源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

apps/desktop/electron/connect-link.test.mjs

@@ -0,0 +1,288 @@
+import assert from "node:assert/strict";
+import { Buffer } from "node:buffer";
+import { createPrivateKey, generateKeyPairSync, sign } from "node:crypto";
+import { mkdtemp, readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import {
+  createConnectLinkReplayGuard,
+  desktopBootstrapFromConnectClaims,
+  extractConnectExchange,
+  extractConnectLinkToken,
+  resolveConnectExchangeUrl,
+  verifyConnectLinkToken,
+  verifyConnectLinkUrl,
+} from "./connect-link.mjs";
+import {
+  applyDesktopBootstrapBrandIcon,
+  persistConnectLinkBranding,
+} from "./connect-link-branding.mjs";
+
+const NOW = 1_783_000_000;
+const KID = "owc-test";
+const { publicKey: publicKeyPem, privateKey: privateKeyPem } = generateKeyPairSync("ed25519", {
+  publicKeyEncoding: { type: "spki", format: "pem" },
+  privateKeyEncoding: { type: "pkcs8", format: "pem" },
+});
+const publicKeys = { [KID]: publicKeyPem };
+
+/**
+ * @param {Record<string, unknown>} [overrides]
+ * @returns {import("@openwork/types/connect-link").ConnectLinkClaims}
+ */
+function claims(overrides = {}) {
+  return {
+    iss: "https://api.openwork.acme.example.com",
+    aud: "openwork-desktop-connect",
+    iat: NOW,
+    exp: NOW + 72 * 3600,
+    jti: "test-jti-0001",
+    v: 1,
+    org: { name: "Acme Robotics" },
+    brand: { appName: "Acme Work", logoUrl: null, iconUrl: null },
+    den: {
+      baseUrl: "https://openwork.acme.example.com",
+      apiBaseUrl: "https://api.openwork.acme.example.com",
+    },
+    requireSignin: true,
+    ...overrides,
+  };
+}
+
+/**
+ * @param {Record<string, unknown>} payload
+ * @param {Record<string, unknown>} [header]
+ */
+function mint(payload, header = { alg: "EdDSA", typ: "JWT", kid: KID }) {
+  const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+  const signingInput = `${encode(header)}.${encode(payload)}`;
+  const signature = sign(null, Buffer.from(signingInput), createPrivateKey(privateKeyPem));
+  return `${signingInput}.${signature.toString("base64url")}`;
+}
+
+function verifyAt(token, nowEpochSeconds = NOW, extra = {}) {
+  return verifyConnectLinkToken({ token, publicKeys, nowEpochSeconds, ...extra });
+}
+
+/** @param {import("@openwork/types/connect-link").ConnectLinkVerifyResult} result */
+function failureOf(result) {
+  assert.equal(result.ok, false);
+  if (result.ok !== false) throw new Error("expected a failure result");
+  return result;
+}
+
+test("extracts only dedicated desktop connect links", () => {
+  assert.equal(extractConnectLinkToken("openwork://connect?token=a.b.c"), "a.b.c");
+  assert.equal(extractConnectLinkToken("openwork-dev://connect?token=a.b.c"), "a.b.c");
+  assert.equal(extractConnectLinkToken("openwork:///connect?token=a.b.c"), "a.b.c");
+  assert.equal(extractConnectLinkToken("openwork://den-auth?grant=x"), null);
+  assert.equal(extractConnectLinkToken("https://connect?token=a.b.c"), null);
+});
+
+test("verifies an exact signed organization target end to end", () => {
+  const expected = claims();
+  const token = mint(expected);
+  const result = verifyConnectLinkUrl(
+    `openwork://connect?token=${encodeURIComponent(token)}`,
+    { publicKeys, nowEpochSeconds: NOW },
+  );
+  assert.equal(result.ok, true);
+  assert.deepEqual(result.claims, expected);
+  assert.equal(result.kid, KID);
+  assert.equal(result.transport, "signed");
+});
+
+test("resolves a keyless exchange through the exact HTTPS Den endpoint", async () => {
+  const code = "abcdefghijklmnopqrstuvwxyz123456";
+  const apiBaseUrl = "https://api.openwork.acme.example.com/api/den";
+  const expected = claims({
+    iss: apiBaseUrl,
+    brand: {
+      appName: "Acme Work",
+      logoUrl: "https://assets.acme.example.com/wordmark.svg",
+      iconUrl: "https://assets.acme.example.com/icon.png",
+    },
+    den: {
+      baseUrl: "https://openwork.acme.example.com",
+      apiBaseUrl,
+    },
+  });
+  const rawUrl = `openwork://connect?code=${code}&apiBaseUrl=${encodeURIComponent(apiBaseUrl)}`;
+  assert.deepEqual(extractConnectExchange(rawUrl), { code, apiBaseUrl });
+
+  const calls = [];
+  const result = await resolveConnectExchangeUrl(rawUrl, {
+    mode: "preview",
+    nowEpochSeconds: NOW,
+    fetcher: (url, init) => {
+      calls.push({ url, init });
+      return Promise.resolve(Response.json({ claims: expected }));
+    },
+  });
+
+  assert.equal(result.ok, true);
+  if (!result.ok) throw new Error("expected exchange success");
+  assert.equal(result.transport, "exchange");
+  assert.equal(result.kid, null);
+  assert.deepEqual(result.claims, expected);
+  assert.equal(calls[0].url, `${apiBaseUrl}/v1/install-connect/preview`);
+  assert.deepEqual(JSON.parse(calls[0].init.body), { code });
+  assert.equal(calls[0].init.redirect, "error");
+  assert.deepEqual(desktopBootstrapFromConnectClaims(result.claims), {
+    baseUrl: "https://openwork.acme.example.com",
+    apiBaseUrl,
+    requireSignin: true,
+    brandAppName: "Acme Work",
+    brandLogoUrl: "https://assets.acme.example.com/wordmark.svg",
+    brandIconUrl: "https://assets.acme.example.com/icon.png",
+  });
+});
+
+test("persists accepted Enterprise activation and branding before applying its icon", async () => {
+  const expectedClaims = claims({
+    brand: {
+      appName: "Acme Work",
+      logoUrl: null,
+      iconUrl: "https://assets.acme.example.com/icon.png",
+    },
+  });
+  const enterpriseActivation = {
+    activatedAt: "2026-07-27T14:00:00.000Z",
+    denBaseUrl: expectedClaims.den.baseUrl,
+  };
+  const calls = [];
+  const config = await persistConnectLinkBranding(expectedClaims, {
+    persistBootstrap: async (nextConfig) => {
+      calls.push({ type: "persist", config: nextConfig });
+      return {
+        ...nextConfig,
+        baseUrl: expectedClaims.den.baseUrl,
+        requireSignin: expectedClaims.requireSignin,
+        writtenAt: "2026-07-15T12:00:00.000Z",
+      };
+    },
+    applyBrandIconUrl: async (iconUrl) => {
+      calls.push({ type: "apply", iconUrl });
+      return { ok: true };
+    },
+    enterpriseActivation,
+  });
+
+  assert.deepEqual(calls.map((call) => call.type), ["persist", "apply"]);
+  assert.deepEqual(calls[0].config.enterpriseActivation, enterpriseActivation);
+  assert.equal(calls[0].config.brandAppName, "Acme Work");
+  assert.equal(calls[0].config.brandIconUrl, "https://assets.acme.example.com/icon.png");
+  assert.equal(calls[1].iconUrl, expectedClaims.brand.iconUrl);
+  assert.equal(config.writtenAt, "2026-07-15T12:00:00.000Z");
+});
+
+test("startup branding applies a saved icon and skips an absent one", async () => {
+  const applied = [];
+  const applyBrandIconUrl = async (iconUrl) => {
+    applied.push(iconUrl);
+    return { ok: true };
+  };
+
+  await applyDesktopBootstrapBrandIcon({ brandIconUrl: "https://assets.acme.example.com/icon.png" }, applyBrandIconUrl);
+  await applyDesktopBootstrapBrandIcon({}, applyBrandIconUrl);
+
+  assert.deepEqual(applied, ["https://assets.acme.example.com/icon.png"]);
+});
+
+test("fails closed for ambiguous, insecure, mismatched, expired, and replayed exchanges", async () => {
+  const code = "abcdefghijklmnopqrstuvwxyz123456";
+  const apiBaseUrl = "https://api.openwork.acme.example.com";
+  const rawUrl = `openwork://connect?code=${code}&apiBaseUrl=${encodeURIComponent(apiBaseUrl)}`;
+  assert.equal(extractConnectExchange(`${rawUrl}&token=a.b.c`), null);
+
+  const insecure = `openwork://connect?code=${code}&apiBaseUrl=${encodeURIComponent("http://den.example.com")}`;
+  assert.equal(failureOf(await resolveConnectExchangeUrl(insecure, {
+    mode: "preview",
+    fetcher: () => Promise.reject(new Error("must not fetch")),
+  })).code, "insecure_url");
+
+  const mismatched = await resolveConnectExchangeUrl(rawUrl, {
+    mode: "preview",
+    nowEpochSeconds: NOW,
+    fetcher: () => Promise.resolve(Response.json({ claims: claims({
+      iss: "https://other.example.com",
+      den: {
+        baseUrl: "https://openwork.acme.example.com",
+        apiBaseUrl: "https://other.example.com",
+      },
+    }) })),
+  });
+  assert.equal(failureOf(mismatched).code, "malformed_claims");
+
+  for (const failureCase of [
+    { status: 409, expectedCode: "replayed" },
+    { status: 410, expectedCode: "expired" },
+    { status: 404, expectedCode: "invalid_token" },
+  ]) {
+    const result = await resolveConnectExchangeUrl(rawUrl, {
+      mode: "exchange",
+      fetcher: () => Promise.resolve(Response.json({}, { status: failureCase.status })),
+    });
+    assert.equal(failureOf(result).code, failureCase.expectedCode);
+  }
+
+  const unavailable = await resolveConnectExchangeUrl(rawUrl, {
+    mode: "preview",
+    fetcher: () => Promise.reject(new Error("offline")),
+  });
+  assert.equal(failureOf(unavailable).code, "unavailable");
+});
+
+test("rejects tampering, algorithm confusion, and unknown keys", () => {
+  const token = mint(claims());
+  const [header, , signature] = token.split(".");
+  const forged = Buffer.from(JSON.stringify(claims({
+    den: { baseUrl: "https://evil.example.com" },
+  }))).toString("base64url");
+  assert.equal(failureOf(verifyAt(`${header}.${forged}.${signature}`)).code, "bad_signature");
+
+  for (const invalidHeader of [
+    { alg: "none", kid: KID },
+    { alg: "HS256", kid: KID },
+    { alg: "EdDSA", kid: KID, crit: ["exp"] },
+  ]) {
+    assert.equal(verifyAt(mint(claims(), invalidHeader)).ok, false);
+  }
+  assert.equal(failureOf(verifyAt(mint(claims(), { alg: "EdDSA", kid: "other" }))).code, "unknown_kid");
+});
+
+test("enforces time and HTTPS policies", () => {
+  const token = mint(claims());
+  assert.equal(verifyAt(token, NOW + 72 * 3600 + 30).ok, true);
+  assert.equal(failureOf(verifyAt(token, NOW + 72 * 3600 + 61)).code, "expired");
+  assert.equal(failureOf(verifyAt(token, NOW - 61)).code, "not_yet_valid");
+
+  const intranet = mint(claims({ den: { baseUrl: "http://intranet.example.com" } }));
+  assert.equal(failureOf(verifyAt(intranet, NOW, { allowInsecureLoopback: true })).code, "insecure_url");
+  const loopback = mint(claims({ den: { baseUrl: "http://127.0.0.1:8790" } }));
+  assert.equal(verifyAt(loopback).ok, false);
+  assert.equal(verifyAt(loopback, NOW, { allowInsecureLoopback: true }).ok, true);
+});
+
+test("replay guard is persistent, atomic, and bounded", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "connect-link-test-"));
+  const filePath = path.join(dir, "seen.json");
+  const guard = createConnectLinkReplayGuard({ filePath });
+  assert.equal(await guard.remember("jti-1"), true);
+  assert.equal(await guard.remember("jti-1"), false);
+
+  const reloaded = createConnectLinkReplayGuard({ filePath });
+  assert.equal(await reloaded.has("jti-1"), true);
+  const concurrent = await Promise.all([
+    reloaded.remember("jti-concurrent"),
+    reloaded.remember("jti-concurrent"),
+  ]);
+  assert.deepEqual(concurrent.sort(), [false, true]);
+
+  for (let index = 0; index < 520; index += 1) {
+    await reloaded.remember(`jti-fill-${index}`);
+  }
+  const persisted = JSON.parse(await readFile(filePath, "utf8"));
+  assert.ok(persisted.length <= 512);
+});