services_hardening_admin_wave_qualification.rs (6961B)
1 #![forbid(unsafe_code)] 2 3 use std::collections::BTreeSet; 4 5 use rhi::RhiAdminRoute; 6 use serde_json::{Value, json}; 7 8 const CONTRACT: &str = 9 include_str!("../contracts/services_hardening/admin_wave_qualification.v1.json"); 10 const OPERATOR_CONTRACT: &str = 11 include_str!("../contracts/services_hardening/operator_contract.v1.json"); 12 const ADMIN_SOURCE: &str = include_str!("../src/admin_v1.rs"); 13 const MANIFEST: &str = include_str!("../Cargo.toml"); 14 const ROOT_SOURCE: &str = include_str!("../src/lib.rs"); 15 16 #[test] 17 fn step209_machine_contract_freezes_the_complete_admin_wave() { 18 let contract: Value = serde_json::from_str(CONTRACT).expect("qualification contract"); 19 let operator: Value = serde_json::from_str(OPERATOR_CONTRACT).expect("operator contract"); 20 assert_eq!(contract["schema"], "radroots.rhi.admin-wave-qualification"); 21 assert_eq!(contract["schema_version"], 1); 22 assert_eq!(contract["contract_version"], 1); 23 assert_eq!(contract["step"], 209); 24 assert_eq!(contract["wave"], "130-b"); 25 assert_eq!(contract["service"], "rhi"); 26 assert_eq!(contract["final_inventory"]["route_count"], 20); 27 assert_eq!(contract["final_inventory"]["model_count"], 33); 28 assert_eq!(contract["final_inventory"]["common_route_count"], 7); 29 assert_eq!(contract["final_inventory"]["domain_route_count"], 13); 30 31 let routes = operator["admin"]["routes"].as_array().expect("routes"); 32 let models = operator["admin"]["models"].as_object().expect("models"); 33 assert_eq!(routes.len(), 20); 34 assert_eq!(models.len(), 33); 35 assert_eq!(RhiAdminRoute::ALL, RhiAdminRoute::ACTIVE); 36 assert_eq!( 37 RhiAdminRoute::COMMON 38 .into_iter() 39 .chain(RhiAdminRoute::DOMAIN) 40 .collect::<Vec<_>>(), 41 RhiAdminRoute::ALL 42 ); 43 let referenced = routes 44 .iter() 45 .flat_map(|route| { 46 ["request_model", "response_model"] 47 .map(|field| route[field].as_str().expect("model reference")) 48 }) 49 .collect::<BTreeSet<_>>(); 50 assert_eq!( 51 referenced, 52 models.keys().map(String::as_str).collect::<BTreeSet<_>>() 53 ); 54 55 assert_eq!( 56 contract["live_negative_matrix"], 57 json!({ 58 "original_wire": [ 59 "duplicate_request_field", 60 "nested_null", 61 "missing_contract_version" 62 ], 63 "version": [ 64 "unknown_major_path", 65 "contract_version_zero_every_mutation", 66 "contract_version_two_every_mutation" 67 ], 68 "pagination": [ 69 "noncanonical_limit", 70 "just_over_maximum_limit", 71 "duplicate_query_item", 72 "unknown_query_item", 73 "malformed_percent_encoding", 74 "noncanonical_cursor", 75 "handler_rejected_unbound_cursor" 76 ], 77 "idempotency": [ 78 "exact_operation_replay_returns_success_without_second_commit", 79 "conflicting_operation_reuse_rejected" 80 ], 81 "peer": [ 82 "owner_only_socket_mode", 83 "current_owner_round_trip", 84 "source_locked_linux_uid_or_gid_allow_and_other_deny" 85 ], 86 "removed_sensitive_routes": [ 87 "identity_rekey_unavailable", 88 "identity_replace_unavailable" 89 ], 90 "resource": [ 91 "request_body_just_over_limit", 92 "response_body_just_over_limit", 93 "page_limit_just_over_maximum", 94 "source_locked_header_query_connection_deadline_and_drain_limits" 95 ] 96 }) 97 ); 98 } 99 100 #[test] 101 fn qualification_is_executable_source_locked_and_authority_safe() { 102 let contract: Value = serde_json::from_str(CONTRACT).expect("qualification contract"); 103 for test in contract["component_corpus"] 104 .as_array() 105 .expect("component corpus") 106 { 107 let test = test.as_str().expect("test name"); 108 assert!( 109 ADMIN_SOURCE.contains(test), 110 "missing component test `{test}`" 111 ); 112 } 113 114 let revision = contract["source_locked_transport_evidence"]["revision"] 115 .as_str() 116 .expect("Lib revision"); 117 assert_eq!(revision.len(), 40); 118 assert!( 119 revision 120 .bytes() 121 .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase()) 122 ); 123 assert_eq!(revision, "053d0c750bf9cd683c6ea37cefe7e79617ba629f"); 124 assert!(MANIFEST.contains("rev = \"055096853fca95e15d0f813d33a14aca13be3881\"")); 125 assert!( 126 MANIFEST 127 .contains("radroots_service_host = { git = \"https://github.com/radrootslabs/lib\"") 128 ); 129 assert_eq!( 130 contract["source_locked_transport_evidence"]["corpus"], 131 json!([ 132 "serves_valid_json_with_exact_caller_correlation_and_no_web_headers", 133 "rejects_oversized_and_malformed_json_before_the_handler", 134 "rejects_invalid_mutation_envelopes_duplicates_and_nested_null_before_dispatch", 135 "parameterized_routes_percent_decode_bounded_values_without_service_authority", 136 "caller_correlation_precedes_entropy_and_survives_timeout_handoff", 137 "rejects_http_1_0_before_dispatch", 138 "request_deadline_returns_a_safe_timeout_and_cancels_the_handler_future", 139 "enforces_header_query_response_and_body_correlation_boundaries", 140 "connection_admission_never_exceeds_the_configured_limit", 141 "graceful_cancellation_stops_admission_and_drains_an_active_request", 142 "linux_process_credentials_allow_uid_or_gid_and_deny_otherwise", 143 "exact_positive_boundaries_are_accepted_for_every_field", 144 "zero_and_just_over_maximum_fail_for_every_field" 145 ]) 146 ); 147 148 for invariant in [ 149 "active_equals_final_inventory", 150 "all_models_referenced_exactly", 151 "authoritative_commit_owned_by_handler", 152 "cursor_authentication_owned_by_handler", 153 "peer_authorization_owned_by_shared_transport", 154 ] { 155 assert_eq!(contract["invariants"][invariant], true, "{invariant}"); 156 } 157 for invariant in [ 158 "adapter_performs_sqlite", 159 "adapter_performs_relay_io", 160 "adapter_performs_identity_mutation", 161 "raw_shared_transport_public", 162 "unbounded_resource", 163 ] { 164 assert_eq!(contract["invariants"][invariant], false, "{invariant}"); 165 } 166 for forbidden in [ 167 "IdentityRekey", 168 "IdentityReplace", 169 "pub fn into_inner", 170 "pub fn router", 171 "pub fn listener", 172 "sqlx::", 173 ] { 174 assert!( 175 !ADMIN_SOURCE.contains(forbidden), 176 "forbidden admin surface `{forbidden}`" 177 ); 178 assert!( 179 !ROOT_SOURCE.contains(forbidden), 180 "forbidden root surface `{forbidden}`" 181 ); 182 } 183 }