dsh 0.2.0-rc.2: in-container update (experimental channel), path-agnostic compose, upstream patches adapted to 0.1.x/0.2.x

upstream/container/platform/test/user-skill-server.test.mjs

@@ -0,0 +1,72 @@
+import assert from 'node:assert/strict'
+import { chmod, lstat, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+import { UserSkillManager } from '../../control-plane/services/management/user-skills.mjs'
+import { LocalApiClient } from '../../control-plane/modules/updater/lib/client.mjs'
+import { createUserSkillServer, listenUserSkills } from '../stage0/lib/user-skill-server.mjs'
+
+async function rootOwnedFixture() {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-user-skill-server-'))
+  const dshHome = join(root, 'dsh')
+  const agentsHome = join(root, 'agents')
+  const skill = join(dshHome, 'skills', 'root-owned')
+  await mkdir(skill, { recursive: true })
+  await mkdir(join(agentsHome, 'skills'), { recursive: true })
+  await writeFile(join(skill, 'SKILL.md'), '---\nname: root-owned\ndescription: Root-owned fixture\n---\n')
+  await chmod(skill, 0o755)
+  await chmod(join(skill, 'SKILL.md'), 0o644)
+  const manager = new UserSkillManager({ dshHome, agentsHome })
+  const server = createUserSkillServer({ manager })
+  const socket = join(root, 'run', 'user-skills.sock')
+  await listenUserSkills(server, socket)
+  return { root, dshHome, manager, server, socket, skill }
+}
+
+test('privileged User Skill broker validates and configures root-owned entries', async t => {
+  const value = await rootOwnedFixture()
+  t.after(async () => {
+    await new Promise(resolve => value.server.close(resolve))
+    await rm(value.root, { recursive: true, force: true })
+  })
+  const client = new LocalApiClient(value.socket)
+  const initial = await value.manager.list()
+  const entry = initial.skills[0]
+  const disabled = await client.request('POST', '/v1/action', {
+    entryId: entry.entryId,
+    revision: initial.revision,
+    action: 'disable',
+  })
+  assert.equal(disabled.skills[0].enabled, false)
+  assert.equal((await lstat(join(value.dshHome, 'skills/.disabled/root-owned'))).isDirectory(), true)
+
+  await assert.rejects(client.request('POST', '/v1/action', {
+    entryId: entry.entryId,
+    revision: initial.revision,
+    action: 'delete',
+  }), error => error.statusCode === 409)
+
+  const deleted = await client.request('POST', '/v1/action', {
+    entryId: disabled.skills[0].entryId,
+    revision: disabled.revision,
+    action: 'delete',
+  })
+  assert.deepEqual(deleted.skills, [])
+})
+
+test('privileged User Skill broker exposes no arbitrary path operation', async t => {
+  const value = await rootOwnedFixture()
+  t.after(async () => {
+    await new Promise(resolve => value.server.close(resolve))
+    await rm(value.root, { recursive: true, force: true })
+  })
+  const client = new LocalApiClient(value.socket)
+  await assert.rejects(client.request('POST', '/v1/action', {
+    entryId: `sha256:${'a'.repeat(64)}`,
+    revision: `sha256:${'b'.repeat(64)}`,
+    action: 'delete',
+    path: '/root',
+  }), error => error.statusCode === 400)
+  assert.equal((await lstat(value.skill)).isDirectory(), true)
+})