyActions } from "./bgp-community-policy-actions.js"
|
||||
import { registerBridgeVlanActions, prepareGenericBridgeVlanChange } from "./bridge-vlan-actions.js"
|
||||
|
||||
const serverId = z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
|
||||
const rowId = z.string().trim().min(1).max(200)
|
||||
@@ -129,6 +130,7 @@ registerRecursiveRecovery(add)
|
||||
registerNetworkHostActions(add)
|
||||
registerBgpFilterBindingActions(add)
|
||||
registerBgpCommunityPolicyActions(add)
|
||||
registerBridgeVlanActions(add)
|
||||
registerTrafficHistoryActions(add)
|
||||
registerSidebarCountsActions(add)
|
||||
registerLogArtifactActions(add)
|
||||
@@ -156,7 +158,7 @@ for (const resource of rosResources) {
|
||||
const delegated = resource.id === "wireguard" && action !== "create" || resource.id === "wireguard_peer" || resource.id === "gre" && action !== "create" || resource.id === "ipsec_peer" && action !== "create" || resource.id === "certificate" && action === "delete" || resource.id === "container" && action === "delete"
|
||||
const previousVersion = action === "create" ? (["ospf_template", "wireguard_peer", "wireguard"].includes(resource.id) ? 3 : 2) : resource.id === "ipsec_peer" || resource.id === "certificate" && action === "delete" ? 2 : resource.id === "wireguard" && action === "update" ? 3 : resource.id === "ospf_template" && action !== "delete" || resource.id === "wireguard_peer" || resource.id === "wireguard" ? 2 : 1
|
||||
add(`ros.${resource.id}.${action}`, `mm_${resource.id}_${action}_plan`, `${resource.title}: ${action}`, resource.permission.split(":")[1], resource.id === "certificate" && action === "update" ? ["mm:certificates:write", "mm:network:write"] : resource.permission + ":write", "write", "servers", schema, {
|
||||
version: resource.id === "ipsec_peer" ? (action === "create" ? 5 : 3) : resource.id === "certificate" ? (action === "update" ? 4 : 3) : previousVersion + (delegated ? 0 : 1) + (resource.id === "ospf_template" ? 1 : 0) + (resource.id === "vrf" ? 1 : 0),
|
||||
version: resource.id === "ipsec_peer" ? (action === "create" ? 5 : 3) : resource.id === "certificate" ? (action === "update" ? 4 : 3) : previousVersion + (delegated ? 0 : 1) + (resource.id === "ospf_template" ? 1 : 0) + (resource.id === "vrf" ? (action === "delete" ? 3 : 2) : 0) + (["bridge", "bridge_port", "bridge_vlan"].includes(resource.id) ? 1 : 0),
|
||||
prepare: async (input, context) => {
|
||||
if (resource.id === "vrf" && input.productionAdmission !== true) throw new McpError("UNSUPPORTED_CAPABILITY", "VRF требует явного productionAdmission:true для проверенного native executor; raw план недоступен", 409)
|
||||
const sid = Number(input.serverId), id = input.id as string | undefined
|
||||
@@ -252,13 +254,24 @@ for (const resource of rosResources) {
|
||||
if (dependent) throw new McpError("STATE_CONFLICT", "Объект используется: сначала подготовьте явное изменение зависимостей", 409)
|
||||
}
|
||||
}
|
||||
const linkedVlan = await prepareGenericBridgeVlanChange({ serverId: sid, resource: resource.id, action, id, fields }, context)
|
||||
if (linkedVlan) {
|
||||
const captured = new Map(snapshots.map(snapshot => [snapshot.resource, snapshot]))
|
||||
for (const snapshot of linkedVlan.snapshots) {
|
||||
const previous = captured.get(snapshot.resource)
|
||||
if (previous && (previous.fingerprint !== snapshot.fingerprint || previous.sourceProof !== snapshot.sourceProof)) throw new McpError("STATE_CONFLICT", "Зависимости VLAN изменились во время подготовки", 409)
|
||||
captured.set(snapshot.resource, snapshot)
|
||||
}
|
||||
const objects = new Map([...references, ...linkedVlan.objects].map(object => [`${object.serverId}/${object.kind}/${object.id}`, object]))
|
||||
return { ...linkedVlan, snapshots: [...captured.values()], objects: [...objects.values()] }
|
||||
}
|
||||
const placeBeforeId = resource.id === "vrf" && action === "create" ? before.rows[0]?.[".id"] : undefined
|
||||
if (resource.id === "vrf" && action === "create" && typeof placeBeforeId !== "string") throw new McpError("STATE_CONFLICT", "Не подтверждён порядок существующих VRF", 409)
|
||||
return { target: { scope: "servers", serverIds: [sid] }, objects: references, snapshots,
|
||||
...(resource.id === "vrf" && input.productionAdmission === true ? { vrfProductionAdmission: true as const } : {}),
|
||||
steps: splitOspfPassiveUpdate({ serverId: sid, resource: resource.id, action, id, fields, ...(typeof placeBeforeId === "string" ? { placeBeforeId } : {}) }).map(step => ({ kind: "ros" as const, step })),
|
||||
requiresHuman: true,
|
||||
warnings: ["Нативное изменение может затронуть управление устройством и требует подтверждения человеком.", "Автоматическое каскадное изменение зависимостей не выполняется.", ...(placeBeforeId ? [`VRF создаётся перед записью ${placeBeforeId}; порядок определяет принадлежность интерфейсов.`] : [])],
|
||||
warnings: ["Нативное изменение может затронуть управление устройством и требует подтверждения человеком.", "Автоматическое каскадное изменение зависимостей не выполняется.", ...(resource.id === "vrf" && action === "delete" ? ["При удалении VRF RouterOS может удалить автоматический IPv6 link-local и его connected-маршрут пустого bridge; статические адреса сохраняются."] : []), ...(placeBeforeId ? [`VRF создаётся перед записью ${placeBeforeId}; порядок определяет принадлежность интерфейсов.`] : [])],
|
||||
}
|
||||
},
|
||||
})
|
||||
@@ -270,7 +283,7 @@ for (const definition of [
|
||||
{ id: "firewall.update", tool: "mm_firewall_rule_update_plan", title: "План изменения правила firewall", resources: ["ip_filter", "ip_nat", "ip_mangle", "ip_raw", "ipv6_filter", "ipv6_nat", "ipv6_mangle", "ipv6_raw"] },
|
||||
] as const) {
|
||||
add(definition.id, definition.tool, definition.title, "network", "mm:network:write", "write", "servers", z.object({ serverId, resource: z.enum(definition.resources), id: rowId, fields: z.record(z.string().max(100), z.union([z.string().max(1000), z.number().finite(), z.boolean()])) }).strict(), {
|
||||
version: definition.id === "interfaces.update" ? 4 : 2,
|
||||
version: definition.id === "interfaces.update" ? 5 : 2,
|
||||
prepare: async (input, context) => {
|
||||
const resource = resourceById(String(input.resource)), fields = resource.fields.safeParse(input.fields)
|
||||
if (!fields.success) throw new McpError("INVALID_INPUT", "Поля не соответствуют типизированной схеме выбранного объекта", 400)
|
||||
@@ -324,6 +337,21 @@ for (const action of ["create", "update", "delete", "binding_add", "binding_remo
|
||||
const ids = [...new Set([...(user?.servers ?? []).map(server => Number(server.serverId)), ...(binding?.serverId ? [binding.serverId] : []),
|
||||
...(before?.bindings ?? []).map(binding => binding.serverId), ...(before?.servers ?? []).map(server => Number(server.serverId))])]
|
||||
if (ids.some(id => !context.connection.policy.scope.serverIds.includes(id))) throw new McpError("SERVER_DENIED", "Сервер не разрешён")
|
||||
if (action === "binding_remove" && !before?.bindings.some(binding => binding.id === input.bindingId)) {
|
||||
throw new McpError("NOT_FOUND", "Привязка не найдена", 404)
|
||||
}
|
||||
if (action === "binding_add") {
|
||||
try {
|
||||
await validateUserBindingCreate(String(input.id), userBindingCreateSchema.parse(input.binding), { signal: context.signal })
|
||||
} catch (error) {
|
||||
if (error instanceof UsersServiceError) {
|
||||
if (error.status === 409) throw new McpError("STATE_CONFLICT", error.message, 409)
|
||||
if (error.status === 400) throw new McpError("INVALID_INPUT", error.message, 400)
|
||||
if (error.status === 404) throw new McpError("NOT_FOUND", error.message, 404)
|
||||
}
|
||||
throw error
|
||||
}
|
||||
}
|
||||
return { target: { scope: "global" }, objects: [{ kind: "user", id: String(input.id ?? "new") }, ...ids.map(id => ({ kind: "server", id: String(id), serverId: id }))], snapshots: [], before,
|
||||
steps: [{ kind: "service", service: `users.${action}`, input }], warnings: ["Изменение /users не меняет JWT-права портала."] }
|
||||
},
|
||||
@@ -352,16 +380,17 @@ function logFilters(input: Record<string, unknown>, context: ActionContext) {
|
||||
}
|
||||
add("logs.query", "mm_logs_query", "История логов", "logs", "mm:servers:read", "read", "servers", logInput, {
|
||||
read: async (input, context) => {
|
||||
const filters = logFilters(input, context), generation = await accessGeneration()
|
||||
const generation = await accessGeneration()
|
||||
let filters: ReturnType<typeof logFilters>
|
||||
let cursor: string | undefined, watermark: string | undefined
|
||||
if (input.cursor) {
|
||||
try {
|
||||
const state = JSON.parse(await decryptSecret(String(input.cursor))) as { generation: string; scope: string; cursor: string; watermark: string; from: string }
|
||||
if (input.from === undefined) filters.from = state.from
|
||||
filters = logFilters({ ...input, from: input.from ?? state.from }, context)
|
||||
if (state.generation !== generation || state.scope !== fingerprint({ filters, connection: context.connection.id })) throw new Error("cursor")
|
||||
cursor = state.cursor; watermark = state.watermark
|
||||
} catch { throw new McpError("RESET_REQUIRED", "Курсор устарел или относится к другим фильтрам", 409) }
|
||||
}
|
||||
} else filters = logFilters(input, context)
|
||||
const result = await readLogPage(filters, { cursor, watermark, limit: Number(input.limit) })
|
||||
return { ...result, nextCursor: result.nextCursor ? await encryptSecret(JSON.stringify({ generation, scope: fingerprint({ filters, connection: context.connection.id }), cursor: result.nextCursor, watermark: result.watermark, from: filters.from })) : null }
|
||||
},
|
||||
@@ -376,7 +405,7 @@ for (const context of [false, true]) add(context ? "logs.context" : "logs.get",
|
||||
return context ? readLogContext(String(input.id)) : entry
|
||||
},
|
||||
})
|
||||
add("logs.follow", "mm_logs_follow", "Новые события", "logs", "mm:servers:read", "read", "servers", logInput.safeExtend({ serverId, cursor: z.string().max(8192).optional(), waitSeconds: z.number().int().min(0).max(30).default(30) }), {
|
||||
add("logs.follow", "mm_logs_follow", "Новые события", "logs", "mm:servers:read", "read", "servers", logInput.safeExtend({ serverId, limit: logInput.shape.limit.default(200), cursor: z.string().max(8192).optional(), waitSeconds: z.number().int().min(0).max(30).default(30) }), {
|
||||
read: async (input, context) => {
|
||||
const maintenance = context.logsFollowMaintenance
|
||||
const signal = context.signal
|
||||
@@ -387,16 +416,18 @@ add("logs.follow", "mm_logs_follow", "Новые события", "logs", "mm:se
|
||||
assertActive()
|
||||
const release = subscribeLogDevice(Number(input.serverId)), until = Date.now() + Number(input.waitSeconds) * 1000
|
||||
try {
|
||||
const filters = logFilters(input, context), generation = await accessGeneration()
|
||||
const generation = await accessGeneration()
|
||||
let filters: ReturnType<typeof logFilters>
|
||||
let cursor = "0"
|
||||
if (input.cursor) {
|
||||
try {
|
||||
const saved = JSON.parse(await decryptSecret(String(input.cursor)))
|
||||
filters.from = saved.from
|
||||
filters = logFilters({ ...input, from: input.from ?? saved.from }, context)
|
||||
if (saved.kind !== "follow" || saved.generation !== generation || saved.scope !== fingerprint({ filters, connection: context.connection.id }) || !/^\d{1,20}$/.test(saved.cursor)) throw new Error("cursor")
|
||||
cursor = saved.cursor
|
||||
} catch { throw new McpError("RESET_REQUIRED", "Курсор follow устарел или относится к другим фильтрам", 409) }
|
||||
} else {
|
||||
filters = logFilters(input, context)
|
||||
cursor = (await pool.query("SELECT COALESCE(max(id),0)::text AS cursor FROM router_log_entries WHERE server_id=$1", [input.serverId])).rows[0].cursor
|
||||
}
|
||||
while (true) {
|
||||
@@ -404,7 +435,7 @@ add("logs.follow", "mm_logs_follow", "Новые события", "logs", "mm:se
|
||||
const current = await validatePrincipal(context.principal)
|
||||
assertActive()
|
||||
if (current.policy.version !== context.connection.policy.version) throw new McpError("RESET_REQUIRED", "Права или область доступа изменились; начните новое чтение", 409)
|
||||
const batch = await readLogStream(filters, cursor)
|
||||
const batch = await readLogStream(filters, cursor, Number(input.limit))
|
||||
assertActive()
|
||||
cursor = batch.cursor
|
||||
if (batch.entries.length || !batch.enabled || Date.now() >= until) return { ...batch, cursor: await encryptSecret(JSON.stringify({ kind: "follow", generation, scope: fingerprint({ filters, connection: context.connection.id }), cursor, from: filters.from })) }
|
||||
|
||||
@@ -17,6 +17,7 @@ try{
|
||||
await pool.query("INSERT INTO backup_storage_settings(id) VALUES(1) ON CONFLICT(id) DO NOTHING")
|
||||
await updateMcpSettings({enabled:true},actor)
|
||||
app=await buildApp({startScheduler:false});await app.ready()
|
||||
await (await import("../../test/mcp-users-bindings.js")).verifyMcpUserBindings(actor)
|
||||
await (await import("./routing-community-context-acceptance.js")).acceptRouteCommunityContextMcp(actor)
|
||||
await (await import("../../test/mcp-acme-test.js")).verifyMcpAcmeTest(actor)
|
||||
await (await import("../../test/mcp-acme-settings.js")).verifyMcpAcmeSettings(actor)
|
||||
|
||||
@@ -0,0 +1,153 @@
|
||||
import { z } from "zod"
|
||||
import { isIP } from "node:net"
|
||||
import { bridgeVlanConfigurationRequestSchema } from "@mmapp/contracts/bridge-vlan"
|
||||
import { buildBridgeVlanConfiguration, bridgeVlanCurrentDesired, BridgeVlanConfigurationError, type BridgeVlanState } from "../../services/bridge-vlan-configuration.js"
|
||||
import { readRosSnapshot, routerClient, rosSnapshotSourceProof, type RosSnapshot, type RosStep } from "./resources.js"
|
||||
import { verifyBridgeManagementChannel } from "./management.js"
|
||||
import { McpError } from "./security.js"
|
||||
import { canonicalBridgeVlanValue } from "../../services/bridge-vlan-values.js"
|
||||
import type { ActionContext, ChangeEvidence } from "./action-types.js"
|
||||
import type { add } from "./actions.js"
|
||||
|
||||
const interfaceResources = ["ethernet", "bridge", "vlan", "gre", "wireguard", "vxlan"]
|
||||
const resources = [...interfaceResources, "bridge_port", "bridge_vlan", "ipv4_address", "ipv6_address"]
|
||||
export async function readBridgeVlanState(serverId: number, context: Pick<ActionContext, "signal">): Promise<{ state: BridgeVlanState; snapshots: RosSnapshot[] }> {
|
||||
const snapshots: RosSnapshot[] = []
|
||||
const active = async () => { if (context.signal?.aborted) throw new McpError("READ_CANCELLED", "Чтение конфигурации VLAN отменено", 409) }
|
||||
// Bind every catalogue to the same configured device source. The executor
|
||||
// rechecks these complete configuration snapshots before each native write.
|
||||
for (const resource of resources) snapshots.push(await readRosSnapshot(serverId, resource, active, snapshots[0]?.sourceProof))
|
||||
const rows = (resource: string) => snapshots.find(snapshot => snapshot.resource === resource)!.rows
|
||||
const state: BridgeVlanState = {
|
||||
bridges: rows("bridge"), ports: rows("bridge_port"), vlans: rows("bridge_vlan"),
|
||||
interfaces: snapshots.filter(snapshot => interfaceResources.includes(snapshot.resource)).flatMap(snapshot => snapshot.rows.map(row => ({
|
||||
resource: snapshot.resource, id: String(row[".id"]), name: String(row.name), disabled: row.disabled,
|
||||
}))),
|
||||
vlanInterfaces: rows("vlan"), ipv4Addresses: rows("ipv4_address"), ipv6Addresses: rows("ipv6_address"),
|
||||
}
|
||||
return { state, snapshots }
|
||||
}
|
||||
|
||||
export async function prepareBridgeVlanConfiguration(raw: unknown, context: ActionContext): Promise<ChangeEvidence> {
|
||||
const input = bridgeVlanConfigurationRequestSchema.parse(raw)
|
||||
let management: Awaited<ReturnType<typeof verifyBridgeManagementChannel>> | undefined
|
||||
try { management = await verifyBridgeManagementChannel(input.serverId) }
|
||||
catch (error) {
|
||||
// Only lack of a current alternate channel permits primary-path admission.
|
||||
// Identity, transport and other verification failures stay fail-closed.
|
||||
if (!(error instanceof McpError) || error.code !== "APPROVAL_REQUIRED") throw error
|
||||
}
|
||||
const { state, snapshots } = await readBridgeVlanState(input.serverId, context)
|
||||
const primaryManagement = management === undefined
|
||||
if (!management) {
|
||||
const { server } = await routerClient(input.serverId)
|
||||
if (!isIP(server.host)) throw new McpError("MANAGEMENT_UNSAFE", "Основной адрес управления должен быть буквальным IP, подтверждённым в конфигурации устройства", 409)
|
||||
if (!snapshots[0]?.sourceProof || await rosSnapshotSourceProof(server) !== snapshots[0].sourceProof) throw new McpError("STATE_CONFLICT", "Источник основного управления изменился во время подготовки VLAN", 409)
|
||||
const expiresAt = Math.min(Date.parse(context.connection.policy.expiresAt), context.connection.owner_valid_until.getTime(), Date.parse(context.principal.credentialExpiresAt))
|
||||
if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) throw new McpError("APPROVAL_REQUIRED", "Нет действующего допуска для основного канала управления", 409)
|
||||
management = { channelId: "primary", serverId: input.serverId, host: server.host, expiresAt: new Date(expiresAt).toISOString() }
|
||||
}
|
||||
try {
|
||||
const plan = buildBridgeVlanConfiguration({ ...input, state, management, now: Date.now() })
|
||||
if (!plan.steps.length) throw new McpError("STATE_CONFLICT", "Конфигурация VLAN уже соответствует плану", 409)
|
||||
return {
|
||||
target: { scope: "servers", serverIds: [input.serverId] }, objects: plan.objects,
|
||||
snapshots, steps: plan.steps.map(step => ({ kind: "ros" as const, step })),
|
||||
requiresHuman: true, validUntil: management.expiresAt,
|
||||
...(primaryManagement ? {} : { managementChannels: [{ channelId: management.channelId, serverId: management.serverId, expiresAt: management.expiresAt }] }),
|
||||
warnings: ["Связанный план изменяет VLAN memberships и PVID в указанном порядке; включение filtering выполняется последним.",
|
||||
"Каждая подтверждённая запись проверяется до следующей. При неизвестном результате дальнейшие записи останавливаются.",
|
||||
primaryManagement ? "Используется основной адрес управления; независимость канала не подтверждена. Обязательно подтверждение человеком; каждый префикс плана сохраняет подтверждённый management-доступ."
|
||||
: "Проверяется конфигурация и доступность зарегистрированного management-канала. Передача пользовательского трафика требует отдельной сетевой проверки."],
|
||||
}
|
||||
} catch (error) {
|
||||
if (error instanceof BridgeVlanConfigurationError) throw new McpError(error.code, error.message, 409)
|
||||
throw error
|
||||
}
|
||||
}
|
||||
|
||||
/** A legacy single-row tool must pass the same effective-state checks, but may
|
||||
* not acquire authority to edit other resource kinds through this delegation. */
|
||||
export async function prepareGenericBridgeVlanChange(step: RosStep, context: ActionContext): Promise<ChangeEvidence | undefined> {
|
||||
const sensitive = step.resource === "bridge" ? ["pvid", "vlan-filtering", "frame-types", "ingress-filtering"] : step.resource === "bridge_port"
|
||||
? ["bridge", "interface", "pvid", "ingress-filtering", "frame-types", "disabled"] : ["bridge", "vlan-ids", "tagged", "untagged", "disabled"]
|
||||
if (!["bridge", "bridge_port", "bridge_vlan"].includes(step.resource) || step.resource === "bridge" && step.action !== "update"
|
||||
|| step.action === "update" && !Object.keys(step.fields).some(key => sensitive.includes(key))) return undefined
|
||||
const { state } = await readBridgeVlanState(step.serverId, context)
|
||||
const rows = step.resource === "bridge" ? state.bridges : step.resource === "bridge_port" ? state.ports : state.vlans
|
||||
const row = rows.find(item => item[".id"] === step.id)
|
||||
const bridgeName = step.resource === "bridge" ? row?.name : step.fields.bridge ?? row?.bridge
|
||||
const bridges = state.bridges.filter(item => item.name === bridgeName)
|
||||
if (bridges.length !== 1 || step.resource !== "bridge" && row && row.bridge !== bridgeName) throw new McpError("STATE_CONFLICT", "Смена bridge требует отдельных явных планов удаления и добавления порта", 409)
|
||||
const bridgeId = String(bridges[0][".id"])
|
||||
try {
|
||||
const desired = bridgeVlanCurrentDesired(state, bridgeId)
|
||||
const bool = (value: unknown): boolean => {
|
||||
if (value === "true" || value === true) return true
|
||||
if (value === "false" || value === false) return false
|
||||
throw new McpError("INVALID_INPUT", "Нужны явные параметры порта VLAN", 400)
|
||||
}
|
||||
const ref = (name: unknown) => {
|
||||
const matches = state.interfaces.filter(iface => iface.name === name)
|
||||
if (matches.length !== 1) throw new McpError("INVALID_INPUT", "Не подтверждён стабильный ID участника VLAN", 400)
|
||||
return { resource: matches[0].resource, id: matches[0].id }
|
||||
}
|
||||
if (step.resource === "bridge") {
|
||||
if (Object.keys(step.fields).some(key => !sensitive.includes(key))) throw new McpError("INVALID_INPUT", "Подготовьте свойства bridge и VLAN filtering отдельными планами", 400)
|
||||
if (step.fields.pvid !== undefined) desired.pvid = Number(step.fields.pvid)
|
||||
if (step.fields["vlan-filtering"] !== undefined) desired.filtering = bool(step.fields["vlan-filtering"])
|
||||
if (step.fields["frame-types"] !== undefined) desired.frameTypes = bridgeVlanConfigurationRequestSchema.shape.desired.shape.frameTypes.parse(step.fields["frame-types"])
|
||||
if (step.fields["ingress-filtering"] !== undefined) desired.ingressFiltering = bool(step.fields["ingress-filtering"])
|
||||
} else if (step.resource === "bridge_port") {
|
||||
const index = desired.ports.findIndex(port => port.id === step.id)
|
||||
if (step.action === "delete") {
|
||||
if (index < 0) throw new McpError("NOT_FOUND", "Статический порт не найден", 404)
|
||||
desired.ports.splice(index, 1); desired.removePortIds.push(step.id!)
|
||||
} else {
|
||||
const effective = { ...row, ...step.fields }
|
||||
const port = { ...(step.action === "update" ? { id: step.id } : {}), interface: ref(effective.interface), pvid: Number(effective.pvid),
|
||||
ingressFiltering: bool(effective["ingress-filtering"]), frameTypes: effective["frame-types"], disabled: bool(effective.disabled),
|
||||
...(effective.comment === undefined ? {} : { comment: effective.comment }) }
|
||||
const parsed = bridgeVlanConfigurationRequestSchema.shape.desired.shape.ports.element.parse(port)
|
||||
if (step.action === "create") desired.ports.push(parsed)
|
||||
else { if (index < 0) throw new McpError("NOT_FOUND", "Статический порт не найден", 404); desired.ports[index] = parsed }
|
||||
}
|
||||
} else {
|
||||
const index = desired.vlans.findIndex(vlan => vlan.id === step.id)
|
||||
if (step.action === "delete") {
|
||||
if (index < 0) throw new McpError("NOT_FOUND", "Статическая VLAN membership не найдена", 404)
|
||||
desired.vlans.splice(index, 1); desired.removeVlanIds.push(step.id!)
|
||||
} else {
|
||||
const effective = { ...row, ...step.fields }
|
||||
const members = (value: unknown) => value === undefined || value === "" ? [] : String(value).split(",").map(ref)
|
||||
const vlan = { ...(step.action === "update" ? { id: step.id } : {}), vlanIds: effective["vlan-ids"], tagged: members(effective.tagged), untagged: members(effective.untagged),
|
||||
disabled: effective.disabled === undefined && step.action === "create" ? false : bool(effective.disabled), ...(effective.comment === undefined ? {} : { comment: effective.comment }) }
|
||||
const parsed = bridgeVlanConfigurationRequestSchema.shape.desired.shape.vlans.element.parse(vlan)
|
||||
if (step.action === "create") desired.vlans.push(parsed)
|
||||
else { if (index < 0) throw new McpError("NOT_FOUND", "Статическая VLAN membership не найдена", 404); desired.vlans[index] = parsed }
|
||||
}
|
||||
}
|
||||
const evidence = await prepareBridgeVlanConfiguration({ serverId: step.serverId, bridgeId, desired }, context)
|
||||
if (evidence.steps.length !== 1 || evidence.steps[0].kind !== "ros" || evidence.steps[0].step.resource !== step.resource || evidence.steps[0].step.action !== step.action || evidence.steps[0].step.id !== step.id) {
|
||||
throw new McpError("APPROVAL_REQUIRED", "Для связанных изменений используйте явный план mm_bridge_vlan_configuration_plan с соответствующим разрешением", 409)
|
||||
}
|
||||
const native = evidence.steps[0].step
|
||||
if (step.action === "update" && Object.entries(native.fields).some(([key, value]) => !Object.hasOwn(step.fields, key)
|
||||
|| (step.resource === "bridge_vlan" ? canonicalBridgeVlanValue(key, value) !== canonicalBridgeVlanValue(key, step.fields[key]) : value !== step.fields[key]))) {
|
||||
throw new McpError("STATE_CONFLICT", "Состояние VLAN изменилось во время подготовки; незапрошенные поля не будут перезаписаны", 409)
|
||||
}
|
||||
return evidence
|
||||
} catch (error) {
|
||||
if (error instanceof BridgeVlanConfigurationError) throw new McpError(error.code, error.message, 409)
|
||||
throw error
|
||||
}
|
||||
}
|
||||
|
||||
export function registerBridgeVlanActions(register: typeof add) {
|
||||
register("network.bridge-vlan.read", "mm_bridge_vlan_configuration_get", "Полная конфигурация bridge VLAN и стабильные ID участников", "network", "mm:network:read", "read", "servers", z.object({ serverId: z.number().int().positive() }).strict(), {
|
||||
read: async (input, context) => ({ state: (await readBridgeVlanState(Number(input.serverId), context)).state }),
|
||||
})
|
||||
register("network.bridge-vlan.configure", "mm_bridge_vlan_configuration_plan", "Связанный план VLAN membership, PVID и bridge filtering", "network", "mm:network:write", "write", "servers", bridgeVlanConfigurationRequestSchema, {
|
||||
prepare: prepareBridgeVlanConfiguration,
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
import assert from "node:assert/strict"
|
||||
process.env.AUTH_REQUIRED = "true"
|
||||
process.env.AUTH_JWT_SECRET = "bridge-vlan-owned-acceptance-secret"
|
||||
process.env.AUTH_ISSUER = "https://auth.test.local"
|
||||
const { pool, closePool } = await import("../../db/index.js")
|
||||
const { applySqlMigrations } = await import("../../db/migrate.js")
|
||||
const { updateMcpSettings } = await import("./store.js")
|
||||
const { buildApp } = await import("../../index.js")
|
||||
const actor = { id: "bridge-vlan-owner", email: "bridge@example.invalid", name: "Bridge VLAN owner", apps: ["mm"], permissions: ["mm:settings:admin", "mm:network:admin"], expiresAt: Date.now() + 3600000 }
|
||||
let app: Awaited<ReturnType<typeof buildApp>> | undefined
|
||||
try {
|
||||
await applySqlMigrations(pool)
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM servers")).rows[0].n, 0, "Disposable empty database required")
|
||||
await updateMcpSettings({ enabled: true }, actor)
|
||||
app = await buildApp({ startScheduler: false }); await app.ready()
|
||||
await (await import("../../test/mcp-bridge-vlan-configuration.js")).verifyMcpBridgeVlanConfiguration(actor, app)
|
||||
} finally {
|
||||
await (await import("../../services/scheduler.js")).stopSchedulerForDatabaseOperation()
|
||||
await (await import("../../services/traffic-flow-ingest.js")).stopTrafficFlowListenerForDatabaseOperation()
|
||||
await app?.close(); await closePool()
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
import assert from "node:assert/strict"
|
||||
import test from "node:test"
|
||||
import { configurationRows, resourceById, rosSnapshotVersion, type ConfigurationRow, type RosSnapshot, type RosStep } from "./resources.js"
|
||||
import { createRosPrefix } from "./ros-prefix.js"
|
||||
import { verifyRosStepSnapshots } from "./ros-step-verification.js"
|
||||
import { fingerprint, McpError } from "./security.js"
|
||||
|
||||
const snapshot = (resource: string, raw: ConfigurationRow[]): RosSnapshot => {
|
||||
const rows = configurationRows(resourceById(resource), raw)
|
||||
return { serverId: 1, resource, rows, fingerprint: fingerprint(rows), sourceProof: "a".repeat(64), projectionVersion: rosSnapshotVersion(resource) }
|
||||
}
|
||||
const membership = { ".id": "*1", bridge: "br", "vlan-ids": "20-22", tagged: "ether2,ether3", dynamic: "false", disabled: "false" }
|
||||
|
||||
test("VLAN readback accepts equivalent VID/member sets and omitted empty fields, retaining exact native identity", () => {
|
||||
const before = snapshot("bridge_vlan", [membership])
|
||||
const after = snapshot("bridge_vlan", [{ ...membership, "vlan-ids": "22,20,21", tagged: "ether3,ether2" }])
|
||||
const step: RosStep = { serverId: 1, resource: "bridge_vlan", action: "update", id: "*1", fields: { "vlan-ids": "20-22", tagged: "ether3,ether2", untagged: "", comment: "" } }
|
||||
assert.equal(verifyRosStepSnapshots(step, {}, before, after), true)
|
||||
assert.equal(verifyRosStepSnapshots(step, {}, before, snapshot("bridge_vlan", [{ ...membership, "vlan-ids": "20-23" }])), false)
|
||||
assert.equal(verifyRosStepSnapshots(step, {}, before, snapshot("bridge_vlan", [{ ...membership, ".id": "*2" }])), false)
|
||||
assert.throws(() => snapshot("bridge_vlan", [{ ...membership, "vlan-ids": "20,20-22" }]), /Недостоверная/)
|
||||
})
|
||||
|
||||
test("PVID-generated rows may change while the sealed static VLAN configuration remains exact", async () => {
|
||||
const port = { ".id": "*2", bridge: "br", interface: "ether2", pvid: "10", disabled: "false" }
|
||||
const dynamic = { ".id": "*D", bridge: "br", "vlan-ids": "10", untagged: "ether2", dynamic: "true" }
|
||||
const raw = new Map<string, ConfigurationRow[]>([["bridge_port", [port]], ["bridge_vlan", [membership, dynamic]]])
|
||||
const initial = [...raw].map(([resource, rows]) => snapshot(resource, rows))
|
||||
const read = async (_server: number, resource: string, active: () => Promise<unknown> = async () => {}) => { await active(); return snapshot(resource, raw.get(resource)!) }
|
||||
const prefix = createRosPrefix(initial, read)
|
||||
await prefix.check()
|
||||
raw.set("bridge_port", [{ ...port, pvid: "20" }])
|
||||
raw.set("bridge_vlan", [membership, { ...dynamic, ".id": "*E", "vlan-ids": "20" }])
|
||||
const step: RosStep = { serverId: 1, resource: "bridge_port", action: "update", id: "*2", fields: { pvid: "20" } }
|
||||
await prefix.advance(step, {}, await read(1, "bridge_port"))
|
||||
await prefix.check()
|
||||
raw.set("bridge_vlan", [{ ...membership, tagged: "ether2" }, dynamic])
|
||||
await assert.rejects(prefix.check(), error => error instanceof McpError && error.code === "STATE_CONFLICT")
|
||||
})
|
||||
|
||||
test("full VLAN ranges and long sparse VID sets stay representable in plans and inverse snapshots", () => {
|
||||
const resource = resourceById("bridge_vlan")
|
||||
const expanded = Array.from({ length: 4094 }, (_, index) => String(index + 1)).join(",")
|
||||
const sparse = Array.from({ length: 2047 }, (_, index) => String(index * 2 + 1)).join(",")
|
||||
assert.ok(sparse.length > 100)
|
||||
for (const value of ["1-4094", sparse]) assert.equal(resource.fields.safeParse({ "vlan-ids": value }).success, true)
|
||||
for (const value of ["0", "4095", "10-9", "10,10-12"]) assert.equal(resource.fields.safeParse({ "vlan-ids": value }).success, false)
|
||||
const before = snapshot("bridge_vlan", [membership])
|
||||
const after = snapshot("bridge_vlan", [{ ...membership, "vlan-ids": expanded }])
|
||||
assert.equal(after.rows[0]["vlan-ids"], "1-4094", "Native expansion must not overflow the public inverse DTO")
|
||||
assert.equal(verifyRosStepSnapshots({ serverId: 1, resource: "bridge_vlan", action: "update", id: "*1", fields: { "vlan-ids": "1-4094" } }, {}, before, after), true)
|
||||
})
|
||||
|
||||
test("unknown dynamic flags are retained; only explicit RouterOS-generated VLAN rows are excluded", () => {
|
||||
assert.equal(snapshot("bridge_vlan", [{ ...membership, dynamic: "unknown" }]).rows.length, 1)
|
||||
for (const dynamic of [true, "true", "yes"]) assert.equal(snapshot("bridge_vlan", [{ ...membership, dynamic }]).rows.length, 0)
|
||||
assert.equal(snapshot("bridge_vlan", [{ ...membership, dynamic: "false" }]).rows.length, 1)
|
||||
})
|
||||
|
||||
test("old bridge CPU, port and VLAN projection contracts cannot execute after semantic projection changes", () => {
|
||||
for (const resource of ["bridge", "bridge_port", "bridge_vlan"]) {
|
||||
const current = snapshot(resource, resource === "bridge_vlan" ? [membership] : [{ ".id": "*2", bridge: "br", interface: "ether2", pvid: "10" }])
|
||||
assert.equal(current.projectionVersion, 4)
|
||||
assert.throws(() => createRosPrefix([{ ...current, projectionVersion: 3 }]), error => error instanceof McpError && error.code === "PLAN_EXPIRED")
|
||||
}
|
||||
})
|
||||
test("CPU frame admission and MVRP configuration are sealed, with no MVRP write permission", () => {
|
||||
const bridge = { ".id": "*1", name: "br", pvid: "10", "vlan-filtering": "true", "frame-types": "admit-all", "ingress-filtering": "true", mvrp: "false", running: "true" }
|
||||
const original = snapshot("bridge", [bridge])
|
||||
for (const field of ["frame-types", "ingress-filtering", "mvrp"]) {
|
||||
const changed = snapshot("bridge", [{ ...bridge, [field]: field === "frame-types" ? "admit-only-vlan-tagged" : "false" === bridge[field as keyof typeof bridge] ? "true" : "false" }])
|
||||
assert.notEqual(changed.fingerprint, original.fingerprint)
|
||||
}
|
||||
assert.equal(snapshot("bridge", [{ ...bridge, running: "false" }]).fingerprint, original.fingerprint)
|
||||
assert.equal(resourceById("bridge").fields.safeParse({ mvrp: true }).success, false)
|
||||
})
|
||||
@@ -0,0 +1,135 @@
|
||||
import { bridgeVlanStateSchema, type BridgeVlanDesired, type BridgeVlanState } from "@mmapp/contracts/bridge-vlan"
|
||||
import { bridgeVlanCurrentDesired } from "../../services/bridge-vlan-configuration.js"
|
||||
import type { ActionContext, ChangeEvidence } from "./action-types.js"
|
||||
import { prepareBridgeVlanConfiguration, readBridgeVlanState } from "./bridge-vlan-actions.js"
|
||||
import { acknowledgedCreateId, assertNoCallerCreateId, recoveryRosStepId } from "./native-create-identity.js"
|
||||
import { readRosSnapshot, rosSnapshotVersion, type RosSnapshot, type RosStep } from "./resources.js"
|
||||
import { verifyRosStepSnapshots } from "./ros-step-verification.js"
|
||||
import { decryptSecret, fingerprint, McpError } from "./security.js"
|
||||
|
||||
type Checkpoint = { step_index: number; before_sealed: string; after_sealed: string | null }
|
||||
type Intended = { step_index: number; state: string; result: unknown }
|
||||
const key = (snapshot: Pick<RosSnapshot, "serverId" | "resource">) => `${snapshot.serverId}:${snapshot.resource}`
|
||||
function conflict(message: string): never { throw new McpError("STATE_CONFLICT", message, 409) }
|
||||
|
||||
export function needsBridgeVlanRecovery(sourceAction: string, evidence: ChangeEvidence): boolean {
|
||||
if (sourceAction === "network.bridge-vlan.configure") return true
|
||||
return evidence.steps.some(change => {
|
||||
if (change.kind !== "ros") return false
|
||||
const step = change.step
|
||||
if (step.resource === "bridge") return step.action === "update" && Object.keys(step.fields).some(field => ["pvid", "vlan-filtering", "frame-types", "ingress-filtering"].includes(field))
|
||||
const sensitive = step.resource === "bridge_port" ? ["bridge", "interface", "pvid", "ingress-filtering", "frame-types", "disabled"]
|
||||
: step.resource === "bridge_vlan" ? ["bridge", "vlan-ids", "tagged", "untagged", "disabled"] : []
|
||||
return sensitive.length > 0 && (step.action !== "update" || Object.keys(step.fields).some(field => sensitive.includes(field)))
|
||||
})
|
||||
}
|
||||
|
||||
function validSnapshot(snapshot: RosSnapshot): boolean {
|
||||
return snapshot.projectionVersion === rosSnapshotVersion(snapshot.resource) && !!snapshot.sourceProof && Array.isArray(snapshot.rows) && snapshot.fingerprint === fingerprint(snapshot.rows)
|
||||
}
|
||||
function sameSnapshot(left: RosSnapshot, right: RosSnapshot): boolean {
|
||||
return validSnapshot(left) && validSnapshot(right) && key(left) === key(right) && left.fingerprint === right.fingerprint && left.sourceProof === right.sourceProof
|
||||
}
|
||||
function stateFromSnapshots(serverId: number, snapshots: Map<string, RosSnapshot>): BridgeVlanState {
|
||||
const rows = (resource: string) => {
|
||||
const snapshot = snapshots.get(key({ serverId, resource }))
|
||||
if (!snapshot || !validSnapshot(snapshot)) conflict("Нет полного исходного снимка bridge VLAN с актуальной проекцией")
|
||||
return snapshot.rows
|
||||
}
|
||||
return bridgeVlanStateSchema.parse({ bridges: rows("bridge"), ports: rows("bridge_port"), vlans: rows("bridge_vlan"),
|
||||
vlanInterfaces: rows("vlan"), ipv4Addresses: rows("ipv4_address"), ipv6Addresses: rows("ipv6_address"),
|
||||
interfaces: ["ethernet", "bridge", "vlan", "gre", "wireguard", "vxlan"].flatMap(resource => rows(resource).map(row => ({ resource, id: String(row[".id"]), name: String(row.name), disabled: row.disabled }))),
|
||||
})
|
||||
}
|
||||
|
||||
/** Fresh typed inverse of a completely verified transition. Deleted port/VLAN
|
||||
* rows are recreated without their old IDs; new rows are removed only by ACK. */
|
||||
export async function prepareBridgeVlanRecovery(input: {
|
||||
operationId: string; evidence: ChangeEvidence; checkpoints: Checkpoint[]; intended: Intended[];
|
||||
}, context: ActionContext): Promise<ChangeEvidence> {
|
||||
const { operationId, evidence, checkpoints, intended } = input
|
||||
if (!evidence.steps.length || evidence.steps.some(change => change.kind !== "ros" || !["bridge", "bridge_port", "bridge_vlan"].includes(change.step.resource))) {
|
||||
throw new McpError("UNSUPPORTED_CAPABILITY", "Обратный VLAN план не поддерживает смешанные ресурсы", 409)
|
||||
}
|
||||
const native = evidence.steps.map(change => (change as { kind: "ros"; step: RosStep }).step)
|
||||
if (native.some(step => step.resource === "bridge" && step.action !== "update")) {
|
||||
throw new McpError("UNSUPPORTED_CAPABILITY", "Создание или удаление самого bridge не поддерживает типизированный обратный VLAN план", 409)
|
||||
}
|
||||
const serverIds = [...new Set(native.map(step => step.serverId))]
|
||||
if (serverIds.length !== 1 || evidence.target.scope !== "servers" || evidence.target.serverIds.length !== 1 || evidence.target.serverIds[0] !== serverIds[0]) conflict("Нет однозначного сервера исходного VLAN плана")
|
||||
const serverId = serverIds[0]
|
||||
if (!context.connection.policy.scope.serverIds.includes(serverId)) throw new McpError("SERVER_DENIED", "VLAN сервер вне текущего допуска")
|
||||
if (intended.length !== native.length || checkpoints.length !== native.length || new Set(intended.map(item => item.step_index)).size !== native.length || new Set(checkpoints.map(item => item.step_index)).size !== native.length) conflict("Нет полного набора подтверждённых шагов VLAN")
|
||||
const baseline = new Map<string, RosSnapshot>()
|
||||
for (const snapshot of evidence.snapshots) {
|
||||
if (snapshot.serverId !== serverId || !validSnapshot(snapshot) || baseline.has(key(snapshot))) conflict("Исходные VLAN снимки или их версии не подтверждены")
|
||||
baseline.set(key(snapshot), snapshot)
|
||||
}
|
||||
const baselineState = stateFromSnapshots(serverId, baseline), expected = new Map(baseline)
|
||||
const created: Array<{ resource: "bridge_port" | "bridge_vlan"; id: string }> = []
|
||||
const deleted: Array<{ resource: "bridge_port" | "bridge_vlan"; id: string }> = []
|
||||
for (let index = 0; index < native.length; index++) {
|
||||
const step = native[index], checkpoint = checkpoints.find(item => item.step_index === index), receipt = intended.find(item => item.step_index === index)
|
||||
assertNoCallerCreateId(step)
|
||||
if (!checkpoint?.before_sealed || !checkpoint.after_sealed || receipt?.state !== "verified") conflict("Нет полного проверенного checkpoint VLAN; требуется ручная сверка")
|
||||
const before = JSON.parse(await decryptSecret(checkpoint.before_sealed)) as RosSnapshot
|
||||
const after = JSON.parse(await decryptSecret(checkpoint.after_sealed)) as RosSnapshot
|
||||
const previous = expected.get(key({ serverId, resource: step.resource }))
|
||||
if (!previous || !sameSnapshot(previous, before) || !validSnapshot(after) || before.sourceProof !== after.sourceProof || !verifyRosStepSnapshots(step, receipt.result, before, after)) conflict("Исходный переход VLAN или источник не подтверждён")
|
||||
if (step.action === "create") {
|
||||
const ack = acknowledgedCreateId(receipt.result), actual = recoveryRosStepId(step, before.rows, after.rows)
|
||||
if (!ack || actual !== ack || !["bridge_port", "bridge_vlan"].includes(step.resource)) conflict("Нет точного ACK и checkpoint ID созданного VLAN объекта")
|
||||
created.push({ resource: step.resource as "bridge_port" | "bridge_vlan", id: ack })
|
||||
} else if (step.action === "delete") {
|
||||
if (!step.id || !["bridge_port", "bridge_vlan"].includes(step.resource)) conflict("Не подтверждён ID удалённого VLAN объекта")
|
||||
deleted.push({ resource: step.resource as "bridge_port" | "bridge_vlan", id: step.id })
|
||||
}
|
||||
expected.set(key(after), after)
|
||||
}
|
||||
const bridgeNames = new Set(native.map(step => {
|
||||
const rows = step.resource === "bridge" ? baselineState.bridges : step.resource === "bridge_port" ? baselineState.ports : baselineState.vlans
|
||||
const row = rows.find(item => item[".id"] === step.id)
|
||||
const name = step.resource === "bridge" ? row?.name : step.fields.bridge ?? row?.bridge
|
||||
if (typeof name !== "string" || !name) conflict("Не подтверждён исходный bridge VLAN")
|
||||
return name
|
||||
}))
|
||||
const bridges = baselineState.bridges.filter(row => bridgeNames.has(String(row.name)))
|
||||
if (bridgeNames.size !== 1 || bridges.length !== 1) conflict("Обратный VLAN план требует один однозначный bridge")
|
||||
const bridgeId = String(bridges[0][".id"]), desired: BridgeVlanDesired = bridgeVlanCurrentDesired(baselineState, bridgeId)
|
||||
for (const item of deleted) {
|
||||
const terminal = expected.get(key({ serverId, resource: item.resource }))
|
||||
const original = item.resource === "bridge_port" ? desired.ports.find(row => row.id === item.id) : desired.vlans.find(row => row.id === item.id)
|
||||
if (!original || !terminal || terminal.rows.some(row => row[".id"] === item.id)) conflict("Нет подтверждённого удаления исходной VLAN identity")
|
||||
delete original.id
|
||||
}
|
||||
for (const item of created) {
|
||||
const originalRows = baseline.get(key({ serverId, resource: item.resource }))!.rows
|
||||
const terminalRows = expected.get(key({ serverId, resource: item.resource }))!.rows
|
||||
if (originalRows.some(row => row[".id"] === item.id) || !terminalRows.some(row => row[".id"] === item.id)) conflict("ACK ID VLAN не является подтверждённым новым объектом")
|
||||
if (item.resource === "bridge_port") desired.removePortIds.push(item.id)
|
||||
else desired.removeVlanIds.push(item.id)
|
||||
}
|
||||
const compare = async (snapshots: RosSnapshot[]): Promise<RosSnapshot[]> => {
|
||||
const captured = new Map(snapshots.map(snapshot => [key(snapshot), snapshot]))
|
||||
for (const snapshot of snapshots) {
|
||||
const terminal = expected.get(key(snapshot))
|
||||
if (!terminal || !sameSnapshot(terminal, snapshot)) conflict("После операции изменились VLAN конфигурация, зависимости или источник; обратный план запрещён")
|
||||
}
|
||||
for (const [resourceKey, terminal] of expected) {
|
||||
const current = captured.get(resourceKey) ?? await readRosSnapshot(serverId, terminal.resource, undefined, terminal.sourceProof)
|
||||
if (!sameSnapshot(terminal, current)) conflict("После операции обнаружен drift зависимости VLAN; обратный план запрещён")
|
||||
captured.set(resourceKey, current)
|
||||
}
|
||||
return [...captured.values()]
|
||||
}
|
||||
await compare((await readBridgeVlanState(serverId, context)).snapshots)
|
||||
// Reconstruct through the same model, with a freshly verified management
|
||||
// channel. Old receipts never confer authority to run the inverse.
|
||||
const inverse = await prepareBridgeVlanConfiguration({ serverId, bridgeId, desired }, context)
|
||||
const snapshots = await compare(inverse.snapshots)
|
||||
const objects = new Map([...evidence.objects, ...inverse.objects].map(object => [`${object.serverId}/${object.kind}/${object.id}`, object]))
|
||||
return { ...inverse, snapshots, objects: [...objects.values()], requiresHuman: true,
|
||||
warnings: [`Типизированный обратный VLAN план операции ${operationId}; все исходные шаги и ACK проверены.`, ...inverse.warnings,
|
||||
"Удалённые port/VLAN rows создаются с новыми ID RouterOS. Unknown операции не повторяются; восстановление самого bridge не поддерживается."],
|
||||
}
|
||||
}
|
||||
@@ -2954,17 +2954,41 @@ try {
|
||||
await (await import("../../test/mcp-host-files.js")).verifyMcpHostFiles(actor,app)
|
||||
const readinessAccess = await createMcpConnection(mcpConnectionCreateSchema.parse({ ...input, name: "Actual readiness handshake", scope: { ...input.scope, operationIds: ["servers.list"] } }), actor)
|
||||
const readinessHeaders = { authorization: "Bearer " + jwt }
|
||||
const simulatorHeaders = { authorization: "Bearer " + await new SignJWT({ sub: "policy-preview-admin", apps: ["mm"], permissions: ["mm:mcp:admin"] })
|
||||
.setProtectedHeader({ alg: "HS256" }).setIssuer(env.authIssuer).setExpirationTime("1h").sign(new TextEncoder().encode(env.jwtSecret)) }
|
||||
const policyPreview = (payload: Record<string, unknown>) => app!.inject({ method: "POST", url: "/api/mcp/policy/preview", headers: simulatorHeaders, payload })
|
||||
const simulatedServerRead = { connectionId: readinessAccess.connection.id, operationId: "servers.list", target: { scope: "servers", serverIds: [1] } }
|
||||
const simulation = await policyPreview(simulatedServerRead)
|
||||
assert.equal(simulation.statusCode, 200, simulation.body)
|
||||
assert.equal(simulation.json().result.decision, "allowed", "an administrator simulates the stored owner's rights, not the administrator's rights")
|
||||
assert.equal(simulation.json().executionAvailable, false)
|
||||
assert.equal((await policyPreview({ ...simulatedServerRead, ownerPermissions: ["mm:settings:admin"] })).statusCode, 400)
|
||||
const ready = await app.inject({ method: "POST", url: `/api/mcp/connections/${readinessAccess.connection.id}/check`, headers: readinessHeaders, payload: {} })
|
||||
assert.equal(ready.statusCode, 200, ready.body)
|
||||
assert.equal(ready.json().ok, true, ready.body); assert.equal(ready.json().checks.protocolHandshake, true)
|
||||
assert.equal(ready.json().protocolProbe.status, "passed"); assert.equal(ready.json().protocolProbe.clientCredentialsVerified, false)
|
||||
assert.equal(ready.json().protocolProbe.capabilitiesRead, "skipped")
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_credentials WHERE connection_id=$1 AND client_id='mcp-readiness-probe'", [readinessAccess.connection.id])).rows[0].n, 0)
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_grants WHERE connection_id=$1", [readinessAccess.connection.id])).rows[0].n, 0)
|
||||
const duplicateReady = await app.inject({ method: "POST", url: `/api/mcp/connections/${readinessAccess.connection.id}/check`, headers: readinessHeaders, payload: {} })
|
||||
assert.equal(duplicateReady.statusCode, 429)
|
||||
await setConnectionStatus(readinessAccess.connection.id, "paused", actor)
|
||||
const pausedSimulation = await policyPreview(simulatedServerRead)
|
||||
assert.equal(pausedSimulation.statusCode, 200, pausedSimulation.body)
|
||||
assert.equal(pausedSimulation.json().result.decision, "denied")
|
||||
assert.ok(pausedSimulation.json().result.reasons.some((reason: { code: string }) => reason.code === "CONNECTION_INACTIVE"))
|
||||
const pausedReady = await app.inject({ method: "POST", url: `/api/mcp/connections/${readinessAccess.connection.id}/check`, headers: readinessHeaders, payload: {} })
|
||||
assert.equal(pausedReady.statusCode, 200); assert.equal(pausedReady.json().protocolProbe.status, "skipped")
|
||||
const readableAccess = await createMcpConnection(mcpConnectionCreateSchema.parse({ ...input, name: "Actual readiness capability read", scope: { ...input.scope, operationIds: ["servers.list", "capabilities.read"] } }), actor)
|
||||
const readable = await app.inject({ method: "POST", url: `/api/mcp/connections/${readableAccess.connection.id}/check`, headers: readinessHeaders, payload: {} })
|
||||
assert.equal(readable.statusCode, 200, readable.body)
|
||||
assert.equal(readable.json().ok, true, readable.body)
|
||||
assert.equal(readable.json().protocolProbe.capabilitiesRead, "passed")
|
||||
assert.equal(readable.json().protocolProbe.credentialType, "temporary-capabilities-read")
|
||||
const readinessReads = (await pool.query("SELECT tool FROM mcp_requests WHERE connection_id=$1 AND tool NOT LIKE 'protocol:%'", [readableAccess.connection.id])).rows
|
||||
assert.deepEqual(readinessReads.map(row => row.tool), ["mm_capabilities_get"])
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_credentials WHERE connection_id=$1 AND client_id='mcp-readiness-probe'", [readableAccess.connection.id])).rows[0].n, 0)
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_grants WHERE connection_id=$1", [readableAccess.connection.id])).rows[0].n, 0)
|
||||
const emptyGrantAccess = await createMcpConnection(mcpConnectionCreateSchema.parse({ ...input, name: "Readiness has no operation authority" }), actor)
|
||||
const { withMcpProbeCredential } = await import("./readiness.js")
|
||||
let endedProbeToken = ""
|
||||
@@ -2980,7 +3004,7 @@ try {
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_grants WHERE connection_id=$1", [emptyGrantAccess.connection.id])).rows[0].n, 0)
|
||||
const readinessAudit = (await pool.query("SELECT payload FROM mcp_audit WHERE connection_id=$1", [emptyGrantAccess.connection.id])).rows
|
||||
assert.ok(!JSON.stringify(readinessAudit).includes(endedProbeToken))
|
||||
console.log("✓ Actual readiness initialize/tools-list over public HTTP: temporary empty grant, no tool authority, cleanup on success/error, cooldown and paused precheck skip")
|
||||
console.log("✓ Actual readiness initialize/tools-list and optional capabilities read over public HTTP: narrow grant, cleanup on success/error, cooldown and paused precheck skip")
|
||||
const deviceConnection = await createMcpConnection(mcpConnectionCreateSchema.parse({ ...input, name: "Web interfaces", scope: { ...input.scope, operationIds: ["ros.bridge.list", "ros.bridge.create"] } }), actor)
|
||||
const deviceHeaders = { authorization: "Bearer " + jwt }
|
||||
const deviceCatalog = await app.inject({ url: "/api/mcp/devices/catalog?connectionId=" + deviceConnection.connection.id, headers: deviceHeaders })
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { randomUUID } from "node:crypto"
|
||||
import type { IncomingMessage, ServerResponse } from "node:http"
|
||||
import { setTimeout as delay } from "node:timers/promises"
|
||||
import type { FastifyInstance } from "fastify"
|
||||
@@ -12,7 +13,7 @@ export async function verifyLogsFollowSdkCancellation(app: FastifyInstance, endp
|
||||
const access = await createMcpConnection(mcpConnectionCreateSchema.parse({
|
||||
name: "Logs follow SDK cancellation", mode: "approval", permissions: ["mm:servers:read"],
|
||||
expiresAt: new Date(Math.min(actor.expiresAt ?? Infinity, Date.now() + 600_000)).toISOString(),
|
||||
scope: { serverIds: [1], operationIds: ["logs.follow"], allowGlobal: false },
|
||||
scope: { serverIds: [1], operationIds: ["logs.follow", "logs.query"], allowGlobal: false },
|
||||
}), actor)
|
||||
const client = new Client({ name: "logs-follow-sdk-cancellation", version: "1.0.0" }, {
|
||||
versionNegotiation: { mode: { pin: "2026-07-28" } },
|
||||
@@ -76,6 +77,63 @@ export async function verifyLogsFollowSdkCancellation(app: FastifyInstance, endp
|
||||
release()
|
||||
await refused.catch(() => undefined)
|
||||
}
|
||||
pool.query = originalQuery
|
||||
const from = "2000-01-01T00:00:00Z", to = "2000-01-01T00:30:00Z"
|
||||
const followOnce = (filters: { from?: string; cursor?: string }) => client.callTool({
|
||||
name: "mm_logs_follow", arguments: { serverId: 1, waitSeconds: 0, to, ...filters },
|
||||
})
|
||||
const initial = await followOnce({ from })
|
||||
assert.ok(!initial.isError)
|
||||
const cursor = (initial.structuredContent as { result?: { cursor?: unknown } } | undefined)?.result?.cursor
|
||||
assert.ok(typeof cursor === "string" && cursor.length > 0)
|
||||
assert.ok(!(await followOnce({ from, cursor })).isError)
|
||||
assert.ok(!(await followOnce({ cursor })).isError, "omitting from must resume the historical cursor's period")
|
||||
const changed = await followOnce({ from: "2000-01-01T00:01:00Z", cursor })
|
||||
assert.equal(changed.isError, true)
|
||||
assert.match(JSON.stringify(changed), /RESET_REQUIRED/)
|
||||
assert.doesNotMatch(JSON.stringify(changed), /"cursor"/)
|
||||
console.log("✓ MCP logs follow: historical cursor resumes, changed from requires reset")
|
||||
|
||||
const marker = `mcp-logs-cursor-${randomUUID()}`
|
||||
const readFollowPage = async (options: { cursor?: string; limit?: number }) => {
|
||||
const result = await client.callTool({ name: "mm_logs_follow", arguments: { serverId: 1, from, to, q: marker, waitSeconds: 0, ...options } })
|
||||
assert.ok(!result.isError)
|
||||
return (result.structuredContent as { result: { entries: { id: string }[]; cursor: string } }).result
|
||||
}
|
||||
const start = await readFollowPage({})
|
||||
assert.deepEqual(start.entries, [])
|
||||
try {
|
||||
await pool.query(`INSERT INTO router_log_entries(server_id,server_name,host,router_id,raw_time,received_at,effective_at,topics,level,message,generation)
|
||||
SELECT 1,'cursor fixture','127.0.0.1','fixture','00:02:00',now(),$1::timestamptz+n*interval '2 minutes',ARRAY['system'],'info',$2,0
|
||||
FROM generate_series(1,2) AS n`, [from, marker])
|
||||
const defaultFollow = await readFollowPage({ cursor: start.cursor })
|
||||
assert.equal(defaultFollow.entries.length, 2)
|
||||
const firstFollow = await readFollowPage({ cursor: start.cursor, limit: 1 })
|
||||
const secondFollow = await readFollowPage({ cursor: firstFollow.cursor, limit: 1 })
|
||||
assert.equal(firstFollow.entries.length, 1)
|
||||
assert.equal(secondFollow.entries.length, 1)
|
||||
assert.deepEqual([...firstFollow.entries, ...secondFollow.entries].map(row => row.id), defaultFollow.entries.map(row => row.id))
|
||||
assert.deepEqual((await readFollowPage({ cursor: secondFollow.cursor, limit: 1 })).entries, [])
|
||||
console.log("✓ MCP logs follow: requested batch limit and lossless cursor progression")
|
||||
const query = (filters: { from?: string; cursor?: string }) => client.callTool({
|
||||
name: "mm_logs_query", arguments: { serverId: 1, q: marker, limit: 1, to, ...filters },
|
||||
})
|
||||
type Page = { entries: { id: string }[]; nextCursor: string | null }
|
||||
const first = await query({ from })
|
||||
assert.ok(!first.isError)
|
||||
const firstPage = (first.structuredContent as { result: Page }).result
|
||||
assert.equal(firstPage.entries.length, 1)
|
||||
assert.ok(firstPage.nextCursor)
|
||||
const next = await query({ cursor: firstPage.nextCursor })
|
||||
assert.ok(!next.isError)
|
||||
const nextPage = (next.structuredContent as { result: Page }).result
|
||||
assert.equal(nextPage.entries.length, 1)
|
||||
assert.notEqual(nextPage.entries[0].id, firstPage.entries[0].id)
|
||||
assert.equal(nextPage.nextCursor, null)
|
||||
console.log("✓ MCP logs query: historical pagination resumes without resending from")
|
||||
} finally {
|
||||
await pool.query("DELETE FROM router_log_entries WHERE server_id=1 AND message=$1", [marker])
|
||||
}
|
||||
} finally {
|
||||
bound.abort()
|
||||
pool.query = originalQuery
|
||||
|
||||
@@ -41,7 +41,7 @@ export async function registerManagementChannel(raw: unknown, actor: AuthUser) {
|
||||
})
|
||||
return { id, serverId: input.serverId, expiresAt: input.expiresAt, verification: "identity-and-reachability", independence: "human-attestation" }
|
||||
}
|
||||
export async function verifyManagementChannel(serverId: number, requiredId?: string) {
|
||||
async function verifiedManagementChannel(serverId: number, requiredId?: string) {
|
||||
const { rows: [row] } = await pool.query("SELECT * FROM mcp_management_channels WHERE server_id=$1 AND revoked_at IS NULL AND expires_at>now()", [serverId])
|
||||
if (!row || requiredId && row.id !== requiredId || row.generation !== await accessGeneration()) throw new McpError("APPROVAL_REQUIRED", "Нет актуального проверенного независимого канала управления", 409)
|
||||
const config = JSON.parse(await decryptSecret(row.config_sealed)) as MikrotikConnectParams
|
||||
@@ -50,7 +50,17 @@ export async function verifyManagementChannel(serverId: number, requiredId?: str
|
||||
if (hashes.some(value => value !== row.identity_hash)) throw new McpError("STATE_CONFLICT", "Идентичность основного или management-канала изменилась", 409)
|
||||
const changed = await pool.query("UPDATE mcp_management_channels SET verified_at=now() WHERE id=$1 AND revoked_at IS NULL AND expires_at>now() RETURNING id", [row.id])
|
||||
if (!changed.rowCount) throw new McpError("APPROVAL_REQUIRED", "Допуск management-канала был отозван во время проверки", 409)
|
||||
return { channelId: row.id as string, serverId, expiresAt: row.expires_at.toISOString() as string }
|
||||
return { channelId: row.id as string, serverId, expiresAt: row.expires_at.toISOString() as string, host: config.host }
|
||||
}
|
||||
export async function verifyManagementChannel(serverId: number, requiredId?: string) {
|
||||
const { host: _host, ...receipt } = await verifiedManagementChannel(serverId, requiredId)
|
||||
return receipt
|
||||
}
|
||||
/** Internal VLAN preparation uses the verified endpoint to trace its actual
|
||||
* address/interface. It is not accepted from tool input or returned in the
|
||||
* public channel receipt. */
|
||||
export async function verifyBridgeManagementChannel(serverId: number, requiredId?: string) {
|
||||
return verifiedManagementChannel(serverId, requiredId)
|
||||
}
|
||||
export async function managementEvidence(serverIds: number[]) {
|
||||
try { return { requiresHuman: false, managementChannels: await Promise.all([...new Set(serverIds)].map(serverId => verifyManagementChannel(serverId))) } }
|
||||
|
||||
@@ -11,7 +11,7 @@ const creates = rosResources.filter(resource => !resource.readOnly && resource.c
|
||||
assert.equal(creates.length, 30)
|
||||
for (const resource of creates) {
|
||||
const action = findAction(`mm_${resource.id}_create_plan`)
|
||||
assert.equal(action.operation.version, ["ospf_template", "ipsec_peer"].includes(resource.id) ? 5 : ["wireguard", "vrf"].includes(resource.id) ? 4 : 3)
|
||||
assert.equal(action.operation.version, ["ospf_template", "ipsec_peer", "vrf"].includes(resource.id) ? 5 : ["wireguard", "bridge", "bridge_port", "bridge_vlan"].includes(resource.id) ? 4 : 3)
|
||||
assert.equal(action.schema.safeParse({ serverId: 1, fields: {} }).success, true)
|
||||
for (const id of ["*OLD", undefined, null, ""]) {
|
||||
const rejected = action.schema.safeParse({ serverId: 1, fields: {}, id })
|
||||
|
||||
@@ -38,7 +38,7 @@ assert.throws(() => action.schema.parse({ serverId: 1, expectedServerProof: "for
|
||||
assert.throws(() => action.schema.parse({ serverId: 1, version: 1 }))
|
||||
assert.equal(action.schema.parse({ serverId: 1 }).family, "ipv4")
|
||||
assert.equal(findAction("mm_routing_measurement_plan").operation.version, 2)
|
||||
assert.equal(findAction("mm_operation_recovery_plan").operation.version, 7)
|
||||
assert.equal(findAction("mm_operation_recovery_plan").operation.version, 8)
|
||||
assert.equal(findAction("mm_ospf_template_create_plan").operation.version, 5)
|
||||
assert.equal(findAction("mm_ospf_template_update_plan").operation.version, 4)
|
||||
assert.equal(findAction("mm_ospf_template_delete_plan").operation.version, 3)
|
||||
@@ -49,11 +49,11 @@ assert.equal(findAction("mm_wireguard_update_plan").operation.version, 3)
|
||||
assert.equal(findAction("mm_wireguard_interface_edit_plan").operation.version, 3)
|
||||
assert.equal(findAction("mm_wireguard_interface_create_plan").operation.version, 3)
|
||||
assert.equal(findAction("mm_wireguard_create_plan").operation.version, 4)
|
||||
assert.equal(findAction("mm_interfaces_update_plan").operation.version, 4)
|
||||
assert.equal(findAction("mm_interfaces_update_plan").operation.version, 5)
|
||||
assert.equal(findAction("mm_ipsec_peer_delete_plan").operation.version, 3)
|
||||
assert.equal(findAction("mm_ipsec_peer_update_plan").operation.version, 3)
|
||||
assert.equal(findAction("mm_certificate_delete_plan").operation.version, 3)
|
||||
for (const [tool, version] of [["mm_route_optimizer_plan", 7], ["mm_route_profile_save_plan", 4], ["mm_route_path_verify", 2], ["mm_operation_recovery_plan", 7], ["mm_ecmp_plan", 2], ["mm_rpf_plan", 2], ["mm_vrf_plan", 3], ["mm_firewall_rule_update_plan", 2]] as const) {
|
||||
for (const [tool, version] of [["mm_route_optimizer_plan", 7], ["mm_route_profile_save_plan", 4], ["mm_route_path_verify", 2], ["mm_operation_recovery_plan", 8], ["mm_ecmp_plan", 2], ["mm_rpf_plan", 2], ["mm_vrf_plan", 4], ["mm_firewall_rule_update_plan", 2]] as const) {
|
||||
const routed = findAction(tool)
|
||||
assert.equal(routed.operation.version, version)
|
||||
assert.equal(findMcpOperation(routed.operation.id)?.version, version)
|
||||
|
||||
@@ -2,7 +2,7 @@ import assert from "node:assert/strict"
|
||||
import { createOspfOwnerSourceGuard, verifyOspfOwnerGraph, verifyOspfOwnerGraphAtPhase } from "./ospf-owner-graph.js"
|
||||
import { fingerprint, McpError, redact } from "./security.js"
|
||||
import { createRosPrefix } from "./ros-prefix.js"
|
||||
import { ROS_SNAPSHOT_VERSION, type RosSnapshot } from "./resources.js"
|
||||
import { rosSnapshotVersion, type RosSnapshot } from "./resources.js"
|
||||
|
||||
const ids = [1, 2, 3]
|
||||
const graph = { family: "ipv4" as const, sourceSecretProofs: ids.map(serverId => ({ serverId, proof: fingerprint({ serverId }) })), instances: ids.map(serverId => ({ serverId, fingerprint: fingerprint({ serverId, native: "instances" }) })) }
|
||||
@@ -54,7 +54,7 @@ const catalogAuthorize = async () => {
|
||||
await sourceGuard()
|
||||
}
|
||||
const catalogRows = [{ ".id": "*A", name: "keep", disabled: "false" }]
|
||||
const catalog: RosSnapshot = { serverId: 1, resource: "bridge", rows: catalogRows, fingerprint: fingerprint(catalogRows), projectionVersion: ROS_SNAPSHOT_VERSION, sourceProof: "a".repeat(64) }
|
||||
const catalog: RosSnapshot = { serverId: 1, resource: "bridge", rows: catalogRows, fingerprint: fingerprint(catalogRows), projectionVersion: rosSnapshotVersion("bridge"), sourceProof: "a".repeat(64) }
|
||||
reads = []
|
||||
const catalogPrefix = createRosPrefix([catalog], async (_id, _resource, beforeRead = async () => {}) => {
|
||||
// Match readRosSnapshot's normal three grant/source fences without polling a
|
||||
|
||||
@@ -21,7 +21,7 @@ test("failed/malformed/redirected and stalled protocol probes are bounded and ne
|
||||
try {
|
||||
for (const state of ["malformed", "redirect", "large", "announced", "stalled"]) {
|
||||
mode = state
|
||||
const started = performance.now(), result = await runMcpProtocolProbe(endpoint, "private-readiness-fixture", 300)
|
||||
const started = performance.now(), result = await runMcpProtocolProbe(endpoint, "private-readiness-fixture", { timeoutMs: 300 })
|
||||
assert.equal(result.status, "failed", state)
|
||||
assert.ok(performance.now() - started < 3000, state)
|
||||
assert.ok(!JSON.stringify(result).includes("private-readiness-fixture"))
|
||||
@@ -29,3 +29,49 @@ test("failed/malformed/redirected and stalled protocol probes are bounded and ne
|
||||
assert.equal(forwarded, 0); assert.ok(requests >= 5)
|
||||
} finally { server.closeAllConnections(); await new Promise<void>(resolve => server.close(() => resolve())) }
|
||||
})
|
||||
|
||||
test("capabilities readiness refuses widened scope and checks the tool result", async () => {
|
||||
const capability = { id: "capabilities.read", toolName: "mm_capabilities_get" }
|
||||
const tool = { name: capability.toolName, inputSchema: { type: "object" } }
|
||||
let mode = "extra-tool", calls = 0
|
||||
const server = createServer(async (req, res) => {
|
||||
if (req.method !== "POST") { res.writeHead(405).end(); return }
|
||||
const chunks: Buffer[] = []
|
||||
for await (const chunk of req) chunks.push(chunk)
|
||||
const { id, method, params } = JSON.parse(Buffer.concat(chunks).toString())
|
||||
if (id === undefined) { res.writeHead(202).end(); return }
|
||||
let result: unknown
|
||||
if (method === "initialize") result = { protocolVersion: params.protocolVersion, capabilities: { tools: {} }, serverInfo: { name: "fixture", version: "1.0.0" } }
|
||||
if (method === "tools/list") result = { tools: mode === "extra-tool" ? [tool, { ...tool, name: "mm_servers_list" }] : [tool] }
|
||||
if (method === "tools/call") {
|
||||
calls++
|
||||
assert.equal(params.name, capability.toolName)
|
||||
if (mode === "timeout") { res.writeHead(200, { "content-type": "application/json" }).write("{"); return }
|
||||
const operations = mode === "extra-operation" ? [capability, { id: "servers.list" }] : [capability]
|
||||
result = { content: [], isError: mode === "tool-error", structuredContent: { result: { schemaVersion: 1, operations } } }
|
||||
}
|
||||
res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ jsonrpc: "2.0", id, result }))
|
||||
})
|
||||
await new Promise<void>(resolve => server.listen(0, "127.0.0.1", resolve))
|
||||
const endpoint = new URL(`http://127.0.0.1:${(server.address() as { port: number }).port}/mcp`)
|
||||
const probe = () => runMcpProtocolProbe(endpoint, "private-readiness-fixture", { timeoutMs: 400, readCapabilities: true })
|
||||
try {
|
||||
const widened = await probe()
|
||||
assert.equal(widened.reason, "SCOPE_NOT_ENFORCED")
|
||||
assert.equal(widened.capabilitiesRead, "skipped")
|
||||
assert.equal(calls, 0)
|
||||
for (const state of ["tool-error", "extra-operation", "timeout"]) {
|
||||
mode = state
|
||||
const result = await probe()
|
||||
assert.equal(result.status, "failed", state)
|
||||
assert.equal(result.capabilitiesRead, "failed", state)
|
||||
assert.equal(result.reason, state === "timeout" ? "TIMEOUT" : "CAPABILITIES_READ_FAILED", state)
|
||||
}
|
||||
mode = "valid"
|
||||
const valid = await probe()
|
||||
assert.equal(valid.status, "passed")
|
||||
assert.equal(valid.capabilitiesRead, "passed")
|
||||
assert.equal(valid.clientCredentialsVerified, false)
|
||||
assert.equal(calls, 4)
|
||||
} finally { server.closeAllConnections(); await new Promise<void>(resolve => server.close(() => resolve())) }
|
||||
})
|
||||
@@ -9,15 +9,19 @@ export interface ProtocolProbe {
|
||||
status: "passed" | "failed" | "skipped";
|
||||
elapsedMs: number;
|
||||
reason?: string;
|
||||
credentialType: "temporary-no-operations";
|
||||
credentialType: "temporary-no-operations" | "temporary-capabilities-read";
|
||||
capabilitiesRead: "passed" | "failed" | "skipped";
|
||||
clientCredentialsVerified: false;
|
||||
}
|
||||
|
||||
/** A temporary access credential may negotiate metadata, but its empty grant
|
||||
* permits no tools. The ordinary connection credentials are never recovered. */
|
||||
export async function withMcpProbeCredential<T>(connectionId: string, actor: AuthUser, work: (token: string) => Promise<T>): Promise<T> {
|
||||
const capabilitiesOperation = "capabilities.read"
|
||||
const capabilitiesTool = "mm_capabilities_get"
|
||||
|
||||
/** The probe may read its own narrowed capabilities when the connection grants
|
||||
* that operation. The ordinary connection credentials are never recovered. */
|
||||
export async function withMcpProbeCredential<T>(connectionId: string, actor: AuthUser, work: (token: string, readCapabilities: boolean) => Promise<T>): Promise<T> {
|
||||
const credentialId = randomUUID(), grantId = randomUUID(), token = randomToken("access")
|
||||
await transaction(async client => {
|
||||
const readCapabilities = await transaction(async client => {
|
||||
await client.query("SELECT id FROM mcp_connections WHERE id=$1 FOR UPDATE", [connectionId])
|
||||
const connection = await getConnection(connectionId, client)
|
||||
assertConnectionVisible(connection, actor)
|
||||
@@ -27,14 +31,16 @@ export async function withMcpProbeCredential<T>(connectionId: string, actor: Aut
|
||||
const expired = (await client.query("DELETE FROM mcp_credentials WHERE connection_id=$1 AND client_id='mcp-readiness-probe' AND expires_at<=now() RETURNING id", [connectionId])).rows.map(row => row.id)
|
||||
if (expired.length) await client.query("DELETE FROM mcp_grants WHERE connection_id=$1 AND payload->>'credentialId'=ANY($2::text[])", [connectionId, expired])
|
||||
const expiresAt = new Date(Math.min(Date.now() + 20000, Date.parse(connection.policy.expiresAt), connection.owner_valid_until.getTime())).toISOString()
|
||||
const grant = mcpTemporaryGrantSchema.parse({ id: grantId, startsAt: new Date(Date.now() - 1000).toISOString(), expiresAt, scope: { serverIds: [], operationIds: [], allowGlobal: false } })
|
||||
const allowed = connection.policy.scope.operationIds.includes(capabilitiesOperation)
|
||||
const grant = mcpTemporaryGrantSchema.parse({ id: grantId, startsAt: new Date(Date.now() - 1000).toISOString(), expiresAt, scope: { serverIds: [], operationIds: allowed ? [capabilitiesOperation] : [], allowGlobal: false } })
|
||||
await client.query("INSERT INTO mcp_credentials(id,connection_id,digest,kind,expires_at,audience,client_id) VALUES($1,$2,$3,'access',$4,$5,'mcp-readiness-probe')", [credentialId, connectionId, tokenDigest(token), expiresAt, canonicalMcpUrl().href])
|
||||
await client.query("INSERT INTO mcp_grants(id,connection_id,payload) VALUES($1,$2,$3::jsonb)", [grantId, connectionId, JSON.stringify({ ...grant, credentialId })])
|
||||
await validatePrincipal({ connectionId, credentialId, credentialExpiresAt: expiresAt }, client)
|
||||
await audit(client, actor.id, "connection.handshake.start", connectionId, { credentialId, expiresAt })
|
||||
return allowed
|
||||
})
|
||||
let completed = false
|
||||
try { const result = await work(token); completed = true; return result }
|
||||
try { const result = await work(token, readCapabilities); completed = true; return result }
|
||||
finally {
|
||||
await transaction(async client => {
|
||||
await client.query("DELETE FROM mcp_grants WHERE id=$1 AND connection_id=$2", [grantId, connectionId])
|
||||
@@ -45,11 +51,12 @@ export async function withMcpProbeCredential<T>(connectionId: string, actor: Aut
|
||||
}
|
||||
|
||||
/** One deadline covers negotiation, metadata and HTTP response bodies. */
|
||||
export async function runMcpProtocolProbe(endpoint: URL, token: string, timeoutMs = 8000): Promise<ProtocolProbe> {
|
||||
export async function runMcpProtocolProbe(endpoint: URL, token: string, { timeoutMs = 8000, readCapabilities = false } = {}): Promise<ProtocolProbe> {
|
||||
const started = performance.now(), controller = new AbortController()
|
||||
const timer = setTimeout(() => controller.abort(), timeoutMs)
|
||||
const client = new Client({ name: "MikrotikManager readiness", version: "1.0.0" })
|
||||
const result = (status: ProtocolProbe["status"], reason?: string): ProtocolProbe => ({ status, reason, elapsedMs: Math.round(performance.now() - started), credentialType: "temporary-no-operations", clientCredentialsVerified: false })
|
||||
let capabilitiesRead: ProtocolProbe["capabilitiesRead"] = "skipped"
|
||||
const result = (status: ProtocolProbe["status"], reason?: string): ProtocolProbe => ({ status, reason, elapsedMs: Math.round(performance.now() - started), credentialType: readCapabilities ? "temporary-capabilities-read" : "temporary-no-operations", capabilitiesRead, clientCredentialsVerified: false })
|
||||
try {
|
||||
const transport = new StreamableHTTPClientTransport(endpoint, { requestInit: { headers: { Authorization: `Bearer ${token}` }, redirect: "error" }, redirectPolicy: "follow",
|
||||
fetch: async (url, init) => {
|
||||
@@ -67,13 +74,22 @@ export async function runMcpProtocolProbe(endpoint: URL, token: string, timeoutM
|
||||
} })
|
||||
await client.connect(transport, { timeout: timeoutMs })
|
||||
const tools = await client.listTools({}, { timeout: timeoutMs })
|
||||
if (tools.tools.length !== 0 || tools.nextCursor) return result("failed", "SCOPE_NOT_ENFORCED")
|
||||
const expectedTools = readCapabilities ? [capabilitiesTool] : []
|
||||
if (tools.nextCursor || tools.tools.length !== expectedTools.length || tools.tools.some((tool, index) => tool.name !== expectedTools[index])) return result("failed", "SCOPE_NOT_ENFORCED")
|
||||
if (readCapabilities) {
|
||||
capabilitiesRead = "failed"
|
||||
const call = await client.callTool({ name: capabilitiesTool, arguments: {} }, { timeout: timeoutMs })
|
||||
const output = (call.structuredContent as { result?: { schemaVersion?: unknown; operations?: unknown } } | undefined)?.result
|
||||
const operations = output?.operations
|
||||
if (call.isError || output?.schemaVersion !== 1 || !Array.isArray(operations) || operations.length !== 1 || operations[0]?.id !== capabilitiesOperation || operations[0]?.toolName !== capabilitiesTool) return result("failed", "CAPABILITIES_READ_FAILED")
|
||||
capabilitiesRead = "passed"
|
||||
}
|
||||
return result("passed")
|
||||
} catch { return result("failed", controller.signal.aborted ? "TIMEOUT" : "TRANSPORT_FAILED") }
|
||||
} catch { return result("failed", controller.signal.aborted ? "TIMEOUT" : capabilitiesRead === "failed" ? "CAPABILITIES_READ_FAILED" : "TRANSPORT_FAILED") }
|
||||
finally { clearTimeout(timer); controller.abort(); await client.close().catch(() => {}) }
|
||||
}
|
||||
|
||||
export async function checkMcpProtocol(connectionId: string, actor: AuthUser) {
|
||||
const endpoint = canonicalMcpUrl()
|
||||
return withMcpProbeCredential(connectionId, actor, token => runMcpProtocolProbe(endpoint, token))
|
||||
return withMcpProbeCredential(connectionId, actor, (token, readCapabilities) => runMcpProtocolProbe(endpoint, token, { readCapabilities }))
|
||||
}
|
||||
@@ -6,13 +6,14 @@ import { decryptSecret, fingerprint, McpError } from "./security.js"
|
||||
import { effectiveMcpConnection } from "./store.js"
|
||||
import { findMcpService } from "./service-registry.js"
|
||||
import { findMcpOperation } from "./registry.js"
|
||||
import { readRosSnapshot, resourceById, routerClient, validateRosStep, splitOspfPassiveUpdate, ROS_SNAPSHOT_VERSION, type RosSnapshot, type RosStep } from "./resources.js"
|
||||
import { readRosSnapshot, resourceById, routerClient, validateRosStep, splitOspfPassiveUpdate, rosSnapshotVersion, type RosSnapshot, type RosStep } from "./resources.js"
|
||||
import { verifyRosStepSnapshots } from "./ros-step-verification.js"
|
||||
import type { add } from "./actions.js"
|
||||
import type { ActionContext, ChangeEvidence, ChangeStep } from "./action-types.js"
|
||||
import { loadScopedRecoverySource } from "./routing-community-scoped-recovery-source.js"
|
||||
import { prepareScopedRecovery, registerScopedRecoveryService } from "./routing-community-scoped-recovery.js"
|
||||
import { reconcileVrfProductionStep } from "../../services/vrf-production-execution.js"
|
||||
import { needsBridgeVlanRecovery, prepareBridgeVlanRecovery } from "./bridge-vlan-recovery.js"
|
||||
|
||||
async function source(operationId: string, context: ActionContext, allowServices = false) {
|
||||
const { rows: [row] } = await pool.query("SELECT o.*,p.operation_id AS source_action,p.operation_version AS source_version,p.evidence FROM mcp_operations o JOIN mcp_plans p ON p.id=o.plan_id WHERE o.id=$1 AND o.connection_id=$2", [operationId, context.connection.id])
|
||||
@@ -86,7 +87,7 @@ export function registerRecoveryActions(register: typeof add) {
|
||||
},
|
||||
})
|
||||
register("operations.recover", "mm_operation_recovery_plan", "Подготовить отдельный обратный план сетевой операции", "network", "mm:network:write", "write", "servers", z.object({ operationId: z.string().uuid() }).strict(), {
|
||||
version: 7,
|
||||
version: 8,
|
||||
target: async (input, context) => {
|
||||
const { evidence } = await source(String(input.operationId), context, true)
|
||||
if (evidence.steps.some(step => step.kind === "ros" && step.step.resource === "vrf")) throw new McpError("UNSUPPORTED_CAPABILITY", "VRF не имеет проверенной обратной ревизии; используйте read-only сверку и отдельный approved план", 409)
|
||||
@@ -106,6 +107,7 @@ export function registerRecoveryActions(register: typeof add) {
|
||||
const checkpoints = (await pool.query("SELECT step_index,before_sealed,after_sealed FROM mcp_operation_checkpoints WHERE operation_id=$1 ORDER BY step_index DESC", [row.id])).rows
|
||||
const intended = (await pool.query("SELECT step_index,state,result FROM mcp_operation_steps WHERE operation_id=$1 ORDER BY step_index DESC", [row.id])).rows
|
||||
if (!intended.length || intended.some(step => step.state !== "verified") || intended.length !== checkpoints.length || checkpoints.some(checkpoint => !checkpoint.after_sealed)) throw new McpError("STATE_CONFLICT", "Нет полного набора подтверждённых снимков; требуется ручная сверка", 409)
|
||||
if (needsBridgeVlanRecovery(row.source_action, evidence)) return prepareBridgeVlanRecovery({ operationId: row.id, evidence, checkpoints, intended }, context)
|
||||
const snapshots = new Map<string, RosSnapshot>(), steps: ChangeStep[] = [], objects: ChangeEvidence["objects"] = [...evidence.objects]
|
||||
for (const checkpoint of checkpoints) {
|
||||
const original = evidence.steps[checkpoint.step_index]
|
||||
@@ -113,7 +115,7 @@ export function registerRecoveryActions(register: typeof add) {
|
||||
const step = original.step, resource = resourceById(step.resource)
|
||||
if (!context.connection.policy.scope.serverIds.includes(step.serverId)) throw new McpError("SERVER_DENIED", "Зависимость вне допуска")
|
||||
const before = JSON.parse(await decryptSecret(checkpoint.before_sealed)) as RosSnapshot, after = JSON.parse(await decryptSecret(checkpoint.after_sealed)) as RosSnapshot
|
||||
if (before.projectionVersion !== ROS_SNAPSHOT_VERSION || after.projectionVersion !== ROS_SNAPSHOT_VERSION || !before.sourceProof || before.sourceProof !== after.sourceProof || before.fingerprint !== fingerprint(before.rows) || after.fingerprint !== fingerprint(after.rows) || !verifyRosStepSnapshots(step, intended.find(item => item.step_index === checkpoint.step_index)?.result, before, after)) throw new McpError("STATE_CONFLICT", "Исходный переход каталога или источник не подтверждён; обратный план запрещён", 409)
|
||||
if (before.projectionVersion !== rosSnapshotVersion(step.resource) || after.projectionVersion !== rosSnapshotVersion(step.resource) || !before.sourceProof || before.sourceProof !== after.sourceProof || before.fingerprint !== fingerprint(before.rows) || after.fingerprint !== fingerprint(after.rows) || !verifyRosStepSnapshots(step, intended.find(item => item.step_index === checkpoint.step_index)?.result, before, after)) throw new McpError("STATE_CONFLICT", "Исходный переход каталога или источник не подтверждён; обратный план запрещён", 409)
|
||||
const key = `${step.serverId}:${step.resource}`
|
||||
if (!snapshots.has(key)) {
|
||||
const current = await readRosSnapshot(step.serverId, step.resource, undefined, after.sourceProof)
|
||||
@@ -143,7 +145,7 @@ export function registerRecoveryActions(register: typeof add) {
|
||||
const key = `${dependency.serverId}:${dependency.resource}`
|
||||
if (snapshots.has(key)) continue
|
||||
const current = await readRosSnapshot(dependency.serverId, dependency.resource, undefined, dependency.sourceProof)
|
||||
if (current.fingerprint !== dependency.fingerprint || current.sourceProof !== dependency.sourceProof || dependency.projectionVersion !== ROS_SNAPSHOT_VERSION) throw new McpError("STATE_CONFLICT", "Зависимость или источник исходного плана изменились", 409)
|
||||
if (current.fingerprint !== dependency.fingerprint || current.sourceProof !== dependency.sourceProof || dependency.projectionVersion !== rosSnapshotVersion(dependency.resource)) throw new McpError("STATE_CONFLICT", "Зависимость или источник исходного плана изменились", 409)
|
||||
snapshots.set(key, current)
|
||||
}
|
||||
objects.push(...[...new Set([...snapshots.values()].map(snapshot => snapshot.serverId))].map(serverId => ({ kind: "server", id: String(serverId), serverId })))
|
||||
|
||||
@@ -5,14 +5,19 @@ import { eq } from "drizzle-orm"
|
||||
import { db } from "../../db/index.js"
|
||||
import { servers } from "../../db/schema.js"
|
||||
import { MikrotikClient } from "../../services/mikrotik.js"
|
||||
import { readRouterOsSnapshotGet } from "../../services/routeros-snapshot-read.js"
|
||||
import { McpError, fingerprint, privateSecretFingerprint } from "./security.js"
|
||||
import { readOspfEffectiveDisabled } from "../../services/ospf-effective-disabled.js"
|
||||
import { greNativeFieldsSchema } from "../../services/gre-mutation-input.js"
|
||||
import { canonicalVrfMembers } from "../../services/vrf-members.js"
|
||||
import { canonicalBridgeVlanValue } from "../../services/bridge-vlan-values.js"
|
||||
|
||||
const text = z.string().max(1000)
|
||||
const name = z.string().trim().min(1).max(100)
|
||||
const bool = z.boolean()
|
||||
const vlanIds = z.string().min(1).max(16384).refine(value => {
|
||||
try { canonicalBridgeVlanValue("vlan-ids", value); return true } catch { return false }
|
||||
}, "Требуется непересекающийся список VLAN ID/диапазонов 1..4094")
|
||||
const integer = (min: number, max: number) => z.number().int().min(min).max(max)
|
||||
const common = { name: name.optional(), comment: text.optional(), disabled: bool.optional() }
|
||||
const ipv4 = name.refine(value => isIP(value) === 4, "Требуется IPv4 router/area ID")
|
||||
@@ -31,13 +36,15 @@ const route = {
|
||||
export interface RosResourceSpec {
|
||||
id: string; path: string; title: string; permission: string; fields: z.ZodObject;
|
||||
create: boolean; remove: boolean; requiredOnCreate?: string[]; readOnly?: boolean
|
||||
/** Native configuration sealed for drift checks, never accepted as writes. */
|
||||
observeFields?: readonly string[]
|
||||
}
|
||||
export const rosResources: RosResourceSpec[] = [
|
||||
{ id: "routing_filter", path: "/routing/filter/rule", title: "Фильтры маршрутизации", permission: "mm:filters", fields: z.object({ chain: text.optional(), rule: text.optional(), comment: text.optional(), disabled: bool.optional() }).strict(), create: false, remove: false, readOnly: true },
|
||||
{ id: "ethernet", path: "/interface/ethernet", title: "Ethernet", permission: "mm:network", fields: z.object({ ...common, mtu: integer(68, 65535).optional(), "auto-negotiation": bool.optional() }).strict(), create: false, remove: false },
|
||||
{ id: "bridge", path: "/interface/bridge", title: "Bridge", permission: "mm:network", fields: z.object({ ...common, mtu: integer(68, 65535).optional(), "vlan-filtering": bool.optional(), pvid: integer(1, 4094).optional(), "protocol-mode": z.enum(["none", "stp", "rstp", "mstp"]).optional() }).strict(), create: true, remove: true, requiredOnCreate: ["name"] },
|
||||
{ id: "bridge", path: "/interface/bridge", title: "Bridge", permission: "mm:network", fields: z.object({ ...common, mtu: integer(68, 65535).optional(), "vlan-filtering": bool.optional(), pvid: integer(1, 4094).optional(), "frame-types": z.enum(["admit-all", "admit-only-vlan-tagged", "admit-only-untagged-and-priority-tagged"]).optional(), "ingress-filtering": bool.optional(), "protocol-mode": z.enum(["none", "stp", "rstp", "mstp"]).optional() }).strict(), observeFields: ["mvrp"], create: true, remove: true, requiredOnCreate: ["name"] },
|
||||
{ id: "bridge_port", path: "/interface/bridge/port", title: "Порты bridge", permission: "mm:network", fields: z.object({ bridge: name.optional(), interface: name.optional(), pvid: integer(1, 4094).optional(), "ingress-filtering": bool.optional(), "frame-types": z.enum(["admit-all", "admit-only-vlan-tagged", "admit-only-untagged-and-priority-tagged"]).optional(), disabled: bool.optional(), comment: text.optional() }).strict(), create: true, remove: true, requiredOnCreate: ["bridge", "interface"] },
|
||||
{ id: "bridge_vlan", path: "/interface/bridge/vlan", title: "Bridge VLAN membership", permission: "mm:network", fields: z.object({ bridge: name.optional(), "vlan-ids": name.optional(), tagged: text.optional(), untagged: text.optional(), disabled: bool.optional(), comment: text.optional() }).strict(), create: true, remove: true, requiredOnCreate: ["bridge", "vlan-ids"] },
|
||||
{ id: "bridge_vlan", path: "/interface/bridge/vlan", title: "Bridge VLAN membership", permission: "mm:network", fields: z.object({ bridge: name.optional(), "vlan-ids": vlanIds.optional(), tagged: text.optional(), untagged: text.optional(), disabled: bool.optional(), comment: text.optional() }).strict(), create: true, remove: true, requiredOnCreate: ["bridge", "vlan-ids"] },
|
||||
{ id: "vlan", path: "/interface/vlan", title: "VLAN", permission: "mm:network", fields: z.object({ ...common, interface: name.optional(), "vlan-id": integer(1, 4094).optional(), mtu: integer(68, 65535).optional(), "use-service-tag": bool.optional() }).strict(), create: true, remove: true, requiredOnCreate: ["name", "interface", "vlan-id"] },
|
||||
{ id: "ipv4_address", path: "/ip/address", title: "IPv4-адреса", permission: "mm:network", fields: z.object({ address: name.optional(), interface: name.optional(), network: name.optional(), comment: text.optional(), disabled: bool.optional() }).strict(), create: true, remove: true, requiredOnCreate: ["address", "interface"] },
|
||||
{ id: "ipv6_address", path: "/ipv6/address", title: "IPv6-адреса", permission: "mm:network", fields: z.object({ address: name.optional(), interface: name.optional(), advertise: bool.optional(), comment: text.optional(), disabled: bool.optional() }).strict(), create: true, remove: true, requiredOnCreate: ["address", "interface"] },
|
||||
@@ -70,6 +77,7 @@ export const rosResources: RosResourceSpec[] = [
|
||||
export type ConfigurationRow = Record<string, unknown>
|
||||
export interface RosStep { serverId: number; resource: string; action: "create" | "update" | "delete"; id?: string; fields: Record<string, string>; placeBeforeId?: string; expectedCost?: number; expectedServerProof?: string }
|
||||
export const ROS_SNAPSHOT_VERSION = 3
|
||||
export const rosSnapshotVersion = (resource: string): number => ["bridge", "bridge_port", "bridge_vlan"].includes(resource) ? 4 : ROS_SNAPSHOT_VERSION
|
||||
export interface RosSnapshot { serverId: number; resource: string; rows: ConfigurationRow[]; fingerprint: string; projectionVersion?: number; sourceProof?: string }
|
||||
export function resourceById(id: string): RosResourceSpec {
|
||||
const resource = rosResources.find(item => item.id === id)
|
||||
@@ -93,13 +101,21 @@ export function configurationRows(resource: RosResourceSpec, payload: unknown):
|
||||
// RouterOS creates/removes IPv6 link-local rows with interface runtime state.
|
||||
// They cannot be configured independently and must not invalidate a sealed
|
||||
// inverse plan when its own GRE is disabled. Explicit addresses remain sealed.
|
||||
const configuration = rows.filter(row => !(resource.id === "ipv6_address" && [true, "true"].includes((row as ConfigurationRow).dynamic as boolean | string) && /^fe80:/i.test(String((row as ConfigurationRow).address))))
|
||||
const configuration = rows.filter(row => !(resource.id === "ipv6_address" && [true, "true"].includes((row as ConfigurationRow).dynamic as boolean | string) && /^fe80:/i.test(String((row as ConfigurationRow).address)))
|
||||
// These rows are generated from bridge/port PVID, not independently
|
||||
// configurable VLAN entries. Their inputs remain sealed in bridge/ports.
|
||||
&& !(resource.id === "bridge_vlan" && [true, "true", "yes"].includes((row as ConfigurationRow).dynamic as boolean | string)))
|
||||
const selectedRows = configuration.map(row => {
|
||||
const selected = Object.fromEntries(Object.entries(row as ConfigurationRow).filter(([key]) => [".id", "dynamic", "builtin", "default", ...fields].includes(key)))
|
||||
const selected = Object.fromEntries(Object.entries(row as ConfigurationRow).filter(([key]) => [".id", "dynamic", "builtin", "default", ...fields, ...(resource.observeFields ?? [])].includes(key)))
|
||||
// RouterOS 7.24.5 returns an explicit empty fib flag for non-FIB tables.
|
||||
// Normalize only this observed field; missing values must remain unknown.
|
||||
if (resource.id === "routing_table" && selected.fib === "") selected.fib = "false"
|
||||
if (resource.id === "vrf" && selected.interfaces !== undefined) selected.interfaces = canonicalVrfMembers(selected.interfaces)
|
||||
if (["bridge_port", "bridge_vlan"].includes(resource.id) && selected.comment === undefined) selected.comment = ""
|
||||
if (resource.id === "bridge_vlan") {
|
||||
try { for (const field of ["vlan-ids", "tagged", "untagged"]) selected[field] = canonicalBridgeVlanValue(field, selected[field]) }
|
||||
catch { throw new McpError("STATE_CONFLICT", "Недостоверная конфигурация VLAN membership", 409) }
|
||||
}
|
||||
return selected
|
||||
})
|
||||
// Reordering an ordered catalog changes configuration even with unchanged rows.
|
||||
@@ -118,10 +134,10 @@ export async function readRosSnapshot(serverId: number, resourceId: string, befo
|
||||
const payload = resourceId === "ospf_template" ? await client.getOspfInterfaceTemplates(checkSource) : ["ospf_instance", "ospf_area", "bgp_instance", "bgp_connection"].includes(resourceId) ? await readOspfEffectiveDisabled(await client.get<unknown>(resource.path), async id => {
|
||||
await checkSource()
|
||||
return client.post(resource.path + "/get", { ".id": id, "value-name": "disabled" })
|
||||
}) : await client.get<unknown>(resource.path)
|
||||
}) : await readRouterOsSnapshotGet<unknown>({ client, path: resource.path, assertCurrent: checkSource })
|
||||
await checkSource()
|
||||
const rows = configurationRows(resource, payload)
|
||||
return { serverId, resource: resourceId, rows, fingerprint: fingerprint(rows), projectionVersion: ROS_SNAPSHOT_VERSION, sourceProof }
|
||||
return { serverId, resource: resourceId, rows, fingerprint: fingerprint(rows), projectionVersion: rosSnapshotVersion(resourceId), sourceProof }
|
||||
}
|
||||
export async function rosSnapshotSourceProof(server: Awaited<ReturnType<typeof routerClient>>["server"]): Promise<string> {
|
||||
return privateSecretFingerprint(fingerprint({ id: server.id, enabled: server.enabled, host: server.host, port: server.port, useSsl: server.useSsl, verifySsl: server.verifySsl, username: server.username, password: server.password, epoch: server.routingEndpointEpoch }), "mcp-ros-snapshot-source-v3")
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
import { fingerprint, McpError } from "./security.js"
|
||||
import { readRosSnapshot, ROS_SNAPSHOT_VERSION, type RosSnapshot, type RosStep } from "./resources.js"
|
||||
import { readRosSnapshot, rosSnapshotVersion, type RosSnapshot, type RosStep } from "./resources.js"
|
||||
import { verifyRosStepSnapshots } from "./ros-step-verification.js"
|
||||
import { acknowledgedCreateId } from "./native-create-identity.js"
|
||||
|
||||
const key = (snapshot: Pick<RosSnapshot, "serverId" | "resource">) => `${snapshot.serverId}:${snapshot.resource}`
|
||||
function valid(snapshot: RosSnapshot): boolean {
|
||||
if (snapshot.projectionVersion !== ROS_SNAPSHOT_VERSION || typeof snapshot.sourceProof !== "string" || !/^[a-f0-9]{64}$/.test(snapshot.sourceProof) || !Array.isArray(snapshot.rows) || snapshot.fingerprint !== fingerprint(snapshot.rows)) return false
|
||||
if (snapshot.projectionVersion !== rosSnapshotVersion(snapshot.resource) || typeof snapshot.sourceProof !== "string" || !/^[a-f0-9]{64}$/.test(snapshot.sourceProof) || !Array.isArray(snapshot.rows) || snapshot.fingerprint !== fingerprint(snapshot.rows)) return false
|
||||
if (["ip_settings", "ipv6_settings"].includes(snapshot.resource)) return snapshot.rows.length === 1 && !!snapshot.rows[0] && typeof snapshot.rows[0] === "object" && !Array.isArray(snapshot.rows[0])
|
||||
const ids = snapshot.rows.map(acknowledgedCreateId)
|
||||
return ids.every(id => id !== undefined) && new Set(ids).size === ids.length
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
import { isDeepStrictEqual } from "node:util"
|
||||
import { acknowledgedCreateId } from "./native-create-identity.js"
|
||||
import { canonicalBridgeVlanValue } from "../../services/bridge-vlan-values.js"
|
||||
import { isOrderedRosResource, resourceById, type ConfigurationRow, type RosResourceSpec, type RosSnapshot, type RosStep } from "./resources.js"
|
||||
|
||||
function booleanValue(value: unknown): unknown {
|
||||
@@ -23,6 +24,9 @@ function requested(resource: RosResourceSpec, fields: RosStep["fields"], row: Co
|
||||
const schema = resource.fields.shape[key]
|
||||
if (!schema || typeof value !== "string" || !Object.hasOwn(row, key) || row[key] === undefined || row[key] === null) return false
|
||||
if (schema.safeParse(true).success) return ["true", "false"].includes(value) && booleanValue(row[key]) === (value === "true")
|
||||
if (resource.id === "bridge_vlan" && ["vlan-ids", "tagged", "untagged"].includes(key)) {
|
||||
try { return canonicalBridgeVlanValue(key, row[key]) === canonicalBridgeVlanValue(key, value) } catch { return false }
|
||||
}
|
||||
return String(row[key]) === value
|
||||
})
|
||||
}
|
||||
|
||||
@@ -34,13 +34,15 @@ import { registerManagementChannel } from "./management.js"
|
||||
import { isSchedulerJobsPaused, pauseSchedulerJobsAndWait, resumeSchedulerJobs } from "../../services/scheduler-running.js"
|
||||
|
||||
/** Disposable SQL + loopback HTTP only. Does not access or configure CHR. */
|
||||
export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options: { originalEffectsOnly?: boolean; originalCredentialRevocationOnly?: boolean; forwardRoundsOnly?: boolean; manualInverseChargeOnly?: boolean; manualInverseChargeCase?: "positive" | "quota" | "concurrent" | "unknown" | "revoked" | "nonpersistent" | "mixed-forward"; lateInverseAuthorityChange?: "edit" | "disable" | "grant" } = {}) {
|
||||
export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options: { originalEffectsOnly?: boolean; controllerFailoverOnly?: boolean; originalCredentialRevocationOnly?: boolean; forwardRoundsOnly?: boolean; manualInverseChargeOnly?: boolean; manualInverseChargeCase?: "positive" | "quota" | "concurrent" | "unknown" | "revoked" | "nonpersistent" | "mixed-forward"; lateInverseAuthorityChange?: "edit" | "disable" | "grant" } = {}) {
|
||||
const sid = options.lateInverseAuthorityChange ? { edit: 131, disable: 132, grant: 133 }[options.lateInverseAuthorityChange] : 131
|
||||
const writer: AuthUser = { ...actor, permissions: [...new Set([...actor.permissions, "mm:filters:write"])] }
|
||||
const initial = compileManagedFilterRules([{ community: "65000:10", gateway: "192.0.2.1", outIface: "", action: "route", description: "" }, { community: "65000:20", gateway: "192.0.2.5", outIface: "", action: "route", description: "" }])
|
||||
const filters = ["a", "b"].map(key => ({ ".id": "*f" + key, chain: "custom-" + key, rule: initial, disabled: "false", comment: managedComment("NEVER_SCOPED_COMMENT_" + key), opaque: "NEVER_SCOPED_OPAQUE" }))
|
||||
let mode: "normal" | "ignored" | "lost" | "collateral" | "post-failed" | "post-unknown" = "normal", writes = 0, requests = 0
|
||||
let controllerProbeUnknown = false
|
||||
let controllerFailoverProbeSources: string[] | undefined
|
||||
let controllerFailoverReserveHealthy = true
|
||||
let pendingPostCheckpoint = false, postCheckpointsObserved = 0
|
||||
let afterForwardWrite: (() => Promise<void>) | undefined
|
||||
let afterConfigurationCheckpoint: ((operationId: string) => Promise<void>) | undefined
|
||||
@@ -65,6 +67,9 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
const effectConnection = { ".id": "*ca", name: "peer-a", instance: "default", vrf: "main", "routing-table": "tenant-a", afi: "ip",
|
||||
"input.filter": "custom-a", "output.filter-chain": "", templates: "", disabled: "false", "use-bfd": "false",
|
||||
"local.address": "198.18.0.1", "remote.address": "198.18.0.2", "remote.as": "65001" }
|
||||
const { vrf: effectTransportVrf, ...effectSessionFields } = effectConnection
|
||||
const effectSession = { ...effectSessionFields, ".id": "*sa", "local.afi": "ip", "remote.afi": "ip", established: "true",
|
||||
"local.address": `${effectConnection["local.address"]}@${effectTransportVrf}`, "remote.address": `${effectConnection["remote.address"]}@${effectTransportVrf}` }
|
||||
const collections = (path: string): Record<string, unknown>[] => ({
|
||||
"/system/resource": [{ version: "7.20.1" }],
|
||||
"/routing/table": ["main", "tenant-a", "tenant-b", "probe-a", "probe-b"].map((name, index) => ({ ".id": "*t" + index, name, fib: "true", disabled: "false", invalid: "false" })),
|
||||
@@ -72,10 +77,13 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
"/routing/bgp/connection": [effectConnection, { ...effectConnection, ".id": "*cb", name: "peer-b", "routing-table": "tenant-b", "input.filter": "custom-b" }],
|
||||
"/routing/bgp/instance": [{ ".id": "*i", name: "default", vrf: "main", "routing-table": "main", disabled: "false" }],
|
||||
"/routing/bgp/template": [], "/routing/filter/rule": filters,
|
||||
"/ip/route": [1, 9].map(value => ({ ".id": "*r" + value, "dst-address": "192.0.2." + value + "/32", "routing-table": "main", disabled: "false",
|
||||
"/ip/route": (controllerFailoverProbeSources ? [1, 9, 10, 11] : [1, 9]).map(value => ({ ".id": "*r" + value, "dst-address": "192.0.2." + value + "/32", "routing-table": "main", disabled: "false",
|
||||
"immediate-gw": "203.0.113." + value + "%wan-a", comment: managedComment("recursive"), opaque: "NEVER_SCOPED_ROUTE" })),
|
||||
"/interface": ["wan-a", "wan-b", "hop", "target"].map((name, index) => ({ ".id": "*if" + index, name, disabled: "false", running: "true" })),
|
||||
"/ip/address": ["wan-a", "wan-b", "hop", "target"].map((name, index) => ({ ".id": "*ad" + index, interface: name, address: "198.51.100." + (index + 1) + "/32", disabled: "false", invalid: "false" })),
|
||||
"/ip/address": [
|
||||
...["wan-a", "wan-b", "hop", "target"].map((name, index) => ({ ".id": "*ad" + index, interface: name, address: "198.51.100." + (index + 1) + "/32", disabled: "false", invalid: "false" })),
|
||||
...(controllerFailoverProbeSources ? [11, 12, 13].map(index => ({ ".id": "*ad" + index, interface: "wan-a", address: "198.51.100." + index + "/32", disabled: "false", invalid: "false" })) : []),
|
||||
],
|
||||
...(options.originalEffectsOnly ? {
|
||||
"/routing/table": ["main", "tenant-a", "tenant-b", "probe-a", "probe-b"].map((name, index) => ({ ".id": "*t" + index, name, fib: "", disabled: "false", invalid: "false" })),
|
||||
"/routing/bgp/connection": [effectConnection],
|
||||
@@ -83,7 +91,7 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
} : {}),
|
||||
...(exposeEffectCatalogue || options.originalEffectsOnly ? {
|
||||
"/routing/route": effectRoutes(),
|
||||
"/routing/bgp/session": [{ ...effectConnection, ".id": "*sa", "local.afi": "ip", "remote.afi": "ip", established: "true" }],
|
||||
"/routing/bgp/session": [effectSession],
|
||||
} : {}),
|
||||
} as Record<string, Record<string, unknown>[]>)[path] ?? []
|
||||
let requestFailure: { error: unknown } | undefined
|
||||
@@ -113,23 +121,27 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
if (req.method === "POST" && path.endsWith("/get")) { const row = collections(path.slice(0, -4)).find(row => row[".id"] === args[".id"]), value = row?.[args["value-name"]]; res.end(JSON.stringify(value === undefined ? [] : { ret: value })); return }
|
||||
if (req.method === "POST" && path === "/tool/ping") {
|
||||
if (pendingInversePost) {
|
||||
const intents = (await pool.query("SELECT source_operation_id FROM mcp_scoped_recovery_intents WHERE state='intent'")).rows
|
||||
assert.ok(connectionId)
|
||||
const intents = (await pool.query("SELECT i.source_operation_id FROM mcp_scoped_recovery_intents i JOIN mcp_operations o ON o.id=i.recovery_operation_id WHERE i.state='intent' AND o.connection_id=$1", [connectionId])).rows
|
||||
assert.equal(intents.length, 1, "Post-inverse probe must follow one durable single-use inverse intent")
|
||||
pendingInversePost = false; inversePostChecks++
|
||||
}
|
||||
if (pendingPostCheckpoint) {
|
||||
const checkpoint = (await pool.query("SELECT c.configuration_sealed,c.configuration_proof FROM mcp_operation_checkpoints c JOIN mcp_operations o ON o.id=c.operation_id WHERE o.state='running' AND c.configuration_sealed IS NOT NULL")).rows
|
||||
assert.ok(connectionId)
|
||||
const checkpoint = (await pool.query("SELECT c.configuration_sealed,c.configuration_proof FROM mcp_operation_checkpoints c JOIN mcp_operations o ON o.id=c.operation_id WHERE o.state='running' AND c.configuration_sealed IS NOT NULL AND o.connection_id=$1", [connectionId])).rows
|
||||
assert.equal(checkpoint.length, 1, "Exact CONFIG_APPLIED must commit before the post-change network probe")
|
||||
const packet = JSON.parse(await decryptSecret(checkpoint[0].configuration_sealed))
|
||||
assert.equal(packet.phase, "CONFIG_APPLIED"); assert.equal(packet.originalRule, initial)
|
||||
assert.equal(packet.originalCandidateId, "a"); assert.equal(packet.desiredCandidateId, "b")
|
||||
assert.equal(packet.originalCandidateId, "a"); assert.equal(packet.desiredCandidateId, controllerFailoverProbeSources ? "d" : "b")
|
||||
assert.equal(packet.desiredRule, filters.find(row => row[".id"] === packet.nativeId)!.rule)
|
||||
assert.ok(checkpoint[0].configuration_proof); pendingPostCheckpoint = false; postCheckpointsObserved++
|
||||
const sharedCheck = afterConfigurationCheckpoint; afterConfigurationCheckpoint = undefined
|
||||
await sharedCheck?.(packet.operationId)
|
||||
}
|
||||
observedVrfs.add(args.vrf)
|
||||
res.end(JSON.stringify(controllerProbeUnknown || mode === "post-unknown" && writes ? [{ message: "unsupported fixture output" }] : [{ sent: "3", received: mode === "post-failed" && writes ? "0" : "3", "packet-loss": mode === "post-failed" && writes ? "100" : "0", "avg-rtt": "1ms" }]))
|
||||
if (controllerFailoverProbeSources) controllerFailoverProbeSources.push(args["src-address"])
|
||||
const probeFailed = controllerFailoverProbeSources && (!controllerFailoverReserveHealthy || args["src-address"] !== "198.51.100.13") || mode === "post-failed" && writes
|
||||
res.end(JSON.stringify(controllerProbeUnknown || mode === "post-unknown" && writes ? [{ message: "unsupported fixture output" }] : [{ sent: "3", received: probeFailed ? "0" : "3", "packet-loss": probeFailed ? "100" : "0", "avg-rtt": "1ms" }]))
|
||||
return
|
||||
}
|
||||
if (req.method === "POST" && path === "/tool/traceroute") { observedVrfs.add(args.vrf); res.end(JSON.stringify([3, 4].map(index => ({ address: "198.51.100." + index, sent: "1", loss: "0" })))); return }
|
||||
@@ -264,6 +276,74 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
return operation
|
||||
} finally { observer.close() }
|
||||
}
|
||||
const acceptControllerFailover = async () => {
|
||||
reset(); await refresh(); exposeEffectCatalogue = true; originalEffectCase = "transition"
|
||||
controllerFailoverProbeSources = []
|
||||
const profileId = randomUUID(), initialWrites = writes
|
||||
persistentProfileIds.push(profileId)
|
||||
try {
|
||||
const configured = profile("a"), original = configured.candidates[0]
|
||||
configured.candidates = [1, 10, 11, 9].map((gateway, index) => ({ ...original,
|
||||
id: ["a", "b", "c", "d"][index], gateway: "192.0.2." + gateway,
|
||||
gatewayRef: { resource: "ipv4_route", id: "*r" + gateway },
|
||||
controlProbe: { ...original.controlProbe!, sourceAddress: "198.51.100." + [1, 11, 12, 13][index] },
|
||||
}))
|
||||
const analysis = await invokeMcpTool(principal, "mm_route_optimizer_analyze", { profile: configured }) as { currentCandidateId: string; ranking: Array<{ eligible: boolean; candidate: { id: string } }> }
|
||||
assert.equal(analysis.currentCandidateId, "a")
|
||||
assert.deepEqual(analysis.ranking.filter(row => row.eligible).map(row => row.candidate.id), ["a", "b", "c", "d"])
|
||||
const enrollment = await invokeMcpTool(principal, "mm_route_profile_save_plan", {
|
||||
profileId, profile: configured, enabled: true, expiresAt: new Date(Date.now() + 600000).toISOString(),
|
||||
}) as { planId: string }
|
||||
await approvePlan(enrollment.planId, writer, true)
|
||||
assert.equal((await execute(enrollment.planId)).state, "applied")
|
||||
const readController = async () => (await pool.query("SELECT enabled,state FROM mcp_routing_profiles WHERE id=$1", [profileId])).rows[0]
|
||||
const failures = new Set<string>()
|
||||
let switchPlanId: string | undefined
|
||||
for (const [index, alternate] of [12, 13, 13, 12, 13].entries()) {
|
||||
// Drive the normal scheduled entry point without waiting a minute.
|
||||
await pool.query("UPDATE mcp_routing_profiles SET state=state-'probedAt' WHERE id=$1", [profileId])
|
||||
controllerFailoverProbeSources.length = 0
|
||||
// The previously passing reserve must be rechecked, and its prior
|
||||
// pass cannot authorize failover if the current check fails.
|
||||
controllerFailoverReserveHealthy = index !== 2
|
||||
await tickRoutingProfiles()
|
||||
const row = await readController()
|
||||
assert.equal(row.enabled, true, String(row.state.pausedReason))
|
||||
assert.deepEqual(controllerFailoverProbeSources, [1, 11, alternate].map(last => "198.51.100." + last))
|
||||
failures.add(row.state.failureKey)
|
||||
assert.equal(failures.size, index + 1, "Each counted failure must come from a distinct path check")
|
||||
assert.equal(writes, initialWrites)
|
||||
if (index < 4) {
|
||||
assert.equal(row.state.failureCount, index + 1)
|
||||
assert.equal(row.state.planId, undefined, "Earlier healthy reserve evidence cannot replace a fresh passing probe")
|
||||
} else {
|
||||
assert.equal(row.state.candidateId, "d")
|
||||
switchPlanId = row.state.planId
|
||||
}
|
||||
}
|
||||
assert.ok(switchPlanId)
|
||||
assert.equal((await loadPlan(switchPlanId)).state, "awaiting-approval")
|
||||
await tickRoutingProfiles()
|
||||
assert.equal(writes, initialWrites)
|
||||
await approvePlan(switchPlanId, writer, true)
|
||||
await tickRoutingProfiles()
|
||||
const operationId: string = (await readController()).state.operationId
|
||||
assert.ok(operationId)
|
||||
assert.equal(await waitForOperation(operationId), "applied")
|
||||
await tickRoutingProfiles()
|
||||
const completed = await readController()
|
||||
assert.equal(completed.enabled, true, String(completed.state.pausedReason))
|
||||
assert.equal(completed.state.baseline.packet.candidateId, "d")
|
||||
assert.equal(completed.state.baseline.packet.transition.operationId, operationId)
|
||||
assert.equal(completed.state.failoverReserveCursor, undefined)
|
||||
assert.equal(writes, initialWrites + 1)
|
||||
const result = { accepted: true, stableRanking: ["a", "b", "c", "d"], selectedReserve: "d", probeCallsPerTick: 3,
|
||||
distinctFailuresBeforePlan: failures.size, priorPassedProbeNotReused: true, humanApproval: true, nativeWrites: 1 }
|
||||
console.log("Bounded controller reserve SQL/HTTP:", JSON.stringify(result))
|
||||
return result
|
||||
} finally { await disablePersistent(profileId); controllerFailoverProbeSources = undefined; controllerFailoverReserveHealthy = true }
|
||||
}
|
||||
if (options.controllerFailoverOnly) return { ...await acceptControllerFailover(), persistentAuthorityCases: 0 }
|
||||
if (options.originalEffectsOnly) {
|
||||
const cases: Array<Record<string, unknown>> = []
|
||||
let publicManualRevision2: Record<string, unknown> | undefined
|
||||
@@ -546,8 +626,9 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
assert.equal(switched.state.baseline.packet.transition.planId, switchPlanId)
|
||||
assert.equal(writes - beforeControllerWrites, 1)
|
||||
await disablePersistent(activeProfileId)
|
||||
const boundedReserveFailover = await acceptControllerFailover()
|
||||
assert.deepEqual((await pool.query("SELECT * FROM filter_rules WHERE server_id=$1 ORDER BY id", [sid])).rows, dbBefore)
|
||||
const result = { accepted: true, cases, publicManualRevision2, persistentAuthorityCases: 0, realMcpDispatcher: true, realSql: true, routerOsTransport: "declared-synthetic-localhost-http",
|
||||
const result = { accepted: true, cases, publicManualRevision2, boundedReserveFailover, persistentAuthorityCases: 0, realMcpDispatcher: true, realSql: true, routerOsTransport: "declared-synthetic-localhost-http",
|
||||
genuineApprovedRunningOrigin: true, actualConfigurationCheckpoint: true, signedEffectTamperRejected: true,
|
||||
originalAutoRecoveryEnabled: false, fullRoutingAccepted: false, scopedControllerEnabled: true, publicScopedControllerLifecycle: true, nativeChrAccepted: false, forwardingVerified: false }
|
||||
console.log("Original effect SQL/runtime component:", JSON.stringify(result))
|
||||
@@ -700,10 +781,20 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
const recovery = await invokeMcpTool(principal, "mm_operation_recovery_plan", { operationId: source.id }) as { planId: string; state: string }
|
||||
assert.equal(recovery.state, "awaiting-approval")
|
||||
assert.equal((await loadPlan(recovery.planId)).operation_id, "operations.recover")
|
||||
assert.equal((await loadPlan(recovery.planId)).operation_version, 7)
|
||||
assert.equal((await loadPlan(recovery.planId)).operation_version, 8)
|
||||
await assert.rejects(applyPlan(principal, recovery.planId, randomUUID()))
|
||||
assert.deepEqual(await snapshot(), afterForward, "No approval means no debit/charge/native write")
|
||||
await approvePlan(recovery.planId, writer, true)
|
||||
if (chargeCase === "positive" && !options.lateInverseAuthorityChange) {
|
||||
await pool.query("UPDATE mcp_plans SET operation_version=7 WHERE id=$1", [recovery.planId])
|
||||
try {
|
||||
await assert.rejects(applyPlan(principal, recovery.planId, randomUUID()), { code: "PLAN_EXPIRED" })
|
||||
assert.equal((await pool.query("SELECT id FROM mcp_operations WHERE plan_id=$1", [recovery.planId])).rowCount, 0)
|
||||
assert.deepEqual(await snapshot(), afterForward, "Superseded approved inverse cannot create an operation, debit or native write")
|
||||
} finally {
|
||||
await pool.query("UPDATE mcp_plans SET operation_version=8 WHERE id=$1", [recovery.planId])
|
||||
}
|
||||
}
|
||||
if (chargeCase === "mixed-forward") {
|
||||
assert(competingForward)
|
||||
const attempts = [
|
||||
@@ -827,9 +918,14 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
assert.equal(afterInverse.forward, persistent ? 1 : 0); assert.equal(afterInverse.manualInverse, persistent ? 1 : 0); assert.equal(afterInverse.total, persistent ? 2 : 0)
|
||||
assert.equal(afterInverse.reserved, 0); assert.equal(afterInverse.legacy, 0)
|
||||
assert.equal(afterInverse.writes, 2); if (chargeCase !== "unknown") assert.equal(inversePostChecks, 1)
|
||||
const charges = (await pool.query("SELECT recovery_operation_id,recovery_plan_id,source_operation_id,profile_id,charge_units FROM mcp_routing_manual_inverse_charges WHERE source_operation_id=$1", [source.id])).rows
|
||||
const charges = (await pool.query("SELECT recovery_operation_id,recovery_plan_id,source_operation_id,profile_id,charge_units,binding_sealed FROM mcp_routing_manual_inverse_charges WHERE source_operation_id=$1", [source.id])).rows
|
||||
assert.equal(charges.length, persistent ? 1 : 0);
|
||||
if (persistent) { assert.equal(charges[0].recovery_operation_id, inverse.id); assert.equal(charges[0].recovery_plan_id, inverse.plan_id); assert.equal(charges[0].profile_id,id); assert.equal(charges[0].charge_units,1) }
|
||||
if (persistent) {
|
||||
assert.equal(charges[0].recovery_operation_id, inverse.id); assert.equal(charges[0].recovery_plan_id, inverse.plan_id); assert.equal(charges[0].profile_id,id); assert.equal(charges[0].charge_units,1)
|
||||
const binding = JSON.parse(await decryptSecret(charges[0].binding_sealed))
|
||||
assert.equal(binding.operationVersion, 8)
|
||||
assert.equal(binding.sourceVersion, 7)
|
||||
}
|
||||
const intent = (await pool.query("SELECT state,verified_sealed,recovery_operation_id,authority_profile_id,authority_profile_version,reservation_id FROM mcp_scoped_recovery_intents WHERE source_operation_id=$1 AND source_step_index=0", [source.id])).rows
|
||||
assert.equal(intent.length, 1); assert.equal(intent[0].state, chargeCase === "unknown" ? "unknown" : "verified"); assert.equal(intent[0].recovery_operation_id, inverse.id)
|
||||
assert.equal(intent[0].authority_profile_id, null); assert.equal(intent[0].authority_profile_version, persistent ? 1 : null); assert.equal(intent[0].reservation_id, null)
|
||||
@@ -1235,9 +1331,12 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
|
||||
console.log("Worker exclusion preserved exact running CONFIG_APPLIED profile")
|
||||
}
|
||||
const action = { principal, connection: await effectiveMcpConnection(principal) }
|
||||
// Reuse the approved plan's original deadline: now +90s would extend
|
||||
// its preparation-time probe horizon and mask the duplicate-owner guard.
|
||||
const deadline = (await loadPlan(plan.planId)).expires_at.getTime()
|
||||
const reads = requests
|
||||
await assert.rejects(createRoutingNetworkNativeSession({ sourceOperationId: operationId, context: action,
|
||||
authorize: async () => {}, deadline: Date.now() + 90000, manifest: { servers: [sid], probes: [] } }), /Source native session уже создавалась/)
|
||||
authorize: async () => {}, deadline, manifest: { servers: [sid], probes: [] } }), /Source native session уже создавалась/)
|
||||
assert.equal(requests, reads); assert.equal(writes, before + 1)
|
||||
})
|
||||
assert.equal(op.state, "applied"); assert.equal(writes, before + 1)
|
||||
|
||||
@@ -243,7 +243,7 @@ export function registerRoutingControls(register: typeof add) {
|
||||
},
|
||||
})
|
||||
register("routing.vrf.update", "mm_vrf_plan", "Проверенный состав существующего VRF", "network", "mm:network:write", "write", "servers", z.object({ serverId, id: objectId, interfaces: z.array(text).min(1).max(100).refine(values => new Set(values).size === values.length) }).strict(), {
|
||||
version: 3,
|
||||
version: 4,
|
||||
prepare: async (input, context) => {
|
||||
const sid = Number(input.serverId), { client } = await routerClient(sid), snapshot = await readRosSnapshot(sid, "vrf"), current = snapshot.rows.find(row => row[".id"] === input.id)
|
||||
if (!current || current.name === "main" || !hasManagedCommentPrefix(String(current.comment ?? ""))) throw new McpError("PROTECTED_OBJECT", "Изменять состав можно только у существующего VRF приложения")
|
||||
|
||||
@@ -57,7 +57,7 @@ function cursor(rows:unknown[],onFetch?:()=>void) {
|
||||
test("historical cursor authenticates more than two pages of genuine nonpersistent classifications",async()=>{
|
||||
const dir=await mkdtemp(join(tmpdir(),"mm-manual-history-unit-")),previous=process.env.MCP_STATE_DIR;process.env.MCP_STATE_DIR=dir
|
||||
try {
|
||||
const rows=[];for(let n=0;n<25;n++)rows.push((await fixture(false,n%2?6:7)).row)
|
||||
const rows=[];for(let n=0;n<25;n++)rows.push((await fixture(false,6+n%3)).row)
|
||||
const f=cursor(rows)
|
||||
await assertLegacyManualHistoryWithinOwner(f.db,randomUUID(),at,()=>{})
|
||||
assert.equal(f.calls.filter(sql=>sql.startsWith("FETCH")).length,3)
|
||||
@@ -76,8 +76,10 @@ test("historical authentication, active persistent refusal, future rejection and
|
||||
await assertLegacyManualHistoryWithinOwner(cursor([f.row]).db,f.profileId,"2026-11-01T13:01:00.001Z",()=>{})
|
||||
const expiredTamper={...f.row,source_evidence:null}
|
||||
await assert.rejects(assertLegacyManualHistoryWithinOwner(cursor([expiredTamper]).db,f.profileId,"2026-11-01T14:00:00.000Z",()=>{}))
|
||||
const current={...f.row,recovery_version:7}
|
||||
await assert.rejects(assertLegacyManualHistoryWithinOwner(cursor([current]).db,f.profileId,"2026-11-01T14:00:00.000Z",()=>{}),/lacks durable charge/)
|
||||
for (const version of [7,8]) {
|
||||
const current={...f.row,recovery_version:version}
|
||||
await assert.rejects(assertLegacyManualHistoryWithinOwner(cursor([current]).db,f.profileId,"2026-11-01T14:00:00.000Z",()=>{}),/lacks durable charge/)
|
||||
}
|
||||
const stripped={...f.input};delete stripped.persistentProfileAuthority
|
||||
await assert.rejects(assertLegacyManualHistoryWithinOwner(cursor([{...f.row,source_evidence:await encryptSecret(JSON.stringify({steps:[{kind:"service",service:"routing.community.scoped",input:stripped}]}))}]).db,f.profileId,at,()=>{}))
|
||||
const future={...f.intent,createdAt:"2026-11-01T12:00:00.001Z"}
|
||||
@@ -112,14 +114,14 @@ test("state transfer cap MODEL refuses oversized or NULL history as a whole, wit
|
||||
}finally{if(previous===undefined)delete process.env.MCP_STATE_DIR;else process.env.MCP_STATE_DIR=previous;await rm(dir,{recursive:true,force:true})}
|
||||
})
|
||||
|
||||
async function retentionFixture() {
|
||||
const f=await fixture(true,7), authority=f.input.persistentProfileAuthority as {packet:{profileVersion:number;scope:number[]};proof:string}
|
||||
async function retentionFixture(version = 7) {
|
||||
const f=await fixture(true,version), authority=f.input.persistentProfileAuthority as {packet:{profileVersion:number;scope:number[]};proof:string}
|
||||
const payload=await encryptSecret(JSON.stringify({MODEL:true}))
|
||||
const row={...f.row,recovery_payload:payload,authority_profile_version:1}
|
||||
const binding=manualInverseReceiptSchema.shape.binding.parse({revision:1,recoveryOperationId:f.intent.operationId,recoveryPlanId:row.recovery_plan_id,
|
||||
sourceOperationId:f.intent.sourceOperationId,sourcePlanId:row.source_plan_id,sourceStepIndex:0,profileId:f.profileId,profileVersion:1,
|
||||
connectionId:f.intent.connectionId,ownerId:f.intent.ownerId,originalPrincipal:f.input.principal,recoveryPrincipal:f.input.principal,
|
||||
operationVersion:7,sourceVersion:7,authorityProof:authority.proof,sourceProof:f.intent.sourceProof,sourceRequestProof:f.input.requestProof,
|
||||
operationVersion:version,sourceVersion:7,authorityProof:authority.proof,sourceProof:f.intent.sourceProof,sourceRequestProof:f.input.requestProof,
|
||||
recoveryRequestProof:f.intent.requestSeal,sourceEvidenceProof:fingerprint(row.source_evidence),recoveryEvidenceProof:fingerprint(row.recovery_evidence),
|
||||
recoveryPayloadProof:fingerprint(payload),scope:authority.packet.scope,createdAt:at,chargeUnits:1})
|
||||
const receipt={binding,proof:await sign(binding,"routing-manual-inverse-charge-v1")}
|
||||
@@ -153,17 +155,19 @@ function retentionOwner(f:Awaited<ReturnType<typeof retentionFixture>>,present=t
|
||||
test('retention MODEL intent2 authenticates SQL clock after parent GC; unknown noReplay anchor survives',async()=>{
|
||||
const dir=await mkdtemp(join(tmpdir(),'mm-intent2-retention-')),previous=process.env.MCP_STATE_DIR;process.env.MCP_STATE_DIR=dir
|
||||
try {
|
||||
const f=await retentionFixture(),owner=retentionOwner(f),before=fingerprint(f.row)
|
||||
// SQL aging and the transaction owner below are MODELS, never genuine SQL.
|
||||
await assertLegacyManualHistoryWithinOwner(owner.db,f.profileId,'2026-11-03T12:00:00.000Z',()=>{})
|
||||
assert.deepEqual(await retainManualInverseChargesWithinOwner(owner.db,1),{deleted:1})
|
||||
assert.equal(owner.deleted.length,1);assert.equal(fingerprint(f.row),before)
|
||||
for(const profile of [f.profileId,randomUUID()])await assertLegacyManualHistoryWithinOwner(owner.db,profile,'2026-11-03T12:00:00.000Z',()=>{})
|
||||
assert(owner.calls.findIndex(s=>s.includes('pg_advisory_xact_lock'))<owner.calls.findIndex(s=>s.startsWith('SELECT c.recovery_operation_id')))
|
||||
const candidate=owner.calls.find(s=>s.startsWith('SELECT c.recovery_operation_id'))!
|
||||
assert(candidate.indexOf("state IN('pending','running')")<candidate.indexOf('LIMIT 100'))
|
||||
assert(candidate.includes('r.authority_profile_version IS NOT NULL'))
|
||||
assert.equal(f.intent.revision,2);assert.equal(await decryptSecretExisting(f.row.intent_sealed),JSON.stringify(f.intent))
|
||||
for (const version of [7,8]) {
|
||||
const f=await retentionFixture(version),owner=retentionOwner(f),before=fingerprint(f.row)
|
||||
// SQL aging and the transaction owner below are MODELS, never genuine SQL.
|
||||
await assertLegacyManualHistoryWithinOwner(owner.db,f.profileId,'2026-11-03T12:00:00.000Z',()=>{})
|
||||
assert.deepEqual(await retainManualInverseChargesWithinOwner(owner.db,1),{deleted:1})
|
||||
assert.equal(owner.deleted.length,1);assert.equal(fingerprint(f.row),before)
|
||||
for(const profile of [f.profileId,randomUUID()])await assertLegacyManualHistoryWithinOwner(owner.db,profile,'2026-11-03T12:00:00.000Z',()=>{})
|
||||
assert(owner.calls.findIndex(s=>s.includes('pg_advisory_xact_lock'))<owner.calls.findIndex(s=>s.startsWith('SELECT c.recovery_operation_id')))
|
||||
const candidate=owner.calls.find(s=>s.startsWith('SELECT c.recovery_operation_id'))!
|
||||
assert(candidate.indexOf("state IN('pending','running')")<candidate.indexOf('LIMIT 100'))
|
||||
assert(candidate.includes('r.authority_profile_version IS NOT NULL'))
|
||||
assert.equal(f.intent.revision,2);assert.equal(await decryptSecretExisting(f.row.intent_sealed),JSON.stringify(f.intent))
|
||||
}
|
||||
}finally{if(previous===undefined)delete process.env.MCP_STATE_DIR;else process.env.MCP_STATE_DIR=previous;await rm(dir,{recursive:true,force:true})}
|
||||
})
|
||||
|
||||
@@ -182,6 +186,11 @@ test('retention MODEL refuses recent/future/malformed copy, present corrupt pare
|
||||
const t=retentionOwner(tamper);await assert.rejects(retainManualInverseChargesWithinOwner(t.db,1),/MAC/);assert.equal(t.deleted.length,0)
|
||||
const legacy=await fixture(true,7)
|
||||
await assert.rejects(assertLegacyManualHistoryWithinOwner(cursor([legacy.row]).db,legacy.profileId,'2026-11-03T12:00:00.000Z',()=>{}),/lacks durable/)
|
||||
const wrongVersion=await retentionFixture(7);wrongVersion.row.recovery_version=8
|
||||
const mismatched=retentionOwner(wrongVersion)
|
||||
await assert.rejects(assertLegacyManualHistoryWithinOwner(mismatched.db,wrongVersion.profileId,'2026-11-03T12:00:00.000Z',()=>{}),/signed allocation/)
|
||||
await assert.rejects(retainManualInverseChargesWithinOwner(mismatched.db,1),/hint/)
|
||||
assert.equal(mismatched.deleted.length,0)
|
||||
// Revision2 payload proof cannot be replaced by an authentic stamp from a different payload.
|
||||
const payload=await retentionFixture();payload.row.recovery_payload=await encryptSecret('{}')
|
||||
await assert.rejects(assertLegacyManualHistoryWithinOwner(retentionOwner(payload,false).db,payload.profileId,'2026-11-03T12:00:00.000Z',()=>{}),/payload/)
|
||||
|
||||
@@ -40,7 +40,7 @@ export async function classifyManualInverseHistory(row:HistoricalRow,observedAt:
|
||||
intent.receiptId!==row.recovery_receipt_id || intent.validUntil!==iso(row.deadline) ||
|
||||
row.source_connection_id!==intent.connectionId || row.recovery_connection_id!==intent.connectionId ||
|
||||
row.source_action!=="routing.community.switch" || row.source_version!==7 ||
|
||||
row.recovery_action!=="operations.recover" || ![6,7].includes(row.recovery_version??0) ||
|
||||
row.recovery_action!=="operations.recover" || ![6,7,8].includes(row.recovery_version??0) ||
|
||||
!["partial","applied"].includes(row.source_state??"")) throw fail("Historical manual intent/source identity differs")
|
||||
const source=await sealedJson(row.source_evidence) as ChangeEvidence, recovery=await sealedJson(row.recovery_evidence) as ChangeEvidence
|
||||
const step=source.steps?.[0], inverse=recovery.steps?.[0]
|
||||
@@ -141,7 +141,7 @@ export async function assertLegacyManualHistoryWithinOwner(db:PoolClient,profile
|
||||
// Authenticate any durable inverse row before treating this old manual
|
||||
// identity as represented by the normal profile ledger.
|
||||
const {authenticateManualInverseHistoryWithinOwner}=await import("./routing-manual-inverse-store.js")
|
||||
if(await authenticateManualInverseHistoryWithinOwner(db,classified.intent,classified.authority,observedAt,{sourceEvidenceProof:fingerprint(row.source_evidence),recoveryEvidenceProof:fingerprint(row.recovery_evidence),recoveryPlanId:row.recovery_plan_id,sourcePlanId:row.source_plan_id,sourceRequestProof:classified.sourceRequestProof,sourcePrincipal:classified.sourcePrincipal,recoveryPrincipal:classified.recoveryPrincipal})) continue
|
||||
if(await authenticateManualInverseHistoryWithinOwner(db,classified.intent,classified.authority,observedAt,{sourceEvidenceProof:fingerprint(row.source_evidence),recoveryEvidenceProof:fingerprint(row.recovery_evidence),recoveryPlanId:row.recovery_plan_id,recoveryVersion:row.recovery_version,sourcePlanId:row.source_plan_id,sourceRequestProof:classified.sourceRequestProof,sourcePrincipal:classified.sourcePrincipal,recoveryPrincipal:classified.recoveryPrincipal})) continue
|
||||
if(row.recovery_version!==6) throw fail("Current persistent manual inverse lacks durable charge")
|
||||
if(classified.authority.packet.profileId!==profileId) continue
|
||||
// Historical v6 sealed evidence.validUntil bounded admission; source and
|
||||
|
||||
@@ -7,6 +7,7 @@ import { effectiveMcpConnection } from "./store.js"
|
||||
import { decryptSecretExisting, encryptSecret, fingerprint, McpError, privateFingerprinterExisting, privateSecretFingerprint } from "./security.js"
|
||||
import { routingProfileAuthorityBindingSchema } from "./routing-profile-authority.js"
|
||||
import type { RoutingSwitchLedgerEntry } from "./routing-switch-ledger-contract.js"
|
||||
import { findMcpOperation } from "./registry.js"
|
||||
|
||||
const fail = (message: string) => new McpError("STATE_CONFLICT", message, 409)
|
||||
const uuid = z.string().uuid(), proof = z.string().regex(/^[a-f0-9]{64}$/), stamp = z.string().datetime()
|
||||
@@ -14,7 +15,7 @@ const principal = z.object({ connectionId: uuid, credentialId: uuid, credentialE
|
||||
export const manualInverseBindingSchema = z.object({ revision: z.literal(1), recoveryOperationId: uuid, recoveryPlanId: uuid,
|
||||
sourceOperationId: uuid, sourcePlanId: uuid, sourceStepIndex: z.literal(0), profileId: uuid, profileVersion: z.number().int().positive(),
|
||||
connectionId: uuid, ownerId: z.string().min(1).max(1000), originalPrincipal: principal, recoveryPrincipal: principal,
|
||||
operationVersion: z.literal(7), sourceVersion: z.literal(7), authorityProof: proof, sourceProof: proof,
|
||||
operationVersion: z.union([z.literal(7), z.literal(8)]), sourceVersion: z.literal(7), authorityProof: proof, sourceProof: proof,
|
||||
sourceRequestProof: proof, recoveryRequestProof: proof, sourceEvidenceProof: proof,
|
||||
recoveryEvidenceProof: proof, recoveryPayloadProof: proof,
|
||||
scope: z.array(z.number().int().positive().safe()).min(1).max(1000), createdAt: stamp, chargeUnits: z.literal(1) }).strict()
|
||||
@@ -74,7 +75,8 @@ export async function selectManualInverseAdmissionWithinOwner(db: PoolClient, pl
|
||||
if (plan.operation_id!=="operations.recover") return undefined
|
||||
const step=evidence.steps[0]
|
||||
if (evidence.steps.length!==1 || step.kind!=="service" || step.service!=="routing.community.scoped.recover") return undefined
|
||||
if (plan.operation_version!==7 || step.input.mode!=="manual") throw fail("Manual recovery action version/mode differs")
|
||||
if (plan.operation_version!==findMcpOperation(plan.operation_id)?.version) throw new McpError("PLAN_EXPIRED", "Версия операции изменилась; подготовьте новый план", 409)
|
||||
if (step.input.mode!=="manual") throw fail("Manual recovery mode differs")
|
||||
const { loadScopedManualRecoveryAdmissionWithinOwner } = await import("./routing-community-scoped-recovery.js")
|
||||
const loaded = await loadScopedManualRecoveryAdmissionWithinOwner(step.input, actor, db)
|
||||
const { source } = loaded
|
||||
@@ -92,7 +94,7 @@ function expectedBinding(selected: NonNullable<Awaited<ReturnType<typeof selectM
|
||||
return manualInverseBindingSchema.parse({revision:1,recoveryOperationId:operationId,recoveryPlanId:plan.id,
|
||||
sourceOperationId:selected.source.row.id,sourcePlanId:selected.source.row.source_plan_id,sourceStepIndex:0,profileId:authority.profileId,profileVersion:authority.profileVersion,
|
||||
connectionId:actor.connectionId,ownerId:authority.ownerId,originalPrincipal:principal.parse(selected.input.principal),recoveryPrincipal:actor,
|
||||
operationVersion:7,sourceVersion:7,authorityProof:selected.authority.proof,sourceProof:selected.source.sourceProof,
|
||||
operationVersion:plan.operation_version,sourceVersion:selected.source.row.source_version,authorityProof:selected.authority.proof,sourceProof:selected.source.sourceProof,
|
||||
sourceRequestProof:selected.input.requestProof,recoveryRequestProof:selected.recoveryInput.requestProof,
|
||||
sourceEvidenceProof:selected.sourceEvidenceProof,recoveryEvidenceProof:fingerprint(plan.evidence.sealed),
|
||||
recoveryPayloadProof:fingerprint(plan.payload.sealed),scope:authority.scope,createdAt:observedAt,chargeUnits:1})
|
||||
@@ -134,7 +136,7 @@ export async function admitManualInverseWithinOwner(db: PoolClient, operationId:
|
||||
/** A committed charge is required before the existing manual native intent.
|
||||
* This authenticates identity only; existing live/native authority still runs. */
|
||||
export async function assertManualInverseChargeWithinOwner(db:PoolClient,operationId:string,input:Record<string,unknown>,actor:McpPrincipal) {
|
||||
const rows=(await db.query<StoredPlan>("SELECT p.* FROM mcp_operations o JOIN mcp_plans p ON p.id=o.plan_id WHERE o.id=$1 AND o.connection_id=$2 AND o.state='running' AND p.state='executing' AND p.operation_id='operations.recover' AND p.operation_version=7",[operationId,actor.connectionId])).rows
|
||||
const rows=(await db.query<StoredPlan>("SELECT p.* FROM mcp_operations o JOIN mcp_plans p ON p.id=o.plan_id WHERE o.id=$1 AND o.connection_id=$2 AND o.state='running' AND p.state='executing' AND p.operation_id='operations.recover' AND p.operation_version=$3",[operationId,actor.connectionId,findMcpOperation("operations.recover")?.version])).rows
|
||||
if(rows.length!==1) throw fail("Manual native claim requires current running action version")
|
||||
const plan=rows[0], evidence=JSON.parse(await decryptSecretExisting(plan.evidence.sealed)) as ChangeEvidence
|
||||
const step=evidence.steps[0]
|
||||
@@ -154,7 +156,7 @@ export async function assertManualInverseChargeWithinOwner(db:PoolClient,operati
|
||||
export async function authenticateManualInverseHistoryWithinOwner(db:PoolClient,
|
||||
intent:{revision?:number;manualInverseCharge?:ManualInverseReceipt;operationId:string;sourceOperationId:string;sourceReceiptId:string;sourceProof:string;requestSeal:string;connectionId:string;ownerId:string},
|
||||
authority:z.infer<typeof routingProfileAuthorityBindingSchema>,observedAt:string,
|
||||
identity:{sourceEvidenceProof:string;recoveryEvidenceProof:string;recoveryPlanId:string|null;sourcePlanId:string|null;sourceRequestProof:unknown;sourcePrincipal:unknown;recoveryPrincipal:unknown}) {
|
||||
identity:{sourceEvidenceProof:string;recoveryEvidenceProof:string;recoveryPlanId:string|null;recoveryVersion:number|null;sourcePlanId:string|null;sourceRequestProof:unknown;sourcePrincipal:unknown;recoveryPrincipal:unknown}) {
|
||||
const rows=(await db.query<ChargeRow>(`SELECT ${columns} FROM mcp_routing_manual_inverse_charges WHERE recovery_operation_id=$1 OR source_operation_id=$2 LIMIT 3`,[intent.operationId,intent.sourceOperationId])).rows
|
||||
const copy = intent.revision === 2 ? await authenticateCopy(intent.manualInverseCharge, observedAt) : undefined
|
||||
if (!rows.length && !copy) return false
|
||||
@@ -166,7 +168,8 @@ export async function authenticateManualInverseHistoryWithinOwner(db:PoolClient,
|
||||
value.profileId!==authority.packet.profileId || value.profileVersion!==authority.packet.profileVersion || value.authorityProof!==authority.proof ||
|
||||
value.connectionId!==intent.connectionId || value.ownerId!==intent.ownerId || value.sourceProof!==intent.sourceProof ||
|
||||
value.recoveryRequestProof!==intent.requestSeal || value.sourceEvidenceProof!==identity.sourceEvidenceProof ||
|
||||
value.recoveryEvidenceProof!==identity.recoveryEvidenceProof || value.recoveryPlanId!==identity.recoveryPlanId || value.sourcePlanId!==identity.sourcePlanId)throw fail("Historical inverse is not represented by its signed allocation")
|
||||
value.recoveryEvidenceProof!==identity.recoveryEvidenceProof || value.recoveryPlanId!==identity.recoveryPlanId ||
|
||||
value.operationVersion!==identity.recoveryVersion || value.sourcePlanId!==identity.sourcePlanId)throw fail("Historical inverse is not represented by its signed allocation")
|
||||
// Only revision2 needs this extra one-row bounded projection; preserve the
|
||||
// existing cursor page payload ceiling and legacy protocol untouched.
|
||||
const payload = copy ? (await db.query<{sealed:string|null}>("SELECT CASE WHEN octet_length(payload::text)<=1048576 THEN payload->>'sealed' END AS sealed FROM mcp_plans WHERE id=$1 LIMIT 2",[identity.recoveryPlanId])).rows : []
|
||||
@@ -201,11 +204,11 @@ export async function retainManualInverseChargesWithinOwner(db: PoolClient, rete
|
||||
" WHERE r.mode='manual' AND r.source_operation_id=$1 AND r.source_step_index=0 AND r.recovery_operation_id=$2",[candidate.source_operation_id,candidate.recovery_operation_id])).rows
|
||||
if(rows.length!==1)throw fail("Retention intent/source pair disappeared")
|
||||
const row=rows[0],classified=await classifyManualInverseHistory(row,observedAt)
|
||||
if(classified.kind!=="persistent" || classified.intent.revision!==2 || row.recovery_version!==7 ||
|
||||
if(classified.kind!=="persistent" || classified.intent.revision!==2 || row.recovery_version!==classified.intent.manualInverseCharge.binding.operationVersion ||
|
||||
row.authority_profile_version!==candidate.profile_version || row.authority_profile_version!==classified.intent.manualInverseCharge.binding.profileVersion)
|
||||
throw fail("Retention hint is not an authenticated persistent intent2")
|
||||
if(!await authenticateManualInverseHistoryWithinOwner(db,classified.intent,classified.authority,observedAt,{
|
||||
sourceEvidenceProof:fingerprint(row.source_evidence),recoveryEvidenceProof:fingerprint(row.recovery_evidence),recoveryPlanId:row.recovery_plan_id,sourcePlanId:row.source_plan_id,sourceRequestProof:classified.sourceRequestProof,sourcePrincipal:classified.sourcePrincipal,recoveryPrincipal:classified.recoveryPrincipal}))
|
||||
sourceEvidenceProof:fingerprint(row.source_evidence),recoveryEvidenceProof:fingerprint(row.recovery_evidence),recoveryPlanId:row.recovery_plan_id,recoveryVersion:row.recovery_version,sourcePlanId:row.source_plan_id,sourceRequestProof:classified.sourceRequestProof,sourcePrincipal:classified.sourcePrincipal,recoveryPrincipal:classified.recoveryPrincipal}))
|
||||
throw fail("Retention parent is not authenticated")
|
||||
const result=await db.query("DELETE FROM mcp_routing_manual_inverse_charges WHERE recovery_operation_id=$1 AND source_operation_id=$2",[candidate.recovery_operation_id,candidate.source_operation_id])
|
||||
if(result.rowCount!==1)throw fail("Retention parent delete was not confirmed")
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { test } from "node:test"
|
||||
import { routeAiProfileSchema, type RouteObservation } from "@mmapp/contracts/mcp-routing"
|
||||
import { rankRoutingCandidates, decideRoutingSwitch, type ControllerState, type PathHealth } from "./routing-model.js"
|
||||
import { rankRoutingCandidates, decideRoutingSwitch, selectFailoverReserveProbes, type ControllerState, type PathHealth } from "./routing-model.js"
|
||||
|
||||
const now = Date.parse("2026-10-17T10:00:00Z"), at = new Date(now).toISOString()
|
||||
const profile = routeAiProfileSchema.parse({ name: "Test", serverId: 1, community: "65000:10", family: "ipv4", candidates: [
|
||||
@@ -81,6 +81,26 @@ test("failover starts a fresh series after downtime or legacy state and ignores
|
||||
assert.equal(result.state.failureObservedAt, new Date(time).toISOString())
|
||||
}
|
||||
})
|
||||
test("bounded failover probing keeps the highest eligible reserve and eventually visits every other eligible probe", () => {
|
||||
const controlProbe = { targetInterface: "exit-a", expectedHops: [{ serverId: 3, interface: "exit-a" }] }
|
||||
const configured = routeAiProfileSchema.parse({ ...profile, excludedCandidateIds: ["05"],
|
||||
candidates: Array.from({ length: 100 }, (_, index) => ({ ...profile.candidates[0], id: String(index).padStart(2, "0"),
|
||||
controlProbe: index === 4 ? undefined : controlProbe })) })
|
||||
const ranking = rankRoutingCandidates(configured, a, now)
|
||||
const expected = ranking.filter(row => row.eligible && row.candidate.controlProbe && !["00", "01"].includes(row.candidate.id)).map(row => row.candidate.id)
|
||||
let cursor: string | undefined
|
||||
for (const alternate of expected) {
|
||||
const probes = selectFailoverReserveProbes(ranking, "00", cursor)
|
||||
assert.deepEqual(probes.candidateIds, ["01", alternate])
|
||||
assert.equal(probes.cursor, alternate)
|
||||
cursor = probes.cursor
|
||||
}
|
||||
assert.deepEqual(selectFailoverReserveProbes(ranking, "00", cursor).candidateIds, ["01", "02"])
|
||||
assert.deepEqual(selectFailoverReserveProbes(ranking, "00", "05").candidateIds, ["01", "02"])
|
||||
const pinned = rankRoutingCandidates({ ...configured, pinnedCandidateId: "09" }, a, now)
|
||||
assert.deepEqual(selectFailoverReserveProbes(pinned, "00"), { candidateIds: ["09"], cursor: undefined })
|
||||
assert.deepEqual(selectFailoverReserveProbes(pinned, "09"), { candidateIds: [], cursor: undefined })
|
||||
})
|
||||
test("routing combines RTT, independent losses and bottleneck speed, never claims an observed path", () => {
|
||||
const ranked = rankRoutingCandidates(profile, a, now).find(row => row.candidate.id === "a")!
|
||||
assert.equal(ranked.pingMs, 20); assert.ok(Math.abs(ranked.lossPct! - 1.99) < 0.00001)
|
||||
|
||||
@@ -52,6 +52,17 @@ export function rankRoutingCandidates(profile: RouteAiProfile, observations: Rou
|
||||
|
||||
export interface PathHealth { id: string; candidateId: string; status: "passed" | "failed" | "unknown"; observedAt: string }
|
||||
export interface ControllerState { pendingCandidateId?: string; consecutive?: number; observationKey?: string; lastSwitchAt?: string; switches?: string[]; operationId?: string; pausedReason?: string; failureCount?: number; failureKey?: string; failureObservedAt?: string; failingCandidateId?: string }
|
||||
|
||||
export function selectFailoverReserveProbes(ranking: ReturnType<typeof rankRoutingCandidates>, currentCandidateId: string, previous?: string) {
|
||||
const standbys = ranking.filter(({ candidate, eligible }) => eligible && candidate.id !== currentCandidateId && candidate.controlProbe)
|
||||
.map(({ candidate }) => candidate.id)
|
||||
const [preferred, ...remaining] = standbys
|
||||
if (remaining.length === 0) return { candidateIds: standbys, cursor: undefined }
|
||||
const index = remaining.indexOf(previous ?? "")
|
||||
const cursor = remaining[(index + 1) % remaining.length]
|
||||
return { candidateIds: [preferred, cursor], cursor }
|
||||
}
|
||||
|
||||
const pathHealthFreshnessSec = 90
|
||||
export function decideRoutingSwitch(profile: RouteAiProfile, state: ControllerState, ranking: ReturnType<typeof rankRoutingCandidates>, currentCandidateId: string | null, now = Date.now(), health: PathHealth[] = [], chargedSwitchesPerHour?: number) {
|
||||
const next: ControllerState = { ...state, switches: (state.switches ?? []).filter(at => now - Date.parse(at) < 3600000) }
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
import { isIP } from "node:net"
|
||||
|
||||
export function parseRoutingEndpoint(value: unknown) {
|
||||
if (typeof value !== "string" || !value.length || value.length > 256) throw Error("missing-or-unsupported-field")
|
||||
const match = /^([^%@/,\s]+)(?:\/(\d+))?(?:%([^%@/,\s]+))?(?:@([^%@/,\s]+))?$/.exec(value)
|
||||
if (!match) throw Error("unsupported-endpoint")
|
||||
const [, address, prefix, interfaceName, vrf] = match
|
||||
const family = isIP(address)
|
||||
if (!family) throw Error("unsupported-address")
|
||||
if (prefix !== undefined && prefix !== String(family === 4 ? 32 : 128)) throw Error("unsupported-peer-range")
|
||||
return { address, interface: interfaceName, vrf }
|
||||
}
|
||||
|
||||
export function matchesBgpSessionContext(
|
||||
row: Record<string, unknown>,
|
||||
expected: { table: string; vrf: string },
|
||||
local: ReturnType<typeof parseRoutingEndpoint>,
|
||||
remote: ReturnType<typeof parseRoutingEndpoint>,
|
||||
) {
|
||||
if (!Object.hasOwn(row, "routing-table") || row["routing-table"] !== expected.table) return false
|
||||
if (Object.hasOwn(row, "vrf")) {
|
||||
return row.vrf === expected.vrf && (local.vrf === undefined || local.vrf === expected.vrf) &&
|
||||
(remote.vrf === undefined || remote.vrf === expected.vrf)
|
||||
}
|
||||
// RouterOS may report the transport VRF only in the two runtime addresses.
|
||||
// The installation table alone cannot identify it.
|
||||
return local.vrf === expected.vrf && remote.vrf === expected.vrf
|
||||
}
|
||||
@@ -16,6 +16,8 @@ assert(process.env.MCP_STATE_DIR && isAbsolute(process.env.MCP_STATE_DIR))
|
||||
assert.equal(basename(resolve(process.env.MCP_STATE_DIR)), "state")
|
||||
assert(basename(dirname(resolve(process.env.MCP_STATE_DIR))).startsWith("mm-mcp-test-"))
|
||||
const originalEffects = process.env.MMAPP_OWN_ROUTING_ORIGINAL_EFFECTS === "true"
|
||||
const controllerFailoverOnly = process.env.MMAPP_OWN_ROUTING_CONTROLLER_FAILOVER_ONLY === "true"
|
||||
assert(!controllerFailoverOnly || originalEffects, "Focused controller failover requires the owned original-effects fixture")
|
||||
assert(!(originalEffects && process.env.MMAPP_OWN_ROUTING_WORKER_REPRO === "true"), "Owned effect acceptance cannot mix with the worker repro profile")
|
||||
process.env.AUTH_REQUIRED = "true"
|
||||
process.env.AUTH_JWT_SECRET = "owned-routing-forward-rounds-acceptance-secret"
|
||||
@@ -35,7 +37,7 @@ try {
|
||||
console.log("Worker fixture repro:",await (await import("./routing-worker-fixture-isolation.sql-helper.js")).acceptRoutingWorkerFixtureIsolation(actor))
|
||||
}
|
||||
const result = await (await import("./routing-community-scoped-acceptance.js")).acceptScopedRouteCommunitySwitch(actor,
|
||||
originalEffects ? { originalEffectsOnly: true } : process.env.MMAPP_OWN_ROUTING_WORKER_REPRO==="true"?{}:{ forwardRoundsOnly: true })
|
||||
originalEffects ? { originalEffectsOnly: true, controllerFailoverOnly } : process.env.MMAPP_OWN_ROUTING_WORKER_REPRO==="true"?{}:{ forwardRoundsOnly: true })
|
||||
assert.equal(result.accepted, true)
|
||||
} finally {
|
||||
await (await import("../../services/scheduler.js")).stopSchedulerForDatabaseOperation()
|
||||
|
||||
@@ -154,6 +154,25 @@ for (const mutation of ["duplicate-config", "wrong-config-id", "unresolved-templ
|
||||
assert.equal(f.parser.parseBgp("peer1", raw).status, "unknown")
|
||||
})
|
||||
|
||||
for (const ipv6 of [false, true]) test("BGP runtime context can come from both exact qualified " + (ipv6 ? "IPv6" : "IPv4") + " endpoints", () => {
|
||||
const f = fixture(ipv6), raw = structuredClone(f.bgp) as unknown as RawMutation, session = raw.payload[0]
|
||||
const local = session["local.address"], remote = session["remote.address"]
|
||||
delete session.vrf
|
||||
session["local.address"] = `${local}@main`
|
||||
session["remote.address"] = `${remote}@main`
|
||||
const observation = f.parser.parseBgp("peer1", raw)
|
||||
assert.equal(observation.status, "observed", JSON.stringify(observation))
|
||||
assert.equal(observation.securityProof, false)
|
||||
for (const mutation of [
|
||||
{ "remote.address": remote }, { "remote.address": `${remote}@tenant` },
|
||||
{ "remote.address": `${remote}@main@main` }, { "routing-table": "main" },
|
||||
{ vrf: "tenant" }, { vrf: null },
|
||||
]) {
|
||||
assert.equal(f.parser.parseBgp("peer1", { ...raw, payload: [{ ...session, ...mutation }] }).status, "unknown")
|
||||
}
|
||||
assert.equal(f.parser.parseBgp("peer1", { ...raw, payload: [session, { ...session, ".id": "*B3" }] }).status, "unknown")
|
||||
})
|
||||
|
||||
test("native cached non-established BGP cannot invent a model FSM state from an undocumented field", () => {
|
||||
const f = fixture(), raw = structuredClone(f.bgp) as unknown as RawMutation
|
||||
raw.payload[0].established = "false"
|
||||
|
||||
@@ -2,6 +2,7 @@ import { isIP } from "node:net"
|
||||
import { z } from "zod"
|
||||
import { canonicalBgpPolicyPrefix } from "../../services/bgp-community-policy-model.js"
|
||||
import { captureRoutingNetworkManifest, type RoutingNetworkRound } from "./routing-network-verifier-model.js"
|
||||
import { matchesBgpSessionContext, parseRoutingEndpoint } from "./routing-native-endpoint.js"
|
||||
|
||||
/** Pure decoded-response parsers, NOT source authentication or completeness
|
||||
* proof. Only the explicit RouterOS7.20–7.26 field subset below is recognized.
|
||||
@@ -32,11 +33,8 @@ function canonicalAddress(value: unknown): string {
|
||||
return canonicalBgpPolicyPrefix(text + "/" + (family === 4 ? 32 : 128)).split("/")[0]
|
||||
}
|
||||
function endpoint(value: unknown) {
|
||||
const text = literal(value), match = /^([^%@/,\s]+)(?:\/(\d+))?(?:%([^%@/,\s]+))?(?:@([^%@/,\s]+))?$/.exec(text)
|
||||
if (!match) return fail("unsupported-endpoint")
|
||||
const address = canonicalAddress(match[1])
|
||||
if (match[2] !== undefined && match[2] !== String(isIP(address) === 4 ? 32 : 128)) return fail("unsupported-peer-range")
|
||||
return { address, interface: match[3], vrf: match[4] }
|
||||
const parsed = parseRoutingEndpoint(value)
|
||||
return { ...parsed, address: canonicalAddress(parsed.address) }
|
||||
}
|
||||
function decodedRows(payload: unknown, maximum = 1000, ids = true): Row[] {
|
||||
let nodes = 0
|
||||
@@ -144,7 +142,7 @@ export function captureRoutingNetworkNativeParser(rawManifest: unknown) {
|
||||
if (instance !== wanted.instance) continue
|
||||
if (local.address !== wanted.localAddress || remote.address !== wanted.remoteAddress) continue
|
||||
if (integer(row["remote.as"], 4294967295) !== wanted.remoteAsn || !afi(row["remote.afi"]).includes(expectedAfi) || !afi(row["local.afi"]).includes(expectedAfi)) return unknown("bgp-session-asn-or-afi-drift")
|
||||
if (row.vrf !== binding.vrf || row["routing-table"] !== binding.table || [local.vrf, remote.vrf].some(vrf => vrf !== undefined && vrf !== binding.vrf) || local.interface !== binding.local.interface || remote.interface !== binding.remote.interface) return unknown("bgp-session-context-drift")
|
||||
if (!matchesBgpSessionContext(row, binding, local, remote) || local.interface !== binding.local.interface || remote.interface !== binding.remote.interface) return unknown("bgp-session-context-drift")
|
||||
relevant.push(row)
|
||||
}
|
||||
if (relevant.length !== 1) return unknown("missing-or-ambiguous-bgp-session")
|
||||
|
||||
@@ -7,7 +7,9 @@ const require=createRequire(new URL('../../../package.json',import.meta.url)),ts
|
||||
const hash=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex'),sign=async(value,purpose)=>hash([purpose,value]);
|
||||
const code=ts.transpileModule(await readFile(new URL('./routing-controller-baseline.ts',import.meta.url),'utf8'),{compilerOptions:{module:ts.ModuleKind.CommonJS,target:ts.ScriptTarget.ES2022}}).outputText;
|
||||
const effectCode=ts.transpileModule(await readFile(new URL('./routing-original-effects.ts',import.meta.url),'utf8'),{compilerOptions:{module:ts.ModuleKind.CommonJS,target:ts.ScriptTarget.ES2022}}).outputText,effectExports={};
|
||||
new Function('exports','require',effectCode)(effectExports,name=>{if(name==='node:net')return require('node:net');if(name==='zod')return{z};if(name==='./security.js')return{fingerprint:hash};if(name==='./routing-community-context-model.js')return{};throw Error(name);});
|
||||
const endpointCode=ts.transpileModule(await readFile(new URL('./routing-native-endpoint.ts',import.meta.url),'utf8'),{compilerOptions:{module:ts.ModuleKind.CommonJS,target:ts.ScriptTarget.ES2022}}).outputText,endpointExports={};
|
||||
new Function('exports','require',endpointCode)(endpointExports,require);
|
||||
new Function('exports','require',effectCode)(effectExports,name=>{if(name==='node:net')return require('node:net');if(name==='zod')return{z};if(name==='./security.js')return{fingerprint:hash};if(name==='./routing-community-context-model.js')return{};if(name==='./routing-native-endpoint.js')return endpointExports;throw Error(name);});
|
||||
const preparedValue={status:'prepared',revision:1,serverId:1,routeSelectionScope:'table-afi-community-observation',candidateId:'b',family:'ipv4',table:'tenant',community:'65000:10',expectedGateway:'192.0.2.9',expectedImmediate:{address:'198.51.100.2',interface:'ether2'},binding:{connectionId:'*c',sessionId:'*s',instance:'default',table:'tenant',vrf:'main',localAddress:'192.0.2.1',remoteAddress:'192.0.2.2',remoteAsn:65001,afi:'ip'},bfd:{applicability:'not-configured',evidence:'explicit-use-bfd-false'},routes:[{nativeId:'*r',prefix:'203.0.113.0/24',originalGateway:'192.0.2.8'}],probe:{key:'b',serverId:1,destination:'198.51.100.20',source:'198.51.100.10',interface:'wan',probeVrf:'probe',expectedHops:['198.51.100.20']}};
|
||||
async function fixture(selection='absent',effectStatus='observed-expected',switched=true){
|
||||
const principal={connectionId:randomUUID(),credentialId:randomUUID(),credentialExpiresAt:new Date(Date.now()+120000).toISOString()},profileId=randomUUID(),planId=randomUUID(),operationId=randomUUID(),grant=new Date(Date.now()+60000).toISOString();
|
||||
|
||||
@@ -6,9 +6,11 @@ import { isIP } from 'node:net';
|
||||
import { randomUUID, createHash } from 'node:crypto';
|
||||
const require=createRequire(new URL('../../../package.json',import.meta.url)), ts=require('typescript'),{z}=require('zod');
|
||||
const source=await readFile(new URL('./routing-original-effects.ts',import.meta.url),'utf8');
|
||||
const exports={};
|
||||
const exports={}, endpointExports={};
|
||||
const endpointSource=await readFile(new URL('./routing-native-endpoint.ts',import.meta.url),'utf8');
|
||||
new Function('exports','require',ts.transpileModule(endpointSource,{compilerOptions:{module:ts.ModuleKind.CommonJS,target:ts.ScriptTarget.ES2022}}).outputText)(endpointExports,require);
|
||||
const gateway=value=>{const match=/^([^@%\s,]+)(?:%([^@%\s,]+))?(?:@([^@%\s,]+))?$/.exec(value);if(!match||!isIP(match[1]))throw Error();return {address:match[1],family:isIP(match[1]),interface:match[2]??null,resolverTable:match[3]??'main'};};
|
||||
const providers={ 'node:net':{isIP},'node:crypto':{randomUUID},zod:{z},'./routing-community-context-model.js':{routeGatewayContext:gateway},'./security.js':{fingerprint:value=>createHash('sha256').update(JSON.stringify(value)).digest('hex')},
|
||||
const providers={ 'node:net':{isIP},'node:crypto':{randomUUID},zod:{z},'./routing-community-context-model.js':{routeGatewayContext:gateway},'./routing-native-endpoint.js':endpointExports,'./security.js':{fingerprint:value=>createHash('sha256').update(JSON.stringify(value)).digest('hex')},
|
||||
'./path-verification.js':{inspectControlPing:rows=>{const row=rows.at(-1),sent=Number(row.sent),received=Number(row.received);return {confirmedFailure:sent===3&&received===0,ping:{measured:sent===3&&Number.isInteger(received)&&received>=0&&received<=3,loss:(sent-received)/sent*100}};},
|
||||
inspectTrace:(rows,destination,expected)=>({verified:Array.isArray(rows)&&rows.at(-1)?.address===destination&&expected.every(x=>rows.some(r=>r.address===x))})}};
|
||||
new Function('exports','require',ts.transpileModule(source,{compilerOptions:{module:ts.ModuleKind.CommonJS,target:ts.ScriptTarget.ES2022}}).outputText)(exports,name=>{assert.ok(providers[name],name);return providers[name];});
|
||||
@@ -26,11 +28,33 @@ function fixture(){
|
||||
}
|
||||
test('actual captured predicate seals BGP destinations separately from static resolver ID',()=>{const f=fixture();assert.equal(f.selection.status,'prepared');assert.equal(f.selection.routes[0].nativeId,'*r');assert.notEqual(f.selection.routes[0].nativeId,f.raw.candidate['.id']);assert.equal(f.selection.binding.sessionId,'*s');assert.equal('sessionKey'in f.selection.routes[0],false);});
|
||||
test('two real effect captures can observe expected FIB/adjacency/probe while logcoverage and stronger claims stay false',async()=>{const f=fixture(),result=await f.inspect([f.sample(),f.sample()]);assert.equal(result.status,'observed-expected');assert.equal(result.logCoverage,'unknown');assert.equal(result.routeOriginVerified,false);assert.equal(result.recursiveChainVerified,false);assert.equal(result.forwardingVerified,false);assert.equal(result.autoRecoveryAllowed,false);assert.equal(result.rounds[0].relatedTopicRows,1);});
|
||||
function qualifyRuntimeSession(row) {
|
||||
delete row.vrf;
|
||||
row['local.address'] += '@main';
|
||||
row['remote.address'] += '@main';
|
||||
}
|
||||
test('BGP session uses exact runtime endpoint qualifiers when VRF is absent and the installation table is separate',async()=>{
|
||||
const f=fixture();
|
||||
qualifyRuntimeSession(f.raw.sessions[0]);
|
||||
const selection=f.prepare();
|
||||
assert.equal(selection.status,'prepared');
|
||||
assert.equal(selection.binding.vrf,'main');
|
||||
assert.equal(selection.binding.table,'tenant');
|
||||
const samples=[f.sample(),f.sample()];
|
||||
const report=await exports.inspectOriginalEffectRounds(selection,samples,f.baseline);
|
||||
assert.equal(report.status,'observed-expected');
|
||||
assert.equal(report.routeOriginVerified,false);
|
||||
});
|
||||
for(const [name,change]of[
|
||||
['missing affected BGP route',f=>{f.raw.routes=[];}],['ambiguous prefix',f=>{f.raw.routes.push({...f.raw.routes[0],'.id':'*r2'});}],
|
||||
['connected resolver is not affected BGP route',f=>{f.raw.routes[0].bgp='false';f.raw.routes[0].connect='true';}],
|
||||
['unresolved inheritance',f=>{f.raw.connections[0].templates='template';}],['BFD not explicitly known',f=>{delete f.raw.connections[0]['use-bfd'];}],
|
||||
['router-selected source retained as unsupported effect subset',f=>{delete f.raw.probe.source;}],['mixed session identity',f=>{f.raw.sessions.push({...f.raw.sessions[0],'.id':'*s2'});}],
|
||||
['implicit VRF without both endpoint qualifiers',f=>{qualifyRuntimeSession(f.raw.sessions[0]);f.raw.sessions[0]['local.address']='192.0.2.1';}],
|
||||
['qualified endpoints in the installation table',f=>{qualifyRuntimeSession(f.raw.sessions[0]);f.raw.sessions[0]['remote.address']='192.0.2.2@tenant';}],
|
||||
['contradictory explicit VRF',f=>{qualifyRuntimeSession(f.raw.sessions[0]);f.raw.sessions[0].vrf='tenant';}],
|
||||
['malformed peer ASN',f=>{f.raw.sessions[0]['remote.as']='0xfde9';}],
|
||||
['duplicate native ID even with unrelated tuple',f=>{f.raw.sessions.push({...f.raw.sessions[0],instance:'unrelated'});}],
|
||||
['noncanonical AFI prefix',f=>{f.raw.routes[0]['dst-address']='2001:db8::/64';}]
|
||||
])test(`prepared ambiguity/unsupported remains unknown: ${name}`,()=>{const f=fixture();change(f);assert.equal(f.prepare().status,'unknown');});
|
||||
test('baseline binds saved route IDs/prefix/gateway and does not infer operation UUID',()=>{const f=fixture(),base=f.sample();base.servers[0].routes.payload=structuredClone(f.raw.routes);assert.equal(exports.originalEffectBaselineMatches(f.selection,base),true);base.servers[0].routes.payload[0]['.id']='*different';assert.equal(exports.originalEffectBaselineMatches(f.selection,base),false);});
|
||||
|
||||
@@ -2,6 +2,7 @@ import { isIP } from "node:net"
|
||||
import { z } from "zod"
|
||||
import type { RouteAiProfile } from "@mmapp/contracts/mcp-routing"
|
||||
import { routeGatewayContext } from "./routing-community-context-model.js"
|
||||
import { matchesBgpSessionContext, parseRoutingEndpoint } from "./routing-native-endpoint.js"
|
||||
import { fingerprint } from "./security.js"
|
||||
|
||||
type Row = Record<string, unknown>
|
||||
@@ -43,10 +44,27 @@ export type OriginalEffectReport = z.infer<typeof originalEffectReportSchema>
|
||||
export const unknownOriginalEffects = (reason: string): OriginalEffectReport => ({ scope: "prepared-route-fib-adjacency-control-effects", status: "unknown", reason,
|
||||
rounds: [], logSource: "routeros-rest-ring", logCoverage: "unknown", selectionIdentity: null, routeSelectionScope: "table-afi-community-observation", transitionAttribution: "unproven", switchEffectObserved: false, semanticProof: false, routeOriginVerified: false, recursiveChainVerified: false, forwardingVerified: false, autoRecoveryAllowed: false })
|
||||
|
||||
function tuple(row: Row, expected: Prepared["binding"], session: boolean) {
|
||||
function connectionMatches(row: Row, expected: Prepared["binding"]) {
|
||||
return row.instance === expected.instance && row["routing-table"] === expected.table && row.vrf === expected.vrf &&
|
||||
row["local.address"] === expected.localAddress && row["remote.address"] === expected.remoteAddress && Number(row["remote.as"]) === expected.remoteAsn &&
|
||||
(session ? row["local.afi"] === expected.afi && row["remote.afi"] === expected.afi : row.afi === expected.afi)
|
||||
row["local.address"] === expected.localAddress && row["remote.address"] === expected.remoteAddress &&
|
||||
(row["remote.as"] === expected.remoteAsn || row["remote.as"] === String(expected.remoteAsn)) &&
|
||||
row.afi === expected.afi
|
||||
}
|
||||
|
||||
function selectBgpSession(rows: Row[], expected: Prepared["binding"]) {
|
||||
try {
|
||||
let match: Row | undefined
|
||||
for (const row of rows) {
|
||||
if (row.instance !== expected.instance) continue
|
||||
const local = parseRoutingEndpoint(row["local.address"]), remote = parseRoutingEndpoint(row["remote.address"])
|
||||
if (local.address !== expected.localAddress || remote.address !== expected.remoteAddress) continue
|
||||
if (match || local.interface !== undefined || remote.interface !== undefined || !matchesBgpSessionContext(row, expected, local, remote) ||
|
||||
(row["remote.as"] !== expected.remoteAsn && row["remote.as"] !== String(expected.remoteAsn)) || row["local.afi"] !== expected.afi || row["remote.afi"] !== expected.afi ||
|
||||
row.state !== undefined || flag(row.established) === undefined || !id.safeParse(row[".id"]).success) return undefined
|
||||
match = row
|
||||
}
|
||||
return match && unique(rows, String(match[".id"])).length === 1 ? match : undefined
|
||||
} catch { return undefined }
|
||||
}
|
||||
function selectedRows(rows: Row[], selection: Pick<Prepared, "table" | "family" | "community">) {
|
||||
return rows.filter(row => row["routing-table"] === selection.table && family(row) === selection.family && flag(row.bgp) === true && communities(row).includes(selection.community))
|
||||
@@ -69,10 +87,10 @@ export function prepareOriginalEffectSelection(profile: RouteAiProfile, candidat
|
||||
const peer = connection[0], afi = profile.family === "ipv4" ? "ip" : "ipv6"
|
||||
const wanted = tupleSchema.parse({ connectionId: peer[".id"], sessionId: "*0", instance: binding.instance, table: binding.table, vrf: binding.vrf,
|
||||
localAddress: peer["local.address"], remoteAddress: peer["remote.address"], remoteAsn: Number(peer["remote.as"]), afi })
|
||||
if (!tuple(peer, wanted, false)) throw Error()
|
||||
const sessions = raw.sessions.filter(row => tuple(row, wanted, true))
|
||||
if (sessions.length !== 1 || flag(sessions[0].established) === undefined) throw Error()
|
||||
wanted.sessionId = id.parse(sessions[0][".id"])
|
||||
if (!connectionMatches(peer, wanted)) throw Error()
|
||||
const session = selectBgpSession(raw.sessions, wanted)
|
||||
if (!session) throw Error()
|
||||
wanted.sessionId = id.parse(session[".id"])
|
||||
const affected = selectedRows(raw.routes, profile)
|
||||
if (!affected.length || affected.length > 32 || new Set(affected.map(row => row["dst-address"])).size !== affected.length || new Set(affected.map(row => row[".id"])).size !== affected.length) throw Error()
|
||||
for (const row of affected) {
|
||||
@@ -130,10 +148,10 @@ export async function inspectOriginalEffectRounds(rawSelection: unknown, samples
|
||||
return { prefix: wanted.prefix, status }
|
||||
})
|
||||
const connections = unique(source.bgp.connectionsPayload, selection.binding.connectionId)
|
||||
const sessions = source.bgp.payload.filter(row => tuple(row, selection.binding, true))
|
||||
const session = selectBgpSession(source.bgp.payload, selection.binding)
|
||||
let bgp: z.infer<typeof state> = "unknown"
|
||||
if (connections.length === 1 && tuple(connections[0], selection.binding, false) && flag(connections[0].disabled) === false && flag(connections[0]["use-bfd"]) === false &&
|
||||
sessions.length === 1 && sessions[0][".id"] === selection.binding.sessionId && flag(sessions[0].established) !== undefined) bgp = flag(sessions[0].established) ? "observed-expected" : "observed-other"
|
||||
if (connections.length === 1 && connectionMatches(connections[0], selection.binding) && flag(connections[0].disabled) === false && flag(connections[0]["use-bfd"]) === false &&
|
||||
session?.[".id"] === selection.binding.sessionId) bgp = flag(session.established) ? "observed-expected" : "observed-other"
|
||||
const probe = sample.probes.find(row => row.key === selection.probe.key)
|
||||
let controlProbe: "passed" | "failed" | "unknown" = "unknown"
|
||||
if (probe) {
|
||||
|
||||
@@ -9,7 +9,7 @@ import { pool } from "../../db/index.js"
|
||||
import { registerMcpService } from "./service-registry.js"
|
||||
import { accessGeneration, McpError } from "./security.js"
|
||||
import { audit, validatePrincipal, type McpPrincipal } from "./store.js"
|
||||
import { decideRoutingSwitch, type ControllerState, type PathHealth, type rankRoutingCandidates } from "./routing-model.js"
|
||||
import { decideRoutingSwitch, selectFailoverReserveProbes, type ControllerState, type PathHealth, type rankRoutingCandidates } from "./routing-model.js"
|
||||
import type { add } from "./actions.js"
|
||||
import { COMMUNITY_PATH_MAX_AGE_MS } from "./path-proof-purpose.js"
|
||||
import { controllerProfileCurrent, publishControllerState, saveControllerProfileCas, withControllerProfileLease } from "./routing-controller-fence.js"
|
||||
@@ -61,7 +61,7 @@ export function registerRoutingProfileActions(register: typeof add) {
|
||||
})
|
||||
}
|
||||
|
||||
interface PersistentController extends ControllerState { baseline?:RoutingControllerBaseline; planId?: string; candidateId?: string; expectedCandidateId?: string; reason?: string; checkedAt?: string; probedAt?: string }
|
||||
interface PersistentController extends ControllerState { baseline?:RoutingControllerBaseline; planId?: string; candidateId?: string; expectedCandidateId?: string; reason?: string; checkedAt?: string; probedAt?: string; failoverReserveCursor?: string }
|
||||
/** Also fenced per profile so direct/concurrent ticks cannot publish stale state. */
|
||||
export async function tickRoutingProfiles() {
|
||||
const { invokeMcpTool, applyPlan } = await import("./runtime.js")
|
||||
@@ -95,6 +95,7 @@ export async function tickRoutingProfiles() {
|
||||
next.lastSwitchAt = at; next.switches = [...(state.switches ?? [])]; next.consecutive = 0
|
||||
next.expectedCandidateId = state.candidateId
|
||||
delete next.planId; delete next.candidateId; delete next.pendingCandidateId; delete next.operationId
|
||||
delete next.failoverReserveCursor
|
||||
next.reason = "Изменение конфигурации проверено; ожидаются новые измерения сети"
|
||||
} else if (plan.operation_id) next.reason = "Операция выполняется"
|
||||
else if (plan.expires_at.getTime() <= Date.now()) { await stop("План истёк без подтверждения"); return }
|
||||
@@ -111,26 +112,42 @@ export async function tickRoutingProfiles() {
|
||||
const analysis = await invokeMcpTool(principal, "mm_route_optimizer_analyze", { profile }) as { ranking: ReturnType<typeof rankRoutingCandidates>; currentCandidateId: string | null }
|
||||
if (state.expectedCandidateId && analysis.currentCandidateId !== state.expectedCandidateId) { await stop("Наблюдаемый путь изменился вне ожидаемого переключения; требуется проверка вмешательства или дрейфа"); return }
|
||||
if (analysis.currentCandidateId) next.expectedCandidateId = analysis.currentCandidateId
|
||||
const health: PathHealth[] = []
|
||||
const selected = [analysis.currentCandidateId, ...analysis.ranking.filter(value => value.eligible).slice(0, 2).map(value => value.candidate.id)]
|
||||
if (profile.candidates.some(candidate => candidate.controlProbe) && !connection.policy.scope.operationIds.includes("routing.path.verify")) { await stop("Не выдано право контрольной проверки пути"); return }
|
||||
for (const candidateId of [...new Set(selected)].filter((id): id is string => !!id)) {
|
||||
const probeCandidate = async (candidateId: string): Promise<PathHealth | undefined> => {
|
||||
if (!profile.candidates.find(candidate => candidate.id === candidateId)?.controlProbe) return
|
||||
await current()
|
||||
if (profile.candidates.find(candidate => candidate.id === candidateId)?.controlProbe) health.push(await invokeMcpTool(principal, "mm_route_path_verify", { profile, candidateId }) as PathHealth)
|
||||
return await invokeMcpTool(principal, "mm_route_path_verify", { profile, candidateId }) as PathHealth
|
||||
}
|
||||
const currentHealth = analysis.currentCandidateId ? await probeCandidate(analysis.currentCandidateId) : undefined
|
||||
const health = currentHealth ? [currentHealth] : []
|
||||
const failoverProbes = analysis.currentCandidateId && currentHealth?.status === "failed"
|
||||
? selectFailoverReserveProbes(analysis.ranking, analysis.currentCandidateId, state.failoverReserveCursor) : undefined
|
||||
const candidates = failoverProbes?.candidateIds ?? analysis.ranking.filter(value => value.eligible).slice(0, 2)
|
||||
.map(value => value.candidate.id).filter(id => id !== analysis.currentCandidateId)
|
||||
for (const candidateId of candidates) {
|
||||
const observed = await probeCandidate(candidateId)
|
||||
if (observed) health.push(observed)
|
||||
}
|
||||
await assertRoutingControllerBaseline(state.baseline,row.id,row.version,profile,row.grant_expires_at.toISOString(),{principal,connection})
|
||||
const charges = await createRoutingReservationStore().readHourlyCharges(row.id, principal)
|
||||
await current()
|
||||
const decision = decideRoutingSwitch(profile, state, analysis.ranking, analysis.currentCandidateId, Date.now(), health, charges.totalCharges)
|
||||
Object.assign(next, decision.state, { reason: decision.reason })
|
||||
next.probedAt = new Date().toISOString()
|
||||
if (decision.state.pausedReason) { await stop(decision.state.pausedReason); return }
|
||||
const hasFreshSelectedProbe = health.some(probe => {
|
||||
if (probe.candidateId !== decision.switchTo || probe.status !== "passed") return false
|
||||
const age = Date.now() - Date.parse(probe.observedAt)
|
||||
const decisionAt = Date.now()
|
||||
const hasFreshPassedProbe = (candidateId: string | null) => health.some(probe => {
|
||||
if (probe.candidateId !== candidateId || probe.status !== "passed") return false
|
||||
const age = decisionAt - Date.parse(probe.observedAt)
|
||||
return age >= 0 && age < COMMUNITY_PATH_MAX_AGE_MS
|
||||
})
|
||||
if (decision.switchTo && usesScopedRouteAiContext(profile) && !hasFreshSelectedProbe) {
|
||||
const decision = decideRoutingSwitch(profile, state, analysis.ranking, analysis.currentCandidateId, decisionAt, health, charges.totalCharges)
|
||||
Object.assign(next, decision.state, { reason: decision.reason })
|
||||
if (!failoverProbes?.cursor) delete next.failoverReserveCursor
|
||||
else if (!hasFreshPassedProbe(failoverProbes.cursor)) {
|
||||
// Advance past failed/unknown reserves. Keep rechecking a passing
|
||||
// reserve while the current path accumulates independent failures.
|
||||
next.failoverReserveCursor = failoverProbes.cursor
|
||||
}
|
||||
next.probedAt = new Date().toISOString()
|
||||
if (decision.state.pausedReason) { await stop(decision.state.pausedReason); return }
|
||||
if (decision.switchTo && usesScopedRouteAiContext(profile) && !hasFreshPassedProbe(decision.switchTo)) {
|
||||
next.reason = "Ожидается успешная контрольная проба выбранного пути"
|
||||
} else if (decision.switchTo) {
|
||||
await current()
|
||||
|
||||
@@ -14,8 +14,10 @@ try {
|
||||
issuedAt: Date.now() - 1000, expiresAt: Date.now() + 900000 }
|
||||
await (await import("./store.js")).updateMcpSettings({ enabled: true }, actor)
|
||||
await import("./actions.js")
|
||||
const mixed = await (await import("./routing-community-scoped-acceptance.js")).acceptScopedRouteCommunitySwitch(actor,
|
||||
{ manualInverseChargeOnly: true, manualInverseChargeCase: "mixed-forward" })
|
||||
const { acceptScopedRouteCommunitySwitch } = await import("./routing-community-scoped-acceptance.js")
|
||||
const inverse = await acceptScopedRouteCommunitySwitch(actor, { manualInverseChargeOnly: true })
|
||||
console.log("private routing v8 manual inverse charge and intent SQL acceptance:", JSON.stringify(inverse))
|
||||
const mixed = await acceptScopedRouteCommunitySwitch(actor, { manualInverseChargeOnly: true, manualInverseChargeCase: "mixed-forward" })
|
||||
console.log("private routing mixed forward/manual inverse admission SQL acceptance:", JSON.stringify(mixed))
|
||||
} finally {
|
||||
await (await import("../../services/scheduler.js")).stopSchedulerForDatabaseOperation()
|
||||
|
||||
@@ -1,4 +1,6 @@
|
||||
import { pollErrorLog } from "../../services/server-poll-error-provenance.js"
|
||||
import { vrfPreparationDiagnostic } from "./vrf-preparation-diagnostic.js"
|
||||
import { createVrfRuntimeDiagnosticBoundary } from "../../services/vrf-execution-diagnostic.js"
|
||||
import { capturePublishedServerProbeTerminalProof } from "../../services/server-probe-operation-retirement.js"
|
||||
import { SERVER_PROBE_OPERATION } from "../../services/server-probe-authority.js"
|
||||
import { preparedPlanExpiry } from "./plan-expiry.js"
|
||||
@@ -13,6 +15,7 @@ import { logSettingsPatchSchema } from "@mmapp/contracts"
|
||||
import { pool } from "../../db/index.js"
|
||||
import { hasPermission, type AuthUser } from "../../lib/permissions.js"
|
||||
import { createUser, updateUser, deleteUser, addBinding, removeBinding, getUserById } from "../users/service/users-service.js"
|
||||
import { normalizeBindingPeer } from "../users/peer-bind.js"
|
||||
import { getLogSettings, updateLogSettings } from "../../services/router-logs-collector.js"
|
||||
import { refreshScheduler } from "../../services/scheduler.js"
|
||||
import { withApplicationMutationLock, withConfigMutationLock } from "../../services/config-mutation-lock.js"
|
||||
@@ -20,7 +23,7 @@ import { withOperationConfigurationLockClient, assertOperationConfigurationLockS
|
||||
import { sharedDatabaseGate } from "../../services/shared-database-gate.js"
|
||||
import { withRuntimePollPrincipalSource, executeRuntimePollPolicyTransaction, type RuntimePollPolicyLoan } from "./runtime-poll-principal-boundary.js"
|
||||
import { readPollRuntimePolicySource, type PollRuntimePolicySource } from "./poll-runtime-policy-source.js"
|
||||
import { withVerifiedConfigurationChange } from "../../services/config-mutation-policy.js"
|
||||
import { withVerifiedConfigurationChange, assertVerifiedConfigurationAccess } from "../../services/config-mutation-policy.js"
|
||||
import { beginMcpOperationAdmission, insertMcpOperationAdmission, retireMcpOperationAdmission, withMcpOperationExecutionOrigin, stripMcpOperationExecutionPrivateResult, type McpOperationAdmission } from "./operation-execution-origin.js"
|
||||
import { createOspfOwnerSourceGuard, verifyOspfOwnerGraph, verifyOspfOwnerGraphAtPhase } from "./ospf-owner-graph.js"
|
||||
import { evaluateMcpPolicy } from "./policy.js"
|
||||
@@ -78,6 +81,12 @@ async function policyInput(client: Pick<PoolClient, "query">, connection: Connec
|
||||
usage: { callsInMinute: Number(usage.calls), mutationsInHour: Number(usage.mutations), concurrentReads: Number(usage.reads) }, auditAvailable: true,
|
||||
}
|
||||
}
|
||||
|
||||
export async function readMcpPolicyPreviewInput(connection: ConnectionRow, input: Pick<McpPolicyPreviewRequest, "operationId" | "target" | "objects" | "objectCount">): Promise<McpPolicyPreviewRequest> {
|
||||
const current = await policyInput(pool, connection, input.operationId, input.target)
|
||||
return { ...current, objects: input.objects, objectCount: input.objectCount }
|
||||
}
|
||||
|
||||
async function temporaryScope(client: Pick<PoolClient, "query">, connection: ConnectionRow, credentialId: string) {
|
||||
const { rows } = await client.query("SELECT payload FROM mcp_grants WHERE connection_id=$1 AND revoked_at IS NULL AND payload->>'credentialId'=$2", [connection.id, credentialId])
|
||||
if (!rows.length) return undefined
|
||||
@@ -127,6 +136,7 @@ async function invokeMcpToolInner(principal: McpPrincipal, toolName: string, raw
|
||||
const call = await reserveCall(principal, toolName, input, signal)
|
||||
const cancelled = () => logsFollowMaintenance && logsFollowCancellation(logsFollowMaintenance, signal)
|
||||
const assertActive = () => { const failure = cancelled(); if (failure) throw failure }
|
||||
let vrfPreparing = false
|
||||
try {
|
||||
assertActive()
|
||||
if (logsFollowMaintenance) call.context.logsFollowMaintenance = logsFollowMaintenance
|
||||
@@ -137,6 +147,7 @@ async function invokeMcpToolInner(principal: McpPrincipal, toolName: string, raw
|
||||
let result: unknown
|
||||
if (action.read) result = await action.read(input, call.context)
|
||||
else if (action.prepare) {
|
||||
vrfPreparing = ["ros.vrf.create", "ros.vrf.update", "ros.vrf.delete"].includes(action.operation.id)
|
||||
const evidence = await action.prepare(input, call.context)
|
||||
result = await transaction(async client => {
|
||||
await client.query("SELECT id FROM mcp_connections WHERE id=$1 FOR UPDATE", [principal.connectionId])
|
||||
@@ -184,6 +195,7 @@ async function invokeMcpToolInner(principal: McpPrincipal, toolName: string, raw
|
||||
await audit(client, connection.owner_id, "plan.create", connection.id, { planId: id, operationId: action.operation.id, decision })
|
||||
return { planId: id, expiresAt: expiresAt.toISOString(), state: decision.decision === "approval-required" ? "awaiting-approval" : "draft", decision, changes: redact(publicMcpChangeEvidence(action.operation.id, evidence)), ...(vrfTicket ? { vrfTicket } : {}), executionAvailable: true }
|
||||
})
|
||||
vrfPreparing = false
|
||||
} else throw new McpError("UNSUPPORTED_CAPABILITY", "Нет обработчика операции", 409)
|
||||
assertActive()
|
||||
const current = await effectiveMcpConnection(principal)
|
||||
@@ -194,6 +206,12 @@ async function invokeMcpToolInner(principal: McpPrincipal, toolName: string, raw
|
||||
assertActive()
|
||||
return output
|
||||
} catch (error) {
|
||||
if (vrfPreparing) {
|
||||
try {
|
||||
const diagnostic = vrfPreparationDiagnostic(call.requestId, action.operation.id, error)
|
||||
if (diagnostic) console.error(JSON.stringify(diagnostic))
|
||||
} catch { /* Diagnostics must never replace the original failure. */ }
|
||||
}
|
||||
const failure = cancelled() ?? error
|
||||
await completeRequest(call.requestId, started, null, failure)
|
||||
throw failure
|
||||
@@ -262,7 +280,7 @@ async function serviceExecute(service: string, input: Record<string, unknown>, c
|
||||
if (service === "users.create") return createUser(appUserCreateSchema.parse(input.user))
|
||||
if (service === "users.update") return updateUser(String(input.id), appUserUpdateSchema.parse(input.user))
|
||||
if (service === "users.delete") return deleteUser(String(input.id))
|
||||
if (service === "users.binding_add") return addBinding(String(input.id), userBindingCreateSchema.parse(input.binding))
|
||||
if (service === "users.binding_add") return addBinding(String(input.id), userBindingCreateSchema.parse(input.binding), { assertCurrent: assertVerifiedConfigurationAccess })
|
||||
if (service === "users.binding_remove") return removeBinding(String(input.id), String(input.bindingId))
|
||||
if (service === "logs.settings.update") { const result = await updateLogSettings(logSettingsPatchSchema.parse(input.settings)); await refreshScheduler(); return result }
|
||||
throw new McpError("UNSUPPORTED_CAPABILITY", "Неизвестный сервис", 409)
|
||||
@@ -286,7 +304,11 @@ export async function verifyStep(step: ChangeStep, result: unknown, before?: Ros
|
||||
if (step.service === "users.binding_remove") { const current = await getUserById(String(step.input.id)); return !!current && !current.bindings.some(binding => binding.id === step.input.bindingId) }
|
||||
if (step.service === "users.binding_add") {
|
||||
const binding = userBindingCreateSchema.parse(step.input.binding), current = await getUserById(String(step.input.id))
|
||||
return !!current?.bindings.some(item => item.serverId === binding.serverId && item.interfaceName === binding.interfaceName && item.peerPublicKey === (binding.peerPublicKey ?? ""))
|
||||
const createdId = result && typeof result === "object" ? (result as { id?: unknown }).id : undefined
|
||||
return typeof createdId === "string" && !!current?.bindings.some(item => item.id === createdId
|
||||
&& item.serverId === binding.serverId && item.interfaceName === binding.interfaceName.trim()
|
||||
&& (binding.interfaceType === undefined || item.interfaceType === binding.interfaceType)
|
||||
&& item.peerPublicKey === normalizeBindingPeer(item.interfaceType, binding.peerPublicKey))
|
||||
}
|
||||
if (step.service === "logs.settings.update") {
|
||||
const current = await getLogSettings() as unknown as Record<string, unknown>
|
||||
@@ -441,6 +463,7 @@ async function executeOperationWithLease(operationId: string, principal: McpPrin
|
||||
const plan = await loadPlan(operation.plan_id), evidence = JSON.parse(await decryptSecret(plan.evidence.sealed)) as ChangeEvidence
|
||||
const serverIds = evidence.target.scope === "servers" ? evidence.target.serverIds : evidence.objects.flatMap(object => object.serverId ? [object.serverId] : [])
|
||||
let attempted = false, confirmed = 0, activeServiceStep = false
|
||||
let vrfDiagnosticFallback: ReturnType<typeof createVrfRuntimeDiagnosticBoundary> | undefined
|
||||
let reservedForwardPassed = false
|
||||
let reservedRecoverySummary: Record<string, unknown> | undefined
|
||||
const diagnosticOnly = evidence.steps.length === 1 && evidence.steps.every(step => step.kind === "service" && findMcpService(step.service)?.cancellableDiagnostic === true)
|
||||
@@ -548,17 +571,23 @@ async function executeOperationWithLease(operationId: string, principal: McpPrin
|
||||
originalExpiresAt:Math.min(plan.expires_at.getTime(),evidence.validUntil?Date.parse(evidence.validUntil):Infinity,Date.parse(principal.credentialExpiresAt),Date.parse(connection.policy.expiresAt),connection.owner_valid_until.getTime(),originalServiceGrant!.admissionExpiresAt),
|
||||
serviceInput:step.input}:undefined
|
||||
const reservedStep: { outcome?: ReservedRoutingStepOutcome<unknown> } = {}
|
||||
vrfDiagnosticFallback = productionVrf && step.kind === "ros" && step.step.resource === "vrf" && ["ros.vrf.create", "ros.vrf.update", "ros.vrf.delete", "routing.vrf.update"].includes(plan.operation_id)
|
||||
? createVrfRuntimeDiagnosticBoundary(operationId, step.step.action === "update" ? "patch" : step.step.action, diagnostic => { console.error(JSON.stringify(diagnostic)) }) : undefined
|
||||
const result = await withVerifiedConfigurationChange({ actorId: connection.owner_id, connectionId: connection.id, serverIds, objects: evidence.objects, approved: !!plan.approved_by, serverWide: step.kind === "service", ...(serviceExecution?{serviceExecution}:{}), authorize: async () => { await (step.kind === "ros" ? authorizeCatalog() : authorize()) }, ...(step.kind === "ros" ? { beforeDispatch: async () => { await prefix!.check(authorizeCatalog); await authorize(); await authorizeCatalog(); if (productionVrf) { if (!vrfBeforeDispatch) throw new McpError("STATE_CONFLICT", "VRF command guard отсутствует", 409); await vrfBeforeDispatch() } } } : {}) },
|
||||
async () => {
|
||||
vrfDiagnosticFallback?.executorEntered()
|
||||
if (step.kind === "ros") {
|
||||
if (!productionVrf) return executeRosStep(step.step)
|
||||
const before = evidence.snapshots.find(snapshot => snapshot.resource === "vrf" && snapshot.serverId === step.step.serverId)
|
||||
if (!before?.sourceProof) throw new McpError("STATE_CONFLICT", "Нет VRF source-v3 proof", 409)
|
||||
if (!["ros.vrf.create", "ros.vrf.update", "ros.vrf.delete", "routing.vrf.update"].includes(plan.operation_id)) throw new McpError("STATE_CONFLICT", "VRF action binding изменён", 409)
|
||||
return executeVrfProductionStep({ operationId, planId: plan.id, connectionId: connection.id, ownerId: connection.owner_id,
|
||||
const receipt = await executeVrfProductionStep({ operationId, planId: plan.id, connectionId: connection.id, ownerId: connection.owner_id,
|
||||
operationName: plan.operation_id as "ros.vrf.create" | "ros.vrf.update" | "ros.vrf.delete" | "routing.vrf.update", operationVersion: plan.operation_version,
|
||||
stepIndex: index, step: step.step, sourceProof: before.sourceProof, originalSnapshots: evidence.snapshots, authorize: authorizeCatalog,
|
||||
assertDependencies: () => prefix!.check(authorizeCatalog), installBeforeDispatch: guard => { vrfBeforeDispatch = guard } })
|
||||
assertDependencies: () => prefix!.check(authorizeCatalog), installBeforeDispatch: guard => { vrfBeforeDispatch = guard },
|
||||
onDiagnostic: diagnostic => { vrfDiagnosticFallback?.observed(diagnostic) } })
|
||||
vrfDiagnosticFallback?.executorReturned()
|
||||
return receipt
|
||||
}
|
||||
const forward = () => serviceExecute(step.service, step.input, { operationId, phase: "forward", stepIndex: index, ...(routingReservationForward ? { routingReservationForward } : {}) })
|
||||
if (!routingReservationId) return step.service === "servers.poll" ? withRuntimePollPrincipalSource(principal, async (current, policyLoan) => {
|
||||
@@ -571,6 +600,7 @@ async function executeOperationWithLease(operationId: string, principal: McpPrin
|
||||
reservedStep.outcome = await executeReservedRoutingStep({ reservationId: routingReservationId, sourceOperationId: operationId, principal, forward })
|
||||
return reservedStep.outcome.forwardResult
|
||||
})
|
||||
vrfDiagnosticFallback = undefined
|
||||
if (reservedStep.outcome?.kind === "recovered") {
|
||||
// The generic source remains intent/result=null until the private
|
||||
// inverse has finished. Record the forward ACK, never B VERIFIED
|
||||
@@ -636,6 +666,7 @@ async function executeOperationWithLease(operationId: string, principal: McpPrin
|
||||
assertOperationConfigurationLockCheckpoint()
|
||||
if (receiptId && finishedAt) return { receiptId, operationId, connectionId:operation.connection_id, finishedAt }
|
||||
} catch (error) {
|
||||
vrfDiagnosticFallback?.failure(error)
|
||||
if (routingReservationId && hasConfirmedReservedRoutingForward(error)) confirmed = Math.max(confirmed, 1)
|
||||
if (error instanceof VrfProductionAcknowledgedFailure) confirmed = Math.max(confirmed, error.acknowledgedWrites)
|
||||
const code = error instanceof VrfProductionClaimOutcomeUnknown ? "VRF_CLAIM_OUTCOME_UNKNOWN" : error instanceof McpError ? error.code : "DEVICE_UNAVAILABLE"
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
import assert from "node:assert/strict"
|
||||
process.env.AUTH_REQUIRED = "true"
|
||||
process.env.AUTH_JWT_SECRET = "users-bindings-owned-acceptance-secret"
|
||||
const { pool, closePool } = await import("../../db/index.js")
|
||||
const { applySqlMigrations } = await import("../../db/migrate.js")
|
||||
const { updateMcpSettings } = await import("./store.js")
|
||||
const actor = { id: "users-bindings-owner", email: "users@example.invalid", name: "User binding owner", apps: ["mm"], permissions: ["mm:settings:admin"], expiresAt: Date.now() + 3600000 }
|
||||
try {
|
||||
await applySqlMigrations(pool)
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM servers")).rows[0].n, 0, "Disposable empty database required")
|
||||
await updateMcpSettings({ enabled: true }, actor)
|
||||
await (await import("../../test/mcp-users-bindings.js")).verifyMcpUserBindings(actor)
|
||||
} finally {
|
||||
await closePool()
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { test } from "node:test"
|
||||
import { vrfPreparationDiagnostic } from "./vrf-preparation-diagnostic.js"
|
||||
|
||||
const requestId = "12345678-1234-4123-8123-123456789abc"
|
||||
const operationId = "ros.vrf.update"
|
||||
function fixture(message = "VRF production transition refused: static address provenance/context", stack?: string) {
|
||||
const error = new Error(message)
|
||||
if (stack !== undefined) Object.defineProperty(error, "stack", { value: stack, configurable: true, writable: true })
|
||||
return error
|
||||
}
|
||||
const stack = "Error: SECRET-PASSWORD 192.0.2.9 native-body\n at must (C:\\private\\backend\\src\\services\\vrf-production-transition.ts:80:82)\n at wrapped (C:\\private\\backend\\src\\modules\\mcp\\vrf-ticket-runtime.ts:76:9)"
|
||||
|
||||
test("plain Error at known refusal produces bounded first owned source, stage and constant reason", () => {
|
||||
const diagnostic = vrfPreparationDiagnostic(requestId, operationId, fixture(undefined, stack))
|
||||
assert.deepEqual(diagnostic, { event: "mcp.vrf.preparation-failed", requestId, operationId, stage: "transition", errorClass: "Error", firstOwnedFrame: { source: "vrf-production-transition", line: 80 }, reason: "static-address-context" })
|
||||
for (const secret of ["SECRET-PASSWORD", "192.0.2.9", "private", "native-body", "must", "stack", "message"]) assert.ok(!JSON.stringify(diagnostic).includes(secret), secret)
|
||||
})
|
||||
test("real constructed Error with native stack never returns function names or raw text", () => {
|
||||
const diagnostic = vrfPreparationDiagnostic(requestId, "ros.vrf.create", new Error("SECRET native payload"))!
|
||||
assert.equal(diagnostic.errorClass, "Error"); assert.equal(diagnostic.reason, "other")
|
||||
assert.ok(!JSON.stringify(diagnostic).includes("SECRET"))
|
||||
const known = new Error("VRF production transition refused: dependency connected route identity")
|
||||
const result = vrfPreparationDiagnostic(requestId, operationId, known)!
|
||||
assert.equal(result.reason, "connected-route-identity"); assert.equal(result.stage, "transition")
|
||||
// Native lazy stack accessors stay unmaterialized. No prepareStackTrace hook
|
||||
// is needed to classify the actual own-data refusal message.
|
||||
assert.equal(typeof Object.getOwnPropertyDescriptor(known, "stack")?.get, "function")
|
||||
assert.equal(result.firstOwnedFrame, undefined)
|
||||
})
|
||||
test("exact known messages map to enums; appended secrets remain other", () => {
|
||||
for (const [message, reason] of [
|
||||
["VRF production ticket refused: original dependency projection changed during preparation", "original-dependency-projection"],
|
||||
["VRF production transition refused: dependency connected route identity", "connected-route-identity"],
|
||||
["VRF production transition refused: missing ordered main VRF", "main-vrf-context"],
|
||||
["VRF production transition refused: main VRF shape", "main-vrf-context"],
|
||||
]) {
|
||||
assert.equal(vrfPreparationDiagnostic(requestId, operationId, fixture(message))!.reason, reason)
|
||||
assert.equal(vrfPreparationDiagnostic(requestId, operationId, fixture(message + " SECRET"))!.reason, "other")
|
||||
}
|
||||
})
|
||||
test("actual native Error unknown refusal suffix maps only reviewed stage without exposing secrets", () => {
|
||||
for (const [prefix, stage] of [["VRF production read refused: ", "read"], ["VRF production admission refused: ", "admission"], ["VRF production transition refused: ", "transition"], ["VRF production ticket refused: ", "ticket"]]) {
|
||||
const error = new Error(prefix + "SECRET-PASSWORD 192.0.2.9 native-body")
|
||||
Object.defineProperty(error, "name", { get() { throw Error("SECRET name getter invoked") } })
|
||||
const result = vrfPreparationDiagnostic(requestId, operationId, error)!
|
||||
assert.equal(result.stage, stage); assert.equal(result.reason, "other"); assert.equal(result.firstOwnedFrame, undefined)
|
||||
for (const secret of ["SECRET-PASSWORD", "192.0.2.9", "native-body", prefix]) assert.ok(!JSON.stringify(result).includes(secret))
|
||||
}
|
||||
const tooLong = fixture("VRF production read refused: " + "S".repeat(512))
|
||||
assert.equal(vrfPreparationDiagnostic(requestId, operationId, tooLong)!.stage, "other")
|
||||
})
|
||||
test("proxy, prototype and toStringTag spoofing reject without triggering traps", () => {
|
||||
let traps = 0
|
||||
const fail = () => { traps++; throw Error("SECRET getter called") }
|
||||
const proxy = new Proxy(fixture(), { get: fail, getPrototypeOf: fail, getOwnPropertyDescriptor: fail, ownKeys: fail })
|
||||
const spoof = Object.create(Error.prototype) as object
|
||||
Object.defineProperties(spoof, { message: { get: fail }, stack: { get: fail }, [Symbol.toStringTag]: { get: fail } })
|
||||
for (const error of [proxy, spoof, { name: "Error", message: "SECRET", stack }]) assert.deepEqual(vrfPreparationDiagnostic(requestId, operationId, error), { event: "mcp.vrf.preparation-failed", requestId, operationId, stage: "other", errorClass: "NonError", reason: "other" })
|
||||
assert.equal(traps, 0)
|
||||
})
|
||||
test("actual Error own accessors and constructor/name getters are never invoked", () => {
|
||||
for (const field of ["message", "stack"]) {
|
||||
const error = fixture(undefined, stack), calls = { count: 0 }
|
||||
Object.defineProperty(error, field, { get() { calls.count++; throw Error("SECRET") } })
|
||||
Object.defineProperty(error, "name", { get() { calls.count++; throw Error("SECRET") } })
|
||||
Object.defineProperty(error, "constructor", { get() { calls.count++; throw Error("SECRET") } })
|
||||
const diagnostic = vrfPreparationDiagnostic(requestId, operationId, error)!
|
||||
assert.equal(diagnostic.reason, field === "stack" ? "static-address-context" : "other"); assert.equal(diagnostic.stage, field === "stack" ? "transition" : "other"); assert.equal(diagnostic.firstOwnedFrame, undefined)
|
||||
assert.equal(calls.count, 0)
|
||||
}
|
||||
})
|
||||
test("built-in error classes use prototype identity and subclasses remain a fixed enum", () => {
|
||||
for (const [error, expected] of [[new TypeError("SECRET"), "TypeError"], [new RangeError("SECRET"), "RangeError"], [new SyntaxError("SECRET"), "SyntaxError"], [new (class SecretError extends Error {})("SECRET"), "OtherNativeError"]] as const) assert.equal(vrfPreparationDiagnostic(requestId, operationId, error)!.errorClass, expected)
|
||||
})
|
||||
test("nested Linux/Windows/compiled paths return source enums with bounded line only", () => {
|
||||
for (const path of ["/app/dist/services/vrf-production-read.js", "file:///app/dist/services/vrf-production-read.js", "file:///C:/workspace/backend/src/services/vrf-production-read.ts", "C:\\workspace\\backend\\src\\services\\vrf-production-read.ts"]) {
|
||||
const diagnostic = vrfPreparationDiagnostic(requestId, operationId, fixture("unexpected", `Error: SECRET\n at external (/tmp/node_modules/native.js:99:2)\n at closure (${path}:203:12)`))!
|
||||
assert.equal(diagnostic.stage, "read"); assert.deepEqual(diagnostic.firstOwnedFrame, { source: "vrf-production-read", line: 203 })
|
||||
assert.ok(!JSON.stringify(diagnostic).includes(path))
|
||||
}
|
||||
})
|
||||
test("non-owned paths, wrong directories and invalid line numbers never pass through", () => {
|
||||
for (const path of ["/app/dist/services/private-secret.ts:1:1", "/app/dist/other/vrf-production-read.ts:1:1", "/app/dist/services/vrf-production-read.ts:0:1", "/app/dist/services/vrf-production-read.ts:1000001:1", "https://secret.example/src/services/vrf-production-read.ts:1:1"]) assert.equal(vrfPreparationDiagnostic(requestId, operationId, fixture("unexpected", `Error: SECRET\n at run (${path})`))!.firstOwnedFrame, undefined)
|
||||
})
|
||||
test("stack scan has fixed byte/line bounds and never inspects error causes", () => {
|
||||
const error = fixture("SECRET", "Error: SECRET\n" + " at external (/tmp/external.js:1:1)\n".repeat(70) + " at internal (/app/dist/services/vrf-production-transition.js:80:1)")
|
||||
Object.defineProperty(error, "cause", { get() { throw Error("SECRET cause accessed") } })
|
||||
assert.equal(vrfPreparationDiagnostic(requestId, operationId, error)!.firstOwnedFrame, undefined)
|
||||
error.stack = "Error: " + "S".repeat(17000) + "\n at internal (/app/dist/services/vrf-production-transition.js:80:1)"
|
||||
assert.equal(vrfPreparationDiagnostic(requestId, operationId, error)!.firstOwnedFrame, undefined)
|
||||
})
|
||||
test("nonerrors have no copied fields; non-VRF/non-UUID calls have no diagnostic", () => {
|
||||
for (const error of [null, undefined, "SECRET", 42, Symbol("SECRET"), () => { throw Error("SECRET") }]) assert.equal(vrfPreparationDiagnostic(requestId, operationId, error)!.errorClass, "NonError")
|
||||
for (const operation of ["ros.vrf.list", "routing.vrf.update", "mcp.operation.apply", "ros.bridge.update", "ros.vrf.update SECRET"]) assert.equal(vrfPreparationDiagnostic(requestId, operation, fixture()), undefined)
|
||||
assert.equal(vrfPreparationDiagnostic("SECRET-not-a-uuid", operationId, fixture()), undefined)
|
||||
})
|
||||
@@ -0,0 +1,86 @@
|
||||
import { types } from "node:util"
|
||||
|
||||
const ownedSources = {
|
||||
"vrf-production-read": { directory: "services", stage: "read" },
|
||||
"vrf-production-admission": { directory: "services", stage: "admission" },
|
||||
"vrf-production-transition": { directory: "services", stage: "transition" },
|
||||
"vrf-production-ticket-store": { directory: "services", stage: "ticket" },
|
||||
"vrf-production-action-binding": { directory: "services", stage: "admission" },
|
||||
"vrf-members": { directory: "services", stage: "read" },
|
||||
"vrf-ticket-runtime": { directory: "modules/mcp", stage: "ticket" },
|
||||
"resources": { directory: "modules/mcp", stage: "read" },
|
||||
"actions": { directory: "modules/mcp", stage: "other" },
|
||||
"runtime": { directory: "modules/mcp", stage: "runtime" },
|
||||
} as const
|
||||
type Source = keyof typeof ownedSources
|
||||
type Stage = typeof ownedSources[Source]["stage"]
|
||||
type Reason = "original-dependency-projection" | "static-address-context" | "connected-route-identity" | "main-vrf-context" | "other"
|
||||
type ErrorClass = "Error" | "TypeError" | "RangeError" | "SyntaxError" | "ReferenceError" | "URIError" | "EvalError" | "OtherNativeError" | "NonError"
|
||||
type Operation = "ros.vrf.create" | "ros.vrf.update" | "ros.vrf.delete"
|
||||
export interface VrfPreparationDiagnostic {
|
||||
event: "mcp.vrf.preparation-failed"; requestId: string; operationId: Operation;
|
||||
stage: Stage; errorClass: ErrorClass;
|
||||
firstOwnedFrame?: { source: Source; line: number };
|
||||
reason: Reason;
|
||||
}
|
||||
|
||||
// Only complete, reviewed constant refusals. No user/native text is copied and
|
||||
// appending any text (including secrets) intentionally maps back to "other".
|
||||
const reasons = new Map<string, Reason>([
|
||||
["VRF production ticket refused: original dependency projection changed during preparation", "original-dependency-projection"],
|
||||
["VRF production transition refused: static address provenance/context", "static-address-context"],
|
||||
["VRF production transition refused: dependency connected route identity", "connected-route-identity"],
|
||||
["VRF production transition refused: missing ordered main VRF", "main-vrf-context"],
|
||||
["VRF production transition refused: main VRF shape", "main-vrf-context"],
|
||||
])
|
||||
const refusalStages: ReadonlyArray<readonly [string, Stage]> = [
|
||||
["VRF production read refused: ", "read"],
|
||||
["VRF production admission refused: ", "admission"],
|
||||
["VRF production transition refused: ", "transition"],
|
||||
["VRF production ticket refused: ", "ticket"],
|
||||
]
|
||||
const classes: Array<[object, ErrorClass]> = [
|
||||
[Error.prototype, "Error"], [TypeError.prototype, "TypeError"], [RangeError.prototype, "RangeError"], [SyntaxError.prototype, "SyntaxError"],
|
||||
[ReferenceError.prototype, "ReferenceError"], [URIError.prototype, "URIError"], [EvalError.prototype, "EvalError"],
|
||||
]
|
||||
const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
|
||||
|
||||
function dataString(error: object, key: "message" | "stack"): string | undefined {
|
||||
const descriptor = Object.getOwnPropertyDescriptor(error, key)
|
||||
return descriptor && Object.hasOwn(descriptor, "value") && typeof descriptor.value === "string" ? descriptor.value : undefined
|
||||
}
|
||||
function ownedFrame(stack: string | undefined): VrfPreparationDiagnostic["firstOwnedFrame"] {
|
||||
if (!stack) return undefined
|
||||
// Bound work before splitting, and ignore the first error-message line.
|
||||
for (const line of stack.slice(0, 16384).split(/\r?\n/).slice(1, 65)) {
|
||||
if (line.length > 2048 || !/^\s+at\s/.test(line)) continue
|
||||
const match = /(?:^|[ (])(?:file:\/\/)?(?:[A-Za-z]:[\\/]|\/)[^\r\n]*?[\\/](?:src|dist)[\\/](services|modules[\\/]mcp)[\\/]([a-z-]+)\.(?:ts|js):([1-9]\d{0,6}):[1-9]\d{0,6}\)?$/.exec(line)
|
||||
if (!match || !Object.hasOwn(ownedSources, match[2])) continue
|
||||
const source = match[2] as Source, lineNumber = Number(match[3])
|
||||
if (match[1].replaceAll("\\", "/") !== ownedSources[source].directory || lineNumber > 1000000) continue
|
||||
return { source, line: lineNumber }
|
||||
}
|
||||
return undefined
|
||||
}
|
||||
|
||||
/** Pure bounded diagnostic. Never inspect arbitrary error getters/proxies,
|
||||
* retain original objects, or expose messages, paths, addresses or stack text. */
|
||||
export function vrfPreparationDiagnostic(requestId: string, operationId: string, error: unknown): VrfPreparationDiagnostic | undefined {
|
||||
if (typeof requestId !== "string" || !uuid.test(requestId) || !["ros.vrf.create", "ros.vrf.update", "ros.vrf.delete"].includes(operationId)) return undefined
|
||||
const result: VrfPreparationDiagnostic = { event: "mcp.vrf.preparation-failed", requestId, operationId: operationId as Operation, stage: "other", errorClass: "NonError", reason: "other" }
|
||||
// isNativeError is an internal-slot check, unlike instanceof/toString. It
|
||||
// rejects Proxy(Error) and prototype/toStringTag imitations without traps.
|
||||
if (!types.isNativeError(error)) return result
|
||||
result.errorClass = classes.find(([prototype]) => Object.getPrototypeOf(error) === prototype)?.[1] ?? "OtherNativeError"
|
||||
const message = dataString(error, "message"), stack = dataString(error, "stack")
|
||||
if (message !== undefined && message.length <= 512) {
|
||||
result.reason = reasons.get(message) ?? "other"
|
||||
result.stage = refusalStages.find(([prefix]) => message.startsWith(prefix))?.[1] ?? "other"
|
||||
}
|
||||
// Node 22 uses a native lazy stack accessor. We deliberately do not invoke
|
||||
// it (nor Error.prepareStackTrace); exact own-message reasons still work.
|
||||
if (message === undefined || stack === undefined) return result
|
||||
const frame = ownedFrame(stack)
|
||||
if (frame) { result.firstOwnedFrame = frame; result.stage = ownedSources[frame.source].stage }
|
||||
return result
|
||||
}
|
||||
@@ -49,7 +49,7 @@ export async function prepareRuntimeVrfTicket(input: VrfRuntimeTicketInput, depe
|
||||
const actionId = vrfNativeActionFor(input.operationId, request)
|
||||
const context: PrepareVrfProductionTicketInput["context"] = { binding: { planId: input.planId, actorId: input.ownerId, serverId: native.serverId, sourceProof }, connectionId: input.connectionId, actionId,
|
||||
actionVersion: input.operationId === "routing.vrf.update" ? Number(findMcpOperation(actionId)?.version) : input.operationVersion,
|
||||
...(input.operationId === "routing.vrf.update" ? { authorityAction: { id: "routing.vrf.update" as const, version: input.operationVersion as 3 } } : {}) }
|
||||
...(input.operationId === "routing.vrf.update" ? { authorityAction: { id: "routing.vrf.update" as const, version: input.operationVersion as 4 } } : {}) }
|
||||
assertVrfActionContext(context, request); assertVrfAliasEvidence(context, request, evidence)
|
||||
const authority = async () => {
|
||||
await input.assertAuthority()
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
import type { UserBindingCreate } from "@mmapp/contracts/users"
|
||||
import { getServerRowById } from "../servers/repository/servers-repository.js"
|
||||
import { MikrotikClient } from "../../services/mikrotik.js"
|
||||
import { sameWireguardEndpoint } from "../../services/wireguard-source.js"
|
||||
import { ipsecClientBindingKeys, type IpsecServerState } from "../../services/ipsec-live.js"
|
||||
import { bindingNativeRows, readBindingTarget, UserBindingTargetError } from "./binding-target.js"
|
||||
|
||||
export function readNativeUserBindingTarget(input: UserBindingCreate, options: { signal?: AbortSignal; assertCurrent?: () => Promise<unknown> } = {}) {
|
||||
return readBindingTarget(input, async () => {
|
||||
const server = await getServerRowById(input.serverId)
|
||||
if (!server?.enabled) throw new UserBindingTargetError("Сервер отключён или не найден", 404)
|
||||
const client = MikrotikClient.fromServer(server)
|
||||
return {
|
||||
async assertCurrent() {
|
||||
const fresh = await getServerRowById(input.serverId)
|
||||
if (!fresh || !sameWireguardEndpoint(fresh, server)) throw new UserBindingTargetError("Источник привязки изменился", 409)
|
||||
},
|
||||
get: (path, timeout, signal, maximum) => client.get(path, timeout, signal, maximum),
|
||||
ipsecKeys: (certs, peers, identities) => ipsecClientBindingKeys({ server,
|
||||
certs: bindingNativeRows(certs, [".id", "name"]) as IpsecServerState["certs"],
|
||||
peers: bindingNativeRows(peers, [".id"]) as IpsecServerState["peers"],
|
||||
identities: bindingNativeRows(identities, [".id"]) as IpsecServerState["identities"],
|
||||
}),
|
||||
}
|
||||
}, options)
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { resolveBindingInterface, resolveBindingPeer, readBindingTarget, UserBindingTargetError } from "./binding-target.js"
|
||||
|
||||
const row = (name: string, type: string, id = "*1") => ({ ".id": id, name, type })
|
||||
const refused = (status: number) => (error: unknown) => error instanceof UserBindingTargetError && error.status === status
|
||||
let cases = 0
|
||||
for (const [native, expected] of [["ether", "ether"], ["bridge", "bridge"], ["vlan", "vlan"], ["vxlan", "vxlan"], ["gre-tunnel", "gre"], ["wg", "wg"], ["wireguard", "wg"], ["dummy", "other"]]) {
|
||||
const iface = resolveBindingInterface({ serverId: 1, interfaceName: "actual" }, [row("actual", native)])
|
||||
assert.equal(iface.type, expected); cases++
|
||||
}
|
||||
for (const raw of [undefined, {}, [{ ".id": "*1", name: "ether-guess" }], [row("actual", "")], [row("actual", "ether", "*G1")], [row("actual", "ether"), row("duplicate-id", "ether")]]) {
|
||||
assert.throws(() => resolveBindingInterface({ serverId: 1, interfaceName: "actual" }, raw), refused(502)); cases++
|
||||
}
|
||||
assert.throws(() => resolveBindingInterface({ serverId: 1, interfaceName: "missing" }, []), refused(404)); cases++
|
||||
assert.throws(() => resolveBindingInterface({ serverId: 1, interfaceName: "actual" }, [row("actual", "ether"), row("actual", "ether", "*2")]), refused(409)); cases++
|
||||
assert.throws(() => resolveBindingInterface({ serverId: 1, interfaceName: "actual", interfaceType: "ether" }, [row("actual", "wg")]), refused(409)); cases++
|
||||
const wgInput = { serverId: 1, interfaceName: "wg-real", peerPublicKey: "actual-key" }
|
||||
const wg = resolveBindingInterface(wgInput, [row("wg-real", "wg")])
|
||||
const peer = { ".id": "*2", interface: "wg-real", "public-key": "actual-key", "preshared-key": "PRIVATE_VALUE" }
|
||||
assert.equal(resolveBindingPeer(wgInput, wg, [peer]).peerPublicKey, "actual-key"); cases++
|
||||
assert.equal(JSON.stringify(resolveBindingPeer(wgInput, wg, [peer])).includes("PRIVATE_VALUE"), false); cases++
|
||||
for (const peers of [[], [{ ...peer, interface: "foreign" }], [{ ...peer, "public-key": "foreign" }]]) {
|
||||
assert.throws(() => resolveBindingPeer(wgInput, wg, peers), refused(404)); cases++
|
||||
}
|
||||
assert.throws(() => resolveBindingPeer(wgInput, wg, [peer, { ...peer, ".id": "*3" }]), refused(409)); cases++
|
||||
assert.throws(() => resolveBindingPeer({ ...wgInput, peerPublicKey: "" }, wg, [peer]), refused(400)); cases++
|
||||
for (const key of ["client-cn", "managed-psk-name"]) {
|
||||
const input = { serverId: 1, interfaceName: "ipsec-vpn", peerPublicKey: key }
|
||||
const iface = resolveBindingInterface(input)
|
||||
assert.equal(resolveBindingPeer(input, iface, undefined, ["client-cn", "managed-psk-name"]).peerPublicKey, key); cases++
|
||||
assert.throws(() => resolveBindingPeer(input, iface, undefined, [key, key]), refused(409)); cases++
|
||||
assert.throws(() => resolveBindingPeer(input, iface, undefined, []), refused(404)); cases++
|
||||
}
|
||||
let current = true, authority = true, nativeCalls = 0
|
||||
const open = async () => ({
|
||||
async assertCurrent() { if (!current) throw new UserBindingTargetError("Источник привязки изменился", 409) },
|
||||
async get(path: string, timeout: number, signal: AbortSignal, maximum: number) {
|
||||
assert(timeout > 0 && timeout <= 10000); assert.equal(maximum, 1048576); assert(signal instanceof AbortSignal)
|
||||
nativeCalls++
|
||||
return path === "/interface" ? [row("wg-real", "wg")] : [peer]
|
||||
},
|
||||
ipsecKeys() { return ["client-cn", "managed-psk-name"] },
|
||||
})
|
||||
const selected = await readBindingTarget(wgInput, open, { assertCurrent: async () => { assert(authority, "current authority") } })
|
||||
assert.equal(nativeCalls, 2); cases++
|
||||
current = false; await assert.rejects(selected.assertCurrent(), refused(409)); cases++
|
||||
current = true; authority = false; await assert.rejects(selected.assertCurrent(), /current authority/); cases++
|
||||
authority = true
|
||||
await assert.rejects(readBindingTarget(wgInput, async () => ({ ...await open(), async get() { current = false; return [row("wg-real", "wg")] } })), refused(409)); cases++
|
||||
current = true
|
||||
const cancelled = new AbortController(); cancelled.abort()
|
||||
await assert.rejects(readBindingTarget(wgInput, open, { signal: cancelled.signal })); cases++
|
||||
const ipsecPaths: string[] = []
|
||||
const psk = await readBindingTarget({ serverId: 1, interfaceName: "ipsec-vpn", peerPublicKey: "managed-psk-name" }, async () => ({
|
||||
...await open(), async get(path) { ipsecPaths.push(path); return [] },
|
||||
}))
|
||||
assert.equal(psk.peerPublicKey, "managed-psk-name")
|
||||
assert.deepEqual(ipsecPaths, ["/certificate", "/ip/ipsec/peer", "/ip/ipsec/identity"]); cases++
|
||||
await assert.rejects(readBindingTarget(wgInput, async () => ({ ...await open(), async get() { throw Error("PRIVATE_UPSTREAM_BODY") } })), error =>
|
||||
refused(502)(error) && !(error as Error).message.includes("PRIVATE_UPSTREAM_BODY")); cases++
|
||||
console.log("User binding native selectors, eight types, peer keys, scope/source/authority and privacy cases:", cases)
|
||||
@@ -0,0 +1,90 @@
|
||||
import type { InterfaceType, UserBindingCreate } from "@mmapp/contracts/users"
|
||||
import { mapRosInterfaceType } from "./iface-type.js"
|
||||
import { normalizeBindingPeer, PeerBindError, peerDisplayName } from "./peer-bind.js"
|
||||
import { nativeNetworkRows } from "../../services/network-observed-read.js"
|
||||
|
||||
export class UserBindingTargetError extends Error {
|
||||
constructor(message: string, readonly status: 400 | 404 | 409 | 502) { super(message) }
|
||||
}
|
||||
export interface BindingInterface { ifaceName: string; type: InterfaceType; nativeId?: string }
|
||||
export interface BindingTarget extends BindingInterface { peerPublicKey: string; peerName: string }
|
||||
export function bindingNativeRows(raw: unknown, required: string[]) {
|
||||
try {
|
||||
const rows = nativeNetworkRows(raw, required)
|
||||
if (rows.some(row => !/^\*[a-f0-9]+$/i.test(row[".id"]!))) throw new Error("native ID")
|
||||
return rows
|
||||
}
|
||||
catch { throw new UserBindingTargetError("Не подтверждён native-каталог привязки.", 502) }
|
||||
}
|
||||
export function resolveBindingInterface(input: UserBindingCreate, raw?: unknown): BindingInterface {
|
||||
const ifaceName = input.interfaceName.trim()
|
||||
if (!ifaceName) throw new UserBindingTargetError("Имя интерфейса обязательно", 400)
|
||||
let type: InterfaceType, nativeId: string | undefined
|
||||
if (ifaceName === "ipsec-vpn") type = "ipsec"
|
||||
else {
|
||||
const rows = bindingNativeRows(raw, [".id", "name", "type"])
|
||||
const matches = rows.filter(row => row.name === ifaceName)
|
||||
if (!matches.length) throw new UserBindingTargetError("Интерфейс не найден", 404)
|
||||
if (matches.length !== 1) throw new UserBindingTargetError("Неоднозначное имя интерфейса", 409)
|
||||
type = mapRosInterfaceType(matches[0].type)
|
||||
nativeId = matches[0][".id"]
|
||||
if (type === "ipsec") throw new UserBindingTargetError("Для IPsec выберите каталог ipsec-vpn", 409)
|
||||
}
|
||||
if (input.interfaceType !== undefined && input.interfaceType !== type) throw new UserBindingTargetError("Тип интерфейса изменился или не соответствует устройству", 409)
|
||||
return { ifaceName, type, ...(nativeId ? { nativeId } : {}) }
|
||||
}
|
||||
export function resolveBindingPeer(input: UserBindingCreate, iface: BindingInterface, rawPeers?: unknown, ipsecKeys?: string[]): BindingTarget {
|
||||
let peerPublicKey: string
|
||||
try { peerPublicKey = normalizeBindingPeer(iface.type, input.peerPublicKey) }
|
||||
catch (error) { if (error instanceof PeerBindError) throw new UserBindingTargetError(error.message, 400); throw error }
|
||||
if (iface.type === "wg") {
|
||||
const matches = bindingNativeRows(rawPeers, [".id", "interface", "public-key"]).filter(row =>
|
||||
[iface.ifaceName, iface.nativeId].includes(row.interface) && row["public-key"] === peerPublicKey)
|
||||
if (!matches.length) throw new UserBindingTargetError("Пир WireGuard не найден на выбранном интерфейсе", 404)
|
||||
if (matches.length !== 1) throw new UserBindingTargetError("Неоднозначный пир WireGuard", 409)
|
||||
}
|
||||
if (iface.type === "ipsec") {
|
||||
if (!Array.isArray(ipsecKeys) || ipsecKeys.length > 10000 || ipsecKeys.some(key => typeof key !== "string" || !key.trim())) throw new UserBindingTargetError("Не подтверждён native-каталог клиентов IPsec", 502)
|
||||
const matches = ipsecKeys.filter(key => key === peerPublicKey)
|
||||
if (!matches.length) throw new UserBindingTargetError("Клиент IPsec не найден", 404)
|
||||
if (matches.length !== 1) throw new UserBindingTargetError("Неоднозначный ключ клиента IPsec", 409)
|
||||
}
|
||||
return { ...iface, peerPublicKey, peerName: iface.type === "wg" ? peerDisplayName({ publicKey: peerPublicKey, name: input.peerName }) : "" }
|
||||
}
|
||||
|
||||
export interface BindingReadSession {
|
||||
assertCurrent(): Promise<unknown>
|
||||
get(path: string, timeoutMs: number, signal: AbortSignal, maxResponseBytes: number): Promise<unknown>
|
||||
ipsecKeys(certs: unknown, peers: unknown, identities: unknown): string[]
|
||||
}
|
||||
/** Fixed catalogues only; no UI snapshot/history, writes, retries or authority token. */
|
||||
export async function readBindingTarget(input: UserBindingCreate, open: () => Promise<BindingReadSession>, options: { signal?: AbortSignal; assertCurrent?: () => Promise<unknown> } = {}) {
|
||||
const end = performance.now() + 10000, signal = options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(10000)]) : AbortSignal.timeout(10000)
|
||||
const session = await open()
|
||||
const assertCurrent = async () => {
|
||||
signal.throwIfAborted()
|
||||
if (performance.now() >= end) throw new UserBindingTargetError("Истёк срок проверки привязки", 502)
|
||||
await options.assertCurrent?.()
|
||||
await session.assertCurrent()
|
||||
signal.throwIfAborted()
|
||||
if (performance.now() >= end) throw new UserBindingTargetError("Истёк срок проверки привязки", 502)
|
||||
}
|
||||
const read = async (path: string) => {
|
||||
await assertCurrent()
|
||||
let value: unknown
|
||||
try { value = await session.get(path, Math.max(1, Math.ceil(end - performance.now())), signal, 1048576) }
|
||||
catch { throw new UserBindingTargetError("Native-каталог привязки недоступен", 502) }
|
||||
await assertCurrent()
|
||||
return value
|
||||
}
|
||||
const iface = resolveBindingInterface(input, input.interfaceName.trim() === "ipsec-vpn" ? undefined : await read("/interface"))
|
||||
let rawPeers: unknown, ipsecKeys: string[] | undefined
|
||||
if (iface.type === "wg") rawPeers = await read("/interface/wireguard/peers")
|
||||
if (iface.type === "ipsec") {
|
||||
const certs = await read("/certificate"), peers = await read("/ip/ipsec/peer"), identities = await read("/ip/ipsec/identity")
|
||||
ipsecKeys = session.ipsecKeys(certs, peers, identities)
|
||||
}
|
||||
const target = resolveBindingPeer(input, iface, rawPeers, ipsecKeys)
|
||||
await assertCurrent()
|
||||
return { ...target, assertCurrent }
|
||||
}
|
||||
@@ -41,10 +41,10 @@ import {
|
||||
parseRawInterfaces,
|
||||
} from "../iface-type.js"
|
||||
import {
|
||||
normalizeBindingPeer,
|
||||
PeerBindError,
|
||||
peerDisplayName,
|
||||
} from "../peer-bind.js"
|
||||
import { readNativeUserBindingTarget } from "../binding-native-read.js"
|
||||
import { UserBindingTargetError } from "../binding-target.js"
|
||||
import { listWireGuardPeersForCatalog } from "../../../services/wireguard-live.js"
|
||||
import { listIpsecClientsForCatalog } from "../../../services/ipsec-live.js"
|
||||
|
||||
@@ -190,28 +190,22 @@ async function deleteUserImpl(id: string): Promise<void> {
|
||||
await deleteUserRowById(id)
|
||||
}
|
||||
|
||||
export function addBinding(userId: string, input: UserBindingCreate): Promise<UserBinding> { return executeGuardedApplicationWrite({ kind: "user", id: userId }, () => userMutationDependencies(userId, [input.serverId]), () => addBindingImpl(userId, input)) }
|
||||
async function addBindingImpl(userId: string, input: UserBindingCreate): Promise<UserBinding> {
|
||||
type BindingReadOptions = { signal?: AbortSignal; assertCurrent?: () => Promise<unknown> }
|
||||
export function addBinding(userId: string, input: UserBindingCreate, options: BindingReadOptions = {}): Promise<UserBinding> { return executeGuardedApplicationWrite({ kind: "user", id: userId }, () => userMutationDependencies(userId, [input.serverId]), () => addBindingImpl(userId, input, options)) }
|
||||
/** Read-only validation shared by plan preparation and the guarded write. */
|
||||
export async function validateUserBindingCreate(userId: string, input: UserBindingCreate, options: BindingReadOptions = {}): Promise<{ ifaceName: string; type: InterfaceType; peerPublicKey: string; peerName: string; assertCurrent(): Promise<void> }> {
|
||||
const user = await getUserRowById(userId)
|
||||
if (!user) throw new UsersServiceError("Пользователь не найден", 404)
|
||||
const serverRows = await db.select().from(servers).where(eq(servers.id, input.serverId)).limit(1)
|
||||
if (!serverRows[0]) throw new UsersServiceError("Сервер не найден", 404)
|
||||
const ifaceName = input.interfaceName.trim()
|
||||
if (!ifaceName) throw new UsersServiceError("Имя интерфейса обязательно", 400)
|
||||
const type: InterfaceType = input.interfaceType ?? await inferIfaceType(input.serverId, ifaceName)
|
||||
let peerPublicKey = ""
|
||||
let target: Awaited<ReturnType<typeof readNativeUserBindingTarget>>
|
||||
try {
|
||||
peerPublicKey = normalizeBindingPeer(type, input.peerPublicKey)
|
||||
target = await readNativeUserBindingTarget(input, options)
|
||||
} catch (err) {
|
||||
if (err instanceof PeerBindError) throw new UsersServiceError(err.message, err.status)
|
||||
if (err instanceof UserBindingTargetError) throw new UsersServiceError(err.message, err.status)
|
||||
throw err
|
||||
}
|
||||
const peerName = type === "wg"
|
||||
? peerDisplayName({
|
||||
publicKey: peerPublicKey,
|
||||
name: input.peerName,
|
||||
})
|
||||
: ""
|
||||
const { ifaceName, type, peerPublicKey, peerName, assertCurrent } = target
|
||||
const taken = await getBindingByServerIfacePeer(input.serverId, ifaceName, peerPublicKey)
|
||||
if (taken) {
|
||||
throw new UsersServiceError(
|
||||
@@ -221,8 +215,14 @@ async function addBindingImpl(userId: string, input: UserBindingCreate): Promise
|
||||
409,
|
||||
)
|
||||
}
|
||||
return { ifaceName, type, peerPublicKey, peerName, assertCurrent }
|
||||
}
|
||||
|
||||
async function addBindingImpl(userId: string, input: UserBindingCreate, options: BindingReadOptions): Promise<UserBinding> {
|
||||
const { ifaceName, type, peerPublicKey, peerName, assertCurrent } = await validateUserBindingCreate(userId, input, options)
|
||||
const now = new Date().toISOString()
|
||||
try {
|
||||
await assertCurrent()
|
||||
const row = await createBindingRow({
|
||||
id: randomUUID(),
|
||||
userId,
|
||||
@@ -237,6 +237,7 @@ async function addBindingImpl(userId: string, input: UserBindingCreate): Promise
|
||||
})
|
||||
return await toBindingDto(row)
|
||||
} catch (err) {
|
||||
if (err instanceof UserBindingTargetError) throw new UsersServiceError(err.message, err.status)
|
||||
if (isUniqueConstraintError(err)) {
|
||||
throw new UsersServiceError(
|
||||
type === "wg"
|
||||
@@ -258,13 +259,6 @@ async function removeBindingImpl(userId: string, bindingId: string): Promise<voi
|
||||
await deleteBindingRowById(bindingId)
|
||||
}
|
||||
|
||||
async function inferIfaceType(serverId: number, ifaceName: string): Promise<InterfaceType> {
|
||||
const snap = await getLatestSnapshot(serverId)
|
||||
const parsed = parseRawInterfaces(snap?.rawInterfaces)
|
||||
const found = parsed.find((i) => i.name === ifaceName)
|
||||
return found?.type ?? "other"
|
||||
}
|
||||
|
||||
export async function getInterfaceCatalogState(serverId: number): Promise<InterfaceCatalogState> {
|
||||
const serverRows = await db.select().from(servers).where(eq(servers.id, serverId)).limit(1)
|
||||
if (!serverRows[0]) throw new UsersServiceError("Сервер не найден", 404)
|
||||
|
||||
@@ -11,6 +11,10 @@ import { mcpPublicUrl } from "./mcp-transport.js"
|
||||
import { assertPortalClaimsCurrent } from "../modules/mcp/portal-revocation.js"
|
||||
|
||||
const clientInput = z.object({ name: z.string().trim().min(1).max(100), redirectUris: z.array(z.string().url()).min(1).max(10) }).strict()
|
||||
const consentInput = z.discriminatedUnion("approve", [
|
||||
z.object({ requestId: z.string().uuid(), approve: z.literal(true), connectionId: z.string().uuid() }).strict(),
|
||||
z.object({ requestId: z.string().uuid(), approve: z.literal(false), connectionId: z.string().uuid().optional() }).strict(),
|
||||
])
|
||||
function safeRedirect(value: string): boolean {
|
||||
const url = new URL(value)
|
||||
return !url.username && !url.password && !url.hash && (url.protocol === "https:" || url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname))
|
||||
@@ -134,21 +138,29 @@ export const mcpOauth: FastifyPluginAsync = async app => {
|
||||
return authorization
|
||||
})
|
||||
admin.post("/api/mcp/oauth/consent", async request => {
|
||||
const input = z.object({ requestId: z.string().uuid(), connectionId: z.string().uuid(), approve: z.boolean() }).strict().parse(request.body)
|
||||
const input = consentInput.parse(request.body)
|
||||
return transaction(async db => {
|
||||
const { rows: [authorization] } = await db.query("SELECT r.* FROM mcp_oauth_requests r JOIN mcp_oauth_clients c ON c.id=r.client_id WHERE r.id=$1 AND r.expires_at>now() AND r.code_digest IS NULL AND r.consumed_at IS NULL AND c.enabled=true FOR UPDATE OF r", [input.requestId])
|
||||
if (!authorization) throw new McpError("NOT_FOUND", "Запрос согласия устарел", 404)
|
||||
const connection = await getConnection(input.connectionId, db)
|
||||
if (connection.owner_id !== request.authUser!.id || connection.policy.status !== "active" || connection.generation !== await accessGeneration() || connection.owner_valid_until.getTime() <= Date.now()) throw new McpError("PERMISSION_DENIED", "Выберите своё действующее подключение с подтверждёнными правами владельца")
|
||||
const redirect = new URL(authorization.redirect_uri)
|
||||
if (authorization.state) redirect.searchParams.set("state", authorization.state)
|
||||
redirect.searchParams.set("iss", issuer)
|
||||
if (!input.approve) { redirect.searchParams.set("error", "access_denied"); await db.query("UPDATE mcp_oauth_requests SET consumed_at=now() WHERE id=$1", [authorization.id]) }
|
||||
else {
|
||||
let connectionId: string | null = null
|
||||
if (input.approve) {
|
||||
const connection = await getConnection(input.connectionId, db)
|
||||
const generation = await accessGeneration(), now = Date.now()
|
||||
if (connection.owner_id !== request.authUser!.id || connection.policy.status !== "active" || connection.generation !== generation ||
|
||||
Date.parse(connection.policy.expiresAt) <= now || connection.owner_valid_until.getTime() <= now) {
|
||||
throw new McpError("PERMISSION_DENIED", "Выберите своё действующее подключение с подтверждёнными правами владельца")
|
||||
}
|
||||
connectionId = connection.id
|
||||
const code = randomToken("code"); redirect.searchParams.set("code", code)
|
||||
await db.query("UPDATE mcp_oauth_requests SET code_digest=$2,connection_id=$3 WHERE id=$1", [authorization.id, tokenDigest(code), connection.id])
|
||||
await db.query("UPDATE mcp_oauth_requests SET code_digest=$2,connection_id=$3 WHERE id=$1", [authorization.id, tokenDigest(code), connectionId])
|
||||
} else {
|
||||
redirect.searchParams.set("error", "access_denied")
|
||||
await db.query("UPDATE mcp_oauth_requests SET consumed_at=now() WHERE id=$1", [authorization.id])
|
||||
}
|
||||
await audit(db, request.authUser!.id, "oauth.consent", connection.id, { clientId: authorization.client_id, approved: input.approve })
|
||||
await audit(db, request.authUser!.id, "oauth.consent", connectionId, { clientId: authorization.client_id, approved: input.approve })
|
||||
return { redirectUrl: redirect.href }
|
||||
})
|
||||
})
|
||||
|
||||
@@ -163,6 +163,23 @@ try {
|
||||
assert.ok(!response.body.includes("NEVER_"))
|
||||
assert.equal(artifactQueries, 2, "malformed artifact stops after bounded metadata before ciphertext, owner, source or native access")
|
||||
} finally { pool.query = originalQuery; pool.connect = originalConnect }
|
||||
const profile = {
|
||||
id: createBody.connectionId, connection_id: createBody.connectionId, version: 2,
|
||||
config: { name: "Route AI test" }, enabled: true, grant_expires_at: "2099-01-01T00:00:00Z", updated_at: "2026-11-01T00:00:00Z",
|
||||
state: { reason: "План ожидает подтверждения", candidateId: "wan-b", failureCount: 3,
|
||||
baseline: { nativeRule: "NEVER_PRIVATE_BASELINE" }, failoverReserveCursor: "NEVER_PRIVATE_CURSOR" },
|
||||
}
|
||||
pool.query = (async (sql: string, values: unknown[]) => {
|
||||
assert.match(sql, /FROM mcp_routing_profiles p JOIN mcp_connections c/)
|
||||
assert.deepEqual(values, [true, "human-admin"])
|
||||
return { rows: [profile] }
|
||||
}) as typeof pool.query
|
||||
try {
|
||||
const listed = await app.inject({ url: "/api/mcp/routing-profiles", headers: admin })
|
||||
assert.equal(listed.statusCode, 200, listed.body)
|
||||
assert.deepEqual(listed.json().profiles, [{ ...profile, state: { reason: profile.state.reason, candidateId: "wan-b", failureCount: 3 } }])
|
||||
assert.ok(!listed.body.includes("NEVER_PRIVATE_"))
|
||||
} finally { pool.query = originalQuery }
|
||||
env.authRequired = false
|
||||
assert.equal((await app.inject({ url: "/api/mcp/catalog" })).statusCode, 503)
|
||||
assert.equal((await app.inject({ method: "POST", url: "/api/mcp/policy/preview", payload, headers: admin })).statusCode, 503)
|
||||
|
||||
@@ -4,6 +4,7 @@ import { humanIpsecExistingCertificateExportMetadata, readHumanIpsecExistingCert
|
||||
import type { createIpsecExistingCertificateExportArtifactStore } from "../services/ipsec-existing-certificate-export-artifact.js"
|
||||
import type { FastifyPluginAsync } from "fastify"
|
||||
import { z } from "zod"
|
||||
import { bridgeVlanConfigurationRequestSchema } from "@mmapp/contracts/bridge-vlan"
|
||||
import { randomUUID, createHash } from "node:crypto"
|
||||
import { mcpCatalogResponseSchema, mcpConnectionCreateSchema, mcpPageQuerySchema, mcpPolicyPreviewRequestSchema, mcpPolicyPreviewResponseSchema, mcpSettingsPatchSchema, mcpTemporaryGrantSchema } from "@mmapp/contracts/mcp"
|
||||
import { mcpProtectionCreateRequestSchema } from "../modules/mcp/protection-requests.js"
|
||||
@@ -16,7 +17,7 @@ import { pool } from "../db/index.js"
|
||||
import { hasPermission, type AuthUser } from "../lib/permissions.js"
|
||||
import { accessGeneration, decryptSecret, encryptSecret, McpError, randomToken, redact, tokenDigest } from "../modules/mcp/security.js"
|
||||
import { createMcpConnection, listMcpConnections, getMcpSettings, updateMcpSettings, getConnection, assertConnectionVisible, rotateConnectionToken, setConnectionStatus, updateMcpConnection, transaction, audit } from "../modules/mcp/store.js"
|
||||
import { approvePlan, loadPlan, publicPlan } from "../modules/mcp/runtime.js"
|
||||
import { approvePlan, loadPlan, publicPlan, readMcpPolicyPreviewInput } from "../modules/mcp/runtime.js"
|
||||
import { applyPlan, invokeMcpTool } from "../modules/mcp/runtime.js"
|
||||
import { findOwnerPlanReplayTombstone } from "../modules/mcp/operation-replay-tombstones.js"
|
||||
import { routeAiProfileSchema } from "@mmapp/contracts/mcp-routing"
|
||||
@@ -28,6 +29,7 @@ import { assertPortalClaimsCurrent } from "../modules/mcp/portal-revocation.js"
|
||||
import { sharedDatabaseGate } from "../services/shared-database-gate.js"
|
||||
import { readFile } from "node:fs/promises"
|
||||
import { checkMcpProtocol, type ProtocolProbe } from "../modules/mcp/readiness.js"
|
||||
import { publicRoutingControllerState } from "../modules/mcp/routing-community-public.js"
|
||||
import { humanBackupDownloadMetadata, readHumanBackupDownloadArtifact } from "../modules/mcp/backup-download-artifact.js"
|
||||
import { humanDatabaseBackupMetadata, readHumanDatabaseBackupArtifact } from "../modules/mcp/database-backup-artifact.js"
|
||||
import { humanWireguardExportMetadata, readHumanWireguardExportArtifact } from "../modules/mcp/wireguard-export-artifact.js"
|
||||
@@ -38,6 +40,7 @@ import { readServerPollCapacity } from "../services/server-poll-capacity.js"
|
||||
import { connectProbeStorage } from "../services/server-probe-storage-connection.js"
|
||||
|
||||
const uuid = z.string().uuid()
|
||||
const selectedPolicyPreviewSchema = mcpPolicyPreviewRequestSchema.pick({ operationId: true, target: true, objects: true, objectCount: true }).extend({ connectionId: uuid })
|
||||
const deviceResource = z.enum(["ethernet", "bridge", "bridge_port", "bridge_vlan", "vlan", "ipv4_address", "ipv6_address", "vrf"])
|
||||
const devicePlanCommon = { connectionId: uuid, fields: z.record(z.string(), z.unknown()).default({}) }
|
||||
export const mcpDevicePlanBodySchema = z.discriminatedUnion("action", [
|
||||
@@ -126,15 +129,25 @@ export function createMcpRoutes(checkClaims = assertPortalClaimsCurrent, options
|
||||
})
|
||||
|
||||
app.post("/mcp/policy/preview", async (request, reply) => {
|
||||
const parsed = mcpPolicyPreviewRequestSchema.safeParse(request.body)
|
||||
const parsed = z.union([selectedPolicyPreviewSchema, mcpPolicyPreviewRequestSchema]).safeParse(request.body)
|
||||
if (!parsed.success) return reply.code(400).send({ error: "Некорректные параметры симуляции политики MCP", details: parsed.error.flatten() })
|
||||
const now = new Date()
|
||||
let input
|
||||
if ("connectionId" in parsed.data) {
|
||||
const connection = await getConnection(parsed.data.connectionId)
|
||||
assertConnectionVisible(connection, actorOf(request.authUser))
|
||||
const [generation, settings, current] = await Promise.all([
|
||||
accessGeneration(), getMcpSettings(), readMcpPolicyPreviewInput(connection, parsed.data),
|
||||
])
|
||||
const inactive = !settings.enabled || connection.generation !== generation || connection.owner_valid_until <= now
|
||||
input = inactive && current.policy.status === "active" ? { ...current, policy: { ...current.policy, status: "paused" as const } } : current
|
||||
} else input = parsed.data
|
||||
return mcpPolicyPreviewResponseSchema.parse({
|
||||
simulation: true,
|
||||
executionAvailable: false,
|
||||
evaluatedAt: now.toISOString(),
|
||||
policyVersion: parsed.data.policy.version,
|
||||
result: evaluateMcpPolicy(parsed.data, now),
|
||||
policyVersion: input.policy.version,
|
||||
result: evaluateMcpPolicy(input, now),
|
||||
})
|
||||
})
|
||||
|
||||
@@ -183,6 +196,20 @@ export function createMcpRoutes(checkClaims = assertPortalClaimsCurrent, options
|
||||
await audit(pool, actor.id, "device.web.plan", input.connectionId, { serverId: params.serverId, resource: params.resource, action: input.action, objectId: input.action === "create" ? null : input.id ?? null })
|
||||
return ownerDelegate(async () => invokeMcpTool(principal, `mm_${params.resource}_${input.action}_plan`, mcpDevicePlanArguments(params.serverId, input)))
|
||||
})
|
||||
app.get("/mcp/devices/:serverId/bridge-vlan/configuration", async request => {
|
||||
const { serverId } = z.object({ serverId: z.coerce.number().int().positive() }).parse(request.params)
|
||||
const { connectionId } = z.object({ connectionId: uuid }).strict().parse(request.query)
|
||||
const principal = await ownerPrincipal(connectionId, actorOf(request.authUser), "network.bridge-vlan.read")
|
||||
return ownerDelegate(() => invokeMcpTool(principal, "mm_bridge_vlan_configuration_get", { serverId }))
|
||||
})
|
||||
app.post("/mcp/devices/:serverId/bridge-vlan/configuration/plan", async request => {
|
||||
const { serverId } = z.object({ serverId: z.coerce.number().int().positive() }).parse(request.params)
|
||||
const { connectionId, ...input } = bridgeVlanConfigurationRequestSchema.omit({ serverId: true }).extend({ connectionId: uuid }).strict().parse(request.body)
|
||||
const actor = actorOf(request.authUser)
|
||||
const principal = await ownerPrincipal(connectionId, actor, "network.bridge-vlan.configure")
|
||||
await audit(pool, actor.id, "device.web.vlan-plan", connectionId, { serverId, bridgeId: input.bridgeId })
|
||||
return ownerDelegate(() => invokeMcpTool(principal, "mm_bridge_vlan_configuration_plan", { serverId, ...input }))
|
||||
})
|
||||
app.get("/mcp/settings", async () => getMcpSettings())
|
||||
app.put("/mcp/settings", async request => updateMcpSettings(mcpSettingsPatchSchema.parse(request.body), actorOf(request.authUser)))
|
||||
app.post("/mcp/pause", async request => { await updateMcpSettings({ enabled: false }, actorOf(request.authUser)); return { ok: true } })
|
||||
@@ -310,14 +337,15 @@ export function createMcpRoutes(checkClaims = assertPortalClaimsCurrent, options
|
||||
permissions: actions.filter(action => connection.policy.scope.operationIds.includes(action.operation.id)).every(action => action.operation.requiredPermissions.every(permission => hasPermission(connection.owner_permissions, permission) && hasPermission(connection.policy.permissions, permission))),
|
||||
credentials: (await pool.query("SELECT 1 FROM mcp_credentials WHERE connection_id=$1 AND revoked_at IS NULL AND expires_at>now() AND kind IN ('bearer','access') LIMIT 1", [connection.id])).rows.length > 0,
|
||||
}
|
||||
const protocolProbe: ProtocolProbe = Object.values(checks).every(Boolean) ? await checkMcpProtocol(connection.id, actorOf(request.authUser)) : { status: "skipped", reason: "PRECHECK_FAILED", elapsedMs: 0, credentialType: "temporary-no-operations", clientCredentialsVerified: false }
|
||||
const protocolProbe: ProtocolProbe = Object.values(checks).every(Boolean) ? await checkMcpProtocol(connection.id, actorOf(request.authUser)) : { status: "skipped", reason: "PRECHECK_FAILED", elapsedMs: 0, credentialType: "temporary-no-operations", capabilitiesRead: "skipped", clientCredentialsVerified: false }
|
||||
const result = { ...checks, protocolHandshake: protocolProbe.status === "passed" }
|
||||
await audit(pool, actorOf(request.authUser).id, "connection.check", connection.id, { checks: result, protocolProbe })
|
||||
return { ok: Object.values(result).every(Boolean), checks: result, protocolProbe, checkedAt: new Date().toISOString(), transport: "streamable-http", endpointPath: "/mcp" }
|
||||
})
|
||||
app.get("/mcp/routing-profiles", async request => {
|
||||
const actor = actorOf(request.authUser)
|
||||
return { profiles: (await pool.query("SELECT p.id,p.connection_id,p.version,p.config,p.state,p.enabled,p.grant_expires_at,p.updated_at FROM mcp_routing_profiles p JOIN mcp_connections c ON c.id=p.connection_id WHERE ($1::boolean OR c.owner_id=$2) ORDER BY p.updated_at DESC LIMIT 200", [hasPermission(actor.permissions, "mm:mcp:admin"), actor.id])).rows }
|
||||
const { rows } = await pool.query("SELECT p.id,p.connection_id,p.version,p.config,p.state,p.enabled,p.grant_expires_at,p.updated_at FROM mcp_routing_profiles p JOIN mcp_connections c ON c.id=p.connection_id WHERE ($1::boolean OR c.owner_id=$2) ORDER BY p.updated_at DESC LIMIT 200", [hasPermission(actor.permissions, "mm:mcp:admin"), actor.id])
|
||||
return { profiles: rows.map(row => ({ ...row, state: publicRoutingControllerState(row.state) })) }
|
||||
})
|
||||
app.post("/mcp/routing-profiles/:id/pause", async request => {
|
||||
const id = idOf(request.params), actor = actorOf(request.authUser)
|
||||
|
||||
@@ -97,6 +97,9 @@ assert.equal(failedProperty.statusCode,503);assert.equal(failedProperty.json().r
|
||||
propertyFailure=false
|
||||
rawPayload=[{".id":"one",gateway:"192.0.2.1"}]
|
||||
assert.equal((await app.inject({method:"GET",url:"/api/recursive-routes/gateways/catalog?serverId=1"})).json().gateways[0].status,"unknown")
|
||||
rawPayload=[{".id":"one",gateway:"192.0.2.1",inactive:"true"}]
|
||||
assert.equal((await app.inject({method:"GET",url:"/api/recursive-routes/gateways/catalog?serverId=1"})).json().gateways[0].status,"inactive")
|
||||
assert.equal((await app.inject({method:"GET",url:"/api/recursive-routes/gateways?serverId=1"})).json().gateways[0].status,"down")
|
||||
for (const type of ["home-router", "exit-node"] as const) {
|
||||
server.enabled=false;server.type=type
|
||||
const counts={writes,rawReads,savedSnapshots}
|
||||
|
||||
@@ -146,7 +146,7 @@ const recursiveDefaults: RecursiveRouteDependencies = {
|
||||
// Every ownership marker is a comment. Keep all commented rows, including
|
||||
// unsupported ones that must block an unsafe replacement of the managed set.
|
||||
return purpose === "gateways"
|
||||
? client.get<unknown>("/ip/route?.proplist=.id,gateway,active")
|
||||
? client.get<unknown>("/ip/route?.proplist=.id,gateway,active,inactive")
|
||||
: client.post<unknown>("/ip/route/print", { ".query": ["comment"] })
|
||||
},
|
||||
readProperty: (server, id, property) => MikrotikClient.fromServer(server).post("/ip/route/get", { ".id": id, "value-name": property }),
|
||||
|
||||
@@ -0,0 +1,332 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { test } from "node:test"
|
||||
import { bridgeVlanConfigurationRequestSchema } from "@mmapp/contracts/bridge-vlan"
|
||||
import { buildBridgeVlanConfiguration, bridgeVlanCurrentDesired, bridgeVlanInverseDesired, parseBridgeVlanIds, type BridgeVlanDesired, type BridgeVlanState } from "./bridge-vlan-configuration.js"
|
||||
|
||||
const cpu = { resource: "bridge", id: "*1" }, access = { resource: "ethernet", id: "*2" }, trunk = { resource: "ethernet", id: "*3" }
|
||||
function fixture() {
|
||||
const state: BridgeVlanState = {
|
||||
bridges: [{ ".id": "*1", name: "br-users", disabled: "false", pvid: "1", "vlan-filtering": "false", "frame-types": "admit-all", "ingress-filtering": "true", mvrp: "false" }],
|
||||
interfaces: [
|
||||
{ ...cpu, name: "br-users", disabled: "false" }, { ...access, name: "ether2", disabled: "false" }, { ...trunk, name: "ether3", disabled: "false" },
|
||||
{ resource: "ethernet", id: "*4", name: "ether-mgmt", disabled: "false" },
|
||||
{ resource: "vlan", id: "*5", name: "mgmt-vlan", disabled: "false" },
|
||||
],
|
||||
ports: [{ ".id": "*10", bridge: "br-users", interface: "ether2", pvid: "10", "ingress-filtering": "true", "frame-types": "admit-all", disabled: "false" }],
|
||||
vlans: [], vlanInterfaces: [],
|
||||
ipv4Addresses: [{ ".id": "*20", address: "192.0.2.1/24", interface: "ether-mgmt", disabled: "false" }], ipv6Addresses: [],
|
||||
}
|
||||
const desired: BridgeVlanDesired = {
|
||||
filtering: true, pvid: 1,
|
||||
ports: [{ id: "*10", interface: access, pvid: 10, ingressFiltering: true, frameTypes: "admit-all", disabled: false }, { interface: trunk, pvid: 1, ingressFiltering: true, frameTypes: "admit-only-vlan-tagged", disabled: false }],
|
||||
vlans: [{ vlanIds: "10", tagged: [cpu, trunk], untagged: [access], disabled: false }], removePortIds: [], removeVlanIds: [],
|
||||
}
|
||||
return structuredClone({ serverId: 1, bridgeId: "*1", state, desired, management: { serverId: 1, channelId: "verified-channel", host: "192.0.2.1", expiresAt: "2026-11-05T01:00:00Z" }, now: Date.parse("2026-11-05T00:00:00Z") })
|
||||
}
|
||||
const build = (change?: (value: ReturnType<typeof fixture>) => void) => { const value = fixture(); change?.(value); return buildBridgeVlanConfiguration(value) }
|
||||
|
||||
test("enable creates VLAN and port before filtering, stable IDs and foreign rows retained", () => {
|
||||
const value = fixture(); value.state.ports.push({ ".id": "*99", bridge: "foreign", interface: "foreign-port" })
|
||||
const original = structuredClone(value), plan = buildBridgeVlanConfiguration(value)
|
||||
assert.deepEqual(plan.steps.map(step => [step.resource, step.action]), [["bridge_vlan", "create"], ["bridge_port", "create"], ["bridge", "update"]])
|
||||
assert.deepEqual(plan.steps.at(-1)?.fields, { "vlan-filtering": "true" })
|
||||
assert.equal(plan.steps[0].fields.tagged, "br-users,ether3")
|
||||
assert.ok(plan.objects.some(object => object.kind === "bridge_port" && object.id === "*10"))
|
||||
assert.deepEqual(value, original, "preparation must be pure")
|
||||
})
|
||||
test("strict VID parsing includes arbitrary ranges and rejects overlaps and invalid syntax", () => {
|
||||
assert.deepEqual(parseBridgeVlanIds("4094,11-13,1"), [1, 11, 12, 13, 4094])
|
||||
for (const bad of ["", "0", "4095", "10-9", "1,1", "1-3,3-4", "01", "1, 2", "1-", "+1", "1.1", "1,,2"]) assert.throws(() => parseBridgeVlanIds(bad), undefined, bad)
|
||||
})
|
||||
test("public schema rejects management evidence, unknown flags, and fractional PVID", () => {
|
||||
const value = fixture(), request = { serverId: value.serverId, bridgeId: value.bridgeId, desired: value.desired }
|
||||
assert.ok(bridgeVlanConfigurationRequestSchema.safeParse(request).success)
|
||||
assert.ok(!bridgeVlanConfigurationRequestSchema.safeParse({ ...request, management: value.management }).success)
|
||||
assert.ok(!bridgeVlanConfigurationRequestSchema.safeParse({ ...request, desired: { ...request.desired, managementSafe: true } }).success)
|
||||
assert.ok(!bridgeVlanConfigurationRequestSchema.safeParse({ ...request, desired: { ...request.desired, pvid: 1.5 } }).success)
|
||||
})
|
||||
test("full desired set cannot silently omit existing rows or claim a foreign row", () => {
|
||||
assert.throws(() => build(value => { value.desired.ports.shift() }), /полный список/)
|
||||
assert.throws(() => build(value => { value.desired.ports[0].id = "*99" }), /полный список/)
|
||||
assert.throws(() => build(value => { value.desired.removePortIds.push("*10") }), /Повтор/)
|
||||
})
|
||||
test("cross-bridge memberships and foreign slaves are refused", () => {
|
||||
assert.throws(() => build(value => { value.desired.vlans[0].tagged.push({ resource: "ethernet", id: "*4" }) }), /не принадлежит/)
|
||||
assert.throws(() => build(value => { value.state.ports.push({ ".id": "*98", interface: "ether3", bridge: "foreign" }) }), /другому bridge/)
|
||||
assert.throws(() => build(value => { value.desired.ports[1].interface = cpu }), /является bridge/)
|
||||
})
|
||||
test("effective tagged/untagged overlap and duplicate membership are refused", () => {
|
||||
assert.throws(() => build(value => { value.desired.vlans[0].tagged.push(access) }), /Повтор/)
|
||||
assert.throws(() => build(value => { value.desired.vlans.push(structuredClone(value.desired.vlans[0])) }), /Неоднозначная/)
|
||||
})
|
||||
test("explicit untagged VLAN must agree with PVID; omitted untagged uses native PVID membership", () => {
|
||||
assert.throws(() => build(value => { value.desired.ports[0].pvid = 11 }), /не соответствует PVID/)
|
||||
assert.ok(build(value => { value.desired.vlans[0].untagged = [] }).steps.length > 0)
|
||||
assert.throws(() => build(value => { value.desired.vlans[0].vlanIds = "10-11" }), /не соответствует PVID/)
|
||||
})
|
||||
|
||||
function implicitPvidManagement() {
|
||||
const value = fixture()
|
||||
value.state.bridges[0]["vlan-filtering"] = "true"; value.state.bridges[0].pvid = "10"
|
||||
value.state.ipv4Addresses[0].interface = "br-users"
|
||||
value.state.vlans = [{ ".id": "*30", bridge: "br-users", dynamic: "true", "vlan-ids": "10", "current-untagged": "br-users,ether2" }]
|
||||
value.desired = bridgeVlanCurrentDesired(value.state, value.bridgeId)
|
||||
return value
|
||||
}
|
||||
test("implicit PVID CPU and access membership supports a safe edit without static VLAN commands", () => {
|
||||
const value = implicitPvidManagement(); value.desired.ports[0].ingressFiltering = false
|
||||
const plan = buildBridgeVlanConfiguration(value)
|
||||
assert.deepEqual(plan.steps, [{ serverId: 1, resource: "bridge_port", action: "update", id: "*10", fields: { "ingress-filtering": "false" } }])
|
||||
assert.equal(plan.managementPath.bridgeName, "br-users")
|
||||
assert.deepEqual(plan.inverse.desired.vlans, [])
|
||||
})
|
||||
test("implicit management rejects CPU/port PVID migration and CPU frame admission loss", () => {
|
||||
for (const change of [
|
||||
(value: ReturnType<typeof implicitPvidManagement>) => { value.desired.pvid = 11 },
|
||||
(value: ReturnType<typeof implicitPvidManagement>) => { value.desired.ports[0].pvid = 11 },
|
||||
(value: ReturnType<typeof implicitPvidManagement>) => { value.desired.frameTypes = "admit-only-vlan-tagged" },
|
||||
]) {
|
||||
const value = implicitPvidManagement(); change(value)
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value), /CPU management|management/)
|
||||
}
|
||||
})
|
||||
test("CPU observation is required and MVRP dynamic registration is unsupported", () => {
|
||||
for (const field of ["frame-types", "ingress-filtering"]) {
|
||||
const value = implicitPvidManagement(); delete value.state.bridges[0][field]
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value))
|
||||
}
|
||||
const value = implicitPvidManagement(); value.state.bridges[0].mvrp = "true"
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value), error => error instanceof Error && "code" in error && error.code === "UNSUPPORTED_CAPABILITY")
|
||||
})
|
||||
test("tagged-only CPU does not acquire implicit PVID membership and untagged-only CPU cannot serve a VLAN interface", () => {
|
||||
const value = fixture(); value.state.bridges[0]["frame-types"] = "admit-only-vlan-tagged"; value.desired.pvid = 10
|
||||
assert.ok(buildBridgeVlanConfiguration(value).steps.length > 0)
|
||||
const tagged = implicitPvidManagement()
|
||||
tagged.state.vlans = [{ ".id": "*11", bridge: "br-users", "vlan-ids": "10", tagged: "br-users,ether2", disabled: "false" }]
|
||||
tagged.state.ports[0]["frame-types"] = "admit-only-vlan-tagged"
|
||||
tagged.state.bridges[0]["frame-types"] = "admit-only-untagged-and-priority-tagged"; tagged.state.bridges[0].pvid = "1"
|
||||
tagged.state.vlanInterfaces = [{ ".id": "*5", name: "mgmt-vlan", interface: "br-users", "vlan-id": "10", disabled: "false" }]
|
||||
tagged.state.ipv4Addresses[0].interface = "mgmt-vlan"
|
||||
tagged.desired = bridgeVlanCurrentDesired(tagged.state, tagged.bridgeId); tagged.desired.ports[0].ingressFiltering = false
|
||||
assert.throws(() => buildBridgeVlanConfiguration(tagged), /CPU management/)
|
||||
})
|
||||
test("multi-VLAN tagged ranges are supported without fabricated access ports", () => {
|
||||
const plan = build(value => { value.desired.vlans.push({ vlanIds: "20-30,40", tagged: [cpu, trunk], untagged: [], disabled: false }) })
|
||||
assert.equal(plan.steps.filter(step => step.resource === "bridge_vlan" && step.action === "create").length, 2)
|
||||
})
|
||||
test("independent management disables filtering first for edits and restores last", () => {
|
||||
const plan = build(value => { value.state.bridges[0]["vlan-filtering"] = "true" })
|
||||
assert.deepEqual(plan.steps[0].fields, { "vlan-filtering": "false" })
|
||||
assert.deepEqual(plan.steps.at(-1)?.fields, { "vlan-filtering": "true" })
|
||||
})
|
||||
test("explicit deletion is supported, inverse recreates old configuration with original fields", () => {
|
||||
const value = fixture()
|
||||
value.state.vlans = [{ ".id": "*11", bridge: "br-users", "vlan-ids": "10", tagged: "br-users", untagged: "ether2", disabled: "false", comment: "original" }]
|
||||
value.desired.filtering = false; value.desired.ports = []; value.desired.vlans = []
|
||||
value.desired.removePortIds = ["*10"]; value.desired.removeVlanIds = ["*11"]
|
||||
const plan = buildBridgeVlanConfiguration(value)
|
||||
assert.deepEqual(plan.steps.map(step => [step.resource, step.action, step.id]), [["bridge_vlan", "delete", "*11"], ["bridge_port", "delete", "*10"]])
|
||||
const inverse = bridgeVlanInverseDesired(plan, [])
|
||||
assert.equal(inverse.ports[0].id, undefined); assert.equal(inverse.vlans[0].id, undefined)
|
||||
assert.equal(inverse.vlans[0].comment, "original"); assert.equal(inverse.ports[0].pvid, 10)
|
||||
assert.ok(plan.objects.some(object => object.kind === "ethernet" && object.id === access.id), "Removed old physical interface remains protected")
|
||||
assert.ok(plan.objects.some(object => object.kind === "bridge" && object.id === cpu.id), "Removed old CPU membership remains protected")
|
||||
})
|
||||
test("inverse removes only exact executor ACK IDs, never predicted native IDs", () => {
|
||||
const plan = build(), inverse = bridgeVlanInverseDesired(plan, [{ stepIndex: 0, id: "*A1" }, { stepIndex: 1, id: "*A2" }])
|
||||
assert.deepEqual(inverse.removeVlanIds, ["*A1"]); assert.deepEqual(inverse.removePortIds, ["*A2"])
|
||||
assert.throws(() => bridgeVlanInverseDesired(plan, []), /ACK/)
|
||||
assert.throws(() => bridgeVlanInverseDesired(plan, [{ stepIndex: 0, id: "*A1" }, { stepIndex: 0, id: "*A2" }]), /Повтор/)
|
||||
})
|
||||
test("dynamic rows cannot be modified or deleted and never become commands", () => {
|
||||
const plan = build(value => { value.state.vlans.push({ ".id": "*30", bridge: "br-users", dynamic: "true", "vlan-ids": "10", "current-untagged": "ether2" }) })
|
||||
assert.ok(plan.steps.every(step => step.id !== "*30"))
|
||||
assert.throws(() => build(value => { value.state.ports[0].dynamic = "true" }), /полный список/)
|
||||
})
|
||||
test("channel host must be an actual enabled configured address with live same-server receipt", () => {
|
||||
assert.throws(() => build(value => { value.management.host = "198.51.100.1" }), /Адрес канала/)
|
||||
assert.throws(() => build(value => { value.management.serverId = 2 }), /канала управления/)
|
||||
assert.throws(() => build(value => { value.management.expiresAt = new Date(value.now).toISOString() }), /канала управления/)
|
||||
assert.throws(() => build(value => { value.state.ipv4Addresses[0].disabled = "true" }), /Адрес канала/)
|
||||
assert.throws(() => build(value => { value.state.ipv4Addresses.push({ ...value.state.ipv4Addresses[0], ".id": "*21" }) }), /однозначно/)
|
||||
})
|
||||
test("equivalent IPv6 channel addresses resolve without textual spelling assumptions", () => {
|
||||
const plan = build(value => { value.management.host = "2001:db8::1"; value.state.ipv4Addresses = []; value.state.ipv6Addresses = [{ ".id": "*22", address: "2001:0db8:0:0:0:0:0:1/64", interface: "ether-mgmt", disabled: "false" }] })
|
||||
assert.equal(plan.managementPath.addressId, "*22")
|
||||
})
|
||||
function bridgeManagement() {
|
||||
const value = fixture()
|
||||
value.state.bridges[0]["vlan-filtering"] = "true"
|
||||
value.state.bridges[0].pvid = "10"
|
||||
value.state.ipv4Addresses[0].interface = "br-users"
|
||||
value.state.vlans = [{ ".id": "*11", bridge: "br-users", "vlan-ids": "10", untagged: "br-users,ether2", disabled: "false" }]
|
||||
value.desired.pvid = 10
|
||||
value.desired.vlans[0] = { id: "*11", vlanIds: "10", tagged: [trunk], untagged: [cpu, access], disabled: false }
|
||||
return value
|
||||
}
|
||||
test("same-bridge CPU management allows multiple safe changes without a filtering outage", () => {
|
||||
const value = bridgeManagement(), plan = buildBridgeVlanConfiguration(value)
|
||||
assert.equal(plan.managementPath.bridgeName, "br-users")
|
||||
assert.ok(plan.steps.length >= 2)
|
||||
assert.ok(plan.steps.every(step => step.fields["vlan-filtering"] === undefined))
|
||||
})
|
||||
test("removing redundant explicit CPU untagged declaration preserves derived PVID membership", () => {
|
||||
const value = bridgeManagement(); value.desired.vlans[0].untagged = [access]
|
||||
assert.ok(buildBridgeVlanConfiguration(value).steps.length > 0)
|
||||
})
|
||||
test("port removal and untagged migration cannot fabricate management safety", () => {
|
||||
for (const change of [
|
||||
(value: ReturnType<typeof bridgeManagement>) => { value.desired.ports.shift(); value.desired.removePortIds = ["*10"]; value.desired.vlans[0].untagged = [cpu] },
|
||||
(value: ReturnType<typeof bridgeManagement>) => { value.desired.pvid = 20 },
|
||||
]) { const value = bridgeManagement(); change(value); assert.throws(() => buildBridgeVlanConfiguration(value)) }
|
||||
})
|
||||
test("a direct bridge CPU address also preserves existing tagged external management paths", () => {
|
||||
const value = implicitPvidManagement()
|
||||
value.state.ports.push({ ".id": "*12", bridge: "br-users", interface: "ether3", pvid: "1", "ingress-filtering": "true", "frame-types": "admit-only-vlan-tagged", disabled: "false" })
|
||||
value.state.vlans = [{ ".id": "*11", bridge: "br-users", "vlan-ids": "10", tagged: "ether3", disabled: "false" }]
|
||||
value.desired = bridgeVlanCurrentDesired(value.state, value.bridgeId)
|
||||
value.desired.ports[0].ingressFiltering = false
|
||||
assert.equal(buildBridgeVlanConfiguration(value).steps.length, 1)
|
||||
value.desired.vlans[0].tagged = []
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value), /CPU management/)
|
||||
})
|
||||
test("VLAN management derives VID and CPU membership from the configured parent", () => {
|
||||
const value = fixture()
|
||||
value.state.bridges[0]["vlan-filtering"] = "true"
|
||||
value.state.ports[0]["frame-types"] = "admit-only-vlan-tagged"
|
||||
value.state.ports[0].pvid = "1"
|
||||
value.state.vlans = [{ ".id": "*11", bridge: "br-users", "vlan-ids": "10", tagged: "br-users,ether2", disabled: "false" }]
|
||||
value.state.vlanInterfaces = [{ ".id": "*5", name: "mgmt-vlan", interface: "br-users", "vlan-id": "10", disabled: "false" }]
|
||||
value.state.ipv4Addresses[0].interface = "mgmt-vlan"
|
||||
value.desired.ports[0].pvid = 1; value.desired.ports[0].frameTypes = "admit-only-vlan-tagged"
|
||||
value.desired.vlans[0] = { id: "*11", vlanIds: "10", tagged: [cpu, access, trunk], untagged: [], disabled: false }
|
||||
const plan = buildBridgeVlanConfiguration(value)
|
||||
assert.equal(plan.managementPath.vlanId, 10)
|
||||
for (const [kind, id] of [["ipv4_address", "*20"], ["vlan", "*5"], ["bridge", "*1"], ["bridge_port", "*10"], ["ethernet", "*2"]]) assert.ok(plan.objects.some(object => object.kind === kind && object.id === id), `Missing protected management dependency ${kind}/${id}`)
|
||||
assert.ok(plan.steps.every(step => step.fields["vlan-filtering"] === undefined))
|
||||
value.desired.vlans[0].tagged = [access, trunk]
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value), /CPU management/)
|
||||
})
|
||||
test("unknown PVID/frame types/flags and duplicate source identities refuse preparation", () => {
|
||||
assert.throws(() => build(value => { delete value.state.ports[0].pvid }))
|
||||
assert.throws(() => build(value => { value.state.ports[0]["frame-types"] = "unknown" }))
|
||||
assert.throws(() => build(value => { value.state.bridges[0]["vlan-filtering"] = "unknown" }))
|
||||
assert.throws(() => build(value => { value.state.interfaces.push({ ...value.state.interfaces[0] }) }), /Повтор/)
|
||||
})
|
||||
test("unchanged full desired configuration has zero writes and omitted comments stay omitted", () => {
|
||||
const value = bridgeManagement()
|
||||
value.desired.ports.pop(); value.desired.vlans[0].tagged = []
|
||||
const plan = buildBridgeVlanConfiguration(value)
|
||||
assert.deepEqual(plan.steps, [])
|
||||
assert.equal(plan.inverse.desired.ports[0].comment, undefined)
|
||||
assert.equal(plan.inverse.desired.vlans[0].comment, undefined)
|
||||
})
|
||||
test("native projection to desired retains IDs and optional empty-field semantics", () => {
|
||||
const value = bridgeManagement(), desired = bridgeVlanCurrentDesired(value.state, value.bridgeId)
|
||||
assert.deepEqual(desired.vlans[0].tagged, [])
|
||||
assert.equal(desired.ports[0].id, "*10")
|
||||
assert.equal(desired.ports[0].comment, undefined)
|
||||
assert.deepEqual(buildBridgeVlanConfiguration({ ...value, desired }).steps, [])
|
||||
})
|
||||
test("unchanged native VID range syntax does not generate formatting-only mutations", () => {
|
||||
const value = fixture()
|
||||
value.state.ports[0]["frame-types"] = "admit-only-vlan-tagged"
|
||||
value.state.vlans = [{ ".id": "*11", bridge: "br-users", "vlan-ids": "20-30,40", tagged: "br-users,ether2", disabled: "false" }]
|
||||
const desired = bridgeVlanCurrentDesired(value.state, value.bridgeId)
|
||||
assert.deepEqual(buildBridgeVlanConfiguration({ ...value, desired }).steps, [])
|
||||
})
|
||||
test("dynamic PVID admission cannot conflict with an explicit tagged membership", () => {
|
||||
assert.throws(() => build(value => {
|
||||
value.desired.ports[1].frameTypes = "admit-all"; value.desired.ports[1].pvid = 10
|
||||
}), /PVID создаёт конфликт/)
|
||||
assert.throws(() => build(value => { value.desired.pvid = 10 }), /CPU PVID/)
|
||||
})
|
||||
test("unfiltered management ignores ingress flags: every existing L2 port is preserved", () => {
|
||||
const value = fixture()
|
||||
value.state.ipv4Addresses[0].interface = "br-users"
|
||||
value.state.bridges[0].pvid = "10"
|
||||
value.state.ports[0].pvid = "99"
|
||||
value.desired.pvid = 10
|
||||
value.desired.vlans[0].untagged = [cpu, access]; value.desired.vlans[0].tagged = [trunk]
|
||||
assert.ok(buildBridgeVlanConfiguration(value).steps.length > 0)
|
||||
value.desired.ports[0].frameTypes = "admit-only-vlan-tagged"
|
||||
value.desired.vlans[0].untagged = [cpu]; value.desired.vlans[0].tagged = [access, trunk]
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value), /CPU management/)
|
||||
})
|
||||
test("adding a management parent as a bridge port cannot be presented as independence", () => {
|
||||
assert.throws(() => build(value => {
|
||||
value.desired.ports.push({ interface: { resource: "ethernet", id: "*4" }, pvid: 10, ingressFiltering: true, frameTypes: "admit-all", disabled: false })
|
||||
value.desired.vlans[0].untagged.push({ resource: "ethernet", id: "*4" })
|
||||
}), /management интерфейс в slave/)
|
||||
})
|
||||
test("inverse explicitly clears a newly assigned previously absent comment", () => {
|
||||
const plan = build(value => { value.desired.ports[0].comment = "new comment" })
|
||||
assert.equal(plan.inverse.desired.ports[0].comment, "")
|
||||
})
|
||||
test("independent management address, bridge and actual port dependencies enter protection policy", () => {
|
||||
const value = fixture()
|
||||
value.state.bridges.push({ ".id": "*40", name: "br-mgmt", disabled: "false", pvid: "1", "vlan-filtering": "false" })
|
||||
value.state.interfaces.push({ resource: "bridge", id: "*40", name: "br-mgmt", disabled: "false" })
|
||||
value.state.ports.push({ ".id": "*41", bridge: "br-mgmt", interface: "ether-mgmt", pvid: "1", "frame-types": "admit-all", disabled: "false" })
|
||||
value.state.ipv4Addresses[0].interface = "br-mgmt"
|
||||
const plan = buildBridgeVlanConfiguration(value)
|
||||
for (const [kind, id] of [["ipv4_address", "*20"], ["bridge", "*40"], ["bridge_port", "*41"], ["ethernet", "*4"]]) assert.ok(plan.objects.some(object => object.kind === kind && object.id === id), `Missing protected management dependency ${kind}/${id}`)
|
||||
})
|
||||
test("reassigned old port and removed old VLAN members remain in protected references", () => {
|
||||
const value = fixture()
|
||||
value.desired.filtering = false
|
||||
value.state.vlans = [{ ".id": "*11", bridge: "br-users", "vlan-ids": "10", tagged: "ether2", disabled: "false" }]
|
||||
value.desired.ports = [{ ...value.desired.ports[0], interface: trunk }]
|
||||
value.desired.vlans = [{ id: "*11", vlanIds: "10", tagged: [trunk], untagged: [], disabled: false }]
|
||||
const plan = buildBridgeVlanConfiguration(value)
|
||||
assert.ok(plan.objects.some(object => object.kind === "ethernet" && object.id === access.id))
|
||||
assert.ok(plan.objects.some(object => object.kind === "ethernet" && object.id === trunk.id))
|
||||
})
|
||||
test("L3 GRE/WireGuard native bridge ports are rejected before any plan is emitted", () => {
|
||||
for (const resource of ["gre", "wireguard"]) {
|
||||
const value = fixture()
|
||||
value.state.interfaces.find(iface => iface.id === trunk.id)!.resource = resource
|
||||
value.desired.ports[1].interface.resource = resource
|
||||
value.desired.vlans[0].tagged[1].resource = resource
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value), error => error instanceof Error && "code" in error && error.code === "UNSUPPORTED_CAPABILITY")
|
||||
}
|
||||
})
|
||||
test("catalogued L2 VLAN and VXLAN ports remain available", () => {
|
||||
for (const resource of ["vlan", "vxlan"]) {
|
||||
const value = fixture()
|
||||
value.state.interfaces.find(iface => iface.id === trunk.id)!.resource = resource
|
||||
value.desired.ports[1].interface.resource = resource
|
||||
value.desired.vlans[0].tagged[1].resource = resource
|
||||
if (resource === "vlan") value.state.vlanInterfaces.push({ ".id": trunk.id, name: "ether3", interface: "ether-mgmt", "vlan-id": "101", disabled: "false" })
|
||||
assert.ok(buildBridgeVlanConfiguration(value).steps.some(step => step.resource === "bridge_port" && step.fields.interface === "ether3"))
|
||||
}
|
||||
})
|
||||
test("a VLAN over the selected bridge cannot be fed back into that bridge", () => {
|
||||
const value = fixture()
|
||||
value.state.interfaces.find(iface => iface.id === trunk.id)!.resource = "vlan"
|
||||
value.desired.ports[1].interface.resource = "vlan"; value.desired.vlans[0].tagged[1].resource = "vlan"
|
||||
value.state.vlanInterfaces.push({ ".id": trunk.id, name: "ether3", interface: "br-users", "vlan-id": "101", disabled: "false" })
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value), /собственные порты/)
|
||||
})
|
||||
test("explicit port replacement deletes old interface claim before native CREATE", () => {
|
||||
const value = fixture()
|
||||
delete value.desired.ports[0].id; value.desired.removePortIds = ["*10"]
|
||||
const plan = buildBridgeVlanConfiguration(value)
|
||||
const removal = plan.steps.findIndex(step => step.resource === "bridge_port" && step.action === "delete" && step.id === "*10")
|
||||
const addition = plan.steps.findIndex(step => step.resource === "bridge_port" && step.action === "create" && step.fields.interface === "ether2")
|
||||
assert.ok(removal >= 0 && addition > removal)
|
||||
const acks = plan.steps.flatMap((step, stepIndex) => step.action === "create" ? [{ stepIndex, id: `*${(stepIndex + 100).toString(16)}` }] : [])
|
||||
const inverse = bridgeVlanInverseDesired(plan, acks)
|
||||
assert.equal(inverse.ports[0].id, undefined)
|
||||
assert.ok(inverse.removePortIds.includes(acks.find(ack => ack.stepIndex === addition)!.id))
|
||||
})
|
||||
test("swapping existing claimed interfaces has no executable order and refuses before publication", () => {
|
||||
const value = fixture()
|
||||
value.state.ports.push({ ".id": "*12", bridge: "br-users", interface: "ether3", pvid: "1", "ingress-filtering": "true", "frame-types": "admit-only-vlan-tagged", disabled: "true" })
|
||||
value.desired.ports[1].id = "*12"
|
||||
value.desired.ports[0].interface = trunk; value.desired.ports[1].interface = access
|
||||
value.desired.filtering = false; value.desired.vlans = []
|
||||
const before = structuredClone(value)
|
||||
assert.throws(() => buildBridgeVlanConfiguration(value), /конфликта интерфейсов/)
|
||||
assert.deepEqual(value, before)
|
||||
})
|
||||
@@ -0,0 +1,338 @@
|
||||
import { isIP } from "node:net"
|
||||
import type { z } from "zod"
|
||||
import { bridgeVlanDesiredSchema, bridgeVlanRowIdSchema as id, bridgeVlanInterfaceReferenceSchema as reference, bridgeVlanIdSchema as vid, bridgeVlanFrameTypesSchema as frames, type BridgeVlanDesired, type BridgeVlanState } from "@mmapp/contracts/bridge-vlan"
|
||||
import type { ConfigurationRow, RosStep } from "../modules/mcp/resources.js"
|
||||
export { bridgeVlanDesiredSchema, type BridgeVlanDesired, type BridgeVlanState }
|
||||
export type BridgeVlanInterface = { resource: string; id: string; name: string; disabled?: unknown }
|
||||
/** This argument belongs to the trusted server adapter, never the public request.
|
||||
* The adapter verifies channel identity/revocation and decrypts its literal host.
|
||||
* These values and all source snapshots must be sealed and rechecked on apply. */
|
||||
export type BridgeVlanManagement = { channelId: string; serverId: number; expiresAt: string; host: string }
|
||||
export class BridgeVlanConfigurationError extends Error {
|
||||
constructor(readonly code: "INVALID_INPUT" | "STATE_CONFLICT" | "MANAGEMENT_UNSAFE" | "UNSUPPORTED_CAPABILITY", message: string) { super(message) }
|
||||
}
|
||||
/** L2 port kinds available in the actual typed configuration catalogue.
|
||||
* RouterOS also supports EoIP/bond/Wi-Fi, but they need their own indexed
|
||||
* configuration resource before this planner can prove their stable identity.
|
||||
* GRE and WireGuard carry L3 traffic and cannot be native bridge ports.
|
||||
* https://manual.mikrotik.com/docs/bridging-and-switching/
|
||||
* https://help.mikrotik.com/docs/spaces/ROS/pages/24805531/GRE
|
||||
* https://help.mikrotik.com/docs/spaces/ROS/pages/69664792/WireGuard */
|
||||
export const BRIDGE_VLAN_L2_PORT_RESOURCES = ["ethernet", "vlan", "vxlan"] as const
|
||||
function reject(message: string, code: BridgeVlanConfigurationError["code"] = "STATE_CONFLICT"): never { throw new BridgeVlanConfigurationError(code, message) }
|
||||
const text = (row: ConfigurationRow, key: string): string => typeof row[key] === "string" ? row[key] as string : reject(`Не подтверждено поле ${key}`)
|
||||
function flag(value: unknown): boolean {
|
||||
if ([true, "true", "yes"].includes(value as boolean | string)) return true
|
||||
if ([false, "false", "no"].includes(value as boolean | string)) return false
|
||||
return reject("Не подтверждено логическое свойство")
|
||||
}
|
||||
const mutable = (row: ConfigurationRow) => !["dynamic", "builtin", "default"].some(key => row[key] !== undefined && flag(row[key]))
|
||||
const enabled = (row: ConfigurationRow) => !flag(row.disabled)
|
||||
const rowId = (row: ConfigurationRow) => id.parse(row[".id"])
|
||||
const keyOf = (value: { resource: string; id: string }) => `${value.resource}:${value.id}`
|
||||
const unique = (values: string[], label: string) => { if (new Set(values).size !== values.length) reject(`Повтор ${label}`, "INVALID_INPUT") }
|
||||
|
||||
/** Ranges are inclusive. Reject overlaps rather than silently deduplicating. */
|
||||
export function parseBridgeVlanIds(value: string): number[] {
|
||||
const found = new Set<number>()
|
||||
for (const part of value.split(",")) {
|
||||
if (!/^[1-9]\d{0,3}(?:-[1-9]\d{0,3})?$/.test(part)) reject("Некорректный VLAN ID/диапазон", "INVALID_INPUT")
|
||||
const [start, rawEnd] = part.split("-").map(Number), end = rawEnd ?? start
|
||||
if (start < 1 || end > 4094 || end < start) reject("VLAN ID вне 1..4094", "INVALID_INPUT")
|
||||
for (let n = start; n <= end; n++) { if (found.has(n)) reject("Повтор VLAN ID", "INVALID_INPUT"); found.add(n) }
|
||||
}
|
||||
return [...found].sort((a, b) => a - b)
|
||||
}
|
||||
const names = (row: ConfigurationRow, field: string): string[] => {
|
||||
if (row[field] === undefined && ["tagged", "untagged"].includes(field)) return []
|
||||
const value = text(row, field)
|
||||
if (!value) return []
|
||||
const result = value.split(",")
|
||||
if (result.some(name => !name || name.trim() !== name)) reject("Неоднозначный список интерфейсов")
|
||||
unique(result, "интерфейса")
|
||||
return result
|
||||
}
|
||||
const numberVid = (value: unknown) => vid.parse(typeof value === "string" && /^\d+$/.test(value) ? Number(value) : value)
|
||||
type Topology = { bridge: ConfigurationRow; ports: ConfigurationRow[]; vlans: ConfigurationRow[] }
|
||||
type Admission = { interface: string; mode: "tagged" | "untagged" }
|
||||
export type BridgeVlanConfigurationPlan = {
|
||||
serverId: number; bridgeId: string; steps: RosStep[];
|
||||
objects: Array<{ kind: string; id: string; serverId: number }>;
|
||||
managementPath: { channelId: string; addressId: string; interfaceName: string; bridgeName?: string; vlanId?: number };
|
||||
inverse: { desired: BridgeVlanDesired; created: Array<{ stepIndex: number; resource: "bridge_port" | "bridge_vlan" }> };
|
||||
}
|
||||
|
||||
/** Convert observed static rows without replacing unknown native properties
|
||||
* with assumed defaults. Used by the editor and generic effective PATCH guard. */
|
||||
export function bridgeVlanCurrentDesired(state: BridgeVlanState, bridgeId: string): BridgeVlanDesired {
|
||||
const bridges = state.bridges.filter(row => row[".id"] === bridgeId)
|
||||
if (bridges.length !== 1) reject("Bridge не найден однозначно")
|
||||
const bridge = bridges[0], bridgeName = text(bridge, "name")
|
||||
const refFor = (name: string) => {
|
||||
const found = state.interfaces.filter(value => value.name === name)
|
||||
if (found.length !== 1) reject("Не подтверждена идентичность интерфейса")
|
||||
return { resource: found[0].resource, id: id.parse(found[0].id) }
|
||||
}
|
||||
return {
|
||||
filtering: flag(bridge["vlan-filtering"]), pvid: numberVid(bridge.pvid), frameTypes: frames.parse(bridge["frame-types"]), ingressFiltering: flag(bridge["ingress-filtering"]),
|
||||
ports: state.ports.filter(row => row.bridge === bridgeName && mutable(row)).map(row => ({ id: rowId(row), interface: refFor(text(row, "interface")), pvid: numberVid(row.pvid), ingressFiltering: flag(row["ingress-filtering"]), frameTypes: frames.parse(row["frame-types"]), disabled: flag(row.disabled), ...(row.comment === undefined ? {} : { comment: text(row, "comment") }) })),
|
||||
vlans: state.vlans.filter(row => row.bridge === bridgeName && mutable(row)).map(row => ({ id: rowId(row), vlanIds: text(row, "vlan-ids"), tagged: names(row, "tagged").map(refFor), untagged: names(row, "untagged").map(refFor), disabled: flag(row.disabled), ...(row.comment === undefined ? {} : { comment: text(row, "comment") }) })),
|
||||
removePortIds: [], removeVlanIds: [],
|
||||
}
|
||||
}
|
||||
|
||||
export function buildBridgeVlanConfiguration(input: {
|
||||
serverId: number; bridgeId: string; desired: BridgeVlanDesired; state: BridgeVlanState; management: BridgeVlanManagement; now: number;
|
||||
}): BridgeVlanConfigurationPlan {
|
||||
const { serverId, bridgeId, state, management } = input, desired = bridgeVlanDesiredSchema.parse(input.desired)
|
||||
if (!Number.isSafeInteger(serverId) || serverId <= 0 || management.serverId !== serverId || !management.channelId || !Number.isFinite(input.now) || !(Date.parse(management.expiresAt) > input.now) || !isIP(management.host)) reject("Нет актуального канала управления", "MANAGEMENT_UNSAFE")
|
||||
const bridges = state.bridges.filter(row => row[".id"] === bridgeId)
|
||||
if (bridges.length !== 1 || !mutable(bridges[0]) || !enabled(bridges[0])) reject("Bridge не подтверждён или отключён")
|
||||
const bridge = bridges[0], bridgeName = text(bridge, "name")
|
||||
// A dynamic VLAN table is not evidence of caller-owned rows. PVID-generated
|
||||
// untagged membership is derived below; protocol registrations are unsupported.
|
||||
if (bridge.mvrp !== undefined && flag(bridge.mvrp)) reject("MVRP создаёт программируемые VLAN memberships; этот режим не поддерживается", "UNSUPPORTED_CAPABILITY")
|
||||
const cpuFrames = frames.parse(bridge["frame-types"]), cpuIngress = flag(bridge["ingress-filtering"])
|
||||
const byRef = new Map(state.interfaces.map(iface => [keyOf(iface), iface]))
|
||||
unique(state.interfaces.map(keyOf), "идентичности интерфейса")
|
||||
unique(state.interfaces.map(iface => iface.name), "имени интерфейса")
|
||||
const bridgeRef = state.interfaces.find(iface => iface.resource === "bridge" && iface.id === bridgeId && iface.name === bridgeName)
|
||||
if (!bridgeRef) reject("Не подтверждена идентичность CPU bridge")
|
||||
const resolve = (ref: z.infer<typeof reference>) => byRef.get(keyOf(ref)) ?? reject("Неизвестный стабильный ID интерфейса", "INVALID_INPUT")
|
||||
const oldPorts = state.ports.filter(row => row.bridge === bridgeName), oldVlans = state.vlans.filter(row => row.bridge === bridgeName)
|
||||
unique(state.ports.map(rowId), "ID порта"); unique(state.vlans.map(rowId), "ID membership")
|
||||
// Dynamic rows remain owned by RouterOS; they are never converted to commands.
|
||||
const staticPorts = oldPorts.filter(mutable), staticVlans = oldVlans.filter(mutable)
|
||||
const account = (rows: ConfigurationRow[], keep: Array<{ id?: string }>, remove: string[], label: string) => {
|
||||
const requested = [...keep.flatMap(row => row.id ? [row.id] : []), ...remove]
|
||||
unique(requested, label)
|
||||
const existing = rows.map(rowId)
|
||||
if (requested.length !== existing.length || requested.some(value => !existing.includes(value))) reject(`Нужен явный полный список ${label}`, "INVALID_INPUT")
|
||||
}
|
||||
account(staticPorts, desired.ports, desired.removePortIds, "портов")
|
||||
account(staticVlans, desired.vlans, desired.removeVlanIds, "VLAN memberships")
|
||||
unique(desired.ports.map(port => keyOf(port.interface)), "порта bridge")
|
||||
const portRows = desired.ports.map((port, index) => {
|
||||
const iface = resolve(port.interface)
|
||||
if (iface.name === bridgeName || iface.resource === "bridge" || state.ports.some(row => row.interface === iface.name && row.bridge !== bridgeName)) reject("Интерфейс уже принадлежит другому bridge или является bridge", "INVALID_INPUT")
|
||||
if (!(BRIDGE_VLAN_L2_PORT_RESOURCES as readonly string[]).includes(iface.resource)) reject("Тип интерфейса не поддерживает подтверждённый L2 bridge port", "UNSUPPORTED_CAPABILITY")
|
||||
let parent = iface.name
|
||||
const ancestors = new Set<string>()
|
||||
while (true) {
|
||||
if (ancestors.has(parent)) reject("Цикл VLAN родителей bridge-порта", "INVALID_INPUT")
|
||||
ancestors.add(parent)
|
||||
const vlans = state.vlanInterfaces.filter(row => row.name === parent)
|
||||
if (!vlans.length) {
|
||||
if (parent === iface.name && iface.resource === "vlan") reject("Не подтверждён VLAN parent bridge-порта", "UNSUPPORTED_CAPABILITY")
|
||||
break
|
||||
}
|
||||
if (vlans.length !== 1) reject("Неоднозначный VLAN parent bridge-порта", "STATE_CONFLICT")
|
||||
parent = text(vlans[0], "interface")
|
||||
if (parent === bridgeName) reject("VLAN над выбранным bridge нельзя вернуть в его собственные порты", "INVALID_INPUT")
|
||||
}
|
||||
if (!port.disabled && iface.disabled !== undefined && flag(iface.disabled)) reject("Порт ссылается на отключённый интерфейс", "INVALID_INPUT")
|
||||
const previous = staticPorts.find(row => row[".id"] === port.id)
|
||||
return { ".id": port.id ?? `new-port-${index}`, bridge: bridgeName, interface: iface.name, pvid: String(port.pvid), "ingress-filtering": String(port.ingressFiltering), "frame-types": port.frameTypes, disabled: String(port.disabled), ...(port.comment !== undefined ? { comment: port.comment } : previous?.comment !== undefined ? { comment: text(previous, "comment") } : {}) }
|
||||
})
|
||||
const vlanRows = desired.vlans.map((vlan, index) => {
|
||||
const tagged = vlan.tagged.map(ref => resolve(ref).name), untagged = vlan.untagged.map(ref => resolve(ref).name)
|
||||
unique([...tagged, ...untagged], "tagged/untagged участника")
|
||||
parseBridgeVlanIds(vlan.vlanIds)
|
||||
const previous = staticVlans.find(row => row[".id"] === vlan.id)
|
||||
return { ".id": vlan.id ?? `new-vlan-${index}`, bridge: bridgeName, "vlan-ids": vlan.vlanIds, ...(tagged.length || previous?.tagged !== undefined ? { tagged: tagged.join(",") } : {}), ...(untagged.length || previous?.untagged !== undefined ? { untagged: untagged.join(",") } : {}), disabled: String(vlan.disabled), ...(vlan.comment !== undefined ? { comment: vlan.comment } : previous?.comment !== undefined ? { comment: text(previous, "comment") } : {}) }
|
||||
})
|
||||
const target: Topology = { bridge: { ...bridge, pvid: String(desired.pvid), "vlan-filtering": String(desired.filtering), "frame-types": desired.frameTypes ?? cpuFrames, "ingress-filtering": String(desired.ingressFiltering ?? cpuIngress) }, ports: [...oldPorts.filter(row => !mutable(row)), ...portRows], vlans: [...oldVlans.filter(row => !mutable(row)), ...vlanRows] }
|
||||
const activePorts = (topology: Topology) => topology.ports.filter(enabled)
|
||||
const membership = (topology: Topology, vlanId: number, mode: "tagged" | "untagged") => {
|
||||
const members = new Set(topology.vlans.filter(row => mutable(row) && enabled(row) && parseBridgeVlanIds(text(row, "vlan-ids")).includes(vlanId)).flatMap(row => names(row, mode)))
|
||||
// RouterOS automatically includes CPU/ports that accept untagged ingress
|
||||
// as untagged PVID members. Never synthesize a VLAN table command for it.
|
||||
if (mode === "untagged") for (const port of [topology.bridge, ...activePorts(topology)]) {
|
||||
if (enabled(port) && frames.parse(port["frame-types"]) !== "admit-only-vlan-tagged" && numberVid(port.pvid) === vlanId) members.add(port === topology.bridge ? bridgeName : text(port, "interface"))
|
||||
}
|
||||
return members
|
||||
}
|
||||
// Validate effective static state; dynamic PVID membership is derived from
|
||||
// the actual port PVID, never accepted as caller-owned VLAN configuration.
|
||||
const validate = (topology: Topology) => {
|
||||
const ports = activePorts(topology), allowed = new Set([bridgeName, ...topology.ports.map(row => text(row, "interface"))])
|
||||
const used = new Set<string>(), configuredVids = new Set<number>()
|
||||
for (const vlan of topology.vlans.filter(row => mutable(row) && enabled(row))) {
|
||||
const vids = parseBridgeVlanIds(text(vlan, "vlan-ids")), tagged = names(vlan, "tagged"), untagged = names(vlan, "untagged")
|
||||
unique([...tagged, ...untagged], "tagged/untagged участника")
|
||||
if ([...tagged, ...untagged].some(name => !allowed.has(name))) reject("Участник VLAN не принадлежит выбранному bridge", "INVALID_INPUT")
|
||||
for (const n of vids) { if (configuredVids.has(n)) reject("Неоднозначная эффективная VLAN membership", "INVALID_INPUT"); configuredVids.add(n) }
|
||||
for (const n of vids) for (const name of [...tagged, ...untagged]) {
|
||||
const key = `${n}:${name}`
|
||||
if (used.has(key)) reject("Неоднозначная эффективная VLAN membership", "INVALID_INPUT")
|
||||
used.add(key)
|
||||
const pvid = name === bridgeName ? numberVid(topology.bridge.pvid) : numberVid(topology.ports.find(row => row.interface === name)!.pvid)
|
||||
if (untagged.includes(name) && (vids.length !== 1 || pvid !== n)) reject("Untagged VLAN не соответствует PVID", "INVALID_INPUT")
|
||||
}
|
||||
}
|
||||
if (flag(topology.bridge["vlan-filtering"])) for (const port of ports) {
|
||||
const frameTypes = frames.parse(port["frame-types"])
|
||||
if (frameTypes !== "admit-only-vlan-tagged" && membership(topology, numberVid(port.pvid), "tagged").has(text(port, "interface"))) reject("PVID создаёт конфликт tagged/untagged membership", "INVALID_INPUT")
|
||||
}
|
||||
if (flag(topology.bridge["vlan-filtering"]) && frames.parse(topology.bridge["frame-types"]) !== "admit-only-vlan-tagged" && membership(topology, numberVid(topology.bridge.pvid), "tagged").has(bridgeName)) reject("CPU PVID создаёт конфликт tagged/untagged membership", "INVALID_INPUT")
|
||||
}
|
||||
validate(target)
|
||||
const addresses = [...state.ipv4Addresses, ...state.ipv6Addresses].filter(row => typeof row.address === "string" && isIP(row.address.split("/")[0]) === isIP(management.host) && sameAddress(row.address.split("/")[0], management.host) && enabled(row))
|
||||
if (addresses.length !== 1) reject("Адрес канала не найден однозначно в конфигурации", "MANAGEMENT_UNSAFE")
|
||||
const address = addresses[0], addressInterface = text(address, "interface")
|
||||
let managementInterface = addressInterface, managementVid: number | undefined
|
||||
const visited = new Set<string>()
|
||||
while (true) {
|
||||
if (visited.has(managementInterface)) reject("Цикл родителей management", "MANAGEMENT_UNSAFE")
|
||||
visited.add(managementInterface)
|
||||
const candidates = state.vlanInterfaces.filter(row => row.name === managementInterface)
|
||||
if (!candidates.length) break
|
||||
if (candidates.length !== 1 || !enabled(candidates[0]) || managementVid !== undefined) reject("Не подтверждён management VLAN parent", "MANAGEMENT_UNSAFE")
|
||||
managementVid = numberVid(candidates[0]["vlan-id"]); managementInterface = text(candidates[0], "interface")
|
||||
}
|
||||
const managementPort = state.ports.find(row => row.interface === managementInterface)
|
||||
const affected = managementInterface === bridgeName || managementPort?.bridge === bridgeName
|
||||
// An IP directly assigned to a bridge slave does not prove CPU delivery.
|
||||
if (managementPort?.bridge === bridgeName) reject("Management IP на slave-порту не доказывает CPU-доступ", "MANAGEMENT_UNSAFE")
|
||||
if (target.ports.some(row => row.interface === managementInterface)) reject("План превращает management интерфейс в slave-порт", "MANAGEMENT_UNSAFE")
|
||||
const managementBase = state.interfaces.find(iface => iface.name === managementInterface)
|
||||
if (!managementBase || !["ethernet", "bridge"].includes(managementBase.resource)) reject("Не подтверждён физический management parent", "MANAGEMENT_UNSAFE")
|
||||
if (managementPort) reject("Management IP на slave-порту не доказывает CPU-доступ", "MANAGEMENT_UNSAFE")
|
||||
// A different bridge is independent only if none of its actual member
|
||||
// interfaces depends on this bridge (for example a VLAN over this bridge).
|
||||
const dependentOnTarget = (name: string, visiting = new Set<string>()): boolean => {
|
||||
if (name === bridgeName || target.ports.some(row => row.interface === name)) return true
|
||||
if (visiting.has(name)) reject("Цикл management зависимостей", "MANAGEMENT_UNSAFE")
|
||||
const next = new Set(visiting).add(name)
|
||||
const vlan = state.vlanInterfaces.find(row => row.name === name)
|
||||
if (vlan) return dependentOnTarget(text(vlan, "interface"), next)
|
||||
const iface = state.interfaces.find(item => item.name === name)
|
||||
if (!iface || !["ethernet", "bridge"].includes(iface.resource)) reject("Не подтверждены management зависимости", "MANAGEMENT_UNSAFE")
|
||||
return iface.resource === "bridge" && state.ports.filter(row => row.bridge === name && enabled(row)).some(row => dependentOnTarget(text(row, "interface"), next))
|
||||
}
|
||||
if (!affected && dependentOnTarget(managementInterface)) reject("Management зависит от изменяемого bridge", "MANAGEMENT_UNSAFE")
|
||||
if (!state.interfaces.some(iface => iface.name === managementInterface && (iface.disabled === undefined || !flag(iface.disabled)))) reject("Не подтверждён management интерфейс", "MANAGEMENT_UNSAFE")
|
||||
const admissions = (topology: Topology): Admission[] => {
|
||||
if (!affected) return []
|
||||
const filtering = flag(topology.bridge["vlan-filtering"]), vlanId = managementVid ?? numberVid(topology.bridge.pvid)
|
||||
if (!filtering) return activePorts(topology).map(port => ({ interface: text(port, "interface"), mode: managementVid === undefined ? "untagged" as const : "tagged" as const }))
|
||||
const cpuMode = managementVid === undefined ? "untagged" : "tagged"
|
||||
const cpuFrameTypes = frames.parse(topology.bridge["frame-types"])
|
||||
if (cpuMode === "untagged" && cpuFrameTypes === "admit-only-vlan-tagged" || cpuMode === "tagged" && cpuFrameTypes === "admit-only-untagged-and-priority-tagged") return []
|
||||
if (filtering && !membership(topology, vlanId, cpuMode).has(bridgeName)) return []
|
||||
if (membership(topology, vlanId, "tagged").has(bridgeName) && membership(topology, vlanId, "untagged").has(bridgeName)) return []
|
||||
return activePorts(topology).flatMap(port => {
|
||||
const name = text(port, "interface"), frameTypes = frames.parse(port["frame-types"]), result: Admission[] = []
|
||||
if (membership(topology, vlanId, "tagged").has(name) && membership(topology, vlanId, "untagged").has(name)) return []
|
||||
if (frameTypes !== "admit-only-untagged-and-priority-tagged" && membership(topology, vlanId, "tagged").has(name)) result.push({ interface: name, mode: "tagged" })
|
||||
if (frameTypes !== "admit-only-vlan-tagged" && numberVid(port.pvid) === vlanId && (!filtering || membership(topology, vlanId, "untagged").has(name))) result.push({ interface: name, mode: "untagged" })
|
||||
return result
|
||||
})
|
||||
}
|
||||
let current: Topology = structuredClone({ bridge, ports: oldPorts, vlans: oldVlans })
|
||||
const baseline = admissions(current)
|
||||
if (affected && !baseline.length) reject("Не подтверждён исходный CPU management-доступ", "MANAGEMENT_UNSAFE")
|
||||
const preservesManagement = (topology: Topology) => !affected || baseline.every(old => admissions(topology).some(next => old.interface === next.interface && old.mode === next.mode))
|
||||
if (!preservesManagement(target)) reject("План изменяет подтверждённые пути CPU management", "MANAGEMENT_UNSAFE")
|
||||
const inverseDesired = bridgeVlanCurrentDesired(state, bridgeId)
|
||||
for (const port of inverseDesired.ports) {
|
||||
if (desired.removePortIds.includes(port.id!)) delete port.id
|
||||
else if (port.comment === undefined && desired.ports.some(next => next.id === port.id && next.comment !== undefined)) port.comment = ""
|
||||
}
|
||||
for (const vlan of inverseDesired.vlans) {
|
||||
if (desired.removeVlanIds.includes(vlan.id!)) delete vlan.id
|
||||
else if (vlan.comment === undefined && desired.vlans.some(next => next.id === vlan.id && next.comment !== undefined)) vlan.comment = ""
|
||||
}
|
||||
const steps: RosStep[] = [], created: BridgeVlanConfigurationPlan["inverse"]["created"] = []
|
||||
const append = (step: RosStep) => { if (step.action === "create") created.push({ stepIndex: steps.length, resource: step.resource as "bridge_port" | "bridge_vlan" }); steps.push(step) }
|
||||
const mutation = (resource: "bridge_port" | "bridge_vlan", old: ConfigurationRow[], next: ConfigurationRow[], deleted: string[]) => {
|
||||
const result: Array<{ step: RosStep; modelId: string }> = []
|
||||
for (const row of next) {
|
||||
const nativeId = String(row[".id"]), previous = old.find(value => value[".id"] === nativeId)
|
||||
const fields = Object.fromEntries(Object.entries(row).filter(([key, value]) => key !== ".id" && (!previous || String(previous[key]) !== value)).map(([key, value]) => [key, String(value)]))
|
||||
if (Object.keys(fields).length) result.push({ step: { serverId, resource, action: previous ? "update" : "create", ...(previous ? { id: nativeId } : {}), fields }, modelId: nativeId })
|
||||
}
|
||||
for (const nativeId of deleted) result.push({ step: { serverId, resource, action: "delete", id: nativeId, fields: {} }, modelId: nativeId })
|
||||
return result
|
||||
}
|
||||
const pending = [...mutation("bridge_vlan", staticVlans, vlanRows, desired.removeVlanIds), ...mutation("bridge_port", staticPorts, portRows, desired.removePortIds)]
|
||||
// Independent management permits a disabled intermediate topology. A channel
|
||||
// on this bridge instead requires every acknowledged prefix to preserve it.
|
||||
if (flag(bridge["vlan-filtering"]) && (!desired.filtering || pending.length > 0) && !affected) {
|
||||
append({ serverId, resource: "bridge", action: "update", id: bridgeId, fields: { "vlan-filtering": "false" } }); current.bridge["vlan-filtering"] = "false"
|
||||
}
|
||||
while (pending.length) {
|
||||
let selected = -1, next: Topology | undefined
|
||||
for (let index = 0; index < pending.length; index++) {
|
||||
const item = pending[index], candidate = structuredClone(current), field = item.step.resource === "bridge_port" ? "ports" : "vlans"
|
||||
if (item.step.action === "delete") candidate[field] = candidate[field].filter(row => row[".id"] !== item.modelId)
|
||||
else if (item.step.action === "create") candidate[field].push({ ".id": item.modelId, ...item.step.fields })
|
||||
else candidate[field] = candidate[field].map(row => row[".id"] === item.modelId ? { ...row, ...item.step.fields } : row)
|
||||
// RouterOS permits only one bridge-port row per interface, including
|
||||
// disabled rows. Explicit replacement must DELETE before CREATE, and
|
||||
// swaps requiring an invented temporary interface are not admitted.
|
||||
const claimed = candidate.ports.map(row => text(row, "interface"))
|
||||
if (new Set(claimed).size !== claimed.length) continue
|
||||
if (preservesManagement(candidate)) { selected = index; next = candidate; break }
|
||||
}
|
||||
if (selected < 0 || !next) reject("Не существует порядка без конфликта интерфейсов или потери management", "STATE_CONFLICT")
|
||||
append(pending.splice(selected, 1)[0].step); current = next
|
||||
}
|
||||
const finalFields: Record<string, string> = {}
|
||||
if (numberVid(current.bridge.pvid) !== desired.pvid) finalFields.pvid = String(desired.pvid)
|
||||
if (desired.frameTypes !== undefined && frames.parse(current.bridge["frame-types"]) !== desired.frameTypes) finalFields["frame-types"] = desired.frameTypes
|
||||
if (desired.ingressFiltering !== undefined && flag(current.bridge["ingress-filtering"]) !== desired.ingressFiltering) finalFields["ingress-filtering"] = String(desired.ingressFiltering)
|
||||
if (flag(current.bridge["vlan-filtering"]) !== desired.filtering) finalFields["vlan-filtering"] = String(desired.filtering)
|
||||
if (Object.keys(finalFields).length) {
|
||||
if (!preservesManagement({ ...current, bridge: { ...current.bridge, ...finalFields } })) reject("Финальное переключение теряет management", "MANAGEMENT_UNSAFE")
|
||||
append({ serverId, resource: "bridge", action: "update", id: bridgeId, fields: finalFields })
|
||||
}
|
||||
const objectMap = new Map<string, { kind: string; id: string; serverId: number }>()
|
||||
for (const [kind, rows] of [["bridge", [bridge]], ["bridge_port", oldPorts], ["bridge_vlan", oldVlans]] as const) for (const row of rows) objectMap.set(`${kind}:${rowId(row)}`, { kind, id: rowId(row), serverId })
|
||||
for (const ref of [...desired.ports.map(port => port.interface), ...desired.vlans.flatMap(vlan => [...vlan.tagged, ...vlan.untagged])]) objectMap.set(keyOf(ref), { kind: ref.resource, id: ref.id, serverId })
|
||||
const oldMemberNames = new Set([...oldPorts.map(row => text(row, "interface")), ...oldVlans.flatMap(row => [...names(row, "tagged"), ...names(row, "untagged")])])
|
||||
for (const name of oldMemberNames) {
|
||||
const iface = state.interfaces.find(value => value.name === name) ?? reject("Не подтверждена прежняя зависимость bridge")
|
||||
objectMap.set(keyOf(iface), { kind: iface.resource, id: iface.id, serverId })
|
||||
}
|
||||
const addressResource = state.ipv4Addresses.includes(address) ? "ipv4_address" : "ipv6_address"
|
||||
objectMap.set(`${addressResource}:${rowId(address)}`, { kind: addressResource, id: rowId(address), serverId })
|
||||
const managementVisited = new Set<string>()
|
||||
const includeManagement = (name: string) => {
|
||||
if (managementVisited.has(name)) return
|
||||
managementVisited.add(name)
|
||||
const iface = state.interfaces.find(value => value.name === name) ?? reject("Не подтверждена идентичность management dependency")
|
||||
objectMap.set(keyOf(iface), { kind: iface.resource, id: iface.id, serverId })
|
||||
const vlan = state.vlanInterfaces.find(row => row.name === name)
|
||||
if (vlan) includeManagement(text(vlan, "interface"))
|
||||
if (iface.resource === "bridge") for (const port of state.ports.filter(row => row.bridge === name && enabled(row))) {
|
||||
objectMap.set(`bridge_port:${rowId(port)}`, { kind: "bridge_port", id: rowId(port), serverId })
|
||||
includeManagement(text(port, "interface"))
|
||||
}
|
||||
}
|
||||
includeManagement(addressInterface)
|
||||
return { serverId, bridgeId, steps, objects: [...objectMap.values()], managementPath: { channelId: management.channelId, addressId: rowId(address), interfaceName: addressInterface, ...(affected ? { bridgeName, ...(managementVid === undefined ? {} : { vlanId: managementVid }) } : {}) }, inverse: { desired: inverseDesired, created } }
|
||||
}
|
||||
|
||||
function sameAddress(left: string, right: string): boolean {
|
||||
if (isIP(left) === 4) return left === right
|
||||
// WHATWG URL canonicalizes equivalent compressed IPv6 spellings.
|
||||
try { return new URL(`http://[${left}]/`).hostname === new URL(`http://[${right}]/`).hostname } catch { return false }
|
||||
}
|
||||
|
||||
/** ACKs must come from successful executor read-back, never from user JSON.
|
||||
* Re-prepare this desired state against fresh snapshots and obtain approval;
|
||||
* this function grants no automatic compensation or replay authority. */
|
||||
export function bridgeVlanInverseDesired(plan: BridgeVlanConfigurationPlan, createAcks: Array<{ stepIndex: number; id: string }>): BridgeVlanDesired {
|
||||
unique(createAcks.map(ack => String(ack.stepIndex)), "create ACK")
|
||||
if (createAcks.length !== plan.inverse.created.length) reject("Нет точных ACK всех созданных объектов")
|
||||
const desired = structuredClone(plan.inverse.desired)
|
||||
for (const created of plan.inverse.created) {
|
||||
const ack = createAcks.find(value => value.stepIndex === created.stepIndex)
|
||||
if (!ack) reject("Нет create ACK")
|
||||
const nativeId = id.parse(ack.id)
|
||||
if (created.resource === "bridge_port") desired.removePortIds.push(nativeId)
|
||||
else desired.removeVlanIds.push(nativeId)
|
||||
}
|
||||
return desired
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
/** RouterOS VLAN IDs and membership are sets, not row-order-sensitive strings.
|
||||
* Never apply this normalization to interface names or arbitrary properties. */
|
||||
export function canonicalBridgeVlanValue(field: string, value: unknown): unknown {
|
||||
if (["tagged", "untagged"].includes(field)) {
|
||||
if (value === undefined || value === "") return ""
|
||||
if (typeof value !== "string") throw Error("Invalid VLAN members")
|
||||
const names = value.split(",")
|
||||
if (names.some(name => !name || name.trim() !== name) || new Set(names).size !== names.length) throw Error("Ambiguous VLAN members")
|
||||
return names.sort().join(",")
|
||||
}
|
||||
if (field !== "vlan-ids") return value
|
||||
if (typeof value !== "string" || !value.length) throw Error("Invalid VLAN IDs")
|
||||
const ids = new Set<number>()
|
||||
for (const part of value.split(",")) {
|
||||
if (!/^[1-9]\d{0,3}(?:-[1-9]\d{0,3})?$/.test(part)) throw Error("Invalid VLAN IDs")
|
||||
const [start, rawEnd] = part.split("-").map(Number), end = rawEnd ?? start
|
||||
if (start < 1 || end > 4094 || end < start) throw Error("Invalid VLAN IDs")
|
||||
for (let id = start; id <= end; id++) {
|
||||
if (ids.has(id)) throw Error("Overlapping VLAN IDs")
|
||||
ids.add(id)
|
||||
}
|
||||
}
|
||||
const sorted = [...ids].sort((a, b) => a - b), ranges: string[] = []
|
||||
for (let index = 0; index < sorted.length;) {
|
||||
const start = sorted[index]
|
||||
let end = start
|
||||
while (++index < sorted.length && sorted[index] === end + 1) end = sorted[index]
|
||||
ranges.push(start === end ? String(start) : `${start}-${end}`)
|
||||
}
|
||||
return ranges.join(",")
|
||||
}
|
||||
@@ -236,7 +236,7 @@ export async function fetchIpsecState(server: ServerRow, reader?: MikrotikClient
|
||||
* 2) PSK-identity.
|
||||
* Общая listener-identity (без remote-certificate) клиентом не считается — она обслуживает всех.
|
||||
*/
|
||||
export function mapClients(state: IpsecServerState): IpsecClientDto[] {
|
||||
export function mapClients(state: Pick<IpsecServerState, "server" | "peers" | "identities" | "certs" | "modeConfigs" | "active">): IpsecClientDto[] {
|
||||
const server = state.server
|
||||
const ike2Peers = selectIke2Peers(state.peers)
|
||||
const ike2PeerNames = ike2Peers.map((p) => (p.name ?? "").trim()).filter(Boolean)
|
||||
@@ -414,6 +414,13 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
|
||||
return out.sort((a, b) => a.name.localeCompare(b.name))
|
||||
}
|
||||
|
||||
/** Binding selectors reuse the existing client eligibility/name/CN rules,
|
||||
* including PSK and shared-listener exclusion. No online/static-IP observation
|
||||
* is claimed: this projection returns keys only from the three native menus. */
|
||||
export function ipsecClientBindingKeys(state: Pick<IpsecServerState, "server" | "peers" | "identities" | "certs">): string[] {
|
||||
return mapClients({ ...state, modeConfigs: [], active: [] }).map(client => client.commonName ?? client.name)
|
||||
}
|
||||
|
||||
/** Explicit namespaces prevent cross-menu RouterOS ID collisions. Legacy ambiguous IDs fail closed. */
|
||||
export function resolveIpsecClientTarget(state: IpsecServerState, token: string) {
|
||||
const kind = token.startsWith("cert:") ? "cert" : token.startsWith("identity:") ? "identity" : undefined
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { fetchIpsecState, getEnabledIpsecServerById, listIpsec, mapClients, mapServerSummary, resolveIpsecClientTarget } from "./ipsec-live.js"
|
||||
import { fetchIpsecState, getEnabledIpsecServerById, listIpsec, mapClients, mapServerSummary, resolveIpsecClientTarget, ipsecClientBindingKeys } from "./ipsec-live.js"
|
||||
import { removeManagedIpsecServer } from "./ipsec-cleanup.js"
|
||||
import { deleteUserModeConfig, ensureIpsecPeer, identityRosBody, putOrPatchByName } from "./ipsec-ros.js"
|
||||
import { ipsecManagedComment, isIpsecManagedComment } from "./ipsec-config.js"
|
||||
@@ -244,4 +244,7 @@ assert.equal(mapClients(sanState)[0]?.online,false); checks++
|
||||
sanState.certs.pop()
|
||||
sanState.identities=[]
|
||||
assert.equal(mapClients(sanState)[0]?.online,false); checks++
|
||||
assert.deepEqual(ipsecClientBindingKeys(state), mapClients(state).map(client => client.commonName ?? client.name)); checks++
|
||||
assert(ipsecClientBindingKeys(state).includes("PSK"), "Managed PSK selector survives the keys-only projection"); checks++
|
||||
assert.deepEqual(ipsecClientBindingKeys(sessionState), mapClients(sessionState).map(client => client.commonName ?? client.name)); checks++
|
||||
console.log(`ipsec-state: ${checks} checks passed`)
|
||||
@@ -14,6 +14,10 @@ assert.equal(parseRecursiveCatalog([{...row,disabled:"true"}])[0].disabled,true)
|
||||
const gateway=(id:string,active?:string)=>({".id":id,gateway:"192.0.2.1%ether1",active})
|
||||
assert.equal(parseRecursiveGatewayCatalog([gateway("a")])[0].status,"unknown")
|
||||
assert.equal(parseRecursiveGatewayCatalog([gateway("a","false")])[0].status,"inactive")
|
||||
assert.equal(parseRecursiveGatewayCatalog([{...gateway("a"),inactive:"true"}])[0].status,"inactive")
|
||||
assert.equal(parseRecursiveGatewayCatalog([{...gateway("a"),inactive:true}])[0].status,"inactive")
|
||||
assert.equal(parseRecursiveGatewayCatalog([{...gateway("a"),inactive:"false"}])[0].status,"unknown")
|
||||
assert.equal(parseRecursiveGatewayCatalog([{...gateway("a","true"),inactive:"true"}])[0].status,"unknown")
|
||||
assert.equal(parseRecursiveGatewayCatalog([gateway("a","false"),gateway("b")])[0].status,"unknown")
|
||||
assert.equal(parseRecursiveGatewayCatalog([gateway("a"),gateway("b","true")])[0].status,"active")
|
||||
assert.deepEqual(parseRecursiveGatewayCatalog([{".id":"a",gateway:"999.0.0.1"}]),[])
|
||||
|
||||
@@ -75,8 +75,12 @@ export function parseRecursiveGatewayCatalog(payload: unknown): RecursiveGateway
|
||||
if (typeof row.gateway !== "string") continue
|
||||
const [ip, name = ip] = row.gateway.trim().split("%")
|
||||
if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(ip) || ip.split(".").some(part => Number(part) > 255) || !name) continue
|
||||
const id = ip + "%" + name, active = observedBoolean(rosText(row.active))
|
||||
const status = active === true ? "active" : active === false ? "inactive" : "unknown"
|
||||
const id = ip + "%" + name
|
||||
const active = typeof row.active === "boolean" ? row.active : observedBoolean(rosText(row.active))
|
||||
const inactive = typeof row.inactive === "boolean" ? row.inactive : observedBoolean(rosText(row.inactive))
|
||||
let status: RecursiveGatewayObservation["status"] = "unknown"
|
||||
if (active === true && inactive !== true) status = "active"
|
||||
if (active !== true && (active === false || inactive === true)) status = "inactive"
|
||||
const previous = result.get(id)
|
||||
result.set(id, { id, ip, name, status: previous?.status === "active" || status === "active" ? "active" : previous?.status === "unknown" || status === "unknown" ? "unknown" : "inactive" })
|
||||
}
|
||||
|
||||
@@ -58,11 +58,11 @@ export async function readLogContext(id: string) {
|
||||
const after = (await pool.query<LogEntry>(`SELECT ${logColumns} FROM router_log_entries WHERE server_id=$1 AND (effective_at,id)>($2::timestamptz,$3::bigint) ORDER BY effective_at,router_log_entries.id LIMIT 10`, [entry.serverId, entry.effectiveAt, id])).rows
|
||||
return { entry, before: before.reverse(), after }
|
||||
}
|
||||
export async function readLogStream(filters: LogFilters, cursor: string) {
|
||||
export async function readLogStream(filters: LogFilters, cursor: string, limit = 200) {
|
||||
// A committed upper bound is safe per device: writers are serialized by its advisory lock.
|
||||
// Advance across non-matching events too, so a quiet filtered stream never rescans its backlog.
|
||||
const { rows: [upper] } = await pool.query<{ watermark: string }>(`SELECT GREATEST(COALESCE(max(id),0),$2::bigint)::text AS watermark FROM router_log_entries WHERE server_id=$1`, [filters.serverId, cursor])
|
||||
const where = logWhere(filters, ["id>$1::bigint", "id<=$2::bigint"], [cursor, upper.watermark])
|
||||
const entries = (await pool.query<LogEntry>(`SELECT ${logColumns} FROM router_log_entries WHERE ${where.sql} ORDER BY router_log_entries.id LIMIT 200`, where.values)).rows
|
||||
return { entries, cursor: entries.length === 200 ? entries[entries.length - 1].id : upper.watermark, state: (await getLogStates(filters.serverId))[0] ?? null, enabled: (await getLogSettings()).enabled }
|
||||
const entries = (await pool.query<LogEntry>(`SELECT ${logColumns} FROM router_log_entries WHERE ${where.sql} ORDER BY router_log_entries.id LIMIT $${where.values.length + 1}`, [...where.values, limit])).rows
|
||||
return { entries, cursor: entries.length === limit ? entries[entries.length - 1].id : upper.watermark, state: (await getLogStates(filters.serverId))[0] ?? null, enabled: (await getLogSettings()).enabled }
|
||||
}
|
||||
@@ -0,0 +1,130 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { createServer, type RequestListener } from "node:http"
|
||||
import { test } from "node:test"
|
||||
import { MikrotikClient, isRouterOsPreHeaderGetReset } from "./mikrotik.js"
|
||||
import { readRouterOsSnapshotGet } from "./routeros-snapshot-read.js"
|
||||
|
||||
async function loopback(work: (client: MikrotikClient, received: string[]) => Promise<void>, respond: RequestListener) {
|
||||
const received: string[] = []
|
||||
const server = createServer((request, response) => {
|
||||
assert.equal(request.method, "GET")
|
||||
received.push(request.url!)
|
||||
respond(request, response)
|
||||
})
|
||||
await new Promise<void>(resolve => server.listen(0, "127.0.0.1", resolve))
|
||||
const address = server.address(); assert(address && typeof address !== "string")
|
||||
const client = new MikrotikClient({ host: "127.0.0.1", port: address.port, useSsl: false, verifySsl: false, username: "fixture", password: "fixture" })
|
||||
try { await work(client, received) }
|
||||
finally { server.closeAllConnections(); await new Promise<void>(resolve => server.close(() => resolve())) }
|
||||
}
|
||||
|
||||
async function brandedReset(): Promise<Error> {
|
||||
let error: unknown
|
||||
await loopback(async client => {
|
||||
try { await client.get("/interface/ethernet") } catch (failure) { error = failure }
|
||||
}, request => request.destroy())
|
||||
assert(error instanceof Error && isRouterOsPreHeaderGetReset(error))
|
||||
return error
|
||||
}
|
||||
|
||||
test("actual pre-header reset retries the same GET once with fresh source/authority admission", async () => {
|
||||
let requests = 0, guards = 0
|
||||
await loopback(async (client, received) => {
|
||||
assert.deepEqual(await readRouterOsSnapshotGet({ client, path: "/interface/ethernet", assertCurrent: async () => { guards++ } }), [{ ".id": "*1", name: "ether1" }])
|
||||
assert.deepEqual(received, ["/rest/interface/ethernet", "/rest/interface/ethernet"])
|
||||
assert.equal(guards, 4)
|
||||
}, (request, response) => {
|
||||
if (++requests === 1) request.destroy()
|
||||
else response.end(JSON.stringify([{ ".id": "*1", name: "ether1" }]))
|
||||
})
|
||||
})
|
||||
|
||||
test("repeated actual resets stop at two GETs and preserve the final transport error", async () => {
|
||||
await loopback(async (client, received) => {
|
||||
const failures: unknown[] = []
|
||||
const wrapped = { async get<T>(...args: Parameters<MikrotikClient["get"]>) {
|
||||
try { return await client.get<T>(...args) } catch (error) { failures.push(error); throw error }
|
||||
} }
|
||||
await assert.rejects(readRouterOsSnapshotGet({ client: wrapped, path: "/interface/ethernet", assertCurrent: async () => {} }), error => error === failures[1])
|
||||
assert.equal(failures.length, 2); assert.equal(received.length, 2)
|
||||
assert(failures.every(isRouterOsPreHeaderGetReset))
|
||||
}, request => request.destroy())
|
||||
})
|
||||
|
||||
for (const outcome of ["headers-reset", "information-reset", "body-reset", "429", "bad-json", "timeout", "abort"] as const) {
|
||||
test(`${outcome} cannot spend a retry slot`, async () => {
|
||||
const abort = new AbortController()
|
||||
await loopback(async (client, received) => {
|
||||
let failure: unknown
|
||||
try { await readRouterOsSnapshotGet({ client, path: "/interface/ethernet", timeoutMs: 80, signal: abort.signal, assertCurrent: async () => {} }) }
|
||||
catch (error) { failure = error }
|
||||
assert(failure instanceof Error)
|
||||
assert.equal(isRouterOsPreHeaderGetReset(failure), false)
|
||||
assert.equal(received.length, 1)
|
||||
}, (request, response) => {
|
||||
if (outcome === "timeout") return
|
||||
if (outcome === "abort") { abort.abort(new Error("caller cancelled")); return }
|
||||
if (outcome === "information-reset") { response.writeContinue(); setTimeout(() => request.destroy(), 10); return }
|
||||
if (outcome === "headers-reset" || outcome === "body-reset") {
|
||||
response.writeHead(200, { "content-type": "application/json", "content-length": "1000" }); response.flushHeaders()
|
||||
if (outcome === "body-reset") response.write("[")
|
||||
setTimeout(() => response.destroy(), 10); return
|
||||
}
|
||||
if (outcome === "429") { response.writeHead(429); response.end("{}"); return }
|
||||
response.end("!")
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
test("spoofed reset, pre-abort and initial authority denial dispatch at most one or zero GETs", async () => {
|
||||
const spoof = Object.assign(new Error("ECONNRESET"), { code: "ECONNRESET" })
|
||||
let calls = 0
|
||||
const client = { async get<T>(): Promise<T> { calls++; throw spoof } }
|
||||
await assert.rejects(readRouterOsSnapshotGet({ client, path: "/interface", assertCurrent: async () => {} }), error => error === spoof)
|
||||
assert.equal(calls, 1)
|
||||
const abort = new AbortController(); const cancelled = new Error("cancelled"); abort.abort(cancelled)
|
||||
await assert.rejects(readRouterOsSnapshotGet({ client, path: "/interface", signal: abort.signal, assertCurrent: async () => {} }), error => error === cancelled)
|
||||
const denied = new Error("authority denied")
|
||||
await assert.rejects(readRouterOsSnapshotGet({ client, path: "/interface", assertCurrent: async () => { throw denied } }), error => error === denied)
|
||||
assert.equal(calls, 1)
|
||||
})
|
||||
|
||||
test("both attempts share one decreasing budget including admission work", async () => {
|
||||
const reset = await brandedReset()
|
||||
let clock = 0, guards = 0, dispatches = 0
|
||||
const timeouts: number[] = []
|
||||
const client = { async get<T>(_path: string, timeout?: number, _signal?: AbortSignal, _maxBytes?: number, beforeDispatch?: () => Promise<unknown>): Promise<T> {
|
||||
timeouts.push(timeout!)
|
||||
await beforeDispatch!()
|
||||
dispatches++
|
||||
if (dispatches === 1) { clock += 20; throw reset }
|
||||
return [] as T
|
||||
} }
|
||||
await readRouterOsSnapshotGet({ client, path: "/interface", timeoutMs: 100, now: () => clock, assertCurrent: async () => { guards++; clock += 10 } })
|
||||
assert.deepEqual(timeouts, [90, 50]); assert.equal(guards, 4); assert.equal(dispatches, 2)
|
||||
})
|
||||
|
||||
test("authority/source revocation and expiry between attempts forbid the second GET", async () => {
|
||||
const reset = await brandedReset()
|
||||
for (const outcome of ["authority", "source", "expiry"] as const) {
|
||||
let clock = 0, guards = 0, calls = 0
|
||||
const denied = new Error(outcome + " changed")
|
||||
const client = { async get<T>(_path: string, _timeout?: number, _signal?: AbortSignal, _maxBytes?: number, beforeDispatch?: () => Promise<unknown>): Promise<T> {
|
||||
await beforeDispatch!(); calls++; throw reset
|
||||
} }
|
||||
await assert.rejects(readRouterOsSnapshotGet({ client, path: "/interface", timeoutMs: 100, now: () => clock, assertCurrent: async () => {
|
||||
if (++guards === 3) { if (outcome === "expiry") clock = 100; else throw denied }
|
||||
} }), error => error === (outcome === "expiry" ? reset : denied))
|
||||
assert.equal(calls, 1); assert.equal(guards, 3)
|
||||
}
|
||||
})
|
||||
|
||||
test("deadline expiry during the final dispatch admission starts no HTTP request", async () => {
|
||||
let clock = 0, guards = 0
|
||||
await loopback(async (client, received) => {
|
||||
await assert.rejects(readRouterOsSnapshotGet({ client, path: "/interface", timeoutMs: 100, now: () => clock, assertCurrent: async () => {
|
||||
if (++guards === 2) clock = 100
|
||||
} }), { name: "TimeoutError" })
|
||||
assert.equal(received.length, 0)
|
||||
}, (_request, response) => response.end("[]"))
|
||||
})
|
||||
@@ -0,0 +1,49 @@
|
||||
import { isRouterOsPreHeaderGetReset } from "./mikrotik.js"
|
||||
|
||||
interface SnapshotGetClient {
|
||||
get<T>(path: string, timeoutMs?: number, signal?: AbortSignal, maxResponseBytes?: number, beforeDispatch?: () => Promise<unknown>): Promise<T>
|
||||
}
|
||||
|
||||
/** A single catalogue read, pinned to the original client/path. Only a transport-
|
||||
* branded reset before any response headers can spend its one retry slot. */
|
||||
export async function readRouterOsSnapshotGet<T>(input: {
|
||||
client: SnapshotGetClient
|
||||
path: string
|
||||
assertCurrent(): Promise<unknown>
|
||||
timeoutMs?: number
|
||||
signal?: AbortSignal
|
||||
now?: () => number
|
||||
}): Promise<T> {
|
||||
const { client, path, assertCurrent, signal } = input
|
||||
const timeoutMs = input.timeoutMs ?? 10_000, now = input.now ?? (() => performance.now())
|
||||
if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2_147_483_647) throw new RangeError("Invalid RouterOS snapshot read timeout")
|
||||
const deadline = now() + timeoutMs
|
||||
let originalReset: unknown
|
||||
const remaining = () => {
|
||||
signal?.throwIfAborted()
|
||||
const budget = deadline - now()
|
||||
if (budget <= 0) throw originalReset ?? new DOMException("RouterOS snapshot read deadline expired", "TimeoutError")
|
||||
return Math.ceil(budget)
|
||||
}
|
||||
for (let attempt = 0; attempt < 2; attempt++) {
|
||||
remaining()
|
||||
await assertCurrent()
|
||||
const budget = remaining()
|
||||
const deadlineSignal = AbortSignal.timeout(budget)
|
||||
const requestSignal = signal ? AbortSignal.any([signal, deadlineSignal]) : deadlineSignal
|
||||
try {
|
||||
const result = await client.get<T>(path, budget, requestSignal, undefined, async () => {
|
||||
await assertCurrent()
|
||||
remaining()
|
||||
requestSignal.throwIfAborted()
|
||||
})
|
||||
remaining()
|
||||
return result
|
||||
} catch (error) {
|
||||
if (attempt !== 0 || !isRouterOsPreHeaderGetReset(error) || signal?.aborted) throw error
|
||||
originalReset = error
|
||||
remaining()
|
||||
}
|
||||
}
|
||||
throw originalReset
|
||||
}
|
||||
@@ -0,0 +1,184 @@
|
||||
import assert from 'node:assert/strict'
|
||||
import {readFile} from 'node:fs/promises'
|
||||
import ts from 'typescript'
|
||||
|
||||
// Execute the real emitted executor body with only its imported I/O dependencies
|
||||
// substituted. No SQL, HTTP, config files or live authority can be contacted.
|
||||
const compile=async name=>ts.transpileModule(await readFile(new URL(name,import.meta.url),'utf8'),{compilerOptions:{target:ts.ScriptTarget.ES2022,module:ts.ModuleKind.ES2022}}).outputText
|
||||
const uri=source=>'data:text/javascript;base64,'+Buffer.from(source).toString('base64')
|
||||
// Preserve offline I/O substitution while linking pure relative leaf modules.
|
||||
const pureModules=new Map()
|
||||
async function pureModuleUri(name){
|
||||
if(pureModules.has(name))return pureModules.get(name)
|
||||
const loading=(async()=>{
|
||||
let code=await compile(name)
|
||||
const ast=ts.createSourceFile(name,code,ts.ScriptTarget.ES2022,true,ts.ScriptKind.JS)
|
||||
const imports=ast.statements.filter(ts.isImportDeclaration).filter(node=>node.moduleSpecifier.text.startsWith('./'))
|
||||
const edits=await Promise.all(imports.map(async node=>({start:node.moduleSpecifier.getStart(ast),end:node.moduleSpecifier.end,value:await pureModuleUri(node.moduleSpecifier.text.replace(/\.js$/,'.ts'))})))
|
||||
for(const edit of edits.reverse())code=code.slice(0,edit.start)+JSON.stringify(edit.value)+code.slice(edit.end)
|
||||
return uri(code)
|
||||
})()
|
||||
pureModules.set(name,loading);return loading
|
||||
}
|
||||
const diagnosticUri=await pureModuleUri('./vrf-execution-diagnostic.ts')
|
||||
const diagnostic=await import(diagnosticUri)
|
||||
const id='12345678-1234-4123-8123-123456789abc'
|
||||
let cases=0
|
||||
for(const [error,expected]of [[Error('SECRET'),'Error'],[new TypeError('SECRET'),'TypeError'],[new RangeError('SECRET'),'RangeError'],[new SyntaxError('SECRET'),'SyntaxError'],[new ReferenceError('SECRET'),'ReferenceError'],[new URIError('SECRET'),'URIError'],[new EvalError('SECRET'),'EvalError'],[{message:'SECRET'},'NonError'],[new Proxy(Error('SECRET'),{get(){throw Error('getter')}}),'NonError']]){
|
||||
const value=diagnostic.vrfExecutionDiagnostic(id,'create','raw-before',error,false,{serverId:1,catalog:'vrf',boundary:'native-get'})
|
||||
assert.equal(value.errorClass,expected);assert.equal(JSON.stringify(value).includes('SECRET'),false);cases++
|
||||
}
|
||||
const trap=Error('SECRET')
|
||||
for(const key of ['message','stack','code','cause'])Object.defineProperty(trap,key,{get(){throw Error('SECRET getter')}})
|
||||
assert.equal(diagnostic.vrfExecutionDiagnostic(id,'create','raw-before',trap,false).category,'other');cases++
|
||||
for(const code of ['ECONNRESET','ETIMEDOUT','40P01','SECRET']){
|
||||
const value=diagnostic.vrfExecutionDiagnostic(id,'delete','ack-journal',Object.assign(Error('SECRET'),{code}),true)
|
||||
assert.equal(value.category,({ECONNRESET:'reset',ETIMEDOUT:'timeout','40P01':'pg-deadlock'})[code]??'other')
|
||||
assert.equal(JSON.stringify(value).includes('SECRET'),false);cases++
|
||||
}
|
||||
assert.equal(diagnostic.vrfExecutionDiagnostic('SECRET','create','raw-before',Error(),false),undefined)
|
||||
assert.equal(diagnostic.vrfExecutionDiagnostic(id,'SECRET','raw-before',Error(),false),undefined)
|
||||
assert.equal(diagnostic.vrfExecutionDiagnostic(id,'create','SECRET',Error(),false),undefined)
|
||||
assert.equal(diagnostic.vrfExecutionDiagnostic(id,'create','raw-before',Error(),false,{serverId:1,catalog:'SECRET',boundary:'native-get'}).read,undefined);cases++
|
||||
diagnostic.notifyVrfDiagnostic(()=>{throw Error('observer')},{})
|
||||
diagnostic.notifyVrfDiagnostic(async()=>{throw Error('observer')},{})
|
||||
await new Promise(resolve=>setImmediate(resolve));cases++
|
||||
|
||||
const key='__vrfDiagnosticOfflineFixture'
|
||||
class McpError extends Error{constructor(code,message){super(message);this.code=code}}
|
||||
globalThis[key]={McpError}
|
||||
const functions=['readVrfProductionSnapshot','claimStoredVrfProductionTicket','inspectVrfProductionAdmission','assertVrfProductionHistoryProvenance','assertVrfProductionTransitionCheckpoint','classifyVrfProductionTransition','openVrfProductionTransitionCheckpoint','sealVrfProductionTransitionCheckpoint','vrfProductionCheckpointCatalogs','assertVerifiedConfigurationAccess','withVrfClaimQuarantine','assertVrfActionContext','vrfNativeActionFor','vrfActionContractsCurrent','findMcpOperation','decryptSecretExisting','encryptSecret','fingerprint','withVrfProductionSealingKey','configurationRows','resourceById','routerClient','rosSnapshotSourceProof']
|
||||
const stubUri=uri(`export const McpError=globalThis.${key}.McpError;export const pool={query:(...args)=>globalThis.${key}.query(...args)};`+functions.map(name=>`export const ${name}=(...args)=>globalThis.${key}.${name}(...args);`).join('\n'))
|
||||
let emitted=await compile('./vrf-production-execution.ts')
|
||||
const ast=ts.createSourceFile('executor.js',emitted,ts.ScriptTarget.ES2022,true,ts.ScriptKind.JS)
|
||||
const edits=ast.statements.filter(ts.isImportDeclaration).map(node=>({start:node.moduleSpecifier.getStart(ast),end:node.moduleSpecifier.end,value:node.moduleSpecifier.text.endsWith('/vrf-execution-diagnostic.js')?diagnosticUri:stubUri}))
|
||||
for(const edit of edits.reverse())emitted=emitted.slice(0,edit.start)+JSON.stringify(edit.value)+emitted.slice(edit.end)
|
||||
const api=await import(uri(emitted))
|
||||
function fixture(options={}){
|
||||
const failure=Object.assign(Error('PRIVATE_PASSWORD native-body SQL /private/path'),{code:options.errno??'ETIMEDOUT'})
|
||||
const events=[],calls=[];let reads=0,deps=0,access=0,inspect=0,routers=0,guard,clientCalls=0
|
||||
const proof='a'.repeat(64),snapshot={projection:'raw-native-v1',serverId:1,sourceProof:proof,catalogs:{vrf:[{'.id':'*0',name:'main',interfaces:'all',disabled:'false'}],interface_inventory:[]}}
|
||||
const fail=name=>{calls.push(name);if(options.fail===name)throw failure}
|
||||
const f={McpError,
|
||||
async query(sql){
|
||||
if(sql.includes('SELECT cp.after_sealed')){fail('history-load');return{rows:[]}}
|
||||
if(sql.includes('SELECT ticket_id')){fail('ticket-lookup');return{rows:[{ticket_id:'ticket'}]}}
|
||||
if(sql.includes('SET before_sealed'))fail('checkpoint-before')
|
||||
if(sql.includes("SET state='applied'"))fail('ack-journal')
|
||||
if(sql.includes('SET after_sealed'))fail('checkpoint-after')
|
||||
return{rows:[{id,operation_id:id}]}
|
||||
},
|
||||
async assertVerifiedConfigurationAccess(){fail('access-'+(++access))},
|
||||
async routerClient(){fail('router-'+(++routers));return{server:{},client:{
|
||||
async put(){clientCalls++;fail('client-before-guard');await guard();fail('client-after-guard');return options.badAck?{}:{'.id':'*1'}},
|
||||
async patch(){clientCalls++;await guard();return{'.id':'*1'}},
|
||||
async delete(_path,_timeout,_before,onBody){clientCalls++;await guard();onBody(options.badDeleteBody?'PRIVATE_INVALID_JSON':'{}')},
|
||||
}}},
|
||||
async rosSnapshotSourceProof(){return proof},
|
||||
vrfNativeActionFor(){return'ros.vrf.create'},assertVrfActionContext(){},vrfActionContractsCurrent(){return true},findMcpOperation(){return{version:1}},
|
||||
async withVrfProductionSealingKey(work){fail('sealing-key');return work(Buffer.alloc(32))},
|
||||
async readVrfProductionSnapshot(input){reads++;input.observeRead?.({serverId:1,catalog:'gre',boundary:'native-get'});fail('read-'+reads);return structuredClone(snapshot)},
|
||||
configurationRows(_spec,rows){return rows},resourceById(){return{}},fingerprint(){return'current-fingerprint'},
|
||||
async withVrfClaimQuarantine(input){return input.claim()},async claimStoredVrfProductionTicket(){fail('ticket-claim');return{privateSealed:'PRIVATE_SEALED'}},
|
||||
async encryptSecret(){return'PRIVATE_CIPHERTEXT'},async decryptSecretExisting(){throw Error('not used')},
|
||||
inspectVrfProductionAdmission(){fail('inspect-'+(++inspect));return{admission:{}}},
|
||||
assertVrfProductionHistoryProvenance(){},assertVrfProductionTransitionCheckpoint(){},openVrfProductionTransitionCheckpoint(){},vrfProductionCheckpointCatalogs(){return[]},
|
||||
classifyVrfProductionTransition(){fail('classification');return{checkpoint:{}}},sealVrfProductionTransitionCheckpoint(){return'PRIVATE_HISTORY'},
|
||||
}
|
||||
globalThis[key]=f
|
||||
const input={operationId:id,planId:'plan',connectionId:'connection',ownerId:'owner',operationName:options.action==='delete'?'ros.vrf.delete':'ros.vrf.create',operationVersion:1,stepIndex:0,
|
||||
step:{serverId:1,resource:'vrf',action:options.action??'create',...(options.action==='delete'?{id:'*1'}:{}),fields:options.action==='delete'?{}:{name:'customers',interfaces:'none'},placeBeforeId:options.action==='delete'?undefined:'*0'},sourceProof:proof,
|
||||
originalSnapshots:options.originalDrift?[{serverId:1,resource:'vrf',sourceProof:proof,fingerprint:'old-fingerprint'}]:[],
|
||||
async authorize(){},async assertDependencies(){fail('dependencies-'+(++deps))},installBeforeDispatch(value){fail('install');guard=value},
|
||||
onDiagnostic(value){events.push(value);if(options.observerThrows)throw Error('logging failed');if(options.observerRejects)return Promise.reject(Error('async logging failed'))},
|
||||
}
|
||||
return{failure,events,calls,input,clientCalls:()=>clientCalls,run:()=>api.executeVrfProductionStep(input)}
|
||||
}
|
||||
for(const [fail,stage,ack]of [
|
||||
['access-1','initial-authorization',false],['sealing-key','sealing-key',false],['read-1','raw-before',false],
|
||||
['ticket-lookup','ticket-lookup',false],['ticket-claim','ticket-claim',false],['checkpoint-before','checkpoint-before',false],['install','install-predispatch',false],
|
||||
['access-2','explicit-predispatch-authorization',false],['dependencies-1','explicit-predispatch-dependencies',false],['read-2','explicit-predispatch-read',false],['inspect-1','explicit-predispatch-admission',false],['access-3','explicit-predispatch-final-authorization',false],
|
||||
['router-4','dispatch-source',false],['client-before-guard','client-call',false],['access-4','installed-predispatch-authorization',false],['dependencies-2','installed-predispatch-dependencies',false],['read-3','installed-predispatch-read',false],['inspect-2','installed-predispatch-admission',false],['access-5','installed-predispatch-final-authorization',false],['client-after-guard','client-call',false],
|
||||
['ack-journal','ack-journal',true],['access-6','post-ack-authorization',true],['read-4','raw-after',true],['classification','transition-classification',true],['dependencies-3','post-ack-dependencies',true],['access-7','post-ack-final-authorization',true],['checkpoint-after','checkpoint-after',true],
|
||||
]){
|
||||
const f=fixture({fail});let thrown;try{await f.run()}catch(error){thrown=error}
|
||||
assert.ok(thrown,fail);assert.equal(f.events.length,1,fail);assert.equal(f.events[0].stage,stage,fail);assert.equal(f.events[0].executorAckObserved,ack,fail)
|
||||
assert.equal(f.events[0].category,'timeout',fail)
|
||||
if(fail.startsWith('read-'))assert.deepEqual(f.events[0].read,{serverId:1,catalog:'gre',boundary:'native-get'},fail)
|
||||
else assert.equal(f.events[0].read,undefined,fail)
|
||||
if(!ack)assert.equal(thrown,f.failure,fail)
|
||||
else assert.ok(thrown instanceof api.VrfProductionAcknowledgedFailure,fail)
|
||||
if(fail==='ack-journal')assert.equal(thrown.code,'VRF_ACK_JOURNAL_UNCONFIRMED')
|
||||
if(fail==='checkpoint-after')assert.equal(thrown.code,'VRF_VERIFIED_CHECKPOINT_UNCONFIRMED')
|
||||
assert.equal(JSON.stringify(f.events).includes('PRIVATE'),false);cases++
|
||||
}
|
||||
for(const observer of ['observerThrows','observerRejects']){
|
||||
const f=fixture({fail:'read-1',[observer]:true});await assert.rejects(f.run(),error=>error===f.failure)
|
||||
await new Promise(resolve=>setImmediate(resolve));assert.equal(f.events.length,1);cases++
|
||||
}
|
||||
const original=fixture({originalDrift:true});await assert.rejects(original.run(),error=>error.code==='STATE_CONFLICT');assert.equal(original.events[0].stage,'original-dependencies');cases++
|
||||
const history=fixture({action:'delete',fail:'history-load'});await assert.rejects(history.run(),error=>error===history.failure);assert.equal(history.events[0].stage,'history-load');cases++
|
||||
const malformed=fixture({badAck:true});await assert.rejects(malformed.run(),error=>error.code==='STATE_CONFLICT'&&!(error instanceof api.VrfProductionAcknowledgedFailure));assert.equal(malformed.events[0].stage,'ack-identity');assert.equal(malformed.events[0].executorAckObserved,true);cases++
|
||||
const malformedDelete=fixture({action:'delete',badDeleteBody:true});await assert.rejects(malformedDelete.run(),error=>error instanceof api.VrfProductionAcknowledgedFailure&&error.code==='VERIFICATION_FAILED');assert.equal(malformedDelete.events[0].executorAckObserved,true);assert.equal(malformedDelete.events[0].stage,'ack-identity');cases++
|
||||
const happy=fixture();const receipt=await happy.run();assert.equal(receipt.configurationVerified,true);assert.equal(happy.events.length,0);assert.equal(happy.clientCalls(),1);cases++
|
||||
const silent=fixture({fail:'read-1'});delete silent.input.onDiagnostic;await assert.rejects(silent.run(),error=>error===silent.failure);cases++
|
||||
// Exercise the exact emitted runtime policy call/callback/fallback/clear wiring.
|
||||
// Only its surrounding policy and executor I/O are synthetic. Extracting the
|
||||
// live AST statements means this test fails if the runtime stops wiring them.
|
||||
const runtimeSource=await compile('../modules/mcp/runtime.ts')
|
||||
const runtimeAst=ts.createSourceFile('runtime.js',runtimeSource,ts.ScriptTarget.ES2022,true,ts.ScriptKind.JS)
|
||||
const setup=[],clear=[],policyCalls=[],fallback=[]
|
||||
function visit(node){
|
||||
if(ts.isExpressionStatement(node)){
|
||||
const text=node.getText(runtimeAst)
|
||||
if(text.startsWith('vrfDiagnosticFallback = productionVrf'))setup.push(text)
|
||||
if(text==='vrfDiagnosticFallback = undefined;')clear.push(text)
|
||||
if(text==='vrfDiagnosticFallback?.failure(error);')fallback.push(text)
|
||||
}
|
||||
if(ts.isVariableStatement(node)&&node.declarationList.declarations.length===1){
|
||||
const value=node.declarationList.declarations[0]
|
||||
if(value.name.getText(runtimeAst)==='result'&&value.initializer&&ts.isAwaitExpression(value.initializer)&&ts.isCallExpression(value.initializer.expression)&&value.initializer.expression.expression.getText(runtimeAst)==='withVerifiedConfigurationChange'&&node.getText(runtimeAst).includes('executeVrfProductionStep'))policyCalls.push(node.getText(runtimeAst))
|
||||
}
|
||||
ts.forEachChild(node,visit)
|
||||
}
|
||||
visit(runtimeAst)
|
||||
for(const statements of [setup,clear,policyCalls,fallback])assert.equal(statements.length,1)
|
||||
const runtimeBoundary=new Function(`return async function(env){
|
||||
const {productionVrf,step,plan,operationId,connection,serverIds,evidence,serviceExecution,reservedStep,authorizeCatalog,authorize,prefix,McpError,executeVrfProductionStep,executeRosStep,withVerifiedConfigurationChange,createVrfRuntimeDiagnosticBoundary,console}=env;
|
||||
const index=0;let vrfDiagnosticFallback,vrfBeforeDispatch;
|
||||
try{${setup[0]}\n${policyCalls[0]}\n${clear[0]}\nif(env.failAfterWrapper)throw env.failure;return result}
|
||||
catch(error){${fallback[0]}\nthrow error}
|
||||
}`)()
|
||||
for(const mode of ['runtime-policy-entry','policy-authorize','executor-entry','executor-clone','executor-binding','executor-reported','runtime-policy-exit','after-wrapper','non-production','success']){
|
||||
for(const loggerThrows of [false,true]){
|
||||
const error=Object.assign(Error('PRIVATE_RUNTIME_POLICY_FAILURE'),{code:'ECONNRESET'}),events=[]
|
||||
const env={failure:error,failAfterWrapper:mode==='after-wrapper',productionVrf:mode!=='non-production',
|
||||
operationId:id,connection:{owner_id:'owner',id:'connection'},serverIds:[1],evidence:{objects:[],snapshots:[{resource:'vrf',serverId:1,sourceProof:'a'.repeat(64)}]},serviceExecution:undefined,reservedStep:{},
|
||||
plan:{id:'plan',operation_id:'ros.vrf.create',operation_version:1,approved_by:'owner'},step:{kind:'ros',step:{serverId:1,resource:'vrf',action:'create',fields:{name:'customers',interfaces:'none'}}},
|
||||
prefix:{async check(){}},async authorize(){},async authorizeCatalog(){if(mode==='policy-authorize')throw error},McpError,createVrfRuntimeDiagnosticBoundary:diagnostic.createVrfRuntimeDiagnosticBoundary,
|
||||
console:{error(raw){events.push(JSON.parse(raw));if(loggerThrows)throw Error('PRIVATE_LOGGER_FAILURE')}},
|
||||
async executeRosStep(){throw error},
|
||||
async executeVrfProductionStep(input){
|
||||
if(mode==='executor-entry')throw error
|
||||
if(mode==='executor-clone'){input.step.fields.uncloneable=()=>{};return api.executeVrfProductionStep(input)}
|
||||
if(mode==='executor-binding'){fixture();globalThis[key].assertVrfActionContext=()=>{throw error};return api.executeVrfProductionStep(input)}
|
||||
if(mode==='executor-reported'){input.onDiagnostic(diagnostic.vrfExecutionDiagnostic(id,'create','raw-before',error,false,{serverId:1,catalog:'vrf',boundary:'native-get'}));throw error}
|
||||
return{kind:'vrf-production-execution-v1',configurationVerified:true,nativeId:'*1'}
|
||||
},
|
||||
async withVerifiedConfigurationChange(context,work){
|
||||
if(mode==='runtime-policy-entry')throw error
|
||||
if(mode==='policy-authorize')await context.authorize()
|
||||
const receipt=await work();if(mode==='runtime-policy-exit')throw error;return receipt
|
||||
},
|
||||
}
|
||||
if(mode==='success'){assert.equal((await runtimeBoundary(env)).configurationVerified,true);assert.equal(events.length,0)}
|
||||
else{
|
||||
await assert.rejects(runtimeBoundary(env),value=>mode==='executor-clone'?value.name==='DataCloneError':value===error)
|
||||
if(['after-wrapper','non-production'].includes(mode))assert.equal(events.length,0)
|
||||
else{assert.equal(events.length,1);assert.equal(events[0].stage,mode==='executor-reported'?'raw-before':['executor-clone','executor-binding'].includes(mode)?'executor-entry':mode==='policy-authorize'?'runtime-policy-entry':mode);assert.equal(events[0].executorAckObserved,mode==='runtime-policy-exit');assert.equal(events[0].category,mode==='executor-clone'?'other':'reset')}
|
||||
}
|
||||
assert.equal(JSON.stringify(events).includes('PRIVATE'),false);cases++
|
||||
}
|
||||
}
|
||||
delete globalThis[key]
|
||||
console.log('VRF private execution diagnostics, actual executor body with offline imported I/O, closed projection cases:',cases)
|
||||
@@ -0,0 +1,74 @@
|
||||
import { types } from "node:util"
|
||||
import { readVrfTransitionRefusal, type VrfTransitionRefusalTag } from "./vrf-transition-refusal.js"
|
||||
|
||||
export const VRF_EXECUTION_STAGES = [
|
||||
"runtime-policy-entry", "executor-entry", "runtime-policy-exit",
|
||||
"initial-authorization", "sealing-key", "history-load", "raw-before", "original-dependencies", "history-provenance", "supported-shape", "ticket-lookup", "ticket-claim", "checkpoint-before", "install-predispatch",
|
||||
"explicit-predispatch-authorization", "explicit-predispatch-dependencies", "explicit-predispatch-read", "explicit-predispatch-admission", "explicit-predispatch-final-authorization",
|
||||
"dispatch-source", "client-call", "installed-predispatch-authorization", "installed-predispatch-dependencies", "installed-predispatch-read", "installed-predispatch-admission", "installed-predispatch-final-authorization",
|
||||
"ack-identity", "ack-journal", "post-ack-authorization", "raw-after", "transition-classification", "post-ack-dependencies", "post-ack-final-authorization", "checkpoint-after",
|
||||
] as const
|
||||
export type VrfExecutionStage = typeof VRF_EXECUTION_STAGES[number]
|
||||
export const VRF_READ_BOUNDARIES = ["authority-before", "native-get", "authority-after", "shape", "snapshot-validation", "final-authority"] as const
|
||||
export interface VrfRawReadObservation { serverId: number; catalog?: string; boundary: typeof VRF_READ_BOUNDARIES[number] }
|
||||
const catalogs = new Set(["bridge", "bridge_port", "bridge_vlan", "vrf", "ipv4_address", "ipv6_address", "ipv4_route", "ipv6_route", "routing_table", "ethernet", "ip_filter", "ipv6_filter", "routing_rule", "ip_settings", "ipv6_settings", "interface_inventory", "interface_list_members", "vlan", "bonding", "wireguard", "wireguard_peer", "gre", "ipip", "eoip", "vxlan", "vxlan_vtep", "pppoe_client"])
|
||||
const classes = [[Error.prototype, "Error"], [TypeError.prototype, "TypeError"], [RangeError.prototype, "RangeError"], [SyntaxError.prototype, "SyntaxError"], [ReferenceError.prototype, "ReferenceError"], [URIError.prototype, "URIError"], [EvalError.prototype, "EvalError"]] as const
|
||||
const categories = Object.freeze({ ECONNRESET: "reset", ECONNREFUSED: "refused", ETIMEDOUT: "timeout", ENOTFOUND: "dns", EAI_AGAIN: "dns", EPIPE: "pipe", ABORT_ERR: "aborted", ERR_STREAM_DESTROYED: "stream", "40001": "pg-serialization", "40P01": "pg-deadlock", "57014": "pg-cancelled", "08003": "pg-connection", "08006": "pg-connection", "57P01": "pg-connection" } as const)
|
||||
export interface VrfExecutionDiagnostic {
|
||||
event: "mcp.vrf.execution-failed"
|
||||
operationId: string
|
||||
action: "create" | "patch" | "delete"
|
||||
stage: VrfExecutionStage
|
||||
errorClass: "Error" | "TypeError" | "RangeError" | "SyntaxError" | "ReferenceError" | "URIError" | "EvalError" | "OtherNativeError" | "NonError"
|
||||
category: "other" | typeof categories[keyof typeof categories]
|
||||
/** Executor response observation only, never write-fence/dispatch proof. */
|
||||
executorAckObserved: boolean
|
||||
read?: VrfRawReadObservation
|
||||
transition?: VrfTransitionRefusalTag
|
||||
}
|
||||
/** Closed private diagnostic only. Never read error messages, stacks, getters,
|
||||
* causes, request bodies, SQL or native values. No outcome/authority is minted. */
|
||||
export function vrfExecutionDiagnostic(operationId: string, action: string, stage: VrfExecutionStage, error: unknown, executorAckObserved: boolean, read?: VrfRawReadObservation): VrfExecutionDiagnostic | undefined {
|
||||
if (typeof operationId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(operationId) || !["create", "patch", "delete"].includes(action) || !VRF_EXECUTION_STAGES.includes(stage) || typeof executorAckObserved !== "boolean") return undefined
|
||||
const result: VrfExecutionDiagnostic = { event: "mcp.vrf.execution-failed", operationId, action: action as VrfExecutionDiagnostic["action"], stage, errorClass: "NonError", category: "other", executorAckObserved }
|
||||
if (types.isNativeError(error)) {
|
||||
result.errorClass = classes.find(([prototype]) => Object.getPrototypeOf(error) === prototype)?.[1] ?? "OtherNativeError"
|
||||
const descriptor = Object.getOwnPropertyDescriptor(error, "code")
|
||||
if (descriptor && Object.hasOwn(descriptor, "value") && typeof descriptor.value === "string" && Object.hasOwn(categories, descriptor.value)) result.category = categories[descriptor.value as keyof typeof categories]
|
||||
}
|
||||
if (read && Number.isSafeInteger(read.serverId) && read.serverId > 0 && VRF_READ_BOUNDARIES.includes(read.boundary) && (read.catalog === undefined || typeof read.catalog === "string" && catalogs.has(read.catalog))) result.read = { serverId: read.serverId, boundary: read.boundary, ...(read.catalog === undefined ? {} : { catalog: read.catalog }) }
|
||||
const transition = readVrfTransitionRefusal(error)
|
||||
if (transition) result.transition = transition
|
||||
return result
|
||||
}
|
||||
/** Observers are in-process only and cannot fail, await, or replace the work. */
|
||||
export function notifyVrfDiagnostic<T>(observer: ((value: T) => unknown) | undefined, value: T): void {
|
||||
try {
|
||||
if (!observer) return
|
||||
const result = observer(value)
|
||||
if (types.isPromise(result)) void Promise.prototype.then.call(result, undefined, () => {})
|
||||
} catch { /* Private observation never changes the original control flow. */ }
|
||||
}
|
||||
/** Private per-step fallback for failures before the executor's own try or in
|
||||
* its surrounding policy context. Executor diagnostics always take precedence.
|
||||
* Runtime discards this object immediately when the policy wrapper succeeds. */
|
||||
export function createVrfRuntimeDiagnosticBoundary(operationId: string, action: string, observer: (value: VrfExecutionDiagnostic) => unknown) {
|
||||
let stage: VrfExecutionStage = "runtime-policy-entry", emitted = false, executorAckObserved = false
|
||||
return {
|
||||
executorEntered() { stage = "executor-entry" },
|
||||
executorReturned() { stage = "runtime-policy-exit"; executorAckObserved = true },
|
||||
observed(value: VrfExecutionDiagnostic) {
|
||||
if (value.operationId !== operationId || value.action !== action || emitted) return
|
||||
emitted = true
|
||||
notifyVrfDiagnostic(observer, value)
|
||||
},
|
||||
failure(error: unknown) {
|
||||
if (emitted) return
|
||||
emitted = true
|
||||
try {
|
||||
const value = vrfExecutionDiagnostic(operationId, action, stage, error, executorAckObserved)
|
||||
if (value) notifyVrfDiagnostic(observer, value)
|
||||
} catch { /* Fallback logging cannot replace the outer runtime error. */ }
|
||||
},
|
||||
}
|
||||
}
|
||||
@@ -3,11 +3,11 @@ import { assertVrfActionContext, dedupeVrfAliasSnapshots, vrfNativeActionFor, vr
|
||||
import type { VrfTicketContext } from "./vrf-production-ticket-store.js"
|
||||
import type { VrfProductionRequest } from "./vrf-production-admission.js"
|
||||
import type { RosSnapshot } from "../modules/mcp/resources.js"
|
||||
const context = { actionId: "ros.vrf.update", actionVersion: 3, authorityAction: { id: "routing.vrf.update", version: 3 } } as VrfTicketContext
|
||||
const context = { actionId: "ros.vrf.update", actionVersion: 4, authorityAction: { id: "routing.vrf.update", version: 4 } } as VrfTicketContext
|
||||
const request: VrfProductionRequest = { action: "patch", id: "*a", fields: { interfaces: "owned-a,owned-b" } }
|
||||
let cases = 0
|
||||
assertVrfActionContext(context, request); cases++
|
||||
assert.deepEqual(vrfPublicAuthority(context), { id: "routing.vrf.update", version: 3 }); cases++
|
||||
assert.deepEqual(vrfPublicAuthority(context), { id: "routing.vrf.update", version: 4 }); cases++
|
||||
assert.equal(vrfNativeActionFor("routing.vrf.update", request), "ros.vrf.update"); cases++
|
||||
const invalidRequests: VrfProductionRequest[] = [
|
||||
{ ...request, action: "create" as const }, { ...request, action: "delete" as const }, { ...request, fields: { name: "other" } },
|
||||
@@ -15,6 +15,7 @@ const invalidRequests: VrfProductionRequest[] = [
|
||||
]
|
||||
for (const changed of invalidRequests) { assert.throws(() => assertVrfActionContext(context, changed)); cases++ }
|
||||
assert.throws(() => assertVrfActionContext({ ...context, authorityAction: { id: "routing.vrf.update", version: 2 } } as unknown as VrfTicketContext, request)); cases++
|
||||
assert.throws(() => assertVrfActionContext({ ...context, authorityAction: { id: "routing.vrf.update", version: 3 } } as unknown as VrfTicketContext, request)); cases++
|
||||
assert.throws(() => assertVrfActionContext({ ...context, actionId: "ros.vrf.delete" }, request)); cases++
|
||||
const snapshot: RosSnapshot = { serverId: 1, resource: "vrf", rows: [{ ".id": "*a", interfaces: "owned-a" }], fingerprint: "a".repeat(64), sourceProof: "b".repeat(64), projectionVersion: 3 }
|
||||
assert.equal(dedupeVrfAliasSnapshots([snapshot, structuredClone(snapshot)]).length, 1); cases++
|
||||
|
||||
@@ -11,7 +11,7 @@ export interface VrfActionContext {
|
||||
actionId: VrfNativeActionId
|
||||
actionVersion: number
|
||||
/** Actual public authority, never a canonical permission substitution. */
|
||||
authorityAction?: { id: "routing.vrf.update"; version: 3 }
|
||||
authorityAction?: { id: "routing.vrf.update"; version: 4 }
|
||||
}
|
||||
const refuse = (reason: string): never => { throw Error("VRF action binding refused: " + reason) }
|
||||
export function vrfPublicAuthority(context: VrfActionContext): { id: VrfAuthorityActionId; version: number } {
|
||||
@@ -26,7 +26,7 @@ export function vrfNativeActionFor(publicId: string, request: VrfProductionReque
|
||||
export function assertVrfActionContext(context: VrfActionContext, request: VrfProductionRequest): void {
|
||||
const authority = vrfPublicAuthority(context)
|
||||
if (!Number.isSafeInteger(context.actionVersion) || context.actionVersion < 1 || vrfNativeActionFor(authority.id, request) !== context.actionId) refuse("native action/version")
|
||||
if (context.authorityAction && (context.authorityAction.id !== "routing.vrf.update" || context.authorityAction.version !== 3 || request.action !== "patch" || !request.id || !/^\*[a-f0-9]+$/i.test(request.id) || request.placeBeforeId !== undefined || Object.keys(request.fields).length !== 1 || typeof request.fields.interfaces !== "string")) refuse("alias must be one exact interfaces PATCH")
|
||||
if (context.authorityAction && (context.authorityAction.id !== "routing.vrf.update" || context.authorityAction.version !== 4 || request.action !== "patch" || !request.id || !/^\*[a-f0-9]+$/i.test(request.id) || request.placeBeforeId !== undefined || Object.keys(request.fields).length !== 1 || typeof request.fields.interfaces !== "string")) refuse("alias must be one exact interfaces PATCH")
|
||||
}
|
||||
/** Registry versions are protocol fences, not permission grants. */
|
||||
export function vrfActionContractsCurrent(context: VrfActionContext): boolean {
|
||||
|
||||
@@ -22,7 +22,7 @@ const request: VrfProductionRequest = { action: "patch", id: "*1", fields: { nam
|
||||
const issued = sealVrfProductionAdmission({ snapshot: snapshot(), binding, request, secret, now })
|
||||
const input = () => ({ sealed: issued.sealed, snapshot: snapshot(), binding: structuredClone(binding), request: structuredClone(request), secret, now: now + 1 })
|
||||
const read = inspectVrfProductionAdmission(input())
|
||||
assert.equal(read.admission.version, 2)
|
||||
assert.equal(read.admission.version, 3)
|
||||
assert.equal(read.admission.companionExecution, "requires-native-transition-proof")
|
||||
assert.equal(read.admission.members[0].id, "*11")
|
||||
assert.deepEqual(read.admission.members[0].parents.map(row => [row.id, row.configurationId]), [["*11", "*21"], ["*10", "*20"]])
|
||||
@@ -68,11 +68,10 @@ for (const [resource, field] of [["interface_inventory", "rx-byte"], ["ipv4_rout
|
||||
const fresh = input(); fresh.snapshot.catalogs[resource][0][field] = "changed-live-telemetry"
|
||||
assert.equal(inspectVrfProductionAdmission(fresh).digest, issued.digest)
|
||||
}
|
||||
// Old globally projected admissions cannot be replayed under v2 even with an
|
||||
// otherwise correct MAC/key. Both the private signature domain and schema
|
||||
// version changed; no durable SQL migration or public tool version is needed.
|
||||
// Old admissions cannot be replayed under v3 even with the correct key.
|
||||
// Private schema/domains and the four VRF operation versions changed together.
|
||||
const oldPayload = Buffer.from(JSON.stringify({ ...issued.admission, version: 1 })).toString("base64url")
|
||||
for (const domain of ["mmapp-vrf-production-admission-v1\0", "mmapp-vrf-production-admission-v2\0"]) {
|
||||
for (const domain of ["mmapp-vrf-production-admission-v1\0", "mmapp-vrf-production-admission-v2\0", "mmapp-vrf-production-admission-v3\0"]) {
|
||||
refuse(value => { value.sealed = oldPayload + "." + createHmac("sha256", secret).update(domain).update(oldPayload).digest("hex") })
|
||||
}
|
||||
for (const field of ["actorId", "planId", "sourceProof"] as const) refuse(value => { value.binding[field] = "different" })
|
||||
|
||||
@@ -27,7 +27,7 @@ export interface VrfProductionMember {
|
||||
addresses: Array<{ resource: "ipv4_address" | "ipv6_address"; id: string; parentId: string; configurationHash: string }>
|
||||
}
|
||||
export interface VrfProductionAdmission {
|
||||
version: 2
|
||||
version: 3
|
||||
ticketId: string
|
||||
issuedAt: number
|
||||
expiresAt: number
|
||||
@@ -46,7 +46,7 @@ export const VRF_PRODUCTION_REQUIRED_CATALOGS = ["bridge", "bridge_port", "bridg
|
||||
const idPattern = /^\*[a-f0-9]+$/i
|
||||
const proofPattern = /^[a-f0-9]{64}$/i
|
||||
const singleton = new Set(["ip_settings", "ipv6_settings"])
|
||||
const interfaceResources: Record<string, string> = { ether: "ethernet", ethernet: "ethernet", bridge: "bridge", vlan: "vlan", wireguard: "wireguard", "gre-tunnel": "gre", "ipip-tunnel": "ipip", "eoip-tunnel": "eoip", vxlan: "vxlan", bond: "bonding", bonding: "bonding", "pppoe-out": "pppoe_client" }
|
||||
const interfaceResources: Record<string, string> = { ether: "ethernet", ethernet: "ethernet", bridge: "bridge", vlan: "vlan", wg: "wireguard", wireguard: "wireguard", "gre-tunnel": "gre", "ipip-tunnel": "ipip", "eoip-tunnel": "eoip", vxlan: "vxlan", bond: "bonding", bonding: "bonding", "pppoe-out": "pppoe_client" }
|
||||
const nativeIdentity = (id: string): string => id.slice(1).replace(/^0+/, "").toLowerCase() || "0"
|
||||
function requireAdmission(condition: unknown, reason: string): asserts condition {
|
||||
if (!condition) throw new Error(`VRF production admission refused: ${reason}`)
|
||||
@@ -62,7 +62,7 @@ function canonical(value: unknown, depth = 0): string {
|
||||
// low-entropy configuration values in a persisted ticket. Tickets remain
|
||||
// server-private: their authenticated envelope does not encrypt its payload.
|
||||
type DigestPurpose = "snapshot" | "member" | "parent" | "address" | "ticket"
|
||||
const hash = (value: unknown, secret: Uint8Array, purpose: DigestPurpose): string => createHmac("sha256", secret).update(`mmapp-vrf-production-${purpose}-digest-v2\0`).update(canonical(value)).digest("hex")
|
||||
const hash = (value: unknown, secret: Uint8Array, purpose: DigestPurpose): string => createHmac("sha256", secret).update(`mmapp-vrf-production-${purpose}-digest-v3\0`).update(canonical(value)).digest("hex")
|
||||
function validateBinding(binding: VrfProductionBinding): void {
|
||||
requireAdmission(Number.isSafeInteger(binding.serverId) && binding.serverId > 0 && proofPattern.test(binding.sourceProof), "server/source binding")
|
||||
requireAdmission(typeof binding.actorId === "string" && binding.actorId.length > 0 && binding.actorId.length <= 200 && typeof binding.planId === "string" && binding.planId.length > 0 && binding.planId.length <= 200, "human/plan binding")
|
||||
@@ -194,7 +194,7 @@ function buildMembers(catalogs: Record<string, VrfProductionRow[]>, request: Vrf
|
||||
})
|
||||
}
|
||||
function key(secret: Uint8Array): void { requireAdmission(secret instanceof Uint8Array && secret.byteLength >= 32, "weak sealing key") }
|
||||
function signature(payload: string, secret: Uint8Array): string { return createHmac("sha256", secret).update("mmapp-vrf-production-admission-v2\0").update(payload).digest("hex") }
|
||||
function signature(payload: string, secret: Uint8Array): string { return createHmac("sha256", secret).update("mmapp-vrf-production-admission-v3\0").update(payload).digest("hex") }
|
||||
|
||||
/** Trusted prepare path only: authenticate the human and validate permission
|
||||
* before calling. Persist the returned ticket ID/digest with the plan in the
|
||||
@@ -205,7 +205,7 @@ export function sealVrfProductionAdmission(input: { snapshot: VrfProductionSnaps
|
||||
requireAdmission(Number.isSafeInteger(input.now) && input.now >= 0 && Number.isSafeInteger(ttl) && ttl > 0 && ttl <= 300000 && Number.isSafeInteger(input.now + ttl), "invalid ticket lifetime")
|
||||
const catalogs = validateSnapshot(input.snapshot, input.binding)
|
||||
const selected = buildMembers(catalogs, input.request, input.secret)
|
||||
const admission: VrfProductionAdmission = { version: 2, ticketId: randomUUID(), issuedAt: input.now, expiresAt: input.now + ttl, binding: structuredClone(input.binding), request: structuredClone(input.request), snapshotHash: hash(catalogs, input.secret, "snapshot"), members: selected, companionExecution: "requires-native-transition-proof" }
|
||||
const admission: VrfProductionAdmission = { version: 3, ticketId: randomUUID(), issuedAt: input.now, expiresAt: input.now + ttl, binding: structuredClone(input.binding), request: structuredClone(input.request), snapshotHash: hash(catalogs, input.secret, "snapshot"), members: selected, companionExecution: "requires-native-transition-proof" }
|
||||
const payload = Buffer.from(canonical(admission)).toString("base64url")
|
||||
return { sealed: `${payload}.${signature(payload, input.secret)}`, admission, digest: hash(admission, input.secret, "ticket") }
|
||||
}
|
||||
@@ -218,7 +218,7 @@ export function inspectVrfProductionAdmission(input: { sealed: string; secret: U
|
||||
requireAdmission(extra === undefined && /^[A-Za-z0-9_-]+$/.test(payload ?? "") && proofPattern.test(mac ?? ""), "invalid sealed envelope")
|
||||
requireAdmission(timingSafeEqual(Buffer.from(mac, "hex"), Buffer.from(signature(payload, input.secret), "hex")), "ticket signature changed")
|
||||
const admission = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as VrfProductionAdmission
|
||||
requireAdmission(admission.version === 2 && admission.companionExecution === "requires-native-transition-proof" && typeof admission.ticketId === "string" && /^[a-f0-9-]{36}$/.test(admission.ticketId), "unknown ticket schema")
|
||||
requireAdmission(admission.version === 3 && admission.companionExecution === "requires-native-transition-proof" && typeof admission.ticketId === "string" && /^[a-f0-9-]{36}$/.test(admission.ticketId), "unknown ticket schema")
|
||||
requireAdmission(Number.isSafeInteger(input.now) && Number.isSafeInteger(admission.issuedAt) && Number.isSafeInteger(admission.expiresAt) && input.now >= admission.issuedAt && input.now < admission.expiresAt && admission.expiresAt - admission.issuedAt <= 300000, "expired/future ticket")
|
||||
requireAdmission(canonical(input.binding) === canonical(admission.binding) && canonical(input.request) === canonical(admission.request), "human/plan/source/request changed")
|
||||
const catalogs = validateSnapshot(input.snapshot, input.binding)
|
||||
|
||||
@@ -9,6 +9,7 @@ import { assertVrfActionContext, vrfNativeActionFor, vrfActionContractsCurrent,
|
||||
import { findMcpOperation } from "../modules/mcp/registry.js"
|
||||
import { decryptSecretExisting, encryptSecret, fingerprint, McpError, withVrfProductionSealingKey } from "../modules/mcp/security.js"
|
||||
import { configurationRows, resourceById, routerClient, rosSnapshotSourceProof, type RosSnapshot, type RosStep } from "../modules/mcp/resources.js"
|
||||
import { notifyVrfDiagnostic, vrfExecutionDiagnostic, type VrfExecutionDiagnostic, type VrfExecutionStage, type VrfRawReadObservation } from "./vrf-execution-diagnostic.js"
|
||||
|
||||
export interface VrfProductionExecutionInput {
|
||||
operationId: string
|
||||
@@ -28,6 +29,8 @@ export interface VrfProductionExecutionInput {
|
||||
/** The existing native policy invokes this AFTER configuration.intent and
|
||||
* before actual HTTP. The runtime owns the closure; never a JSON field. */
|
||||
installBeforeDispatch(guard: () => Promise<void>): void
|
||||
/** Private in-process observation only; never authority or public evidence. */
|
||||
onDiagnostic?(value: VrfExecutionDiagnostic): unknown
|
||||
}
|
||||
export interface VrfProductionExecutionReceipt {
|
||||
kind: "vrf-production-execution-v1"
|
||||
@@ -121,7 +124,7 @@ export async function executeVrfProductionStep(original: VrfProductionExecutionI
|
||||
const actionId = vrfNativeActionFor(input.operationName, request)
|
||||
const context: VrfTicketContext = { binding, connectionId: input.connectionId, actionId,
|
||||
actionVersion: input.operationName === "routing.vrf.update" ? Number(findMcpOperation(actionId)?.version) : input.operationVersion,
|
||||
...(input.operationName === "routing.vrf.update" ? { authorityAction: { id: "routing.vrf.update" as const, version: input.operationVersion as 3 } } : {}) }
|
||||
...(input.operationName === "routing.vrf.update" ? { authorityAction: { id: "routing.vrf.update" as const, version: input.operationVersion as 4 } } : {}) }
|
||||
assertVrfActionContext(context, request)
|
||||
const assertSource = async () => {
|
||||
await input.authorize()
|
||||
@@ -130,61 +133,106 @@ export async function executeVrfProductionStep(original: VrfProductionExecutionI
|
||||
await input.authorize()
|
||||
}
|
||||
let acknowledged = false
|
||||
let executorAckObserved = false, diagnosticReported = false
|
||||
let stage: VrfExecutionStage = "initial-authorization", read: VrfRawReadObservation | undefined
|
||||
const mark = (next: VrfExecutionStage) => { stage = next; read = undefined }
|
||||
const observeRead = (value: VrfRawReadObservation) => { read = value }
|
||||
const report = (error: unknown) => {
|
||||
if (diagnosticReported) return
|
||||
diagnosticReported = true
|
||||
try {
|
||||
const diagnostic = vrfExecutionDiagnostic(input.operationId, request.action, stage, error, executorAckObserved, read)
|
||||
if (diagnostic) notifyVrfDiagnostic(input.onDiagnostic, diagnostic)
|
||||
} catch { /* Original exception and acknowledgement handling stay authoritative. */ }
|
||||
}
|
||||
const authorize = async () => { await assertVerifiedConfigurationAccess(); await input.authorize(); if (!vrfActionContractsCurrent(context)) throw new McpError("PLAN_EXPIRED", "Native/public VRF contract изменился; повтор запрещён", 409); await assertIntent(input, acknowledged); await assertSource() }
|
||||
await authorize()
|
||||
try { return await withVrfProductionSealingKey(async secret => {
|
||||
try {
|
||||
await authorize()
|
||||
mark("sealing-key")
|
||||
return await withVrfProductionSealingKey(async secret => {
|
||||
mark("history-load")
|
||||
const previous = await loadVerifiedVrfProductionHistory({ sql: pool, ownerId: input.ownerId, serverId: binding.serverId, sourceProof: binding.sourceProof, nativeId: request.id, secret })
|
||||
const before = await readVrfProductionSnapshot({ serverId: binding.serverId, expectedSourceProof: binding.sourceProof, request, assertAuthority: authorize })
|
||||
mark("raw-before")
|
||||
const before = await readVrfProductionSnapshot({ serverId: binding.serverId, expectedSourceProof: binding.sourceProof, request, assertAuthority: authorize, observeRead })
|
||||
mark("original-dependencies")
|
||||
for (const original of input.originalSnapshots) {
|
||||
if (before.catalogs[original.resource] === undefined) continue
|
||||
insist(original.serverId === binding.serverId && original.sourceProof === binding.sourceProof && fingerprint(configurationRows(resourceById(original.resource), before.catalogs[original.resource])) === original.fingerprint, "Original VRF dependency projection изменилась; новый raw ticket не разрешает adoption")
|
||||
}
|
||||
mark("history-provenance")
|
||||
if (previous) assertVrfProductionHistoryProvenance(previous, before)
|
||||
mark("supported-shape")
|
||||
supported(before, request)
|
||||
mark("ticket-lookup")
|
||||
const tickets = await pool.query<{ ticket_id: string }>("SELECT ticket_id FROM vrf_production_tickets WHERE plan_id=$1 AND connection_id=$2", [input.planId, input.connectionId])
|
||||
insist(tickets.rows.length === 1, "Нет единственного authentic VRF preparation ticket")
|
||||
mark("ticket-claim")
|
||||
const claimed = await withVrfClaimQuarantine({ operationId: input.operationId, planId: input.planId, connectionId: input.connectionId, ownerId: input.ownerId, journal: pool,
|
||||
claim: () => claimStoredVrfProductionTicket({ context, request, secret, execution: { operationId: input.operationId, stepIndex: input.stepIndex }, sql: pool, ticketId: tickets.rows[0].ticket_id, snapshot: before, assertAuthority: authorize, assertCurrentSource: assertSource }) })
|
||||
insist(typeof claimed.privateSealed === "string", "Нет authentic private VRF admission")
|
||||
const sealed = claimed.privateSealed
|
||||
mark("checkpoint-before")
|
||||
const beforeJournal = await pool.query("UPDATE mcp_operation_checkpoints SET before_sealed=$3 WHERE operation_id=$1 AND step_index=$2 RETURNING operation_id", [input.operationId, input.stepIndex, await encryptSecret(JSON.stringify({ kind: "vrf-production-before-v1", before }))])
|
||||
insist(beforeJournal.rows.length === 1, "Исходный private VRF checkpoint не подтверждён; dispatch запрещён")
|
||||
const preDispatch = async () => {
|
||||
await authorize(); await input.assertDependencies()
|
||||
const current = await readVrfProductionSnapshot({ serverId: binding.serverId, expectedSourceProof: binding.sourceProof, request, requiredCatalogs: Object.keys(before.catalogs), assertAuthority: authorize })
|
||||
inspectVrfProductionAdmission({ snapshot: current, binding, request, sealed, secret, now: Date.now() })
|
||||
const preDispatch = async (installed = false) => {
|
||||
const prefix = installed ? "installed" : "explicit"
|
||||
mark(`${prefix}-predispatch-authorization`)
|
||||
await authorize()
|
||||
mark(`${prefix}-predispatch-dependencies`)
|
||||
await input.assertDependencies()
|
||||
mark(`${prefix}-predispatch-read`)
|
||||
const current = await readVrfProductionSnapshot({ serverId: binding.serverId, expectedSourceProof: binding.sourceProof, request, requiredCatalogs: Object.keys(before.catalogs), assertAuthority: authorize, observeRead })
|
||||
mark(`${prefix}-predispatch-admission`)
|
||||
inspectVrfProductionAdmission({ snapshot: current, binding, request, sealed, secret, now: Date.now() })
|
||||
mark(`${prefix}-predispatch-final-authorization`)
|
||||
await authorize()
|
||||
if (installed) mark("client-call")
|
||||
}
|
||||
input.installBeforeDispatch(preDispatch)
|
||||
mark("install-predispatch")
|
||||
input.installBeforeDispatch(() => preDispatch(true))
|
||||
await preDispatch()
|
||||
mark("dispatch-source")
|
||||
const { client, server } = await routerClient(binding.serverId)
|
||||
insist(await rosSnapshotSourceProof(server) === binding.sourceProof, "VRF dispatch source изменился")
|
||||
const path = "/ip/vrf" + (request.id ? "/" + encodeURIComponent(request.id) : "")
|
||||
let deleteAck: unknown
|
||||
mark("client-call")
|
||||
const ack = request.action === "create" ? await client.put(path, { ...request.fields, ...(request.placeBeforeId ? { "place-before": request.placeBeforeId } : {}) })
|
||||
: request.action === "delete" ? (await client.delete(path, 10000, undefined, body => {
|
||||
acknowledged = true
|
||||
executorAckObserved = true
|
||||
mark("ack-identity")
|
||||
try { deleteAck = body.trim() ? JSON.parse(body) : undefined } catch { throw new McpError("VERIFICATION_FAILED", "Native VRF DELETE ACK имеет неизвестный body; повтор запрещён", 409) }
|
||||
}), deleteAck) : await client.patch(path, request.fields)
|
||||
executorAckObserved = true
|
||||
mark("ack-identity")
|
||||
const acknowledgedId = request.action === "create" && ack && typeof ack === "object" ? (ack as Record<string, unknown>)[".id"] : request.id
|
||||
insist(typeof acknowledgedId === "string", "Нет точного native ACK ID; повтор запрещён")
|
||||
// Receipt is already observed even if the following durable journal fails.
|
||||
acknowledged = true
|
||||
if (request.action !== "create" && ack && typeof ack === "object" && Object.hasOwn(ack, ".id") && (ack as Record<string, unknown>)[".id"] !== request.id) throw new McpError("VERIFICATION_FAILED", "Native VRF ACK содержит противоречащий target ID; повтор запрещён", 409)
|
||||
mark("ack-journal")
|
||||
try {
|
||||
const ackJournal = await pool.query("UPDATE mcp_operation_steps SET state='applied',result=$3::jsonb,finished_at=clock_timestamp() WHERE operation_id=$1 AND step_index=$2 AND state='intent' RETURNING operation_id", [input.operationId, input.stepIndex, JSON.stringify({ kind: "vrf-production-ack-v1", nativeId: acknowledgedId, action: request.action })])
|
||||
insist(ackJournal.rows.length === 1, "VRF ACK journal не подтверждён")
|
||||
} catch { throw new McpError("VRF_ACK_JOURNAL_UNCONFIRMED", "Native VRF ACK получен, durable journal не подтверждён; сверка без повтора", 409) }
|
||||
} catch (error) { report(error); throw new McpError("VRF_ACK_JOURNAL_UNCONFIRMED", "Native VRF ACK получен, durable journal не подтверждён; сверка без повтора", 409) }
|
||||
mark("post-ack-authorization")
|
||||
await authorize()
|
||||
const after = await readVrfProductionSnapshot({ serverId: binding.serverId, expectedSourceProof: binding.sourceProof, request: vrfProductionReadSelection(input.step, before.catalogs.vrf.find(row => row[".id"] === request.id)?.interfaces), requiredCatalogs: Object.keys(before.catalogs), assertAuthority: authorize })
|
||||
mark("raw-after")
|
||||
const after = await readVrfProductionSnapshot({ serverId: binding.serverId, expectedSourceProof: binding.sourceProof, request: vrfProductionReadSelection(input.step, before.catalogs.vrf.find(row => row[".id"] === request.id)?.interfaces), requiredCatalogs: Object.keys(before.catalogs), assertAuthority: authorize, observeRead })
|
||||
mark("transition-classification")
|
||||
const classified = classifyVrfProductionTransition({ before, after, binding, request, sealed, secret, now: Date.now(), acknowledgedId, previous })
|
||||
await input.assertDependencies(); await authorize()
|
||||
mark("post-ack-dependencies")
|
||||
await input.assertDependencies()
|
||||
mark("post-ack-final-authorization")
|
||||
await authorize()
|
||||
mark("checkpoint-after")
|
||||
try {
|
||||
const checkpoint = sealVrfProductionTransitionCheckpoint(classified.checkpoint, { serverId: binding.serverId, sourceProof: binding.sourceProof, actorId: binding.actorId, nativeId: acknowledgedId }, secret)
|
||||
const persisted = await pool.query("UPDATE mcp_operation_checkpoints SET after_sealed=$3 WHERE operation_id=$1 AND step_index=$2 RETURNING operation_id", [input.operationId, input.stepIndex, await encryptSecret(JSON.stringify({ kind: "vrf-production-private-checkpoint-v1", sealed: checkpoint }))])
|
||||
insist(persisted.rows.length === 1, "Verified private VRF checkpoint не подтверждён")
|
||||
} catch { throw new McpError("VRF_VERIFIED_CHECKPOINT_UNCONFIRMED", "Native VRF ACK получен, private checkpoint не подтверждён; сверка без повтора", 409) }
|
||||
} catch (error) { report(error); throw new McpError("VRF_VERIFIED_CHECKPOINT_UNCONFIRMED", "Native VRF ACK получен, private checkpoint не подтверждён; сверка без повтора", 409) }
|
||||
const receipt: VrfProductionExecutionReceipt = { kind: "vrf-production-execution-v1", action: request.action, nativeId: acknowledgedId, configurationVerified: true, forwardingVerified: false }
|
||||
return receipt
|
||||
}) } catch (error) { if (acknowledged) throw new VrfProductionAcknowledgedFailure(error); throw error }
|
||||
}) } catch (error) { report(error); if (acknowledged) throw new VrfProductionAcknowledgedFailure(error); throw error }
|
||||
}
|
||||
@@ -0,0 +1,210 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { createHmac } from "node:crypto"
|
||||
import { readFile } from "node:fs/promises"
|
||||
import { sealVrfProductionAdmission, VRF_PRODUCTION_REQUIRED_CATALOGS, type VrfProductionRequest, type VrfProductionSnapshot, type VrfProductionRow as Row } from "./vrf-production-admission.js"
|
||||
import { vrfProductionDependencyObjects, classifyVrfProductionTransition, sealVrfProductionTransitionCheckpoint, openVrfProductionTransitionCheckpoint, assertVrfProductionHistoryProvenance, type VrfProductionTransitionCheckpoint } from "./vrf-production-transition.js"
|
||||
|
||||
const secret = Buffer.alloc(32, 7), now = 1000, sourceProof = "a".repeat(64)
|
||||
const binding = { serverId: 7, sourceProof, actorId: "human", planId: "gre-local-proof" }
|
||||
let cases = 0
|
||||
const report = JSON.parse(await readFile(new URL("../../../docs/mcp-chr-vrf-companion-native-v5.json", import.meta.url), "utf8"))
|
||||
// Lifecycle shapes come from the existing native bridge fixture. Converting
|
||||
// the concrete parents and auto-LL below is a pure synthetic GRE lifecycle
|
||||
// model, not evidence that those GRE lifecycle reads ran on native routers.
|
||||
function snapshot(phase: string, gre = true, macBackedGre = false): VrfProductionSnapshot {
|
||||
const raw = report.phases.find((item: { phase: string }) => item.phase === phase)
|
||||
const catalogs: Record<string, Row[]> = Object.fromEntries(VRF_PRODUCTION_REQUIRED_CATALOGS.map(key => [key, structuredClone(raw.owned[key].raw)]))
|
||||
catalogs.vrf.push({ ".id": "*0", name: "main", interfaces: "all", disabled: "false", builtin: "true" })
|
||||
catalogs.routing_table.unshift({ ".id": "*0", name: "main", dynamic: "true", fib: "true" })
|
||||
catalogs.ip_settings = [{}]; catalogs.ipv6_settings = [{}]
|
||||
if (!gre) return { projection: "raw-native-v1", serverId: 7, sourceProof, catalogs }
|
||||
catalogs.gre = catalogs.bridge.map((row, index) => ({ ".id": row[".id"], name: row.name, "local-address": `198.18.245.${index ? 13 : 9}`, "remote-address": `198.18.245.${index ? 14 : 10}` }))
|
||||
const greNames = new Set(catalogs.gre.map(row => row.name))
|
||||
for (const row of catalogs.interface_inventory) if (greNames.has(row.name)) { row.type = "gre-tunnel"; if (!macBackedGre) delete row["mac-address"] }
|
||||
if (!macBackedGre) for (const row of catalogs.ipv6_address) if (row.dynamic === "true" && greNames.has(row.interface)) {
|
||||
row.address = row.interface === catalogs.gre[0].name ? "fe80::2:c612:f50a/64" : "fe80::2:c612:f50e/64"
|
||||
// Synthetic correction from observed GRE context; not native lifecycle proof.
|
||||
row.vrf = catalogs.interface_inventory.find(item => item.name === row.interface)!.vrf
|
||||
}
|
||||
if (!macBackedGre) for (const row of catalogs.interface_inventory.filter(item => greNames.has(item.name))) {
|
||||
// Synthetic ordered-context cycle model, not native forward-cycle proof.
|
||||
const contextPhases = ["addresses-before-vrf", "vrf-create", "vrf-rename", "vrf-disable", "vrf-reenable", "vrf-membership-transfer-a-to-b", "vrf-delete-addresses-remain"]
|
||||
let previous = "main", cycles = 0
|
||||
for (const step of contextPhases.slice(0, contextPhases.indexOf(phase) + 1)) {
|
||||
const vector = report.phases.find((item: { phase: string }) => item.phase === step)
|
||||
const current = String(vector.owned.interface_inventory.raw.find((item: Row) => item.name === row.name).vrf)
|
||||
if (current !== previous) cycles++
|
||||
previous = current
|
||||
}
|
||||
const clock = (seconds: number) => new Date(Date.UTC(2026, 0, 1, 0, 0, seconds)).toISOString().slice(0, 19).replace("T", " ")
|
||||
row["link-downs"] = String(cycles); row["last-link-up-time"] = clock(cycles * 2)
|
||||
if (cycles) row["last-link-down-time"] = clock(cycles * 2 - 1)
|
||||
else delete row["last-link-down-time"]
|
||||
}
|
||||
catalogs.bridge = []
|
||||
catalogs.wireguard = [{ ".id": "*ff11", name: "gre-source-wg" }]; catalogs.wireguard_peer = []
|
||||
catalogs.interface_inventory.push({ ".id": "*ff11", name: "gre-source-wg", type: "wg", vrf: "main" })
|
||||
for (const [index, host] of [9, 13].entries()) catalogs.ipv4_address.push({ ".id": `*ff2${index}`, interface: "gre-source-wg", address: `198.18.245.${host}/30`, dynamic: "false", disabled: "false", vrf: "main" })
|
||||
return { projection: "raw-native-v1", serverId: 7, sourceProof, catalogs }
|
||||
}
|
||||
function input(before: VrfProductionSnapshot, after: VrfProductionSnapshot, request: VrfProductionRequest, previous?: VrfProductionTransitionCheckpoint, acknowledgedId?: string) {
|
||||
const issued = sealVrfProductionAdmission({ snapshot: before, binding, request, secret, now })
|
||||
return { before, after, request, previous, acknowledgedId, binding, secret, now, sealed: issued.sealed }
|
||||
}
|
||||
const stages = ["vrf-create", "vrf-rename", "vrf-disable", "vrf-reenable", "vrf-membership-transfer-a-to-b", "vrf-delete-addresses-remain"]
|
||||
const inputs: ReturnType<typeof input>[] = []
|
||||
let before = snapshot("addresses-before-vrf"), previous: VrfProductionTransitionCheckpoint | undefined
|
||||
for (const phase of stages) {
|
||||
const command = report.journal.find((item: { phase: string }) => item.phase === phase), after = snapshot(phase)
|
||||
const request: VrfProductionRequest = { action: command.method === "PUT" ? "create" : command.method === "DELETE" ? "delete" : "patch", ...(command.id ? { id: command.id } : {}), fields: command.fields, ...(command.method === "PUT" ? { placeBeforeId: "*0" } : {}) }
|
||||
const current = input(before, after, request, previous, command.assignedId)
|
||||
const result = classifyVrfProductionTransition(current)
|
||||
const scope = { serverId: 7, sourceProof, actorId: binding.actorId, nativeId: command.assignedId ?? command.id }
|
||||
const sealed = sealVrfProductionTransitionCheckpoint(result.checkpoint, scope, secret)
|
||||
previous = openVrfProductionTransitionCheckpoint(sealed, scope, secret)
|
||||
assertVrfProductionHistoryProvenance(previous, after)
|
||||
inputs.push(current); before = after; cases++
|
||||
}
|
||||
// These four LL/endpoints/no-MAC inventory observations are from the exact V29
|
||||
// native capture. Unrelated raw17 and concrete parent defaults are synthetic.
|
||||
for (const [id, name, local, remote, ll] of [
|
||||
["*2A", "mcp-route-8b47e64eec5a-gre-a", "198.18.245.9", "198.18.245.10", "fe80::2:c612:f50a/64"],
|
||||
["*2B", "mcp-route-8b47e64eec5a-gre-b", "198.18.245.13", "198.18.245.14", "fe80::2:c612:f50e/64"],
|
||||
["*1E", "mcp-route-8b47e64eec5a-gre-a", "198.18.245.10", "198.18.245.9", "fe80::2:c612:f509/64"],
|
||||
["*1F", "mcp-route-8b47e64eec5a-gre-b", "198.18.245.14", "198.18.245.13", "fe80::2:c612:f50d/64"],
|
||||
]) {
|
||||
const s = snapshot("addresses-before-vrf")
|
||||
s.catalogs.gre = [{ ".id": id, name, "local-address": local, "remote-address": remote }]
|
||||
s.catalogs.interface_inventory = [{ ".id": id, name, type: "gre-tunnel", vrf: "main", disabled: "false", running: "true" }, { ".id": "*ff11", name: "gre-source-wg", type: "wg", vrf: "main" }]
|
||||
s.catalogs.ipv4_address = [{ ".id": "*ff20", address: `${local}/30`, interface: "gre-source-wg", disabled: "false", dynamic: "false", vrf: "main" }]
|
||||
s.catalogs.ipv6_address = [{ ".id": "*33", address: ll, interface: name, "actual-interface": name, dynamic: "true", disabled: "false", invalid: "false", vrf: "main", "auto-link-local": "true", "link-local": "true" }]
|
||||
s.catalogs.ipv6_route = [{ ".id": "*ff30", "dst-address": "fe80::/64", dynamic: "true", connect: "true", "routing-table": "main", gateway: name, "immediate-gw": name }]
|
||||
const request: VrfProductionRequest = { action: "create", placeBeforeId: "*0", fields: { name: "capture-vrf", interfaces: name } }
|
||||
const { admission } = sealVrfProductionAdmission({ snapshot: s, binding, request, secret, now })
|
||||
assert.ok(vrfProductionDependencyObjects(s, admission).some(row => row.kind === "ipv6_route")); cases++
|
||||
}
|
||||
const base = inputs[0]
|
||||
const selected = String(base.request.fields.interfaces)
|
||||
const ll = (s: VrfProductionSnapshot) => s.catalogs.ipv6_address.find(row => row.interface === selected && row.dynamic === "true")!
|
||||
const inventory = (s: VrfProductionSnapshot) => s.catalogs.interface_inventory.find(row => row.name === selected)!
|
||||
for (const mutate of [
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre[0]["remote-address"] = "198.18.245.99" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre[0]["local-address"] = "198.18.245.99" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre = [] },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre.push({ ...s.catalogs.gre[0], ".id": "*ff88" }) },
|
||||
(s: VrfProductionSnapshot) => { inventory(s).type = "ether" },
|
||||
(s: VrfProductionSnapshot) => { inventory(s)["mac-address"] = "02:00:00:00:00:01" },
|
||||
...["auto-link-local", "link-local", "disabled"].map(field => (s: VrfProductionSnapshot) => { ll(s)[field] = field === "disabled" ? "true" : "false" }),
|
||||
(s: VrfProductionSnapshot) => { ll(s).address = "fe80::2:c612:f50a/128" },
|
||||
(s: VrfProductionSnapshot) => { ll(s).address = "fe80::cafe/64" },
|
||||
(s: VrfProductionSnapshot) => { ll(s)["actual-interface"] = "foreign" },
|
||||
(s: VrfProductionSnapshot) => { ll(s).invalid = "true" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.ipv6_route[0].gateway = "foreign" },
|
||||
]) {
|
||||
const changed = structuredClone(base.before); mutate(changed)
|
||||
assert.throws(() => { const issued = sealVrfProductionAdmission({ snapshot: changed, binding, request: base.request, secret, now }); vrfProductionDependencyObjects(changed, issued.admission) }, /VRF production/); cases++
|
||||
}
|
||||
// Parent/config/endpoint changes cannot hide behind a newly approved before,
|
||||
// nor behind serialized checkpoint histories while an acquired LL is absent.
|
||||
const absentInput = inputs[5], checkpoint = absentInput.previous!
|
||||
for (const mutate of [
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre[1][".id"] = "*ff99" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre[1]["remote-address"] = "198.18.245.15" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre[1]["local-address"] = "198.18.245.9" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.wireguard[0][".id"] = "*ff99" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.interface_inventory.find(row => row.type === "wg")![".id"] = "*ff98" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.interface_inventory.find(row => row.type === "wg")!.type = "ether" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.ipv4_address.find(row => row.interface === "gre-source-wg")![".id"] = "*ff98" },
|
||||
(s: VrfProductionSnapshot) => { const row = s.catalogs.ipv4_address.find(row => row.interface === "gre-source-wg")!; row.address = String(row.address).replace("/30", "/29") },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.interface_inventory.find(row => row.name === s.catalogs.gre[1].name)!["mac-address"] = "02:00:00:00:00:01" },
|
||||
]) { const changed = structuredClone(absentInput.before); mutate(changed); assert.throws(() => assertVrfProductionHistoryProvenance(checkpoint, changed)); cases++ }
|
||||
const foreign = structuredClone(base.after); foreign.catalogs.ipv6_route.push({ ".id": "*ffaa", opaque: "foreign" })
|
||||
assert.throws(() => classifyVrfProductionTransition({ ...base, after: foreign })); cases++
|
||||
const staticAdoption = structuredClone(base.after); ll(staticAdoption).dynamic = "false"
|
||||
assert.throws(() => classifyVrfProductionTransition({ ...base, after: staticAdoption })); cases++
|
||||
for (const mutate of [
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre[0][".id"] = "*ff99" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre[0]["remote-address"] = "198.18.245.11"; ll(s).address = "fe80::2:c612:f50b/64" },
|
||||
(s: VrfProductionSnapshot) => { s.catalogs.gre[0]["local-address"] = "198.18.245.13" },
|
||||
(s: VrfProductionSnapshot) => { inventory(s).type = "bridge" },
|
||||
(s: VrfProductionSnapshot) => { inventory(s)["mac-address"] = "02:00:00:00:00:01" },
|
||||
]) { const changed = structuredClone(base.after); mutate(changed); assert.throws(() => classifyVrfProductionTransition({ ...base, after: changed })); cases++ }
|
||||
assert.throws(() => classifyVrfProductionTransition({ ...base, now: now + 300000 })); cases++
|
||||
assert.throws(() => classifyVrfProductionTransition({ ...base, binding: { ...binding, actorId: "foreign" } })); cases++
|
||||
assert.throws(() => classifyVrfProductionTransition({ ...base, after: { ...base.after, sourceProof: "b".repeat(64) } })); cases++
|
||||
// Authenticated legacy v1 EUI64 histories remain supported. A deliberately
|
||||
// incomplete v1 GRE absence checkpoint must fail closed after authentication.
|
||||
const scope = { serverId: 7, sourceProof, actorId: binding.actorId, nativeId: absentInput.request.id! }
|
||||
const encoded = sealVrfProductionTransitionCheckpoint(checkpoint, scope, secret)
|
||||
const legacy = JSON.parse(Buffer.from(encoded.split(".")[0], "base64url").toString())
|
||||
legacy.version = 1; delete legacy.history.provenance.greMembers
|
||||
for (const row of legacy.history.provenance.missingMembers) delete row.greParent
|
||||
const payload = Buffer.from(JSON.stringify(legacy)).toString("base64url")
|
||||
const signature = createHmac("sha256", secret).update("mmapp-vrf-production-transition-history-v1\0").update(payload).digest("hex")
|
||||
assert.throws(() => openVrfProductionTransitionCheckpoint(`${payload}.${signature}`, scope, secret), /incomplete legacy GRE provenance/); cases++
|
||||
function asLegacy(sealed: string): string {
|
||||
const value = JSON.parse(Buffer.from(sealed.split(".")[0], "base64url").toString())
|
||||
value.version = 1; delete value.history.provenance.greMembers
|
||||
for (const row of value.history.provenance.missingMembers) delete row.greParent
|
||||
const payload = Buffer.from(JSON.stringify(value)).toString("base64url")
|
||||
return payload + "." + createHmac("sha256", secret).update("mmapp-vrf-production-transition-history-v1\0").update(payload).digest("hex")
|
||||
}
|
||||
const createdScope = { ...scope, nativeId: base.acknowledgedId! }
|
||||
const oldGre = openVrfProductionTransitionCheckpoint(asLegacy(sealVrfProductionTransitionCheckpoint(inputs[1].previous!, createdScope, secret)), createdScope, secret)
|
||||
assert.throws(() => assertVrfProductionHistoryProvenance(oldGre, base.after), /incomplete legacy GRE provenance/); cases++
|
||||
const oldGreResealed = sealVrfProductionTransitionCheckpoint(oldGre, createdScope, secret)
|
||||
assert.equal(JSON.parse(Buffer.from(oldGreResealed.split(".")[0], "base64url").toString()).version, 1); cases++
|
||||
const nativeBefore = snapshot("addresses-before-vrf", false), nativeAfter = snapshot("vrf-create", false)
|
||||
const nativeResult = classifyVrfProductionTransition(input(nativeBefore, nativeAfter, base.request, undefined, base.acknowledgedId))
|
||||
const oldEui64 = openVrfProductionTransitionCheckpoint(asLegacy(sealVrfProductionTransitionCheckpoint(nativeResult.checkpoint, createdScope, secret)), createdScope, secret)
|
||||
assertVrfProductionHistoryProvenance(oldEui64, nativeAfter)
|
||||
classifyVrfProductionTransition(input(nativeAfter, snapshot("vrf-rename", false), inputs[1].request, oldEui64)); cases++
|
||||
let legacyBefore = nativeAfter, legacyPrevious = oldEui64
|
||||
for (let index = 1; index < stages.length; index++) {
|
||||
const after = snapshot(stages[index], false)
|
||||
const result = classifyVrfProductionTransition(input(legacyBefore, after, inputs[index].request, legacyPrevious))
|
||||
legacyPrevious = openVrfProductionTransitionCheckpoint(asLegacy(sealVrfProductionTransitionCheckpoint(result.checkpoint, createdScope, secret)), createdScope, secret)
|
||||
assertVrfProductionHistoryProvenance(legacyPrevious, after)
|
||||
legacyBefore = after; cases++
|
||||
}
|
||||
// GREs with a real MAC retain the original strict EUI64 dispatch and legacy
|
||||
// member witness, including old v1 absence/revival history compatibility.
|
||||
let macBefore = snapshot("addresses-before-vrf", true, true), macPrevious: VrfProductionTransitionCheckpoint | undefined
|
||||
const macAdmission = sealVrfProductionAdmission({ snapshot: macBefore, binding, request: base.request, secret, now }).admission
|
||||
assert.ok(vrfProductionDependencyObjects(macBefore, macAdmission).some(row => row.kind === "ipv6_route")); cases++
|
||||
for (let index = 0; index < stages.length; index++) {
|
||||
const after = snapshot(stages[index], true, true)
|
||||
const result = classifyVrfProductionTransition(input(macBefore, after, inputs[index].request, macPrevious, inputs[index].acknowledgedId))
|
||||
macPrevious = openVrfProductionTransitionCheckpoint(asLegacy(sealVrfProductionTransitionCheckpoint(result.checkpoint, createdScope, secret)), createdScope, secret)
|
||||
assertVrfProductionHistoryProvenance(macPrevious, after)
|
||||
macBefore = after; cases++
|
||||
}
|
||||
// Even a valid replacement MAC/EUI64 pair cannot replace a historical no-MAC
|
||||
// GRE witness under a fresh approval or while its acquired LL remains absent.
|
||||
const macReplacement = structuredClone(absentInput.before)
|
||||
const acquired = macReplacement.catalogs.interface_inventory.find(row => row.name === macReplacement.catalogs.gre[1].name)!
|
||||
acquired["mac-address"] = "02:00:00:00:00:01"
|
||||
assert.throws(() => assertVrfProductionHistoryProvenance(checkpoint, macReplacement)); cases++
|
||||
const presentReplacement = structuredClone(base.after)
|
||||
inventory(presentReplacement)["mac-address"] = "02:00:00:00:00:01"
|
||||
ll(presentReplacement).address = "fe80::ff:fe00:1/64"
|
||||
assert.throws(() => assertVrfProductionHistoryProvenance(inputs[1].previous!, presentReplacement)); cases++
|
||||
// Optional secrets and noncausal source annotations never enter the durable
|
||||
// witness. Their complete values remain fenced within a current transition.
|
||||
const secretBefore = structuredClone(base.before), secretAfter = structuredClone(base.after)
|
||||
for (const s of [secretBefore, secretAfter]) {
|
||||
s.catalogs.gre[0]["ipsec-secret"] = "GRE-secret-must-never-be-serialized"
|
||||
s.catalogs.ipv4_address.find(row => row.interface === "gre-source-wg")!.comment = "source-annotation-must-not-be-serialized"
|
||||
}
|
||||
const secretResult = classifyVrfProductionTransition(input(secretBefore, secretAfter, base.request, undefined, base.acknowledgedId))
|
||||
const secretSealed = sealVrfProductionTransitionCheckpoint(secretResult.checkpoint, createdScope, secret)
|
||||
const secretPayload = Buffer.from(secretSealed.split(".")[0], "base64url").toString()
|
||||
assert.equal(secretPayload.includes("ipsec-secret"), false)
|
||||
assert.equal(secretPayload.includes("GRE-secret-must-never-be-serialized"), false)
|
||||
assert.equal(secretPayload.includes("source-annotation-must-not-be-serialized"), false)
|
||||
const secretOpened = openVrfProductionTransitionCheckpoint(secretSealed, createdScope, secret)
|
||||
assertVrfProductionHistoryProvenance(secretOpened, secretAfter); cases++
|
||||
const currentSecretDrift = structuredClone(secretAfter)
|
||||
currentSecretDrift.catalogs.gre[0]["ipsec-secret"] = "changed-during-current-transition"
|
||||
assert.throws(() => classifyVrfProductionTransition(input(secretBefore, currentSecretDrift, base.request, undefined, base.acknowledgedId))); cases++
|
||||
console.log("GRE captured auto-LL, synthetic lifecycle, durable endpoints, negative conservation cases:", cases)
|
||||
@@ -1,6 +1,7 @@
|
||||
/** Reviewed top-level telemetry spellings are scoped to native REST catalogs.
|
||||
* Unknown catalogs/fields, nested values and familiar names on other paths
|
||||
* remain configuration. This projection is the v2 private admission contract. */
|
||||
* remain configuration. New admissions use v3; the immutable v2 rules below
|
||||
* remain available only to compare authenticated legacy snapshot proofs. */
|
||||
const interfaceTelemetry = ["running", "actual-mtu", "current-mac-address", "rx-byte", "tx-byte", "rx-packet", "tx-packet", "rx-drop", "tx-drop", "rx-error", "tx-error", "tx-queue-drop", "fp-rx-byte", "fp-tx-byte", "fp-rx-packet", "fp-tx-packet"]
|
||||
const resourceTelemetry: Readonly<Record<string, ReadonlySet<string>>> = {
|
||||
bridge: new Set(interfaceTelemetry), ethernet: new Set(interfaceTelemetry), interface_inventory: new Set(interfaceTelemetry),
|
||||
@@ -10,8 +11,14 @@ const resourceTelemetry: Readonly<Record<string, ReadonlySet<string>>> = {
|
||||
ip_settings: new Set(["ipv4-fast-path-active", "ipv4-fasttrack-active", "ipv4-fast-path-packets", "ipv4-fast-path-bytes", "ipv4-fasttrack-packets", "ipv4-fasttrack-bytes"]),
|
||||
ipv6_settings: new Set(["ipv6-fast-path-active", "ipv6-fast-path-packets", "ipv6-fast-path-bytes"]),
|
||||
}
|
||||
export const isVrfProductionTelemetry = (resource: string, field: string): boolean => resourceTelemetry[resource]?.has(field) === true
|
||||
export const isVrfProductionTelemetryValue = (resource: string, field: string, value: unknown): boolean => isVrfProductionTelemetry(resource, field) && (typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value))
|
||||
const wireguardPeerTelemetry = new Set(["rx", "tx", "last-handshake"])
|
||||
const scalar = (value: unknown): boolean => typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)
|
||||
export const isVrfProductionTelemetry = (resource: string, field: string): boolean => resourceTelemetry[resource]?.has(field) === true || resource === "wireguard_peer" && wireguardPeerTelemetry.has(field)
|
||||
export const isVrfProductionTelemetryValue = (resource: string, field: string, value: unknown): boolean => isVrfProductionTelemetry(resource, field) && scalar(value)
|
||||
export function vrfProductionConfiguration<T>(resource: string, row: Record<string, T>, omit: readonly string[] = []): Record<string, T> {
|
||||
return Object.fromEntries(Object.entries(row).filter(([field, value]) => !isVrfProductionTelemetryValue(resource, field, value) && !omit.includes(field)))
|
||||
}
|
||||
/** Exact pre-v3 projection. Never use to prepare/claim a new admission. */
|
||||
export function vrfProductionConfigurationV2<T>(resource: string, row: Record<string, T>, omit: readonly string[] = []): Record<string, T> {
|
||||
return Object.fromEntries(Object.entries(row).filter(([field, value]) => !(resourceTelemetry[resource]?.has(field) === true && scalar(value)) && !omit.includes(field)))
|
||||
}
|
||||
@@ -1,6 +1,7 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { readVrfProductionSnapshot, VRF_PRODUCTION_RAW_PATHS, type VrfProductionReadAdapter, type VrfProductionRawClient } from "./vrf-production-read.js"
|
||||
import { VRF_PRODUCTION_REQUIRED_CATALOGS, sealVrfProductionAdmission, type VrfProductionRequest, type VrfProductionSnapshot } from "./vrf-production-admission.js"
|
||||
import type { VrfRawReadObservation } from "./vrf-execution-diagnostic.js"
|
||||
|
||||
const sourceProof = "a".repeat(64)
|
||||
const request: VrfProductionRequest = { action: "patch", id: "*1", fields: { name: "customers" } }
|
||||
@@ -147,3 +148,65 @@ for (let i = 0; i < 130; i++) {
|
||||
deep.catalogs.vrf[0].interfaces = "vlan-0"
|
||||
await assert.rejects(readVrfProductionSnapshot(deep.input), /closure budget/)
|
||||
console.log("VRF production raw reader model tests passed")
|
||||
|
||||
// Optional observation adds no GET, authentication, source resolution or timer.
|
||||
const observed = model(), observations: VrfRawReadObservation[] = []
|
||||
assert.deepEqual(await readVrfProductionSnapshot({ ...observed.input, observeRead: value => observations.push(value) }), snapshot)
|
||||
assert.deepEqual(observed.calls, happy.calls)
|
||||
assert.deepEqual(observed.counters(), happy.counters())
|
||||
assert.equal(observations.length, observed.calls.length * 5 + 2)
|
||||
assert.deepEqual(observations.slice(0, 4).map(value => value.boundary), ["authority-before", "native-get", "authority-after", "shape"])
|
||||
assert.ok(observations.every(value => value.serverId === 7))
|
||||
assert.deepEqual(observations.at(-2), { serverId: 7, boundary: "final-authority" })
|
||||
assert.deepEqual(observations.at(-1), { serverId: 7, boundary: "snapshot-validation" })
|
||||
for (const rejectAsync of [false, true]) {
|
||||
const unchanged = model()
|
||||
await readVrfProductionSnapshot({ ...unchanged.input, observeRead: () => {
|
||||
if (rejectAsync) return Promise.reject(Error("private observer failure"))
|
||||
throw Error("private observer failure")
|
||||
} })
|
||||
await new Promise(resolve => setImmediate(resolve))
|
||||
assert.deepEqual(unchanged.calls, happy.calls)
|
||||
assert.deepEqual(unchanged.counters(), happy.counters())
|
||||
}
|
||||
const failedGet = model(), readError = Object.assign(Error("PRIVATE_NATIVE_JSON_OR_TRANSPORT"), { code: "ECONNRESET" }), readEvents: VrfRawReadObservation[] = []
|
||||
const resolveSource = failedGet.input.adapter.resolve
|
||||
failedGet.input.adapter.resolve = async serverId => {
|
||||
const source = await resolveSource(serverId)
|
||||
return { ...source, client: { async get<T>(): Promise<T> { throw readError } } }
|
||||
}
|
||||
await assert.rejects(readVrfProductionSnapshot({ ...failedGet.input, observeRead: value => readEvents.push(value) }), error => error === readError)
|
||||
assert.deepEqual(readEvents.at(-1), { serverId: 7, catalog: "bridge", boundary: "native-get" })
|
||||
const failedShape = model(), shapeEvents: VrfRawReadObservation[] = []
|
||||
failedShape.payloads.bridge = { PRIVATE_NATIVE_ROWS: "not a catalog" }
|
||||
await assert.rejects(readVrfProductionSnapshot({ ...failedShape.input, observeRead: value => shapeEvents.push(value) }), /incomplete\/oversized raw catalog/)
|
||||
assert.deepEqual(shapeEvents.at(-1), { serverId: 7, catalog: "bridge", boundary: "shape" })
|
||||
const failedAuthority = model(), authorityEvents: VrfRawReadObservation[] = []
|
||||
failedAuthority.afterGet(() => failedAuthority.revoke())
|
||||
await assert.rejects(readVrfProductionSnapshot({ ...failedAuthority.input, observeRead: value => authorityEvents.push(value) }))
|
||||
assert.deepEqual(authorityEvents.at(-1), { serverId: 7, catalog: "bridge", boundary: "authority-after" })
|
||||
assert.equal(JSON.stringify([...readEvents, ...shapeEvents, ...authorityEvents]).includes("PRIVATE"), false)
|
||||
for (const kind of ["inventory", "closure", "source"] as const) {
|
||||
const local = model(), localEvents: VrfRawReadObservation[] = []
|
||||
if (kind === "inventory") local.catalogs.interface_inventory.push({ ".id": "*ff88", name: "ether1", type: "ether" })
|
||||
if (kind === "closure") local.input.request.fields.interfaces = "missing-selected-member"
|
||||
if (kind === "source") {
|
||||
local.catalogs.interface_inventory.push({ ".id": "*50", name: "customer-gre", type: "gre-tunnel" })
|
||||
local.catalogs.gre = [{ ".id": "*60", name: "customer-gre", "local-address": "0.0.0.0", "remote-address": "198.51.100.1" }]
|
||||
local.input.request.fields.interfaces = "customer-gre"
|
||||
}
|
||||
await assert.rejects(readVrfProductionSnapshot({ ...local.input, observeRead: value => localEvents.push(value) }))
|
||||
assert.deepEqual(localEvents.at(-1), { serverId: 7, boundary: "snapshot-validation" }, kind)
|
||||
assert.ok(local.calls.length >= VRF_PRODUCTION_REQUIRED_CATALOGS.length)
|
||||
}
|
||||
const budget = model(), budgetEvents: VrfRawReadObservation[] = []
|
||||
for (const resource of ["bridge", "bridge_port", "bridge_vlan", "ip_filter", "ipv6_filter"]) budget.catalogs[resource] = [{ ".id": "*ff88", opaque: "x".repeat(7 * 1024 * 1024) }]
|
||||
await assert.rejects(readVrfProductionSnapshot({ ...budget.input, observeRead: value => budgetEvents.push(value) }), /raw evidence byte budget/)
|
||||
assert.deepEqual(budgetEvents.at(-1), { serverId: 7, boundary: "snapshot-validation" })
|
||||
const finalAuthority = model(), finalEvents: VrfRawReadObservation[] = []
|
||||
finalAuthority.afterResolve(() => {
|
||||
if (finalAuthority.counters().resolveCalls === happy.counters().resolveCalls) finalAuthority.revoke()
|
||||
})
|
||||
await assert.rejects(readVrfProductionSnapshot({ ...finalAuthority.input, observeRead: value => finalEvents.push(value) }))
|
||||
assert.deepEqual(finalEvents.at(-1), { serverId: 7, boundary: "final-authority" })
|
||||
console.log("VRF raw-reader optional diagnostics: same IO/order/timers and original read/shape/authority failures passed")
|
||||
@@ -1,5 +1,6 @@
|
||||
import { isIP } from "node:net"
|
||||
import { VRF_PRODUCTION_REQUIRED_CATALOGS, type VrfProductionRequest, type VrfProductionRow, type VrfProductionSnapshot } from "./vrf-production-admission.js"
|
||||
import { notifyVrfDiagnostic, type VrfRawReadObservation } from "./vrf-execution-diagnostic.js"
|
||||
|
||||
/** Raw, complete REST catalogs. Never replace with configurationRows(): that
|
||||
* projection drops native companions, unknown fields and dynamic link-local. */
|
||||
@@ -11,7 +12,7 @@ export const VRF_PRODUCTION_RAW_PATHS: Readonly<Record<string, string>> = Object
|
||||
vlan: "/interface/vlan", bonding: "/interface/bonding", wireguard: "/interface/wireguard", wireguard_peer: "/interface/wireguard/peers",
|
||||
gre: "/interface/gre", ipip: "/interface/ipip", eoip: "/interface/eoip", vxlan: "/interface/vxlan", vxlan_vtep: "/interface/vxlan/vteps", pppoe_client: "/interface/pppoe-client",
|
||||
})
|
||||
const types: Readonly<Record<string, string>> = Object.freeze({ ether: "ethernet", ethernet: "ethernet", bridge: "bridge", vlan: "vlan", bond: "bonding", bonding: "bonding", wireguard: "wireguard", "gre-tunnel": "gre", "ipip-tunnel": "ipip", "eoip-tunnel": "eoip", vxlan: "vxlan", "pppoe-out": "pppoe_client" })
|
||||
const types: Readonly<Record<string, string>> = Object.freeze({ ether: "ethernet", ethernet: "ethernet", bridge: "bridge", vlan: "vlan", bond: "bonding", bonding: "bonding", wg: "wireguard", wireguard: "wireguard", "gre-tunnel": "gre", "ipip-tunnel": "ipip", "eoip-tunnel": "eoip", vxlan: "vxlan", "pppoe-out": "pppoe_client" })
|
||||
const idPattern = /^\*[a-f0-9]+$/i
|
||||
const nativeIdentity = (id: string): string => id.slice(1).replace(/^0+/, "").toLowerCase() || "0"
|
||||
const singleton = new Set(["ip_settings", "ipv6_settings"])
|
||||
@@ -41,6 +42,8 @@ export interface ReadVrfProductionInput {
|
||||
* first GET. Caller JSON must never supply this callback or the adapter. */
|
||||
assertAuthority(): Promise<unknown>
|
||||
adapter?: VrfProductionReadAdapter
|
||||
/** Trusted in-process observer only; no reads, timers or authority are added. */
|
||||
observeRead?(value: VrfRawReadObservation): unknown
|
||||
}
|
||||
function insist(value: unknown, reason: string): asserts value {
|
||||
if (!value) throw new Error(`VRF production read refused: ${reason}`)
|
||||
@@ -107,10 +110,17 @@ export async function readVrfProductionSnapshot(input: ReadVrfProductionInput):
|
||||
let totalBytes = 0
|
||||
const read = async (resource: string): Promise<void> => {
|
||||
insist(Object.hasOwn(VRF_PRODUCTION_RAW_PATHS, resource), "unknown raw resource")
|
||||
notifyVrfDiagnostic(input.observeRead, { serverId: input.serverId, catalog: resource, boundary: "authority-before" })
|
||||
const source = await fence()
|
||||
notifyVrfDiagnostic(input.observeRead, { serverId: input.serverId, catalog: resource, boundary: "native-get" })
|
||||
const payload = await source.client.get<unknown>(VRF_PRODUCTION_RAW_PATHS[resource], 10000, undefined, MAX_BYTES)
|
||||
notifyVrfDiagnostic(input.observeRead, { serverId: input.serverId, catalog: resource, boundary: "authority-after" })
|
||||
await fence()
|
||||
notifyVrfDiagnostic(input.observeRead, { serverId: input.serverId, catalog: resource, boundary: "shape" })
|
||||
const catalog = rows(resource, payload)
|
||||
// Catalog shape succeeded. Budgets and subsequent closure validation are
|
||||
// snapshot work, not a failure of this completed native GET/catalog shape.
|
||||
notifyVrfDiagnostic(input.observeRead, { serverId: input.serverId, boundary: "snapshot-validation" })
|
||||
const size = Buffer.byteLength(JSON.stringify(catalog))
|
||||
totalBytes += size
|
||||
insist(size < MAX_BYTES && totalBytes < MAX_TOTAL_BYTES, "raw evidence byte budget")
|
||||
@@ -199,6 +209,8 @@ export async function readVrfProductionSnapshot(input: ReadVrfProductionInput):
|
||||
const family = resource === "ipv4_address" ? 4 : 6
|
||||
insist(extra === undefined && isIP(host) === family && /^\d+$/.test(prefix ?? "") && Number(prefix) <= (family === 4 ? 32 : 128), "invalid native address prefix")
|
||||
}
|
||||
notifyVrfDiagnostic(input.observeRead, { serverId: input.serverId, boundary: "final-authority" })
|
||||
await fence()
|
||||
notifyVrfDiagnostic(input.observeRead, { serverId: input.serverId, boundary: "snapshot-validation" })
|
||||
return { projection: "raw-native-v1", serverId: input.serverId, sourceProof: input.expectedSourceProof, catalogs }
|
||||
}
|
||||
@@ -1,13 +1,14 @@
|
||||
import { noteVrfTransitionRefusal, withVrfTransitionSection, type VrfTransitionGuard } from "./vrf-transition-refusal.js"
|
||||
import { isIP } from "node:net"
|
||||
import { isDeepStrictEqual } from "node:util"
|
||||
import { createHash, createHmac, timingSafeEqual } from "node:crypto"
|
||||
import { inspectVrfProductionAdmission, VRF_PRODUCTION_REQUIRED_CATALOGS, type VrfProductionAdmission, type VrfProductionBinding, type VrfProductionRequest, type VrfProductionRow, type VrfProductionSnapshot } from "./vrf-production-admission.js"
|
||||
import { isVrfProductionTelemetryValue, vrfProductionConfiguration } from "./vrf-production-projection.js"
|
||||
import { isVrfProductionTelemetryValue, vrfProductionConfiguration, vrfProductionConfigurationV2 } from "./vrf-production-projection.js"
|
||||
|
||||
type Row = VrfProductionRow
|
||||
export interface VrfProductionTransitionCheckpoint { readonly kind: "vrf-production-transition-checkpoint-v1" }
|
||||
interface SnapshotProof { kind: "configuration-sha256-v1"; serverId: number; sourceProof: string; catalogDigests: Record<string, string> }
|
||||
interface CausalProvenance { inactiveCycle?: Row; missingMembers: Row[] }
|
||||
interface SnapshotProof { kind: "configuration-sha256-v1" | "configuration-sha256-v2"; serverId: number; sourceProof: string; catalogDigests: Record<string, string> }
|
||||
interface CausalProvenance { inactiveCycle?: Row; missingMembers: Row[]; greMembers?: Row[] }
|
||||
interface History { snapshot: VrfProductionSnapshot | SnapshotProof; vrfId: string; activeVirtual?: Row; dormantTable?: Row; absentLl: Array<{ address: Row; route: Row; member: string }>; provenance: CausalProvenance }
|
||||
const histories = new WeakMap<VrfProductionTransitionCheckpoint, History>()
|
||||
export interface VrfProductionCheckpointScope { serverId: number; sourceProof: string; actorId: string; nativeId: string }
|
||||
@@ -24,7 +25,8 @@ export function sealVrfProductionTransitionCheckpoint(checkpoint: VrfProductionT
|
||||
const history = histories.get(checkpoint)
|
||||
must(history && history.vrfId === scope.nativeId && history.snapshot.serverId === scope.serverId && history.snapshot.sourceProof === scope.sourceProof && scope.actorId.length > 0 && secret.byteLength >= 32, "checkpoint scope")
|
||||
const durable = { ...history, snapshot: "projection" in history.snapshot ? snapshotProof(history.snapshot) : history.snapshot }
|
||||
const text = JSON.stringify({ version: 1, scope, history: durable })
|
||||
// Re-sealing legacy history cannot mint the missing GRE witnesses.
|
||||
const text = JSON.stringify({ version: history.provenance.greMembers === undefined ? 1 : 2, scope, history: durable })
|
||||
must(Buffer.byteLength(text) <= maxCheckpointBytes, "private checkpoint budget")
|
||||
const payload = Buffer.from(text).toString("base64url")
|
||||
return payload + "." + createHmac("sha256", secret).update(checkpointPurpose).update(payload).digest("hex")
|
||||
@@ -37,9 +39,10 @@ export function openVrfProductionTransitionCheckpoint(sealed: string, scope: Vrf
|
||||
must(timingSafeEqual(expected, Buffer.from(parts[1], "hex")), "private checkpoint signature")
|
||||
const bytes = Buffer.from(parts[0], "base64url"); must(bytes.byteLength <= maxCheckpointBytes, "private checkpoint budget")
|
||||
const value = JSON.parse(bytes.toString("utf8")) as { version: number; scope: VrfProductionCheckpointScope; history: History }
|
||||
must(value.version === 1 && isDeepStrictEqual(value.scope, scope) && value.history?.vrfId === scope.nativeId, "private checkpoint scope/version")
|
||||
must([1, 2].includes(value.version) && isDeepStrictEqual(value.scope, scope) && value.history?.vrfId === scope.nativeId, "private checkpoint scope/version")
|
||||
const proof = value.history.snapshot as SnapshotProof
|
||||
must(proof?.kind === "configuration-sha256-v1" && proof.catalogDigests && VRF_PRODUCTION_REQUIRED_CATALOGS.every(key => Object.hasOwn(proof.catalogDigests, key)) && Object.values(proof.catalogDigests).every(digest => /^[a-f0-9]{64}$/.test(digest)) && proof.serverId === scope.serverId && proof.sourceProof === scope.sourceProof && Array.isArray(value.history.absentLl) && Array.isArray(value.history.provenance?.missingMembers), "private checkpoint source/history")
|
||||
must(["configuration-sha256-v1", "configuration-sha256-v2"].includes(proof?.kind) && proof.catalogDigests && VRF_PRODUCTION_REQUIRED_CATALOGS.every(key => Object.hasOwn(proof.catalogDigests, key)) && Object.values(proof.catalogDigests).every(digest => /^[a-f0-9]{64}$/.test(digest)) && proof.serverId === scope.serverId && proof.sourceProof === scope.sourceProof && Array.isArray(value.history.absentLl) && Array.isArray(value.history.provenance?.missingMembers), "private checkpoint source/history")
|
||||
must(value.version === 2 ? Array.isArray(value.history.provenance.greMembers) : !value.history.provenance.missingMembers.some(row => row.type === "gre-tunnel" && !Object.hasOwn(row, "mac-address")), "incomplete legacy GRE provenance")
|
||||
const checkpoint: VrfProductionTransitionCheckpoint = Object.freeze({ kind: "vrf-production-transition-checkpoint-v1" })
|
||||
histories.set(checkpoint, structuredClone(value.history))
|
||||
return checkpoint
|
||||
@@ -55,13 +58,23 @@ export function vrfProductionCheckpointCatalogs(checkpoint: VrfProductionTransit
|
||||
}
|
||||
const cycleFields = [".id", "id", "type", "vrf", "disabled", "link-downs", "last-link-up-time", "last-link-down-time"]
|
||||
function witness(row: Row, fields: readonly string[]): Row { return Object.fromEntries(Object.entries(row).filter(([field]) => fields.includes(field))) }
|
||||
function memberWitness(row: Row): Row { const result = witness(row, [".id", "name", "type", "mac-address"]); if (typeof result["mac-address"] === "string") result["mac-address"] = result["mac-address"].toLowerCase(); return result }
|
||||
function memberWitness(row: Row, snapshot: VrfProductionSnapshot): Row {
|
||||
const result = witness(row, [".id", "name", "type", "mac-address"])
|
||||
if (typeof result["mac-address"] === "string") result["mac-address"] = result["mac-address"].toLowerCase()
|
||||
if (row.type === "gre-tunnel" && !Object.hasOwn(row, "mac-address")) result.greParent = greParent(snapshot, row)
|
||||
return result
|
||||
}
|
||||
/** Prior history is causal provenance, not a lease on the router's complete
|
||||
* configuration. The fresh approved ticket fences ALL current dependencies. */
|
||||
export function assertVrfProductionHistoryProvenance(checkpoint: VrfProductionTransitionCheckpoint, before: VrfProductionSnapshot): void {
|
||||
const history = histories.get(checkpoint); must(history, "unknown private checkpoint")
|
||||
must(history.snapshot.serverId === before.serverId && history.snapshot.sourceProof === before.sourceProof, "history source changed")
|
||||
const target = before.catalogs.vrf.find(row => row[".id"] === history.vrfId)
|
||||
must(history.provenance.greMembers !== undefined || !before.catalogs.interface_inventory.some(row => row.type === "gre-tunnel" && !Object.hasOwn(row, "mac-address") && target && members(target.interfaces).includes(String(row.name))), "incomplete legacy GRE provenance")
|
||||
for (const expected of history.provenance.greMembers ?? []) {
|
||||
const member = before.catalogs.interface_inventory.find(row => row[".id"] === expected[".id"])
|
||||
must(member && isDeepStrictEqual(memberWitness(member, before), expected), "GRE causal parent/endpoint changed")
|
||||
}
|
||||
if (history.provenance.inactiveCycle) {
|
||||
const cycle = history.provenance.inactiveCycle, virtual = before.catalogs.interface_inventory.find(row => row[".id"] === cycle[".id"])
|
||||
must(target && yes(target.disabled) && virtual && virtual.name === target.name, "inactive causal identity/context changed")
|
||||
@@ -71,13 +84,19 @@ export function assertVrfProductionHistoryProvenance(checkpoint: VrfProductionTr
|
||||
must(history.provenance.missingMembers.length === new Set(history.absentLl.map(item => item.member)).size, "missing LL causal witnesses")
|
||||
for (const expected of history.provenance.missingMembers) {
|
||||
const member = before.catalogs.interface_inventory.find(row => row[".id"] === expected[".id"])
|
||||
must(target && no(target.disabled) && member && isDeepStrictEqual(memberWitness(member), expected) && member.vrf === target.name && context(before.catalogs.vrf, String(member.name)) === target.name, "missing LL member causal identity/MAC/context changed")
|
||||
must(target && no(target.disabled) && member && isDeepStrictEqual(memberWitness(member, before), expected) && member.vrf === target.name && context(before.catalogs.vrf, String(member.name)) === target.name, "missing LL member causal identity/MAC/context changed")
|
||||
must(!addressSources(before, [String(member.name)]).some(source => source.ll), "historical LL absence changed")
|
||||
}
|
||||
}
|
||||
const yes = (value: unknown) => [true, "true", "yes"].includes(value as string | boolean)
|
||||
const no = (value: unknown) => [false, "false", "no"].includes(value as string | boolean)
|
||||
function must(value: unknown, reason: string): asserts value { if (!value) throw Error(`VRF production transition refused: ${reason}`) }
|
||||
function must(value: unknown, reason: string, guard?: VrfTransitionGuard): asserts value {
|
||||
if (!value) {
|
||||
const error = Error(`VRF production transition refused: ${reason}`)
|
||||
noteVrfTransitionRefusal(error, reason, guard)
|
||||
throw error
|
||||
}
|
||||
}
|
||||
function nativeId(value: unknown): string { must(typeof value === "string" && /^\*[a-f0-9]+$/i.test(value), "native ID"); return value.slice(1).replace(/^0+/, "").toLowerCase() || "0" }
|
||||
const projected = vrfProductionConfiguration
|
||||
function same(resource: string, old: Row, current: Row, omit: readonly string[] = []): void { must(isDeepStrictEqual(projected(resource, old, omit), projected(resource, current, omit)), "opaque configuration drift") }
|
||||
@@ -103,7 +122,7 @@ function valid(snapshot: VrfProductionSnapshot): void {
|
||||
bytes += Buffer.byteLength(JSON.stringify(rows)); must(bytes < 32 * 1024 * 1024, "raw byte budget")
|
||||
}
|
||||
}
|
||||
function snapshotProof(snapshot: VrfProductionSnapshot): SnapshotProof {
|
||||
function snapshotProof(snapshot: VrfProductionSnapshot, kind: SnapshotProof["kind"] = "configuration-sha256-v2"): SnapshotProof {
|
||||
let hash = createHash("sha256")
|
||||
const feed = (value: unknown): void => {
|
||||
if (Array.isArray(value)) { hash.update("["); for (const child of value) { feed(child); hash.update(",") } hash.update("]"); return }
|
||||
@@ -111,11 +130,13 @@ function snapshotProof(snapshot: VrfProductionSnapshot): SnapshotProof {
|
||||
hash.update(JSON.stringify(value))
|
||||
}
|
||||
const catalogDigests: Record<string, string> = {}
|
||||
for (const resource of Object.keys(snapshot.catalogs).sort()) { hash = createHash("sha256").update("mmapp-vrf-production-full-catalog-v1\0"); feed(resource); feed(snapshot.catalogs[resource].map(row => projected(resource, row))); catalogDigests[resource] = hash.digest("hex") }
|
||||
return { kind: "configuration-sha256-v1", serverId: snapshot.serverId, sourceProof: snapshot.sourceProof, catalogDigests }
|
||||
const projection = kind === "configuration-sha256-v1" ? vrfProductionConfigurationV2 : projected
|
||||
const domain = kind === "configuration-sha256-v1" ? "mmapp-vrf-production-full-catalog-v1\0" : "mmapp-vrf-production-full-catalog-v2\0"
|
||||
for (const resource of Object.keys(snapshot.catalogs).sort()) { hash = createHash("sha256").update(domain); feed(resource); feed(snapshot.catalogs[resource].map(row => projection(resource, row))); catalogDigests[resource] = hash.digest("hex") }
|
||||
return { kind, serverId: snapshot.serverId, sourceProof: snapshot.sourceProof, catalogDigests }
|
||||
}
|
||||
function snapshotSame(old: VrfProductionSnapshot | SnapshotProof, current: VrfProductionSnapshot): void {
|
||||
if (!("projection" in old)) { const next = snapshotProof(current); must(old.serverId === next.serverId && old.sourceProof === next.sourceProof && Object.entries(old.catalogDigests).every(([resource, digest]) => next.catalogDigests[resource] === digest), "checkpoint parent/configuration/order drift"); return }
|
||||
if (!("projection" in old)) { const next = snapshotProof(current, old.kind); must(old.serverId === next.serverId && old.sourceProof === next.sourceProof && Object.entries(old.catalogDigests).every(([resource, digest]) => next.catalogDigests[resource] === digest), "checkpoint parent/configuration/order drift"); return }
|
||||
snapshotSame(snapshotProof(old), current)
|
||||
}
|
||||
function members(value: unknown): string[] {
|
||||
@@ -147,13 +168,50 @@ function context(vrfs: Row[], name: string): string {
|
||||
if (vrf.name === "main") { must(vrf.interfaces === "all" && no(vrf.disabled), "main VRF shape"); return "main" }
|
||||
if (no(vrf.disabled) && members(vrf.interfaces).includes(name)) return vrf.name
|
||||
}
|
||||
throw Error("VRF production transition refused: missing ordered main VRF")
|
||||
const error = Error("VRF production transition refused: missing ordered main VRF")
|
||||
noteVrfTransitionRefusal(error, "missing ordered main VRF")
|
||||
throw error
|
||||
}
|
||||
function eui64(row: Row, inventory: Row): void {
|
||||
must(yes(row.dynamic) && yes(row["auto-link-local"]) && yes(row["link-local"]) && row.vrf === "main" && typeof inventory["mac-address"] === "string" && /^(?:[a-f0-9]{2}:){5}[a-f0-9]{2}$/i.test(inventory["mac-address"]), "link-local parent flags/MAC")
|
||||
const mac = inventory["mac-address"].split(":").map(word => parseInt(word, 16)), bytes = [mac[0] ^ 2, mac[1], mac[2], 255, 254, mac[3], mac[4], mac[5]], words = ["fe80", "0", "0", "0", ...[0, 2, 4, 6].map(index => (bytes[index] * 256 + bytes[index + 1]).toString(16))]
|
||||
must(prefix(row.address, 6).length === 64 && prefix(row.address, 6).host && prefix(`${words.join(":")}/128`, 6).network === prefix(`${String(row.address).split("/")[0]}/128`, 6).network, "EUI64 link-local address")
|
||||
}
|
||||
/** Bounded observed RouterOS IPv4 GRE auto-LL form, verified on four native
|
||||
* GREs in the V29 capture. This is not a general IPv6 or tunnel derivation.
|
||||
* The current concrete GRE and its explicit source parent remain mandatory. */
|
||||
function greParent(snapshot: VrfProductionSnapshot, inventory: Row): Row {
|
||||
must(inventory.type === "gre-tunnel" && !Object.hasOwn(inventory, "mac-address"), "GRE native no-MAC parent")
|
||||
const rows = snapshot.catalogs.gre?.filter(row => row.name === inventory.name) ?? []
|
||||
must(rows.length === 1, "GRE exact concrete parent")
|
||||
const config = rows[0]; nativeId(config[".id"]); nativeId(inventory[".id"])
|
||||
const unicast4 = (value: unknown): value is string => typeof value === "string" && isIP(value) === 4 && Number(value.split(".")[0]) > 0 && Number(value.split(".")[0]) < 224 && value !== "255.255.255.255"
|
||||
must(unicast4(config["local-address"]) && unicast4(config["remote-address"]), "GRE explicit IPv4 endpoints")
|
||||
const sources = snapshot.catalogs.ipv4_address.filter(row => typeof row.address === "string" && row.address.split("/")[0] === config["local-address"])
|
||||
must(sources.length === 1 && no(sources[0].dynamic) && no(sources[0].disabled), "GRE exact static source")
|
||||
const roots = snapshot.catalogs.interface_inventory.filter(row => row.name === sources[0].interface)
|
||||
must(roots.length === 1 && roots[0][".id"] !== inventory[".id"], "GRE exact source parent")
|
||||
const resources: Record<string, string> = { ether: "ethernet", ethernet: "ethernet", bridge: "bridge", vlan: "vlan", wg: "wireguard", wireguard: "wireguard", "gre-tunnel": "gre", "ipip-tunnel": "ipip", "eoip-tunnel": "eoip", vxlan: "vxlan", bond: "bonding", bonding: "bonding", "pppoe-out": "pppoe_client" }
|
||||
const resource = resources[String(roots[0].type)], configs = resource ? snapshot.catalogs[resource]?.filter(row => row.name === roots[0].name) ?? [] : []
|
||||
must(configs.length === 1, "GRE concrete source parent")
|
||||
nativeId(roots[0][".id"]); nativeId(configs[0][".id"])
|
||||
// Durable causal history needs identity/endpoints, not opaque configuration
|
||||
// or optional GRE secrets. Fresh admission/current reconciliation still fence
|
||||
// the complete configuration separately.
|
||||
return { configuration: witness(config, [".id", "name", "local-address", "remote-address"]), sourceAddress: witness(sources[0], [".id", "address", "interface", "actual-interface", "dynamic", "disabled", "vrf"]), sourceInventory: witness(roots[0], [".id", "name", "type", "mac-address"]), sourceConfiguration: witness(configs[0], [".id", "name"]), sourceResource: resource }
|
||||
}
|
||||
function nativeLinkLocal(snapshot: VrfProductionSnapshot, row: Row, inventory: Row): void {
|
||||
if (inventory.type !== "gre-tunnel" || Object.hasOwn(inventory, "mac-address")) { eui64(row, inventory); return }
|
||||
const parent = greParent(snapshot, inventory), config = parent.configuration as Row
|
||||
must(yes(row.dynamic) && yes(row["auto-link-local"]) && yes(row["link-local"]) && no(row.disabled) && row.interface === inventory.name && row["actual-interface"] === inventory.name && no(row.invalid), "GRE auto-link-local native flags/identity")
|
||||
const effectiveContext = context(snapshot.catalogs.vrf, String(inventory.name))
|
||||
must(inventory.vrf === effectiveContext, "GRE inventory effective context")
|
||||
must(row.vrf === effectiveContext, "GRE link-local effective context")
|
||||
const octets = String(config["remote-address"]).split(".").map(Number)
|
||||
const expected = `fe80::2:${(octets[0] * 256 + octets[1]).toString(16)}:${(octets[2] * 256 + octets[3]).toString(16)}/64`
|
||||
const parsed = prefix(row.address, 6)
|
||||
must(parsed.length === 64 && prefix(`${parsed.host}/128`, 6).network === prefix(`${expected.split("/")[0]}/128`, 6).network, "GRE observed remote-bound auto-link-local")
|
||||
}
|
||||
interface Source { resource: "ipv4_address" | "ipv6_address"; row: Row; member: string; network: string; family: 4 | 6; ll: boolean }
|
||||
function addressSources(snapshot: VrfProductionSnapshot, names: string[]): Source[] {
|
||||
const result: Source[] = []
|
||||
@@ -164,7 +222,7 @@ function addressSources(snapshot: VrfProductionSnapshot, names: string[]): Sourc
|
||||
const parsed = prefix(row.address, family)
|
||||
if (ll) {
|
||||
must(family === 6, "dynamic non-link-local address")
|
||||
const inventory = snapshot.catalogs.interface_inventory.filter(item => item.name === member); must(inventory.length === 1, "LL inventory"); eui64(row, inventory[0])
|
||||
const inventory = snapshot.catalogs.interface_inventory.filter(item => item.name === member); must(inventory.length === 1, "LL inventory"); nativeLinkLocal(snapshot, row, inventory[0])
|
||||
} else must(no(row.dynamic) && row.vrf === context(snapshot.catalogs.vrf, member), "static address provenance/context")
|
||||
result.push({ resource, row, member, network: parsed.network, family, ll })
|
||||
}
|
||||
@@ -180,6 +238,28 @@ function routeFor(row: Row, source: Source, vrfs: Row[]): boolean {
|
||||
if (row["routing-table"] !== table || row.gateway !== gateway || row["immediate-gw"] !== source.member || row.interface !== undefined && row.interface !== "" && row.interface !== source.member) return false
|
||||
return row["local-address"] === undefined || row["local-address"] === `${String(source.row.address).split("/")[0]}%${gateway}`
|
||||
}
|
||||
/** A terminal DELETE may remove one proven automatic LL from an unchanged,
|
||||
* empty concrete bridge. It creates no revival debt for the deleted target. */
|
||||
function deletedBridgeLinkLocal(before: VrfProductionSnapshot, after: VrfProductionSnapshot, old: Row, source: Source, oldRoute: Row, beforeSources: Source[], afterSources: Source[]): void {
|
||||
const name = source.member
|
||||
must(source.ll && source.family === 6 && no(old.disabled) && members(old.interfaces).includes(name) && context(before.catalogs.vrf, name) === old.name && context(after.catalogs.vrf, name) === "main" && !after.catalogs.vrf.some(row => row[".id"] === old[".id"]), "DELETE bridge LL owned context")
|
||||
const parents = [before, after].map(snapshot => snapshot.catalogs.interface_inventory.filter(row => row.name === name))
|
||||
must(parents.every(rows => rows.length === 1) && parents.every(rows => rows[0].type === "bridge" && rows[0].disabled === "false" && rows[0].running === "true" && rows[0].dynamic === "false") && parents[0][0][".id"] === parents[1][0][".id"] && parents[0][0]["mac-address"] === parents[1][0]["mac-address"], "DELETE bridge LL concrete parent")
|
||||
const parent = parents[0][0], id = parent[".id"]
|
||||
for (const snapshot of [before, after]) {
|
||||
const bridges = snapshot.catalogs.bridge.filter(row => row.name === name)
|
||||
const reference = (value: unknown) => typeof value === "string" && value.split(",").some(item => [name, id].includes(item.trim()))
|
||||
must(bridges.length === 1 && bridges[0][".id"] === id && bridges[0].disabled === "false" && bridges[0].dynamic === "false" && bridges[0].running === "true" && bridges[0]["mac-address"] === parent["mac-address"] && !snapshot.catalogs.bridge_port.some(row => reference(row.bridge) || reference(row.interface)) && !snapshot.catalogs.bridge_vlan.some(row => reference(row.bridge) || reference(row.tagged) || reference(row.untagged) || reference(row["current-tagged"]) || reference(row["current-untagged"])) && !(snapshot.catalogs.vlan ?? []).some(row => reference(row.interface)), "DELETE bridge LL empty configuration")
|
||||
}
|
||||
same("bridge", before.catalogs.bridge.find(row => row.name === name)!, after.catalogs.bridge.find(row => row.name === name)!)
|
||||
must(source.row.dynamic === "true" && source.row["auto-link-local"] === "true" && source.row["link-local"] === "true" && source.row.disabled === "false" && source.row.invalid === "false" && source.row.interface === name && source.row["actual-interface"] === name, "DELETE bridge LL automatic provenance")
|
||||
eui64(source.row, parent)
|
||||
const statics = beforeSources.filter(item => item.member === name && !item.ll)
|
||||
must(statics.some(item => item.family === 4) && statics.every(item => afterSources.some(next => next.member === name && next.resource === item.resource && !next.ll && next.row[".id"] === item.row[".id"] && next.network === item.network)) && !afterSources.some(item => item.member === name && item.ll), "DELETE bridge LL static address closure")
|
||||
const routeReference = (row: Row) => [row.gateway, row["immediate-gw"], row.interface].some(value => typeof value === "string" && (value === name || value === id || value.startsWith(name + "@") || value.startsWith(String(id) + "@")))
|
||||
const linkLocalRoute = (row: Row) => { try { return prefix(row["dst-address"], 6).network === source.network && routeReference(row) } catch { return false } }
|
||||
must(before.catalogs.ipv6_route.filter(linkLocalRoute).length === 1 && before.catalogs.ipv6_route.filter(linkLocalRoute)[0] === oldRoute && !after.catalogs.ipv6_route.some(linkLocalRoute), "DELETE bridge LL connected route closure")
|
||||
}
|
||||
/** Existing object guards must see the exact concrete parent/dependent
|
||||
* identities already proved by admission, not a guessed numeric namespace. */
|
||||
export function vrfProductionDependencyObjects(snapshot: VrfProductionSnapshot, admission: VrfProductionAdmission): Array<{ kind: string; id: string; serverId: number }> {
|
||||
@@ -205,6 +285,29 @@ export function vrfProductionDependencyObjects(snapshot: VrfProductionSnapshot,
|
||||
return [...objects.values()]
|
||||
}
|
||||
const timestamp = (value: unknown): value is string => typeof value === "string" && /^\d{4}-\d\d-\d\d \d\d:\d\d:\d\d$/.test(value) && !Number.isNaN(Date.parse(value.replace(" ", "T") + "Z")) && new Date(value.replace(" ", "T") + "Z").toISOString().slice(0, 19).replace("T", " ") === value
|
||||
const greMemberChronology = ["link-downs", "last-link-up-time", "last-link-down-time"] as const
|
||||
/** One observed no-MAC GRE context-transfer cycle only. No chronology becomes
|
||||
* telemetry: unchanged context and every other concrete type remain strict. */
|
||||
function memberInventoryOmissions(before: VrfProductionSnapshot, after: VrfProductionSnapshot, name: string, old: Row, current: Row): string[] {
|
||||
const omit = ["vrf", "status"]
|
||||
if (isDeepStrictEqual(witness(old, greMemberChronology), witness(current, greMemberChronology))) return omit
|
||||
const previousContext = context(before.catalogs.vrf, name), nextContext = context(after.catalogs.vrf, name)
|
||||
must(old.type === "gre-tunnel" && current.type === "gre-tunnel" && old.name === name && current.name === name && old[".id"] === current[".id"] && !Object.hasOwn(old, "mac-address") && !Object.hasOwn(current, "mac-address") && previousContext !== nextContext && old.vrf === previousContext && current.vrf === nextContext, "bounded GRE cycle member identity/context")
|
||||
must(no(old.disabled) && no(current.disabled) && old.running === "true" && current.running === "true", "bounded GRE cycle active state")
|
||||
const a = greParent(before, old), b = greParent(after, current)
|
||||
const parent = (snapshot: VrfProductionSnapshot, resource: string, id: unknown) => snapshot.catalogs[resource]?.find(row => row[".id"] === id)
|
||||
const oldGre = before.catalogs.gre.find(row => row.name === name), newGre = after.catalogs.gre.find(row => row.name === name)
|
||||
const resource = String(a.sourceResource)
|
||||
const oldRoot = parent(before, resource, (a.sourceConfiguration as Row)[".id"]), newRoot = parent(after, resource, (b.sourceConfiguration as Row)[".id"])
|
||||
const oldAddress = parent(before, "ipv4_address", (a.sourceAddress as Row)[".id"]), newAddress = parent(after, "ipv4_address", (b.sourceAddress as Row)[".id"])
|
||||
must(isDeepStrictEqual(a, b) && oldGre && newGre && oldRoot && newRoot && oldAddress && newAddress && isDeepStrictEqual(projected("gre", oldGre), projected("gre", newGre)) && isDeepStrictEqual(projected(resource, oldRoot), projected(resource, newRoot)) && isDeepStrictEqual(projected("ipv4_address", oldAddress), projected("ipv4_address", newAddress)), "bounded GRE cycle parent/configuration")
|
||||
const oldCount = old["link-downs"], newCount = current["link-downs"]
|
||||
// Twenty canonical digits are a local parsing budget, not a native bit-width claim.
|
||||
must(typeof oldCount === "string" && /^(0|[1-9]\d{0,19})$/.test(oldCount) && typeof newCount === "string" && /^(0|[1-9]\d{0,19})$/.test(newCount) && BigInt(newCount) === BigInt(oldCount) + 1n, "bounded GRE cycle count")
|
||||
const oldUp = old["last-link-up-time"], oldDown = old["last-link-down-time"], newDown = current["last-link-down-time"], newUp = current["last-link-up-time"]
|
||||
must(timestamp(oldUp) && (oldDown === undefined || timestamp(oldDown)) && timestamp(newDown) && timestamp(newUp) && (oldDown === undefined || oldDown <= oldUp) && newDown >= oldUp && (oldDown === undefined || newDown >= oldDown) && newDown <= newUp, "bounded GRE cycle chronology")
|
||||
return [...omit, ...greMemberChronology]
|
||||
}
|
||||
function activeVirtual(row: Row): void {
|
||||
must(row.type === "vrf" && row.vrf === "main" && no(row.disabled) && row.running === "true" && row.status === "--LERU--O---------------" && row.flags === " UP RUNNING NOARP MASTER LOWER_UP (0x104c1)" && row["actual-mtu"] === "65536" && row.mtu === "65536" && typeof row.ifname === "string" && /^vrf\d+$/.test(row.ifname) && typeof row.ifindex === "string" && /^[1-9]\d*$/.test(row.ifindex) && typeof row["mac-address"] === "string" && /^(?:[a-f0-9]{2}:){5}[a-f0-9]{2}$/i.test(row["mac-address"]) && (parseInt(row["mac-address"].slice(0, 2), 16) & 3) === 2 && timestamp(row["last-link-up-time"]), "bounded native active virtual shape")
|
||||
}
|
||||
@@ -251,6 +354,7 @@ export function classifyVrfProductionTransition(input: VrfProductionTransitionIn
|
||||
const exemptBefore = new Map<string, Set<Row>>(), exemptAfter = new Map<string, Set<Row>>()
|
||||
const explain = (resource: string, previous: Row | undefined, next: Row | undefined) => { if (previous) { const rows = exemptBefore.get(resource) ?? new Set<Row>(); rows.add(previous); exemptBefore.set(resource, rows) } if (next) { const rows = exemptAfter.get(resource) ?? new Set<Row>(); rows.add(next); exemptAfter.set(resource, rows) } }
|
||||
explain("vrf", old, current)
|
||||
withVrfTransitionSection("member-inventory", () => {
|
||||
for (const name of changes) {
|
||||
const a = before.catalogs.interface_inventory.filter(row => row.name === name), b = after.catalogs.interface_inventory.filter(row => row.name === name)
|
||||
// The signed admission already resolves exact concrete physical/VLAN/etc
|
||||
@@ -262,41 +366,52 @@ export function classifyVrfProductionTransition(input: VrfProductionTransitionIn
|
||||
const x = String(a[0].status), y = String(b[0].status)
|
||||
must(x.length === 24 && y.length === 24 && x.slice(0, 20) === y.slice(0, 20) && x.slice(21) === y.slice(21) && x[20] === (oldContext.get(name) === "main" ? "-" : "V") && y[20] === (newContext.get(name) === "main" ? "-" : "V"), "member status native shape")
|
||||
}
|
||||
same("interface_inventory", a[0], b[0], ["vrf", "status"]); explain("interface_inventory", a[0], b[0])
|
||||
same("interface_inventory", a[0], b[0], memberInventoryOmissions(before, after, name, a[0], b[0])); explain("interface_inventory", a[0], b[0])
|
||||
}
|
||||
const beforeSources = addressSources(before, names), afterSources = addressSources(after, names), absences: History["absentLl"] = []
|
||||
})
|
||||
const beforeSources = withVrfTransitionSection("before-address", () => addressSources(before, names))
|
||||
const afterSources = withVrfTransitionSection("after-address", () => addressSources(after, names))
|
||||
const absences: History["absentLl"] = []
|
||||
const routeResource = (source: Source) => source.family === 4 ? "ipv4_route" : "ipv6_route"
|
||||
const route = (snapshot: VrfProductionSnapshot, source: Source): Row => { const matches = snapshot.catalogs[routeResource(source)].filter(row => routeFor(row, source, snapshot.catalogs.vrf)); must(matches.length === 1, "missing/ambiguous proven connected route"); return matches[0] }
|
||||
const route = (snapshot: VrfProductionSnapshot, source: Source): Row => withVrfTransitionSection("connected-route", () => { const matches = snapshot.catalogs[routeResource(source)].filter(row => routeFor(row, source, snapshot.catalogs.vrf)); must(matches.length === 1, "missing/ambiguous proven connected route"); return matches[0] })
|
||||
const usedAfter = new Set<Source>()
|
||||
for (const source of beforeSources) {
|
||||
const successors = afterSources.filter(candidate => candidate.member === source.member && candidate.network === source.network && candidate.ll === source.ll)
|
||||
must(successors.length <= 1, "ambiguous address successor")
|
||||
const successor = successors[0], oldRoute = route(before, source)
|
||||
if (!successor) {
|
||||
if (request.action === "delete" && source.ll) {
|
||||
withVrfTransitionSection("LL-comparison", () => deletedBridgeLinkLocal(before, after, old!, source, oldRoute, beforeSources, afterSources))
|
||||
explain(source.resource, source.row, undefined); explain(routeResource(source), oldRoute, undefined); continue
|
||||
}
|
||||
must(source.ll && transfer && current!.interfaces === source.member && oldContext.get(source.member) === "main", "address/route absence outside exact acquisition")
|
||||
absences.push({ address: structuredClone(source.row), route: structuredClone(oldRoute), member: source.member }); explain(source.resource, source.row, undefined); explain(routeResource(source), oldRoute, undefined); continue
|
||||
}
|
||||
usedAfter.add(successor)
|
||||
if (source.ll) same(source.resource, source.row, successor.row, [".id"])
|
||||
const moved = changes.includes(source.member)
|
||||
if (source.ll) {
|
||||
const concreteNoMacGre = [before, after].every(snapshot => snapshot.catalogs.interface_inventory.some(row => row.name === source.member && row.type === "gre-tunnel" && !Object.hasOwn(row, "mac-address")))
|
||||
withVrfTransitionSection("LL-comparison", () => same(source.resource, source.row, successor.row, moved && concreteNoMacGre ? [".id", "vrf"] : [".id"]))
|
||||
}
|
||||
else { must(source.row[".id"] === successor.row[".id"], "static address identity changed"); same(source.resource, source.row, successor.row, ["vrf"]) }
|
||||
const newRoute = route(after, successor)
|
||||
const moved = changes.includes(source.member)
|
||||
must(Object.hasOwn(oldRoute, "local-address") === Object.hasOwn(newRoute, "local-address"), "connected route local-address shape changed")
|
||||
const ownedDelete = request.action === "delete" && oldContext.get(source.member) === old!.name
|
||||
same(routeResource(source), oldRoute, newRoute, moved ? [".id", "gateway", "immediate-gw", "routing-table", "local-address"] : transfer || ownedDelete ? [".id"] : [])
|
||||
withVrfTransitionSection("connected-route", () => same(routeResource(source), oldRoute, newRoute, moved ? [".id", "gateway", "immediate-gw", "routing-table", "local-address"] : transfer || ownedDelete ? [".id"] : []))
|
||||
if (source.ll && source.row[".id"] !== successor.row[".id"]) must(moved || transfer || ownedDelete, "LL ID changed outside native move")
|
||||
explain(source.resource, source.row, successor.row); explain(routeResource(source), oldRoute, newRoute)
|
||||
}
|
||||
for (const successor of afterSources.filter(source => !usedAfter.has(source))) {
|
||||
const missing = history?.absentLl.filter(item => item.member === successor.member) ?? []
|
||||
must(request.action === "delete" && successor.ll && missing.length === 1, "new address/route adoption forbidden")
|
||||
same(successor.resource, missing[0].address, successor.row, [".id"]); const nextRoute = route(after, successor)
|
||||
withVrfTransitionSection("LL-comparison", () => same(successor.resource, missing[0].address, successor.row, [".id"])); const nextRoute = route(after, successor)
|
||||
must(Object.hasOwn(missing[0].route, "local-address") === Object.hasOwn(nextRoute, "local-address"), "revived route local-address shape")
|
||||
same(routeResource(successor), missing[0].route, nextRoute, [".id", "gateway", "immediate-gw", "routing-table", "local-address"])
|
||||
explain(successor.resource, undefined, successor.row); explain(routeResource(successor), undefined, nextRoute)
|
||||
}
|
||||
for (const missing of history?.absentLl ?? []) if (!afterSources.some(source => source.member === missing.member && source.ll)) { must(request.action !== "delete", "DELETE missing expected LL revival"); absences.push(structuredClone(missing)) }
|
||||
let active: Row | undefined, dormant: Row | undefined
|
||||
withVrfTransitionSection("virtual", () => {
|
||||
for (const resource of ["routing_table", "interface_inventory"]) {
|
||||
const find = (snapshot: VrfProductionSnapshot, vrf: Row | undefined): Row | undefined => {
|
||||
if (!vrf) return undefined
|
||||
@@ -338,17 +453,23 @@ export function classifyVrfProductionTransition(input: VrfProductionTransitionIn
|
||||
}
|
||||
explain(resource, a, b)
|
||||
}
|
||||
})
|
||||
// No explained successor may acquire an ID belonging to a foreign row.
|
||||
withVrfTransitionSection("foreign", () => {
|
||||
for (const resource of Object.keys(before.catalogs)) {
|
||||
const a = exemptBefore.get(resource) ?? new Set<Row>(), b = exemptAfter.get(resource) ?? new Set<Row>()
|
||||
const foreignBefore = before.catalogs[resource].filter(row => !a.has(row)), foreignAfter = after.catalogs[resource].filter(row => !b.has(row))
|
||||
must(isDeepStrictEqual(foreignBefore.map(row => projected(resource, row)), foreignAfter.map(row => projected(resource, row))), `foreign ${resource} configuration/order changed`)
|
||||
must(isDeepStrictEqual(foreignBefore.map(row => projected(resource, row)), foreignAfter.map(row => projected(resource, row))), `foreign ${resource} configuration/order changed`, "FOREIGN_CATALOG_CONFIGURATION_ORDER_CHANGED")
|
||||
for (const row of b) must(!foreignBefore.some(previous => nativeId(previous[".id"]) === nativeId(row[".id"])), "companion acquired foreign ID")
|
||||
}
|
||||
})
|
||||
const checkpoint: VrfProductionTransitionCheckpoint = Object.freeze({ kind: "vrf-production-transition-checkpoint-v1" })
|
||||
const provenance: CausalProvenance = { missingMembers: [...new Set(absences.map(item => item.member))].map(name => {
|
||||
const inventory = after.catalogs.interface_inventory.find(row => row.name === name); must(inventory, "missing LL causal member")
|
||||
return memberWitness(inventory)
|
||||
return memberWitness(inventory, after)
|
||||
}), greMembers: [...new Set([...names, ...(history?.provenance.greMembers ?? []).map(row => String(row.name))])].flatMap(name => {
|
||||
const inventory = after.catalogs.interface_inventory.find(row => row.name === name)
|
||||
return inventory?.type === "gre-tunnel" && !Object.hasOwn(inventory, "mac-address") ? [memberWitness(inventory, after)] : []
|
||||
}) }
|
||||
if (current && yes(current.disabled) && (active || dormant)) {
|
||||
const virtual = after.catalogs.interface_inventory.find(row => row.type === "vrf" && row.name === current.name && row.vrf === "main")
|
||||
|
||||
@@ -0,0 +1,148 @@
|
||||
import { types } from "node:util"
|
||||
|
||||
// Explicit immutable code table, never derive a tag from
|
||||
// a message, stack, native value, dynamic resource name or caller JSON.
|
||||
export const VRF_TRANSITION_REASON_CODES = Object.freeze({
|
||||
"DELETE bridge LL owned context": "DELETE_BRIDGE_LL_OWNED_CONTEXT",
|
||||
"DELETE bridge LL concrete parent": "DELETE_BRIDGE_LL_CONCRETE_PARENT",
|
||||
"DELETE bridge LL empty configuration": "DELETE_BRIDGE_LL_EMPTY_CONFIGURATION",
|
||||
"DELETE bridge LL automatic provenance": "DELETE_BRIDGE_LL_AUTOMATIC_PROVENANCE",
|
||||
"DELETE bridge LL static address closure": "DELETE_BRIDGE_LL_STATIC_ADDRESS_CLOSURE",
|
||||
"DELETE bridge LL connected route closure": "DELETE_BRIDGE_LL_CONNECTED_ROUTE_CLOSURE",
|
||||
"bounded GRE cycle member identity/context": "BOUNDED_GRE_CYCLE_MEMBER_IDENTITY_CONTEXT",
|
||||
"bounded GRE cycle active state": "BOUNDED_GRE_CYCLE_ACTIVE_STATE",
|
||||
"bounded GRE cycle parent/configuration": "BOUNDED_GRE_CYCLE_PARENT_CONFIGURATION",
|
||||
"bounded GRE cycle count": "BOUNDED_GRE_CYCLE_COUNT",
|
||||
"bounded GRE cycle chronology": "BOUNDED_GRE_CYCLE_CHRONOLOGY",
|
||||
"CIDR": "CIDR",
|
||||
"CREATE exact new ACK identity": "CREATE_EXACT_NEW_ACK_IDENTITY",
|
||||
"CREATE exact ordered insertion": "CREATE_EXACT_ORDERED_INSERTION",
|
||||
"DELETE exact target": "DELETE_EXACT_TARGET",
|
||||
"DELETE missing expected LL revival": "DELETE_MISSING_EXPECTED_LL_REVIVAL",
|
||||
"EUI64 link-local address": "EUI64_LINK_LOCAL_ADDRESS",
|
||||
"GRE auto-link-local native flags/identity": "GRE_AUTO_LINK_LOCAL_NATIVE_FLAGS_IDENTITY",
|
||||
"GRE causal parent/endpoint changed": "GRE_CAUSAL_PARENT_ENDPOINT_CHANGED",
|
||||
"GRE concrete source parent": "GRE_CONCRETE_SOURCE_PARENT",
|
||||
"GRE exact concrete parent": "GRE_EXACT_CONCRETE_PARENT",
|
||||
"GRE exact source parent": "GRE_EXACT_SOURCE_PARENT",
|
||||
"GRE exact static source": "GRE_EXACT_STATIC_SOURCE",
|
||||
"GRE explicit IPv4 endpoints": "GRE_EXPLICIT_IPV4_ENDPOINTS",
|
||||
"GRE inventory effective context": "GRE_INVENTORY_EFFECTIVE_CONTEXT",
|
||||
"GRE link-local effective context": "GRE_LINK_LOCAL_EFFECTIVE_CONTEXT",
|
||||
"GRE native no-MAC parent": "GRE_NATIVE_NO_MAC_PARENT",
|
||||
"GRE observed remote-bound auto-link-local": "GRE_OBSERVED_REMOTE_BOUND_AUTO_LINK_LOCAL",
|
||||
"IPv6 words": "IPV6_WORDS",
|
||||
"JSON nesting budget": "JSON_NESTING_BUDGET",
|
||||
"LL ID changed outside native move": "LL_ID_CHANGED_OUTSIDE_NATIVE_MOVE",
|
||||
"LL inventory": "LL_INVENTORY",
|
||||
"PATCH exact target/order": "PATCH_EXACT_TARGET_ORDER",
|
||||
"VRF identity/enabled state": "VRF_IDENTITY_ENABLED_STATE",
|
||||
"VRF table exact native parent": "VRF_TABLE_EXACT_NATIVE_PARENT",
|
||||
"address context": "ADDRESS_CONTEXT",
|
||||
"address/route absence outside exact acquisition": "ADDRESS_ROUTE_ABSENCE_OUTSIDE_EXACT_ACQUISITION",
|
||||
"after source/catalog set changed": "AFTER_SOURCE_CATALOG_SET_CHANGED",
|
||||
"ambiguous ID aliases": "AMBIGUOUS_ID_ALIASES",
|
||||
"ambiguous address successor": "AMBIGUOUS_ADDRESS_SUCCESSOR",
|
||||
"ambiguous equal-prefix address sources": "AMBIGUOUS_EQUAL_PREFIX_ADDRESS_SOURCES",
|
||||
"ambiguous members": "AMBIGUOUS_MEMBERS",
|
||||
"ambiguous target companion": "AMBIGUOUS_TARGET_COMPANION",
|
||||
"bounded native active virtual shape": "BOUNDED_NATIVE_ACTIVE_VIRTUAL_SHAPE",
|
||||
"bounded native inactive virtual shape": "BOUNDED_NATIVE_INACTIVE_VIRTUAL_SHAPE",
|
||||
"bounded virtual disable shape": "BOUNDED_VIRTUAL_DISABLE_SHAPE",
|
||||
"catalog budget": "CATALOG_BUDGET",
|
||||
"checkpoint parent/configuration/order drift": "CHECKPOINT_PARENT_CONFIGURATION_ORDER_DRIFT",
|
||||
"checkpoint scope": "CHECKPOINT_SCOPE",
|
||||
"checkpoint target changed": "CHECKPOINT_TARGET_CHANGED",
|
||||
"companion acquired foreign ID": "COMPANION_ACQUIRED_FOREIGN_ID",
|
||||
"complete raw17 snapshot": "COMPLETE_RAW17_SNAPSHOT",
|
||||
"connected route local-address shape changed": "CONNECTED_ROUTE_LOCAL_ADDRESS_SHAPE_CHANGED",
|
||||
"dependency connected route identity": "DEPENDENCY_CONNECTED_ROUTE_IDENTITY",
|
||||
"dependency object source": "DEPENDENCY_OBJECT_SOURCE",
|
||||
"disabled/deleted table unexpectedly present": "DISABLED_DELETED_TABLE_UNEXPECTEDLY_PRESENT",
|
||||
"disabled/unknown selected address unsupported": "DISABLED_UNKNOWN_SELECTED_ADDRESS_UNSUPPORTED",
|
||||
"dynamic non-link-local address": "DYNAMIC_NON_LINK_LOCAL_ADDRESS",
|
||||
"foreign VRF configuration/order changed": "FOREIGN_VRF_CONFIGURATION_ORDER_CHANGED",
|
||||
"historical LL absence changed": "HISTORICAL_LL_ABSENCE_CHANGED",
|
||||
"history source changed": "HISTORY_SOURCE_CHANGED",
|
||||
"inactive causal cycle/table absence changed": "INACTIVE_CAUSAL_CYCLE_TABLE_ABSENCE_CHANGED",
|
||||
"inactive causal identity/context changed": "INACTIVE_CAUSAL_IDENTITY_CONTEXT_CHANGED",
|
||||
"inactive virtual chronology": "INACTIVE_VIRTUAL_CHRONOLOGY",
|
||||
"incomplete legacy GRE provenance": "INCOMPLETE_LEGACY_GRE_PROVENANCE",
|
||||
"link-local parent flags/MAC": "LINK_LOCAL_PARENT_FLAGS_MAC",
|
||||
"main VRF shape": "MAIN_VRF_SHAPE",
|
||||
"mapped IPv6 alias": "MAPPED_IPV6_ALIAS",
|
||||
"member concrete type/parent identity changed": "MEMBER_CONCRETE_TYPE_PARENT_IDENTITY_CHANGED",
|
||||
"member native VRF context": "MEMBER_NATIVE_VRF_CONTEXT",
|
||||
"member status native shape": "MEMBER_STATUS_NATIVE_SHAPE",
|
||||
"missing LL causal member": "MISSING_LL_CAUSAL_MEMBER",
|
||||
"missing LL causal witnesses": "MISSING_LL_CAUSAL_WITNESSES",
|
||||
"missing LL member causal identity/MAC/context changed": "MISSING_LL_MEMBER_CAUSAL_IDENTITY_MAC_CONTEXT_CHANGED",
|
||||
"missing inactive causal virtual": "MISSING_INACTIVE_CAUSAL_VIRTUAL",
|
||||
"missing ordered main VRF": "MISSING_ORDERED_MAIN_VRF",
|
||||
"missing primary ACK target ID": "MISSING_PRIMARY_ACK_TARGET_ID",
|
||||
"missing prior virtual interface": "MISSING_PRIOR_VIRTUAL_INTERFACE",
|
||||
"missing resulting virtual interface": "MISSING_RESULTING_VIRTUAL_INTERFACE",
|
||||
"missing/ambiguous proven connected route": "MISSING_AMBIGUOUS_PROVEN_CONNECTED_ROUTE",
|
||||
"native ID": "NATIVE_ID",
|
||||
"native row": "NATIVE_ROW",
|
||||
"new address/route adoption forbidden": "NEW_ADDRESS_ROUTE_ADOPTION_FORBIDDEN",
|
||||
"new table unknown fields": "NEW_TABLE_UNKNOWN_FIELDS",
|
||||
"new virtual unknown fields/defaults/generated identity": "NEW_VIRTUAL_UNKNOWN_FIELDS_DEFAULTS_GENERATED_IDENTITY",
|
||||
"newly enabled table unknown fields": "NEWLY_ENABLED_TABLE_UNKNOWN_FIELDS",
|
||||
"non-JSON raw value": "NON_JSON_RAW_VALUE",
|
||||
"opaque configuration drift": "OPAQUE_CONFIGURATION_DRIFT",
|
||||
"prefix length": "PREFIX_LENGTH",
|
||||
"private checkpoint budget": "PRIVATE_CHECKPOINT_BUDGET",
|
||||
"private checkpoint budget/key": "PRIVATE_CHECKPOINT_BUDGET_KEY",
|
||||
"private checkpoint encoding": "PRIVATE_CHECKPOINT_ENCODING",
|
||||
"private checkpoint scope/version": "PRIVATE_CHECKPOINT_SCOPE_VERSION",
|
||||
"private checkpoint signature": "PRIVATE_CHECKPOINT_SIGNATURE",
|
||||
"private checkpoint source/history": "PRIVATE_CHECKPOINT_SOURCE_HISTORY",
|
||||
"raw byte budget": "RAW_BYTE_BUDGET",
|
||||
"reenable generated identity/chronology": "REENABLE_GENERATED_IDENTITY_CHRONOLOGY",
|
||||
"requested primary field mismatch": "REQUESTED_PRIMARY_FIELD_MISMATCH",
|
||||
"revived route local-address shape": "REVIVED_ROUTE_LOCAL_ADDRESS_SHAPE",
|
||||
"singleton cardinality": "SINGLETON_CARDINALITY",
|
||||
"static address identity changed": "STATIC_ADDRESS_IDENTITY_CHANGED",
|
||||
"static address provenance/context": "STATIC_ADDRESS_PROVENANCE_CONTEXT",
|
||||
"unknown member selector": "UNKNOWN_MEMBER_SELECTOR",
|
||||
"unknown private checkpoint": "UNKNOWN_PRIVATE_CHECKPOINT",
|
||||
"unrecognized serialized checkpoint": "UNRECOGNIZED_SERIALIZED_CHECKPOINT",
|
||||
"unrequested enabled transition": "UNREQUESTED_ENABLED_TRANSITION",
|
||||
"unreviewed CREATE defaults": "UNREVIEWED_CREATE_DEFAULTS",
|
||||
"virtual interface ID changed": "VIRTUAL_INTERFACE_ID_CHANGED"
|
||||
} as const)
|
||||
export type VrfTransitionGuard = typeof VRF_TRANSITION_REASON_CODES[keyof typeof VRF_TRANSITION_REASON_CODES] | "FOREIGN_CATALOG_CONFIGURATION_ORDER_CHANGED"
|
||||
export const VRF_TRANSITION_GUARDS = [...Object.values(VRF_TRANSITION_REASON_CODES), "FOREIGN_CATALOG_CONFIGURATION_ORDER_CHANGED"] as const
|
||||
export const VRF_TRANSITION_SECTIONS = ["member-inventory", "before-address", "after-address", "LL-comparison", "connected-route", "virtual", "foreign"] as const
|
||||
export type VrfTransitionSection = typeof VRF_TRANSITION_SECTIONS[number]
|
||||
export interface VrfTransitionRefusalTag { guard: VrfTransitionGuard; section?: VrfTransitionSection }
|
||||
const guards = new Set<string>(VRF_TRANSITION_GUARDS), sections = new Set<string>(VRF_TRANSITION_SECTIONS)
|
||||
const owned = new WeakMap<object, Readonly<VrfTransitionRefusalTag>>()
|
||||
/** Internal transition must() calls this immediately after creating its Error.
|
||||
* Preserve that exact Error and its properties; no replacement/wrapping. */
|
||||
export function noteVrfTransitionRefusal(error: Error, reason: string, explicit?: VrfTransitionGuard): void {
|
||||
try {
|
||||
if (typeof reason !== "string") return
|
||||
const guard = explicit ?? (Object.hasOwn(VRF_TRANSITION_REASON_CODES, reason) ? VRF_TRANSITION_REASON_CODES[reason as keyof typeof VRF_TRANSITION_REASON_CODES] : undefined)
|
||||
if (types.isNativeError(error) && guard && guards.has(guard)) owned.set(error, Object.freeze({ guard }))
|
||||
} catch { /* Diagnostic recording cannot replace the original refusal. */ }
|
||||
}
|
||||
export function readVrfTransitionRefusal(error: unknown): VrfTransitionRefusalTag | undefined {
|
||||
if (!error || typeof error !== "object") return undefined
|
||||
const value = owned.get(error)
|
||||
return value ? { ...value } : undefined
|
||||
}
|
||||
/** Synchronous pure classifier sections only. Never tag an unowned error; keep
|
||||
* the innermost established section and rethrow the original object unchanged. */
|
||||
export function withVrfTransitionSection<T>(section: VrfTransitionSection, work: () => T): T {
|
||||
try { return work() } catch (error) {
|
||||
try {
|
||||
if (error && typeof error === "object") {
|
||||
const value = owned.get(error)
|
||||
if (value && !value.section && sections.has(section)) owned.set(error, Object.freeze({ ...value, section }))
|
||||
}
|
||||
} catch { /* Never replace the original error. */ }
|
||||
throw error
|
||||
}
|
||||
}
|
||||
@@ -43,15 +43,24 @@ function fixture(t: TestContext, outcomes: Outcome[]) {
|
||||
}
|
||||
}
|
||||
|
||||
test("dependency reset retries the same GET with fresh authority, reduced time, and one capture slot", async t => {
|
||||
const { client, paths, timeouts } = fixture(t, ["reset", "ok", "reset"])
|
||||
test("two distinct dependency resets can retry with fresh authority and the original read deadlines", async t => {
|
||||
const { client, paths, timeouts } = fixture(t, ["reset", "ok", "reset", "ok", "reset"])
|
||||
let authorized = 0, clock = 0
|
||||
const read = createWireguardDependencyReader(client, async () => { if (++authorized === 2) clock += 120 }, () => clock)
|
||||
assert.deepEqual(await read("/interface"), [])
|
||||
await assert.rejects(read("/routing/ospf/neighbor"), { code: "STATE_UNAVAILABLE" })
|
||||
assert.equal(authorized, 3)
|
||||
assert.deepEqual(paths, ["/rest/interface", "/rest/interface", "/rest/routing/ospf/neighbor"])
|
||||
assert.deepEqual(timeouts, [10_000, 9_880, 10_000])
|
||||
assert.deepEqual(await read("/routing/ospf/neighbor"), [])
|
||||
await assert.rejects(read("/ip/route"), { code: "STATE_UNAVAILABLE" })
|
||||
assert.equal(authorized, 5)
|
||||
assert.deepEqual(paths, ["/rest/interface", "/rest/interface", "/rest/routing/ospf/neighbor", "/rest/routing/ospf/neighbor", "/rest/ip/route"])
|
||||
assert.deepEqual(timeouts, [10_000, 9_880, 10_000, 10_000, 10_000])
|
||||
})
|
||||
|
||||
test("the same catalogue cannot use the second retry slot", async t => {
|
||||
const { client, paths } = fixture(t, ["reset", "reset", "reset"])
|
||||
const read = createWireguardDependencyReader(client, async () => {})
|
||||
await assert.rejects(read("/interface"), { code: "STATE_UNAVAILABLE" })
|
||||
await assert.rejects(read("/interface"), { code: "STATE_UNAVAILABLE" })
|
||||
assert.equal(paths.length, 3)
|
||||
})
|
||||
|
||||
test("post-header reset, refusal, malformed body and unproven reset cannot replay", async t => {
|
||||
@@ -67,13 +76,13 @@ test("post-header reset, refusal, malformed body and unproven reset cannot repla
|
||||
assert.equal(calls, 1)
|
||||
})
|
||||
|
||||
test("base IPv4 and IPv6 address reads never retry or use the dependency slot", async t => {
|
||||
const { client, paths } = fixture(t, ["reset", "reset", "reset", "ok"])
|
||||
test("IPv4 and IPv6 reads share the dependency retry budget", async t => {
|
||||
const { client, paths } = fixture(t, ["reset", "ok", "reset", "ok", "reset"])
|
||||
const read = createWireguardDependencyReader(client, async () => {})
|
||||
await assert.rejects(read("/ip/address"), { code: "STATE_UNAVAILABLE" })
|
||||
await assert.rejects(read("/ipv6/address"), { code: "STATE_UNAVAILABLE" })
|
||||
assert.deepEqual(await read("/interface"), [])
|
||||
assert.deepEqual(paths, ["/rest/ip/address", "/rest/ipv6/address", "/rest/interface", "/rest/interface"])
|
||||
assert.deepEqual(await read("/ip/address"), [])
|
||||
assert.deepEqual(await read("/ipv6/address"), [])
|
||||
await assert.rejects(read("/interface"), { code: "STATE_UNAVAILABLE" })
|
||||
assert.deepEqual(paths, ["/rest/ip/address", "/rest/ip/address", "/rest/ipv6/address", "/rest/ipv6/address", "/rest/interface"])
|
||||
})
|
||||
|
||||
test("retry authority denial and deadline expiry stop before transport", async t => {
|
||||
|
||||
@@ -46,20 +46,22 @@ function nativeRows(raw: unknown, required: string[] = []): Row[] {
|
||||
return raw as Row[]
|
||||
}
|
||||
|
||||
/** Share one retry across this dependency capture and renew source authority before using it. */
|
||||
/** Retry at most two distinct catalogue GETs per capture, with fresh source authority. */
|
||||
export function createWireguardDependencyReader(client: Pick<MikrotikClient, "get">, authorizeSource: () => Promise<unknown>, now = () => performance.now()) {
|
||||
const timeoutMs = 10_000, maxBytes = 1_048_576
|
||||
const unavailable = () => fail("STATE_UNAVAILABLE", "Не прочитан обязательный источник зависимостей WireGuard")
|
||||
let retried = false
|
||||
const retriedPaths = new Set<string>()
|
||||
return async (path: string): Promise<unknown> => {
|
||||
await authorizeSource()
|
||||
const deadline = now() + timeoutMs
|
||||
try {
|
||||
return await client.get(path, timeoutMs, undefined, maxBytes)
|
||||
} catch (error) {
|
||||
if (retried || !wireguardInterfaceDependencyPaths.includes(path) || !isRouterOsPreHeaderGetReset(error) || now() >= deadline) throw unavailable()
|
||||
const retryableCatalogue = path === "/ip/address" || path === "/ipv6/address" || wireguardInterfaceDependencyPaths.includes(path)
|
||||
if (retriedPaths.size >= 2 || retriedPaths.has(path) || !retryableCatalogue
|
||||
|| !isRouterOsPreHeaderGetReset(error) || now() >= deadline) throw unavailable()
|
||||
}
|
||||
retried = true
|
||||
retriedPaths.add(path)
|
||||
await authorizeSource()
|
||||
const remaining = Math.floor(deadline - now())
|
||||
if (remaining < 1) throw unavailable()
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
import { pool } from "../db/index.js"
|
||||
import { getServerRowById, type ServerRow } from "../modules/servers/repository/servers-repository.js"
|
||||
import { fingerprint, McpError, privateFingerprinter } from "../modules/mcp/security.js"
|
||||
import { MikrotikClient } from "./mikrotik.js"
|
||||
import { isRouterOsPreHeaderGetReset, MikrotikClient } from "./mikrotik.js"
|
||||
import { observedBoolean } from "./ospf-observed-values.js"
|
||||
import { withApplicationMutationLock, withConfigMutationLock } from "./config-mutation-lock.js"
|
||||
import { captureAndAppendRevision } from "./config-revisions.js"
|
||||
@@ -56,9 +56,21 @@ export function wireguardPeerDeletionTarget(state: WireguardPeerDeletionState, i
|
||||
export async function readWireguardPeerDeletionState(server: ServerRow, beforeRead: () => Promise<unknown> = async () => {}): Promise<WireguardPeerDeletionState> {
|
||||
const sign = await privateFingerprinter("wireguard-peer-delete-v1"), serverProof = sign(fingerprint(wireguardEndpointSource(server)))
|
||||
const client = MikrotikClient.fromServer(server)
|
||||
let catalogueRetryUsed = false
|
||||
const read = async (path: string) => {
|
||||
await source(server, beforeRead)
|
||||
const deadline = performance.now() + 10_000
|
||||
try { return await client.get<unknown>(path, 10000, undefined, 1048576) }
|
||||
catch (error) {
|
||||
if (catalogueRetryUsed || !isRouterOsPreHeaderGetReset(error) || performance.now() >= deadline) {
|
||||
throw problem("Native-каталог WireGuard недоступен", "STATE_UNAVAILABLE")
|
||||
}
|
||||
}
|
||||
catalogueRetryUsed = true
|
||||
await source(server, beforeRead)
|
||||
const remaining = Math.floor(deadline - performance.now())
|
||||
if (remaining < 1) throw problem("Native-каталог WireGuard недоступен", "STATE_UNAVAILABLE")
|
||||
try { return await client.get<unknown>(path, remaining, undefined, 1048576) }
|
||||
catch { throw problem("Native-каталог WireGuard недоступен", "STATE_UNAVAILABLE") }
|
||||
}
|
||||
const rawInterfaces = await read("/interface/wireguard"), rawPeers = await read("/interface/wireguard/peers")
|
||||
|
||||
@@ -0,0 +1,351 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { randomUUID } from "node:crypto"
|
||||
import { createServer } from "node:http"
|
||||
import { setTimeout as delay } from "node:timers/promises"
|
||||
import { SignJWT } from "jose"
|
||||
import type { FastifyInstance } from "fastify"
|
||||
import type { BridgeVlanDesired, BridgeVlanState } from "@mmapp/contracts/bridge-vlan"
|
||||
import { mcpConnectionCreateSchema } from "@mmapp/contracts/mcp"
|
||||
import { env } from "../config.js"
|
||||
import { pool } from "../db/index.js"
|
||||
import type { AuthUser } from "../lib/permissions.js"
|
||||
import { accessGeneration, decryptSecret, encryptSecret, fingerprint } from "../modules/mcp/security.js"
|
||||
import { bridgeVlanCurrentDesired } from "../services/bridge-vlan-configuration.js"
|
||||
import { createMcpConnection, authenticateMcpToken, setConnectionStatus } from "../modules/mcp/store.js"
|
||||
import { invokeMcpTool, approvePlan } from "../modules/mcp/runtime.js"
|
||||
|
||||
/** Synthetic SQL and two HTTP loopback endpoints only. The sealed channel is
|
||||
* seeded: this does not claim channel registration, TLS or network independence. */
|
||||
export async function verifyMcpBridgeVlanConfiguration(actor: AuthUser, app: FastifyInstance) {
|
||||
const serverId = 91801, channelId = randomUUID(), connections: string[] = [], pending = new Set<string>()
|
||||
type Row = Record<string, string>
|
||||
type Rows = Record<string, Row[]>
|
||||
const initial: Rows = {
|
||||
"/interface/ethernet": [
|
||||
{ ".id": "*2", name: "ether2", disabled: "false" }, { ".id": "*3", name: "ether3", disabled: "false" },
|
||||
{ ".id": "*4", name: "ether-mgmt", disabled: "false" }, { ".id": "*9", name: "ether9", disabled: "false" },
|
||||
],
|
||||
"/interface/bridge": [{ ".id": "*1", name: "br-users", pvid: "1", "vlan-filtering": "false", "frame-types": "admit-all", "ingress-filtering": "true", mvrp: "false", disabled: "false", opaque: "preserve-bridge" }, { ".id": "*8", name: "br-foreign", pvid: "1", "vlan-filtering": "false", "frame-types": "admit-all", "ingress-filtering": "true", mvrp: "false", disabled: "false" }],
|
||||
"/interface/bridge/port": [{ ".id": "*10", bridge: "br-users", interface: "ether2", pvid: "10", "ingress-filtering": "true", "frame-types": "admit-all", disabled: "false", opaque: "preserve-port" }, { ".id": "*98", bridge: "br-foreign", interface: "ether9", pvid: "99", "ingress-filtering": "true", "frame-types": "admit-all", disabled: "false" }],
|
||||
"/interface/bridge/vlan": [{ ".id": "*11", bridge: "br-users", "vlan-ids": "10", tagged: "br-users", untagged: "ether2", disabled: "false", dynamic: "false", comment: "existing-membership", opaque: "preserve-static" }, { ".id": "*99", bridge: "br-foreign", "vlan-ids": "99", tagged: "br-foreign", untagged: "ether9", dynamic: "false", disabled: "false" }],
|
||||
"/interface/vlan": [], "/interface/gre": [], "/interface/wireguard": [], "/interface/vxlan": [], "/ip/vrf": [],
|
||||
"/ip/address": [{ ".id": "*20", interface: "ether-mgmt", address: "127.0.0.1/8", disabled: "false", dynamic: "false" }], "/ipv6/address": [],
|
||||
}
|
||||
initial["/interface/bridge/vlan"].push({ ".id": "*30", bridge: "br-users", "vlan-ids": "10", dynamic: "true", "current-untagged": "ether2", disabled: "false" })
|
||||
let rows = structuredClone(initial), commands: string[] = [], nextId = 160, lostAck = false, managementReads = 0, primaryIdentityReads = 0
|
||||
let beforePrimaryIdentity: (() => void) | undefined
|
||||
const router = createServer(async (req, res) => {
|
||||
res.setHeader("content-type", "application/json")
|
||||
const path = decodeURIComponent((req.url ?? "").replace(/^\/rest/, ""))
|
||||
if (req.method === "GET") {
|
||||
if (path === "/system/license") {
|
||||
primaryIdentityReads++
|
||||
if (beforePrimaryIdentity) { const run = beforePrimaryIdentity; beforePrimaryIdentity = undefined; run() }
|
||||
res.end(JSON.stringify({ "system-id": "synthetic-bridge-device" })); return
|
||||
}
|
||||
if (path === "/interface") { res.end(JSON.stringify(Object.entries(rows).filter(([key]) => ["/interface/ethernet", "/interface/bridge"].includes(key)).flatMap(([key, values]) => values.map(row => ({ ...row, type: key.endsWith("ethernet") ? "ether" : "bridge" }))))); return }
|
||||
if (!Object.hasOwn(rows, path)) { res.statusCode = 404; res.end("{}"); return }
|
||||
res.end(JSON.stringify(rows[path])); return
|
||||
}
|
||||
const base = Object.keys(rows).sort((a, b) => b.length - a.length).find(key => path === key || path.startsWith(key + "/"))
|
||||
assert.ok(base, "Only declared fixture collections may be mutated")
|
||||
let raw = ""; for await (const chunk of req) raw += chunk
|
||||
const input = raw ? JSON.parse(raw) : {}
|
||||
const fields = Object.fromEntries(Object.entries(input).map(([key, value]) => [key, value === "yes" ? "true" : value === "no" ? "false" : String(value)]))
|
||||
commands.push(req.method + " " + path)
|
||||
if (req.method === "PUT") {
|
||||
const row = { ".id": "*" + (++nextId).toString(16), ...fields, dynamic: "false" }; rows[base].push(row)
|
||||
if (lostAck) { lostAck = false; req.socket.destroy(); return }
|
||||
res.end(JSON.stringify(row)); return
|
||||
}
|
||||
if (req.method === "PATCH") { const row = rows[base].find(row => row[".id"] === path.slice(base.length + 1)); assert.ok(row); Object.assign(row, fields); res.end(JSON.stringify(row)); return }
|
||||
if (req.method === "DELETE") { const id = path.slice(base.length + 1); assert.ok(rows[base].some(row => row[".id"] === id)); rows[base] = rows[base].filter(row => row[".id"] !== id); res.end("{}"); return }
|
||||
res.statusCode = 405; res.end("{}")
|
||||
})
|
||||
const management = createServer((req, res) => {
|
||||
managementReads++; assert.equal(req.method, "GET"); assert.equal(req.url, "/rest/system/license")
|
||||
res.setHeader("content-type", "application/json"); res.end(JSON.stringify({ "system-id": "synthetic-bridge-device" }))
|
||||
})
|
||||
await Promise.all([new Promise<void>(resolve => router.listen(0, "127.0.0.1", resolve)), new Promise<void>(resolve => management.listen(0, "127.0.0.1", resolve))])
|
||||
const cpu = { resource: "bridge", id: "*1" }, access = { resource: "ethernet", id: "*2" }, trunk = { resource: "ethernet", id: "*3" }
|
||||
const desired: BridgeVlanDesired = {
|
||||
filtering: true, pvid: 1,
|
||||
ports: [{ id: "*10", interface: access, pvid: 10, ingressFiltering: true, frameTypes: "admit-all", disabled: false }, { interface: trunk, pvid: 1, ingressFiltering: true, frameTypes: "admit-only-vlan-tagged", disabled: false }],
|
||||
vlans: [{ id: "*11", vlanIds: "10", tagged: [cpu], untagged: [access], disabled: false }, { vlanIds: "20", tagged: [cpu, trunk], untagged: [], disabled: false }], removePortIds: [], removeVlanIds: [],
|
||||
}
|
||||
const input = { serverId, bridgeId: "*1", desired }
|
||||
const issue = async (name: string, serverIds = [serverId], permissions = ["mm:network:write"], operationIds = ["network.bridge-vlan.read", "network.bridge-vlan.configure", "changes.apply", "operations.read", "operations.recover"], mode: "approval" | "autonomous" = "approval") => {
|
||||
const result = await createMcpConnection(mcpConnectionCreateSchema.parse({ name, mode, expiresAt: new Date(Date.now() + 1800000).toISOString(), permissions, scope: { allowGlobal: false, serverIds, operationIds }, limits: { callsPerMinute: 120, mutationsPerHour: 100 } }), actor)
|
||||
connections.push(result.connection.id); return { ...result, principal: await authenticateMcpToken(result.token) }
|
||||
}
|
||||
const prepare = (principal: Awaited<ReturnType<typeof authenticateMcpToken>>) => invokeMcpTool(principal, "mm_bridge_vlan_configuration_plan", input) as Promise<{ planId: string; state: string }>
|
||||
try {
|
||||
await pool.query("INSERT INTO servers(id,name,host,port,use_ssl,enabled,password) VALUES($1,'bridge-owned','127.0.0.1',$2,false,true,'synthetic-password')", [serverId, (router.address() as { port: number }).port])
|
||||
await pool.query("INSERT INTO mcp_management_channels(id,server_id,config_sealed,identity_hash,attestation,created_by,generation,expires_at) VALUES($1,$2,$3,$4,$5,$6,$7,$8)", [channelId, serverId, await encryptSecret(JSON.stringify({ host: "127.0.0.1", port: (management.address() as { port: number }).port, useSsl: false, verifySsl: true, username: "fixture", password: "synthetic-password" })), fingerprint("synthetic-bridge-device"), "Synthetic fixture: no independent network or TLS registration claim", actor.id, await accessGeneration(), new Date(Date.now() + 1800000)])
|
||||
const access = await issue("Bridge linked acceptance"), principal = access.principal
|
||||
const token = await new SignJWT({ sub: actor.id, apps: actor.apps, permissions: actor.permissions }).setProtectedHeader({ alg: "HS256" }).setIssuer(env.authIssuer).setExpirationTime("1h").sign(new TextEncoder().encode(env.jwtSecret))
|
||||
const headers = { authorization: "Bearer " + token }
|
||||
const ownerRead = await app.inject({ method: "GET", url: `/api/mcp/devices/${serverId}/bridge-vlan/configuration?connectionId=${access.connection.id}`, headers })
|
||||
assert.equal(ownerRead.statusCode, 200, ownerRead.body)
|
||||
assert.deepEqual(ownerRead.json(), await invokeMcpTool(principal, "mm_bridge_vlan_configuration_get", { serverId }))
|
||||
const denied = await issue("Bridge excluded server", []), observer = await issue("Bridge read only", [serverId], ["mm:network:read"])
|
||||
await assert.rejects(prepare(denied.principal), (error: unknown) => (error as { code?: string }).code === "SERVER_DENIED")
|
||||
await assert.rejects(prepare(observer.principal), (error: unknown) => (error as { code?: string }).code === "CONNECTION_PERMISSION_MISSING")
|
||||
assert.deepEqual(rows, initial); assert.equal(commands.length, 0)
|
||||
const ownerPlan = await app.inject({ method: "POST", url: `/api/mcp/devices/${serverId}/bridge-vlan/configuration/plan`, headers, payload: { connectionId: access.connection.id, bridgeId: input.bridgeId, desired } })
|
||||
assert.equal(ownerPlan.statusCode, 200, ownerPlan.body)
|
||||
const plan = ownerPlan.json() as { planId: string; state: string }
|
||||
assert.equal(plan.state, "awaiting-approval"); assert.deepEqual(rows, initial); assert.equal(commands.length, 0)
|
||||
const key = randomUUID()
|
||||
const apply = (planId: string, idempotencyKey = key) => invokeMcpTool(principal, "mm_change_apply", { planId, idempotencyKey }) as Promise<{ id: string }>
|
||||
const wait = async (id: string, operationPrincipal = principal) => {
|
||||
pending.add(id)
|
||||
for (let n = 0; n < 1200; n++) {
|
||||
const state = (await pool.query("SELECT state FROM mcp_operations WHERE id=$1", [id])).rows[0]?.state as string
|
||||
if (!["pending", "running"].includes(state)) {
|
||||
pending.delete(id)
|
||||
return await invokeMcpTool(operationPrincipal, "mm_operation_get", { operationId: id }) as { state: string; verification: string; error_code: string; steps: { state: string }[] }
|
||||
}
|
||||
await delay(25)
|
||||
}
|
||||
throw Error("Bridge VLAN fixture operation unresolved; do not replay or clean live state")
|
||||
}
|
||||
await assert.rejects(apply(plan.planId)); assert.equal(commands.length, 0)
|
||||
const approval = await app.inject({ method: "POST", url: `/api/mcp/plans/${plan.planId}/decision`, headers, payload: { approve: true } })
|
||||
assert.equal(approval.statusCode, 200, approval.body)
|
||||
const operation = await apply(plan.planId), result = await wait(operation.id)
|
||||
assert.equal(result.state, "applied", JSON.stringify(result)); assert.equal(result.verification, "passed")
|
||||
assert.equal(result.steps.length, 3); assert.ok(result.steps.every(step => step.state === "verified"))
|
||||
assert.deepEqual(commands, ["PUT /interface/bridge/vlan", "PUT /interface/bridge/port", "PATCH /interface/bridge/*1"])
|
||||
assert.equal(rows["/interface/bridge"][0]["vlan-filtering"], "true")
|
||||
for (const path of ["/interface/bridge/port", "/interface/bridge/vlan"]) for (const row of initial[path]) assert.deepEqual(rows[path].find(value => value[".id"] === row[".id"]), row, "Conserve static and foreign configuration")
|
||||
assert.deepEqual(rows["/interface/bridge"][1], initial["/interface/bridge"][1]); assert.equal(rows["/interface/bridge"][0].opaque, "preserve-bridge")
|
||||
const readback = await invokeMcpTool(principal, "mm_bridge_vlan_configuration_get", { serverId }) as { state: { vlans: Row[]; ports: Row[]; bridges: Row[] } }
|
||||
assert.equal(readback.state.vlans.length, 3); assert.equal(readback.state.ports.length, 3); assert.equal(readback.state.bridges[0]["vlan-filtering"], "true")
|
||||
assert.equal((await apply(plan.planId)).id, operation.id); assert.equal(commands.length, 3)
|
||||
const recover = (operationId: string, sourcePrincipal = principal) => invokeMcpTool(sourcePrincipal, "mm_operation_recovery_plan", { operationId }) as Promise<{ planId: string; state: string }>
|
||||
const completedForward = structuredClone(rows)
|
||||
rows["/interface/bridge/vlan"][1].comment = "external-recovery-drift"
|
||||
await assert.rejects(recover(operation.id), (error: unknown) => (error as { code?: string }).code === "STATE_CONFLICT")
|
||||
assert.equal(commands.length, 3); rows = completedForward
|
||||
const createReceipt = (await pool.query("SELECT result FROM mcp_operation_steps WHERE operation_id=$1 AND step_index=0", [operation.id])).rows[0].result
|
||||
await pool.query("UPDATE mcp_operation_steps SET result=$2::jsonb WHERE operation_id=$1 AND step_index=0", [operation.id, JSON.stringify({ ...createReceipt, ".id": "*beef" })])
|
||||
try { await assert.rejects(recover(operation.id), (error: unknown) => (error as { code?: string }).code === "STATE_CONFLICT") }
|
||||
finally { await pool.query("UPDATE mcp_operation_steps SET result=$2::jsonb WHERE operation_id=$1 AND step_index=0", [operation.id, JSON.stringify(createReceipt)]) }
|
||||
assert.equal(commands.length, 3, "A checkpoint delta cannot replace the actual create ACK")
|
||||
const savedEvidence = (await pool.query("SELECT evidence FROM mcp_plans WHERE id=$1", [plan.planId])).rows[0].evidence
|
||||
const obsolete = JSON.parse(await decryptSecret(savedEvidence.sealed))
|
||||
obsolete.snapshots.find((snapshot: { resource: string }) => snapshot.resource === "bridge_port").projectionVersion = 3
|
||||
await pool.query("UPDATE mcp_plans SET evidence=$2::jsonb WHERE id=$1", [plan.planId, JSON.stringify({ sealed: await encryptSecret(JSON.stringify(obsolete)) })])
|
||||
try { await assert.rejects(recover(operation.id), (error: unknown) => (error as { code?: string }).code === "STATE_CONFLICT") }
|
||||
finally { await pool.query("UPDATE mcp_plans SET evidence=$2::jsonb WHERE id=$1", [plan.planId, JSON.stringify(savedEvidence)]) }
|
||||
const newChannelId = randomUUID()
|
||||
await pool.query("UPDATE mcp_management_channels SET id=$2 WHERE id=$1", [channelId, newChannelId])
|
||||
const inverse = await recover(operation.id)
|
||||
assert.equal(inverse.state, "awaiting-approval"); assert.equal(commands.length, 3)
|
||||
const inverseEvidence = JSON.parse(await decryptSecret((await pool.query("SELECT evidence FROM mcp_plans WHERE id=$1", [inverse.planId])).rows[0].evidence.sealed))
|
||||
assert.equal(inverseEvidence.managementChannels[0].channelId, newChannelId, "Inverse freshly verifies current management, never copies the expired source receipt")
|
||||
await assert.rejects(apply(inverse.planId, randomUUID())); assert.equal(commands.length, 3)
|
||||
await approvePlan(inverse.planId, actor, true)
|
||||
const inverseOperation = await apply(inverse.planId, randomUUID()), inverseResult = await wait(inverseOperation.id)
|
||||
assert.equal(inverseResult.state, "applied", JSON.stringify(inverseResult)); assert.equal(inverseResult.verification, "passed")
|
||||
assert.ok(inverseResult.steps.every(step => step.state === "verified"))
|
||||
assert.deepEqual(commands.slice(3).map(command => command.replace(/\*[^/]+$/, "*id")), ["PATCH /interface/bridge/*id", "DELETE /interface/bridge/vlan/*id", "DELETE /interface/bridge/port/*id"])
|
||||
assert.deepEqual(rows, initial, "Approved typed recovery restores the exact baseline and preserves foreign rows")
|
||||
rows = structuredClone(initial); commands = []
|
||||
// Legacy tools get their original operation grants only. They cannot gain
|
||||
// linked configuration authority or emit extra native resource changes.
|
||||
const generic = await issue("Bridge legacy safety", [serverId], ["mm:network:write"], ["ros.bridge.update", "ros.bridge_port.update", "ros.bridge_vlan.update", "interfaces.update", "changes.apply", "operations.read", "operations.recover"])
|
||||
const genericPlan = (tool: string, body: Record<string, unknown>) => invokeMcpTool(generic.principal, tool, { serverId, ...body }) as Promise<{ planId: string; state: string }>
|
||||
const plansBefore = (await pool.query("SELECT count(*)::int AS n FROM mcp_plans")).rows[0].n
|
||||
rows["/interface/bridge/vlan"][0].untagged = ""
|
||||
rows["/interface/bridge/vlan"][0].tagged = "br-users,ether2"
|
||||
const invalidFiltering = structuredClone(rows)
|
||||
for (const [tool, body] of [
|
||||
["mm_bridge_update_plan", { id: "*1", fields: { "vlan-filtering": true } }],
|
||||
["mm_interfaces_update_plan", { resource: "bridge", id: "*1", fields: { "vlan-filtering": true } }],
|
||||
] as const) {
|
||||
await assert.rejects(genericPlan(tool, body), (error: unknown) => (error as { code?: string }).code === "INVALID_INPUT")
|
||||
assert.deepEqual(rows, invalidFiltering); assert.equal(commands.length, 0)
|
||||
}
|
||||
rows = structuredClone(initial)
|
||||
await assert.rejects(genericPlan("mm_bridge_vlan_update_plan", { id: "*11", fields: { bridge: "br-foreign" } }), (error: unknown) => (error as { code?: string }).code === "STATE_CONFLICT")
|
||||
await assert.rejects(genericPlan("mm_bridge_vlan_update_plan", { id: "*11", fields: { tagged: "br-users,ether2" } }), (error: unknown) => (error as { code?: string }).code === "INVALID_INPUT")
|
||||
assert.deepEqual(rows, initial); assert.equal(commands.length, 0)
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_plans")).rows[0].n, plansBefore, "Invalid legacy requests produce neither plans nor writes")
|
||||
let raced = false
|
||||
beforePrimaryIdentity = () => { raced = true; rows["/interface/bridge/port"][0].pvid = "11" }
|
||||
await assert.rejects(genericPlan("mm_bridge_port_update_plan", { id: "*10", fields: { "ingress-filtering": false } }), (error: unknown) => {
|
||||
const value = error as { code?: string; message?: string }
|
||||
return value.code === "STATE_CONFLICT" && !!value.message?.includes("незапрошенные поля")
|
||||
})
|
||||
assert.equal(raced, true); assert.equal(commands.length, 0)
|
||||
assert.equal(rows["/interface/bridge/port"][0].pvid, "11", "Concurrent PVID is not silently reverted by a different requested field")
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_plans")).rows[0].n, plansBefore)
|
||||
rows = structuredClone(initial)
|
||||
const single = await genericPlan("mm_bridge_port_update_plan", { id: "*10", fields: { "ingress-filtering": false } })
|
||||
assert.equal(single.state, "awaiting-approval"); assert.deepEqual(rows, initial)
|
||||
await approvePlan(single.planId, actor, true)
|
||||
const singleOperation = await invokeMcpTool(generic.principal, "mm_change_apply", { planId: single.planId, idempotencyKey: randomUUID() }) as { id: string }
|
||||
const singleResult = await wait(singleOperation.id, generic.principal)
|
||||
assert.equal(singleResult.state, "applied", JSON.stringify(singleResult)); assert.equal(singleResult.verification, "passed")
|
||||
assert.deepEqual(singleResult.steps.map(step => step.state), ["verified"])
|
||||
assert.deepEqual(commands, ["PATCH /interface/bridge/port/*10"])
|
||||
const expected = structuredClone(initial); expected["/interface/bridge/port"][0]["ingress-filtering"] = "false"
|
||||
assert.deepEqual(rows, expected, "Valid single-field legacy change emits exactly its original command")
|
||||
const singleInverse = await recover(singleOperation.id, generic.principal)
|
||||
await approvePlan(singleInverse.planId, actor, true)
|
||||
const singleRecovered = await invokeMcpTool(generic.principal, "mm_change_apply", { planId: singleInverse.planId, idempotencyKey: randomUUID() }) as { id: string }
|
||||
const singleRecoveryResult = await wait(singleRecovered.id, generic.principal)
|
||||
assert.equal(singleRecoveryResult.state, "applied", JSON.stringify(singleRecoveryResult)); assert.equal(singleRecoveryResult.verification, "passed")
|
||||
assert.deepEqual(rows, initial, "Sensitive generic source uses typed inverse without linked configure grant")
|
||||
rows = structuredClone(initial); commands = []
|
||||
const deletionForward = await prepare(principal); await approvePlan(deletionForward.planId, actor, true)
|
||||
assert.equal((await wait((await apply(deletionForward.planId, randomUUID())).id)).state, "applied")
|
||||
const beforeDeletion = (await invokeMcpTool(principal, "mm_bridge_vlan_configuration_get", { serverId }) as { state: BridgeVlanState }).state
|
||||
const removedPortId = String(beforeDeletion.ports.find(row => row.interface === "ether3")![".id"])
|
||||
const removedVlanId = String(beforeDeletion.vlans.find(row => row["vlan-ids"] === "20")![".id"])
|
||||
const deletionDesired = bridgeVlanCurrentDesired(beforeDeletion, "*1")
|
||||
deletionDesired.ports = deletionDesired.ports.filter(row => row.id !== removedPortId); deletionDesired.removePortIds = [removedPortId]
|
||||
deletionDesired.vlans = deletionDesired.vlans.filter(row => row.id !== removedVlanId); deletionDesired.removeVlanIds = [removedVlanId]
|
||||
const deletion = await invokeMcpTool(principal, "mm_bridge_vlan_configuration_plan", { serverId, bridgeId: "*1", desired: deletionDesired }) as { planId: string }
|
||||
await approvePlan(deletion.planId, actor, true)
|
||||
const deletedOperation = await apply(deletion.planId, randomUUID()), deletedResult = await wait(deletedOperation.id)
|
||||
assert.equal(deletedResult.state, "applied", JSON.stringify(deletedResult)); assert.ok(deletedResult.steps.every(step => step.state === "verified"))
|
||||
const recreate = await recover(deletedOperation.id); assert.equal(recreate.state, "awaiting-approval")
|
||||
await approvePlan(recreate.planId, actor, true)
|
||||
const recreated = await wait((await apply(recreate.planId, randomUUID())).id)
|
||||
assert.equal(recreated.state, "applied", JSON.stringify(recreated)); assert.equal(recreated.verification, "passed"); assert.ok(recreated.steps.every(step => step.state === "verified"))
|
||||
const afterRecreation = (await invokeMcpTool(principal, "mm_bridge_vlan_configuration_get", { serverId }) as { state: BridgeVlanState }).state
|
||||
assert.notEqual(afterRecreation.ports.find(row => row.interface === "ether3")![".id"], removedPortId)
|
||||
assert.notEqual(afterRecreation.vlans.find(row => row["vlan-ids"] === "20")![".id"], removedVlanId)
|
||||
const topology = (state: BridgeVlanState) => ({ ...state,
|
||||
ports: state.ports.map(({ ".id": _id, ...row }) => row).sort((a, b) => String(a.bridge + ":" + a.interface).localeCompare(String(b.bridge + ":" + b.interface))),
|
||||
vlans: state.vlans.map(({ ".id": _id, ...row }) => row).sort((a, b) => String(a.bridge + ":" + a["vlan-ids"]).localeCompare(String(b.bridge + ":" + b["vlan-ids"]))),
|
||||
})
|
||||
assert.deepEqual(topology(afterRecreation), topology(beforeDeletion), "Deleted memberships and ports restore configuration with newly acknowledged IDs")
|
||||
for (const path of ["/interface/bridge/port", "/interface/bridge/vlan"]) for (const row of initial[path]) assert.deepEqual(rows[path].find(value => value[".id"] === row[".id"]), row)
|
||||
rows = structuredClone(initial); commands = []
|
||||
const stale = await prepare(principal); await approvePlan(stale.planId, actor, true)
|
||||
rows["/interface/bridge/vlan"][1].comment = "external-drift"
|
||||
const drift = await wait((await apply(stale.planId, randomUUID())).id)
|
||||
assert.equal(drift.state, "rejected", JSON.stringify(drift)); assert.equal(commands.length, 0, "Drift prevents every native write")
|
||||
rows = structuredClone(initial); commands = []
|
||||
const lost = await prepare(principal); await approvePlan(lost.planId, actor, true); lostAck = true
|
||||
const lostKey = randomUUID(), uncertain = await apply(lost.planId, lostKey), unknown = await wait(uncertain.id)
|
||||
assert.equal(unknown.state, "unknown", JSON.stringify(unknown)); assert.equal(commands.length, 1)
|
||||
assert.equal(rows["/interface/bridge/port"].length, initial["/interface/bridge/port"].length)
|
||||
assert.equal(rows["/interface/bridge"][0]["vlan-filtering"], "false")
|
||||
assert.equal((await apply(lost.planId, lostKey)).id, uncertain.id); assert.equal(commands.length, 1, "Unknown ACK never retries or continues")
|
||||
await assert.rejects(recover(uncertain.id), (error: unknown) => (error as { code?: string }).code === "STATE_CONFLICT")
|
||||
assert.equal(commands.length, 1, "Unknown source has no inverse authority")
|
||||
assert.ok(managementReads > 1 && primaryIdentityReads > 1, "Fresh same-identity verification on both synthetic endpoints")
|
||||
rows = structuredClone(initial); commands = []
|
||||
await pool.query("UPDATE mcp_management_channels SET identity_hash=$2 WHERE server_id=$1", [serverId, fingerprint("wrong-device")])
|
||||
await assert.rejects(prepare(principal), (error: unknown) => (error as { code?: string }).code === "STATE_CONFLICT")
|
||||
assert.equal(commands.length, 0, "A registered channel identity mismatch cannot fall back to primary")
|
||||
await pool.query("DELETE FROM mcp_management_channels WHERE server_id=$1", [serverId])
|
||||
rows["/ip/address"][0].address = "192.0.2.1/24"
|
||||
await assert.rejects(prepare(principal), (error: unknown) => (error as { code?: string }).code === "MANAGEMENT_UNSAFE")
|
||||
rows = structuredClone(initial)
|
||||
const stolenManagement = structuredClone(desired)
|
||||
stolenManagement.ports.push({ interface: { resource: "ethernet", id: "*4" }, pvid: 1, ingressFiltering: true, frameTypes: "admit-only-vlan-tagged", disabled: false })
|
||||
stolenManagement.vlans.push({ vlanIds: "30", tagged: [cpu, { resource: "ethernet", id: "*4" }], untagged: [], disabled: false })
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_bridge_vlan_configuration_plan", { ...input, desired: stolenManagement }), (error: unknown) => (error as { code?: string }).code === "MANAGEMENT_UNSAFE")
|
||||
rows["/ip/address"][0].interface = "br-users"
|
||||
await assert.rejects(prepare(principal), (error: unknown) => (error as { code?: string }).code === "MANAGEMENT_UNSAFE")
|
||||
assert.equal(commands.length, 0, "Primary admission refuses unconfirmed address, slave stealing and CPU delivery loss")
|
||||
rows = structuredClone(initial)
|
||||
const primaryPlan = await prepare(principal)
|
||||
assert.equal(primaryPlan.state, "awaiting-approval"); assert.equal(commands.length, 0)
|
||||
assert.equal((primaryPlan as unknown as { changes: { managementChannels?: unknown } }).changes.managementChannels, undefined, "Public primary plan never exposes a fake independent management receipt")
|
||||
const primaryEvidence = JSON.parse(await decryptSecret((await pool.query("SELECT evidence FROM mcp_plans WHERE id=$1", [primaryPlan.planId])).rows[0].evidence.sealed))
|
||||
assert.equal(primaryEvidence.requiresHuman, true)
|
||||
assert.equal(primaryEvidence.managementChannels, undefined, "Primary management is never represented as a registered independent receipt")
|
||||
assert.ok(primaryEvidence.warnings.some((warning: string) => warning.includes("основной адрес") && warning.includes("независимость канала не подтверждена")))
|
||||
assert.ok(Date.parse(primaryEvidence.validUntil) <= Date.parse(principal.credentialExpiresAt) && Date.parse(primaryEvidence.validUntil) <= actor.expiresAt!)
|
||||
await assert.rejects(apply(primaryPlan.planId, randomUUID())); assert.equal(commands.length, 0)
|
||||
await approvePlan(primaryPlan.planId, actor, true)
|
||||
const primaryOperation = await apply(primaryPlan.planId, randomUUID()), primaryResult = await wait(primaryOperation.id)
|
||||
assert.equal(primaryResult.state, "applied", JSON.stringify(primaryResult)); assert.equal(primaryResult.verification, "passed"); assert.ok(primaryResult.steps.every(step => step.state === "verified"))
|
||||
const primaryInverse = await recover(primaryOperation.id)
|
||||
const primaryInverseEvidence = JSON.parse(await decryptSecret((await pool.query("SELECT evidence FROM mcp_plans WHERE id=$1", [primaryInverse.planId])).rows[0].evidence.sealed))
|
||||
assert.equal(primaryInverseEvidence.managementChannels, undefined)
|
||||
await approvePlan(primaryInverse.planId, actor, true)
|
||||
const primaryRecovered = await wait((await apply(primaryInverse.planId, randomUUID())).id)
|
||||
assert.equal(primaryRecovered.state, "applied", JSON.stringify(primaryRecovered)); assert.equal(primaryRecovered.verification, "passed")
|
||||
assert.deepEqual(rows, initial)
|
||||
// A normal filtering-enabled CPU/access management VLAN may consist only
|
||||
// of native dynamic PVID membership, without any static VLAN table row.
|
||||
rows["/interface/bridge"][0]["vlan-filtering"] = "true"; rows["/interface/bridge"][0].pvid = "10"
|
||||
rows["/ip/address"][0].interface = "br-users"
|
||||
rows["/interface/bridge/vlan"] = rows["/interface/bridge/vlan"].filter(row => row[".id"] !== "*11")
|
||||
rows["/interface/bridge/vlan"].find(row => row.dynamic === "true")!["current-untagged"] = "br-users,ether2"
|
||||
const implicitBaseline = structuredClone(rows)
|
||||
const implicitState = (await invokeMcpTool(principal, "mm_bridge_vlan_configuration_get", { serverId }) as { state: BridgeVlanState }).state
|
||||
const implicitDesired = bridgeVlanCurrentDesired(implicitState, "*1")
|
||||
assert.deepEqual(implicitDesired.vlans, [])
|
||||
const implicitPrepare = (next: BridgeVlanDesired) => invokeMcpTool(principal, "mm_bridge_vlan_configuration_plan", { serverId, bridgeId: "*1", desired: next }) as Promise<{ planId: string; state: string }>
|
||||
for (const mutate of [
|
||||
(next: BridgeVlanDesired) => { next.pvid = 11 },
|
||||
(next: BridgeVlanDesired) => { next.ports[0].pvid = 11 },
|
||||
(next: BridgeVlanDesired) => { next.frameTypes = "admit-only-vlan-tagged" },
|
||||
]) {
|
||||
const unsafe = structuredClone(implicitDesired); mutate(unsafe)
|
||||
await assert.rejects(implicitPrepare(unsafe), (error: unknown) => (error as { code?: string }).code === "MANAGEMENT_UNSAFE")
|
||||
}
|
||||
for (const [tool, body] of [
|
||||
["mm_bridge_update_plan", { id: "*1", fields: { pvid: 11 } }],
|
||||
["mm_bridge_port_update_plan", { id: "*10", fields: { pvid: 11 } }],
|
||||
["mm_interfaces_update_plan", { resource: "bridge", id: "*1", fields: { "frame-types": "admit-only-vlan-tagged" } }],
|
||||
] as const) await assert.rejects(genericPlan(tool, body), (error: unknown) => (error as { code?: string }).code === "MANAGEMENT_UNSAFE")
|
||||
const writesBeforeImplicit = commands.length
|
||||
rows["/interface/bridge"][0].mvrp = "true"
|
||||
await assert.rejects(implicitPrepare(implicitDesired), (error: unknown) => (error as { code?: string }).code === "UNSUPPORTED_CAPABILITY")
|
||||
rows = structuredClone(implicitBaseline)
|
||||
for (const field of ["frame-types", "ingress-filtering"]) {
|
||||
delete rows["/interface/bridge"][0][field]
|
||||
await assert.rejects(implicitPrepare(implicitDesired))
|
||||
rows = structuredClone(implicitBaseline)
|
||||
}
|
||||
assert.equal(commands.length, writesBeforeImplicit)
|
||||
implicitDesired.ports[0].ingressFiltering = false
|
||||
const implicitPlan = await implicitPrepare(implicitDesired)
|
||||
assert.equal(implicitPlan.state, "awaiting-approval"); assert.equal(commands.length, writesBeforeImplicit)
|
||||
await approvePlan(implicitPlan.planId, actor, true)
|
||||
const implicitOperation = await apply(implicitPlan.planId, randomUUID()), implicitResult = await wait(implicitOperation.id)
|
||||
assert.equal(implicitResult.state, "applied", JSON.stringify(implicitResult)); assert.equal(implicitResult.verification, "passed")
|
||||
assert.deepEqual(implicitResult.steps.map(step => step.state), ["verified"])
|
||||
assert.deepEqual(commands.slice(writesBeforeImplicit), ["PATCH /interface/bridge/port/*10"], "Derived dynamic PVID rows never become native commands")
|
||||
const implicitInverse = await recover(implicitOperation.id)
|
||||
await approvePlan(implicitInverse.planId, actor, true)
|
||||
const implicitRecovered = await wait((await apply(implicitInverse.planId, randomUUID())).id)
|
||||
assert.equal(implicitRecovered.state, "applied", JSON.stringify(implicitRecovered)); assert.equal(implicitRecovered.verification, "passed")
|
||||
assert.deepEqual(rows, implicitBaseline, "Implicit-PVID CPU management survives approved forward and typed inverse")
|
||||
const beforeCpuEdit = commands.length
|
||||
const cpuOnly = await genericPlan("mm_interfaces_update_plan", { resource: "bridge", id: "*1", fields: { "ingress-filtering": false } })
|
||||
await approvePlan(cpuOnly.planId, actor, true)
|
||||
const cpuOperation = await invokeMcpTool(generic.principal, "mm_change_apply", { planId: cpuOnly.planId, idempotencyKey: randomUUID() }) as { id: string }
|
||||
const cpuResult = await wait(cpuOperation.id, generic.principal)
|
||||
assert.equal(cpuResult.state, "applied", JSON.stringify(cpuResult)); assert.equal(cpuResult.verification, "passed")
|
||||
assert.deepEqual(commands.slice(beforeCpuEdit), ["PATCH /interface/bridge/*1"])
|
||||
const cpuInverse = await recover(cpuOperation.id, generic.principal); await approvePlan(cpuInverse.planId, actor, true)
|
||||
const cpuRecovered = await invokeMcpTool(generic.principal, "mm_change_apply", { planId: cpuInverse.planId, idempotencyKey: randomUUID() }) as { id: string }
|
||||
assert.equal((await wait(cpuRecovered.id, generic.principal)).state, "applied")
|
||||
assert.deepEqual(rows, implicitBaseline, "CPU ingress alias edit and typed inverse preserve implicit PVID management without extra authority")
|
||||
rows = structuredClone(initial)
|
||||
const autonomous = await issue("Primary still human approved", [serverId], ["mm:network:write"], undefined, "autonomous")
|
||||
const humanOnly = await prepare(autonomous.principal)
|
||||
assert.equal(humanOnly.state, "awaiting-approval")
|
||||
const beforeAutonomousApply = commands.length
|
||||
await assert.rejects(invokeMcpTool(autonomous.principal, "mm_change_apply", { planId: humanOnly.planId, idempotencyKey: randomUUID() }), (error: unknown) => (error as { code?: string }).code === "APPROVAL_REQUIRED")
|
||||
assert.equal(commands.length, beforeAutonomousApply); assert.deepEqual(rows, initial)
|
||||
console.log("✓ Linked bridge VLAN SQL/HTTP: approved forward/recovery and delete recreation, fresh registered or human-only primary management, unsafe primary/identity and autonomous bypass refusals, terminal drift/ACK/projection guards, REST/MCP and legacy safety; HTTP fixture only, no TLS/independence claim")
|
||||
} finally {
|
||||
if (!pending.size) {
|
||||
for (const id of connections) await setConnectionStatus(id, "paused", actor)
|
||||
await pool.query("DELETE FROM servers WHERE id=$1", [serverId])
|
||||
}
|
||||
await Promise.all([new Promise<void>((resolve, reject) => router.close(error => error ? reject(error) : resolve())), new Promise<void>((resolve, reject) => management.close(error => error ? reject(error) : resolve()))])
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,219 @@
|
||||
import assert from "node:assert/strict"
|
||||
import { randomUUID } from "node:crypto"
|
||||
import { createServer } from "node:http"
|
||||
import { setTimeout as delay } from "node:timers/promises"
|
||||
import { mcpConnectionCreateSchema } from "@mmapp/contracts/mcp"
|
||||
import type { AuthUser } from "../lib/permissions.js"
|
||||
import { pool } from "../db/index.js"
|
||||
import { ensurePartitionFor } from "../db/partitions.js"
|
||||
import { createMcpConnection, authenticateMcpToken, setConnectionStatus } from "../modules/mcp/store.js"
|
||||
import { invokeMcpTool, approvePlan } from "../modules/mcp/runtime.js"
|
||||
import { addBinding } from "../modules/users/service/users-service.js"
|
||||
import { userBindingCreateSchema } from "@mmapp/contracts/users"
|
||||
|
||||
/** Owned PostgreSQL and loopback RouterOS fixture; never writes to a real router. */
|
||||
export async function verifyMcpUserBindings(actor: AuthUser) {
|
||||
const serverId = 91731, login = "mcp-binding-" + randomUUID(), connections: string[] = []
|
||||
let userId: string | undefined, otherUserId: string | undefined, nativeReads = 0, nativeWrites = 0
|
||||
const otherLogin = login + "-other", wgKey = Buffer.alloc(32, 7).toString("base64")
|
||||
const fixtures = [
|
||||
{ name: "ether-owned-user", type: "ether", raw: "ether" },
|
||||
{ name: "bridge-owned-user", type: "bridge", raw: "bridge" },
|
||||
{ name: "vlan-owned-user", type: "vlan", raw: "vlan" },
|
||||
{ name: "vxlan-owned-user", type: "vxlan", raw: "vxlan" },
|
||||
{ name: "gre-owned-user", type: "gre", raw: "gre-tunnel" },
|
||||
{ name: "other-owned-user", type: "other", raw: "dummy" },
|
||||
{ name: "wg-owned-user", type: "wg", raw: "wg", peerPublicKey: wgKey },
|
||||
{ name: "ipsec-vpn", type: "ipsec", raw: "ipsec", peerPublicKey: "owned-client-cn" },
|
||||
{ name: "ipsec-vpn", type: "ipsec", raw: "ipsec", peerPublicKey: "owned-psk" },
|
||||
]
|
||||
const pendingOperations = new Set<string>()
|
||||
const router = createServer((req, res) => {
|
||||
res.setHeader("content-type", "application/json")
|
||||
if (req.method !== "GET") { nativeWrites++; res.statusCode = 405; res.end("{}"); return }
|
||||
nativeReads++
|
||||
const path = new URL(req.url ?? "/", "http://127.0.0.1").pathname.replace(/^\/rest/, "")
|
||||
const rows = path === "/interface" ? fixtures.filter(iface => iface.type !== "ipsec").map((iface, index) => ({ ".id": "*" + (index + 1).toString(16), name: iface.name, type: iface.raw, running: "true", disabled: "false" }))
|
||||
: path === "/interface/wireguard/peers"
|
||||
? [{ ".id": "*A", interface: "wg-owned-user", "public-key": wgKey, name: "Owned WG peer", "allowed-address": "192.0.2.7/32", disabled: "false" }]
|
||||
: path === "/certificate" ? [{ ".id": "*B", name: "ipsec-user-owned-client", "common-name": "owned-client-cn", ca: "owned-ca", "key-usage": "tls-client" }]
|
||||
: path === "/ip/ipsec/identity" ? [{ ".id": "*C", peer: "ike-owned", "auth-method": "pre-shared-key", comment: "MikrotikManager:ipsec user=owned-psk" }] : []
|
||||
res.end(JSON.stringify(rows))
|
||||
})
|
||||
await new Promise<void>(resolve => router.listen(0, "127.0.0.1", resolve))
|
||||
const operations = ["users.create", "users.get", "users.interfaces.read", "users.interfaces.state", "users.binding_add", "users.binding_remove", "users.delete", "changes.apply", "operations.read"]
|
||||
const issue = async (name: string, serverIds: number[], permissions = ["mm:users:write"]) => {
|
||||
const access = await createMcpConnection(mcpConnectionCreateSchema.parse({ name, mode: "approval", expiresAt: new Date(Date.now() + 1800000).toISOString(), permissions,
|
||||
scope: { allowGlobal: true, serverIds, operationIds: operations }, limits: { callsPerMinute: 2000, mutationsPerHour: 100 } }), actor)
|
||||
connections.push(access.connection.id)
|
||||
return authenticateMcpToken(access.token)
|
||||
}
|
||||
const state = async () => ({
|
||||
users: (await pool.query("SELECT * FROM app_users WHERE login=ANY($1::text[]) ORDER BY login", [[login, otherLogin]])).rows,
|
||||
bindings: (await pool.query("SELECT * FROM user_interface_bindings WHERE server_id=$1 ORDER BY id", [serverId])).rows,
|
||||
})
|
||||
const matches = (code: string) => (error: unknown) => (error as { code?: string }).code === code
|
||||
try {
|
||||
await pool.query("INSERT INTO servers(id,name,host,port,use_ssl,enabled) VALUES($1,'owned-user-binding','127.0.0.1',$2,false,true)", [serverId, (router.address() as { port: number }).port])
|
||||
const sampledAt = new Date()
|
||||
await ensurePartitionFor(pool, "server_snapshots", "week", sampledAt)
|
||||
await pool.query("INSERT INTO server_snapshots(server_id,polled_at,status,raw_interfaces) VALUES($1,$2,'online',$3::jsonb)", [serverId, sampledAt.toISOString(), JSON.stringify(fixtures.filter(iface => iface.type !== "ipsec").map(iface => ({ name: iface.name, type: iface.raw, running: true, disabled: false })))])
|
||||
const principal = await issue("User binding journey", [serverId])
|
||||
const narrow = await issue("User binding excluded server", [])
|
||||
const readOnly = await issue("User binding read only", [serverId], ["mm:users:read"])
|
||||
const getUser = async () => (await invokeMcpTool(principal, "mm_users_get", { id: userId }) as { user: { id: string; login: string; bindings: { id: string; serverId: number; interfaceName: string; interfaceType: string; peerPublicKey: string }[] } }).user
|
||||
const apply = async (tool: string, input: unknown, expected: "applied" | "stale" | "race" = "applied", prepared?: { planId: string; state: string }) => {
|
||||
const before = await state()
|
||||
const plan = prepared ?? await invokeMcpTool(principal, tool, input) as { planId: string; state: string }
|
||||
assert.equal(plan.state, "awaiting-approval")
|
||||
assert.deepEqual(await state(), before, tool + " preparation changes no users or bindings")
|
||||
const key = randomUUID()
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_change_apply", { planId: plan.planId, idempotencyKey: key }), matches("APPROVAL_REQUIRED"))
|
||||
assert.deepEqual(await state(), before, tool + " unapproved apply changes no users or bindings")
|
||||
await approvePlan(plan.planId, actor, true)
|
||||
const operation = await invokeMcpTool(principal, "mm_change_apply", { planId: plan.planId, idempotencyKey: key }) as { id: string }
|
||||
pendingOperations.add(operation.id)
|
||||
for (let attempt = 0; attempt < 600; attempt++) {
|
||||
const result = await invokeMcpTool(principal, "mm_operation_get", { operationId: operation.id }) as { state: string; verification: string; steps: { state: string }[] }
|
||||
if (!["pending", "running"].includes(result.state)) {
|
||||
pendingOperations.delete(operation.id)
|
||||
if (expected === "applied") {
|
||||
assert.equal(result.state, "applied", JSON.stringify(result))
|
||||
assert.equal(result.verification, "passed")
|
||||
assert.equal(result.steps.length, 1)
|
||||
assert.ok(result.steps.every(step => step.state === "verified"))
|
||||
} else {
|
||||
assert.equal(result.state, expected === "stale" ? "rejected" : "unknown", JSON.stringify(result))
|
||||
assert.deepEqual(await state(), before, "Refused race/stale plan leaves SQL ownership unchanged")
|
||||
const stopped = (await pool.query("SELECT error_code,result FROM mcp_operations WHERE id=$1", [operation.id])).rows[0]
|
||||
assert.equal(stopped.result.confirmedWrites, 0)
|
||||
assert.equal(stopped.error_code, expected === "stale" ? "STATE_CONFLICT" : "DEVICE_UNAVAILABLE")
|
||||
}
|
||||
assert.equal((await invokeMcpTool(principal, "mm_change_apply", { planId: plan.planId, idempotencyKey: key }) as { id: string }).id, operation.id)
|
||||
return
|
||||
}
|
||||
await delay(25)
|
||||
}
|
||||
throw Error("User binding operation remains live; never replay")
|
||||
}
|
||||
await apply("mm_users_create_plan", { user: { login, name: "Owned user binding", email: "binding@example.invalid" } })
|
||||
userId = (await state()).users[0]?.id
|
||||
assert.ok(userId)
|
||||
assert.equal((await getUser()).login, login)
|
||||
assert.deepEqual((await getUser()).bindings, [])
|
||||
await apply("mm_users_create_plan", { user: { login: otherLogin, name: "Other owned user", email: "other@example.invalid" } })
|
||||
otherUserId = (await state()).users.find(row => row.login === otherLogin)?.id
|
||||
assert.ok(otherUserId)
|
||||
const invalidSelectors = [
|
||||
{ interfaceName: "missing-native-interface" },
|
||||
{ interfaceName: "wg-owned-user", interfaceType: "ether" },
|
||||
{ interfaceName: "wg-owned-user", peerPublicKey: Buffer.alloc(32, 9).toString("base64") },
|
||||
{ interfaceName: "ipsec-vpn", interfaceType: "ipsec", peerPublicKey: "missing-native-cn" },
|
||||
]
|
||||
for (const [index, binding] of invalidSelectors.entries()) {
|
||||
const before = await state(), plansBefore = (await pool.query("SELECT count(*)::int AS n FROM mcp_plans")).rows[0].n
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_users_binding_add_plan", { id: userId, binding: { serverId, ...binding } }), matches(index === 1 ? "STATE_CONFLICT" : "NOT_FOUND"))
|
||||
assert.deepEqual(await state(), before)
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_plans")).rows[0].n, plansBefore)
|
||||
}
|
||||
type CatalogEntry = { name: string; type: string; boundUserId: string | null; boundUserLogin: string | null; peers?: { publicKey: string; boundUserId: string | null; boundUserLogin: string | null }[] }
|
||||
const catalog = async () => (await invokeMcpTool(principal, "mm_user_interfaces_list", { serverId }) as { interfaces: CatalogEntry[] }).interfaces
|
||||
const owner = async (fixture: typeof fixtures[number]) => {
|
||||
const iface = (await catalog()).find(entry => entry.name === fixture.name)
|
||||
assert.ok(iface, fixture.name + " appears in catalog")
|
||||
assert.equal(iface.type, fixture.type)
|
||||
const entry = fixture.peerPublicKey ? iface.peers?.find(peer => peer.publicKey === fixture.peerPublicKey) : iface
|
||||
assert.ok(entry, fixture.name + " peer appears in catalog")
|
||||
return { id: entry.boundUserId, login: entry.boundUserLogin }
|
||||
}
|
||||
const catalogState = await invokeMcpTool(principal, "mm_user_interfaces_state_get", { serverId }) as { source: string; inventoryComplete: boolean; failures: unknown[] }
|
||||
assert.equal(catalogState.source, "snapshot")
|
||||
assert.equal(catalogState.inventoryComplete, true)
|
||||
assert.deepEqual(catalogState.failures, [])
|
||||
for (const tool of ["mm_user_interfaces_list", "mm_user_interfaces_state_get"]) {
|
||||
await assert.rejects(invokeMcpTool(narrow, tool, { serverId }), matches("SERVER_DENIED"))
|
||||
}
|
||||
for (const fixture of fixtures) {
|
||||
// Infer ordinary/WG types from native rows; verify the service's canonical
|
||||
// name/key, including ordinary-interface peer clearing, after real INSERT.
|
||||
const binding = { serverId, interfaceName: ` ${fixture.name} `, peerPublicKey: fixture.peerPublicKey ? ` ${fixture.peerPublicKey} ` : " ignored-non-peer ", ...(fixture.type === "ipsec" ? { interfaceType: "ipsec" } : {}) }
|
||||
assert.deepEqual(await owner(fixture), { id: null, login: null })
|
||||
const beforeDenied = await state()
|
||||
const plansBefore = (await pool.query("SELECT count(*)::int AS n FROM mcp_plans")).rows[0].n
|
||||
await assert.rejects(invokeMcpTool(narrow, "mm_users_binding_add_plan", { id: userId, binding }), matches("SERVER_DENIED"))
|
||||
await assert.rejects(invokeMcpTool(readOnly, "mm_users_binding_add_plan", { id: userId, binding }), matches("CONNECTION_PERMISSION_MISSING"))
|
||||
assert.deepEqual(await state(), beforeDenied)
|
||||
assert.equal((await pool.query("SELECT count(*)::int AS n FROM mcp_plans")).rows[0].n, plansBefore, "Denied requests create no plans")
|
||||
// Preparation cannot reserve the tuple: another owner can bind it before apply.
|
||||
const racedInput = { id: otherUserId, binding }
|
||||
const racedPlan = await invokeMcpTool(principal, "mm_users_binding_add_plan", racedInput) as { planId: string; state: string }
|
||||
await apply("mm_users_binding_add_plan", { id: userId, binding })
|
||||
const bound = (await getUser()).bindings
|
||||
assert.equal(bound.length, 1)
|
||||
assert.equal(bound[0].serverId, serverId)
|
||||
assert.equal(bound[0].interfaceName, fixture.name)
|
||||
assert.equal(bound[0].interfaceType, fixture.type)
|
||||
assert.equal(bound[0].peerPublicKey, fixture.peerPublicKey ?? "")
|
||||
assert.deepEqual(await owner(fixture), { id: userId, login })
|
||||
const hidden: { incomplete: boolean; bindings: unknown[] } = (await invokeMcpTool(narrow, "mm_users_get", { id: userId }) as { user: { incomplete: boolean; bindings: unknown[] } }).user
|
||||
assert.equal(hidden.incomplete, true)
|
||||
assert.deepEqual(hidden.bindings, [])
|
||||
const beforeConflict = await state()
|
||||
const counts = async () => (await pool.query("SELECT (SELECT count(*)::int FROM mcp_plans) AS plans,(SELECT count(*)::int FROM mcp_operations) AS operations")).rows[0]
|
||||
const beforeCounts = await counts()
|
||||
if (fixture === fixtures[0]) {
|
||||
const readsBefore = nativeReads
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_users_binding_remove_plan", { id: userId, bindingId: randomUUID() }), matches("NOT_FOUND"))
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_users_binding_remove_plan", { id: otherUserId, bindingId: bound[0].id }), matches("NOT_FOUND"))
|
||||
assert.equal(nativeReads, readsBefore, "Invalid removal is refused from the current user snapshot")
|
||||
assert.deepEqual(await counts(), beforeCounts, "Invalid removal creates no plan or operation")
|
||||
assert.deepEqual(await state(), beforeConflict)
|
||||
}
|
||||
for (const id of [userId, otherUserId]) {
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_users_binding_add_plan", { id, binding }), matches("STATE_CONFLICT"))
|
||||
}
|
||||
await assert.rejects(invokeMcpTool(narrow, "mm_users_binding_add_plan", { id: userId, binding }), matches("SERVER_DENIED"))
|
||||
await assert.rejects(invokeMcpTool(readOnly, "mm_users_binding_add_plan", { id: userId, binding }), matches("CONNECTION_PERMISSION_MISSING"))
|
||||
if (fixture.peerPublicKey) {
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_users_binding_add_plan", { id: userId, binding: { ...binding, peerPublicKey: "" } }), matches("INVALID_INPUT"))
|
||||
}
|
||||
assert.deepEqual(await counts(), beforeCounts, "Deterministic duplicate/takeover creates no plan or operation")
|
||||
assert.deepEqual(await state(), beforeConflict)
|
||||
// REST's shared SQL service retains its 409 contract.
|
||||
for (const id of [userId, otherUserId]) {
|
||||
await assert.rejects(addBinding(id, userBindingCreateSchema.parse(binding)), (error: unknown) => (error as { status?: number }).status === 409)
|
||||
}
|
||||
assert.deepEqual(await state(), beforeConflict)
|
||||
await apply("mm_users_binding_add_plan", racedInput, "race", racedPlan)
|
||||
assert.deepEqual(await owner(fixture), { id: userId, login })
|
||||
const beforeRemoveDenied = await state()
|
||||
for (const tool of ["mm_users_binding_remove_plan", "mm_users_delete_plan"]) {
|
||||
await assert.rejects(invokeMcpTool(narrow, tool, tool.includes("binding") ? { id: userId, bindingId: bound[0].id } : { id: userId }), matches("SERVER_DENIED"))
|
||||
}
|
||||
assert.deepEqual(await state(), beforeRemoveDenied)
|
||||
const removeInput = { id: userId, bindingId: bound[0].id }
|
||||
const staleRemoval = await invokeMcpTool(principal, "mm_users_binding_remove_plan", removeInput) as { planId: string; state: string }
|
||||
await apply("mm_users_binding_remove_plan", removeInput)
|
||||
assert.deepEqual((await getUser()).bindings, [])
|
||||
assert.deepEqual(await owner(fixture), { id: null, login: null })
|
||||
await apply("mm_users_binding_remove_plan", removeInput, "stale", staleRemoval)
|
||||
assert.deepEqual(await owner(fixture), { id: null, login: null })
|
||||
}
|
||||
await apply("mm_users_delete_plan", { id: otherUserId })
|
||||
await apply("mm_users_delete_plan", { id: userId })
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_users_get", { id: userId }), matches("NOT_FOUND"))
|
||||
assert.deepEqual(await state(), { users: [], bindings: [] })
|
||||
assert.ok(nativeReads > 0, "Catalog consulted loopback RouterOS fixture")
|
||||
assert.equal(nativeWrites, 0, "User binding workflow never mutates RouterOS")
|
||||
console.log("✓ MCP users: eight native binding types plus IPsec PSK, missing/type-spoof/peer/CN refusal, add/read/remove, catalog owner, duplicate/takeover refusal, approval/replay and scope; owned PostgreSQL/RouterOS stub")
|
||||
} finally {
|
||||
// Never race cleanup against an unresolved operation. This helper runs only
|
||||
// inside the disposable owned profile, whose runner tears down its database.
|
||||
if (pendingOperations.size === 0) {
|
||||
for (const id of connections) await setConnectionStatus(id, "paused", actor)
|
||||
await pool.query("DELETE FROM app_users WHERE login=ANY($1::text[])", [[login, otherLogin]])
|
||||
await pool.query("DELETE FROM servers WHERE id=$1", [serverId])
|
||||
}
|
||||
await new Promise<void>((resolve, reject) => router.close(error => error ? reject(error) : resolve()))
|
||||
}
|
||||
}
|
||||
@@ -16,7 +16,7 @@ if (process.env.MMAPP_VRF_SHARED_OWNED_PG === "true") {
|
||||
} else assert.equal(target.pathname, "/postgres")
|
||||
assert(process.env.MCP_STATE_DIR && process.env.MMAPP_VRF_NATIVE_REPORT)
|
||||
const slice = process.env.MMAPP_VRF_EXECUTION_SLICE ?? "baseline"
|
||||
assert(["baseline", "physical", "vlan", "disabled", "mixed", "reconcile", "sql-journal", "guards", "coexistence", "alias"].includes(slice))
|
||||
assert(["baseline", "physical", "vlan", "disabled", "mixed", "reconcile", "sql-journal", "guards", "coexistence", "alias", "gre"].includes(slice))
|
||||
// Fail closed on restricted loopback before importing DB, runtime, crypto or
|
||||
// any other product module. This probe has no credentials and no remote target.
|
||||
const probe = createNetServer(socket => socket.end())
|
||||
@@ -39,7 +39,9 @@ const { updateMcpSettings, createMcpConnection, authenticateMcpToken, setConnect
|
||||
const { invokeMcpTool, approvePlan, applyPlan } = await import("../modules/mcp/runtime.js")
|
||||
const { VRF_PRODUCTION_REQUIRED_CATALOGS } = await import("../services/vrf-production-admission.js")
|
||||
const { VRF_PRODUCTION_RAW_PATHS } = await import("../services/vrf-production-read.js")
|
||||
const { decryptSecretExisting } = await import("../modules/mcp/security.js")
|
||||
const { decryptSecretExisting, withVrfProductionSealingKey } = await import("../modules/mcp/security.js")
|
||||
const { loadVerifiedVrfProductionHistory } = await import("../services/vrf-production-execution.js")
|
||||
const { assertVrfProductionHistoryProvenance } = await import("../services/vrf-production-transition.js")
|
||||
const { findMcpOperation, registerMcpOperation } = await import("../modules/mcp/registry.js")
|
||||
type Row = Record<string, unknown>
|
||||
const report = JSON.parse(await readFile(process.env.MMAPP_VRF_NATIVE_REPORT, "utf8"))
|
||||
@@ -48,6 +50,20 @@ const phases = slice === "disabled" ? [nativePhases[0], "disabled-create", "disa
|
||||
const createCommand = report.journal.find((value: { phase: string }) => value.phase === "vrf-create")
|
||||
const selectedNames = report.phases.find((value: { phase: string }) => value.phase === nativePhases[0]).owned.bridge.raw.map((row: Row) => String(row.name)) as string[]
|
||||
let coexistenceForeign = false
|
||||
const deleteLoopName = "owned-gre-delete-loop"
|
||||
function addSyntheticDeleteLoop(catalogs: Record<string, Row[]>, selected: boolean): void {
|
||||
const target = catalogs.vrf.find(row => row.name !== "main"), table = selected ? String(target!.name) : "main"
|
||||
if (selected) target!.interfaces = String(target!.interfaces) + "," + deleteLoopName
|
||||
const mac = "02:00:00:00:00:30", id = "*ff30", gateway = deleteLoopName + (table === "main" ? "" : "@" + table)
|
||||
catalogs.bridge.push({ ".id": id, name: deleteLoopName, disabled: "false", dynamic: "false", running: "true", "mac-address": mac, "protocol-mode": "none" })
|
||||
catalogs.interface_inventory.push({ ".id": id, name: deleteLoopName, type: "bridge", disabled: "false", dynamic: "false", running: "true", "mac-address": mac, vrf: table })
|
||||
catalogs.ipv4_address.push({ ".id": "*ff31", interface: deleteLoopName, "actual-interface": deleteLoopName, address: "198.18.246.17/32", dynamic: "false", disabled: "false", invalid: "false", vrf: table })
|
||||
catalogs.ipv4_route.push({ ".id": selected ? "*ff33" : "*ff35", "dst-address": "198.18.246.17/32", gateway, "immediate-gw": deleteLoopName, "local-address": "198.18.246.17%" + gateway, "routing-table": table, dynamic: "true", connect: "true", distance: "0", scope: "10", "target-scope": "5" })
|
||||
if (selected) {
|
||||
catalogs.ipv6_address.push({ ".id": "*ff32", interface: deleteLoopName, "actual-interface": deleteLoopName, address: "fe80::ff:fe00:30/64", dynamic: "true", "auto-link-local": "true", "link-local": "true", disabled: "false", invalid: "false", vrf: "main" })
|
||||
catalogs.ipv6_route.push({ ".id": "*ff34", "dst-address": "fe80::/64", gateway, "immediate-gw": deleteLoopName, "routing-table": table, dynamic: "true", connect: "true", distance: "0", scope: "10", "target-scope": "5" })
|
||||
}
|
||||
}
|
||||
function nativeCatalog(phase: string): Record<string, Row[]> {
|
||||
const record = report.phases.find((value: { phase: string }) => value.phase === phase)
|
||||
assert(record)
|
||||
@@ -92,7 +108,42 @@ function catalog(phase: string): Record<string, Row[]> {
|
||||
result.ipv4_route.push({ ".id": "*ffed", "dst-address": "203.0.113.0/24", gateway: "198.51.100.1", "routing-table": "main", dynamic: "false", disabled: "false" })
|
||||
result.ip_filter.push({ ".id": "*ffec", chain: "forward", action: "drop", comment: "legitimate foreign firewall" })
|
||||
}
|
||||
if (slice === "gre") {
|
||||
// Synthetic six-transition GRE lifecycle derived from the recorded bridge
|
||||
// vectors. Only the remote-bound no-MAC auto-LL/endpoints match captured
|
||||
// GRE observations; these lifecycle transitions are not native CHR proof.
|
||||
result.gre = result.bridge.map((row, index) => ({ ".id": row[".id"], name: row.name, "local-address": `198.18.245.${index ? 13 : 9}`, "remote-address": `198.18.245.${index ? 14 : 10}` }))
|
||||
for (const row of result.interface_inventory) if (selectedNames.includes(String(row.name))) { row.type = "gre-tunnel"; delete row["mac-address"] }
|
||||
for (const row of result.ipv6_address) if (row.dynamic === "true" && selectedNames.includes(String(row.interface))) {
|
||||
row.address = row.interface === selectedNames[0] ? "fe80::2:c612:f50a/64" : "fe80::2:c612:f50e/64"
|
||||
// Synthetic context correction only; never assert native lifecycle proof.
|
||||
row.vrf = result.interface_inventory.find(item => item.name === row.interface)!.vrf
|
||||
}
|
||||
for (const row of result.interface_inventory.filter(item => selectedNames.includes(String(item.name)))) {
|
||||
// Same synthetic bounded-cycle model as the pure suite. It drives this
|
||||
// existing real MCP/SQL/approval/REST profile, not a new test API or native proof.
|
||||
let previous = "main", cycles = 0
|
||||
for (const step of nativePhases.slice(0, nativePhases.indexOf(phase) + 1)) {
|
||||
const current = String(nativeCatalog(step).interface_inventory.find(item => item.name === row.name)!.vrf)
|
||||
if (current !== previous) cycles++
|
||||
previous = current
|
||||
}
|
||||
const clock = (seconds: number) => new Date(Date.UTC(2026, 0, 1, 0, 0, seconds)).toISOString().slice(0, 19).replace("T", " ")
|
||||
row["link-downs"] = String(cycles); row["last-link-up-time"] = clock(cycles * 2)
|
||||
if (cycles) row["last-link-down-time"] = clock(cycles * 2 - 1)
|
||||
else delete row["last-link-down-time"]
|
||||
}
|
||||
result.bridge = []
|
||||
result.wireguard = [{ ".id": "*ff11", name: "gre-source-wg", mtu: "1420", "listen-port": "55100", disabled: "false" }]
|
||||
// Stable nonempty V30-shaped peer configuration, using a documentation IP.
|
||||
// No keys, live underlay or native handshake are implied. The HTTP stub
|
||||
// adds only synthetic changing peer telemetry to each GET response below.
|
||||
result.wireguard_peer = [{ ".id": "*ff12", interface: "gre-source-wg", "endpoint-address": "198.51.100.1", "endpoint-port": "55101", "allowed-address": "198.18.245.10/32,198.18.245.14/32", "persistent-keepalive": "10s", disabled: "false" }]
|
||||
result.interface_inventory.push({ ".id": "*ff11", name: "gre-source-wg", type: "wg", vrf: "main" })
|
||||
for (const [index, host] of [9, 13].entries()) result.ipv4_address.push({ ".id": `*ff2${index}`, interface: "gre-source-wg", address: `198.18.245.${host}/30`, dynamic: "false", disabled: "false", vrf: "main" })
|
||||
}
|
||||
if (slice === "alias") { const target = result.vrf.find(row => row.name !== "main"); if (target) target.comment = "MikrotikManager: owned alias fixture" }
|
||||
if (slice === "gre" && phase === nativePhases.at(-1)) addSyntheticDeleteLoop(result, false)
|
||||
return result
|
||||
}
|
||||
let directDisabledDelete = false
|
||||
@@ -104,6 +155,7 @@ function command(index: number) {
|
||||
return { ...report.journal.find((value: { phase: string }) => value.phase === phases[index]), label: phases[index], after: phases[index] }
|
||||
}
|
||||
let state = catalog(slice === "alias" ? phases[4] : phases[0]), next = slice === "alias" ? 5 : 1, writes = 0, reads = 0
|
||||
let wireguardPeerTelemetryTicks = 0
|
||||
let fault: "none" | "ignored" | "collateral" | "wrong-ack" | "lost-ack" | "post-intent-revoke" | "wrong-explicit-id" | "native-contract-drift" = "none"
|
||||
let connectionId = "", revokePlanId = "", revokeAfter: Date | undefined, revoked = false
|
||||
let lateRoute: Row | undefined
|
||||
@@ -138,6 +190,11 @@ const router = createServer((request, response) => { void (async () => {
|
||||
}
|
||||
if (slice === "alias" && path === "/routing/ospf/interface-template") { response.end(JSON.stringify(aliasOspfRows)); return }
|
||||
const resource = pathToResource.get(path)
|
||||
if (slice === "gre" && resource === "wireguard_peer") {
|
||||
wireguardPeerTelemetryTicks++
|
||||
assert(wireguardPeerTelemetryTicks <= 10000, "Synthetic peer telemetry tick budget")
|
||||
response.end(JSON.stringify(state.wireguard_peer.map(row => ({ ...row, rx: String(wireguardPeerTelemetryTicks * 64), tx: String(wireguardPeerTelemetryTicks * 128), "last-handshake": `${wireguardPeerTelemetryTicks}s` })))); return
|
||||
}
|
||||
response.end(JSON.stringify(resource ? [...state[resource] ?? [], ...(resource === "ipv4_route" && lateRoute ? [lateRoute] : [])] : [])); return
|
||||
}
|
||||
assert(path === "/ip/vrf" || path.startsWith("/ip/vrf/"), "Only the exact VRF native command is permitted")
|
||||
@@ -159,6 +216,12 @@ await new Promise<void>(resolve => router.listen(0, "127.0.0.1", resolve))
|
||||
const closeAgent = installLoopbackFixtureAgent(router)
|
||||
const actor: AuthUser = { id: "owned-vrf-executor", email: "vrf@example.invalid", name: "VRF owned acceptance", apps: ["mm"], permissions: ["mm:settings:admin", "mm:network:admin", "mm:servers:admin"], expiresAt: Date.now() + 1800000 }
|
||||
const accepted: string[] = []
|
||||
const diagnosticStarted = performance.now()
|
||||
// Disabled slice only: phase = positive ordinal * 100 + fixed stage below.
|
||||
// At most 92 numeric stage records; no plan IDs, payloads or error text.
|
||||
const disabledStage = (stage: number) => {
|
||||
if (slice === "disabled") console.log(JSON.stringify({ phase: (accepted.length + 1) * 100 + stage, elapsedMs: Math.round(performance.now() - diagnosticStarted) }))
|
||||
}
|
||||
try {
|
||||
await updateMcpSettings({ enabled: true }, actor)
|
||||
const serverId = Number((await pool.query("INSERT INTO servers(name,host,port,use_ssl,username,password,enabled) VALUES('owned-vrf-runtime','127.0.0.1',$1,false,'admin',$2,true) RETURNING id", [(router.address() as { port: number }).port, password])).rows[0].id)
|
||||
@@ -174,28 +237,67 @@ try {
|
||||
const selected = command(next)
|
||||
const action = selected.method === "PUT" ? "create" : selected.method === "DELETE" ? "delete" : "update"
|
||||
const fields = Object.fromEntries(Object.entries(selected.fields).map(([key, value]) => [key, key === "disabled" ? value === "true" : value]))
|
||||
disabledStage(10) // prepare tool: before/after
|
||||
const result = await invokeMcpTool(principal, slice === "alias" ? "mm_vrf_plan" : `mm_vrf_${action}_plan`, slice === "alias" ? { serverId, id: selected.id, interfaces: String(fields.interfaces).split(",") } : { serverId, productionAdmission: true, ...(selected.id ? { id: selected.id } : {}), fields }) as { planId: string; vrfTicket: { ticketId: string } }
|
||||
disabledStage(11)
|
||||
assert(result.vrfTicket?.ticketId)
|
||||
disabledStage(20) // human approval: before/after
|
||||
await approvePlan(result.planId, actor, true)
|
||||
disabledStage(21)
|
||||
return result
|
||||
}
|
||||
let lastOperationId = ""
|
||||
const positive = async (label: string) => {
|
||||
const beforePeerTicks = wireguardPeerTelemetryTicks
|
||||
const prepared = await prepare(), beforeWrites = writes
|
||||
const operation = await applyPlan(principal, prepared.planId, randomUUID()), terminal = await wait(operation.id)
|
||||
disabledStage(30) // apply call: before/after
|
||||
const operation = await applyPlan(principal, prepared.planId, randomUUID())
|
||||
disabledStage(31)
|
||||
disabledStage(40) // terminal wait: before/after
|
||||
const terminal = await wait(operation.id)
|
||||
disabledStage(41)
|
||||
disabledStage(50) // SQL/crypto/replay postverification: before/after
|
||||
assert.equal(terminal.state, "applied", JSON.stringify({ phase: label, error: terminal.error_code, result: terminal.result }))
|
||||
assert.equal(terminal.verification, "passed"); assert.equal(writes, beforeWrites + 1)
|
||||
const step = (await pool.query("SELECT * FROM mcp_operation_steps WHERE operation_id=$1", [operation.id])).rows[0]
|
||||
assert.equal(step.state, "verified"); assert.equal(step.result.configurationVerified, true); assert.equal(step.result.forwardingVerified, false)
|
||||
const checkpoint = (await pool.query("SELECT after_sealed FROM mcp_operation_checkpoints WHERE operation_id=$1", [operation.id])).rows[0]
|
||||
const checkpoint = (await pool.query("SELECT before_sealed,after_sealed FROM mcp_operation_checkpoints WHERE operation_id=$1", [operation.id])).rows[0]
|
||||
assert.equal(JSON.parse(await decryptSecretExisting(checkpoint.after_sealed)).kind, "vrf-production-private-checkpoint-v1")
|
||||
if (slice === "gre") {
|
||||
assert(wireguardPeerTelemetryTicks > beforePeerTicks, "Each GRE lifecycle phase must read changing peer telemetry")
|
||||
const { before } = JSON.parse(await decryptSecretExisting(checkpoint.before_sealed))
|
||||
if (next === phases.length) {
|
||||
// Synthetic external current-state addition before fresh DELETE approval;
|
||||
// not a claimed earlier native action or historical checkpoint rewrite.
|
||||
assert(before.catalogs.bridge.some((row: Row) => row.name === deleteLoopName))
|
||||
assert(before.catalogs.vrf.some((row: Row) => String(row.interfaces).split(",").includes(deleteLoopName)))
|
||||
assert(before.catalogs.ipv6_address.some((row: Row) => row.interface === deleteLoopName))
|
||||
assert(!state.ipv6_address.some(row => row.interface === deleteLoopName))
|
||||
assert(state.ipv4_address.some(row => row.interface === deleteLoopName && row[".id"] === "*ff31"))
|
||||
assert(state.ipv6_address.some(row => row.interface === selectedNames[1] && row.dynamic === "true"), "Prior GRE acquisition absence must still revive on DELETE")
|
||||
}
|
||||
await withVrfProductionSealingKey(async secret => {
|
||||
const history = await loadVerifiedVrfProductionHistory({ sql: pool, ownerId: actor.id, serverId, sourceProof: before.sourceProof, nativeId: step.result.nativeId, secret })
|
||||
assert(history, "GRE verified SQL checkpoint must reopen")
|
||||
assertVrfProductionHistoryProvenance(history, { ...before, catalogs: state })
|
||||
})
|
||||
}
|
||||
assert.equal((await pool.query("SELECT state FROM vrf_production_tickets WHERE ticket_id=$1", [prepared.vrfTicket.ticketId])).rows[0].state, "claimed")
|
||||
const replay = await applyPlan(principal, prepared.planId, randomUUID()); assert.equal(replay.id, operation.id); assert.equal(writes, beforeWrites + 1)
|
||||
disabledStage(51)
|
||||
accepted.push(label)
|
||||
lastOperationId = operation.id
|
||||
console.log(JSON.stringify({ slice, acceptedCase: label, nativeWrites: writes, configurationVerified: true, forwardingVerified: false }))
|
||||
console.log(JSON.stringify({ slice, acceptedCase: label, nativeWrites: writes, ...(slice === "gre" ? { wireguardPeerTelemetryTicks } : {}), configurationVerified: true, forwardingVerified: false }))
|
||||
}
|
||||
for (let phase = 1; phase < (["sql-journal", "guards", "coexistence", "alias"].includes(slice) ? 1 : slice === "reconcile" ? 2 : phases.length); phase++) {
|
||||
if (slice === "gre" && phase === phases.length - 1) {
|
||||
// Model a separate administrator adding an empty loop bridge and selecting
|
||||
// it after the first five actions. The sixth action gets a fresh approval
|
||||
// and ticket for this complete current graph, with prior GRE debt intact.
|
||||
addSyntheticDeleteLoop(state, true)
|
||||
}
|
||||
await positive(phases[phase])
|
||||
}
|
||||
for (let phase = 1; phase < (["sql-journal", "guards", "coexistence", "alias"].includes(slice) ? 1 : slice === "reconcile" ? 2 : phases.length); phase++) await positive(phases[phase])
|
||||
if (slice === "alias") {
|
||||
await assert.rejects(invokeMcpTool(principal, "mm_vrf_update_plan", { serverId, id: command(next).id, productionAdmission: true, fields: { interfaces: selectedNames[1] } }))
|
||||
const target = state.vrf.find(row => row.name !== "main")!, comment = target.comment
|
||||
@@ -213,6 +315,9 @@ try {
|
||||
const oldPublic = await prepare()
|
||||
await pool.query("UPDATE mcp_plans SET operation_version=2 WHERE id=$1", [oldPublic.planId])
|
||||
await assert.rejects(applyPlan(principal, oldPublic.planId, randomUUID())); assert.equal(writes, 0)
|
||||
const oldV3Public = await prepare()
|
||||
await pool.query("UPDATE mcp_plans SET operation_version=3 WHERE id=$1", [oldV3Public.planId])
|
||||
await assert.rejects(applyPlan(principal, oldV3Public.planId, randomUUID())); assert.equal(writes, 0)
|
||||
const originalNative = findMcpOperation("ros.vrf.update")!, nativeStale = await prepare()
|
||||
revokePlanId = nativeStale.planId; fault = "native-contract-drift"
|
||||
try {
|
||||
@@ -224,9 +329,9 @@ try {
|
||||
accepted.push("public-v2-and-fresh-native-version-fences-no-replay")
|
||||
await positive("alias-only-grant-actual-apply-canonical-tool-denied")
|
||||
const applied = (await pool.query("SELECT p.operation_id,p.operation_version,t.action_id,t.action_version,t.ciphertext FROM mcp_operations o JOIN mcp_plans p ON p.id=o.plan_id JOIN vrf_production_tickets t ON t.plan_id=p.id WHERE o.id=$1", [lastOperationId])).rows[0]
|
||||
assert.equal(applied.operation_id, "routing.vrf.update"); assert.equal(applied.operation_version, 3); assert.equal(applied.action_id, "ros.vrf.update")
|
||||
assert.equal(applied.operation_id, "routing.vrf.update"); assert.equal(applied.operation_version, 4); assert.equal(applied.action_id, "ros.vrf.update")
|
||||
const privateContext = JSON.parse(await decryptSecretExisting(applied.ciphertext)).context
|
||||
assert.deepEqual(privateContext.authorityAction, { id: "routing.vrf.update", version: 3 }); assert.equal(privateContext.actionVersion, originalNative.version)
|
||||
assert.deepEqual(privateContext.authorityAction, { id: "routing.vrf.update", version: 4 }); assert.equal(privateContext.actionVersion, originalNative.version)
|
||||
assert.equal(writes, 1)
|
||||
}
|
||||
if (slice === "coexistence") {
|
||||
@@ -307,7 +412,9 @@ try {
|
||||
console.log(JSON.stringify({ slice, acceptedCase: accepted.slice(1), nativeWrites: writes, readonly: true }))
|
||||
}
|
||||
if (slice === "disabled") {
|
||||
disabledStage(0) // direct disabled-create/delete reset: before/after
|
||||
state = catalog(phases[0]); next = 1; directDisabledDelete = true
|
||||
disabledStage(1)
|
||||
await positive("disabled-create-direct-delete"); await positive("disabled-delete")
|
||||
}
|
||||
if (["physical", "vlan", "mixed"].includes(slice)) {
|
||||
@@ -352,7 +459,8 @@ try {
|
||||
console.log(JSON.stringify({ acceptedCase: selected, nativeWrites: writes, operationState: terminal.state, forwardingVerified: false }))
|
||||
}
|
||||
assert(reads > 0)
|
||||
console.log(JSON.stringify({ slice, rawShape: slice === "baseline" ? "authoritative recorded v5 bridge vectors" : slice === "disabled" ? "synthetic disabled-CREATE derived from v5 inactive vector; never-enabled defaults not actual CHR" : "synthetic physical/VLAN concrete-parent projection derived from v5 context vectors", accepted, writes, rawReads: reads, actualSql: true, actualCrypto: true, actualAuthPolicyApprovalRuntime: true, fakeVerifier: false, actualRouter: false, forwardingVerified: false }))
|
||||
if (slice === "gre") assert(wireguardPeerTelemetryTicks > 6 && wireguardPeerTelemetryTicks <= 10000)
|
||||
console.log(JSON.stringify({ slice, rawShape: slice === "baseline" ? "authoritative recorded v5 bridge vectors" : slice === "disabled" ? "synthetic disabled-CREATE derived from v5 inactive vector; never-enabled defaults not actual CHR" : slice === "gre" ? "synthetic no-MAC GRE lifecycle derived from v5 bridge vectors and captured remote-bound auto-LL; static WG source parent with native wg alias and synthetic ticking peer telemetry; not actual CHR lifecycle" : "synthetic physical/VLAN concrete-parent projection derived from v5 context vectors", accepted, writes, rawReads: reads, ...(slice === "gre" ? { wireguardPeerTelemetryTicks } : {}), actualSql: true, actualCrypto: true, actualAuthPolicyApprovalRuntime: true, fakeVerifier: false, actualRouter: false, forwardingVerified: false }))
|
||||
} finally {
|
||||
closeAgent(); await new Promise<void>(resolve => router.close(() => resolve())); await closePool()
|
||||
}
|
||||
@@ -0,0 +1,156 @@
|
||||
"use client"
|
||||
|
||||
import { useEffect, useRef, useState } from "react"
|
||||
import Link from "next/link"
|
||||
import { Button } from "@/components/ui/button"
|
||||
import { Input } from "@/components/ui/input"
|
||||
import { Checkbox } from "@/components/ui/checkbox"
|
||||
import { bridgeVlanDesiredSchema, type BridgeVlanDesired } from "@mmapp/contracts/bridge-vlan"
|
||||
import type { McpApi } from "@/shared/api/mcp"
|
||||
|
||||
type Row = Record<string, unknown>
|
||||
type Interface = { resource: string; id: string; name: string; disabled?: unknown }
|
||||
type State = { bridges: Row[]; ports: Row[]; vlans: Row[]; interfaces: Interface[]; vlanInterfaces: Row[]; ipv4Addresses: Row[]; ipv6Addresses: Row[] }
|
||||
type Reference = BridgeVlanDesired["ports"][number]["interface"]
|
||||
const keyOf = (reference: Reference) => `${reference.resource}/${reference.id}`
|
||||
const dynamic = (row: Row) => [true, "true", "yes"].includes(row.dynamic as boolean | string)
|
||||
const text = (row: Row, field: string) => String(row[field] ?? "")
|
||||
function boolean(row: Row, field: string): boolean {
|
||||
if ([true, "true", "yes"].includes(row[field] as boolean | string)) return true
|
||||
if ([false, "false", "no"].includes(row[field] as boolean | string)) return false
|
||||
throw new Error(`Не подтверждено поле ${field} у записи ${text(row, ".id")}`)
|
||||
}
|
||||
function Choice({ label, checked, onChange }: { label: string; checked: boolean; onChange: (checked: boolean) => void }) {
|
||||
return <label className="flex items-center gap-2 text-sm"><Checkbox checked={checked} onCheckedChange={value => onChange(value === true)} />{label}</label>
|
||||
}
|
||||
const selectClass = "h-9 min-w-0 rounded-md border bg-background px-3 text-sm"
|
||||
|
||||
function draftFor(state: State, bridgeId: string): BridgeVlanDesired {
|
||||
const bridge = state.bridges.find(row => row[".id"] === bridgeId)
|
||||
if (!bridge) throw new Error("Выберите существующий мост")
|
||||
const name = text(bridge, "name")
|
||||
const reference = (name: string): Reference => {
|
||||
const matches = state.interfaces.filter(item => item.name === name)
|
||||
if (matches.length !== 1) throw new Error(`Не подтверждён интерфейс ${name}; обновите состояние`)
|
||||
return { resource: matches[0].resource, id: matches[0].id }
|
||||
}
|
||||
const members = (value: unknown) => {
|
||||
if (value === undefined || value === "") return []
|
||||
if (typeof value !== "string") throw new Error("Не подтверждён список участников VLAN")
|
||||
return value.split(",").map(name => reference(name.trim()))
|
||||
}
|
||||
return bridgeVlanDesiredSchema.parse({
|
||||
filtering: boolean(bridge, "vlan-filtering"), pvid: Number(bridge.pvid),
|
||||
ports: state.ports.filter(row => row.bridge === name && !dynamic(row)).map(row => ({
|
||||
id: text(row, ".id"), interface: reference(text(row, "interface")), pvid: Number(row.pvid),
|
||||
ingressFiltering: boolean(row, "ingress-filtering"), frameTypes: row["frame-types"], disabled: boolean(row, "disabled"),
|
||||
...(row.comment !== undefined ? { comment: row.comment } : {}),
|
||||
})),
|
||||
vlans: state.vlans.filter(row => row.bridge === name && !dynamic(row)).map(row => ({
|
||||
id: text(row, ".id"), vlanIds: text(row, "vlan-ids"), tagged: members(row.tagged), untagged: members(row.untagged),
|
||||
disabled: boolean(row, "disabled"), ...(row.comment !== undefined ? { comment: row.comment } : {}),
|
||||
})), removePortIds: [], removeVlanIds: [],
|
||||
})
|
||||
}
|
||||
|
||||
export function BridgeVlanWorkflow({ api, connectionId, serverId }: { api: McpApi; connectionId: string; serverId: string }) {
|
||||
const [state, setState] = useState<State | null>(null)
|
||||
const [bridgeId, setBridgeId] = useState("")
|
||||
const [draft, setDraft] = useState<BridgeVlanDesired | null>(null)
|
||||
const [reload, setReload] = useState(0)
|
||||
const [loading, setLoading] = useState(true)
|
||||
const [busy, setBusy] = useState(false)
|
||||
const [error, setError] = useState("")
|
||||
const [receipt, setReceipt] = useState("")
|
||||
const scope = `${connectionId}/${serverId}`
|
||||
const currentScope = useRef(scope)
|
||||
const selectedBridge = useRef(bridgeId)
|
||||
useEffect(() => {
|
||||
const abort = new AbortController()
|
||||
currentScope.current = scope
|
||||
const load = async () => {
|
||||
await Promise.resolve()
|
||||
if (abort.signal.aborted) return
|
||||
setState(null); setDraft(null); setReceipt(""); setError(""); setLoading(true)
|
||||
try {
|
||||
if (!connectionId || !serverId) return
|
||||
const data = await api.bridgeVlanState(connectionId, serverId, abort.signal)
|
||||
if (abort.signal.aborted) return
|
||||
setState(data.state)
|
||||
const selected = data.state.bridges.find(row => row[".id"] === selectedBridge.current)
|
||||
if (selected) setDraft(draftFor(data.state, String(selected[".id"])))
|
||||
else { selectedBridge.current = ""; setBridgeId("") }
|
||||
} catch (failure) { if (!abort.signal.aborted) setError(failure instanceof Error ? failure.message : "Не удалось прочитать состояние моста") }
|
||||
finally { if (!abort.signal.aborted) setLoading(false) }
|
||||
}
|
||||
void load()
|
||||
return () => { abort.abort(); currentScope.current = "" }
|
||||
}, [api, connectionId, serverId, scope, reload])
|
||||
const edit = (change: (value: BridgeVlanDesired) => BridgeVlanDesired) => {
|
||||
setDraft(value => value && change(value)); setReceipt(""); setError("")
|
||||
}
|
||||
const chooseBridge = (id: string) => {
|
||||
selectedBridge.current = id
|
||||
setBridgeId(id); setReceipt(""); setError(""); setDraft(null)
|
||||
if (state && id) try { setDraft(draftFor(state, id)) } catch (failure) { setError(failure instanceof Error ? failure.message : "Не удалось загрузить мост") }
|
||||
}
|
||||
const prepare = async () => {
|
||||
if (!draft) return
|
||||
setBusy(true); setError(""); setReceipt("")
|
||||
try {
|
||||
const checked = bridgeVlanDesiredSchema.safeParse(draft)
|
||||
if (!checked.success) throw new Error("Проверьте PVID (1–4094), диапазоны VLAN и выбранные интерфейсы")
|
||||
const result = await api.bridgeVlanPlan(connectionId, serverId, bridgeId, checked.data)
|
||||
if (currentScope.current === scope) setReceipt(result.planId)
|
||||
} catch (failure) { if (currentScope.current === scope) setError(failure instanceof Error ? failure.message : "Не удалось подготовить план") }
|
||||
finally { setBusy(false) }
|
||||
}
|
||||
const bridgeName = state?.bridges.find(row => row[".id"] === bridgeId)?.name
|
||||
const options = state?.interfaces ?? []
|
||||
const portOptions = options.filter(item => ["ethernet", "vlan", "vxlan"].includes(item.resource) && !state?.ports.some(row => row.interface === item.name && row.bridge !== bridgeName))
|
||||
const nextPort = portOptions.find(item => !draft?.ports.some(port => keyOf(port.interface) === keyOf(item)))
|
||||
const memberOptions = options.filter(item => item.resource === "bridge" && item.id === bridgeId || draft?.ports.some(port => keyOf(port.interface) === keyOf(item)))
|
||||
const interfaceSelect = (label: string, value: Reference, onChange: (value: Reference) => void) => <label className="flex min-w-0 flex-col gap-1 text-sm">{label}<select className={selectClass} value={keyOf(value)} onChange={event => {
|
||||
const item = options.find(item => keyOf(item) === event.target.value)
|
||||
if (item) onChange({ resource: item.resource, id: item.id })
|
||||
}}>{portOptions.map(item => <option key={keyOf(item)} value={keyOf(item)}>{item.name} · {item.resource} {item.id}</option>)}</select></label>
|
||||
const membership = (label: string, selected: Reference[], onChange: (value: Reference[]) => void) => <fieldset className="flex flex-col gap-2"><legend className="mb-2 text-sm font-medium">{label}</legend><div className="flex max-h-40 flex-wrap gap-3 overflow-auto">{options.filter(item => memberOptions.includes(item) || selected.some(value => keyOf(value) === keyOf(item))).map(item => <Choice key={keyOf(item)} label={item.name} checked={selected.some(value => keyOf(value) === keyOf(item))} onChange={checked => onChange(checked ? [...selected, { resource: item.resource, id: item.id }] : selected.filter(value => keyOf(value) !== keyOf(item)))} />)}</div></fieldset>
|
||||
|
||||
return <section className="flex flex-col gap-4 rounded-xl border p-4" aria-label="Связанная настройка Bridge VLAN" aria-busy={loading || busy}>
|
||||
<h3 className="font-semibold">Мост, порты и VLAN</h3>
|
||||
<p className="text-sm text-muted-foreground">Подготовьте единый план VLAN filtering, PVID и участников. Проверяется доступ к управлению устройством. Без независимого канала используется основной адрес с обязательным подтверждением человеком. Подтверждение и применение выполняются отдельно в планах.</p>
|
||||
{error && <p role="alert" className="text-sm text-destructive">{error}</p>}
|
||||
<div className="flex flex-col gap-3 sm:flex-row sm:items-end">
|
||||
<label className="flex min-w-0 flex-1 flex-col gap-1 text-sm">Существующий мост<select className={selectClass} value={bridgeId} disabled={!state || busy} onChange={event => chooseBridge(event.target.value)}><option value="">Выберите мост</option>{state?.bridges.map(row => <option key={text(row, ".id")} value={text(row, ".id")}>{text(row, "name")} · {text(row, ".id")}</option>)}</select></label>
|
||||
<Button variant="outline" className="self-start" disabled={loading || busy || !connectionId || !serverId} onClick={() => setReload(value => value + 1)}>Перечитать и сбросить черновик</Button>
|
||||
</div>
|
||||
{loading && <p role="status" className="text-sm text-muted-foreground">Чтение состояния…</p>}
|
||||
{draft && state && <fieldset disabled={busy || loading} className="flex min-w-0 flex-col gap-4">
|
||||
<div className="flex flex-wrap items-end gap-4"><Choice label="VLAN filtering" checked={draft.filtering} onChange={filtering => edit(value => ({ ...value, filtering }))} /><label className="flex flex-col gap-1 text-sm">PVID моста<Input type="number" min={1} max={4094} value={draft.pvid} onChange={event => edit(value => ({ ...value, pvid: Number(event.target.value) }))} /></label></div>
|
||||
<h4 className="font-medium">Статические порты</h4>
|
||||
{draft.ports.map((port, index) => <fieldset key={port.id ?? `new-${index}`} className="flex min-w-0 flex-col gap-3 rounded-lg border p-3"><legend className="px-1 text-sm">{port.id ?? "Новый порт"}</legend>
|
||||
<div className="grid gap-3 sm:grid-cols-3">{interfaceSelect("Интерфейс порта", port.interface, reference => edit(value => ({ ...value, ports: value.ports.map((item, i) => i === index ? { ...item, interface: reference } : item) })))}
|
||||
<label className="flex flex-col gap-1 text-sm">PVID порта<Input type="number" min={1} max={4094} value={port.pvid} onChange={event => edit(value => ({ ...value, ports: value.ports.map((item, i) => i === index ? { ...item, pvid: Number(event.target.value) } : item) }))} /></label>
|
||||
<label className="flex min-w-0 flex-col gap-1 text-sm">Типы кадров<select className={selectClass} value={port.frameTypes} onChange={event => edit(value => ({ ...value, ports: value.ports.map((item, i) => i === index ? { ...item, frameTypes: event.target.value as typeof port.frameTypes } : item) }))}><option value="admit-all">Все</option><option value="admit-only-vlan-tagged">Только tagged</option><option value="admit-only-untagged-and-priority-tagged">Untagged и priority tagged</option></select></label></div>
|
||||
<div className="flex flex-wrap items-center gap-3"><Choice label="Ingress filtering" checked={port.ingressFiltering} onChange={ingressFiltering => edit(value => ({ ...value, ports: value.ports.map((item, i) => i === index ? { ...item, ingressFiltering } : item) }))} /><Choice label="Отключён" checked={port.disabled} onChange={disabled => edit(value => ({ ...value, ports: value.ports.map((item, i) => i === index ? { ...item, disabled } : item) }))} /><Button variant="outline" onClick={() => edit(value => ({ ...value, ports: value.ports.filter((_, i) => i !== index), removePortIds: port.id ? [...value.removePortIds, port.id] : value.removePortIds }))}>Удалить порт из плана</Button></div>
|
||||
</fieldset>)}
|
||||
<Button variant="outline" className="self-start" disabled={!nextPort} onClick={() => { if (nextPort) edit(value => ({ ...value, ports: [...value.ports, { interface: { resource: nextPort.resource, id: nextPort.id }, pvid: 1, ingressFiltering: true, frameTypes: "admit-all", disabled: false }] })) }}>Добавить порт</Button>
|
||||
<h4 className="font-medium">Статические участники VLAN</h4>
|
||||
{draft.vlans.map((vlan, index) => {
|
||||
const update = (patch: Partial<typeof vlan>) => edit(value => ({ ...value, vlans: value.vlans.map((item, i) => i === index ? { ...item, ...patch } : item) }))
|
||||
return <fieldset key={vlan.id ?? `new-${index}`} className="flex min-w-0 flex-col gap-3 rounded-lg border p-3"><legend className="px-1 text-sm">{vlan.id ?? "Новая запись VLAN"}</legend>
|
||||
<label className="flex flex-col gap-1 text-sm">VLAN ID или диапазоны (например, 10,20–30)<Input value={vlan.vlanIds} placeholder="10,20-30" onChange={event => update({ vlanIds: event.target.value })} /></label>
|
||||
{membership("Tagged, включая CPU-порт моста при необходимости", vlan.tagged, tagged => update({ tagged }))}
|
||||
{membership("Untagged", vlan.untagged, untagged => update({ untagged }))}
|
||||
<div className="flex flex-wrap items-center gap-3"><Choice label="Отключена" checked={vlan.disabled} onChange={disabled => update({ disabled })} /><Button variant="outline" onClick={() => edit(value => ({ ...value, vlans: value.vlans.filter((_, i) => i !== index), removeVlanIds: vlan.id ? [...value.removeVlanIds, vlan.id] : value.removeVlanIds }))}>Удалить запись VLAN из плана</Button></div>
|
||||
</fieldset>
|
||||
})}
|
||||
<Button variant="outline" className="self-start" onClick={() => edit(value => ({ ...value, vlans: [...value.vlans, { vlanIds: "", tagged: [], untagged: [], disabled: false }] }))}>Добавить запись VLAN</Button>
|
||||
{state.ports.filter(row => row.bridge === bridgeName && dynamic(row)).map(row => <p key={`port-${text(row, ".id")}`} className="text-sm text-muted-foreground">Динамический порт {text(row, "interface")} ({text(row, ".id")}) — только чтение</p>)}
|
||||
{state.vlans.filter(row => row.bridge === bridgeName && dynamic(row)).map(row => <p key={`vlan-${text(row, ".id")}`} className="text-sm text-muted-foreground">Динамический VLAN {text(row, "vlan-ids")} ({text(row, ".id")}) — только чтение</p>)}
|
||||
{(draft.removePortIds.length > 0 || draft.removeVlanIds.length > 0) && <p className="text-sm">Явное удаление портов: {draft.removePortIds.join(", ") || "нет"}. Записей VLAN: {draft.removeVlanIds.join(", ") || "нет"}. Для отмены удаления перечитайте состояние.</p>}
|
||||
<Button className="self-start" disabled={busy || loading} onClick={() => { void prepare() }}>{busy ? "Подготовка…" : "Подготовить связанный план VLAN"}</Button>
|
||||
</fieldset>}
|
||||
{receipt && <p role="status" className="break-all text-sm">Подготовлен план {receipt}. <Link className="underline" href="/mcp?tab=plans">Открыть планы для проверки и подтверждения</Link></p>}
|
||||
</section>
|
||||
}
|
||||
@@ -5,7 +5,7 @@ import { useSearchParams } from "next/navigation"
|
||||
import { useTable, type ColumnDef } from "@tanstack/react-table"
|
||||
import { BotIcon, CopyIcon, PlusIcon, RefreshCwIcon, ShieldIcon, StopCircleIcon } from "lucide-react"
|
||||
import { toast } from "sonner"
|
||||
import { mcpConnectionCreateSchema, type McpConnection, type McpOperationDescriptor } from "@mmapp/contracts/mcp"
|
||||
import { mcpConnectionCreateSchema, mcpTargetSchema, type McpConnection, type McpOperationDescriptor, type McpPolicyDecision } from "@mmapp/contracts/mcp"
|
||||
import { routeAiControllerBlockReason, routeAiProfileSchema, type RouteAiProfile } from "@mmapp/contracts/mcp-routing"
|
||||
import { useDataSource } from "@/lib/data-source"
|
||||
import { can, getClaims, hasPermission } from "@/lib/auth"
|
||||
@@ -16,6 +16,8 @@ import { DatabaseRestore } from "./database-restore"
|
||||
import { PlanReview } from "./plan-review"
|
||||
import { ArtifactDownloads } from "./artifact-downloads"
|
||||
import { PollStorageCapacity } from "./poll-storage-capacity"
|
||||
import { BridgeVlanWorkflow } from "./bridge-vlan-workflow"
|
||||
import { ObjectPermissionPreview, PolicyPreviewDecision } from "./object-permission-preview"
|
||||
import { Frame, FrameHeader, FrameTitle, FrameDescription, FramePanel } from "@/components/reui/frame"
|
||||
import { DataGrid, DataGridContainer, DataGridTable, DataGridScrollArea, dataGridFeatures, type DataGridFeatures } from "@/components/reui/data-grid"
|
||||
import { Badge } from "@/components/reui/badge"
|
||||
@@ -33,22 +35,56 @@ type Tab = keyof typeof tabs
|
||||
type RecordRow = Record<string, unknown>
|
||||
function pretty(value: unknown) { return JSON.stringify(value, null, 2) }
|
||||
function date(value: unknown) { return value ? new Date(String(value)).toLocaleString("ru-RU") : "—" }
|
||||
function connectionAccessDeadline(connection: McpConnection) {
|
||||
return Math.min(Date.parse(connection.policy.expiresAt), Date.parse(connection.ownerValidUntil ?? ""))
|
||||
}
|
||||
function ConnectionAccessStatus({ connection }: { connection: McpConnection }) {
|
||||
const [now, setNow] = useState(() => Date.now())
|
||||
const expires = Date.parse(connection.policy.expiresAt), ownerExpires = Date.parse(connection.ownerValidUntil ?? "")
|
||||
useEffect(() => {
|
||||
let timer: number | undefined
|
||||
const tick = () => {
|
||||
const current = Date.now(); setNow(current)
|
||||
const next = [expires, ownerExpires].filter(value => Number.isFinite(value) && value > current).reduce((first, value) => Math.min(first, value), Infinity)
|
||||
if (Number.isFinite(next)) timer = window.setTimeout(tick, Math.min(60000, Math.max(1, next - current + 1)))
|
||||
}
|
||||
tick()
|
||||
return () => window.clearTimeout(timer)
|
||||
}, [expires, ownerExpires])
|
||||
const [label, reason] = connection.policy.status === "revoked" ? ["Доступ отозван", "Подключение и его токены отозваны"]
|
||||
: connection.policy.status === "paused" ? ["На паузе", "Новые вызовы подключения остановлены"]
|
||||
: !connection.generationValid ? ["Доступ аннулирован", "Поколение доступа больше не действительно"]
|
||||
: !Number.isFinite(expires) ? ["Срок не подтверждён", "Не удалось определить срок доступа"]
|
||||
: expires <= now ? ["Срок доступа истёк", "Продлите срок в разрешениях подключения"]
|
||||
: !Number.isFinite(ownerExpires) ? ["Права не подтверждены", "Срок подтверждения прав владельца отсутствует"]
|
||||
: ownerExpires <= now ? ["Права владельца истекли", "Владельцу нужно подтвердить актуальные права"]
|
||||
: ["Активен", "Срок доступа и права владельца действуют"]
|
||||
return <div className="flex flex-col gap-1"><Badge variant={label === "Активен" ? "success-light" : "warning-light"}>{label}</Badge><span className="text-xs text-muted-foreground">{reason}</span></div>
|
||||
}
|
||||
function useQuery<T>(load: (signal: AbortSignal) => Promise<T>) {
|
||||
const [data, setData] = useState<T | null>(null), [error, setError] = useState("")
|
||||
const [updatedAt, setUpdatedAt] = useState<string | null>(null)
|
||||
const refresh = useCallback(() => { window.dispatchEvent(new Event("mcp-refresh")) }, [])
|
||||
useEffect(() => {
|
||||
let alive = true, revision = 0, controller: AbortController | undefined
|
||||
const run = async () => {
|
||||
if (document.hidden) return
|
||||
controller?.abort(); controller = new AbortController(); const requestRevision = ++revision
|
||||
let alive = true, revision = 0, pending = false, controller: AbortController | undefined, deadline: number | undefined
|
||||
const run = async (replace = false) => {
|
||||
if (!alive || document.hidden || (pending && !replace)) return
|
||||
controller?.abort(); window.clearTimeout(deadline); controller = new AbortController(); const requestRevision = ++revision
|
||||
pending = true
|
||||
deadline = window.setTimeout(() => {
|
||||
if (!alive || requestRevision !== revision) return
|
||||
revision++; pending = false; controller?.abort()
|
||||
setError("Обновление не завершилось за минуту. Следующая попытка выполнится автоматически.")
|
||||
}, 60000)
|
||||
try { const result = await load(controller.signal); if (alive && requestRevision === revision) { setData(result); setError(""); setUpdatedAt(new Date().toISOString()) } }
|
||||
catch (failure) { if (alive && requestRevision === revision && !controller.signal.aborted) setError(errorText(failure)) }
|
||||
finally { if (requestRevision === revision) { window.clearTimeout(deadline); pending = false } }
|
||||
}
|
||||
queueMicrotask(() => { void run() })
|
||||
const tick = () => { void run() }, timer = window.setInterval(tick, 5000)
|
||||
window.addEventListener("mcp-refresh", tick); document.addEventListener("visibilitychange", tick)
|
||||
return () => { alive = false; revision++; controller?.abort(); window.clearInterval(timer); window.removeEventListener("mcp-refresh", tick); document.removeEventListener("visibilitychange", tick) }
|
||||
const reload = () => { void run(true) }
|
||||
window.addEventListener("mcp-refresh", reload); document.addEventListener("visibilitychange", tick)
|
||||
return () => { alive = false; revision++; controller?.abort(); window.clearTimeout(deadline); window.clearInterval(timer); window.removeEventListener("mcp-refresh", reload); document.removeEventListener("visibilitychange", tick) }
|
||||
}, [load])
|
||||
return { data, error, refresh, updatedAt }
|
||||
}
|
||||
@@ -75,7 +111,7 @@ function DeviceCatalog({ api, connectionId }: { api: McpApi; connectionId: strin
|
||||
const catalog = useQuery(useCallback(signal => api.deviceCatalog(connectionId, signal), [api, connectionId]))
|
||||
const [serverId, setServerId] = useState(""), [resourceId, setResourceId] = useState("")
|
||||
const resource = catalog.data?.resources.find(resource => resource.id === resourceId)
|
||||
return <><ErrorMessage message={catalog.error} /><div className="grid gap-3 sm:grid-cols-2"><NativeSelect label="Сервер интерфейсов" value={serverId} onChange={setServerId}><option value="">Выберите сервер</option>{catalog.data?.servers.map(server => <option key={server.id} value={String(server.id)} disabled={!server.enabled}>{server.name} · {server.host}</option>)}</NativeSelect><NativeSelect label="Тип объектов устройства" value={resourceId} onChange={setResourceId}><option value="">Выберите тип</option>{catalog.data?.resources.filter(resource => resource.read).map(resource => <option key={resource.id} value={resource.id}>{resource.title}</option>)}</NativeSelect></div>{catalog.data && !catalog.data.resources.some(resource => resource.read) && <p className="text-sm text-muted-foreground">Подключению не выданы инструменты чтения интерфейсов.</p>}{resource && serverId && catalog.data?.servers.some(server => String(server.id) === serverId && server.enabled) && <DeviceEditor key={`${serverId}:${resourceId}`} api={api} connectionId={connectionId} serverId={serverId} resource={resource} />}</>
|
||||
return <><ErrorMessage message={catalog.error} /><div className="grid gap-3 sm:grid-cols-2"><NativeSelect label="Сервер интерфейсов" value={serverId} onChange={setServerId}><option value="">Выберите сервер</option>{catalog.data?.servers.map(server => <option key={server.id} value={String(server.id)} disabled={!server.enabled}>{server.name} · {server.host}</option>)}</NativeSelect><NativeSelect label="Тип объектов устройства" value={resourceId} onChange={setResourceId}><option value="">Выберите тип</option>{catalog.data?.resources.filter(resource => resource.read).map(resource => <option key={resource.id} value={resource.id}>{resource.title}</option>)}</NativeSelect></div>{catalog.data && !catalog.data.resources.some(resource => resource.read) && <p className="text-sm text-muted-foreground">Подключению не выданы инструменты чтения интерфейсов.</p>}{resourceId === "bridge" && serverId && catalog.data?.servers.some(server => String(server.id) === serverId && server.enabled) && <BridgeVlanWorkflow key={`vlan:${connectionId}:${serverId}`} api={api} connectionId={connectionId} serverId={serverId} />}{resource && serverId && catalog.data?.servers.some(server => String(server.id) === serverId && server.enabled) && <DeviceEditor key={`${serverId}:${resourceId}`} api={api} connectionId={connectionId} serverId={serverId} resource={resource} />}</>
|
||||
}
|
||||
function DeviceEditor({ api, connectionId, serverId, resource }: { api: McpApi; connectionId: string; serverId: string; resource: DeviceResource }) {
|
||||
const [offset, setOffset] = useState(0), [editing, setEditing] = useState<RecordRow | "new" | null>(null), [draft, setDraft] = useState<Record<string, unknown>>({})
|
||||
@@ -90,12 +126,18 @@ function DeviceEditor({ api, connectionId, serverId, resource }: { api: McpApi;
|
||||
} catch (failure) { setError(errorText(failure)) } finally { setBusy(false) }
|
||||
}
|
||||
const current = editing && editing !== "new" ? editing : null
|
||||
const ethernetDisabledUnknown = resource.id === "ethernet" && current !== null && current.disabled === undefined
|
||||
const editableFields = resource.fields.filter(field =>
|
||||
editing === "new" || field.key === "comment" || field.key in (current ?? {}) || (ethernetDisabledUnknown && field.key === "disabled"),
|
||||
)
|
||||
const protectedRow = current && ["dynamic", "builtin", "default"].some(key => current[key] === "true" || current[key] === true)
|
||||
const change = (key: string, value: unknown) => setDraft(fields => { const next = { ...fields }; if (value === undefined) delete next[key]; else next[key] = value; return next })
|
||||
return <><ErrorMessage message={rows.error || error} />{receipt && <p role="status" className="text-sm">{receipt}</p>}<div className="flex flex-wrap items-center justify-between gap-2"><p className="text-sm text-muted-foreground">Объектов: {rows.data?.total ?? "…"}. Выберите строку для просмотра и подготовки изменения.</p>{resource.create && <Button variant="outline" disabled={busy} onClick={() => open("new")}><PlusIcon />Создать объект</Button>}</div><Grid items={rows.data?.items ?? []} loading={!rows.data && !rows.error} total={rows.data?.total} columns={[{ id: "nativeId", header: "ID", cell: ({ row }) => String(row.original[".id"] ?? "—") }, { id: "name", header: "Объект", cell: ({ row }) => String(row.original.name ?? row.original.address ?? row.original.interface ?? "—") }, { id: "state", header: "Состояние", cell: ({ row }) => String(row.original.disabled === "true" || row.original.disabled === true ? "Выключен" : row.original.running ?? "—") }]} onSelect={row => { if (row[".id"] && !busy) open(row) }} /><div className="flex gap-2"><Button variant="outline" disabled={busy || offset === 0} onClick={() => { setOffset(Math.max(0, offset - 100)); setEditing(null) }}>Предыдущие объекты</Button><Button variant="outline" disabled={busy || rows.data?.nextOffset == null} onClick={() => { if (rows.data?.nextOffset != null) setOffset(rows.data.nextOffset); setEditing(null) }}>Следующие объекты</Button></div>{editing && <div className="flex flex-col gap-4 rounded-md border p-4"><p className="font-medium">{editing === "new" ? "Новый объект" : `Объект ${String(current?.[".id"])}`}</p>{current && <details><summary className="cursor-pointer text-sm">Текущие свойства</summary><pre className="max-h-60 overflow-auto whitespace-pre-wrap break-all text-xs">{pretty(current)}</pre></details>}{protectedRow ? <p className="text-sm">Системный или динамический объект доступен для чтения.</p> : <><p className="text-xs text-muted-foreground">В план попадут только заполненные изменения. Пустой выбор оставляет свойство без изменения; при создании действует настройка устройства.</p><div className="grid gap-3 sm:grid-cols-2">{resource.fields.filter(field => editing === "new" || field.key in (current ?? {})).map(field => <Field key={field.key} label={`${field.key}${editing === "new" && field.requiredOnCreate ? " *" : ""}`}>{field.type === "boolean" || field.options ? <select aria-label={field.key} className="h-9 min-w-0 rounded-md border border-input bg-background px-2 text-sm" value={String(draft[field.key] ?? "")} disabled={busy || editing !== "new" && !resource.update} onChange={event => change(field.key, event.target.value === "" ? undefined : field.type === "boolean" ? event.target.value === "true" : event.target.value)}><option value="">{current ? `Сейчас: ${String(current[field.key])}` : "По умолчанию устройства"}</option>{(field.options ?? ["true", "false"]).map(value => <option key={value} value={value}>{value}</option>)}</select> : <Input aria-label={field.key} type={field.type === "number" ? "number" : "text"} min={field.min} max={field.max} maxLength={field.maxLength} disabled={busy || editing !== "new" && !resource.update} placeholder={current ? String(current[field.key] ?? "") : ""} value={String(draft[field.key] ?? "")} onChange={event => change(field.key, field.type === "number" ? event.target.value === "" ? undefined : Number(event.target.value) : event.target.value)} />}</Field>)}</div></>}<div className="flex flex-wrap gap-2">{!protectedRow && (editing === "new" ? resource.create : resource.update) && <Button disabled={busy || !Object.keys(draft).length} onClick={() => { void prepare(editing === "new" ? "create" : "update") }}>Подготовить план изменения</Button>}{current && !protectedRow && resource.delete && <Button variant="destructive" disabled={busy} onClick={() => { void prepare("delete") }}>Подготовить план удаления</Button>}<Button variant="outline" disabled={busy} onClick={() => setEditing(null)}>Закрыть объект</Button></div></div>}</>
|
||||
return <><ErrorMessage message={rows.error || error} />{receipt && <p role="status" className="text-sm">{receipt}</p>}<div className="flex flex-wrap items-center justify-between gap-2"><p className="text-sm text-muted-foreground">Объектов: {rows.data?.total ?? "…"}. Выберите строку для просмотра и подготовки изменения.</p>{resource.create && <Button variant="outline" disabled={busy} onClick={() => open("new")}><PlusIcon />Создать объект</Button>}</div><Grid items={rows.data?.items ?? []} loading={!rows.data && !rows.error} total={rows.data?.total} columns={[{ id: "nativeId", header: "ID", cell: ({ row }) => String(row.original[".id"] ?? "—") }, { id: "name", header: "Объект", cell: ({ row }) => String(row.original.name ?? row.original.address ?? row.original.interface ?? "—") }, { id: "state", header: "Состояние", cell: ({ row }) => String(row.original.disabled === "true" || row.original.disabled === true ? "Выключен" : row.original.running ?? "—") }]} onSelect={row => { if (row[".id"] && !busy) open(row) }} /><div className="flex gap-2"><Button variant="outline" disabled={busy || offset === 0} onClick={() => { setOffset(Math.max(0, offset - 100)); setEditing(null) }}>Предыдущие объекты</Button><Button variant="outline" disabled={busy || rows.data?.nextOffset == null} onClick={() => { if (rows.data?.nextOffset != null) setOffset(rows.data.nextOffset); setEditing(null) }}>Следующие объекты</Button></div>{editing && <div className="flex flex-col gap-4 rounded-md border p-4"><p className="font-medium">{editing === "new" ? "Новый объект" : `Объект ${String(current?.[".id"])}`}</p>{current && <details><summary className="cursor-pointer text-sm">Текущие свойства</summary><pre className="max-h-60 overflow-auto whitespace-pre-wrap break-all text-xs">{pretty(current)}</pre></details>}{protectedRow ? <p className="text-sm">Системный или динамический объект доступен для чтения.</p> : <><p className="text-xs text-muted-foreground">В план попадут только заполненные изменения. Пустой выбор оставляет свойство без изменения; при создании действует настройка устройства.</p><div className="grid gap-3 sm:grid-cols-2">{editableFields.map(field => <Field key={field.key} label={`${field.key}${editing === "new" && field.requiredOnCreate ? " *" : ""}`}>{field.type === "boolean" || field.options ? <select aria-label={field.key} className="h-9 min-w-0 rounded-md border border-input bg-background px-2 text-sm" value={String(draft[field.key] ?? "")} disabled={busy || editing !== "new" && !resource.update} onChange={event => change(field.key, event.target.value === "" ? undefined : field.type === "boolean" ? event.target.value === "true" : event.target.value)}><option value="">{ethernetDisabledUnknown && field.key === "disabled" ? "Текущее значение неизвестно" : current ? `Сейчас: ${String(current[field.key])}` : "По умолчанию устройства"}</option>{(field.options ?? ["true", "false"]).map(value => <option key={value} value={value}>{value}</option>)}</select> : <Input aria-label={field.key} type={field.type === "number" ? "number" : "text"} min={field.min} max={field.max} maxLength={field.maxLength} disabled={busy || editing !== "new" && !resource.update} placeholder={current ? String(current[field.key] ?? "") : ""} value={String(draft[field.key] ?? "")} onChange={event => change(field.key, field.type === "number" ? event.target.value === "" ? undefined : Number(event.target.value) : event.target.value)} />}</Field>)}</div>
|
||||
{ethernetDisabledUnknown && draft.disabled !== undefined && <p className="text-sm text-muted-foreground">Исходное состояние неизвестно. Для этого изменения обратный план недоступен.</p>}
|
||||
</>}<div className="flex flex-wrap gap-2">{!protectedRow && (editing === "new" ? resource.create : resource.update) && <Button disabled={busy || !Object.keys(draft).length} onClick={() => { void prepare(editing === "new" ? "create" : "update") }}>Подготовить план изменения</Button>}{current && !protectedRow && resource.delete && <Button variant="destructive" disabled={busy} onClick={() => { void prepare("delete") }}>Подготовить план удаления</Button>}<Button variant="outline" disabled={busy} onClick={() => setEditing(null)}>Закрыть объект</Button></div></div>}</>
|
||||
}
|
||||
function TokenDialog({ token, close }: { token: string; close: () => void }) {
|
||||
return <Dialog open={!!token} onOpenChange={open => { if (!open) close() }}><DialogContent className="sm:max-w-xl"><DialogHeader><DialogTitle>Доступ создан</DialogTitle><DialogDescription>Сохраните токен в настройках AI-клиента. Повторно посмотреть его нельзя.</DialogDescription></DialogHeader><Input aria-label="Одноразовый токен MCP" readOnly type="password" value={token} /><Button onClick={() => { void navigator.clipboard.writeText(token).then(() => toast.success("Токен скопирован"), () => toast.error("Не удалось скопировать токен")) }}><CopyIcon />Копировать</Button><Button variant="outline" onClick={close}>Закрыть и скрыть токен</Button></DialogContent></Dialog>
|
||||
function TokenDialog({ token, close, connectionName }: { token: string; close: () => void; connectionName?: string }) {
|
||||
return <Dialog open={!!token} onOpenChange={open => { if (!open) close() }}><DialogContent className="sm:max-w-xl"><DialogHeader><DialogTitle>Доступ создан</DialogTitle><DialogDescription>{connectionName && `Подключение «${connectionName}». `}Сохраните токен в настройках AI-клиента. Повторно посмотреть его нельзя.</DialogDescription></DialogHeader><Input aria-label="Одноразовый токен MCP" readOnly type="password" value={token} /><Button onClick={() => { void navigator.clipboard.writeText(token).then(() => toast.success("Токен скопирован"), () => toast.error("Не удалось скопировать токен")) }}><CopyIcon />Копировать</Button><Button variant="outline" onClick={close}>Закрыть и скрыть токен</Button></DialogContent></Dialog>
|
||||
}
|
||||
function ConnectionForm({ api, operations, editing, close, created }: { api: McpApi; operations: McpOperationDescriptor[]; editing?: McpConnection; close: () => void; created: (token?: string) => void }) {
|
||||
const [step, setStep] = useState(1), [busy, setBusy] = useState(false), [error, setError] = useState("")
|
||||
@@ -133,28 +175,110 @@ function Connections({ api, operations }: { api: McpApi; operations: McpOperatio
|
||||
const columns = useMemo<ColumnDef<DataGridFeatures, RecordRow>[]>(() => [
|
||||
{ accessorKey: "name", header: "Подключение", size: 200 },
|
||||
{ id: "mode", header: "Режим", cell: ({ row }) => modeLabels[(row.original.policy as McpConnection["policy"]).mode] },
|
||||
{ id: "status", header: "Состояние", cell: ({ row }) => <Badge variant={(row.original.policy as McpConnection["policy"]).status === "active" && row.original.generationValid ? "success-light" : "warning-light"}>{row.original.generationValid ? (row.original.policy as McpConnection["policy"]).status : "доступ аннулирован"}</Badge> },
|
||||
{ id: "status", header: "Состояние доступа", size: 260, cell: ({ row }) => <ConnectionAccessStatus connection={row.original as unknown as McpConnection} /> },
|
||||
{ id: "expiresAt", header: "Доступ до", size: 170, cell: ({ row }) => date((row.original.policy as McpConnection["policy"]).expiresAt) },
|
||||
{ accessorKey: "lastUsedAt", header: "Последний вызов", cell: ({ row }) => date(row.original.lastUsedAt) },
|
||||
{ id: "ownerValidation", header: "Права владельца", size: 190, cell: ({ row }) => { const connection = row.original as unknown as McpConnection; return <div className="flex flex-col gap-1"><span className="text-xs">До {date(connection.ownerValidUntil)}</span>{connection.ownerId === getClaims()?.sub && <Button size="sm" variant="outline" disabled={!connection.generationValid || connection.policy.status === "revoked"} onClick={() => { void act(() => api.revalidate(connection.id)) }}>Обновить мои права</Button>}</div> } },
|
||||
{ id: "ownerValidation", header: "Права владельца до", size: 190, cell: ({ row }) => { const connection = row.original as unknown as McpConnection; return <div className="flex flex-col gap-1"><span className="text-xs">{date(connection.ownerValidUntil)}</span>{connection.ownerId === getClaims()?.sub && <Button size="sm" variant="outline" disabled={!connection.generationValid || connection.policy.status === "revoked"} onClick={() => { void act(() => api.revalidate(connection.id)) }}>Обновить мои права</Button>}</div> } },
|
||||
{ id: "actions", header: "Действия", size: 350, cell: ({ row }) => { const connection = row.original as unknown as McpConnection; return admin && <div className="flex flex-wrap gap-1"><Button size="sm" variant="outline" onClick={() => setEditing(connection)}>Разрешения</Button><Button size="sm" variant="outline" disabled={connection.policy.status === "revoked"} onClick={() => { void act(() => api.status(connection.id, connection.policy.status === "active" ? "paused" : "active")) }}>{connection.policy.status === "active" ? "Пауза" : "Включить"}</Button><Button size="sm" variant="outline" disabled={connection.policy.status === "revoked"} onClick={() => { if (window.confirm("Отозвать доступ подключения и все его токены?")) void act(() => api.status(connection.id, "revoked")) }}>Отозвать</Button><Button size="sm" variant="ghost" disabled={connection.policy.status === "revoked"} onClick={() => { if (window.confirm("Заменить токен? Старый токен перестанет работать.")) void act(async () => setToken((await api.rotate(connection.id)).token)) }}>Новый токен</Button></div> } },
|
||||
], [api, admin, act])
|
||||
return <><Panel title="Подключения" description="Токены, сроки и разрешения AI-клиентов" actions={admin && <Button onClick={() => setEditing("new")}><PlusIcon />Выдать доступ</Button>}><ErrorMessage message={query.error} /><Grid items={(query.data?.connections ?? []) as unknown as RecordRow[]} columns={columns} loading={!query.data && !query.error} /><p className="text-sm text-muted-foreground">HTTP endpoint: адрес backend + /mcp. Для stdio используйте MCP_URL и MCP_TOKEN с командой npm --prefix backend run mcp:stdio.</p></Panel>{editing && <ConnectionForm api={api} operations={operations} editing={editing === "new" ? undefined : editing} close={() => setEditing(null)} created={value => { setEditing(null); if (value) setToken(value); query.refresh() }} />}<TokenDialog token={token} close={() => setToken("")} /></>
|
||||
}
|
||||
function AccessTools({ api }: { api: McpApi }) {
|
||||
const connections = useQuery(useCallback(signal => api.connections(signal), [api]))
|
||||
const [selected, setSelected] = useState(""), [result, setResult] = useState<unknown>(null), [token, setToken] = useState("")
|
||||
const [operations, setOperations] = useState<string[]>([]), [serverText, setServerText] = useState(""), [minutes, setMinutes] = useState(60), [global, setGlobal] = useState(false)
|
||||
const grantLoad = useCallback(async (signal: AbortSignal) => selected ? api.grants(selected, signal) : { grants: [] }, [api, selected])
|
||||
const grants = useQuery(grantLoad), connection = connections.data?.connections.find(value => value.id === selected)
|
||||
const create = async () => {
|
||||
if (!connection) return
|
||||
try {
|
||||
const now = new Date(), expires = new Date(Math.min(now.getTime() + minutes * 60000, Date.parse(connection.policy.expiresAt)))
|
||||
const issued = await api.grant(connection.id, { id: crypto.randomUUID(), startsAt: now.toISOString(), expiresAt: expires.toISOString(), scope: { serverIds: serverText.split(",").map(value => value.trim()).filter(Boolean).map(Number), operationIds: operations, allowGlobal: global } })
|
||||
setToken(issued.token); grants.refresh()
|
||||
} catch (error) { toast.error(errorText(error)) }
|
||||
const [selected, setSelected] = useState("")
|
||||
const [grantBusy, setGrantBusy] = useState(false)
|
||||
const [issued, setIssued] = useState<{ token: string; connectionName: string } | null>(null)
|
||||
const grantLocked = useRef(false)
|
||||
const connection = connections.data?.connections.find(value => value.id === selected)
|
||||
|
||||
const releaseGrant = () => {
|
||||
grantLocked.current = false
|
||||
setGrantBusy(false)
|
||||
}
|
||||
return <Panel title="Проверка подключения и временные допуски" description="Допуск с отдельным токеном может только сузить основной доступ и действует не более 24 часов"><ErrorMessage message={connections.error || grants.error} /><NativeSelect label="Подключение для проверки" value={selected} onChange={value => { setSelected(value); setOperations([]); setServerText(""); setGlobal(false); setResult(null) }}><option value="">Выберите подключение</option>{connections.data?.connections.map(connection => <option key={connection.id} value={connection.id}>{connection.name}</option>)}</NativeSelect>{connection && <><p className="text-sm text-muted-foreground">Права владельца подтверждены до {date(connection.ownerValidUntil)}. Для продления войдите с актуальными правами портала; старые планы и допуски контроллера потребуется подготовить заново.</p><Button variant="outline" className="self-start" disabled={connection.ownerId !== getClaims()?.sub} onClick={() => { void api.revalidate(connection.id).then(() => { connections.refresh(); toast.success("Права владельца обновлены") }, error => toast.error(errorText(error))) }}>Подтвердить текущие права владельца</Button><Button variant="outline" className="self-start" onClick={() => { void api.check(connection.id).then(setResult, error => toast.error(errorText(error))) }}>Проверить готовность доступа</Button>{result !== null && <pre className="overflow-auto rounded bg-muted p-3 text-xs">{pretty(result)}</pre>}<div className="grid gap-3 sm:grid-cols-2"><Field label={`Серверы допуска (доступны: ${connection.policy.scope.serverIds.join(", ")})`}><Input value={serverText} onChange={event => setServerText(event.target.value)} placeholder="ID через запятую" /></Field><Field label="Срок допуска, минут"><Input type="number" min={1} max={1440} value={minutes} onChange={event => setMinutes(Number(event.target.value))} /></Field></div>{connection.policy.scope.allowGlobal && <Choice label="Разрешить глобальные действия в допуске" checked={global} onChange={setGlobal} />}<div className="grid max-h-60 gap-2 overflow-y-auto sm:grid-cols-2">{connection.policy.scope.operationIds.map(id => <Choice key={id} label={id} checked={operations.includes(id)} onChange={checked => setOperations(values => checked ? [...values, id] : values.filter(value => value !== id))} />)}</div><Button className="self-start" disabled={!operations.length || connection.policy.status !== "active"} onClick={() => { void create() }}>Выдать временный допуск</Button>{grants.data?.grants.map(grant => <div key={grant.id} className="flex flex-wrap items-center justify-between gap-2 rounded border p-3 text-sm"><span>До {date(grant.grant.expiresAt)} · {grant.revoked_at ? "отозван" : "выдан"}</span><Button size="sm" variant="outline" disabled={!!grant.revoked_at} onClick={() => { void api.revokeGrant(grant.id).then(grants.refresh, error => toast.error(errorText(error))) }}>Отозвать допуск</Button></div>)}</>}<TokenDialog token={token} close={() => setToken("")} /></Panel>
|
||||
const issue = async (grant: Parameters<McpApi["grant"]>[1]) => {
|
||||
if (!connection || grantLocked.current) return
|
||||
grantLocked.current = true
|
||||
setGrantBusy(true)
|
||||
try {
|
||||
const { token } = await api.grant(connection.id, grant)
|
||||
setIssued({ token, connectionName: connection.name })
|
||||
connections.refresh()
|
||||
} catch (error) {
|
||||
releaseGrant()
|
||||
toast.error(errorText(error))
|
||||
}
|
||||
}
|
||||
|
||||
return <Panel title="Проверка подключения и временные допуски" description="Допуск с отдельным токеном может только сузить основной доступ и действует не более 24 часов">
|
||||
<ErrorMessage message={connections.error} />
|
||||
<NativeSelect label="Подключение для проверки" value={selected} onChange={setSelected}>
|
||||
<option value="">Выберите подключение</option>
|
||||
{connections.data?.connections.map(connection => <option key={connection.id} value={connection.id}>{connection.name}</option>)}
|
||||
</NativeSelect>
|
||||
{connection && <ConnectionAccessTools key={connection.id} api={api} connection={connection} issue={issue} grantBusy={grantBusy} />}
|
||||
{issued && <TokenDialog token={issued.token} connectionName={issued.connectionName} close={() => { setIssued(null); releaseGrant() }} />}
|
||||
</Panel>
|
||||
}
|
||||
|
||||
function ConnectionAccessTools({ api, connection, issue, grantBusy }: {
|
||||
api: McpApi
|
||||
connection: McpConnection
|
||||
issue: (grant: Parameters<McpApi["grant"]>[1]) => Promise<void>
|
||||
grantBusy: boolean
|
||||
}) {
|
||||
const [result, setResult] = useState<Awaited<ReturnType<McpApi["check"]>> | null>(null)
|
||||
const [operations, setOperations] = useState<string[]>([]), [serverText, setServerText] = useState(""), [minutes, setMinutes] = useState(60), [global, setGlobal] = useState(false)
|
||||
const connectionId = connection.id
|
||||
const grants = useQuery(useCallback(signal => api.grants(connectionId, signal), [api, connectionId]))
|
||||
const checkRevision = useRef(0)
|
||||
useEffect(() => () => { checkRevision.current++ }, [])
|
||||
|
||||
const check = async () => {
|
||||
const revision = ++checkRevision.current
|
||||
setResult(null)
|
||||
try {
|
||||
const readiness = await api.check(connectionId)
|
||||
if (revision === checkRevision.current) setResult(readiness)
|
||||
} catch (error) {
|
||||
if (revision === checkRevision.current) toast.error(errorText(error))
|
||||
}
|
||||
}
|
||||
|
||||
const create = () => {
|
||||
const now = new Date(), expires = new Date(Math.min(now.getTime() + minutes * 60000, Date.parse(connection.policy.expiresAt)))
|
||||
try {
|
||||
void issue({
|
||||
id: crypto.randomUUID(), startsAt: now.toISOString(), expiresAt: expires.toISOString(),
|
||||
scope: { serverIds: serverText.split(",").map(value => value.trim()).filter(Boolean).map(Number), operationIds: operations, allowGlobal: global },
|
||||
})
|
||||
} catch (error) {
|
||||
toast.error(errorText(error))
|
||||
}
|
||||
}
|
||||
|
||||
return <>
|
||||
<ErrorMessage message={grants.error} />
|
||||
<p className="text-sm text-muted-foreground">Права владельца подтверждены до {date(connection.ownerValidUntil)}. Для продления войдите с актуальными правами портала; старые планы и допуски контроллера потребуется подготовить заново.</p>
|
||||
<Button variant="outline" className="self-start" disabled={connection.ownerId !== getClaims()?.sub} onClick={() => { void api.revalidate(connectionId).then(() => { grants.refresh(); toast.success("Права владельца обновлены") }, error => toast.error(errorText(error))) }}>Подтвердить текущие права владельца</Button>
|
||||
<Button variant="outline" className="self-start" onClick={() => { void check() }}>Проверить готовность доступа</Button>
|
||||
{result !== null && <>
|
||||
{result.protocolProbe?.capabilitiesRead && <p role="status" className="text-sm text-muted-foreground">
|
||||
{({ passed: "Проверочное чтение возможностей прошло.", failed: "Проверочное чтение возможностей завершилось ошибкой.", skipped: "Проверочное чтение возможностей пропущено." })[result.protocolProbe.capabilitiesRead]}
|
||||
</p>}
|
||||
<pre className="overflow-auto rounded bg-muted p-3 text-xs">{pretty(result)}</pre>
|
||||
</>}
|
||||
<div className="grid gap-3 sm:grid-cols-2">
|
||||
<Field label={`Серверы допуска (доступны: ${connection.policy.scope.serverIds.join(", ")})`}><Input value={serverText} onChange={event => setServerText(event.target.value)} placeholder="ID через запятую" /></Field>
|
||||
<Field label="Срок допуска, минут"><Input type="number" min={1} max={1440} value={minutes} onChange={event => setMinutes(Number(event.target.value))} /></Field>
|
||||
</div>
|
||||
{connection.policy.scope.allowGlobal && <Choice label="Разрешить глобальные действия в допуске" checked={global} onChange={setGlobal} />}
|
||||
<div className="grid max-h-60 gap-2 overflow-y-auto sm:grid-cols-2">{connection.policy.scope.operationIds.map(id => <Choice key={id} label={id} checked={operations.includes(id)} onChange={checked => setOperations(values => checked ? [...values, id] : values.filter(value => value !== id))} />)}</div>
|
||||
<Button className="self-start" disabled={grantBusy || !operations.length || connection.policy.status !== "active"} onClick={create}>Выдать временный допуск</Button>
|
||||
{grants.data?.grants.map(grant => <div key={grant.id} className="flex flex-wrap items-center justify-between gap-2 rounded border p-3 text-sm">
|
||||
<span>До {date(grant.grant.expiresAt)} · {grant.revoked_at ? "отозван" : "выдан"}</span>
|
||||
<Button size="sm" variant="outline" disabled={!!grant.revoked_at} onClick={() => { void api.revokeGrant(grant.id).then(grants.refresh, error => toast.error(errorText(error))) }}>Отозвать допуск</Button>
|
||||
</div>)}
|
||||
</>
|
||||
}
|
||||
function RoutingProfileForm({ api, editing, close }: { api: McpApi; editing?: RecordRow; close: () => void }) {
|
||||
const connections = useQuery(useCallback(signal => api.connections(signal), [api]))
|
||||
@@ -197,20 +321,37 @@ function CandidateProbeEditor({ candidates, update }: { candidates: CandidateFor
|
||||
}
|
||||
function RoutePathVerification({ api }: { api: McpApi }) {
|
||||
const profiles = useQuery(useCallback(signal => api.profiles(signal), [api]))
|
||||
const [profileId, setProfileId] = useState(""), [candidateId, setCandidateId] = useState(""), [busy, setBusy] = useState(false), [error, setError] = useState(""), [result, setResult] = useState<unknown>(null)
|
||||
const [profileId, setProfileId] = useState(""), [candidateId, setCandidateId] = useState(""), [busy, setBusy] = useState(false)
|
||||
const [proofPurpose, setProofPurpose] = useState<"community" | "control-path">("community")
|
||||
const [feedback, setFeedback] = useState<{ key: string; result: unknown } | { key: string; error: string } | null>(null)
|
||||
const revision = useRef(0)
|
||||
const profile = profiles.data?.profiles.find(profile => profile.id === profileId), config = routeAiProfileSchema.safeParse(profile?.config)
|
||||
const check = async () => { setBusy(true); setError(""); setResult(null); try { setResult(await api.checkRoutePath(profileId, candidateId, proofPurpose)) } catch (failure) { setError(errorText(failure)) } finally { setBusy(false) } }
|
||||
const candidates = config.success ? config.data.candidates.filter(candidate => candidate.controlProbe) : []
|
||||
const canCheck = candidates.some(candidate => candidate.id === candidateId)
|
||||
const selectionKey = JSON.stringify([profileId, profile?.version, candidateId, proofPurpose])
|
||||
const currentFeedback = feedback?.key === selectionKey ? feedback : null
|
||||
const invalidate = () => { revision.current++; setFeedback(null) }
|
||||
const check = async () => {
|
||||
if (busy || !canCheck) return
|
||||
const request = ++revision.current
|
||||
setBusy(true); setFeedback(null)
|
||||
try {
|
||||
const result = await api.checkRoutePath(profileId, candidateId, proofPurpose)
|
||||
if (request === revision.current) setFeedback({ key: selectionKey, result })
|
||||
} catch (failure) {
|
||||
if (request === revision.current) setFeedback({ key: selectionKey, error: errorText(failure) })
|
||||
} finally { setBusy(false) }
|
||||
}
|
||||
return <Panel title="Контрольная проверка пути" description="Ограниченные ping и traceroute; неизвестный результат не считается отказом пути.">
|
||||
<ErrorMessage message={profiles.error || error} />
|
||||
<ErrorMessage message={profiles.error || (currentFeedback && "error" in currentFeedback ? currentFeedback.error : "")} />
|
||||
<div className="grid gap-3 sm:grid-cols-2">
|
||||
<NativeSelect label="Профиль для проверки пути" value={profileId} onChange={value => { setProfileId(value); setCandidateId(""); setResult(null) }}><option value="">Выберите профиль</option>{profiles.data?.profiles.map(profile => <option key={String(profile.id)} value={String(profile.id)}>{String((profile.config as RecordRow)?.name ?? profile.id)}</option>)}</NativeSelect>
|
||||
<NativeSelect label="Проверяемый путь" value={candidateId} onChange={value => { setCandidateId(value); setResult(null) }}><option value="">Выберите путь</option>{config.success && config.data.candidates.filter(candidate => candidate.controlProbe).map(candidate => <option key={candidate.id} value={candidate.id}>{candidate.id}</option>)}</NativeSelect>
|
||||
<NativeSelect label="Назначение проверки" value={proofPurpose} onChange={value => { setProofPurpose(value as typeof proofPurpose); setResult(null) }}><option value="community">Путь Community</option><option value="control-path">Самостоятельный контрольный путь</option></NativeSelect>
|
||||
<NativeSelect label="Профиль для проверки пути" value={profileId} onChange={value => { invalidate(); setProfileId(value); setCandidateId("") }}><option value="">Выберите профиль</option>{profiles.data?.profiles.map(profile => <option key={String(profile.id)} value={String(profile.id)}>{String((profile.config as RecordRow)?.name ?? profile.id)}</option>)}</NativeSelect>
|
||||
<NativeSelect label="Проверяемый путь" value={candidateId} onChange={value => { invalidate(); setCandidateId(value) }}><option value="">Выберите путь</option>{candidates.map(candidate => <option key={candidate.id} value={candidate.id}>{candidate.id}</option>)}</NativeSelect>
|
||||
<NativeSelect label="Назначение проверки" value={proofPurpose} onChange={value => { invalidate(); setProofPurpose(value as typeof proofPurpose) }}><option value="community">Путь Community</option><option value="control-path">Самостоятельный контрольный путь</option></NativeSelect>
|
||||
</div>
|
||||
<p className="text-sm text-muted-foreground">{proofPurpose === "control-path" ? "Проверяется только контрольный путь. Результат не разрешает переключение Community и не подтверждает обратный путь." : "Проверка учитывает Community, таблицу маршрутизации и BGP. Применение изменений требует отдельного плана; обратный путь проверяется отдельно."}</p>
|
||||
<Button disabled={busy || !profileId || !candidateId} onClick={() => { void check() }}>Проверить контрольный путь</Button>
|
||||
{result !== null && <pre role="status" className="max-h-72 overflow-auto whitespace-pre-wrap break-all text-xs">{pretty(result)}</pre>}
|
||||
<Button disabled={busy || !canCheck} onClick={() => { void check() }}>Проверить контрольный путь</Button>
|
||||
{currentFeedback && "result" in currentFeedback && <pre role="status" className="max-h-72 overflow-auto whitespace-pre-wrap break-all text-xs">{pretty(currentFeedback.result)}</pre>}
|
||||
</Panel>
|
||||
}
|
||||
function RoutingProfiles({ api }: { api: McpApi }) {
|
||||
@@ -248,21 +389,121 @@ function Records({ api, kind }: { api: McpApi; kind: "requests" | "plans" | "ope
|
||||
{ accessorKey: "error_code", header: "Причина", cell: ({ row }) => String(row.original.error_code ?? row.original.verification ?? "—") },
|
||||
{ id: "details", header: "", cell: ({ row }) => <Button size="sm" variant="ghost" onClick={() => setSelected(row.original)}>Открыть</Button> },
|
||||
], [])
|
||||
const decision = async (approve: boolean) => { if (!selected) return; try { await api.decision(String(selected.id), approve); setSelected(null); query.refresh() } catch (error) { toast.error(errorText(error)) } }
|
||||
return <Panel title={kind === "requests" ? "Обращения" : kind === "plans" ? "Планы изменений" : kind === "operations" ? "Выполнение операций" : kind === "drift" ? "Расхождения конфигурации" : "Административный аудит"} description="Чтение, отказы и изменения доступны для расследования"><ErrorMessage message={query.error} /><p className="text-xs text-muted-foreground">Последнее успешное обновление: {date(query.updatedAt)}{query.error ? " · показаны ранее полученные данные" : ""}</p><RecordFilters kind={kind} /><div className="flex flex-wrap gap-2">{kind === "requests" && <Input className="max-w-sm" aria-label="Имя инструмента" placeholder="Имя инструмента" value={search} onChange={event => { setSearch(event.target.value); setCursor("") }} />}<Input className="max-w-xs" aria-label="Фильтр состояния" placeholder="Состояние" value={status} onChange={event => { setStatus(event.target.value); setCursor("") }} /><Button variant="outline" onClick={query.refresh}><RefreshCwIcon />Обновить</Button></div><Grid items={query.data?.items ?? []} columns={columns} total={query.data?.total} loading={!query.data && !query.error} onSelect={setSelected} /><div className="flex items-center justify-between"><span className="text-sm text-muted-foreground">Найдено: {query.data?.total ?? "—"}</span><div className="flex gap-2"><Button variant="outline" disabled={!cursor} onClick={() => setCursor("")}>В начало</Button><Button variant="outline" disabled={!query.data?.nextCursor} onClick={() => setCursor(query.data?.nextCursor ?? "")}>Далее</Button></div></div><Dialog open={!!selected} onOpenChange={open => { if (!open) setSelected(null) }}><DialogContent className="max-h-[90dvh] overflow-y-auto sm:max-w-3xl"><DialogHeader><DialogTitle>Детали {kind === "plans" ? "плана" : kind === "operations" ? "операции" : "обращения"}</DialogTitle><DialogDescription>Секретные поля скрыты. Подтверждение относится к этому содержимому.</DialogDescription></DialogHeader>{kind === "plans" && selected ? <PlanReview plan={selected} /> : <pre className="max-h-[55dvh] overflow-auto whitespace-pre-wrap break-all rounded-md bg-muted p-3 text-xs">{pretty(selected)}</pre>}{kind === "operations" && selected && <ArtifactDownloads key={String(selected.id)} api={api} operation={selected} />}{kind === "plans" && ["approved", "draft"].includes(String(selected?.state)) && can("mm:mcp:admin") && <Button onClick={() => { if (selected) void api.apply(String(selected.id)).then(() => { setSelected(null); query.refresh(); toast.success("Операция принята; результат появится в списке операций") }, error => toast.error(errorText(error))) }}>Применить план</Button>}{kind === "plans" && selected?.state === "awaiting-approval" && can("mm:mcp:approve") && <div className="flex gap-2"><Button onClick={() => { void decision(true) }}>Подтвердить план</Button><Button variant="outline" onClick={() => { void decision(false) }}>Отклонить</Button></div>}</DialogContent></Dialog></Panel>
|
||||
const pendingPlanRequests = useRef(new Set<string>())
|
||||
const [pendingPlans, setPendingPlans] = useState<ReadonlySet<string>>(() => new Set())
|
||||
const selectedPlanPending = kind === "plans" && !!selected && pendingPlans.has(String(selected.id))
|
||||
const submitPlan = async (action: "approve" | "reject" | "apply") => {
|
||||
if (!selected) return
|
||||
const plan = selected
|
||||
const planId = String(plan.id)
|
||||
const pending = pendingPlanRequests.current
|
||||
if (pending.has(planId)) return
|
||||
pending.add(planId)
|
||||
setPendingPlans(new Set(pending))
|
||||
try {
|
||||
if (action === "apply") {
|
||||
await api.apply(planId)
|
||||
toast.success("Операция принята; результат появится в списке операций")
|
||||
} else {
|
||||
await api.decision(planId, action === "approve")
|
||||
}
|
||||
setSelected(current => current === plan ? null : current)
|
||||
query.refresh()
|
||||
} catch (error) {
|
||||
toast.error(errorText(error))
|
||||
} finally {
|
||||
pending.delete(planId)
|
||||
setPendingPlans(new Set(pending))
|
||||
}
|
||||
}
|
||||
return <Panel title={kind === "requests" ? "Обращения" : kind === "plans" ? "Планы изменений" : kind === "operations" ? "Выполнение операций" : kind === "drift" ? "Расхождения конфигурации" : "Административный аудит"} description="Чтение, отказы и изменения доступны для расследования"><ErrorMessage message={query.error} /><p className="text-xs text-muted-foreground">Последнее успешное обновление: {date(query.updatedAt)}{query.error ? " · показаны ранее полученные данные" : ""}</p><RecordFilters kind={kind} /><div className="flex flex-wrap gap-2">{kind === "requests" && <Input className="max-w-sm" aria-label="Имя инструмента" placeholder="Имя инструмента" value={search} onChange={event => { setSearch(event.target.value); setCursor("") }} />}<Input className="max-w-xs" aria-label="Фильтр состояния" placeholder="Состояние" value={status} onChange={event => { setStatus(event.target.value); setCursor("") }} /><Button variant="outline" onClick={query.refresh}><RefreshCwIcon />Обновить</Button></div><Grid items={query.data?.items ?? []} columns={columns} total={query.data?.total} loading={!query.data && !query.error} onSelect={setSelected} /><div className="flex items-center justify-between"><span className="text-sm text-muted-foreground">Найдено: {query.data?.total ?? "—"}</span><div className="flex gap-2"><Button variant="outline" disabled={!cursor} onClick={() => setCursor("")}>В начало</Button><Button variant="outline" disabled={!query.data?.nextCursor} onClick={() => setCursor(query.data?.nextCursor ?? "")}>Далее</Button></div></div><Dialog open={!!selected} onOpenChange={open => { if (!open) setSelected(null) }}><DialogContent className="max-h-[90dvh] overflow-y-auto sm:max-w-3xl"><DialogHeader><DialogTitle>Детали {kind === "plans" ? "плана" : kind === "operations" ? "операции" : "обращения"}</DialogTitle><DialogDescription>Секретные поля скрыты. Подтверждение относится к этому содержимому.</DialogDescription></DialogHeader>{kind === "plans" && selected ? <PlanReview plan={selected} /> : <pre className="max-h-[55dvh] overflow-auto whitespace-pre-wrap break-all rounded-md bg-muted p-3 text-xs">{pretty(selected)}</pre>}{kind === "operations" && selected && <ArtifactDownloads key={String(selected.id)} api={api} operation={selected} />}{kind === "plans" && ["approved", "draft"].includes(String(selected?.state)) && can("mm:mcp:admin") && <Button disabled={selectedPlanPending} onClick={() => { void submitPlan("apply") }}>Применить план</Button>}{kind === "plans" && selected?.state === "awaiting-approval" && can("mm:mcp:approve") && <div className="flex gap-2"><Button disabled={selectedPlanPending} onClick={() => { void submitPlan("approve") }}>Подтвердить план</Button><Button variant="outline" disabled={selectedPlanPending} onClick={() => { void submitPlan("reject") }}>Отклонить</Button></div>}</DialogContent></Dialog></Panel>
|
||||
}
|
||||
function RecordFilters({ kind }: { kind: string }) {
|
||||
const params = useSearchParams()
|
||||
const update = (field: string, value: string) => { const url = new URL(window.location.href); if (value) url.searchParams.set(kind + "." + field, value); else url.searchParams.delete(kind + "." + field); url.searchParams.delete(kind + ".cursor"); window.history.replaceState(null, "", url.pathname + url.search) }
|
||||
return <div className="grid gap-3 sm:grid-cols-2 lg:grid-cols-3"><Field label="Фильтр подключения MCP"><Input value={params.get(kind + ".connectionId") ?? ""} placeholder="UUID подключения" onChange={event => update("connectionId", event.target.value)} /></Field>{kind === "requests" && <><Field label="Фильтр ID сервера"><Input type="number" min={1} value={params.get(kind + ".serverId") ?? ""} onChange={event => update("serverId", event.target.value)} /></Field><Field label="Фильтр пользователя"><Input value={params.get(kind + ".userId") ?? ""} onChange={event => update("userId", event.target.value)} /></Field></>}{["from", "to"].map(field => <Field key={field} label={field === "from" ? "Обращения с (UTC)" : "Обращения до (UTC)"}><Input type="datetime-local" value={(params.get(kind + "." + field) ?? "").slice(0, 16)} onChange={event => update(field, event.target.value ? new Date(event.target.value + "Z").toISOString() : "")} /></Field>)}</div>
|
||||
}
|
||||
function Permissions({ api }: { api: McpApi }) {
|
||||
const connections = useQuery(useCallback(signal => api.connections(signal), [api])), protections = useQuery(useCallback(signal => api.protections(signal), [api]))
|
||||
const [connectionId, setConnectionId] = useState(""), [operationId, setOperationId] = useState(""), [serverText, setServerText] = useState(""), [result, setResult] = useState<unknown>(null)
|
||||
const [kind, setKind] = useState("server"), [objectId, setObjectId] = useState(""), [protection, setProtection] = useState("human-approval-required"), [reason, setReason] = useState("")
|
||||
function ConnectionPolicySimulation({ api, connection, operations }: {
|
||||
api: McpApi
|
||||
connection: McpConnection
|
||||
operations: McpOperationDescriptor[]
|
||||
}) {
|
||||
const [operationId, setOperationId] = useState(""), [serverText, setServerText] = useState("")
|
||||
const [result, setResult] = useState<McpPolicyDecision | null>(null)
|
||||
const revision = useRef(0)
|
||||
useEffect(() => () => { revision.current++ }, [])
|
||||
|
||||
const available = operations.filter(operation => connection.policy.scope.operationIds.includes(operation.id))
|
||||
const operation = available.find(operation => operation.id === operationId)
|
||||
const target = mcpTargetSchema.safeParse(operation?.scope === "servers"
|
||||
? { scope: "servers", serverIds: serverText.split(/[,\s]+/).filter(Boolean).map(value => /^\d+$/.test(value) ? Number(value) : NaN) }
|
||||
: { scope: operation?.scope })
|
||||
const invalidate = () => { revision.current++; setResult(null) }
|
||||
const preview = async () => {
|
||||
if (!operation || !target.success) return
|
||||
const current = ++revision.current
|
||||
setResult(null)
|
||||
try {
|
||||
const response = await api.preview({ connectionId: connection.id, operationId: operation.id, target: target.data })
|
||||
if (revision.current === current) setResult(response.result)
|
||||
} catch (error) {
|
||||
if (revision.current === current) toast.error(errorText(error))
|
||||
}
|
||||
}
|
||||
|
||||
return <>
|
||||
<div className="grid gap-3 md:grid-cols-2">
|
||||
<NativeSelect label="Операция" value={operationId} onChange={value => { invalidate(); setOperationId(value); setServerText("") }}>
|
||||
<option value="">Выберите действие</option>
|
||||
{available.map(operation => <option key={operation.id} value={operation.id}>{operation.title} · {operation.id}</option>)}
|
||||
</NativeSelect>
|
||||
{operation?.scope === "servers" && <Field label="ID серверов"><Input value={serverText} onChange={event => { invalidate(); setServerText(event.target.value) }} /></Field>}
|
||||
</div>
|
||||
{operation && <p className="text-sm text-muted-foreground">{{ connection: "Область операции — подключение", global: "Область операции — всё приложение", servers: "Область операции — выбранные серверы" }[operation.scope]}</p>}
|
||||
<Button className="self-start" disabled={!target.success || !can("mm:mcp:admin")} onClick={() => { void preview() }}><ShieldIcon />Проверить</Button>
|
||||
{result && <PolicyPreviewDecision result={result} />}
|
||||
</>
|
||||
}
|
||||
|
||||
function Permissions({ api, operations }: { api: McpApi; operations: McpOperationDescriptor[] }) {
|
||||
const connections = useQuery(useCallback(signal => api.connections(signal), [api]))
|
||||
const protections = useQuery(useCallback(signal => api.protections(signal), [api]))
|
||||
const [connectionId, setConnectionId] = useState("")
|
||||
const [kind, setKind] = useState("server"), [objectId, setObjectId] = useState("")
|
||||
const [protection, setProtection] = useState("human-approval-required"), [reason, setReason] = useState("")
|
||||
const [protectionServerText, setProtectionServerText] = useState("")
|
||||
const selected = connections.data?.connections.find(connection => connection.id === connectionId)
|
||||
const preview = async () => { if (!selected) return; try { const serverIds = serverText.split(/[,\s]+/).filter(Boolean).map(Number); const res = await api.preview({ operationId, policy: selected.policy, ownerPermissions: getClaims()?.permissions ?? [], target: serverIds.length ? { scope: "servers", serverIds } : { scope: "global" }, objects: [], protections: protections.data?.protections.map(item => item.object_ref) ?? [] }); setResult(res.result) } catch (error) { toast.error(errorText(error)) } }
|
||||
return <div className="flex flex-col gap-4"><Panel title="Проверка разрешений" description="Гипотетическое решение без выполнения действий и резервирования бюджета"><ErrorMessage message={connections.error || protections.error} /><div className="grid gap-3 md:grid-cols-3"><NativeSelect label="Подключение" value={connectionId} onChange={setConnectionId}><option value="">Выберите подключение</option>{connections.data?.connections.map(connection => <option key={connection.id} value={connection.id}>{connection.name}</option>)}</NativeSelect><NativeSelect label="Операция" value={operationId} onChange={setOperationId}><option value="">Выберите действие</option>{selected?.policy.scope.operationIds.map(id => <option key={id}>{id}</option>)}</NativeSelect><Field label="ID серверов; пусто — глобальное действие"><Input value={serverText} onChange={event => setServerText(event.target.value)} /></Field></div><Button className="self-start" disabled={!selected || !operationId || !can("mm:mcp:admin")} onClick={() => { void preview() }}><ShieldIcon />Проверить</Button>{result !== null && <pre role="status" className="overflow-auto whitespace-pre-wrap rounded bg-muted p-3 text-xs">{pretty(result)}</pre>}</Panel><Panel title="Защищённые объекты" description="Защита сохраняется и при автономном доступе"><div className="flex flex-col gap-2">{protections.data?.protections.map(item => <div key={item.id} className="flex flex-wrap items-center justify-between gap-2 rounded border p-3 text-sm"><span>{item.object_ref.kind} · {item.object_ref.id} · {item.object_ref.protection}<span className="ml-2 text-muted-foreground">{item.reason}</span></span>{can("mm:mcp:admin") && <Button variant="outline" size="sm" onClick={() => { if (window.confirm("Удалить защиту объекта?")) void api.removeProtection(item.id).then(protections.refresh, error => toast.error(errorText(error))) }}>Удалить защиту</Button>}</div>)}</div>{can("mm:mcp:admin") && <><div className="grid gap-3 md:grid-cols-4"><Field label="Тип объекта"><Input value={kind} onChange={event => setKind(event.target.value)} /></Field><Field label="Стабильный ID"><Input value={objectId} onChange={event => setObjectId(event.target.value)} /></Field><NativeSelect label="Защита" value={protection} onChange={setProtection}><option value="human-approval-required">Подтверждение человеком</option><option value="deny">Запрет изменений</option></NativeSelect><Field label="Причина"><Input value={reason} onChange={event => setReason(event.target.value)} /></Field></div><Button className="self-start" disabled={!objectId} onClick={() => { void api.protect({ kind, id: objectId, protection, ...(kind === "server" ? {} : { serverId: Number(serverText) }) }, reason).then(protections.refresh, error => toast.error(errorText(error))) }}>Добавить защиту</Button></>}</Panel></div>
|
||||
const protectionItems = protections.data?.protections ?? []
|
||||
const protectionServerId = Number(protectionServerText)
|
||||
const validProtectionServer = /^\d+$/.test(protectionServerText) && Number.isSafeInteger(protectionServerId) && protectionServerId > 0
|
||||
const addProtection = () => {
|
||||
void api.protect({ kind, id: objectId, protection, ...(kind === "server" ? {} : { serverId: protectionServerId }) }, reason)
|
||||
.then(protections.refresh, error => toast.error(errorText(error)))
|
||||
}
|
||||
return <div className="flex flex-col gap-4">
|
||||
<Panel title="Проверка разрешений" description="Симуляция текущей политики подключения без выполнения операции. Защиту конкретного объекта можно проверить отдельно.">
|
||||
<ErrorMessage message={connections.error || protections.error} />
|
||||
<NativeSelect label="Подключение" value={connectionId} onChange={setConnectionId}>
|
||||
<option value="">Выберите подключение</option>
|
||||
{connections.data?.connections.map(connection => <option key={connection.id} value={connection.id}>{connection.name}</option>)}
|
||||
</NativeSelect>
|
||||
{selected && <ConnectionPolicySimulation key={`simulation:${selected.id}:${selected.policy.version}`} api={api} connection={selected} operations={operations} />}
|
||||
{selected && selected.ownerId === getClaims()?.sub && <ObjectPermissionPreview key={`object:${selected.id}:${selected.policy.version}`} api={api} connection={selected} operations={operations} editable={can("mm:mcp:admin") && !protections.error && !!protections.data} onProtected={protections.refresh} />}
|
||||
</Panel>
|
||||
<Panel title="Защищённые объекты" description="Защита сохраняется и при автономном доступе">
|
||||
<div className="flex flex-col gap-2">{protectionItems.map(item => <div key={item.id} className="flex flex-wrap items-center justify-between gap-2 rounded border p-3 text-sm"><span>{item.object_ref.kind} · {item.object_ref.id} · {item.object_ref.protection}<span className="ml-2 text-muted-foreground">{item.reason}</span></span>{can("mm:mcp:admin") && <Button variant="outline" size="sm" onClick={() => { if (window.confirm("Удалить защиту объекта?")) void api.removeProtection(item.id).then(protections.refresh, error => toast.error(errorText(error))) }}>Удалить защиту</Button>}</div>)}</div>
|
||||
{can("mm:mcp:admin") && <>
|
||||
<div className="grid gap-3 md:grid-cols-4">
|
||||
<Field label="Тип объекта"><Input value={kind} onChange={event => setKind(event.target.value)} /></Field>
|
||||
<Field label="Стабильный ID"><Input value={objectId} onChange={event => setObjectId(event.target.value)} /></Field>
|
||||
{kind !== "server" && <Field label="ID сервера защищаемого объекта"><Input value={protectionServerText} onChange={event => setProtectionServerText(event.target.value)} /></Field>}
|
||||
<NativeSelect label="Защита" value={protection} onChange={setProtection}><option value="human-approval-required">Подтверждение человеком</option><option value="deny">Запрет изменений</option></NativeSelect>
|
||||
<Field label="Причина"><Input value={reason} onChange={event => setReason(event.target.value)} /></Field>
|
||||
</div>
|
||||
<Button className="self-start" disabled={!objectId || kind !== "server" && !validProtectionServer} onClick={addProtection}>Добавить защиту</Button>
|
||||
</>}
|
||||
</Panel>
|
||||
</div>
|
||||
}
|
||||
function OperationRecovery({ api }: { api: McpApi }) {
|
||||
const [id, setId] = useState(""), [result, setResult] = useState<unknown>(null), [error, setError] = useState(""), [busy, setBusy] = useState(false)
|
||||
@@ -304,15 +545,29 @@ function Consent({ api, id }: { api: McpApi; id: string }) {
|
||||
}, [])
|
||||
const currentRequest = !request.error && request.data?.id === id ? request.data : null
|
||||
const ownerId = getClaims()?.sub
|
||||
const eligible = connections.error ? [] : connections.data?.connections.filter(connection => connection.ownerId === ownerId && connection.policy.status === "active") ?? []
|
||||
const canSubmit = currentRequest !== null && eligible.some(connection => connection.id === selected)
|
||||
const [now, setNow] = useState(() => Date.now())
|
||||
const active = connections.error ? [] : connections.data?.connections.filter(connection => connection.ownerId === ownerId && connection.policy.status === "active" && connection.generationValid) ?? []
|
||||
const nextExpiry = active.reduce((earliest, connection) => {
|
||||
const deadline = connectionAccessDeadline(connection)
|
||||
return deadline > now ? Math.min(earliest, deadline) : earliest
|
||||
}, Infinity)
|
||||
useEffect(() => {
|
||||
if (!Number.isFinite(nextExpiry)) return
|
||||
const delay = Math.max(0, nextExpiry - Date.now() + 1)
|
||||
const timer = window.setTimeout(() => setNow(Date.now()), Math.min(delay, 60000))
|
||||
return () => window.clearTimeout(timer)
|
||||
}, [nextExpiry, now])
|
||||
const eligible = active.filter(connection => connectionAccessDeadline(connection) > now)
|
||||
const canDeny = currentRequest !== null
|
||||
const canApprove = canDeny && eligible.some(connection => connection.id === selected)
|
||||
const isCurrentLocation = () => mounted.current && new URLSearchParams(window.location.search).get("oauthRequest") === id
|
||||
const confirm = async (approve: boolean) => {
|
||||
if (!canSubmit || submitting.current || !isCurrentLocation()) return
|
||||
if (!(approve ? canApprove : canDeny) || submitting.current || !isCurrentLocation()) return
|
||||
if (approve && !eligible.some(connection => connection.id === selected && connectionAccessDeadline(connection) > Date.now())) return
|
||||
submitting.current = true
|
||||
setBusy(true)
|
||||
try {
|
||||
const result = await api.consent(id, selected, approve)
|
||||
const result = await api.consent(id, approve ? { approve: true, connectionId: selected } : { approve: false })
|
||||
if (isCurrentLocation()) window.location.assign(result.redirectUrl)
|
||||
} catch (error) {
|
||||
if (!mounted.current) return
|
||||
@@ -329,8 +584,8 @@ function Consent({ api, id }: { api: McpApi; id: string }) {
|
||||
{eligible.map(connection => <option key={connection.id} value={connection.id}>{connection.name} · {modeLabels[connection.policy.mode]}</option>)}
|
||||
</NativeSelect>
|
||||
<div className="flex gap-2">
|
||||
<Button disabled={!canSubmit || busy} onClick={() => { void confirm(true) }}>Разрешить</Button>
|
||||
<Button variant="outline" disabled={!canSubmit || busy} onClick={() => { void confirm(false) }}>Отклонить</Button>
|
||||
<Button disabled={!canApprove || busy} onClick={() => { void confirm(true) }}>Разрешить</Button>
|
||||
<Button variant="outline" disabled={!canDeny || busy} onClick={() => { void confirm(false) }}>Отклонить</Button>
|
||||
</div>
|
||||
</Panel>
|
||||
}
|
||||
@@ -346,5 +601,5 @@ function McpWorkspaceContent({ backendUrl, live }: { backendUrl: string; live: b
|
||||
const [operations, setOperations] = useState<McpOperationDescriptor[]>([]), [error, setError] = useState("")
|
||||
useEffect(() => { if (!live) return; const controller = new AbortController(); void api.catalog(controller.signal).then(catalog => setOperations(catalog.operations), failure => { if (!controller.signal.aborted) setError(errorText(failure)) }); return () => controller.abort() }, [api, live])
|
||||
const changeTab = (value: unknown) => { const next = String(value) as Tab; setTab(next); const url = new URL(window.location.href); url.searchParams.set("tab", next); window.history.replaceState(null, "", url.pathname + url.search) }
|
||||
return <><PageHeader crumbs={[{ label: "MCP" }]} /><main className="flex min-w-0 flex-1 flex-col gap-5 p-4 md:p-6"><div className="flex items-center gap-3"><BotIcon className="size-7 text-muted-foreground" /><div><h1 className="text-xl font-semibold">MCP</h1><p className="text-sm text-muted-foreground">Доступ нейросетей, разрешения и контроль изменений</p></div></div>{!live ? <Panel title="Подключите backend"><p>Для выдачи реального AI-доступа выберите режим «Живые» и настройте авторизацию портала.</p></Panel> : <><ErrorMessage message={error} />{oauthRequestId && <Consent key={oauthRequestId} api={api} id={oauthRequestId} />}<Tabs value={tab} onValueChange={changeTab}><div className="overflow-x-auto pb-1"><TabsList variant="line">{Object.entries(tabs).filter(([key]) => key !== "settings" || can("mm:mcp:admin")).map(([key, title]) => <TabsTrigger key={key} value={key}>{title}</TabsTrigger>)}</TabsList></div><TabsContent value="overview"><Overview api={api} /></TabsContent><TabsContent value="connections"><div className="flex flex-col gap-4"><Connections api={api} operations={operations} />{can("mm:mcp:admin") && <AccessTools api={api} />}</div></TabsContent><TabsContent value="permissions"><Permissions api={api} /></TabsContent><TabsContent value="devices"><DeviceManagement api={api} /></TabsContent><TabsContent value="routing"><div className="flex flex-col gap-4"><RoutingProfiles api={api} /><RoutePathVerification api={api} /></div></TabsContent><TabsContent value="requests"><Records api={api} kind="requests" /></TabsContent><TabsContent value="plans"><div className="flex flex-col gap-4"><Records api={api} kind="plans" /><Records api={api} kind="operations" /><OperationRecovery api={api} /><Records api={api} kind="drift" /></div></TabsContent>{can("mm:mcp:admin") && <TabsContent value="settings"><div className="flex flex-col gap-4"><Settings api={api} /><RestCoverage api={api} /><ManagementChannels api={api} />{can("mm:settings:admin") && <DatabaseRestore api={api} />}</div></TabsContent>}</Tabs></>}</main></>
|
||||
return <><PageHeader crumbs={[{ label: "MCP" }]} /><main className="flex min-w-0 flex-1 flex-col gap-5 p-4 md:p-6"><div className="flex items-center gap-3"><BotIcon className="size-7 text-muted-foreground" /><div><h1 className="text-xl font-semibold">MCP</h1><p className="text-sm text-muted-foreground">Доступ нейросетей, разрешения и контроль изменений</p></div></div>{!live ? <Panel title="Подключите backend"><p>Для выдачи реального AI-доступа выберите режим «Живые» и настройте авторизацию портала.</p></Panel> : <><ErrorMessage message={error} />{oauthRequestId && <Consent key={oauthRequestId} api={api} id={oauthRequestId} />}<Tabs value={tab} onValueChange={changeTab}><div className="overflow-x-auto pb-1"><TabsList variant="line">{Object.entries(tabs).filter(([key]) => key !== "settings" || can("mm:mcp:admin")).map(([key, title]) => <TabsTrigger key={key} value={key}>{title}</TabsTrigger>)}</TabsList></div><TabsContent value="overview"><Overview api={api} /></TabsContent><TabsContent value="connections"><div className="flex flex-col gap-4"><Connections api={api} operations={operations} />{can("mm:mcp:admin") && <AccessTools api={api} />}</div></TabsContent><TabsContent value="permissions"><Permissions api={api} operations={operations} /></TabsContent><TabsContent value="devices"><DeviceManagement api={api} /></TabsContent><TabsContent value="routing"><div className="flex flex-col gap-4"><RoutingProfiles api={api} /><RoutePathVerification api={api} /></div></TabsContent><TabsContent value="requests"><Records api={api} kind="requests" /></TabsContent><TabsContent value="plans"><div className="flex flex-col gap-4"><Records api={api} kind="plans" /><Records api={api} kind="operations" /><OperationRecovery api={api} /><Records api={api} kind="drift" /></div></TabsContent>{can("mm:mcp:admin") && <TabsContent value="settings"><div className="flex flex-col gap-4"><Settings api={api} /><RestCoverage api={api} /><ManagementChannels api={api} />{can("mm:settings:admin") && <DatabaseRestore api={api} />}</div></TabsContent>}</Tabs></>}</main></>
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
"use client"
|
||||
|
||||
import { useEffect, useState } from "react"
|
||||
import { mcpObjectRefSchema, type McpConnection, type McpOperationDescriptor, type McpPolicyDecision } from "@mmapp/contracts/mcp"
|
||||
import type { McpApi } from "@/shared/api/mcp"
|
||||
import { Badge } from "@/components/reui/badge"
|
||||
import { Button } from "@/components/ui/button"
|
||||
import { Input } from "@/components/ui/input"
|
||||
|
||||
type Catalog = Awaited<ReturnType<McpApi["deviceCatalog"]>>
|
||||
type Rows = Awaited<ReturnType<McpApi["deviceRows"]>>
|
||||
export function ObjectPermissionPreview({ api, connection, operations, editable, onProtected }: {
|
||||
api: McpApi; connection: McpConnection; operations: McpOperationDescriptor[]; editable: boolean; onProtected: () => void
|
||||
}) {
|
||||
const [catalog, setCatalog] = useState<Catalog | null>(null), [rows, setRows] = useState<Rows | null>(null)
|
||||
const [server, setServer] = useState(""), [resource, setResource] = useState(""), [nativeId, setNativeId] = useState("")
|
||||
const [operation, setOperation] = useState(""), [offset, setOffset] = useState(0), [protection, setProtection] = useState("human-approval-required"), [reason, setReason] = useState("")
|
||||
const [error, setError] = useState(""), [busy, setBusy] = useState(false), [result, setResult] = useState<McpPolicyDecision | null>(null), [receipt, setReceipt] = useState("")
|
||||
useEffect(() => {
|
||||
const controller = new AbortController()
|
||||
api.deviceCatalog(connection.id, controller.signal).then(value => { if (!controller.signal.aborted) setCatalog(value) }, failure => { if (!controller.signal.aborted) setError(String(failure.message ?? failure)) })
|
||||
return () => controller.abort()
|
||||
}, [api, connection.id])
|
||||
useEffect(() => {
|
||||
if (!server || !resource) return
|
||||
const controller = new AbortController()
|
||||
api.deviceRows(connection.id, server, resource, offset, controller.signal).then(value => { if (!controller.signal.aborted) setRows(value) }, failure => { if (!controller.signal.aborted) setError(String(failure.message ?? failure)) })
|
||||
return () => controller.abort()
|
||||
}, [api, connection.id, server, resource, offset])
|
||||
const reset = () => { setNativeId(""); setRows(null); setResult(null); setReceipt(""); setError("") }
|
||||
const changeServer = (value: string) => { reset(); setServer(value); setOffset(0) }
|
||||
const changeResource = (value: string) => { reset(); setResource(value); setOffset(0) }
|
||||
const availableRows = (rows?.items ?? []).filter(row => typeof row[".id"] === "string" && row[".id"] !== "")
|
||||
const selected = availableRows.find(row => row[".id"] === nativeId)
|
||||
const ready = !!selected && catalog?.servers.some(value => String(value.id) === server) && catalog.resources.some(value => value.id === resource && value.read)
|
||||
const act = async (save: boolean) => {
|
||||
if (!ready) return
|
||||
setBusy(true); setError(""); setResult(null); setReceipt("")
|
||||
try {
|
||||
const object = mcpObjectRefSchema.parse({ kind: resource, id: nativeId, serverId: Number(server) })
|
||||
if (save) { await api.protect({ ...object, protection }, reason); onProtected(); setReceipt(`Защита сохранена: сервер ${server}, ${resource}, ${nativeId}.`) }
|
||||
else {
|
||||
setResult((await api.preview({ connectionId: connection.id, operationId: operation, target: { scope: "servers", serverIds: [Number(server)] }, objects: [object], objectCount: 1 })).result)
|
||||
}
|
||||
} catch (failure) { setError(failure instanceof Error ? failure.message : "Не удалось проверить объект") } finally { setBusy(false) }
|
||||
}
|
||||
const selectClass = "h-9 min-w-0 rounded-md border border-input bg-background px-2 text-sm"
|
||||
return <section aria-label="Проверка объекта устройства" className="flex min-w-0 flex-col gap-4 rounded-md border p-4">
|
||||
<p className="font-medium">Объект устройства</p>
|
||||
<p className="text-sm text-muted-foreground">Выберите объект по данным своего подключения. Проверка гипотетическая: она учитывает выбранный объект и сохранённые защиты. Реальный план дополнительно проверяет зависимости. Выбор объекта не ограничивает токен или временный допуск этим объектом.</p>
|
||||
{error && <p role="alert" className="text-sm text-destructive">{error}</p>}
|
||||
<div className="grid gap-3 sm:grid-cols-2">
|
||||
<label className="flex min-w-0 flex-col gap-1.5 text-sm">Сервер проверяемого объекта<select aria-label="Сервер проверяемого объекта" className={selectClass} disabled={busy || !catalog} value={server} onChange={event => changeServer(event.target.value)}><option value="">Выберите сервер</option>{catalog?.servers.map(value => <option key={value.id} value={value.id}>{value.name} · {value.id}</option>)}</select></label>
|
||||
<label className="flex min-w-0 flex-col gap-1.5 text-sm">Тип проверяемого объекта<select aria-label="Тип проверяемого объекта" className={selectClass} disabled={busy || !catalog} value={resource} onChange={event => changeResource(event.target.value)}><option value="">Выберите тип</option>{catalog?.resources.filter(value => value.read).map(value => <option key={value.id} value={value.id}>{value.title}</option>)}</select></label>
|
||||
<label className="flex min-w-0 flex-col gap-1.5 text-sm">Стабильный ID объекта<select aria-label="Стабильный ID объекта" className={selectClass} disabled={busy || !rows} value={nativeId} onChange={event => { setNativeId(event.target.value); setResult(null); setReceipt("") }}><option value="">{rows && !availableRows.length ? "Нет объектов на странице" : "Выберите объект"}</option>{availableRows.map(row => <option key={String(row[".id"])} value={String(row[".id"])}>{String(row.name ?? row.address ?? row.interface ?? resource)} · {String(row[".id"])}</option>)}</select></label>
|
||||
<label className="flex min-w-0 flex-col gap-1.5 text-sm">Операция над объектом<select aria-label="Операция над объектом" className={selectClass} disabled={busy} value={operation} onChange={event => { setOperation(event.target.value); setResult(null) }}><option value="">Выберите действие</option>{operations.filter(value => value.scope === "servers" && connection.policy.scope.operationIds.includes(value.id)).map(value => <option key={value.id}>{value.id}</option>)}</select></label>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2"><Button variant="outline" disabled={busy || offset === 0} onClick={() => { reset(); setOffset(value => Math.max(0, value - 100)) }}>Предыдущая страница объектов</Button><Button variant="outline" disabled={busy || rows?.nextOffset == null} onClick={() => { const next = rows?.nextOffset; if (next != null) { reset(); setOffset(next) } }}>Следующая страница объектов</Button><Button disabled={!editable || busy || !ready || !operation} onClick={() => { void act(false) }}>Проверить выбранный объект</Button></div>
|
||||
{result && <PolicyPreviewDecision result={result} />}
|
||||
{editable && <><label className="flex flex-col gap-1.5 text-sm">Защита выбранного объекта<select aria-label="Защита выбранного объекта" className={selectClass} disabled={busy} value={protection} onChange={event => setProtection(event.target.value)}><option value="human-approval-required">Подтверждение человеком</option><option value="deny">Запрет изменений</option></select></label><label className="flex flex-col gap-1.5 text-sm">Причина защиты объекта<Input value={reason} disabled={busy} onChange={event => setReason(event.target.value)} /></label><Button className="self-start" disabled={busy || !ready} onClick={() => { void act(true) }}>Защитить выбранный объект</Button></>}
|
||||
{receipt && <p role="status" className="text-sm">{receipt}</p>}
|
||||
</section>
|
||||
}
|
||||
|
||||
export function PolicyPreviewDecision({ result }: { result: McpPolicyDecision }) {
|
||||
return <div role="status" className="flex flex-col gap-3 rounded-md border p-3 text-sm">
|
||||
<Badge variant={result.decision === "allowed" ? "success-light" : result.decision === "denied" ? "destructive-light" : "warning-light"}>{result.decision === "allowed" ? "Разрешено" : result.decision === "denied" ? "Запрещено" : "Нужно подтверждение"}</Badge>
|
||||
{result.reasons.length > 0 && <ul className="list-inside list-disc space-y-1">{result.reasons.map((item, index) => <li key={`${item.code}:${index}`}>{item.message} <span className="text-xs text-muted-foreground">({item.code})</span></li>)}</ul>}
|
||||
<p className="text-xs text-muted-foreground">Лимиты подключения: {result.limits.callsPerMinute} вызовов/мин · {result.limits.concurrentReads} параллельных чтения · {result.limits.mutationsPerHour} изменений/ч · до {result.limits.serversPerPlan} серверов и {result.limits.objectsPerPlan} объектов в плане.</p>
|
||||
</div>
|
||||
}
|
||||
@@ -10,6 +10,10 @@
|
||||
"build": "tsc -p tsconfig.json"
|
||||
},
|
||||
"exports": {
|
||||
"./bridge-vlan": {
|
||||
"types": "./dist/bridge-vlan.d.ts",
|
||||
"default": "./dist/bridge-vlan.js"
|
||||
},
|
||||
"./mcp-routing": {
|
||||
"types": "./dist/mcp-routing.d.ts",
|
||||
"default": "./dist/mcp-routing.js"
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
import { z } from "zod"
|
||||
|
||||
export const bridgeVlanRowIdSchema = z.string().regex(/^\*[0-9a-f]+$/i)
|
||||
export const bridgeVlanInterfaceReferenceSchema = z.object({ resource: z.string().min(1).max(64), id: bridgeVlanRowIdSchema }).strict()
|
||||
export const bridgeVlanIdSchema = z.number().int().min(1).max(4094)
|
||||
export const bridgeVlanFrameTypesSchema = z.enum(["admit-all", "admit-only-vlan-tagged", "admit-only-untagged-and-priority-tagged"])
|
||||
/** Complete desired static state. Omissions never authorize deletion. */
|
||||
export const bridgeVlanDesiredSchema = z.object({
|
||||
filtering: z.boolean(), pvid: bridgeVlanIdSchema,
|
||||
frameTypes: bridgeVlanFrameTypesSchema.optional(), ingressFiltering: z.boolean().optional(),
|
||||
ports: z.array(z.object({ id: bridgeVlanRowIdSchema.optional(), interface: bridgeVlanInterfaceReferenceSchema, pvid: bridgeVlanIdSchema, ingressFiltering: z.boolean(), frameTypes: bridgeVlanFrameTypesSchema, disabled: z.boolean(), comment: z.string().max(1000).optional() }).strict()).max(1024),
|
||||
vlans: z.array(z.object({ id: bridgeVlanRowIdSchema.optional(), vlanIds: z.string().min(1).max(16384), tagged: z.array(bridgeVlanInterfaceReferenceSchema).max(1024), untagged: z.array(bridgeVlanInterfaceReferenceSchema).max(1024), disabled: z.boolean(), comment: z.string().max(1000).optional() }).strict()).max(4094),
|
||||
removePortIds: z.array(bridgeVlanRowIdSchema).max(1024), removeVlanIds: z.array(bridgeVlanRowIdSchema).max(4094),
|
||||
}).strict()
|
||||
export const bridgeVlanConfigurationRequestSchema = z.object({ serverId: z.number().int().positive(), bridgeId: bridgeVlanRowIdSchema, desired: bridgeVlanDesiredSchema }).strict()
|
||||
export type BridgeVlanDesired = z.infer<typeof bridgeVlanDesiredSchema>
|
||||
export type BridgeVlanConfigurationRequest = z.infer<typeof bridgeVlanConfigurationRequestSchema>
|
||||
const rows = z.array(z.record(z.string(), z.unknown()))
|
||||
export const bridgeVlanStateSchema = z.object({
|
||||
bridges: rows, ports: rows, vlans: rows, vlanInterfaces: rows, ipv4Addresses: rows, ipv6Addresses: rows,
|
||||
interfaces: z.array(z.object({ resource: z.string(), id: z.string(), name: z.string(), disabled: z.unknown().optional() }).strict()),
|
||||
}).strict()
|
||||
export type BridgeVlanState = z.infer<typeof bridgeVlanStateSchema>
|
||||
+5
-2
@@ -1,4 +1,5 @@
|
||||
import { z } from "zod"
|
||||
import { bridgeVlanStateSchema, type BridgeVlanDesired } from "@mmapp/contracts/bridge-vlan"
|
||||
import { mcpCatalogResponseSchema, mcpConnectionsSchema, mcpSettingsSchema, mcpPolicyPreviewResponseSchema, mcpPollStorageCapacitySchema, type McpConnectionCreate } from "@mmapp/contracts/mcp"
|
||||
import { requestJson } from "./http-client"
|
||||
import { downloadHumanArtifact } from "./mcp-artifact"
|
||||
@@ -24,6 +25,8 @@ export function mcpApi(base: string) {
|
||||
deviceCatalog: (connectionId: string, signal?: AbortSignal) => get("/devices/catalog?" + new URLSearchParams({ connectionId }), deviceCatalogSchema, signal),
|
||||
deviceRows: (connectionId: string, serverId: string, resource: string, offset = 0, signal?: AbortSignal) => get(`/devices/${encodeURIComponent(serverId)}/${encodeURIComponent(resource)}?` + new URLSearchParams({ connectionId, offset: String(offset) }), z.object({ items: z.array(z.record(z.string(), z.unknown())), total: z.number(), nextOffset: z.number().nullable() }), signal),
|
||||
devicePlan: (connectionId: string, serverId: string, resource: string, action: "create" | "update" | "delete", id: string | undefined, fields: Record<string, unknown>) => send(`/devices/${encodeURIComponent(serverId)}/${encodeURIComponent(resource)}/plan`, { connectionId, action, id, fields }, z.object({ planId: z.string(), state: z.string() })),
|
||||
bridgeVlanState: (connectionId: string, serverId: string, signal?: AbortSignal) => get(`/devices/${encodeURIComponent(serverId)}/bridge-vlan/configuration?` + new URLSearchParams({ connectionId }), z.object({ state: bridgeVlanStateSchema }), signal),
|
||||
bridgeVlanPlan: (connectionId: string, serverId: string, bridgeId: string, desired: BridgeVlanDesired) => send(`/devices/${encodeURIComponent(serverId)}/bridge-vlan/configuration/plan`, { connectionId, bridgeId, desired }, z.object({ planId: z.string(), state: z.string() })),
|
||||
revalidate: (id: string) => send("/connections/" + id + "/revalidate", {}, mcpConnectionsSchema.shape.connections.element),
|
||||
apply: (id: string) => send("/plans/" + id + "/apply", {}, z.object({ id: z.string(), state: z.string() })),
|
||||
profilePlan: (input: unknown) => send("/routing-profiles/plan", input, z.object({ planId: z.string(), state: z.string() })),
|
||||
@@ -36,7 +39,7 @@ export function mcpApi(base: string) {
|
||||
update: (id: string, input: McpConnectionCreate) => send("/connections/" + id, input, mcpConnectionsSchema.shape.connections.element, "PUT"),
|
||||
status: (id: string, status: "active" | "paused" | "revoked") => send(`/connections/${id}/status`, { status }, z.object({ ok: z.literal(true) })),
|
||||
rotate: (id: string) => send(`/connections/${id}/rotate`, {}, z.object({ token: z.string() })),
|
||||
check: (id: string) => send(`/connections/${id}/check`, {}, z.object({ ok: z.boolean(), checks: z.record(z.string(), z.boolean()), checkedAt: z.string(), protocolProbe: z.object({ status: z.enum(["passed", "failed", "skipped"]), elapsedMs: z.number(), reason: z.string().optional(), credentialType: z.literal("temporary-no-operations"), clientCredentialsVerified: z.literal(false) }).optional() })),
|
||||
check: (id: string) => send(`/connections/${id}/check`, {}, z.object({ ok: z.boolean(), checks: z.record(z.string(), z.boolean()), checkedAt: z.string(), protocolProbe: z.object({ status: z.enum(["passed", "failed", "skipped"]), elapsedMs: z.number(), reason: z.string().optional(), credentialType: z.enum(["temporary-no-operations", "temporary-capabilities-read"]), capabilitiesRead: z.enum(["passed", "failed", "skipped"]).optional(), clientCredentialsVerified: z.literal(false) }).optional() })),
|
||||
grants: (id: string, signal?: AbortSignal) => get(`/connections/${id}/grants`, z.object({ grants: z.array(z.object({ id: z.string(), grant: z.record(z.string(), z.unknown()), revoked_at: z.string().nullable() })) }), signal),
|
||||
grant: (id: string, grant: unknown) => send(`/connections/${id}/grants`, grant, z.object({ token: z.string(), expiresAt: z.string() })),
|
||||
revokeGrant: (id: string) => send(`/grants/${id}`, {}, z.object({ ok: z.literal(true) }), "DELETE"),
|
||||
@@ -51,7 +54,7 @@ export function mcpApi(base: string) {
|
||||
createClient: (name: string, redirectUris: string[]) => send("/oauth/clients", { name, redirectUris }, z.object({ clientId: z.string() })),
|
||||
disableClient: (id: string) => send(`/oauth/clients/${id}`, {}, z.object({ ok: z.literal(true) }), "DELETE"),
|
||||
consentRequest: (id: string, signal?: AbortSignal) => get("/oauth/requests/" + id, z.object({ id: z.string(), name: z.string(), redirect_uri: z.string(), scope: z.string() }), signal),
|
||||
consent: (requestId: string, connectionId: string, approve: boolean) => send("/oauth/consent", { requestId, connectionId, approve }, z.object({ redirectUrl: z.string().url() })),
|
||||
consent: (requestId: string, decision: { approve: true; connectionId: string } | { approve: false }) => send("/oauth/consent", { requestId, ...decision }, z.object({ redirectUrl: z.string().url() })),
|
||||
protections: (signal?: AbortSignal) => get("/protections", z.object({ protections: z.array(z.object({ id: z.string(), object_ref: z.object({ kind: z.string(), id: z.string(), serverId: z.number().optional(), protection: z.enum(["deny", "human-approval-required"]) }), reason: z.string() })) }), signal),
|
||||
protect: (object: unknown, reason: string) => send("/protections", { object, reason }, z.object({ id: z.string() })),
|
||||
removeProtection: async (id: string) => requestJson(base, "/api/mcp/protections/" + id, { method: "DELETE" }),
|
||||
|
||||
@@ -0,0 +1,177 @@
|
||||
import { test, expect, type Page, type Route } from "@playwright/test"
|
||||
import { bridgeVlanDesiredSchema } from "../../../packages/contracts/src/bridge-vlan"
|
||||
|
||||
const connectionId = "fa58fa40-4bcb-4616-9316-cb69463b3150"
|
||||
const planId = "6b55ae20-2500-489a-af90-3c7345bf6267"
|
||||
const at = "2026-10-17T00:00:00Z"
|
||||
const connection = { id: connectionId, name: "VLAN editor", ownerId: "ui-admin", policy: { id: connectionId, version: 1, status: "active", mode: "approval", expiresAt: "2099-01-01T00:00:00Z", permissions: ["mm:network:read", "mm:network:write"], scope: { serverIds: [1, 2], operationIds: ["network.bridge-vlan.read", "network.bridge-vlan.configure"], allowGlobal: false }, dangerousPolicy: "approval", autonomousDangerousOperationIds: [], limits: { callsPerMinute: 60, concurrentReads: 4, mutationsPerHour: 10, serversPerPlan: 5, objectsPerPlan: 100 } }, createdAt: at, updatedAt: at, lastUsedAt: null, generationValid: true }
|
||||
function fixture() {
|
||||
return {
|
||||
bridges: [{ ".id": "*1", name: "br-users", pvid: "1", "vlan-filtering": "false", disabled: "false" }, { ".id": "*2", name: "br-other", pvid: "99", "vlan-filtering": "false", disabled: "false" }],
|
||||
interfaces: [{ resource: "bridge", id: "*1", name: "br-users" }, { resource: "bridge", id: "*2", name: "br-other" }, ...[2, 3, 4, 5].map(n => ({ resource: "ethernet", id: `*${n + 1}`, name: `ether${n}`, disabled: "false" })), { resource: "wireguard", id: "*7", name: "wg-l3" }, { resource: "gre", id: "*8", name: "gre-l3" }],
|
||||
ports: [
|
||||
{ ".id": "*10", bridge: "br-users", interface: "ether2", pvid: "10", "ingress-filtering": "true", "frame-types": "admit-all", disabled: "false", comment: "preserve port" },
|
||||
{ ".id": "*11", bridge: "br-users", interface: "ether3", pvid: "1", "ingress-filtering": "true", "frame-types": "admit-only-vlan-tagged", disabled: "false" },
|
||||
{ ".id": "*12", bridge: "br-users", interface: "ether5", dynamic: "true" },
|
||||
],
|
||||
vlans: [
|
||||
{ ".id": "*20", bridge: "br-users", "vlan-ids": "10", tagged: "br-users", untagged: "ether2", disabled: "false", comment: "preserve VLAN" },
|
||||
{ ".id": "*21", bridge: "br-users", "vlan-ids": "30-32", tagged: "br-users,ether3", untagged: "", disabled: "false" },
|
||||
{ ".id": "*22", bridge: "br-users", "vlan-ids": "1", dynamic: "true" },
|
||||
], vlanInterfaces: [], ipv4Addresses: [], ipv6Addresses: [],
|
||||
}
|
||||
}
|
||||
type Calls = { path: string; method: string; body: unknown }[]
|
||||
async function setup(page: Page, stateRoute?: (route: Route, server: string) => Promise<void>) {
|
||||
const calls: Calls = []
|
||||
await page.addInitScript(() => localStorage.setItem("mmapp_token", "header." + btoa(JSON.stringify({ sub: "ui-admin", apps: ["mm"], permissions: ["mm:settings:admin", "mm:servers:read", "mm:network:admin"], exp: 4102444800 })) + ".signature"))
|
||||
await page.route("**/api/**", async route => {
|
||||
const request = route.request(), url = new URL(request.url()), path = url.pathname, method = request.method()
|
||||
calls.push({ path, method, body: method === "POST" ? request.postDataJSON() : null })
|
||||
if (method === "OPTIONS") return route.fulfill({ status: 204 })
|
||||
const json = (body: unknown) => route.fulfill({ json: body })
|
||||
if (path === "/api/auth/config") return json({ required: false })
|
||||
if (path === "/api/mcp/connections") return json({ connections: [connection] })
|
||||
if (path === "/api/mcp/catalog") return json({ stage: "runtime", executionAvailable: true, operations: [] })
|
||||
if (path === "/api/mcp/devices/catalog") return json({ servers: [1, 2].map(id => ({ id, name: `CHR ${id}`, host: `192.0.2.${id}`, enabled: true })), resources: [{ id: "bridge", title: "Bridge", read: true, create: false, update: false, delete: false, fields: [] }] })
|
||||
const state = path.match(/^\/api\/mcp\/devices\/(\d+)\/bridge-vlan\/configuration$/)
|
||||
if (state) {
|
||||
expect(url.searchParams.get("connectionId")).toBe(connectionId)
|
||||
return stateRoute ? stateRoute(route, state[1]) : json({ state: fixture() })
|
||||
}
|
||||
if (path.endsWith("/bridge-vlan/configuration/plan")) return json({ planId, state: "awaiting-approval" })
|
||||
if (/\/devices\/\d+\/bridge$/.test(path)) return json({ items: [], total: 0, nextOffset: null })
|
||||
if (path === "/api/mcp/overview") return json({ connections: 1, calls: 0, errors: 0, approvals: 0, running: 0, enabled: true, observedAt: at })
|
||||
if (path === "/api/mcp/coverage") return json({ version: 1, routes: [] })
|
||||
if (path === "/api/servers") return json([])
|
||||
return json({ items: [], total: 0, nextCursor: null })
|
||||
})
|
||||
return calls
|
||||
}
|
||||
async function open(page: Page) {
|
||||
await page.goto("/mcp?tab=devices")
|
||||
await page.getByLabel("Подключение для управления интерфейсами").selectOption(connectionId)
|
||||
await page.getByLabel("Сервер интерфейсов").selectOption("1")
|
||||
await page.getByLabel("Тип объектов устройства").selectOption("bridge")
|
||||
const editor = page.getByRole("region", { name: "Связанная настройка Bridge VLAN" })
|
||||
await expect(editor.getByLabel("Существующий мост")).toBeEnabled()
|
||||
return editor
|
||||
}
|
||||
|
||||
test("связанный VLAN: полный desired, явные удаления и только подготовка плана", async ({ page }) => {
|
||||
const calls = await setup(page), editor = await open(page)
|
||||
await editor.getByLabel("Существующий мост").selectOption("*1")
|
||||
await expect(editor.getByRole("group", { name: "*10", exact: true })).toBeVisible()
|
||||
await expect(editor.getByText("Динамический порт ether5", { exact: false })).toBeVisible()
|
||||
await expect(editor.getByText("Динамический VLAN 1", { exact: false })).toBeVisible()
|
||||
await expect(editor.getByRole("group", { name: "*12", exact: true })).toHaveCount(0)
|
||||
await editor.getByRole("checkbox", { name: "VLAN filtering", exact: true }).check()
|
||||
await editor.getByLabel("PVID моста", { exact: true }).fill("2")
|
||||
await editor.getByRole("group", { name: "*10", exact: true }).getByLabel("PVID порта").fill("20")
|
||||
await editor.getByRole("group", { name: "*20", exact: true }).getByRole("textbox").fill("20")
|
||||
await editor.getByRole("group", { name: "*11", exact: true }).getByRole("button", { name: "Удалить порт из плана" }).click()
|
||||
await editor.getByRole("group", { name: "*21", exact: true }).getByRole("button", { name: "Удалить запись VLAN из плана" }).click()
|
||||
await editor.getByRole("button", { name: "Добавить порт", exact: true }).click()
|
||||
const newPort = editor.getByRole("group", { name: "Новый порт", exact: true })
|
||||
await expect(newPort.getByRole("option", { name: /wg-l3|gre-l3|br-users/ })).toHaveCount(0)
|
||||
await newPort.getByLabel("Интерфейс порта").selectOption("ethernet/*5")
|
||||
await newPort.getByLabel("Типы кадров").selectOption("admit-only-vlan-tagged")
|
||||
await editor.getByRole("button", { name: "Добавить запись VLAN", exact: true }).click()
|
||||
const newVlan = editor.getByRole("group", { name: "Новая запись VLAN", exact: true })
|
||||
await newVlan.getByRole("textbox").fill("30-32")
|
||||
const tagged = newVlan.getByRole("group", { name: "Tagged, включая CPU-порт моста при необходимости" })
|
||||
await tagged.getByRole("checkbox", { name: "br-users", exact: true }).check()
|
||||
await tagged.getByRole("checkbox", { name: "ether4", exact: true }).check()
|
||||
await expect(editor).toContainText("Явное удаление портов: *11. Записей VLAN: *21")
|
||||
await editor.screenshot({ path: "tmp/mcp-scoped-controller-two-chr-20261105/bridge-vlan-ui-edge.png" })
|
||||
await page.setViewportSize({ width: 390, height: 844 })
|
||||
expect(await editor.evaluate(element => element.scrollWidth <= element.clientWidth)).toBe(true)
|
||||
const bridgeSelect = editor.getByLabel("Существующий мост")
|
||||
expect((await bridgeSelect.boundingBox())!.width).toBeGreaterThanOrEqual(150)
|
||||
const heading = editor.getByRole("heading", { name: "Мост, порты и VLAN", exact: true })
|
||||
await heading.evaluate(element => element.scrollIntoView({ block: "center", behavior: "instant" }))
|
||||
await expect.poll(async () => (await heading.boundingBox())!.y).toBeGreaterThanOrEqual(48)
|
||||
await expect(bridgeSelect).toBeInViewport()
|
||||
await page.screenshot({ path: "tmp/mcp-scoped-controller-two-chr-20261105/bridge-vlan-ui-edge-mobile.png" })
|
||||
await editor.getByRole("button", { name: "Подготовить связанный план VLAN" }).click()
|
||||
await expect(editor.getByRole("status")).toContainText(planId)
|
||||
await expect(editor.getByRole("link", { name: "Открыть планы для проверки и подтверждения" })).toHaveAttribute("href", "/mcp?tab=plans")
|
||||
const posts = calls.filter(call => call.method === "POST")
|
||||
expect(posts).toHaveLength(1)
|
||||
expect(posts[0].path).toBe("/api/mcp/devices/1/bridge-vlan/configuration/plan")
|
||||
const body = posts[0].body as { connectionId: string; bridgeId: string; desired: unknown }
|
||||
expect(body.connectionId).toBe(connectionId); expect(body.bridgeId).toBe("*1")
|
||||
const desired = bridgeVlanDesiredSchema.parse(body.desired)
|
||||
expect(desired).toEqual({ filtering: true, pvid: 2,
|
||||
ports: [{ id: "*10", interface: { resource: "ethernet", id: "*3" }, pvid: 20, ingressFiltering: true, frameTypes: "admit-all", disabled: false, comment: "preserve port" }, { interface: { resource: "ethernet", id: "*5" }, pvid: 1, ingressFiltering: true, frameTypes: "admit-only-vlan-tagged", disabled: false }],
|
||||
vlans: [{ id: "*20", vlanIds: "20", tagged: [{ resource: "bridge", id: "*1" }], untagged: [{ resource: "ethernet", id: "*3" }], disabled: false, comment: "preserve VLAN" }, { vlanIds: "30-32", tagged: [{ resource: "bridge", id: "*1" }, { resource: "ethernet", id: "*5" }], untagged: [], disabled: false }], removePortIds: ["*11"], removeVlanIds: ["*21"],
|
||||
})
|
||||
await editor.getByLabel("PVID моста", { exact: true }).fill("3")
|
||||
await expect(editor.getByRole("status")).toHaveCount(0)
|
||||
expect(calls.filter(call => /\/apply|\/approve|\/bridge\/plan$/.test(call.path))).toHaveLength(0)
|
||||
})
|
||||
|
||||
test("связанный VLAN: смена моста и перечитывание сбрасывают только черновик", async ({ page }) => {
|
||||
const calls = await setup(page), editor = await open(page)
|
||||
await editor.getByLabel("Существующий мост").selectOption("*1")
|
||||
await editor.getByLabel("PVID моста", { exact: true }).fill("40")
|
||||
await editor.getByRole("group", { name: "*11", exact: true }).getByRole("button", { name: "Удалить порт из плана" }).click()
|
||||
await editor.getByLabel("Существующий мост").selectOption("*2")
|
||||
await expect(editor.getByLabel("PVID моста", { exact: true })).toHaveValue("99")
|
||||
await expect(editor.getByRole("group", { name: "*10", exact: true })).toHaveCount(0)
|
||||
await expect(editor.getByText("Явное удаление портов:", { exact: false })).toHaveCount(0)
|
||||
await editor.getByLabel("Существующий мост").selectOption("*1")
|
||||
await expect(editor.getByLabel("PVID моста", { exact: true })).toHaveValue("1")
|
||||
await expect(editor.getByRole("group", { name: "*11", exact: true })).toBeVisible()
|
||||
const reads = () => calls.filter(call => call.path.endsWith("/bridge-vlan/configuration")).length
|
||||
const before = reads()
|
||||
await editor.getByLabel("PVID моста", { exact: true }).fill("40")
|
||||
await editor.getByRole("button", { name: "Перечитать и сбросить черновик" }).click()
|
||||
await expect.poll(reads).toBe(before + 1)
|
||||
await expect(editor.getByLabel("PVID моста", { exact: true })).toHaveValue("1")
|
||||
expect(calls.filter(call => call.method === "POST")).toHaveLength(0)
|
||||
})
|
||||
|
||||
test("связанный VLAN: недостоверное состояние и отказ scope видны без отправки плана", async ({ page }) => {
|
||||
const calls = await setup(page, async (route, server) => {
|
||||
if (server === "2") return route.fulfill({ status: 403, json: { error: "Сервер вне scope подключения" } })
|
||||
const state = fixture(); delete (state.bridges[0] as Record<string, unknown>)["vlan-filtering"]
|
||||
await route.fulfill({ json: { state } })
|
||||
})
|
||||
const editor = await open(page)
|
||||
await editor.getByLabel("Существующий мост").selectOption("*1")
|
||||
await expect(editor.getByRole("alert")).toContainText("Не подтверждено поле vlan-filtering")
|
||||
await expect(editor.getByRole("button", { name: "Подготовить связанный план VLAN" })).toHaveCount(0)
|
||||
await page.getByLabel("Сервер интерфейсов").selectOption("2")
|
||||
await expect(editor.getByRole("alert")).toContainText("Сервер вне scope подключения")
|
||||
await expect(editor.getByLabel("Существующий мост")).toBeDisabled()
|
||||
expect(calls.filter(call => call.method === "POST")).toHaveLength(0)
|
||||
})
|
||||
|
||||
test("связанный VLAN: отменённый ответ прежнего сервера не заменяет новый снимок", async ({ page }) => {
|
||||
let release!: () => void, started!: () => void, finished!: () => void
|
||||
const pending = new Promise<void>(resolve => { release = resolve })
|
||||
const requested = new Promise<void>(resolve => { started = resolve })
|
||||
const settled = new Promise<void>(resolve => { finished = resolve })
|
||||
await setup(page, async (route, server) => {
|
||||
const state = fixture()
|
||||
if (server === "1") {
|
||||
started(); await pending
|
||||
state.bridges[0].name = "late-old-bridge"
|
||||
try { await route.fulfill({ json: { state } }) } catch { /* Aborted by scope change. */ } finally { finished() }
|
||||
} else await route.fulfill({ json: { state } })
|
||||
})
|
||||
await page.goto("/mcp?tab=devices")
|
||||
await page.getByLabel("Подключение для управления интерфейсами").selectOption(connectionId)
|
||||
await page.getByLabel("Сервер интерфейсов").selectOption("1")
|
||||
await page.getByLabel("Тип объектов устройства").selectOption("bridge")
|
||||
await requested
|
||||
await page.getByLabel("Сервер интерфейсов").selectOption("2")
|
||||
const editor = page.getByRole("region", { name: "Связанная настройка Bridge VLAN" })
|
||||
await expect(editor.getByLabel("Существующий мост")).toBeEnabled()
|
||||
await editor.getByLabel("Существующий мост").selectOption("*1")
|
||||
await editor.getByLabel("PVID моста", { exact: true }).fill("70")
|
||||
release(); await settled
|
||||
await expect(editor.getByLabel("PVID моста", { exact: true })).toHaveValue("70")
|
||||
await expect(editor.getByRole("option", { name: "late-old-bridge", exact: false })).toHaveCount(0)
|
||||
})
|
||||
@@ -0,0 +1,111 @@
|
||||
import { test, expect } from "@playwright/test"
|
||||
import sdkPlan from "../sdk-public-plan.fixture.json"
|
||||
|
||||
// Exact public SDK plan from tmp/mcp-bridge-vlan-sdk-20261105/result.json.
|
||||
// The records endpoint uses publicPlan(): planId becomes id and row metadata is
|
||||
// added; changes, their sequence, warnings, snapshots and expiry stay untouched.
|
||||
// This is a browser/mock-API acceptance check, not native RouterOS forwarding.
|
||||
const connectionId = "fa58fa40-4bcb-4616-9316-cb69463b3150"
|
||||
const operationId = "690212c5-6e20-423e-b0d9-9791aeb8dbe7"
|
||||
const action = "network.bridge-vlan.configure"
|
||||
|
||||
for (const outcome of ["applied", "unknown"] as const) {
|
||||
test(`linked VLAN: exact SDK review, human approval, apply and ${outcome} operation`, async ({ page }, testInfo) => {
|
||||
await page.clock.setFixedTime(new Date("2026-11-05T10:42:00.000Z"))
|
||||
const posts: { path: string; body: unknown }[] = []
|
||||
const unexpected: string[] = []
|
||||
let state = sdkPlan.state, applied = false
|
||||
const record = () => ({ id: sdkPlan.planId, connectionId, operationId: action,
|
||||
state, expiresAt: sdkPlan.expiresAt, createdAt: "2026-11-05T10:41:31.883Z",
|
||||
approvedBy: state === "awaiting-approval" ? null : "human-reviewer",
|
||||
changes: sdkPlan.changes })
|
||||
// Operations list returns the redacted SQL row, not mm_operation_get's steps.
|
||||
const result = { id: operationId, plan_id: sdkPlan.planId, connection_id: connectionId,
|
||||
state: outcome, verification: outcome === "applied" ? "passed" : "inconclusive",
|
||||
error_code: outcome === "applied" ? null : "RESULT_UNKNOWN",
|
||||
result: outcome === "applied" ? { confirmedWrites: 3, verificationScope: "configuration" } : { confirmedWrites: 0, needsReview: true },
|
||||
created_at: "2026-11-05T10:42:00.000Z", finished_at: "2026-11-05T10:42:01.000Z",
|
||||
artifactReceipts: [] }
|
||||
await page.route("**/api/**", async route => {
|
||||
const request = route.request(), path = new URL(request.url()).pathname
|
||||
const json = (body: unknown) => route.fulfill({ json: body })
|
||||
if (request.method() === "POST") {
|
||||
posts.push({ path, body: request.postDataJSON() })
|
||||
if (path === `/api/mcp/plans/${sdkPlan.planId}/decision`) {
|
||||
expect(state).toBe("awaiting-approval")
|
||||
expect(request.postDataJSON()).toEqual({ approve: true })
|
||||
state = "approved"
|
||||
return json({ ok: true })
|
||||
}
|
||||
if (path === `/api/mcp/plans/${sdkPlan.planId}/apply`) {
|
||||
expect(state).toBe("approved")
|
||||
expect(request.postDataJSON()).toEqual({})
|
||||
expect(applied).toBe(false)
|
||||
applied = true; state = "completed"
|
||||
return json({ id: operationId, state: "pending" })
|
||||
}
|
||||
unexpected.push(`${request.method()} ${path}`)
|
||||
return route.fulfill({ status: 400, json: { error: "Unexpected mutation" } })
|
||||
}
|
||||
if (path === "/api/auth/config") return json({ required: false })
|
||||
if (path === "/api/mcp/catalog") return json({ stage: "runtime", executionAvailable: true, operations: [] })
|
||||
if (path === "/api/mcp/plans") return json({ items: [record()], total: 1, nextCursor: null })
|
||||
if (path === "/api/mcp/operations") return json({ items: applied ? [result] : [], total: applied ? 1 : 0, nextCursor: null })
|
||||
if (path === "/api/mcp/connections") return json({ connections: [] })
|
||||
if (path === "/api/servers") return json([])
|
||||
if (path.startsWith("/api/mcp/")) return json({ items: [], total: 0, nextCursor: null })
|
||||
return json({})
|
||||
})
|
||||
await page.goto("/mcp?tab=plans")
|
||||
const plans = page.locator("[data-slot=frame]").filter({ has: page.getByText("Планы изменений", { exact: true }) })
|
||||
const operations = page.locator("[data-slot=frame]").filter({ has: page.getByText("Выполнение операций", { exact: true }) })
|
||||
await plans.getByRole("button", { name: "Открыть", exact: true }).click()
|
||||
const dialog = page.getByRole("dialog", { name: "Детали плана" })
|
||||
await expect(dialog.getByText("Шагов: 3", { exact: true })).toBeVisible()
|
||||
await expect(dialog.getByText("Серверы: 1", { exact: true })).toBeVisible()
|
||||
await expect(dialog.getByText("Сервер 1 · ipv4_address · *20", { exact: true })).toBeVisible()
|
||||
for (const warning of sdkPlan.changes.warnings) await expect(dialog.getByText(warning, { exact: true })).toBeVisible()
|
||||
const steps = dialog.locator("ol > li")
|
||||
await expect(steps).toHaveCount(3)
|
||||
for (const [index, value] of sdkPlan.changes.steps.entries()) {
|
||||
await expect(steps.nth(index).locator("p")).toHaveText(`${index + 1}. ${value.step.action} · ${value.step.resource}`)
|
||||
expect(JSON.parse(await steps.nth(index).locator("pre").innerText())).toEqual(value.step)
|
||||
}
|
||||
const snapshots = dialog.getByRole("heading", { name: "Исходное состояние", exact: true }).locator("..").locator("pre")
|
||||
expect(JSON.parse(await snapshots.innerText())).toEqual(sdkPlan.changes.snapshots)
|
||||
await dialog.getByText("Полные данные плана", { exact: true }).click()
|
||||
expect(JSON.parse(await dialog.locator("details pre").innerText())).toEqual(record())
|
||||
expect(posts).toEqual([])
|
||||
await expect(dialog.getByRole("button", { name: "Применить план", exact: true })).toHaveCount(0)
|
||||
await dialog.screenshot({ path: testInfo.outputPath("linked-vlan-review.png") })
|
||||
await dialog.getByRole("button", { name: "Подтвердить план", exact: true }).click()
|
||||
await expect(dialog).not.toBeVisible()
|
||||
await expect(plans.getByText("approved", { exact: true })).toBeVisible()
|
||||
expect(posts).toEqual([{ path: `/api/mcp/plans/${sdkPlan.planId}/decision`, body: { approve: true } }])
|
||||
await plans.getByRole("button", { name: "Открыть", exact: true }).click()
|
||||
await expect(dialog.getByRole("button", { name: "Подтвердить план", exact: true })).toHaveCount(0)
|
||||
await expect(dialog.getByText("approved", { exact: true })).toBeVisible()
|
||||
await dialog.getByText("Полные данные плана", { exact: true }).click()
|
||||
expect(JSON.parse(await dialog.locator("details pre").innerText())).toEqual(record())
|
||||
const applyResponse = page.waitForResponse(response => response.request().method() === "POST" && new URL(response.url()).pathname === `/api/mcp/plans/${sdkPlan.planId}/apply`)
|
||||
await dialog.getByRole("button", { name: "Применить план", exact: true }).click()
|
||||
expect(await (await applyResponse).json()).toEqual({ id: operationId, state: "pending" })
|
||||
await expect(dialog).not.toBeVisible()
|
||||
await expect(plans.getByText("completed", { exact: true })).toBeVisible()
|
||||
await expect(operations.getByText(outcome, { exact: true })).toBeVisible()
|
||||
expect(posts).toEqual([
|
||||
{ path: `/api/mcp/plans/${sdkPlan.planId}/decision`, body: { approve: true } },
|
||||
{ path: `/api/mcp/plans/${sdkPlan.planId}/apply`, body: {} },
|
||||
])
|
||||
await operations.getByRole("button", { name: "Открыть", exact: true }).click()
|
||||
const operationDialog = page.getByRole("dialog", { name: "Детали операции" })
|
||||
expect(JSON.parse(await operationDialog.locator("pre").innerText())).toEqual(result)
|
||||
await operationDialog.screenshot({ path: testInfo.outputPath(`linked-vlan-operation-${outcome}.png`) })
|
||||
await page.keyboard.press("Escape")
|
||||
await operations.getByRole("button", { name: "Обновить", exact: true }).click()
|
||||
await expect(operations.getByText(outcome, { exact: true })).toBeVisible()
|
||||
expect(posts).toHaveLength(2)
|
||||
expect(unexpected).toEqual([])
|
||||
await testInfo.attach("mock-api-evidence", { body: JSON.stringify({ source: "external SDK public plan, synthetic router", planId: sdkPlan.planId, requestSequence: posts, operation: result, nativeForwardingVerified: false }, null, 2), contentType: "application/json" })
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,261 @@
|
||||
{
|
||||
"planId": "55205b80-071d-4037-b035-0136a1d02abe",
|
||||
"expiresAt": "2026-11-05T10:56:31.883Z",
|
||||
"state": "awaiting-approval",
|
||||
"decision": {
|
||||
"decision": "approval-required",
|
||||
"reasons": [
|
||||
{
|
||||
"code": "APPROVAL_REQUIRED",
|
||||
"message": "Защищённый объект требует подтверждения человеком"
|
||||
},
|
||||
{
|
||||
"code": "APPROVAL_REQUIRED",
|
||||
"message": "Опасная операция не разрешена для автономного выполнения"
|
||||
}
|
||||
],
|
||||
"limits": {
|
||||
"callsPerMinute": 120,
|
||||
"concurrentReads": 4,
|
||||
"mutationsPerHour": 100,
|
||||
"serversPerPlan": 5,
|
||||
"objectsPerPlan": 100
|
||||
}
|
||||
},
|
||||
"changes": {
|
||||
"target": {
|
||||
"scope": "servers",
|
||||
"serverIds": [
|
||||
1
|
||||
]
|
||||
},
|
||||
"objects": [
|
||||
{
|
||||
"kind": "bridge",
|
||||
"id": "*1",
|
||||
"serverId": 1
|
||||
},
|
||||
{
|
||||
"kind": "bridge_port",
|
||||
"id": "*10",
|
||||
"serverId": 1
|
||||
},
|
||||
{
|
||||
"kind": "bridge_vlan",
|
||||
"id": "*11",
|
||||
"serverId": 1
|
||||
},
|
||||
{
|
||||
"kind": "ethernet",
|
||||
"id": "*2",
|
||||
"serverId": 1
|
||||
},
|
||||
{
|
||||
"kind": "ethernet",
|
||||
"id": "*3",
|
||||
"serverId": 1
|
||||
},
|
||||
{
|
||||
"kind": "ipv4_address",
|
||||
"id": "*20",
|
||||
"serverId": 1
|
||||
},
|
||||
{
|
||||
"kind": "ethernet",
|
||||
"id": "*4",
|
||||
"serverId": 1
|
||||
}
|
||||
],
|
||||
"snapshots": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "ethernet",
|
||||
"rows": [
|
||||
{
|
||||
".id": "*2",
|
||||
"name": "ether2",
|
||||
"disabled": "false"
|
||||
},
|
||||
{
|
||||
".id": "*3",
|
||||
"name": "ether3",
|
||||
"disabled": "false"
|
||||
},
|
||||
{
|
||||
".id": "*4",
|
||||
"name": "ether-mgmt",
|
||||
"disabled": "false"
|
||||
}
|
||||
],
|
||||
"fingerprint": "08c56d03417d39672c01875e949f888bff078a2a3c3219d10462372aff685fae",
|
||||
"projectionVersion": 3,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "bridge",
|
||||
"rows": [
|
||||
{
|
||||
".id": "*1",
|
||||
"name": "br-users",
|
||||
"pvid": "1",
|
||||
"vlan-filtering": "false",
|
||||
"frame-types": "admit-all",
|
||||
"ingress-filtering": "true",
|
||||
"mvrp": "false",
|
||||
"disabled": "false"
|
||||
}
|
||||
],
|
||||
"fingerprint": "b6cd139e68a4025879f73982c03458a0f3c1ef7b7a662f87b8421317b86ab5d6",
|
||||
"projectionVersion": 4,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "vlan",
|
||||
"rows": [],
|
||||
"fingerprint": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
|
||||
"projectionVersion": 3,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "gre",
|
||||
"rows": [],
|
||||
"fingerprint": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
|
||||
"projectionVersion": 3,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "wireguard",
|
||||
"rows": [],
|
||||
"fingerprint": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
|
||||
"projectionVersion": 3,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "vxlan",
|
||||
"rows": [],
|
||||
"fingerprint": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
|
||||
"projectionVersion": 3,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "bridge_port",
|
||||
"rows": [
|
||||
{
|
||||
".id": "*10",
|
||||
"bridge": "br-users",
|
||||
"interface": "ether2",
|
||||
"pvid": "10",
|
||||
"ingress-filtering": "true",
|
||||
"frame-types": "admit-all",
|
||||
"disabled": "false",
|
||||
"comment": ""
|
||||
}
|
||||
],
|
||||
"fingerprint": "c7e426b6e866bb95030738fef6a244ba1f4ea51bef1b465adb7bb0b524fcae80",
|
||||
"projectionVersion": 4,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "bridge_vlan",
|
||||
"rows": [
|
||||
{
|
||||
".id": "*11",
|
||||
"bridge": "br-users",
|
||||
"vlan-ids": "10",
|
||||
"tagged": "br-users",
|
||||
"untagged": "ether2",
|
||||
"disabled": "false",
|
||||
"dynamic": "false",
|
||||
"comment": ""
|
||||
}
|
||||
],
|
||||
"fingerprint": "fec705be87dbc8a3dab3aeb74b0127007d55759eea7dd2b4fc8ecc7f4757b5f6",
|
||||
"projectionVersion": 4,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "ipv4_address",
|
||||
"rows": [
|
||||
{
|
||||
".id": "*20",
|
||||
"interface": "ether-mgmt",
|
||||
"address": "127.0.0.1/8",
|
||||
"disabled": "false",
|
||||
"dynamic": "false"
|
||||
}
|
||||
],
|
||||
"fingerprint": "f9c4d5c98f751e7cb3fd9663f57c7731d92a53c096e51a90fd63ed29e314964b",
|
||||
"projectionVersion": 3,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
},
|
||||
{
|
||||
"serverId": 1,
|
||||
"resource": "ipv6_address",
|
||||
"rows": [],
|
||||
"fingerprint": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
|
||||
"projectionVersion": 3,
|
||||
"sourceProof": "e0718c0c34d3799be2f02d129907b9043d4d7de70b24c88a6c65161726befe38"
|
||||
}
|
||||
],
|
||||
"steps": [
|
||||
{
|
||||
"kind": "ros",
|
||||
"step": {
|
||||
"serverId": 1,
|
||||
"resource": "bridge_vlan",
|
||||
"action": "create",
|
||||
"fields": {
|
||||
"bridge": "br-users",
|
||||
"vlan-ids": "20",
|
||||
"tagged": "br-users,ether3",
|
||||
"disabled": "false"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "ros",
|
||||
"step": {
|
||||
"serverId": 1,
|
||||
"resource": "bridge_port",
|
||||
"action": "create",
|
||||
"fields": {
|
||||
"bridge": "br-users",
|
||||
"interface": "ether3",
|
||||
"pvid": "1",
|
||||
"ingress-filtering": "true",
|
||||
"frame-types": "admit-only-vlan-tagged",
|
||||
"disabled": "false"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "ros",
|
||||
"step": {
|
||||
"serverId": 1,
|
||||
"resource": "bridge",
|
||||
"action": "update",
|
||||
"id": "*1",
|
||||
"fields": {
|
||||
"vlan-filtering": "true"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"requiresHuman": true,
|
||||
"validUntil": "2026-11-05T11:11:31.385Z",
|
||||
"warnings": [
|
||||
"Связанный план изменяет VLAN memberships и PVID в указанном порядке; включение filtering выполняется последним.",
|
||||
"Каждая подтверждённая запись проверяется до следующей. При неизвестном результате дальнейшие записи останавливаются.",
|
||||
"Используется основной адрес управления; независимость канала не подтверждена. Обязательно подтверждение человеком; каждый префикс плана сохраняет подтверждённый management-доступ."
|
||||
]
|
||||
},
|
||||
"executionAvailable": true
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
// The auth scenarios check access controls, so their Next server can render
|
||||
// with local fonts without reaching Google Fonts during compilation.
|
||||
module.exports = {
|
||||
'https://fonts.googleapis.com/css2?family=Geist:wght@100..900&display=swap':
|
||||
"@font-face { font-family: 'Geist'; font-style: normal; font-weight: 100 900; src: local('Arial'); }",
|
||||
'https://fonts.googleapis.com/css2?family=Geist+Mono:wght@100..900&display=swap':
|
||||
"@font-face { font-family: 'Geist Mono'; font-style: normal; font-weight: 100 900; src: local('Consolas'); }",
|
||||
}
|
||||
@@ -6,10 +6,15 @@ const id = 'fa58fa40-4bcb-4616-9316-cb69463b3150'
|
||||
const at = '2026-10-29T00:00:00Z'
|
||||
const read = { id: 'logs.query', toolName: 'mm_logs_query', title: 'Поиск логов', section: 'logs', version: 1, effect: 'read', risk: 'ordinary', scope: 'servers', requiredPermissions: ['mm:servers:read'], implementation: 'available', annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true } }
|
||||
const forbidden = { ...read, id: 'users.delete', title: 'Запрещённая операция каталога', requiredPermissions: ['mm:users:admin'], effect: 'write' }
|
||||
async function setup(page: Page, permissions: string[]) {
|
||||
async function setup(page: Page, permissions: string[], access: { expiresAt?: string; ownerValidUntil?: string; status?: string; generationValid?: boolean } = {}) {
|
||||
await page.addInitScript(permissions => { localStorage.setItem('mmapp_token', 'header.' + btoa(JSON.stringify({ sub: 'synthetic-owner', apps: ['mm'], permissions, exp: 4102444800 })) + '.signature') }, permissions)
|
||||
const connection = { id, name: 'Синтетический AI клиент', ownerId: 'synthetic-owner', policy: { id, version: 1, status: 'active', mode: 'observer', expiresAt: '2099-01-01T00:00:00Z', permissions: ['mm:servers:read'], scope: { serverIds: [1], operationIds: ['logs.query'], allowGlobal: false }, dangerousPolicy: 'approval', autonomousDangerousOperationIds: [], limits: { callsPerMinute: 60, concurrentReads: 4, mutationsPerHour: 10, serversPerPlan: 5, objectsPerPlan: 100 } }, createdAt: at, updatedAt: at, lastUsedAt: null, generationValid: true }
|
||||
const mutations: { path: string, body: Record<string, unknown> }[] = []
|
||||
connection.policy.expiresAt = access.expiresAt ?? connection.policy.expiresAt
|
||||
connection.policy.status = access.status ?? connection.policy.status
|
||||
connection.generationValid = access.generationValid ?? connection.generationValid
|
||||
const ownerValidUntil = access.ownerValidUntil ?? '2099-01-01T00:00:00Z'
|
||||
let connectionReads = 0
|
||||
let enabled = true
|
||||
await page.route('**/api/**', async route => {
|
||||
const request = route.request(), path = new URL(request.url()).pathname, method = request.method()
|
||||
@@ -20,7 +25,7 @@ async function setup(page: Page, permissions: string[]) {
|
||||
if (path === '/api/auth/config') return json({ required: true })
|
||||
if (path === '/api/mcp/catalog') return json({ stage: 'runtime', executionAvailable: true, operations: [read, forbidden] })
|
||||
if (path === '/api/mcp/overview') return json({ connections: 1, calls: 3, errors: 1, approvals: 0, running: 0, enabled, observedAt: at })
|
||||
if (path === '/api/mcp/connections') return json(method === 'POST' ? { connection, token: 'synthetic-one-time-token' } : { connections: [connection] })
|
||||
if (path === '/api/mcp/connections') { connectionReads++; const visible = { ...connection, ownerValidUntil }; return json(method === 'POST' ? { connection: visible, token: 'synthetic-one-time-token' } : { connections: [visible] }) }
|
||||
if (path === `/api/mcp/connections/${id}/status`) { connection.policy.status = request.postDataJSON().status; return json({ ok: true }) }
|
||||
if (path === '/api/mcp/stop-automation') { enabled = false; return json({ ok: true }) }
|
||||
if (path === '/api/mcp/requests') return json({ items: [{ id: 'synthetic-call', tool: 'mm_logs_query', created_at: at, connection_id: id, status: connection.policy.status === 'active' ? 'completed' : 'denied', error_code: connection.policy.status === 'active' ? null : `connection_${connection.policy.status}`, detail: 'synthetic fixture outcome' }], total: 1, nextCursor: null })
|
||||
@@ -28,9 +33,51 @@ async function setup(page: Page, permissions: string[]) {
|
||||
if (path === '/api/servers') return json([])
|
||||
return json({ items: [], total: 0, nextCursor: null })
|
||||
})
|
||||
return { mutations }
|
||||
return { mutations, get connectionReads() { return connectionReads } }
|
||||
}
|
||||
|
||||
for (const [access, label, reason] of [
|
||||
[{ expiresAt: '2000-01-01T00:00:00Z' }, 'Срок доступа истёк', 'Продлите срок в разрешениях подключения'],
|
||||
[{ ownerValidUntil: '2000-01-01T00:00:00Z' }, 'Права владельца истекли', 'Владельцу нужно подтвердить актуальные права'],
|
||||
[{ status: 'paused' }, 'На паузе', 'Новые вызовы подключения остановлены'],
|
||||
[{ status: 'revoked' }, 'Доступ отозван', 'Подключение и его токены отозваны'],
|
||||
[{ generationValid: false }, 'Доступ аннулирован', 'Поколение доступа больше не действительно'],
|
||||
] as const) test(`synthetic: connection state explains ${label}`, async ({ page }, testInfo) => {
|
||||
await setup(page, ['mm:mcp:read'], access)
|
||||
await page.goto('/mcp?tab=connections')
|
||||
const row = page.getByRole('row').filter({ hasText: 'Синтетический AI клиент' })
|
||||
await expect(row.getByText(label, { exact: true })).toBeVisible()
|
||||
await expect(row.getByText(reason, { exact: true })).toBeVisible()
|
||||
await expect(row.getByText('Активен', { exact: true })).toHaveCount(0)
|
||||
await expect(page.getByRole('columnheader', { name: 'Доступ до', exact: true })).toBeVisible()
|
||||
await expect(page.getByRole('columnheader', { name: 'Права владельца до', exact: true })).toBeVisible()
|
||||
if (label === 'Срок доступа истёк') {
|
||||
await row.screenshot({ path: testInfo.outputPath('connection-expired-desktop.png') })
|
||||
await page.setViewportSize({ width: 390, height: 844 })
|
||||
await row.getByText(label, { exact: true }).scrollIntoViewIfNeeded()
|
||||
expect(await page.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth + 1)).toBe(true)
|
||||
await page.screenshot({ path: testInfo.outputPath('connection-expired-mobile.png') })
|
||||
}
|
||||
})
|
||||
|
||||
for (const field of ['expiresAt', 'ownerValidUntil'] as const) test(`synthetic: connection clock crosses ${field} without another API response`, async ({ page }) => {
|
||||
const start = new Date('2030-01-01T00:00:00Z')
|
||||
await page.clock.install({ time: start })
|
||||
const state = await setup(page, ['mm:mcp:read'], { [field]: '2030-01-01T01:00:02Z' })
|
||||
await page.goto('/mcp?tab=connections')
|
||||
const row = page.getByRole('row').filter({ hasText: 'Синтетический AI клиент' })
|
||||
await expect(row.getByText('Активен', { exact: true })).toBeVisible()
|
||||
await page.clock.pauseAt(new Date('2030-01-01T01:00:00Z'))
|
||||
// Ignore any catch-up polling from pauseAt; the crossing below is <5 seconds.
|
||||
await page.waitForLoadState('networkidle')
|
||||
const reads = state.connectionReads
|
||||
await page.clock.runFor(2100)
|
||||
await expect(row.getByText(field === 'expiresAt' ? 'Срок доступа истёк' : 'Права владельца истекли', { exact: true })).toBeVisible()
|
||||
await expect(row.getByText('Активен', { exact: true })).toHaveCount(0)
|
||||
expect(state.connectionReads).toBe(reads)
|
||||
expect(state.mutations).toEqual([])
|
||||
})
|
||||
|
||||
test('synthetic: bind OAuth consent to the displayed request and submit only once', async ({ page }) => {
|
||||
await setup(page, ['mm:mcp:read'])
|
||||
const firstId = 'fa58fa40-4bcb-4616-9316-cb69463b3151'
|
||||
@@ -90,6 +137,56 @@ test('synthetic: bind OAuth consent to the displayed request and submit only onc
|
||||
expect(decisions).toHaveLength(1)
|
||||
})
|
||||
|
||||
test('synthetic: deny OAuth consent without an available connection', async ({ page, baseURL }) => {
|
||||
await setup(page, ['mm:mcp:read'])
|
||||
const requestId = 'fa58fa40-4bcb-4616-9316-cb69463b3151'
|
||||
const callback = new URL('/local-oauth-callback', baseURL!)
|
||||
const response = { id: requestId, name: 'OAuth without connection', redirect_uri: callback.href, scope: 'mcp' }
|
||||
callback.searchParams.set('error', 'access_denied')
|
||||
const headers = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET,POST,OPTIONS', 'access-control-allow-headers': 'Authorization,Content-Type' }
|
||||
await page.route('**/api/mcp/connections', route => route.fulfill({ headers, json: { connections: [] } }))
|
||||
await page.route(`**/api/mcp/oauth/requests/${requestId}`, route => route.fulfill({ headers, json: response }))
|
||||
const decisions: unknown[] = []
|
||||
await page.route('**/api/mcp/oauth/consent', async route => {
|
||||
if (route.request().method() === 'OPTIONS') return route.fulfill({ status: 204, headers })
|
||||
decisions.push(route.request().postDataJSON())
|
||||
await route.fulfill({ headers, json: { redirectUrl: callback.href } })
|
||||
})
|
||||
await page.route(callback.href, route => route.fulfill({ body: 'OAuth request declined' }))
|
||||
|
||||
await page.goto('/mcp?oauthRequest=' + requestId)
|
||||
await expect(page.getByText('OAuth without connection запрашивает доступ к MikrotikManager.')).toBeVisible()
|
||||
await expect(page.getByLabel('Подключение', { exact: true }).locator('option')).toHaveCount(1)
|
||||
await expect(page.getByRole('button', { name: 'Разрешить', exact: true })).toBeDisabled()
|
||||
await page.getByRole('button', { name: 'Отклонить', exact: true }).click()
|
||||
await expect(page).toHaveURL(callback.href)
|
||||
expect(decisions).toEqual([{ requestId, approve: false }])
|
||||
})
|
||||
|
||||
test('synthetic: OAuth approval becomes unavailable when the selected connection expires', async ({ page }) => {
|
||||
const start = new Date('2030-01-01T00:00:00Z')
|
||||
await page.clock.install({ time: start })
|
||||
await page.clock.pauseAt(new Date('2030-01-01T00:00:01Z'))
|
||||
const state = await setup(page, ['mm:mcp:read'], { expiresAt: '2030-01-01T00:00:03Z' })
|
||||
const requestId = 'fa58fa40-4bcb-4616-9316-cb69463b3151'
|
||||
const headers = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET,OPTIONS', 'access-control-allow-headers': 'Authorization,Content-Type' }
|
||||
await page.route(`**/api/mcp/oauth/requests/${requestId}`, route => route.request().method() === 'OPTIONS'
|
||||
? route.fulfill({ status: 204, headers })
|
||||
: route.fulfill({ headers, json: { id: requestId, name: 'OAuth expiry', redirect_uri: 'https://a.example.test/callback', scope: 'mcp' } }))
|
||||
await page.goto('/mcp?oauthRequest=' + requestId)
|
||||
const connection = page.getByLabel('Подключение', { exact: true })
|
||||
const approve = page.getByRole('button', { name: 'Разрешить', exact: true })
|
||||
await connection.selectOption(id)
|
||||
await expect(approve).toBeEnabled()
|
||||
const reads = state.connectionReads
|
||||
await page.clock.runFor(2100)
|
||||
await expect(approve).toBeDisabled()
|
||||
await expect(connection.locator('option')).toHaveCount(1)
|
||||
await expect(page.getByRole('button', { name: 'Отклонить', exact: true })).toBeEnabled()
|
||||
expect(state.connectionReads).toBe(reads)
|
||||
expect(state.mutations).toEqual([])
|
||||
})
|
||||
|
||||
test('synthetic: issue only selected server/read permission and hide one-time token', async ({ page }) => {
|
||||
const state = await setup(page, ['mm:mcp:admin', 'mm:servers:read'])
|
||||
await page.goto('/mcp?tab=connections')
|
||||
|
||||
@@ -1,4 +1,6 @@
|
||||
import { test, expect, type Page } from "@playwright/test"
|
||||
import { evaluateMcpPolicy } from "../../backend/src/modules/mcp/policy"
|
||||
import type { McpPolicyPreviewRequest } from "@mmapp/contracts/mcp"
|
||||
const id = "fa58fa40-4bcb-4616-9316-cb69463b3150"
|
||||
const at = "2026-10-17T00:00:00Z"
|
||||
const operation = { id: "logs.query", toolName: "mm_logs_query", title: "Поиск логов", section: "logs", version: 1, effect: "read", risk: "ordinary", scope: "servers", requiredPermissions: ["mm:servers:read"], implementation: "available", annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true } }
|
||||
@@ -20,7 +22,7 @@ async function setup(page: Page, fail = false) {
|
||||
if (path === "/api/mcp/devices/catalog") return json({ servers: [{ id: 1, name: "CHR lab", host: "192.0.2.1", enabled: true }], resources: [{ id: "bridge", title: "Bridge", read: true, create: true, update: true, delete: true, fields: [{ key: "name", type: "string", requiredOnCreate: true }, { key: "comment", type: "string", requiredOnCreate: false }, { key: "disabled", type: "boolean", requiredOnCreate: false }] }] })
|
||||
if (path === "/api/mcp/devices/1/bridge/plan") return json({ planId: id, state: "awaiting-approval" })
|
||||
if (path === "/api/mcp/devices/1/bridge") return json({ items: [{ ".id": "*A", name: "lab-bridge", comment: "baseline", disabled: "true" }], total: 1, nextOffset: null })
|
||||
if (path.endsWith("/check")) return json({ ok: true, checks: { enabled: true, active: true, protocolHandshake: true }, checkedAt: at, protocolProbe: { status: "passed", elapsedMs: 12, credentialType: "temporary-no-operations", clientCredentialsVerified: false } })
|
||||
if (path.endsWith("/check")) return json({ ok: true, checks: { enabled: true, active: true, protocolHandshake: true }, checkedAt: at, protocolProbe: { status: "passed", elapsedMs: 12, credentialType: "temporary-capabilities-read", capabilitiesRead: "passed", clientCredentialsVerified: false } })
|
||||
if (path.endsWith("/grants")) return json({ grants: [] })
|
||||
if (path === "/api/mcp/routing-profiles/plan") return json({ planId: id, state: "awaiting-approval" })
|
||||
if (path === "/api/mcp/routing-profiles") return json({ profiles: [{ id, connection_id: id, config: { name: "Community WAN", community: "65000:10", family: "ipv6", table: "main" }, state: { pausedReason: "Допуск контроллера истёк" }, enabled: false, grant_expires_at: at }] })
|
||||
@@ -63,6 +65,80 @@ test("MCP приостанавливает опрос по сигналу скр
|
||||
await expect.poll(overviewCalls).toBeGreaterThan(before)
|
||||
})
|
||||
|
||||
test("MCP: медленное чтение завершается без отмены очередным опросом", async ({ page }) => {
|
||||
await setup(page)
|
||||
let calls = 0
|
||||
let release!: () => void
|
||||
const pending = new Promise<void>(resolve => { release = resolve })
|
||||
await page.route("**/api/mcp/overview", async route => {
|
||||
calls++
|
||||
await pending
|
||||
await route.fulfill({ json: { connections: 1, calls: 7, errors: 1, approvals: 1, running: 0, enabled: true, observedAt: at } })
|
||||
})
|
||||
await page.clock.install()
|
||||
await page.goto("/mcp?tab=overview")
|
||||
try {
|
||||
await expect.poll(() => calls).toBeGreaterThan(0)
|
||||
const initialCalls = calls
|
||||
await page.clock.runFor(11_000)
|
||||
expect(calls).toBe(initialCalls)
|
||||
} finally {
|
||||
release()
|
||||
}
|
||||
await expect(page.getByText("MCP включён", { exact: true })).toBeVisible()
|
||||
await page.clock.runFor(5_000)
|
||||
await expect.poll(() => calls).toBeGreaterThan(1)
|
||||
})
|
||||
|
||||
test("MCP: явное обновление заменяет медленное чтение и сохраняет свежий ответ", async ({ page }) => {
|
||||
await setup(page)
|
||||
let calls = 0
|
||||
let release!: () => void
|
||||
const pending = new Promise<void>(resolve => { release = resolve })
|
||||
await page.route("**/api/mcp/overview", async route => {
|
||||
const current = ++calls
|
||||
if (current === 1) await pending
|
||||
await route.fulfill({ json: { connections: 1, calls: current === 1 ? 7 : 99, errors: 0, approvals: 0, running: 0, enabled: true, observedAt: at } })
|
||||
})
|
||||
await page.clock.install()
|
||||
await page.goto("/mcp?tab=overview")
|
||||
try {
|
||||
await expect.poll(() => calls).toBe(1)
|
||||
await page.evaluate(() => window.dispatchEvent(new Event("mcp-refresh")))
|
||||
await expect.poll(() => calls).toBe(2)
|
||||
await expect(page.getByText("99", { exact: true })).toBeVisible()
|
||||
} finally {
|
||||
release()
|
||||
}
|
||||
await page.clock.runFor(1_000)
|
||||
await expect(page.getByText("99", { exact: true })).toBeVisible()
|
||||
await expect(page.getByText("7", { exact: true })).toHaveCount(0)
|
||||
})
|
||||
|
||||
test("MCP: зависшее чтение показывает ошибку и повторяется после срока ожидания", async ({ page }) => {
|
||||
await setup(page)
|
||||
let calls = 0
|
||||
let release!: () => void
|
||||
const pending = new Promise<void>(resolve => { release = resolve })
|
||||
await page.route("**/api/mcp/overview", async route => {
|
||||
if (++calls === 1) await pending
|
||||
await route.fulfill({ json: { connections: 1, calls: 7, errors: 0, approvals: 0, running: 0, enabled: true, observedAt: at } })
|
||||
})
|
||||
await page.clock.install()
|
||||
await page.goto("/mcp?tab=overview")
|
||||
try {
|
||||
await expect.poll(() => calls).toBe(1)
|
||||
await page.clock.runFor(60_001)
|
||||
await expect(page.getByRole("alert").filter({ hasText: "Обновление не завершилось за минуту" })).toBeVisible()
|
||||
await page.clock.runFor(5_000)
|
||||
await expect.poll(() => calls).toBeGreaterThan(1)
|
||||
await expect(page.getByText("MCP включён", { exact: true })).toBeVisible()
|
||||
await expect(page.getByRole("alert").filter({ hasText: "Обновление не завершилось за минуту" })).toHaveCount(0)
|
||||
} finally {
|
||||
release()
|
||||
}
|
||||
})
|
||||
|
||||
test("MCP журнал: заполненная квота объясняет удержание и показывает admin counters",async({page})=>{
|
||||
await setup(page)
|
||||
await page.route("**/api/mcp/overview",route=>route.fulfill({json:{connections:1,calls:7,errors:0,approvals:0,running:0,enabled:true,observedAt:at,pollStorageCapacity:{status:"observed",owner:{used:8,limit:8,remaining:0},global:{exhausted:true,usage:{used:128,limit:128,remaining:0}},retentionDays:14}}}))
|
||||
@@ -98,11 +174,15 @@ test("MCP журнал: на мобильном общая квота блоки
|
||||
expect(await capacity.evaluate(element=>element.scrollWidth<=element.clientWidth)).toBe(true)
|
||||
await capacity.screenshot({path:"test-results/mcp-poll-capacity-mobile.png"})
|
||||
})
|
||||
const routePathCheckConfig = {
|
||||
name: "Проверка назначения", serverId: 1, community: "65000:10", family: "ipv4", table: "main", probeVrf: "main",
|
||||
candidates: [{ id: "probe", wanInterface: "wan", downstreamInterface: "down", jumpHostId: 2, exitNodeId: 3, gateway: "192.0.2.1", gatewayRef: { resource: "ipv4_route", id: "*r" }, controlProbe: { targetInterface: "exit", expectedHops: [{ serverId: 3, interface: "exit" }] } }],
|
||||
}
|
||||
|
||||
test("Route AI: самостоятельная проба имеет отдельное назначение и не разрешает Community", async ({ page }) => {
|
||||
await setup(page)
|
||||
const headers = { "access-control-allow-origin": "*", "access-control-allow-methods": "GET,POST,OPTIONS", "access-control-allow-headers": "Authorization,Content-Type" }
|
||||
const config = { name: "Проверка назначения", serverId: 1, community: "65000:10", family: "ipv4", table: "main", probeVrf: "main", candidates: [{ id: "probe", wanInterface: "wan", downstreamInterface: "down", jumpHostId: 2, exitNodeId: 3, gateway: "192.0.2.1", gatewayRef: { resource: "ipv4_route", id: "*r" }, controlProbe: { targetInterface: "exit", expectedHops: [{ serverId: 3, interface: "exit" }] } }] }
|
||||
await page.route("**/api/mcp/routing-profiles", route => route.fulfill({ headers, json: { profiles: [{ id, connection_id: id, config, enabled: false }] } }))
|
||||
await page.route("**/api/mcp/routing-profiles", route => route.fulfill({ headers, json: { profiles: [{ id, connection_id: id, config: routePathCheckConfig, enabled: false }] } }))
|
||||
await page.route(`**/api/mcp/routing-profiles/${id}/check`, route => {
|
||||
if (route.request().method() === "OPTIONS") return route.fulfill({ status: 204, headers })
|
||||
return route.fulfill({ headers, json: { proofPurpose: route.request().postDataJSON().proofPurpose, status: "verified", returnPathVerified: false } })
|
||||
@@ -122,6 +202,55 @@ test("Route AI: самостоятельная проба имеет отдел
|
||||
await expect(page.getByText("Результат не разрешает переключение Community", { exact: false })).toBeVisible()
|
||||
})
|
||||
|
||||
test("Route AI: смена выбора отбрасывает запоздалый результат и ошибку пробы", async ({ page }) => {
|
||||
await setup(page)
|
||||
const headers = { "access-control-allow-origin": "*", "access-control-allow-methods": "GET,POST,OPTIONS", "access-control-allow-headers": "Authorization,Content-Type" }
|
||||
const anotherId = "fa58fa40-4bcb-4616-9316-cb69463b3151"
|
||||
const candidate = routePathCheckConfig.candidates[0]
|
||||
const config = { ...routePathCheckConfig, candidates: [candidate, { ...candidate, id: "reserve", wanInterface: "wan-b", gateway: "192.0.2.2", gatewayRef: { resource: "ipv4_route", id: "*s" } }] }
|
||||
await page.route("**/api/mcp/routing-profiles", route => route.fulfill({ headers, json: { profiles: [id, anotherId].map(profileId => ({ id: profileId, config, version: 1, enabled: false })) } }))
|
||||
let requestCount = 0
|
||||
let release: () => void = () => {}
|
||||
await page.route("**/api/mcp/routing-profiles/*/check", async route => {
|
||||
if (route.request().method() === "OPTIONS") return route.fulfill({ status: 204, headers })
|
||||
const request = ++requestCount
|
||||
if (request < 3) await new Promise<void>(resolve => { release = resolve })
|
||||
return request === 2
|
||||
? route.fulfill({ status: 502, headers, json: { error: "Старая ошибка пробы" } })
|
||||
: route.fulfill({ headers, json: { marker: request === 1 ? "old-proof" : "current-proof", ...route.request().postDataJSON() } })
|
||||
})
|
||||
await page.goto("/mcp?tab=routing")
|
||||
const profile = page.getByLabel("Профиль для проверки пути")
|
||||
const path = page.getByLabel("Проверяемый путь")
|
||||
const purpose = page.getByLabel("Назначение проверки")
|
||||
const check = page.getByRole("button", { name: "Проверить контрольный путь", exact: true })
|
||||
const start = async (number: number) => {
|
||||
await check.click()
|
||||
await expect.poll(() => requestCount).toBe(number)
|
||||
}
|
||||
await profile.selectOption(id)
|
||||
await path.selectOption("probe")
|
||||
await start(1)
|
||||
await path.selectOption("reserve")
|
||||
await path.selectOption("probe")
|
||||
release()
|
||||
await expect(check).toBeEnabled()
|
||||
await expect(page.getByText("old-proof", { exact: false })).toHaveCount(0)
|
||||
|
||||
await start(2)
|
||||
await profile.selectOption(anotherId)
|
||||
await path.selectOption("reserve")
|
||||
await purpose.selectOption("control-path")
|
||||
release()
|
||||
await expect(check).toBeEnabled()
|
||||
await expect(page.getByText("Старая ошибка пробы", { exact: false })).toHaveCount(0)
|
||||
|
||||
await start(3)
|
||||
const result = page.locator("pre[role=status]").filter({ hasText: "current-proof" })
|
||||
await expect(result).toContainText('"candidateId": "reserve"')
|
||||
await expect(result).toContainText('"proofPurpose": "control-path"')
|
||||
})
|
||||
|
||||
test("Route AI: автовосстановление блокирует активацию, но позволяет сохранить выключенный профиль", async ({ page }) => {
|
||||
await setup(page)
|
||||
const config = { name: "Профиль восстановления", serverId: 1, community: "65000:10", family: "ipv4", table: "main", probeVrf: "main", autoRecovery: true, candidates: [{ id: "probe", wanInterface: "wan", downstreamInterface: "down", jumpHostId: 2, exitNodeId: 3, gateway: "192.0.2.1", gatewayRef: { resource: "ipv4_route", id: "*r" }, controlProbe: { targetInterface: "exit", expectedHops: [{ serverId: 3, interface: "exit" }] } }] }
|
||||
@@ -154,6 +283,7 @@ test("MCP: доступ, проверка подключения, выдача
|
||||
const readiness = page.locator("pre").filter({ hasText: "protocolProbe" })
|
||||
await expect(readiness).toContainText('"protocolHandshake": true')
|
||||
await expect(readiness).toContainText('"clientCredentialsVerified": false')
|
||||
await expect(page.getByRole("status").filter({ hasText: "Проверочное чтение возможностей прошло." })).toBeVisible()
|
||||
await page.getByRole("button", { name: "Выдать доступ", exact: true }).click()
|
||||
await page.getByLabel("Название", { exact: true }).fill("Новый AI клиент")
|
||||
await page.getByRole("button", { name: "Далее", exact: true }).click()
|
||||
@@ -170,6 +300,186 @@ test("MCP: доступ, проверка подключения, выдача
|
||||
await page.screenshot({ path: "test-results/mcp-route-ai.png", fullPage: true })
|
||||
expect(errors).toEqual([])
|
||||
})
|
||||
test("MCP: временные допуски и результаты проверки привязаны к подключению", async ({ page }) => {
|
||||
await setup(page)
|
||||
const otherId = "fa58fa40-4bcb-4616-9316-cb69463b3151"
|
||||
const other = { ...connection, id: otherId, name: "Мониторинг LAN", policy: { ...connection.policy, id: otherId } }
|
||||
let listed = [connection, other]
|
||||
await page.route("**/api/mcp/connections", route => route.fulfill({ json: { connections: listed } }))
|
||||
|
||||
let releaseOtherGrants!: () => void
|
||||
let releaseIssue!: () => void
|
||||
let releaseFirstCheck!: () => void
|
||||
let releaseStaleCheck!: () => void
|
||||
const otherGrants = new Promise<void>(resolve => { releaseOtherGrants = resolve })
|
||||
const issue = new Promise<void>(resolve => { releaseIssue = resolve })
|
||||
const firstCheck = new Promise<void>(resolve => { releaseFirstCheck = resolve })
|
||||
const staleCheck = new Promise<void>(resolve => { releaseStaleCheck = resolve })
|
||||
const grant = (id: string) => ({ id, grant: { expiresAt: at }, revoked_at: null })
|
||||
|
||||
await page.route(`**/api/mcp/connections/${id}/grants`, async route => {
|
||||
if (route.request().method() === "GET") return route.fulfill({ json: { grants: [grant(id)] } })
|
||||
await issue
|
||||
return route.fulfill({ json: { token: "issued-for-wan", expiresAt: at } })
|
||||
})
|
||||
await page.route(`**/api/mcp/connections/${otherId}/grants`, async route => {
|
||||
await otherGrants
|
||||
await route.fulfill({ json: { grants: [grant(otherId)] } })
|
||||
})
|
||||
await page.route("**/api/mcp/grants/*", route => route.fulfill({ json: { ok: true } }))
|
||||
await page.route(`**/api/mcp/connections/${id}/check`, async route => {
|
||||
await firstCheck
|
||||
await route.fulfill({ json: { ok: true, checks: { wan: true }, checkedAt: at } })
|
||||
})
|
||||
let otherChecks = 0
|
||||
await page.route(`**/api/mcp/connections/${otherId}/check`, async route => {
|
||||
const stale = ++otherChecks === 1
|
||||
if (stale) await staleCheck
|
||||
await route.fulfill({ json: { ok: true, checks: stale ? { stale: true } : { lan: true }, checkedAt: at } })
|
||||
})
|
||||
|
||||
await page.goto("/mcp?tab=connections")
|
||||
const selection = page.getByLabel("Подключение для проверки")
|
||||
const revoke = page.getByRole("button", { name: "Отозвать допуск", exact: true })
|
||||
const check = page.getByRole("button", { name: "Проверить готовность доступа", exact: true })
|
||||
const create = page.getByRole("button", { name: "Выдать временный допуск", exact: true })
|
||||
const readiness = page.locator("pre")
|
||||
|
||||
try {
|
||||
await selection.selectOption(id)
|
||||
await expect(revoke).toBeVisible()
|
||||
await Promise.all([page.waitForRequest(`**/api/mcp/connections/${id}/check`), check.click()])
|
||||
await page.getByRole("checkbox", { name: "logs.query", exact: true }).check()
|
||||
await Promise.all([
|
||||
page.waitForRequest(request => request.method() === "POST" && request.url().endsWith(`/connections/${id}/grants`)),
|
||||
create.click(),
|
||||
])
|
||||
|
||||
await Promise.all([page.waitForRequest(`**/api/mcp/connections/${otherId}/grants`), selection.selectOption(otherId)])
|
||||
await expect(revoke).toHaveCount(0)
|
||||
await page.getByRole("checkbox", { name: "logs.query", exact: true }).check()
|
||||
await expect(create).toBeDisabled()
|
||||
releaseOtherGrants()
|
||||
await expect(revoke).toBeVisible()
|
||||
const revoked = page.waitForRequest(request => request.method() === "DELETE" && request.url().includes("/api/mcp/grants/"))
|
||||
await revoke.click()
|
||||
expect(new URL((await revoked).url()).pathname).toBe(`/api/mcp/grants/${otherId}`)
|
||||
|
||||
await Promise.all([page.waitForRequest(`**/api/mcp/connections/${otherId}/check`), check.click()])
|
||||
await check.click()
|
||||
await expect(readiness).toContainText('"lan": true')
|
||||
const lateResponses = Promise.all([
|
||||
page.waitForResponse(`**/api/mcp/connections/${id}/check`),
|
||||
page.waitForResponse(`**/api/mcp/connections/${otherId}/check`),
|
||||
])
|
||||
releaseFirstCheck()
|
||||
releaseStaleCheck()
|
||||
for (const response of await lateResponses) await response.finished()
|
||||
|
||||
listed = [other]
|
||||
releaseIssue()
|
||||
const dialog = page.getByRole("dialog")
|
||||
await expect(dialog).toContainText(`Подключение «${connection.name}»`)
|
||||
await expect(dialog.getByLabel("Одноразовый токен MCP")).toHaveValue("issued-for-wan")
|
||||
await expect(selection.locator(`option[value="${id}"]`)).toHaveCount(0)
|
||||
await dialog.getByRole("button", { name: "Закрыть и скрыть токен" }).click()
|
||||
await expect(selection).toHaveValue(otherId)
|
||||
await expect(readiness).toContainText('"lan": true')
|
||||
await expect(readiness).not.toContainText('"wan": true')
|
||||
await expect(readiness).not.toContainText('"stale": true')
|
||||
await expect(create).toBeEnabled()
|
||||
} finally {
|
||||
releaseOtherGrants()
|
||||
releaseIssue()
|
||||
releaseFirstCheck()
|
||||
releaseStaleCheck()
|
||||
}
|
||||
})
|
||||
|
||||
test("MCP: симулятор разрешений использует область операции из каталога", async ({ page }) => {
|
||||
await setup(page)
|
||||
const otherId = "fa58fa40-4bcb-4616-9316-cb69463b3158"
|
||||
const capabilities = { ...operation, id: "capabilities.read", toolName: "mm_capabilities_get", title: "Доступные возможности", scope: "connection", requiredPermissions: [] }
|
||||
const users = { ...operation, id: "users.list", toolName: "mm_users_list", title: "Каталог пользователей", scope: "global", requiredPermissions: ["mm:users:read"] }
|
||||
const ownerPermissions = ["mm:servers:read", "mm:users:read"]
|
||||
const policy = { ...connection.policy, permissions: ownerPermissions, scope: { serverIds: [1, 2], operationIds: [capabilities.id, users.id, operation.id], allowGlobal: true } } as McpPolicyPreviewRequest["policy"]
|
||||
const foreign = { ...connection, ownerId: "other-owner", policy }
|
||||
const other = { ...foreign, id: otherId, name: "Другой доступ", policy: { ...policy, id: otherId } }
|
||||
const headers = { "access-control-allow-origin": "*", "access-control-allow-methods": "GET,POST,OPTIONS", "access-control-allow-headers": "Authorization,Content-Type" }
|
||||
await page.route("**/api/mcp/catalog", route => route.fulfill({ headers, json: { stage: "runtime", executionAvailable: true, operations: [operation, capabilities, users] } }))
|
||||
await page.route("**/api/mcp/connections", route => route.fulfill({ headers, json: { connections: [foreign, other] } }))
|
||||
const previews: unknown[] = [], protections: unknown[] = []
|
||||
let releaseStale!: () => void
|
||||
const stale = new Promise<void>(resolve => { releaseStale = resolve })
|
||||
await page.route("**/api/mcp/policy/preview", async route => {
|
||||
if (route.request().method() === "OPTIONS") return route.fulfill({ status: 204, headers })
|
||||
const input = route.request().postDataJSON() as Pick<McpPolicyPreviewRequest, "target" | "operationId">
|
||||
previews.push(input)
|
||||
if (input.target.scope === "servers" && input.target.serverIds.includes(3)) await stale
|
||||
const result = evaluateMcpPolicy({ operationId: input.operationId, target: input.target, policy, ownerPermissions, objects: [], protections: [], objectCount: 0, usage: { callsInMinute: 0, concurrentReads: 0, mutationsInHour: 0 }, auditAvailable: true })
|
||||
await route.fulfill({ headers, json: { simulation: true, executionAvailable: false, evaluatedAt: at, policyVersion: 1, result } })
|
||||
})
|
||||
await page.route("**/api/mcp/protections", route => {
|
||||
if (route.request().method() === "OPTIONS") return route.fulfill({ status: 204, headers })
|
||||
if (route.request().method() === "POST") { protections.push(route.request().postDataJSON()); return route.fulfill({ headers, json: { id } }) }
|
||||
return route.fulfill({ headers, json: { protections: [] } })
|
||||
})
|
||||
|
||||
try {
|
||||
await page.goto("/mcp?tab=permissions")
|
||||
const selectConnection = page.getByLabel("Подключение", { exact: true })
|
||||
const selectOperation = page.getByLabel("Операция", { exact: true })
|
||||
const serverIds = page.getByLabel("ID серверов", { exact: true })
|
||||
const preview = page.getByRole("button", { name: "Проверить", exact: true })
|
||||
const allowed = page.getByText("Разрешено", { exact: true })
|
||||
await selectConnection.selectOption(id)
|
||||
await selectOperation.selectOption(capabilities.id)
|
||||
await expect(page.getByText("Область операции — подключение")).toBeVisible()
|
||||
await expect(serverIds).toHaveCount(0)
|
||||
await preview.click()
|
||||
await expect(allowed).toBeVisible()
|
||||
expect(previews[0]).toEqual({ connectionId: id, operationId: capabilities.id, target: { scope: "connection" } })
|
||||
|
||||
await selectOperation.selectOption(operation.id)
|
||||
await expect(allowed).toHaveCount(0)
|
||||
await expect(preview).toBeDisabled()
|
||||
await serverIds.fill("1,1")
|
||||
await expect(preview).toBeDisabled()
|
||||
await serverIds.fill("2, 1")
|
||||
await preview.click()
|
||||
await expect(allowed).toBeVisible()
|
||||
expect(previews[1]).toEqual({ connectionId: id, operationId: operation.id, target: { scope: "servers", serverIds: [2, 1] } })
|
||||
|
||||
await serverIds.fill("1, 3")
|
||||
await expect(allowed).toHaveCount(0)
|
||||
await preview.click()
|
||||
await expect.poll(() => previews.length).toBe(3)
|
||||
await selectOperation.selectOption(users.id)
|
||||
await expect(page.getByText("Область операции — всё приложение")).toBeVisible()
|
||||
await expect(serverIds).toHaveCount(0)
|
||||
await preview.click()
|
||||
await expect(allowed).toBeVisible()
|
||||
expect(previews[3]).toEqual({ connectionId: id, operationId: users.id, target: { scope: "global" } })
|
||||
const late = page.waitForResponse(response => response.url().endsWith("/api/mcp/policy/preview") && response.request().postDataJSON().target.scope === "servers")
|
||||
releaseStale()
|
||||
await (await late).finished()
|
||||
await expect(allowed).toBeVisible()
|
||||
await expect(page.getByText("Запрещено", { exact: true })).toHaveCount(0)
|
||||
|
||||
await selectConnection.selectOption(otherId)
|
||||
await expect(selectOperation).toHaveValue("")
|
||||
await expect(allowed).toHaveCount(0)
|
||||
await expect(preview).toBeDisabled()
|
||||
|
||||
await page.getByLabel("Тип объекта", { exact: true }).fill("ethernet")
|
||||
await page.getByLabel("Стабильный ID", { exact: true }).fill("*A")
|
||||
const protect = page.getByRole("button", { name: "Добавить защиту" })
|
||||
await expect(protect).toBeDisabled()
|
||||
await page.getByLabel("ID сервера защищаемого объекта").fill("9")
|
||||
await protect.click()
|
||||
await expect.poll(() => protections).toEqual([{ object: { kind: "ethernet", id: "*A", protection: "human-approval-required", serverId: 9 }, reason: "" }])
|
||||
} finally { releaseStale() }
|
||||
})
|
||||
test("MCP: ошибки остаются видимыми, узкий экран не переполняется", async ({ page }) => {
|
||||
await setup(page, true)
|
||||
await page.setViewportSize({ width: 390, height: 844 })
|
||||
@@ -398,6 +708,63 @@ test("MCP: изменение интерфейса готовит план то
|
||||
await page.screenshot({ path: "test-results/mcp-device-editor.png", fullPage: true })
|
||||
})
|
||||
|
||||
test("MCP: можно добавить первый комментарий интерфейса без подстановки остальных свойств", async ({ page }) => {
|
||||
await setup(page)
|
||||
await page.route("**/api/mcp/devices/1/bridge?*", route => route.fulfill({ json: {
|
||||
items: [{ ".id": "*A", name: "lab-bridge", disabled: "true" }], total: 1, nextOffset: null,
|
||||
} }))
|
||||
await page.goto("/mcp?tab=devices")
|
||||
await page.getByLabel("Подключение для управления интерфейсами").selectOption(id)
|
||||
await page.getByLabel("Сервер интерфейсов").selectOption("1")
|
||||
await page.getByLabel("Тип объектов устройства").selectOption("bridge")
|
||||
await page.getByText("lab-bridge", { exact: true }).click()
|
||||
await page.getByRole("textbox", { name: "comment", exact: true }).fill("first comment")
|
||||
const sent = page.waitForRequest(request => request.method() === "POST" && request.url().includes("/api/mcp/devices/1/bridge/plan"))
|
||||
await page.getByRole("button", { name: "Подготовить план изменения", exact: true }).click()
|
||||
expect((await sent).postDataJSON()).toEqual({ connectionId: id, action: "update", id: "*A", fields: { comment: "first comment" } })
|
||||
await expect(page.getByRole("status").filter({ hasText: "Создан план" })).toBeVisible()
|
||||
})
|
||||
|
||||
test("MCP: Ethernet допускает явное изменение неизвестного disabled", async ({ page }) => {
|
||||
await setup(page)
|
||||
await page.route("**/api/mcp/devices/catalog?*", route => route.fulfill({ json: {
|
||||
servers: [{ id: 1, name: "CHR lab", host: "192.0.2.1", enabled: true }],
|
||||
resources: [{ id: "ethernet", title: "Ethernet", read: true, create: false, update: true, delete: false, fields: [
|
||||
{ key: "name", type: "string", requiredOnCreate: false },
|
||||
{ key: "disabled", type: "boolean", requiredOnCreate: false },
|
||||
{ key: "auto-negotiation", type: "boolean", requiredOnCreate: false },
|
||||
] }],
|
||||
} }))
|
||||
await page.route("**/api/mcp/devices/1/ethernet?*", route => route.fulfill({ json: {
|
||||
items: [{ ".id": "*E", name: "lab-ethernet", running: "true" }], total: 1, nextOffset: null,
|
||||
} }))
|
||||
await page.route("**/api/mcp/devices/1/ethernet/plan", route => route.fulfill({ json: { planId: id, state: "awaiting-approval" } }))
|
||||
await page.goto("/mcp?tab=devices")
|
||||
await page.getByLabel("Подключение для управления интерфейсами").selectOption(id)
|
||||
await page.getByLabel("Сервер интерфейсов").selectOption("1")
|
||||
await page.getByLabel("Тип объектов устройства").selectOption("ethernet")
|
||||
await page.getByText("lab-ethernet", { exact: true }).click()
|
||||
|
||||
const disabled = page.getByRole("combobox", { name: "disabled", exact: true })
|
||||
const prepare = page.getByRole("button", { name: "Подготовить план изменения", exact: true })
|
||||
const warning = page.getByText("Исходное состояние неизвестно. Для этого изменения обратный план недоступен.")
|
||||
await expect(disabled.locator("option:checked")).toHaveText("Текущее значение неизвестно")
|
||||
await expect(disabled).toHaveValue("")
|
||||
await expect(prepare).toBeDisabled()
|
||||
await expect(page.getByRole("combobox", { name: "auto-negotiation", exact: true })).toHaveCount(0)
|
||||
await disabled.selectOption("false")
|
||||
await expect(prepare).toBeEnabled()
|
||||
await expect(warning).toBeVisible()
|
||||
await disabled.selectOption("")
|
||||
await expect(prepare).toBeDisabled()
|
||||
await expect(warning).toHaveCount(0)
|
||||
await disabled.selectOption("true")
|
||||
const sent = page.waitForRequest(request => request.method() === "POST" && request.url().endsWith("/api/mcp/devices/1/ethernet/plan"))
|
||||
await prepare.click()
|
||||
expect((await sent).postDataJSON()).toEqual({ connectionId: id, action: "update", id: "*E", fields: { disabled: true } })
|
||||
await expect(page.getByRole("status").filter({ hasText: "Создан план" })).toBeVisible()
|
||||
})
|
||||
|
||||
test("MCP: архив БД загружает человек, подготовка плана не запускает restore", async ({ page }) => {
|
||||
const calls = await setup(page)
|
||||
await page.route("**/api/mcp/connections", route => route.fulfill({ json: { connections: [{ ...connection, policy: { ...connection.policy, permissions: ["mm:settings:admin"], scope: { serverIds: [1], operationIds: ["database.restore"], allowGlobal: true } } }] } }))
|
||||
@@ -437,3 +804,64 @@ test("MCP: обзор плана показывает исходное сост
|
||||
await expect(dialog.getByRole("button", { name: "Подтвердить план", exact: true })).toBeVisible()
|
||||
await dialog.screenshot({ path: "test-results/mcp-plan-review.png" })
|
||||
})
|
||||
|
||||
test("MCP: запоздалое решение не закрывает другой план и повторная отправка блокируется", async ({ page }) => {
|
||||
await setup(page)
|
||||
const secondId = "fa58fa40-4bcb-4616-9316-cb69463b3199"
|
||||
const first = { id, operationId: "routing.community.switch", state: "awaiting-approval", createdAt: at, expiresAt: "2099-01-01T00:00:00Z", changes: {} }
|
||||
const second = { ...first, id: secondId, operationId: "ros.ethernet.update", state: "approved" }
|
||||
let finishDecision!: () => void
|
||||
let finishApply!: () => void
|
||||
const decisionGate = new Promise<void>(resolve => { finishDecision = resolve })
|
||||
const applyGate = new Promise<void>(resolve => { finishApply = resolve })
|
||||
const decisions: unknown[] = []
|
||||
const applications: unknown[] = []
|
||||
await page.route(url => url.pathname === "/api/mcp/plans", route => route.fulfill({ json: { items: [first, second], total: 2, nextCursor: null } }))
|
||||
await page.route(`**/api/mcp/plans/${id}/decision`, async route => {
|
||||
decisions.push(route.request().postDataJSON())
|
||||
await decisionGate
|
||||
first.state = "approved"
|
||||
await route.fulfill({ json: { ok: true } })
|
||||
})
|
||||
await page.route(`**/api/mcp/plans/${secondId}/apply`, async route => {
|
||||
applications.push(route.request().postDataJSON())
|
||||
await applyGate
|
||||
await route.fulfill({ json: { id: secondId, state: "pending" } })
|
||||
})
|
||||
try {
|
||||
await page.goto("/mcp?tab=plans")
|
||||
await page.getByText(first.operationId, { exact: true }).click()
|
||||
const dialog = page.getByRole("dialog")
|
||||
await dialog.getByRole("button", { name: "Подтвердить план", exact: true }).click()
|
||||
await expect(dialog.getByRole("button", { name: "Подтвердить план", exact: true })).toBeDisabled()
|
||||
await expect(dialog.getByRole("button", { name: "Отклонить", exact: true })).toBeDisabled()
|
||||
await page.keyboard.press("Escape")
|
||||
await expect(dialog).toHaveCount(0)
|
||||
|
||||
await page.getByText(first.operationId, { exact: true }).click()
|
||||
await expect(dialog.getByRole("button", { name: "Подтвердить план", exact: true })).toBeDisabled()
|
||||
await page.keyboard.press("Escape")
|
||||
await expect(dialog).toHaveCount(0)
|
||||
|
||||
await page.getByText(second.operationId, { exact: true }).click()
|
||||
const apply = dialog.getByRole("button", { name: "Применить план", exact: true })
|
||||
await expect(apply).toBeEnabled()
|
||||
const decisionResponse = page.waitForResponse(response => response.url().endsWith(`/plans/${id}/decision`))
|
||||
const refreshed = page.waitForResponse(response => new URL(response.url()).pathname === "/api/mcp/plans" && response.json().then(payload => payload.items?.some((item: { id: string; state: string }) => item.id === id && item.state === "approved")))
|
||||
finishDecision()
|
||||
await decisionResponse
|
||||
await refreshed
|
||||
await expect(apply).toBeEnabled()
|
||||
expect(decisions).toEqual([{ approve: true }])
|
||||
|
||||
await apply.click()
|
||||
await expect(apply).toBeDisabled()
|
||||
await expect.poll(() => applications).toEqual([{}])
|
||||
finishApply()
|
||||
await expect(dialog).toHaveCount(0)
|
||||
expect(applications).toEqual([{}])
|
||||
} finally {
|
||||
finishDecision()
|
||||
finishApply()
|
||||
}
|
||||
})
|
||||
Loaded 100 of 101 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user