81 lines
2.6 KiB
TypeScript
81 lines
2.6 KiB
TypeScript
import { mkdtemp, rm } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
|
|
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
|
|
import { writeAnalysisSnapshot } from "../src/application/AnalysisSnapshotFiles.js";
|
|
import { runDirectAnalysis } from "../src/application/DirectAnalysis.js";
|
|
import type { AnalysisSnapshot } from "../src/domain/analysisSnapshot.js";
|
|
import { parseBinaryTarget } from "../src/domain/binaryTarget.js";
|
|
import { createEvidence } from "../src/domain/evidence.js";
|
|
import { createEvidenceBundle } from "../src/domain/evidenceBundle.js";
|
|
import { permissionAuthorityForRoot } from "./fixtures/permissionAuthority.js";
|
|
|
|
let directory: string | undefined;
|
|
|
|
afterEach(async () => {
|
|
vi.unstubAllEnvs();
|
|
if (directory !== undefined)
|
|
await rm(directory, { recursive: true, force: true });
|
|
directory = undefined;
|
|
});
|
|
|
|
describe("direct analysis snapshot permissions", () => {
|
|
it("replays a cache hit with snapshot read authority only", async () => {
|
|
directory = await mkdtemp(join(tmpdir(), "rea-direct-snapshot-"));
|
|
const snapshotPath = join(directory, "analysis.json");
|
|
const target = await parseBinaryTarget(process.execPath);
|
|
if (!target.ok) throw target.error;
|
|
const provider = {
|
|
id: "rea-workflow",
|
|
name: "REA composed investigation workflow",
|
|
version: "1",
|
|
} as const;
|
|
const evidence = createEvidence(target.value, provider, {
|
|
operation: "binary_overview",
|
|
parameters: {},
|
|
result: { cached: true },
|
|
});
|
|
const snapshot: AnalysisSnapshot = {
|
|
snapshot_version: 1,
|
|
target: {
|
|
sha256: target.value.sha256,
|
|
format: target.value.format,
|
|
architecture: target.value.architecture ?? null,
|
|
loader_args: [...target.value.loaderArgs],
|
|
},
|
|
entries: [],
|
|
evidence_bundle: createEvidenceBundle([evidence]),
|
|
};
|
|
const policy = {
|
|
roots: [directory],
|
|
maxBytes: 1024 * 1024,
|
|
maxDepth: 64,
|
|
maxStringLength: 1024,
|
|
maxNodes: 10_000,
|
|
};
|
|
expect(
|
|
(await writeAnalysisSnapshot(snapshot, snapshotPath, false, policy)).ok,
|
|
).toBe(true);
|
|
const authority = await permissionAuthorityForRoot(
|
|
directory,
|
|
["snapshot_read", "snapshot_write"],
|
|
["snapshot_read"],
|
|
);
|
|
vi.stubEnv("REA_ANALYSIS_SNAPSHOT_ROOTS_JSON", JSON.stringify([directory]));
|
|
|
|
await expect(
|
|
runDirectAnalysis(
|
|
process.execPath,
|
|
"binary_overview",
|
|
{},
|
|
{
|
|
snapshotPath,
|
|
permissionAuthority: authority,
|
|
},
|
|
),
|
|
).resolves.toEqual(evidence);
|
|
});
|
|
});
|