@furongjun1999/dsh-memory 0.4.4 → 0.4.6

package/md_cg/test_p21_tokens.py

@@ -0,0 +1,270 @@
+# -*- coding: utf-8 -*-
+"""令牌与角色权职分离端到端测试（P21）。
+
+验证目标：
+  ① fail-closed：无令牌只读、坏令牌拒绝启动
+  ② 设计者载体：签发 → 全权（管理 + 保护层 + 核心私有内容）
+  ③ 派生收窄：子令牌权限只能更小（层/op/密级/管理权）
+  ④ 核心私有内容：非设计者角色写 private 密级 / anchor·self 层被拒
+  ⑤ 委派链：子令牌不可再派生；父吊销级联子令牌
+  ⑥ op 作用域：只读角色执行 write/review 被拒
+
+运行：python -m md_cg.test_p21_tokens
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+from . import tokens
+from .mdcos import MdCGSecure
+from .security import AccessDenied
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def denied(fn, *a, **kw):
+    """执行 fn，返回 (是否被拒, 错误文本)。"""
+    try:
+        fn(*a, **kw)
+        return False, ""
+    except AccessDenied as e:
+        return True, str(e)
+    except tokens.TokenError as e:
+        return True, str(e)
+
+
+class _Mcp:
+    """最小 MCP stdio 客户端（测试用）。"""
+
+    def __init__(self, env):
+        self.p = subprocess.Popen(
+            [sys.executable, "-m", "md_cg.mcp_server"],
+            stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+            text=True, encoding="utf-8", env=env,
+            cwd=os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+        self.i = 0
+        self.send("initialize", {"protocolVersion": "2024-11-05", "capabilities": {},
+                                 "clientInfo": {"name": "p21", "version": "1"}})
+        self.send("notifications/initialized", {}, notify=True)
+
+    def send(self, method, params=None, notify=False):
+        msg = {"jsonrpc": "2.0", "method": method}
+        if params is not None:
+            msg["params"] = params
+        if not notify:
+            self.i += 1
+            msg["id"] = self.i
+        self.p.stdin.write(json.dumps(msg, ensure_ascii=False) + "\n")
+        self.p.stdin.flush()
+        if notify:
+            return None
+        line = self.p.stdout.readline()
+        if not line:
+            raise RuntimeError("MCP 无响应：" + (self.p.stderr.read() or "")[:400])
+        return json.loads(line)
+
+    def call(self, name, args):
+        r = self.send("tools/call", {"name": name, "arguments": args})
+        if "error" in r:
+            return {"error": str(r["error"])}
+        return json.loads(r["result"]["content"][0]["text"])
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *a):
+        try:
+            self.send("shutdown")
+            self.p.wait(timeout=10)
+        except Exception:                     # noqa: BLE001
+            self.p.kill()
+
+
+def main():
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    root = tempfile.mkdtemp(prefix="mdcg_p21_")
+    tf = os.path.join(root, "_tokens.json")
+    kek = os.urandom(32)
+    try:
+        # ---------------- ① 设计者载体 ----------------
+        print("\n[1] 设计者权限载体（外部用户指定）")
+        d = tokens.issue("designer", actor="codebuddy-designer",
+                         label="设计者载体", path=tf)
+        check("签发设计者令牌", d["ok"] and d["token"].startswith("mdcg1.designer."),
+              d["token"][:24] + "…")
+        dp = tokens.verify_token(d["token"], path=tf)
+        check("设计者身份可校验", dp.role == "designer" and dp.can_admin is True,
+              f"role={dp.role} admin={dp.can_admin} clearance={dp.clearance}")
+        cg = MdCGSecure(os.path.join(root, "cg"), principal=dp, master_key=kek)
+        check("设计者可写 anchor 保护层",
+              bool(cg.add("n_anchor", "身份锚点：设计者载体", layer="anchor",
+                          sensitivity="private")))
+        check("设计者可写核心私有内容",
+              bool(cg.add("n_priv", "私有核心内容", layer="knowledge",
+                          sensitivity="secret")))
+
+        # ---------------- ② 派生收窄 ----------------
+        print("\n[2] 派生受限子令牌（子代理权职分离）")
+        v = tokens.derive(d["token"], "verifier", actor="codebuddy-verifier",
+                          label="验证单元", path=tf)
+        check("派生 verifier 子令牌", v["ok"] and v["parent"] == d["token_id"],
+              f"parent={v.get('parent')} clamped={v.get('clamped')}")
+        vp = tokens.verify_token(v["token"], path=tf)
+        check("子令牌权限已收窄",
+              vp.can_admin is False and vp.clearance == "internal"
+              and set(vp.layers_allow or []) <= {"rejected", "contextual"},
+              f"layers={vp.layers_allow} clearance={vp.clearance}")
+        vcg = MdCGSecure(os.path.join(root, "cg"), principal=vp, master_key=kek)
+
+        ok, why = denied(vcg.add, "n_bad", "越权写事实层", layer="knowledge")
+        check("验证单元写 knowledge 层被拒", ok, why[:70])
+        ok, why = denied(vcg.add, "n_self", "越权写自我层", layer="self")
+        check("验证单元写 self 层被拒", ok, why[:70])
+        ok, why = denied(vcg.add, "n_p", "越权私有", layer="rejected",
+                         sensitivity="private")
+        check("验证单元写 private 密级被拒（核心私有内容）", ok, why[:70])
+        check("验证单元可写 rejected 层（职责内）",
+              bool(vcg.add_rejected("假设X", "被实测证伪", sensitivity="internal")))
+        ok, why = denied(vcg.review_decide, "prop_x", "accept", reason="自证")
+        check("验证单元无审核裁决权", ok, why[:70])
+
+        ok, why = denied(tokens.derive, v["token"], "recorder", path=tf)
+        check("子令牌不可再派生（委派链封口）", ok, why[:70])
+        ok, why = denied(tokens.verify_token, d["token"][:-4] + "dead", path=tf)
+        check("篡改令牌密钥被拒", ok, why[:70])
+
+        # ---------------- ③ 其他角色职责 ----------------
+        print("\n[3] 各单元职责边界")
+        r = tokens.issue("recorder", actor="recorder", path=tf)
+        rp = tokens.verify_token(r["token"], path=tf)
+        rcg = MdCGSecure(os.path.join(root, "cg"), principal=rp, master_key=kek)
+        check("记录单元可写 knowledge 层",
+              bool(rcg.add("n_k", "事实条目", layer="knowledge")))
+        ok, why = denied(rcg.add, "n_a", "越权", layer="anchor")
+        check("记录单元写 anchor 层被拒", ok, why[:70])
+
+        o = tokens.issue("output", actor="viewer", path=tf)
+        op_ = tokens.verify_token(o["token"], path=tf)
+        ocg = MdCGSecure(os.path.join(root, "cg"), principal=op_, master_key=kek)
+        ok, why = denied(ocg.add, "n_o", "只读角色写入")
+        check("输出单元写入被拒", ok, why[:70])
+        ok, why = denied(op_.require_op, "write")
+        check("输出单元执行 write op 被拒", ok, why[:70])
+        check("输出单元可读", ocg.get("n_k") is not None)
+
+        g = tokens.issue("guest", actor="anon", path=tf)
+        gp = tokens.verify_token(g["token"], path=tf)
+        check("访客只读且不可管理",
+              gp.can_write is False and gp.can_admin is False
+              and gp.clearance == "internal")
+
+        # ---------------- ④ 过期 / 吊销 / 级联 ----------------
+        print("\n[4] 生命周期")
+        e = tokens.issue("recorder", actor="tmp", ttl=0.05, path=tf)
+        time.sleep(0.12)
+        ok, why = denied(tokens.verify_token, e["token"], path=tf)
+        check("过期令牌被拒", ok, why[:70])
+
+        tokens.revoke(d["token_id"], path=tf)
+        ok1, _ = denied(tokens.verify_token, d["token"], path=tf)
+        ok2, _ = denied(tokens.verify_token, v["token"], path=tf)
+        check("吊销父令牌级联失效子令牌", ok1 and ok2,
+              "父与子均不可用")
+        check("清单默认不含已吊销",
+              all(t["token_id"] != d["token_id"] for t in tokens.list_tokens(path=tf)))
+
+        # ---------------- ⑤ 与 identity 五大单元同源（防漂移） ----------------
+        print("\n[5] 与 identity.POSITIONS 同源校验")
+        from .identity import POSITIONS
+        drift = []
+        for pos, meta in POSITIONS.items():
+            spec = tokens.ROLE_SPECS.get(pos)
+            if not spec:
+                drift.append(f"缺角色 {pos}")
+            elif spec["unit"] != meta["unit"] or meta["duty"] not in spec["duty"]:
+                drift.append(f"{pos}: unit/duty 与 identity 不一致")
+        check("五大单元命名与职责与 identity 同源", not drift,
+              "；".join(drift) or "/".join(tokens.POSITION_ROLES))
+        check("别名解析可用",
+              tokens.role_spec("verifier")["label"] == "验证单元"
+              and tokens.role_spec("recorder")["unit"] == "记录单元"
+              and tokens.role_spec("reflection")["effect"] == "新")
+
+        # ---------------- ⑥ MCP 进程层：fail-closed 与作用域闸门 ----------------
+        print("\n[6] MCP 进程层（令牌优先 / fail-closed）")
+        env = dict(os.environ)
+        env.update({"MDCG_ROOT": os.path.join(root, "mcp"), "MDCG_TOKEN_FILE": tf,
+                    "MDCG_SUSTAIN": "0", "PYTHONIOENCODING": "utf-8"})
+        for k in ("MDCG_TOKEN", "MDCG_LEGACY_ENV_AUTH", "MDCG_CAN_ADMIN",
+                  "MDCG_CAN_WRITE", "MDCG_CLEARANCE", "MDCG_ACTOR"):
+            env.pop(k, None)
+
+        bad = dict(env)
+        bad["MDCG_TOKEN"] = "mdcg1.designer.tk_zzzzzz.bad-secret"
+        rc = subprocess.run([sys.executable, "-m", "md_cg.mcp_server"], env=bad,
+                            capture_output=True, text=True, encoding="utf-8",
+                            timeout=90)
+        check("坏令牌拒绝启动（fail-closed，退出码 3）", rc.returncode == 3,
+              ((rc.stderr or "").strip().splitlines() or [""])[0][:80])
+
+        d2 = tokens.issue("designer", actor="mcp-designer", path=tf)
+        v2 = tokens.derive(d2["token"], "verifier", actor="mcp-verify", path=tf)
+        venv = dict(env)
+        venv["MDCG_TOKEN"] = v2["token"]
+        with _Mcp(venv) as m:
+            who = m.call("cg", {"op": "info"}).get("whoami", {}).get("principal", {})
+            check("令牌身份注入进程", who.get("role") == "verify"
+                  and who.get("auth_mode") == "token",
+                  f"role={who.get('role')} admin={who.get('can_admin')}")
+            r = m.call("cg", {"op": "write", "node_id": "mcp_k", "content": "越权事实",
+                              "layer": "knowledge"})
+            check("验证单元经 MCP 写事实层被拒", "error" in r, str(r.get("error"))[:70])
+            r = m.call("cg", {"op": "review", "action": "list"})
+            check("验证单元经 MCP 调用 review op 被拒", "error" in r,
+                  str(r.get("error"))[:70])
+            r = m.call("cg", {"op": "write", "node_id": "mcp_rej", "content": "证伪记录",
+                              "layer": "rejected"})
+            check("验证单元经 MCP 写 rejected 层放行", r.get("ok") is True
+                  or r.get("id"), str(r)[:70])
+
+        aenv = dict(env)
+        aenv["MDCG_TOKEN"] = d2["token"]
+        with _Mcp(aenv) as m:
+            who = m.call("cg", {"op": "info"}).get("whoami", {}).get("principal", {})
+            check("设计者令牌经 MCP 获得管理权",
+                  who.get("role") == "designer" and who.get("can_admin") is True,
+                  f"role={who.get('role')} admin={who.get('can_admin')}")
+            r = m.call("cg", {"op": "write", "node_id": "mcp_priv",
+                              "content": "核心私有内容", "layer": "knowledge",
+                              "sensitivity": "secret"})
+            check("设计者可经 MCP 写核心私有内容", r.get("ok") is True or r.get("id"),
+                  str(r)[:70])
+    finally:
+        shutil.rmtree(root, ignore_errors=True)
+
+    print(f"\n通过 {PASS} / 失败 {FAIL}")
+    if FAILS:
+        print("失败项：" + "，".join(FAILS))
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_p22_theory.py

@@ -0,0 +1,175 @@
+# -*- coding: utf-8 -*-
+"""版本层端到端测试（P22 · 蜂群互联层0）。
+
+验证目标：
+  ① 声明与校验：未声明 / 合法声明 / 封缄被篡改 / schema 不符 / 版本不在认可集合
+  ② fail-closed：theory_ok=False → 写操作与管理操作**全拒**（只读降级）
+  ③ 唯一核心权限：theory op 仅 designer 可达，其余角色 op 作用域外
+  ④ 审计链：版本跃迁写入 audit
+  ⑤ CLI：`python -m md_cg.theory check` 可用
+
+运行：python -m md_cg.test_p22_theory
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+from . import theory, tokens
+from .security import AccessDenied, Principal
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def denied(fn, *a, **kw):
+    """执行 fn，返回 (是否被拒, 错误文本)。"""
+    try:
+        fn(*a, **kw)
+        return False, ""
+    except (AccessDenied, tokens.TokenError) as e:
+        return True, str(e)
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_theory_")
+    tf = os.path.join(tmp, "theory.json")
+    root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    try:
+        # ---------- ① 未声明（放行，不阻断既有部署） ----------
+        st = theory.check(tf)
+        check("未声明 → 按默认版本放行",
+              st["theory_ok"] is True and st.get("auto") is True, st["reason"])
+        check("未声明 reason 可归因", "未声明" in st["reason"], st["reason"])
+
+        # ---------- ①b ensure：无声明则落盘（声明常态化） ----------
+        st = theory.ensure(tf)
+        check("ensure → 落盘声明", os.path.exists(tf))
+        check("ensure → theory_ok=True", st["theory_ok"] is True, st["reason"])
+        v_before = st["version"]
+        theory.ensure(tf)
+        check("ensure 幂等（不覆盖已有声明）",
+              theory.check(tf)["version"] == v_before)
+
+        # ---------- ② 合法声明 ----------
+        r = theory.declare("3.4", accepted=["3.4", "3.3"], actor="designer",
+                           path=tf)
+        check("declare → ok", r["ok"] is True)
+        check("declare → theory_ok=True", r["status"]["theory_ok"] is True,
+              r["status"]["reason"])
+        check("声明含自身版本", "3.4" in r["status"]["accepted_versions"],
+              str(r["status"]["accepted_versions"]))
+        check("声明文件已落盘", os.path.exists(tf))
+        check("声明含封缄字段",
+              bool((theory.load(tf) or {}).get("declaration_hash")))
+
+        # ---------- ③ 封缄被篡改 ----------
+        raw = theory.load(tf)
+        raw["theory_version"] = "9.9"          # 改内容不改封缄
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(raw, f, ensure_ascii=False)
+        st = theory.check(tf)
+        check("篡改版本号 → 校验失败", st["theory_ok"] is False, st["reason"])
+        check("篡改 reason 指向封缄", "篡改" in st["reason"], st["reason"])
+
+        # ---------- ④ 重新声明即恢复（版本更新权的修复入口） ----------
+        theory.declare("3.4", accepted=["3.4"], path=tf)
+        check("重新声明 → 恢复", theory.check(tf)["theory_ok"] is True)
+
+        # ---------- ⑤ 版本不在认可集合（封缄合法） ----------
+        bad = theory.seal({"schema": theory.SCHEMA, "theory_version": "9.9",
+                           "accepted_versions": ["3.4"], "declared_by": "x",
+                           "declared_at": time.time()})
+        st = theory.check(tf, decl=bad)
+        check("版本不在认可集合 → 失败", st["theory_ok"] is False, st["reason"])
+        check("集合 reason 可归因", "不在认可集合" in st["reason"], st["reason"])
+
+        # ---------- ⑥ schema 不符 ----------
+        bad2 = dict(bad)
+        bad2["schema"] = 99
+        st = theory.check(tf, decl=theory.seal(bad2))
+        check("schema 不符 → 失败", st["theory_ok"] is False, st["reason"])
+        check("schema reason 可归因", "schema" in st["reason"], st["reason"])
+
+        # ---------- ⑦ 审计链 ----------
+        theory.declare("3.5", accepted=["3.5"], path=tf)
+        theory.declare("3.6", accepted=["3.6"], path=tf)
+        decl = theory.load(tf)
+        audit = decl.get("audit") or []
+        check("audit 记录版本跃迁", len(audit) >= 2, str(audit))
+        check("audit 末条指向当前版本",
+              bool(audit) and audit[-1].get("to") == "3.6", str(audit[-1:]))
+
+        # ---------- ⑧ fail-closed：写 / 管理全拒 ----------
+        blocked = Principal(actor="designer", role="designer", can_write=True,
+                            can_admin=True, ops_allow=("*",), theory_ok=False)
+        w_dn, w_msg = denied(blocked.require_write, "internal")
+        check("theory_ok=False → 写被拒", w_dn, w_msg)
+        check("写拒绝原因指向版本层", "版本层" in w_msg, w_msg)
+        a_dn, a_msg = denied(blocked.require_admin, "scrub")
+        check("theory_ok=False → 管理被拒", a_dn, a_msg)
+        check("管理拒绝原因指向版本层", "版本层" in a_msg, a_msg)
+
+        allowed = Principal(actor="designer", role="designer", can_write=True,
+                            can_admin=True, ops_allow=("*",), theory_ok=True)
+        ok_w, _ = denied(allowed.require_write, "internal")
+        check("theory_ok=True → 写放行", ok_w is False)
+        ok_a, _ = denied(allowed.require_admin, "scrub")
+        check("theory_ok=True → 管理放行", ok_a is False)
+
+        # ---------- ⑨ 唯一核心权限：theory op 仅 designer ----------
+        check("ALL_OPS 含 theory", "theory" in tokens.ALL_OPS)
+        for role, spec in tokens.ROLE_SPECS.items():
+            ops = spec.get("ops_allow") or ()
+            if role == "designer":
+                check("designer 可执行 theory", "*" in ops, str(ops))
+                continue
+            check(f"{role} 的 ops_allow 不含 theory", "theory" not in ops,
+                  str(ops))
+            p = Principal(role=role, ops_allow=ops, theory_ok=True)
+            dn, msg = denied(p.require_op, "theory")
+            check(f"{role} 执行 theory 被拒", dn, msg)
+
+        # ---------- ⑩ whoami 暴露版本层 ----------
+        d = allowed.as_dict()
+        check("whoami 含 theory_ok",
+              "theory_ok" in d and d["theory_ok"] is True, str(d.get("theory_ok")))
+        check("whoami 含 theory_version", "theory_version" in d)
+
+        # ---------- ⑪ CLI 可用 ----------
+        r = subprocess.run(
+            [sys.executable, "-m", "md_cg.theory", "check"],
+            env={**os.environ, "MDCG_THEORY_FILE": tf},
+            cwd=root, capture_output=True, text=True,
+            encoding="utf-8", errors="replace", timeout=120)
+        check("CLI check 退出码 0", r.returncode == 0, (r.stderr or "")[:200])
+        check("CLI 输出 theory_ok=True", '"theory_ok": true' in r.stdout,
+              (r.stdout or "")[:200])
+
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print(f"\nP22 版本层：{PASS} passed, {FAIL} failed")
+    if FAILS:
+        print("失败项：" + "、".join(FAILS))
+    return 1 if FAIL else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())