Cheng Zhou
604 lines
31 KiB
JavaScript
604 lines
31 KiB
JavaScript
import { readdir, readFile } from "node:fs/promises";
|
|
import { extname, relative, resolve } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const frontendDir = fileURLToPath(new URL("../", import.meta.url));
|
|
const rootDir = resolve(frontendDir, "..");
|
|
const sourceDir = resolve(frontendDir, "src");
|
|
const tauriDir = resolve(frontendDir, "src-tauri");
|
|
const failures = [];
|
|
|
|
const readJson = async (path) => JSON.parse(await readFile(path, "utf8"));
|
|
|
|
const fail = (message) => failures.push(message);
|
|
const assert = (condition, message) => {
|
|
if (!condition) fail(message);
|
|
};
|
|
|
|
const walk = async (directory) => {
|
|
const entries = await readdir(directory, { withFileTypes: true });
|
|
return (
|
|
await Promise.all(
|
|
entries.map(async (entry) => {
|
|
const path = resolve(directory, entry.name);
|
|
return entry.isDirectory() ? walk(path) : path;
|
|
}),
|
|
)
|
|
).flat();
|
|
};
|
|
|
|
const permissionIdentifier = (permission) =>
|
|
typeof permission === "string" ? permission : typeof permission?.identifier === "string" ? permission.identifier : "";
|
|
const toPosixPath = (path) => path.split("\\").join("/");
|
|
const cspDirective = (csp, name) =>
|
|
csp
|
|
.split(";")
|
|
.map((directive) => directive.trim().split(/\s+/))
|
|
.find(([directiveName]) => directiveName === name)
|
|
?.slice(1) || [];
|
|
|
|
const assertPathScope = (permission, expectedPrefix, description) => {
|
|
const allow = Array.isArray(permission.allow) ? permission.allow : [];
|
|
assert(allow.length > 0, `${description} must define an explicit allow list.`);
|
|
for (const item of allow) {
|
|
const path = item?.path;
|
|
assert(
|
|
typeof path === "string" && path.startsWith(expectedPrefix),
|
|
`${description} may only allow paths under ${expectedPrefix}; found ${path ?? "<missing>"}.`,
|
|
);
|
|
}
|
|
};
|
|
|
|
const verifyTauriConfig = async () => {
|
|
const tauriConfig = await readJson(resolve(tauriDir, "tauri.conf.json"));
|
|
const targets = tauriConfig.bundle?.targets;
|
|
const targetList = Array.isArray(targets) ? targets : [targets].filter(Boolean);
|
|
const csp = tauriConfig.app?.security?.csp || "";
|
|
const cspTokens = csp.split(/[;\s]+/).filter(Boolean);
|
|
const mainWindow = tauriConfig.app?.windows?.find((window) => window.label === "main") || tauriConfig.app?.windows?.[0];
|
|
|
|
assert(tauriConfig.bundle?.active === true, "Tauri bundle must be active for desktop release builds.");
|
|
assert(targetList.includes("app"), "Tauri bundle targets must include app.");
|
|
assert(targetList.includes("dmg"), "Tauri bundle targets must include dmg for macOS distribution.");
|
|
assert(
|
|
tauriConfig.bundle?.createUpdaterArtifacts === true,
|
|
"Tauri must create signed updater artifacts for formal desktop release builds.",
|
|
);
|
|
assert(
|
|
typeof tauriConfig.plugins?.updater?.pubkey === "string" && tauriConfig.plugins.updater.pubkey.length > 80,
|
|
"Tauri updater public key must be configured.",
|
|
);
|
|
assert(csp.includes("default-src 'self'"), "Tauri CSP must keep default-src restricted to self.");
|
|
assert(csp.includes("object-src 'none'"), "Tauri CSP must disable object-src.");
|
|
assert(!csp.includes("'unsafe-eval'"), "Tauri CSP must not allow unsafe-eval.");
|
|
assert(
|
|
!cspTokens.some((token) => token === "*" || token.includes("://*")),
|
|
"Tauri CSP must not use wildcard sources.",
|
|
);
|
|
assert(!/\bconnect-src\b[^;]*\bhttp:\b/.test(csp), "Tauri CSP must not allow broad http: API access.");
|
|
const scriptSources = cspDirective(csp, "script-src");
|
|
const frameSources = cspDirective(csp, "frame-src");
|
|
assert(
|
|
scriptSources.length === 1 && scriptSources[0] === "'self'",
|
|
"Tauri script-src must remain self-only when ONLYOFFICE preview is enabled.",
|
|
);
|
|
assert(
|
|
JSON.stringify(frameSources) ===
|
|
JSON.stringify(["'self'", "blob:", "https:", "http://localhost:*", "http://127.0.0.1:*"]),
|
|
"Tauri frame-src may only add HTTPS and local development servers for the isolated ONLYOFFICE host.",
|
|
);
|
|
assert(mainWindow?.minWidth === 1180, "Main desktop window must keep the minimum width at 1180.");
|
|
assert(mainWindow?.minHeight === 760, "Main desktop window must keep the minimum height at 760.");
|
|
assert(mainWindow?.decorations === true, "Main desktop window must keep native window decorations enabled.");
|
|
assert(mainWindow?.titleBarStyle === "Overlay", "Main desktop window must use the macOS overlay title bar.");
|
|
assert(mainWindow?.hiddenTitle === true, "Main desktop window must hide the native title text.");
|
|
assert(mainWindow?.backgroundColor === "#f9fafb", "Main desktop window must use a non-black WebView background.");
|
|
assert(
|
|
mainWindow?.backgroundThrottling === "disabled",
|
|
"Main desktop window must disable background suspend to avoid macOS resume black flashes.",
|
|
);
|
|
assert(
|
|
mainWindow?.trafficLightPosition?.x === 16 && mainWindow?.trafficLightPosition?.y === 18,
|
|
"Main desktop window must keep traffic light controls at x=16 y=18.",
|
|
);
|
|
};
|
|
|
|
const verifyCapabilities = async () => {
|
|
const capabilitiesDir = resolve(tauriDir, "capabilities");
|
|
const files = (await readdir(capabilitiesDir)).filter((file) => file.endsWith(".json"));
|
|
assert(files.length > 0, "At least one Tauri capability file must exist.");
|
|
|
|
const bannedPermissions = new Set([
|
|
"shell:default",
|
|
"shell:allow-open",
|
|
"shell:allow-execute",
|
|
"fs:default",
|
|
"fs:allow-read-dir",
|
|
"fs:allow-read-text-file",
|
|
"fs:allow-write-text-file",
|
|
"notification:default",
|
|
"opener:default",
|
|
"opener:allow-open-url",
|
|
"opener:allow-reveal-item-in-dir",
|
|
"updater:default",
|
|
"updater:allow-check",
|
|
"updater:allow-download",
|
|
"updater:allow-install",
|
|
"updater:allow-download-and-install",
|
|
]);
|
|
const requiredNotificationPermissions = [
|
|
"notification:allow-is-permission-granted",
|
|
"notification:allow-request-permission",
|
|
"notification:allow-notify",
|
|
];
|
|
const requiredTemporaryFilePermissions = [
|
|
"fs:allow-read-file",
|
|
"fs:allow-write-file",
|
|
"fs:allow-mkdir",
|
|
"fs:allow-remove",
|
|
];
|
|
|
|
for (const file of files) {
|
|
const capability = await readJson(resolve(capabilitiesDir, file));
|
|
assert(!capability.remote, `${file}: remote origins must not receive Tauri capabilities.`);
|
|
assert(
|
|
Array.isArray(capability.windows) && capability.windows.length === 1 && capability.windows[0] === "main",
|
|
`${file}: capabilities must remain scoped to the main local window.`,
|
|
);
|
|
const permissions = Array.isArray(capability.permissions) ? capability.permissions : [];
|
|
const identifiers = permissions.map(permissionIdentifier).filter(Boolean);
|
|
|
|
for (const identifier of identifiers) {
|
|
assert(!identifier.startsWith("shell:"), `${file}: shell permissions are not allowed.`);
|
|
assert(!bannedPermissions.has(identifier), `${file}: ${identifier} is not allowed for CTMS Desktop.`);
|
|
assert(!identifier.includes("persisted-scope"), `${file}: persisted filesystem scopes are not allowed.`);
|
|
assert(!identifier.startsWith("updater:"), `${file}: updater permissions must not be exposed directly to WebView.`);
|
|
if (identifier.startsWith("notification:")) {
|
|
assert(
|
|
requiredNotificationPermissions.includes(identifier),
|
|
`${file}: notification permission ${identifier} is broader than the CTMS Desktop notification boundary.`,
|
|
);
|
|
}
|
|
if (identifier.startsWith("core:window:")) {
|
|
fail(`${file}: window permissions are not allowed; use Tauri overlay drag regions instead.`);
|
|
}
|
|
if (identifier.startsWith("opener:")) {
|
|
assert(identifier === "opener:allow-open-path", `${file}: opener permission ${identifier} is not allowed.`);
|
|
}
|
|
}
|
|
for (const identifier of requiredNotificationPermissions) {
|
|
assert(identifiers.includes(identifier), `${file}: missing ${identifier}.`);
|
|
}
|
|
for (const identifier of requiredTemporaryFilePermissions) {
|
|
assert(identifiers.includes(identifier), `${file}: missing ${identifier}.`);
|
|
}
|
|
|
|
const fsScope = permissions.find((permission) => permissionIdentifier(permission) === "fs:scope");
|
|
assert(Boolean(fsScope), `${file}: fs:scope is required and must be constrained to temporary files.`);
|
|
if (fsScope && typeof fsScope !== "string") {
|
|
assertPathScope(fsScope, "$TEMP/ctms-desktop/", `${file}: fs:scope`);
|
|
}
|
|
|
|
const openerScope = permissions.find((permission) => permissionIdentifier(permission) === "opener:allow-open-path");
|
|
assert(Boolean(openerScope), `${file}: opener:allow-open-path must be explicitly scoped.`);
|
|
if (openerScope && typeof openerScope !== "string") {
|
|
assertPathScope(openerScope, "$TEMP/ctms-desktop/", `${file}: opener:allow-open-path`);
|
|
}
|
|
}
|
|
};
|
|
|
|
const verifyOnlyOfficeBoundary = async () => {
|
|
const runtimeSource = await readFile(resolve(sourceDir, "runtime/onlyoffice.ts"), "utf8");
|
|
const pageSource = await readFile(resolve(sourceDir, "views/OfficePreviewWorkspace.vue"), "utf8");
|
|
const viewerSource = await readFile(resolve(sourceDir, "components/OnlyOfficeViewer.vue"), "utf8");
|
|
const apiSource = await readFile(resolve(sourceDir, "api/onlyoffice.ts"), "utf8");
|
|
const hostSource = await readFile(resolve(frontendDir, "public/onlyoffice-host.js"), "utf8");
|
|
|
|
assert(runtimeSource.includes('ONLYOFFICE_HOST_PATH = "/onlyoffice-host.html"'), "ONLYOFFICE host path must remain fixed.");
|
|
assert(runtimeSource.includes("resolveApiBaseUrl()"), "ONLYOFFICE host must derive from the validated runtime server base URL.");
|
|
assert(!runtimeSource.includes("url:"), "ONLYOFFICE runtime URL resolver must not accept a business-provided URL.");
|
|
assert(pageSource.includes("response.data.host_path !== ONLYOFFICE_HOST_PATH"), "ONLYOFFICE config host path must be checked against the fixed host path.");
|
|
assert(pageSource.includes("onDeactivated") && pageSource.includes("destroyViewer()"), "ONLYOFFICE viewer must be destroyed when a desktop task is deactivated.");
|
|
assert(viewerSource.includes("event.source !== frameWindow"), "ONLYOFFICE bridge must validate the message source window.");
|
|
assert(viewerSource.includes("event.origin !== hostUrl.origin"), "ONLYOFFICE bridge must validate message origin.");
|
|
assert(viewerSource.includes("message.nonce !== nonce"), "ONLYOFFICE bridge must validate its in-memory nonce.");
|
|
assert(hostSource.includes("event.source !== window.parent"), "ONLYOFFICE host must only accept parent-window messages.");
|
|
assert(hostSource.includes("!isAllowedParentOrigin(event.origin)"), "ONLYOFFICE host must validate the parent origin.");
|
|
assert(hostSource.includes("initialized ||"), "ONLYOFFICE host must only accept one initialization.");
|
|
assert(hostSource.includes("message?.nonce"), "ONLYOFFICE host must require the in-memory nonce.");
|
|
assert(hostSource.includes("url.origin !== window.location.origin"), "ONLYOFFICE save-as URL must remain same-origin.");
|
|
assert(hostSource.includes('url.pathname.startsWith("/onlyoffice/")'), "ONLYOFFICE save-as URL must remain under the fixed proxy path.");
|
|
assert(hostSource.includes("postToParent(MESSAGE.SAVE_AS, { fileType, title, mimeType, data }, [data])"), "ONLYOFFICE save-as bridge must transfer validated file bytes.");
|
|
assert(!hostSource.includes("postToParent(MESSAGE.SAVE_AS, { fileType, title, url"), "ONLYOFFICE save-as bridge must not expose the signed result URL to business pages.");
|
|
assert(viewerSource.includes("allowSaveAs: props.allowSaveAs"), "ONLYOFFICE save-as must stay behind an explicit server capability.");
|
|
assert(!/\b(?:localStorage|sessionStorage|console\.)\b/.test(hostSource), "ONLYOFFICE host must not persist or log signed configuration.");
|
|
assert(apiSource.includes("cache: false"), "ONLYOFFICE signed config must not enter the desktop data cache.");
|
|
assert(apiSource.includes("disableRequestDedupe: true"), "ONLYOFFICE signed config requests must not be deduplicated.");
|
|
};
|
|
|
|
const verifyRustBoundary = async () => {
|
|
const libSource = await readFile(resolve(tauriDir, "src/lib.rs"), "utf8");
|
|
const forbiddenRust = ["tauri_plugin_shell", "std::process::Command", "std::process"];
|
|
for (const token of forbiddenRust) {
|
|
assert(!libSource.includes(token), `Rust desktop boundary must not include ${token}.`);
|
|
}
|
|
|
|
const singleInstanceIndex = libSource.indexOf("tauri_plugin_single_instance::init");
|
|
const dialogIndex = libSource.indexOf("tauri_plugin_dialog::init");
|
|
assert(singleInstanceIndex >= 0, "Single-instance plugin must be registered.");
|
|
assert(
|
|
dialogIndex < 0 || singleInstanceIndex < dialogIndex,
|
|
"Single-instance plugin must be registered before other desktop plugins.",
|
|
);
|
|
const singleInstanceSource = libSource.slice(
|
|
singleInstanceIndex,
|
|
dialogIndex > singleInstanceIndex ? dialogIndex : singleInstanceIndex + 600,
|
|
);
|
|
const restoreWindowStart = libSource.indexOf("fn restore_main_window");
|
|
const restoreWindowEnd = libSource.indexOf("fn is_allowed_shortcut_key", restoreWindowStart);
|
|
const restoreWindowSource = libSource.slice(restoreWindowStart, restoreWindowEnd);
|
|
const restoreWindowTokens = ['get_webview_window("main")', "window.unminimize()", "window.show()", "window.set_focus()"];
|
|
assert(restoreWindowStart >= 0, "Desktop runtime must define a shared main-window restore helper.");
|
|
assert(
|
|
singleInstanceSource.includes("restore_main_window(app)"),
|
|
"Single-instance duplicate launch handler must use the shared main-window restore helper.",
|
|
);
|
|
for (const token of restoreWindowTokens) {
|
|
assert(restoreWindowSource.includes(token), `Main-window restore helper must call ${token}.`);
|
|
}
|
|
assert(
|
|
restoreWindowSource.indexOf("window.unminimize()") < restoreWindowSource.indexOf("window.show()") &&
|
|
restoreWindowSource.indexOf("window.show()") < restoreWindowSource.indexOf("window.set_focus()"),
|
|
"Main-window restore helper must restore, show, then focus the main window.",
|
|
);
|
|
assert(libSource.includes("RunEvent::Reopen"), "macOS Dock reopen events must restore the main window.");
|
|
assert(libSource.includes("WebviewWindowBuilder::from_config"), "Dock reopen must rebuild a main window that was actually closed.");
|
|
assert(libSource.includes('find(|config| config.label == "main")'), "Main-window rebuild must use only the configured main window.");
|
|
assert(!libSource.includes("WindowEvent::CloseRequested"), "The macOS red close button must keep its native close-window semantics.");
|
|
assert(!libSource.includes("api.prevent_close()"), "The macOS red close button must not be converted into a hide action.");
|
|
assert(!libSource.includes("window.hide()"), "The macOS red close button must not hide the main window.");
|
|
|
|
const appMenuIndex = libSource.indexOf('package.name.clone()');
|
|
const fileMenuIndex = libSource.indexOf('"文件"');
|
|
assert(appMenuIndex >= 0 && appMenuIndex < fileMenuIndex, "macOS application menu must precede the File menu.");
|
|
for (const token of [
|
|
'Some("关于 CTMS")',
|
|
"short_version: Some(String::new())",
|
|
"icon: handle.default_window_icon().cloned()",
|
|
'"ctms.desktop.preferences"',
|
|
"PredefinedMenuItem::services",
|
|
"PredefinedMenuItem::hide",
|
|
"PredefinedMenuItem::hide_others",
|
|
"PredefinedMenuItem::show_all",
|
|
"PredefinedMenuItem::quit",
|
|
"WINDOW_SUBMENU_ID",
|
|
"HELP_SUBMENU_ID",
|
|
"TOGGLE_SIDEBAR_COMMAND_ID",
|
|
'"显示/隐藏导航栏"',
|
|
]) {
|
|
assert(libSource.includes(token), `Desktop menu must include ${token}.`);
|
|
}
|
|
|
|
const handlerSource = libSource.match(/generate_handler!\s*\\?\[([\s\S]*?)\]/)?.[1] || "";
|
|
const commands = handlerSource
|
|
.split(",")
|
|
.map((command) => command.trim())
|
|
.filter(Boolean);
|
|
const allowedCommands = [
|
|
"credentials::credential_get",
|
|
"credentials::credential_set",
|
|
"credentials::credential_delete",
|
|
"credentials::login_credential_get",
|
|
"credentials::login_credential_set",
|
|
"credentials::login_credential_delete",
|
|
"updates::desktop_update_check",
|
|
"updates::desktop_update_install",
|
|
"desktop_menu_set_shortcuts",
|
|
"desktop_window_set_theme",
|
|
"desktop_window_get_fullscreen",
|
|
"desktop_window_set_fullscreen",
|
|
];
|
|
const unexpected = commands.filter((command) => !allowedCommands.includes(command));
|
|
const missing = allowedCommands.filter((command) => !commands.includes(command));
|
|
assert(unexpected.length === 0, `Unexpected Tauri commands: ${unexpected.join(", ") || "<none>"}.`);
|
|
assert(missing.length === 0, `Missing expected Tauri commands: ${missing.join(", ") || "<none>"}.`);
|
|
assert(libSource.includes("window.is_fullscreen()"), "Desktop fullscreen state must be read from the native window.");
|
|
assert(libSource.includes(".set_fullscreen(fullscreen)"), "Desktop fullscreen changes must target the native window.");
|
|
assert(libSource.includes("DESKTOP_FULLSCREEN_CHANGED_EVENT"), "Native fullscreen state must be emitted back to the WebView.");
|
|
};
|
|
|
|
const verifyDesktopUiNativeSync = async () => {
|
|
const menuSource = await readFile(resolve(sourceDir, "runtime/desktopMenu.ts"), "utf8");
|
|
const preferencesSource = await readFile(resolve(sourceDir, "runtime/desktopUiPreferences.ts"), "utf8");
|
|
const fullscreenSource = await readFile(resolve(sourceDir, "runtime/webFullscreen.ts"), "utf8");
|
|
const appSource = await readFile(resolve(sourceDir, "App.vue"), "utf8");
|
|
|
|
assert(menuSource.includes('invoke("desktop_menu_set_shortcuts"'), "Desktop shortcuts must sync through the controlled Tauri command.");
|
|
assert(menuSource.includes("DESKTOP_SHORTCUTS_CHANGED_EVENT"), "Native menu shortcuts must track preference changes.");
|
|
assert(preferencesSource.includes('"system" | "light" | "dark"'), "Desktop theme must support following the system appearance.");
|
|
assert(preferencesSource.includes('invoke("desktop_window_set_theme"'), "Desktop window theme must sync through the controlled Tauri command.");
|
|
assert(fullscreenSource.includes('invoke<boolean>("desktop_window_get_fullscreen"'), "Desktop fullscreen state must use the controlled Tauri query command.");
|
|
assert(fullscreenSource.includes('invoke<boolean>("desktop_window_set_fullscreen"'), "Desktop fullscreen changes must use the controlled Tauri mutation command.");
|
|
assert(fullscreenSource.includes("ctms:desktop-fullscreen-changed"), "Desktop fullscreen changes must synchronize native window state back to the WebView.");
|
|
assert(preferencesSource.includes('matchMedia("(prefers-color-scheme: dark)")'), "System theme changes must update the WebView appearance.");
|
|
assert(appSource.includes("initializeDesktopThemePreference()"), "Desktop theme synchronization must initialize at app startup.");
|
|
assert(appSource.includes("initializeDesktopMenuShortcutSync()"), "Native menu shortcut synchronization must initialize at app startup.");
|
|
};
|
|
|
|
const verifySourceSafety = async () => {
|
|
const sourceExtensions = new Set([".ts", ".tsx", ".vue", ".js", ".jsx", ".rs"]);
|
|
const files = [
|
|
...(await walk(sourceDir)),
|
|
...(await walk(resolve(tauriDir, "src"))),
|
|
].filter((path) => sourceExtensions.has(extname(path)));
|
|
|
|
for (const path of files) {
|
|
const source = await readFile(path, "utf8");
|
|
const file = toPosixPath(relative(rootDir, path));
|
|
const isRuntimeFile = file.startsWith("frontend/src/runtime/");
|
|
assert(!/[?&](?:token|access_token)=/i.test(source), `${file}: token must not be passed through query parameters.`);
|
|
assert(
|
|
!/console\.(log|debug|info|warn|error)\s*\([^)]*(?:token|access_token|authorization|bearer)/i.test(source),
|
|
`${file}: token-related values must not be written to console logs.`,
|
|
);
|
|
if (source.includes("ctms_token") && file !== "frontend/src/runtime/secureSessionStorage.ts") {
|
|
fail(`${file}: ctms_token may only be handled by secureSessionStorage.`);
|
|
}
|
|
assert(
|
|
!/(?:localStorage|sessionStorage)\.setItem\([^)]*password/i.test(source),
|
|
`${file}: passwords must not be written to browser storage.`,
|
|
);
|
|
if (source.includes("sendNotification") && file !== "frontend/src/runtime/notifications.ts") {
|
|
fail(`${file}: system notifications must be routed through frontend/src/runtime/notifications.ts.`);
|
|
}
|
|
if (!isRuntimeFile) {
|
|
assert(
|
|
!/\bindexedDB\b|\bcaches\.open\s*\(|\bCacheStorage\b|\bsqlite\b/i.test(source),
|
|
`${file}: local data cache storage must be routed through frontend/src/runtime.`,
|
|
);
|
|
}
|
|
}
|
|
};
|
|
|
|
const verifyNotificationBoundary = async () => {
|
|
const source = await readFile(resolve(sourceDir, "runtime/notifications.ts"), "utf8");
|
|
assert(source.includes('title: "CTMS 待办提醒"'), "Desktop notification title must stay generic.");
|
|
assert(source.includes('body: "有新的业务提醒待查看"'), "Desktop notification body must stay generic.");
|
|
assert(!/showSystemNotification\s*=\s*async\s*\([^)]*[a-zA-Z]/.test(source), "Desktop notification body must not accept dynamic business content.");
|
|
};
|
|
|
|
const verifySessionBoundary = async () => {
|
|
const source = await readFile(resolve(sourceDir, "session/sessionManager.ts"), "utf8");
|
|
const tokenBroadcastIndex = source.indexOf('message.type === "TOKEN_UPDATED"');
|
|
const storageBroadcastIndex = source.indexOf('localStorage.setItem("ctms_auth_broadcast"');
|
|
|
|
assert(tokenBroadcastIndex >= 0, "Session manager must branch TOKEN_UPDATED broadcasts before storage fallback.");
|
|
assert(storageBroadcastIndex >= 0, "Session manager must keep storage fallback for non-token auth broadcasts.");
|
|
assert(
|
|
tokenBroadcastIndex >= 0 && storageBroadcastIndex >= 0 && tokenBroadcastIndex < storageBroadcastIndex,
|
|
"Session manager must not persist TOKEN_UPDATED payloads through localStorage broadcast fallback.",
|
|
);
|
|
};
|
|
|
|
const verifyUpdaterBoundary = async () => {
|
|
const source = await readFile(resolve(tauriDir, "src/updates.rs"), "utf8");
|
|
assert(source.includes('join("desktop-updates/stable/latest.json")'), "Desktop updater must derive the fixed stable latest.json path.");
|
|
assert(source.includes("desktop updates require HTTPS outside localhost"), "Desktop updater must reject non-local HTTP update feeds.");
|
|
assert(source.includes("server origin must not include credentials"), "Desktop updater must reject server origins that include credentials.");
|
|
};
|
|
|
|
const verifyDesktopServerConfigurationBoundary = async () => {
|
|
const source = await readFile(resolve(sourceDir, "runtime/desktopServerConfig.ts"), "utf8");
|
|
assert(
|
|
source.includes("import.meta.env.VITE_DESKTOP_SERVER_URL"),
|
|
"Desktop server defaults must come from VITE_DESKTOP_SERVER_URL.",
|
|
);
|
|
assert(!source.includes("ctms.huapont.cn"), "The production CTMS origin must not be hard-coded in Desktop runtime source.");
|
|
assert(
|
|
source.includes("getStoredDesktopServerUrl() || getDefaultDesktopServerUrl()"),
|
|
"A manually stored Desktop server URL must override the build-time default.",
|
|
);
|
|
};
|
|
|
|
const verifyWorkflowGates = async () => {
|
|
const packageInfo = await readJson(resolve(frontendDir, "package.json"));
|
|
assert(packageInfo.engines?.node === ">=22.13.0", "package.json must require Node.js >=22.13.0.");
|
|
const requiredScripts = [
|
|
"desktop:build:macos-release",
|
|
"desktop:build:macos-unsigned-release",
|
|
"desktop:build:windows-release",
|
|
"desktop:release-policy:check",
|
|
"desktop:release-provenance:create",
|
|
"desktop:update-feed:create",
|
|
"desktop:update-feed:check",
|
|
"desktop:release-readiness:check",
|
|
"release:env:check",
|
|
];
|
|
|
|
for (const script of requiredScripts) {
|
|
assert(Boolean(packageInfo.scripts?.[script]), `package.json must define ${script}.`);
|
|
}
|
|
|
|
const provenanceSource = await readFile(resolve(frontendDir, "scripts/create-desktop-release-provenance.mjs"), "utf8");
|
|
assert(provenanceSource.includes('"macos-first"'), "Release provenance must support the approved v0.1.0 macOS-first stage.");
|
|
assert(
|
|
provenanceSource.includes("withheld-pending-combined-verification"),
|
|
"Staged macOS provenance must record that updater feed activation is withheld.",
|
|
);
|
|
const windowsPendingNotice = await readFile(resolve(frontendDir, "desktop-release-windows-pending.txt"), "utf8");
|
|
assert(
|
|
windowsPendingNotice.includes("same immutable v0.1.0 tag") && windowsPendingNotice.includes("latest.json is intentionally withheld"),
|
|
"The staged v0.1.0 private release evidence must include an explicit Windows-pending and updater-feed notice.",
|
|
);
|
|
|
|
const releasePolicy = await readJson(resolve(frontendDir, "desktop-release-policy.json"));
|
|
assert(releasePolicy.schemaVersion === 1, "Desktop release policy schemaVersion must be 1.");
|
|
assert(
|
|
releasePolicy.defaultPlatformSigningMode === "signed",
|
|
"Desktop release policy must default future versions to signed platform releases.",
|
|
);
|
|
assert(releasePolicy.updaterSigningRequired === true, "Desktop release policy must require updater signing.");
|
|
const currentUnsignedException = releasePolicy.unsignedPlatformExceptions?.find(
|
|
(exception) => exception.version === packageInfo.version,
|
|
);
|
|
if (packageInfo.version === "0.1.0") {
|
|
assert(Boolean(currentUnsignedException), "Desktop release policy must record the approved v0.1.0 exception.");
|
|
assert(
|
|
currentUnsignedException?.macosLocalExactTagFallback === true &&
|
|
currentUnsignedException?.windowsDelivery === "deferred-same-tag" &&
|
|
currentUnsignedException?.updaterFeedActivation === "after-combined-platform-verification" &&
|
|
currentUnsignedException?.githubReleaseAssetProfile === "installer-and-checksum-only" &&
|
|
currentUnsignedException?.stagedEvidenceRetention === "private-until-updater-publish" &&
|
|
currentUnsignedException?.updaterArtifactPublishTarget === "anonymous-https-origin",
|
|
"The v0.1.0 exception must constrain local macOS staging, deferred Windows delivery, visible GitHub assets, private evidence retention, and updater publication.",
|
|
);
|
|
}
|
|
if (currentUnsignedException) {
|
|
assert(
|
|
currentUnsignedException.macos === "ad-hoc" && currentUnsignedException.windows === "unsigned",
|
|
`The v${packageInfo.version} exception must use macOS ad-hoc and unsigned Windows modes.`,
|
|
);
|
|
}
|
|
|
|
const workflow = await readFile(resolve(rootDir, ".github/workflows/client-quality-gates.yml"), "utf8");
|
|
const requiredCommands = [
|
|
"npm run version:check",
|
|
"npm run runtime:check",
|
|
"npm run desktop:release:check",
|
|
"npm run ui:contract",
|
|
"npm run type-check",
|
|
"npm run test:unit",
|
|
"npm run build",
|
|
"npm run desktop:build:app",
|
|
"npm run release:env:check",
|
|
];
|
|
|
|
for (const command of requiredCommands) {
|
|
assert(workflow.includes(command), `Client quality gates workflow must run ${command}.`);
|
|
}
|
|
assert(workflow.includes("VITE_BUILD_CHANNEL"), "Client quality gates workflow must inject VITE_BUILD_CHANNEL.");
|
|
assert(workflow.includes("VITE_BUILD_COMMIT"), "Client quality gates workflow must inject VITE_BUILD_COMMIT.");
|
|
assert(workflow.includes("VITE_DESKTOP_SERVER_URL"), "Client quality gates workflow must inject VITE_DESKTOP_SERVER_URL.");
|
|
assert(workflow.match(/node-version: "22\.13"/g)?.length === 2, "Client quality gates must use Node.js 22.13 for Web and Desktop jobs.");
|
|
|
|
const releaseWorkflow = await readFile(resolve(rootDir, ".github/workflows/desktop-release-candidate.yml"), "utf8");
|
|
const requiredReleaseWorkflowTokens = [
|
|
"runs-on: macos-latest",
|
|
"runs-on: windows-latest",
|
|
"REQUIRE_DESKTOP_SIGNING",
|
|
"REQUIRE_WINDOWS_SIGNING",
|
|
"REQUIRE_UPDATER_SIGNING",
|
|
"ALLOW_UNSIGNED_PLATFORM_RELEASE",
|
|
"DESKTOP_PLATFORM_SIGNING_MODE",
|
|
"desktop:release-policy:check",
|
|
"desktop:build:macos-unsigned-release",
|
|
"Signature=adhoc",
|
|
'"NotSigned"',
|
|
"UNSIGNED-PLATFORM",
|
|
"DESKTOP-RELEASE-PROVENANCE.json",
|
|
"--require-provenance",
|
|
"TAURI_SIGNING_PRIVATE_KEY",
|
|
"VITE_DESKTOP_SERVER_URL",
|
|
"APPLE_ID",
|
|
"APPLE_PASSWORD",
|
|
"APPLE_TEAM_ID",
|
|
"WINDOWS_CERTIFICATE",
|
|
"WINDOWS_CERTIFICATE_PASSWORD",
|
|
"WINDOWS_TIMESTAMP_URL",
|
|
"npm audit",
|
|
"npm run desktop:build:macos-release",
|
|
"npm run desktop:build:windows-release",
|
|
"Get-AuthenticodeSignature",
|
|
"EnhancedKeyUsageList",
|
|
"TimeStamperCertificate",
|
|
".nsis.zip",
|
|
"npm run desktop:update-feed:create",
|
|
"--platform-artifact",
|
|
"npm run desktop:update-feed:check",
|
|
"--require-platform windows-x86_64",
|
|
"npm run desktop:release-readiness:check",
|
|
"actions/download-artifact",
|
|
"actions/upload-artifact",
|
|
];
|
|
|
|
for (const token of requiredReleaseWorkflowTokens) {
|
|
assert(releaseWorkflow.includes(token), `Desktop release candidate workflow must include ${token}.`);
|
|
}
|
|
assert(releaseWorkflow.includes('node-version: "22.13"'), "Desktop release candidates must use Node.js 22.13.");
|
|
|
|
const windowsInternalWorkflow = await readFile(resolve(rootDir, ".github/workflows/desktop-windows-internal.yml"), "utf8");
|
|
const requiredWindowsInternalWorkflowTokens = [
|
|
"workflow_dispatch",
|
|
"runs-on: windows-latest",
|
|
"VITE_BUILD_CHANNEL",
|
|
"VITE_BUILD_COMMIT",
|
|
"VITE_DESKTOP_SERVER_URL",
|
|
"npm run release:env:check",
|
|
"npm run version:check",
|
|
"npm run runtime:check",
|
|
"npm run desktop:release:check",
|
|
"npm run ui:contract",
|
|
"npm run type-check",
|
|
"npm run test:unit",
|
|
"npm run build",
|
|
"npm run desktop:build",
|
|
"createUpdaterArtifacts",
|
|
"false",
|
|
"--bundles nsis",
|
|
"SHA256SUMS.txt",
|
|
"actions/upload-artifact",
|
|
];
|
|
|
|
for (const token of requiredWindowsInternalWorkflowTokens) {
|
|
assert(windowsInternalWorkflow.includes(token), `Desktop Windows internal workflow must include ${token}.`);
|
|
}
|
|
|
|
const forbiddenWindowsInternalWorkflowTokens = [
|
|
"desktop:update-feed:create",
|
|
"desktop:update-feed:check",
|
|
"desktop:release-readiness:check",
|
|
"TAURI_SIGNING_PRIVATE_KEY",
|
|
"REQUIRE_DESKTOP_SIGNING",
|
|
"latest.json",
|
|
];
|
|
|
|
for (const token of forbiddenWindowsInternalWorkflowTokens) {
|
|
assert(!windowsInternalWorkflow.includes(token), `Desktop Windows internal workflow must not include ${token}.`);
|
|
}
|
|
assert(windowsInternalWorkflow.includes('node-version: "22.13"'), "Desktop Windows internal builds must use Node.js 22.13.");
|
|
|
|
for (const dockerfile of [resolve(frontendDir, "Dockerfile"), resolve(rootDir, "nginx/Dockerfile")]) {
|
|
const dockerSource = await readFile(dockerfile, "utf8");
|
|
assert(dockerSource.startsWith("FROM node:22.13-alpine"), `${relative(rootDir, dockerfile)} must build with Node.js 22.13.`);
|
|
}
|
|
|
|
const developmentCompose = await readFile(resolve(rootDir, "docker-compose.dev.yaml"), "utf8");
|
|
assert(developmentCompose.includes("image: node:22.13-alpine"), "Development frontend container must use Node.js 22.13.");
|
|
assert(developmentCompose.includes('dependency_hash="$$lock_hash:$$(node --version)"'), "Development dependency cache must include the Node.js version.");
|
|
assert(developmentCompose.includes("pdfjs-dist"), "Development dependency checks must include PDF.js.");
|
|
assert(
|
|
developmentCompose.includes("frontend_node_modules_node22:/app/node_modules") &&
|
|
developmentCompose.includes("frontend_node_modules_node22:"),
|
|
"Development dependencies must use the Node.js 22-specific volume.",
|
|
);
|
|
};
|
|
|
|
await verifyTauriConfig();
|
|
await verifyCapabilities();
|
|
await verifyRustBoundary();
|
|
await verifyDesktopUiNativeSync();
|
|
await verifySourceSafety();
|
|
await verifyNotificationBoundary();
|
|
await verifySessionBoundary();
|
|
await verifyUpdaterBoundary();
|
|
await verifyDesktopServerConfigurationBoundary();
|
|
await verifyOnlyOfficeBoundary();
|
|
await verifyWorkflowGates();
|
|
|
|
if (failures.length > 0) {
|
|
console.error(`Desktop release gate failed:\n${failures.map((item) => ` - ${item}`).join("\n")}`);
|
|
process.exitCode = 1;
|
|
} else {
|
|
console.log("Desktop release gate passed.");
|
|
}
|