jason.woltje
068d868a99
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
36 lines
4.4 KiB
Python
36 lines
4.4 KiB
Python
from pathlib import Path
|
|
import json
|
|
root = Path('/mnt/storage/src/mosaic-stack-rocko-178')
|
|
out = Path(__file__).resolve().parent
|
|
cases = []
|
|
def add(name, path, before, after, test, pattern, check):
|
|
text = (root / path).read_text()
|
|
assert text.count(before) == 1, (name, text.count(before))
|
|
cases.append(dict(name=name, path=path, before=before, after=after, test=test, pattern=pattern, check=check))
|
|
serve = 'packages/webui/src/serve.mjs'
|
|
cli = 'packages/webui/src/cli.mjs'
|
|
http = 'packages/webui/tests/proof.test.mjs'
|
|
startup = 'packages/webui/tests/proof-cli.test.mjs'
|
|
service = 'scripts/webui-service.sh'
|
|
add('M01-auth-before-proof',serve,' // The proof precedes every auth-header read, including the wrong-Host fence.'," if (named && req.headersDistinct[preview.header]?.[0] !== preview.user) return json(res, 401, { error: 'sign-in required' });\n // The proof precedes every auth-header read, including the wrong-Host fence.",http,'refuses missing wrong short','proof refusal precedes auth')
|
|
add('M02-wrong-equal-length',serve,' || !timingSafeEqual(value, proof.value)','',http,'refuses missing wrong short','same-length incorrect proof refuses')
|
|
add('M03-missing-proof',serve,'if (!value || value.length !== proof.value.length || !timingSafeEqual(value, proof.value))','if (value && (value.length !== proof.value.length || !timingSafeEqual(value, proof.value)))',http,'refuses missing wrong short','absent proof refuses')
|
|
add('M04-loopback-proof',serve,'if (!named && values) return json','if (false) return json',http,'header is refused on other Hosts','proof on nonpublic Host refuses')
|
|
add('M05-mode-0644',serve,'[0o600, 0o400].includes(st.mode & 0o7777)','[0o600, 0o400, 0o644].includes(st.mode & 0o7777)',startup,'startup refuses','0644 file refused')
|
|
add('M06-log-refusal',serve,"return json(res, 401, { error: 'proxy proof required' });","log(proof.value.toString('ascii')); return json(res, 401, { error: 'proxy proof required' });",http,'refuses missing wrong short','refusal log never includes proof')
|
|
add('M07-no-follow',serve,' | constants.O_NOFOLLOW','',startup,'startup refuses','fixture symlink refused')
|
|
add('M08-owner',serve,' || st.uid !== process.getuid()','',startup,'startup refuses','another uid refused')
|
|
add('M09-line-bytes',serve,'line.length < 32 || /[^A-Za-z0-9_-]/.test(line)','false',startup,'startup refuses','short/newline/bad-byte file refused')
|
|
add('M10-duplicate-proof',serve,"values?.length === 1 ? Buffer.from(values[0], 'utf8') : null","values?.length ? Buffer.from(values[0], 'utf8') : null",http,'refuses missing wrong short','duplicate header refused')
|
|
add('M11-tester-proof',serve,'if (tester && testerProofHeader && Object.hasOwn(req.headers, testerProofHeader.toLowerCase()))','if (false)',http,'header is refused on other Hosts','tester proof header refused')
|
|
add('M12-main-wiring',cli,'preview: options.preview, proof, send,','preview: options.preview, send,',startup,'CLI applies proof','actual CLI main listener checks proof')
|
|
add('M13-tester-wiring',cli,'testerProofHeader: proof?.header ?? null,','',startup,'CLI applies proof','actual CLI tester rejects proof header')
|
|
add('M14-service-location',service,'case "$proof_path" in "$REPO"|"$REPO"/*|"$copies_path"|"$copies_path"/*) die "proxy proof file must be outside the repository and copies" ;; esac',':', 'packages/webui/tests/service.test.mjs','proxy proof render refuses','render refuses repository/copy path')
|
|
add('M15-service-propagation',service,'flags="$flags --proof-header $PROOF_HEADER --proof-file $PROOF_FILE"',':','packages/webui/tests/service.test.mjs','proxy proof render carries','render carries both flags')
|
|
add('M16-release-preservation','scripts/stack-release.sh',' RUN_CONSOLE=("${P_CONSOLE[@]}")',' RUN_CONSOLE=("${P_CONSOLE[@]:0:4}")','packages/cli/tests/stack-release.test.mjs','T178 proxy proof header','pointer/unit preserve pair through re-pin and rollback')
|
|
add('M17-render-no-open',service," proof_mode=\"$(stat -c '%a' -- \"$PROOF_FILE\")\""," cat -- \"$PROOF_FILE\" >/dev/null\n proof_mode=\"$(stat -c '%a' -- \"$PROOF_FILE\")\"",'render-no-open.py','','render never opens or reads the fixture')
|
|
cases[-1]['command']=['python3',str(out/'render-no-open.py')]
|
|
add('M18-proof-send-status',service,'( --proof-header [^ ]+ --proof-file /[^ ]+)?','','packages/webui/tests/service.test.mjs','proxy proof status','proof flags retain send-on status')
|
|
(out/'mutant-sites.json').write_text(json.dumps(cases, indent=2)+'\n')
|
|
print('PREFLIGHT', len(cases), 'exact-once sites')
|