@oj-module/cli 0.2.6 → 0.2.14

package/src/market/__tests__/bootstrap.test.ts

@@ -0,0 +1,204 @@
+// market/bootstrap spec（T8）：隔离站点自举——「试装不心疼」的物理基础。
+//
+// 钉死隔离六项（端口 / DB / 密钥 / 凭据 / 信任库 / CDN 目录）逐项与真站点物理分离：
+// 任一项漏掉，trial 就不再是「隔离试装」而是「往自己工程里装」，信任库污染与端口
+// 冲突都是不可逆后果。故每条断言都直接查文件系统与配置内容，不靠口头约定。
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { bootstrapIsolatedSite } from "../bootstrap";
+
+/** 假 oj 进程：不起真进程，ready 立即就绪（与 dev.ts 的 ojStarter 注入同形态） */
+function fakeStarter() {
+	const started: Array<{ configPath: string, base: string, apiSrc: string }> = [];
+	const starter = (configPath: string, base: string, apiSrc: string) => {
+		started.push({ configPath, base, apiSrc });
+		return {
+			port: Number(/port: (\d+)/.exec(readFileSync(configPath, "utf-8"))?.[1] ?? "0"),
+			ready: Promise.resolve(),
+			stop: () => Promise.resolve(),
+		};
+	};
+	return { started, starter };
+}
+
+/** 造一个「有 oj 二进制与模板」的源工程：bin/oj + bin/plugins + api/config.yaml + api/src */
+function newSourceProject(): string {
+	const root = mkdtempSync(join(tmpdir(), "ojm-bootstrap-src-"));
+	mkdirSync(join(root, "bin", "plugins"), { recursive: true });
+	writeFileSync(join(root, "bin", "oj"), "#!/bin/sh\necho fake-oj\n", { mode: 0o755 });
+	writeFileSync(join(root, "bin", ".oj-version"), "v0.1.84\n");
+	writeFileSync(join(root, "bin", "plugins", "auth.wasm"), "plugin", "utf-8");
+	mkdirSync(join(root, "api", "src", "_platform"), { recursive: true });
+	writeFileSync(join(root, "api", "src", "_platform", "seed.sql"), "-- seed\n", "utf-8");
+	writeFileSync(
+		join(root, "api", "config.yaml"),
+		[
+			"mounts:",
+			"  - prefix: /api",
+			"    api: src",
+			"server:",
+			"  host: 127.0.0.1",
+			"  port: 9778",
+			"  jwt_secret: __JWT_SECRET__",
+			"exec:",
+			"  _platform:",
+			"    allow: []",
+			"",
+		].join("\n"),
+		"utf-8",
+	);
+	return root;
+}
+
+describe("given 一个装了 oj 二进制的源工程 When 自举隔离站点", () => {
+	it("then 产物全在临时根内：api 树 / bin/oj / bin/plugins 各就各位", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		expect(existsSync(join(site.root, "api", "src", "_platform", "seed.sql"))).toBe(true);
+		expect(existsSync(join(site.root, "bin", "oj"))).toBe(true);
+		expect(existsSync(join(site.root, "bin", "plugins", "auth.wasm"))).toBe(true);
+		expect(site.root).not.toBe(src);
+		await site.cleanup();
+	});
+
+	it("then 端口取自空闲端口且绝不与源工程 config 的 9778 相同", async () => {
+		const src = newSourceProject();
+		const { started, starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		expect(site.port).toBeGreaterThan(1024);
+		expect(site.port).not.toBe(9778);
+		expect(started[0]?.configPath).toBe(join(site.root, "api", "config.yaml"));
+		const cfg = readFileSync(join(site.root, "api", "config.yaml"), "utf-8");
+		expect(cfg).toContain(`port: ${site.port}`);
+		await site.cleanup();
+	});
+
+	it("then jwt_secret 被随机替换（模板占位符不得残留）", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		const cfg = readFileSync(join(site.root, "api", "config.yaml"), "utf-8");
+		expect(cfg).not.toContain("__JWT_SECRET__");
+		await site.cleanup();
+	});
+
+	it("then CDN 目录在临时根内且已落好 fixture 包与索引", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, fixture: "demo-solution@0.1.0", starter });
+
+		expect(site.cdnDir.startsWith(site.root)).toBe(true);
+		expect(existsSync(join(site.cdnDir, "demo-solution-0.1.0.tgz"))).toBe(true);
+		expect(existsSync(join(site.cdnDir, "bundles.yaml"))).toBe(true);
+		expect(site.cdnBaseUrl).toBe(`${site.baseUrl}/cdn`);
+		await site.cleanup();
+	});
+
+	it("then 发布方私钥只在内存：临时根内 CDN 与站点树查不到发布方 PEM", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, fixture: "demo-solution@0.1.0", starter });
+
+		expect(site.publisher.privateKeyPem).toContain("PRIVATE KEY");
+		const pemFiles = listFiles(site.root).filter(f => f.endsWith(".pem"));
+		const outside = pemFiles.filter(f => !f.includes("api/config"));
+		expect(outside).toEqual([]);
+		await site.cleanup();
+	});
+
+	it("then 信任库隔离：临时根内无 .solutions 信任库文件", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		expect(existsSync(join(site.root, ".solutions"))).toBe(false);
+		expect(listFiles(site.root).some(f => f.includes("trusted-keys"))).toBe(false);
+		await site.cleanup();
+	});
+
+	it("then DB 隔离：库文件路径落在临时根内（config 目录相对解析）", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		expect(site.dbPath.startsWith(site.root)).toBe(true);
+		expect(site.dbPath).toContain("db.sqlite");
+		await site.cleanup();
+	});
+});
+
+describe("given 源工程没装 oj 二进制 When 自举", () => {
+	it("then 人话报错指向 ojm vendor，且不留半成品临时根", async () => {
+		const root = mkdtempSync(join(tmpdir(), "ojm-bootstrap-nooj-"));
+		mkdirSync(join(root, "api"), { recursive: true });
+		writeFileSync(join(root, "api", "config.yaml"), "server:\n  port: 9778\n", "utf-8");
+		const { starter } = fakeStarter();
+
+		await expect(bootstrapIsolatedSite({ projectRoot: root, starter }))
+			.rejects
+			.toThrow(/ojm vendor/);
+	});
+});
+
+describe("given 自举成功 When 执行 cleanup", () => {
+	it("then 临时根被销毁（默认不保留现场）", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		await site.cleanup();
+
+		expect(existsSync(site.root)).toBe(false);
+	});
+
+	it("then keep 模式下保留现场并打出销毁清单", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter, keep: true });
+
+		await site.cleanup();
+
+		expect(existsSync(site.root)).toBe(true);
+		expect(site.teardownReport().join("\n")).toContain(site.root);
+	});
+
+	it("then 重复 cleanup 幂等（不抛错）", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		await site.cleanup();
+		await expect(site.cleanup()).resolves.toBeUndefined();
+	});
+});
+
+/** 递归列出根下所有文件（相对路径） */
+function listFiles(root: string): string[] {
+	const out: string[] = [];
+	const walk = (dir: string, prefix: string) => {
+		for (const entry of readdirSync(dir)) {
+			const rel = prefix === "" ? entry : `${prefix}/${entry}`;
+			const abs = join(dir, entry);
+			if (statSync(abs).isDirectory())
+				walk(abs, rel);
+			else
+				out.push(rel);
+		}
+	};
+	walk(root, "");
+	return out;
+}

package/src/market/__tests__/build-index.test.ts

@@ -0,0 +1,154 @@
+// ojm market build-index spec（T4）：扫描 cdn/*.tgz → 全量重建 Form B 索引。
+//
+// 两条必守：① 结果只取决于目录里有什么（多次执行字节一致）；② bundles 的 file 必须逐字
+// `<name>-<version>.tgz`——安装侧 P2-11 会拿它挡索引投毒，写歪一个字符就会装不上。
+import { generateKeyPairSync } from "node:crypto";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { parse as yamlParse } from "yaml";
+
+import { createDeterministicTgz } from "../../deterministic-tar";
+import { verifyCanonical } from "../../lifecycle/sign";
+import { indexCanonical } from "../../publish";
+import { buildIndex } from "../build-index";
+import { buildFixturePackage } from "../fixture";
+
+const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
+const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
+const KEY_ID = "cdn.maintainer";
+
+function testPem(): string {
+	return generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+}
+
+function newProject(): { root: string, cdn: string } {
+	const root = mkdtempSync(join(tmpdir(), "ojm-market-index-"));
+	mkdirSync(join(root, "api"), { recursive: true });
+	writeFileSync(join(root, "api", "config.yaml"), CONFIG, "utf-8");
+	const cdn = join(root, "cdn");
+	mkdirSync(cdn, { recursive: true });
+	return { root, cdn };
+}
+
+/** 把一个 fixture 方案打进 cdn 目录，返回 tgz 文件名 */
+async function putPackage(cdn: string, staging: string, name: string, version: string): Promise<string> {
+	const pkg = buildFixturePackage({ stagingDir: staging, name, version });
+	const tgz = join(cdn, `${name}-${version}.tgz`);
+	await createDeterministicTgz(pkg.dir, tgz);
+	return `${name}-${version}.tgz`;
+}
+
+function readBundles(cdn: string): { solutions?: Array<Record<string, unknown>> } {
+	return yamlParse(readFileSync(join(cdn, "bundles.yaml"), "utf-8")) as { solutions?: Array<Record<string, unknown>> };
+}
+
+describe("given cdn/ 里有多个包与多个版本 When 重建索引", () => {
+	it("then 按 semver 聚合：版本全留、latest 取最大", async () => {
+		const { root, cdn } = newProject();
+		const staging = mkdtempSync(join(tmpdir(), "ojm-stage-"));
+		await putPackage(cdn, staging, "demo-solution", "0.1.0");
+		await putPackage(cdn, staging, "demo-solution", "0.2.0");
+		await putPackage(cdn, staging, "other-solution", "0.3.0");
+
+		const result = await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+
+		const bundles = readBundles(cdn);
+		expect(result.solutions).toBe(2);
+		const demo = bundles.solutions!.find(s => s.name === "demo-solution")!;
+		expect(demo.latest).toBe("0.2.0");
+		expect(demo.versions as unknown[]).toHaveLength(2);
+		const manifests = yamlParse(readFileSync(join(cdn, "manifests.yaml"), "utf-8")) as unknown[];
+		expect(manifests).toHaveLength(3);
+	});
+
+	it("then bundles 的 file 逐字为 <name>-<version>.tgz（安装侧 P2-11 加固前置）", async () => {
+		const { root, cdn } = newProject();
+		const staging = mkdtempSync(join(tmpdir(), "ojm-stage-"));
+		await putPackage(cdn, staging, "demo-solution", "0.1.0");
+
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+
+		const demo = readBundles(cdn).solutions![0]!;
+		const hit = (demo.versions as Array<Record<string, unknown>>)[0]!;
+		expect(hit.file).toBe("demo-solution-0.1.0.tgz");
+		expect(hit.sha256).toMatch(/^[0-9a-f]{64}$/);
+		expect(hit.size).toBeGreaterThan(0);
+	});
+
+	it("then 索引只取决于目录内容：连续两次执行字节一致（幂等）", async () => {
+		const { root, cdn } = newProject();
+		const staging = mkdtempSync(join(tmpdir(), "ojm-stage-"));
+		await putPackage(cdn, staging, "demo-solution", "0.1.0");
+		const key = testPem();
+
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: key });
+		const first = readFileSync(join(cdn, "bundles.yaml"), "utf-8");
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: key });
+		const second = readFileSync(join(cdn, "bundles.yaml"), "utf-8");
+
+		expect(second).toBe(first);
+	});
+});
+
+describe("given cdn/ 为空 When 重建索引", () => {
+	it("then 产出空索引（不是缺 Solutions 段）——空目录也能验、也能装", async () => {
+		const { root, cdn } = newProject();
+
+		const result = await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+
+		expect(result.solutions).toBe(0);
+		const bundles = readBundles(cdn);
+		expect(bundles.solutions).toEqual([]);
+		expect(yamlParse(readFileSync(join(cdn, "manifests.yaml"), "utf-8"))).toEqual([]);
+	});
+});
+
+describe("given cdn/ 里有一个没有内嵌 manifest 的包 When 重建索引", () => {
+	it("then 跳过该包并给出可读警告，其余包照常入索引", async () => {
+		const { root, cdn } = newProject();
+		const staging = mkdtempSync(join(tmpdir(), "ojm-stage-"));
+		writeFileSync(join(cdn, "broken-0.1.0.tgz"), "garbage-not-a-tgz", "utf-8");
+		await putPackage(cdn, staging, "demo-solution", "0.1.0");
+
+		const result = await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+
+		expect(result.skipped).toContain("broken-0.1.0.tgz");
+		expect(result.solutions).toBe(1);
+	});
+});
+
+describe("given 包带包级 .sig 侧车 When 重建索引", () => {
+	it("then manifests 的 archive.signature 带上它（否则安装器按 sig_missing 拒装）", async () => {
+		const { root, cdn } = newProject();
+		const staging = mkdtempSync(join(tmpdir(), "ojm-stage-"));
+		const file = await putPackage(cdn, staging, "demo-solution", "0.1.0");
+		writeFileSync(`${join(cdn, file)}.sig`, JSON.stringify({ alg: "Ed25519", key_id: KEY_ID, public_key: "ab", value: "cd", canon: "v1" }), "utf-8");
+
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+
+		const manifests = yamlParse(readFileSync(join(cdn, "manifests.yaml"), "utf-8")) as Array<Record<string, unknown>>;
+		const archive = manifests[0]!.archive as Record<string, unknown>;
+		expect(archive.signature).toMatchObject({ key_id: KEY_ID });
+	});
+});
+
+describe("given 给了签名身份 When 重建索引", () => {
+	it("then 两份索引各产出可复核的 .sig", async () => {
+		const { root, cdn } = newProject();
+		const staging = mkdtempSync(join(tmpdir(), "ojm-stage-"));
+		await putPackage(cdn, staging, "demo-solution", "0.1.0");
+
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+
+		for (const kind of ["bundles", "manifests"] as const) {
+			const sigPath = join(cdn, `${kind}.yaml.sig`);
+			expect(existsSync(sigPath)).toBe(true);
+			const sig = JSON.parse(readFileSync(sigPath, "utf-8")) as { public_key: string, value: string, key_id: string };
+			expect(sig.key_id).toBe(KEY_ID);
+			const text = readFileSync(join(cdn, `${kind}.yaml`), "utf-8");
+			expect(verifyCanonical(sig.public_key, indexCanonical(kind, text), sig.value)).toBe(true);
+		}
+	});
+});

package/src/market/__tests__/cdn-layout.test.ts

@@ -0,0 +1,96 @@
+// market CDN 布局 spec（T2）：cdn 目录与 `/cdn` 基址的单一真相。
+//
+// 逐条钉死「不许硬编码」——config 里的主机 / 端口 / 挂载路径任一改动，解析结果必须跟随。
+// 之所以值得单独一组用例：dev 形态下 `/cdn` 只在 oj 子进程（9778）上成立，
+// 一旦有人图省事写相对路径或硬编码端口，市场页拿到的会是 index.html 而不是 YAML
+// （设计 §3.1.1）。合规与否由这组用例兜住，而不是靠注释提醒。
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { CDN_MOUNT_PREFIX, resolveCdnLayout, resolveCdnLayoutFromConfig } from "../cdn-layout";
+
+// 绝对路径：真实调用里 configPath 是绝对的，这里不能拿相对路径假装（否则 path.resolve 会相对 cwd 解析）
+const PROJECT = resolve("proj", "my-app");
+const CONFIG_PATH = join(PROJECT, "api", "config.yaml");
+
+/** 拼一份 config：默认端口与主机取自模板实际值 */
+function configOf(mounts: string, server = "  host: 127.0.0.1\n  port: 9778"): string {
+	return `mounts:\n${mounts}server:\n${server}\n`;
+}
+
+const STD_MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
+
+describe("resolveCdnLayoutFromConfig：一切取值都跟随 config", () => {
+	it("given 模板默认挂载 When 解析 Then 目录在工程根 cdn/、基址无尾斜杠", () => {
+		const layout = resolveCdnLayoutFromConfig(configOf(STD_MOUNTS), CONFIG_PATH);
+
+		expect(layout.dir).toBe(join(PROJECT, "cdn"));
+		expect(layout.prefix).toBe(CDN_MOUNT_PREFIX);
+		expect(layout.baseUrl).toBe("http://127.0.0.1:9778/cdn");
+	});
+
+	it("given server.port 改成 9799 When 解析 Then 基址端口跟随（不硬编码 9778）", () => {
+		const layout = resolveCdnLayoutFromConfig(configOf(STD_MOUNTS, "  host: 127.0.0.1\n  port: 9799"), CONFIG_PATH);
+
+		expect(layout.baseUrl).toBe("http://127.0.0.1:9799/cdn");
+	});
+
+	it("given server.host 改成 127.0.0.2 When 解析 Then 基址主机跟随", () => {
+		const layout = resolveCdnLayoutFromConfig(configOf(STD_MOUNTS, "  host: 127.0.0.2\n  port: 9778"), CONFIG_PATH);
+
+		expect(layout.baseUrl).toBe("http://127.0.0.2:9778/cdn");
+	});
+
+	it("given 挂载的 web 改成 ../static-cdn When 解析 Then 目录跟随（单一真相在 config）", () => {
+		const mounts = "  - prefix: /cdn\n    web: ../static-cdn\n";
+
+		const layout = resolveCdnLayoutFromConfig(configOf(mounts), CONFIG_PATH);
+
+		expect(layout.dir).toBe(join(PROJECT, "static-cdn"));
+	});
+
+	it("given 挂载前缀带尾斜杠 When 解析 Then 前缀归一化掉尾斜杠（拼接口径统一）", () => {
+		const mounts = "  - prefix: /cdn/\n    web: ../cdn\n";
+
+		const layout = resolveCdnLayoutFromConfig(configOf(mounts), CONFIG_PATH);
+
+		expect(layout.prefix).toBe(CDN_MOUNT_PREFIX);
+		expect(layout.baseUrl).toBe("http://127.0.0.1:9778/cdn");
+	});
+});
+
+describe("resolveCdnLayoutFromConfig：出错要给得出手", () => {
+	it("given mounts 里没有 /cdn 条目 When 解析 Then 抛错且给出要粘回 config 的两行", () => {
+		const mounts = "  - prefix: /api\n    api: src\n";
+
+		expect(() => resolveCdnLayoutFromConfig(configOf(mounts), CONFIG_PATH)).toThrow(/cdn/);
+
+		try {
+			resolveCdnLayoutFromConfig(configOf(mounts), CONFIG_PATH);
+		}
+		catch (error) {
+			// 人话错误里必须给出可直接粘贴的挂载声明，而不是只抱怨
+			expect(String(error)).toContain("prefix: /cdn");
+			expect(String(error)).toContain("web: ../cdn");
+		}
+	});
+
+	it("given server.port 缺失 When 解析 Then 抛人话错误（与 oj-config.readOjPort 同口径）", () => {
+		expect(() => resolveCdnLayoutFromConfig(configOf(STD_MOUNTS, "  host: 127.0.0.1"), CONFIG_PATH)).toThrow(/server\.port/);
+	});
+});
+
+describe("resolveCdnLayout：从工程根出发", () => {
+	it("given 一个带 api/config.yaml 的工程 When 解析 Then 与文本版结果一致", () => {
+		const root = mkdtempSync(join(tmpdir(), "ojm-cdn-layout-"));
+		mkdirSync(join(root, "api"), { recursive: true });
+		writeFileSync(join(root, "api", "config.yaml"), configOf(STD_MOUNTS), "utf-8");
+
+		const layout = resolveCdnLayout(root);
+
+		expect(layout.dir).toBe(join(root, "cdn"));
+		expect(layout.baseUrl).toBe("http://127.0.0.1:9778/cdn");
+	});
+});

package/src/market/__tests__/failure-playbook.test.ts

@@ -0,0 +1,33 @@
+// market/failure-playbook spec（T12 收尾）：失败文案表的 traceability——
+// 每个 neg 场景预期命中的失败码都必须有双段式条目（成因 + 下一步），漏一条即失败。
+import { describe, expect, it } from "vitest";
+
+import { FAILURE_PLAYBOOK } from "../failure-playbook";
+
+/** 各 neg op 预期命中的失败码（补新 neg op 时同步加行，保持可追溯） */
+const REQUIRED_CODES = [
+	"sig_missing", // neg-nosig
+	"tampered", // neg-tamper
+	"unknown_key", // neg-stranger
+	"rollback_guard", // rollback
+	"index_sig", // neg-badindex
+	"zip_slip", // neg-evil
+] as const;
+
+describe("given 失败文案表 When 逐条核对", () => {
+	it("then 每个 neg 场景的预期失败码都有条目，且双段式字段非空", () => {
+		const byCode = new Map(FAILURE_PLAYBOOK.map(e => [e.code, e]));
+		for (const code of REQUIRED_CODES) {
+			const entry = byCode.get(code);
+			expect(entry, `缺失败码 ${code} 的文案条目`).toBeDefined();
+			expect(entry!.stage.trim()).not.toBe("");
+			expect(entry!.cause.trim()).not.toBe("");
+			expect(entry!.next.trim()).not.toBe("");
+		}
+	});
+
+	it("then code 无重复（表是字典不是日志）", () => {
+		const codes = FAILURE_PLAYBOOK.map(e => e.code);
+		expect(new Set(codes).size).toBe(codes.length);
+	});
+});

package/src/market/__tests__/fixture.test.ts

@@ -0,0 +1,48 @@
+// market/fixture spec（T12）：合成方案树的版本差异——迁移阶梯是 upgrade/rollback op 的物理前提。
+//
+// 0.2.0 起（minor ≥ 2）多一段 0002__more.sql：upgrade 必须真的多走一段迁移，
+// rollback 才有「包内最大 seq < 账本 head」可拦。确定性：同 name@version 输出恒同。
+import { mkdtempSync, readdirSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gunzipSync } from "node:zlib";
+import { describe, expect, it } from "vitest";
+
+import { buildEvilZipSlipTgz, buildFixturePackage } from "../fixture";
+
+describe("given 合成 fixture 方案树 When 看 migrations 目录", () => {
+	it("then 0.1.0 只有 0001（head 上限 1）", () => {
+		const pkg = buildFixturePackage({ stagingDir: mkdtempSync(join(tmpdir(), "ojm-fixture-")), name: "demo-solution", version: "0.1.0" });
+		expect(readdirSync(join(pkg.dir, "api", "demo-solution-0.1.0", "migrations")).sort()).toEqual(["0001__init.sql"]);
+	});
+
+	it("then 0.2.0 多一段 0002（升级真的多走一段迁移）", () => {
+		const pkg = buildFixturePackage({ stagingDir: mkdtempSync(join(tmpdir(), "ojm-fixture-")), name: "demo-solution", version: "0.2.0" });
+		const files = readdirSync(join(pkg.dir, "api", "demo-solution-0.2.0", "migrations")).sort();
+		expect(files).toEqual(["0001__init.sql", "0002__more.sql"]);
+		// 0001 与 0.1.0 逐字节一致（upgrade op 断言依据）
+		const pkg010 = buildFixturePackage({ stagingDir: mkdtempSync(join(tmpdir(), "ojm-fixture-")), name: "demo-solution", version: "0.1.0" });
+		expect(readFileSync(join(pkg.dir, "api", "demo-solution-0.2.0", "migrations", "0001__init.sql")))
+			.toEqual(readFileSync(join(pkg010.dir, "api", "demo-solution-0.1.0", "migrations", "0001__init.sql")));
+	});
+
+	it("then 0002 是合法 ALTER（作用于 fixture 声明的表）", () => {
+		const pkg = buildFixturePackage({ stagingDir: mkdtempSync(join(tmpdir(), "ojm-fixture-")), name: "demo-solution", version: "0.2.0" });
+		const sql = readFileSync(join(pkg.dir, "api", "demo-solution-0.2.0", "migrations", "0002__more.sql"), "utf-8");
+		expect(sql).toContain("ALTER TABLE demo_solution_note");
+	});
+});
+
+describe("given 手造 zip-slip 恶意 tgz When 检查字节", () => {
+	it("then 是合法 gzip/tar 且含 ../ 越界成员，同输入恒同字节（确定性）", () => {
+		const a = join(mkdtempSync(join(tmpdir(), "ojm-evil-")), "evil.tgz");
+		const b = join(mkdtempSync(join(tmpdir(), "ojm-evil-")), "evil.tgz");
+		buildEvilZipSlipTgz(a);
+		buildEvilZipSlipTgz(b);
+		const raw = readFileSync(a);
+		expect([raw[0], raw[1]]).toEqual([0x1F, 0x8B]); // gzip magic
+		expect(readFileSync(b)).toEqual(raw); // 确定性（mtime 置 0）
+		const tar = gunzipSync(raw).toString("utf-8");
+		expect(tar).toContain("../evil.sql"); // R1 必须能检出这个成员
+	});
+});

package/src/market/__tests__/publish.test.ts

@@ -0,0 +1,109 @@
+// ojm market publish spec（T3）：落包到 cdn/ —— 只产出 `.tgz` 与包级 `.tgz.sig`。
+//
+// 钉死 D-1 的职责边界：publish **不碰索引**（不得生成 bundles.yaml / manifests.yaml），
+// 也不得把私钥写进任何目录（私钥是否入盘由隔离场景纪律兜，这里断言 cdn 与暂存区无 PEM）。
+import { Buffer } from "node:buffer";
+import { generateKeyPairSync } from "node:crypto";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { verifyCanonical } from "../../lifecycle/sign";
+import { publishPackage } from "../publish";
+
+const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
+const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
+const KEY_ID = "demo.publisher";
+
+/** Ed25519 测试身份：私钥只在内存，路径从不落盘 */
+function testIdentity(): { privateKeyPem: string, publicKeyHex: string } {
+	const kp = generateKeyPairSync("ed25519");
+	return {
+		privateKeyPem: kp.privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+		publicKeyHex: Buffer.from(kp.publicKey.export({ format: "der", type: "spki" }).subarray(-32)).toString("hex"),
+	};
+}
+
+function newProject(): string {
+	const root = mkdtempSync(join(tmpdir(), "ojm-market-publish-"));
+	mkdirSync(join(root, "api"), { recursive: true });
+	writeFileSync(join(root, "api", "config.yaml"), CONFIG, "utf-8");
+	mkdirSync(join(root, "cdn"), { recursive: true });
+	return root;
+}
+
+describe("given cdn/ 为空 When 发布 fixture", () => {
+	it("then 产出包与其包级签名，且不碰索引", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+
+		const result = await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+
+		expect(existsSync(result.tgzPath)).toBe(true);
+		expect(existsSync(result.sigPath)).toBe(true);
+		// D-1：索引不是 publish 的事
+		expect(existsSync(join(root, "cdn", "bundles.yaml"))).toBe(false);
+		expect(existsSync(join(root, "cdn", "manifests.yaml"))).toBe(false);
+	});
+
+	it("then .sig 是可复核的合法 detached 签名（横向复核）", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+
+		const result = await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+		const sig = JSON.parse(readFileSync(result.sigPath, "utf-8")) as { key_id: string, public_key: string, value: string, canon: string };
+
+		expect(sig.key_id).toBe(KEY_ID);
+		expect(sig.public_key).toBe(identity.publicKeyHex);
+		expect(sig.canon).toBe("v1");
+		expect(verifyCanonical(sig.public_key, result.canonical, sig.value)).toBe(true);
+	});
+
+	it("then 私钥不落盘：cdn 与工程根都查不到 PEM", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+
+		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+
+		const pemInCdn = readdirSync(join(root, "cdn")).filter(f => f.endsWith(".pem"));
+		expect(pemInCdn).toEqual([]);
+	});
+});
+
+describe("given 同 name@version 再次发布", () => {
+	it("when 内容一致 Then 幂等覆盖（sha256 不变）", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+		const base = { projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem };
+
+		const first = await publishPackage(base);
+		const second = await publishPackage(base);
+
+		expect(second.sha256).toBe(first.sha256);
+		expect(second.tgzPath).toBe(first.tgzPath);
+	});
+
+	it("when 已有同版本文件但字节不同 Then 报冲突并提示升版本", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+		const target = join(root, "cdn", "demo-solution-0.1.0.tgz");
+		writeFileSync(target, "not-a-real-tgz-but-different-bytes", "utf-8");
+
+		await expect(publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem }))
+			.rejects
+			.toThrow(/version/);
+	});
+});
+
+describe("given 签名身份缺失 When 发布", () => {
+	it("then 抛人话错误，不产出半截包", async () => {
+		const root = newProject();
+
+		await expect(publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0" }))
+			.rejects
+			.toThrow(/-id/);
+
+		expect(existsSync(join(root, "cdn", "demo-solution-0.1.0.tgz"))).toBe(false);
+	});
+});