mirror of
https://github.com/yaklang/yaklang-chrome-extension.git
synced 2026-09-24 20:21:53 +08:00
feat: advance browser agent integration workflows
This commit is contained in:
go0p
@@ -0,0 +1,173 @@
|
||||
import { browser } from 'wxt/browser';
|
||||
import type {
|
||||
BrowserAuthContextAttestation,
|
||||
BrowserTarget,
|
||||
} from '@/types/models';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import {
|
||||
AUTH_CONTEXT_TTL_MS,
|
||||
captureAuthContextSnapshot,
|
||||
validateAuthContextBinding,
|
||||
} from './auth-context';
|
||||
|
||||
const MAX_ATTESTATIONS = 32;
|
||||
const MAX_ATTESTATION_STORAGE_BYTES = 64 * 1_024;
|
||||
const STORAGE_KEY = 'browser.authorization.auth-attestations.v1';
|
||||
const attestations = new Map<string, BrowserAuthContextAttestation>();
|
||||
let loaded = false;
|
||||
|
||||
function validStoredAttestation(value: unknown): value is BrowserAuthContextAttestation {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
|
||||
const attestation = value as Partial<BrowserAuthContextAttestation>;
|
||||
return attestation.version === 1
|
||||
&& typeof attestation.id === 'string'
|
||||
&& attestation.id.length > 0
|
||||
&& attestation.id.length <= 160
|
||||
&& typeof attestation.deviceId === 'string'
|
||||
&& attestation.deviceId.length > 0
|
||||
&& attestation.deviceId.length <= 320
|
||||
&& typeof attestation.installationId === 'string'
|
||||
&& attestation.installationId.length > 0
|
||||
&& attestation.installationId.length <= 320
|
||||
&& typeof attestation.isolationContextId === 'string'
|
||||
&& attestation.isolationContextId.length > 0
|
||||
&& attestation.isolationContextId.length <= 320
|
||||
&& typeof attestation.cookieStoreId === 'string'
|
||||
&& attestation.cookieStoreId.length > 0
|
||||
&& attestation.cookieStoreId.length <= 320
|
||||
&& typeof attestation.origin === 'string'
|
||||
&& attestation.origin.length > 0
|
||||
&& attestation.origin.length <= 8_192
|
||||
&& typeof attestation.grantId === 'string'
|
||||
&& attestation.grantId.length > 0
|
||||
&& attestation.grantId.length <= 160
|
||||
&& typeof attestation.fingerprint === 'string'
|
||||
&& /^hmac-sha256:[a-f0-9]{64}$/.test(attestation.fingerprint)
|
||||
&& Boolean(attestation.target)
|
||||
&& Number.isSafeInteger(attestation.target?.tabId)
|
||||
&& Number(attestation.target?.tabId) > 0
|
||||
&& Number.isSafeInteger(attestation.target?.frameId)
|
||||
&& Number(attestation.target?.frameId) >= 0
|
||||
&& typeof attestation.target?.documentId === 'string'
|
||||
&& attestation.target.documentId.length > 0
|
||||
&& attestation.target.documentId.length <= 160
|
||||
&& Boolean(attestation.authentication)
|
||||
&& ['authenticated', 'unauthenticated', 'unknown'].includes(String(attestation.authentication?.status))
|
||||
&& Number.isSafeInteger(attestation.authentication?.cookieCount)
|
||||
&& Number(attestation.authentication?.cookieCount) >= 0
|
||||
&& Number.isSafeInteger(attestation.authentication?.storageEntryCount)
|
||||
&& Number(attestation.authentication?.storageEntryCount) >= 0
|
||||
&& Array.isArray(attestation.authentication?.authCookieNames)
|
||||
&& attestation.authentication.authCookieNames.length <= 100
|
||||
&& attestation.authentication.authCookieNames.every(
|
||||
(name) => typeof name === 'string' && name.length <= 500,
|
||||
)
|
||||
&& Array.isArray(attestation.authentication?.authStorageKeys)
|
||||
&& attestation.authentication.authStorageKeys.length <= 100
|
||||
&& attestation.authentication.authStorageKeys.every(
|
||||
(key) => typeof key === 'string' && key.length <= 520,
|
||||
)
|
||||
&& typeof attestation.createdAt === 'number'
|
||||
&& typeof attestation.expiresAt === 'number'
|
||||
&& attestation.expiresAt > attestation.createdAt
|
||||
&& attestation.expiresAt - attestation.createdAt <= AUTH_CONTEXT_TTL_MS;
|
||||
}
|
||||
|
||||
function purge(now = Date.now(), reserve = 0): boolean {
|
||||
let changed = false;
|
||||
for (const [id, attestation] of attestations) {
|
||||
if (attestation.expiresAt <= now) {
|
||||
attestations.delete(id);
|
||||
changed = true;
|
||||
}
|
||||
}
|
||||
while (attestations.size > MAX_ATTESTATIONS - reserve) {
|
||||
const oldest = attestations.keys().next().value as string | undefined;
|
||||
if (!oldest) break;
|
||||
attestations.delete(oldest);
|
||||
changed = true;
|
||||
}
|
||||
return changed;
|
||||
}
|
||||
|
||||
async function load(): Promise<void> {
|
||||
if (loaded) return;
|
||||
loaded = true;
|
||||
try {
|
||||
const stored = await browser.storage.session.get(STORAGE_KEY);
|
||||
const values = stored[STORAGE_KEY];
|
||||
if (!Array.isArray(values)) return;
|
||||
for (const value of values.slice(-MAX_ATTESTATIONS)) {
|
||||
if (validStoredAttestation(value)) attestations.set(value.id, value);
|
||||
}
|
||||
purge();
|
||||
} catch {
|
||||
// The bounded in-memory registry remains valid for this service-worker lifetime.
|
||||
}
|
||||
}
|
||||
|
||||
async function save(): Promise<void> {
|
||||
try {
|
||||
const retained: BrowserAuthContextAttestation[] = [];
|
||||
for (const attestation of [...attestations.values()].reverse()) {
|
||||
const candidate = [attestation, ...retained];
|
||||
if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_ATTESTATION_STORAGE_BYTES) break;
|
||||
retained.unshift(attestation);
|
||||
}
|
||||
attestations.clear();
|
||||
for (const attestation of retained) attestations.set(attestation.id, attestation);
|
||||
await browser.storage.session.set({ [STORAGE_KEY]: retained });
|
||||
} catch {
|
||||
// The bounded in-memory registry remains available when storage.session cannot persist.
|
||||
}
|
||||
}
|
||||
|
||||
export async function captureAuthContextAttestation(input: {
|
||||
target: BrowserTarget;
|
||||
grantId: string;
|
||||
grantExpiresAt: number;
|
||||
}): Promise<BrowserAuthContextAttestation> {
|
||||
await load();
|
||||
const now = Date.now();
|
||||
const snapshot = await captureAuthContextSnapshot(input.target);
|
||||
const attestation: BrowserAuthContextAttestation = {
|
||||
version: 1,
|
||||
id: crypto.randomUUID(),
|
||||
...snapshot,
|
||||
grantId: input.grantId,
|
||||
createdAt: now,
|
||||
expiresAt: Math.min(now + AUTH_CONTEXT_TTL_MS, input.grantExpiresAt),
|
||||
};
|
||||
if (attestation.expiresAt <= now) {
|
||||
throw new ExtensionError('grant_expired', '浏览器共享会话已经过期');
|
||||
}
|
||||
purge(now, 1);
|
||||
attestations.set(attestation.id, attestation);
|
||||
await save();
|
||||
return attestation;
|
||||
}
|
||||
|
||||
export async function getAuthContextAttestation(
|
||||
id: string,
|
||||
grantId: string,
|
||||
): Promise<BrowserAuthContextAttestation> {
|
||||
await load();
|
||||
if (purge()) await save();
|
||||
const attestation = attestations.get(id);
|
||||
if (!attestation || attestation.grantId !== grantId) {
|
||||
throw new ExtensionError(
|
||||
'auth_context_stale',
|
||||
'认证上下文证明不存在、已过期或不属于当前共享会话',
|
||||
);
|
||||
}
|
||||
try {
|
||||
await validateAuthContextBinding(attestation);
|
||||
return attestation;
|
||||
} catch (error) {
|
||||
attestations.delete(id);
|
||||
await save();
|
||||
if (error instanceof ExtensionError && error.code === 'auth_context_stale') throw error;
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
throw new ExtensionError('auth_context_stale', `认证上下文证明实时复核失败：${message}`);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import type { BrowserCookie, PageContext, PageStorageEntry } from '@/types/models';
|
||||
import { authenticationFingerprint } from './auth-fingerprint';
|
||||
import { AUTHORIZATION_WORKSPACE_TTL_MS } from './lifetime';
|
||||
|
||||
function cookie(name: string, value: string): BrowserCookie {
|
||||
return {
|
||||
name,
|
||||
value,
|
||||
domain: 'example.test',
|
||||
path: '/',
|
||||
secure: true,
|
||||
httpOnly: true,
|
||||
sameSite: 'lax',
|
||||
session: true,
|
||||
hostOnly: true,
|
||||
storeId: 'opaque-store',
|
||||
};
|
||||
}
|
||||
|
||||
function storageEntry(key: string, value: string): PageStorageEntry {
|
||||
return {
|
||||
key,
|
||||
value,
|
||||
byteLength: value.length,
|
||||
authRelated: true,
|
||||
truncated: false,
|
||||
};
|
||||
}
|
||||
|
||||
function context(cookies: BrowserCookie[], storage: PageStorageEntry[] = []): PageContext {
|
||||
return {
|
||||
cookies,
|
||||
document: {
|
||||
url: 'https://example.test/account',
|
||||
localStorage: {
|
||||
supported: true,
|
||||
entries: storage,
|
||||
totalEntries: storage.length,
|
||||
approximateBytes: 0,
|
||||
truncated: false,
|
||||
},
|
||||
sessionStorage: {
|
||||
supported: true,
|
||||
entries: [],
|
||||
totalEntries: 0,
|
||||
approximateBytes: 0,
|
||||
truncated: false,
|
||||
},
|
||||
},
|
||||
} as unknown as PageContext;
|
||||
}
|
||||
|
||||
describe('authorization context fingerprint', () => {
|
||||
it('keeps authorization context available for human and Agent review', () => {
|
||||
expect(AUTHORIZATION_WORKSPACE_TTL_MS).toBe(30 * 60_000);
|
||||
});
|
||||
|
||||
it('keeps raw Cookie and Storage values out of the canonical identity fingerprint', async () => {
|
||||
const signed: string[] = [];
|
||||
const signer = async (value: string) => {
|
||||
signed.push(value);
|
||||
return 'f'.repeat(64);
|
||||
};
|
||||
|
||||
const fingerprint = await authenticationFingerprint(
|
||||
context(
|
||||
[cookie('session_id', 'cookie-secret-value')],
|
||||
[storageEntry('access_token', 'storage-secret-value')],
|
||||
),
|
||||
signer,
|
||||
);
|
||||
const canonical = signed.at(-1) || '';
|
||||
|
||||
expect(fingerprint).toBe(`hmac-sha256:${'f'.repeat(64)}`);
|
||||
expect(canonical).toContain('session_id');
|
||||
expect(canonical).toContain('access_token');
|
||||
expect(canonical).not.toContain('cookie-secret-value');
|
||||
expect(canonical).not.toContain('storage-secret-value');
|
||||
});
|
||||
|
||||
it('fails closed instead of fingerprinting a truncated Cookie collection', async () => {
|
||||
const cookies = Array.from({ length: 501 }, (_, index) => cookie(`cookie-${index}`, 'value'));
|
||||
|
||||
await expect(authenticationFingerprint(context(cookies), async () => 'f'.repeat(64)))
|
||||
.rejects.toThrow('超过 500 个 Cookie');
|
||||
});
|
||||
|
||||
it('fails closed when the shared page-context Storage snapshot is incomplete', async () => {
|
||||
const pageContext = context([cookie('session_id', 'value')]);
|
||||
pageContext.document.localStorage!.truncated = true;
|
||||
|
||||
await expect(authenticationFingerprint(pageContext, async () => 'f'.repeat(64)))
|
||||
.rejects.toThrow('localStorage 快照发生截断');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,366 @@
|
||||
import { browser } from 'wxt/browser';
|
||||
import type {
|
||||
BrowserAuthContextHandle,
|
||||
BrowserIsolationContext,
|
||||
BrowserTarget,
|
||||
} from '@/types/models';
|
||||
import { capturePageContext } from '@/features/page-context/service';
|
||||
import { getState } from '@/platform/storage/state';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import {
|
||||
authenticationFingerprint,
|
||||
authenticationStorageEntries,
|
||||
} from './auth-fingerprint';
|
||||
import {
|
||||
getBrowserIsolationProof,
|
||||
inspectBrowserIsolation,
|
||||
} from './isolation';
|
||||
import { AUTHORIZATION_WORKSPACE_TTL_MS } from './lifetime';
|
||||
|
||||
export const AUTH_CONTEXT_TTL_MS = AUTHORIZATION_WORKSPACE_TTL_MS;
|
||||
const MAX_AUTH_CONTEXTS = 32;
|
||||
const MAX_AUTH_CONTEXT_STORAGE_BYTES = 64 * 1_024;
|
||||
const STORAGE_KEY = 'browser.authorization.auth-contexts.v1';
|
||||
const HMAC_KEY_STORAGE_KEY = 'browser.authorization.hmac-key.v1';
|
||||
|
||||
const handles = new Map<string, BrowserAuthContextHandle>();
|
||||
let handlesLoaded = false;
|
||||
let hmacKeyPromise: Promise<CryptoKey> | undefined;
|
||||
|
||||
function bytesToBase64(bytes: Uint8Array): string {
|
||||
let binary = '';
|
||||
for (let offset = 0; offset < bytes.length; offset += 8_192) {
|
||||
binary += String.fromCharCode(...bytes.subarray(offset, offset + 8_192));
|
||||
}
|
||||
return btoa(binary);
|
||||
}
|
||||
|
||||
function base64ToBytes(value: string): Uint8Array {
|
||||
const binary = atob(value);
|
||||
return Uint8Array.from(binary, (character) => character.charCodeAt(0));
|
||||
}
|
||||
|
||||
function bytesToHex(bytes: Uint8Array): string {
|
||||
return [...bytes].map((byte) => byte.toString(16).padStart(2, '0')).join('');
|
||||
}
|
||||
|
||||
async function sessionHmacKey(): Promise<CryptoKey> {
|
||||
if (hmacKeyPromise) return hmacKeyPromise;
|
||||
hmacKeyPromise = (async () => {
|
||||
let raw: Uint8Array | undefined;
|
||||
try {
|
||||
const stored = await browser.storage.session.get(HMAC_KEY_STORAGE_KEY);
|
||||
const encoded = stored[HMAC_KEY_STORAGE_KEY];
|
||||
if (typeof encoded === 'string') {
|
||||
const candidate = base64ToBytes(encoded);
|
||||
if (candidate.byteLength === 32) raw = candidate;
|
||||
}
|
||||
} catch {
|
||||
// A fresh in-memory session key is sufficient when storage.session is unavailable.
|
||||
}
|
||||
if (!raw) {
|
||||
raw = crypto.getRandomValues(new Uint8Array(32));
|
||||
try {
|
||||
await browser.storage.session.set({ [HMAC_KEY_STORAGE_KEY]: bytesToBase64(raw) });
|
||||
} catch {
|
||||
// Keep the key in this service worker lifetime as the fallback.
|
||||
}
|
||||
}
|
||||
return crypto.subtle.importKey(
|
||||
'raw',
|
||||
Uint8Array.from(raw).buffer,
|
||||
{ name: 'HMAC', hash: 'SHA-256' },
|
||||
false,
|
||||
['sign'],
|
||||
);
|
||||
})();
|
||||
return hmacKeyPromise;
|
||||
}
|
||||
|
||||
async function hmac(value: string): Promise<string> {
|
||||
const signature = await crypto.subtle.sign(
|
||||
'HMAC',
|
||||
await sessionHmacKey(),
|
||||
new TextEncoder().encode(value),
|
||||
);
|
||||
return bytesToHex(new Uint8Array(signature));
|
||||
}
|
||||
|
||||
function authRelated(name: string): boolean {
|
||||
return /(auth|token|jwt|session|login|csrf|xsrf|sid|credential|bearer)/i.test(name);
|
||||
}
|
||||
|
||||
function validStoredHandle(value: unknown): value is BrowserAuthContextHandle {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
|
||||
const handle = value as Partial<BrowserAuthContextHandle>;
|
||||
return handle.version === 1
|
||||
&& typeof handle.id === 'string'
|
||||
&& handle.id.length > 0
|
||||
&& handle.id.length <= 160
|
||||
&& ['left', 'right'].includes(String(handle.slotId))
|
||||
&& typeof handle.deviceId === 'string'
|
||||
&& handle.deviceId.length > 0
|
||||
&& handle.deviceId.length <= 320
|
||||
&& typeof handle.installationId === 'string'
|
||||
&& handle.installationId.length > 0
|
||||
&& handle.installationId.length <= 320
|
||||
&& typeof handle.isolationContextId === 'string'
|
||||
&& handle.isolationContextId.length > 0
|
||||
&& handle.isolationContextId.length <= 320
|
||||
&& typeof handle.isolationProofId === 'string'
|
||||
&& handle.isolationProofId.length > 0
|
||||
&& handle.isolationProofId.length <= 160
|
||||
&& typeof handle.cookieStoreId === 'string'
|
||||
&& handle.cookieStoreId.length > 0
|
||||
&& handle.cookieStoreId.length <= 320
|
||||
&& typeof handle.origin === 'string'
|
||||
&& handle.origin.length > 0
|
||||
&& handle.origin.length <= 8_192
|
||||
&& typeof handle.grantId === 'string'
|
||||
&& handle.grantId.length > 0
|
||||
&& handle.grantId.length <= 160
|
||||
&& typeof handle.fingerprint === 'string'
|
||||
&& /^hmac-sha256:[a-f0-9]{64}$/.test(handle.fingerprint)
|
||||
&& (handle.accountLabel === undefined
|
||||
|| (typeof handle.accountLabel === 'string' && handle.accountLabel.length <= 80))
|
||||
&& Boolean(handle.target)
|
||||
&& Number.isSafeInteger(handle.target?.tabId)
|
||||
&& Number(handle.target?.tabId) > 0
|
||||
&& Number.isSafeInteger(handle.target?.frameId)
|
||||
&& Number(handle.target?.frameId) >= 0
|
||||
&& typeof handle.target?.documentId === 'string'
|
||||
&& handle.target.documentId.length > 0
|
||||
&& handle.target.documentId.length <= 160
|
||||
&& Boolean(handle.authentication)
|
||||
&& ['authenticated', 'unauthenticated', 'unknown'].includes(String(handle.authentication?.status))
|
||||
&& Number.isSafeInteger(handle.authentication?.cookieCount)
|
||||
&& Number(handle.authentication?.cookieCount) >= 0
|
||||
&& Number.isSafeInteger(handle.authentication?.storageEntryCount)
|
||||
&& Number(handle.authentication?.storageEntryCount) >= 0
|
||||
&& Array.isArray(handle.authentication?.authCookieNames)
|
||||
&& handle.authentication.authCookieNames.length <= 100
|
||||
&& handle.authentication.authCookieNames.every((name) => typeof name === 'string' && name.length <= 500)
|
||||
&& Array.isArray(handle.authentication?.authStorageKeys)
|
||||
&& handle.authentication.authStorageKeys.length <= 100
|
||||
&& handle.authentication.authStorageKeys.every((key) => typeof key === 'string' && key.length <= 520)
|
||||
&& typeof handle.createdAt === 'number'
|
||||
&& typeof handle.expiresAt === 'number'
|
||||
&& handle.expiresAt > handle.createdAt
|
||||
&& handle.expiresAt - handle.createdAt <= AUTH_CONTEXT_TTL_MS;
|
||||
}
|
||||
|
||||
function purgeHandles(now = Date.now(), reserve = 0): boolean {
|
||||
let changed = false;
|
||||
for (const [id, handle] of handles) {
|
||||
if (handle.expiresAt <= now) {
|
||||
handles.delete(id);
|
||||
changed = true;
|
||||
}
|
||||
}
|
||||
while (handles.size > MAX_AUTH_CONTEXTS - reserve) {
|
||||
const oldest = handles.keys().next().value as string | undefined;
|
||||
if (!oldest) break;
|
||||
handles.delete(oldest);
|
||||
changed = true;
|
||||
}
|
||||
return changed;
|
||||
}
|
||||
|
||||
async function loadHandles(): Promise<void> {
|
||||
if (handlesLoaded) return;
|
||||
handlesLoaded = true;
|
||||
try {
|
||||
const stored = await browser.storage.session.get(STORAGE_KEY);
|
||||
const values = stored[STORAGE_KEY];
|
||||
if (!Array.isArray(values)) return;
|
||||
for (const value of values.slice(-MAX_AUTH_CONTEXTS)) {
|
||||
if (validStoredHandle(value)) handles.set(value.id, value);
|
||||
}
|
||||
purgeHandles();
|
||||
} catch {
|
||||
// Keep the bounded memory registry on adapters without storage.session.
|
||||
}
|
||||
}
|
||||
|
||||
async function saveHandles(): Promise<void> {
|
||||
try {
|
||||
const retained: BrowserAuthContextHandle[] = [];
|
||||
for (const handle of [...handles.values()].reverse()) {
|
||||
const candidate = [handle, ...retained];
|
||||
if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_AUTH_CONTEXT_STORAGE_BYTES) break;
|
||||
retained.unshift(handle);
|
||||
}
|
||||
handles.clear();
|
||||
for (const handle of retained) handles.set(handle.id, handle);
|
||||
await browser.storage.session.set({
|
||||
[STORAGE_KEY]: retained,
|
||||
});
|
||||
} catch {
|
||||
// Keep the bounded memory registry on adapters without storage.session.
|
||||
}
|
||||
}
|
||||
|
||||
function isolationContext(
|
||||
contexts: BrowserIsolationContext[],
|
||||
isolationContextId: string | undefined,
|
||||
): BrowserIsolationContext | undefined {
|
||||
return contexts.find((context) => context.contextId === isolationContextId);
|
||||
}
|
||||
|
||||
export interface CapturedAuthContextSnapshot {
|
||||
deviceId: string;
|
||||
installationId: string;
|
||||
isolationContextId: string;
|
||||
cookieStoreId: string;
|
||||
origin: string;
|
||||
target: BrowserTarget & { documentId: string };
|
||||
fingerprint: string;
|
||||
authentication: BrowserAuthContextHandle['authentication'];
|
||||
}
|
||||
|
||||
type AuthContextBinding = Pick<
|
||||
BrowserAuthContextHandle,
|
||||
| 'deviceId'
|
||||
| 'installationId'
|
||||
| 'isolationContextId'
|
||||
| 'cookieStoreId'
|
||||
| 'origin'
|
||||
| 'target'
|
||||
| 'fingerprint'
|
||||
>;
|
||||
|
||||
export async function captureAuthContextSnapshot(
|
||||
target: BrowserTarget,
|
||||
): Promise<CapturedAuthContextSnapshot> {
|
||||
const inspection = await inspectBrowserIsolation([target.tabId]);
|
||||
const tab = inspection.tabs[0];
|
||||
const context = isolationContext(inspection.contexts, tab?.isolationContextId);
|
||||
if (!tab || !context?.cookieStoreId || context.level === 'none') {
|
||||
throw new ExtensionError('isolation_unresolved', '目标页面没有可用的隔离上下文，不能创建认证快照');
|
||||
}
|
||||
const pageContext = await capturePageContext(
|
||||
{ includeDom: false, includeStorage: true, includeCookies: true },
|
||||
target,
|
||||
);
|
||||
if (!pageContext.target.documentId) {
|
||||
throw new ExtensionError('stale_document', '目标页面缺少稳定 document 标识');
|
||||
}
|
||||
const state = await getState();
|
||||
const deviceId = state.bridge.pairedEngine?.deviceId;
|
||||
if (!deviceId) throw new ExtensionError('bridge_disconnected', '插件尚未与 Yak 引擎配对');
|
||||
const cookies = pageContext.cookies || [];
|
||||
const storage = authenticationStorageEntries(pageContext);
|
||||
return {
|
||||
deviceId,
|
||||
installationId: state.bridge.installationId,
|
||||
isolationContextId: context.contextId,
|
||||
cookieStoreId: context.cookieStoreId,
|
||||
origin: new URL(pageContext.document.url).origin,
|
||||
target: {
|
||||
tabId: pageContext.target.tabId,
|
||||
frameId: pageContext.target.frameId,
|
||||
documentId: pageContext.target.documentId,
|
||||
},
|
||||
fingerprint: await authenticationFingerprint(pageContext, hmac),
|
||||
authentication: {
|
||||
status: pageContext.authentication.status,
|
||||
cookieCount: cookies.length,
|
||||
storageEntryCount: storage.length,
|
||||
authCookieNames: cookies
|
||||
.filter((cookie) => authRelated(cookie.name))
|
||||
.map((cookie) => cookie.name)
|
||||
.slice(0, 100),
|
||||
authStorageKeys: storage
|
||||
.filter((entry) => authRelated(entry.key))
|
||||
.map((entry) => `${entry.area}:${entry.key}`)
|
||||
.slice(0, 100),
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export async function validateAuthContextBinding(binding: AuthContextBinding): Promise<void> {
|
||||
const state = await getState();
|
||||
if (state.bridge.pairedEngine?.deviceId !== binding.deviceId
|
||||
|| state.bridge.installationId !== binding.installationId) {
|
||||
throw new ExtensionError('auth_context_stale', '插件安装身份或配对引擎已经变化');
|
||||
}
|
||||
const current = await captureAuthContextSnapshot(binding.target);
|
||||
if (current.isolationContextId !== binding.isolationContextId
|
||||
|| current.cookieStoreId !== binding.cookieStoreId) {
|
||||
throw new ExtensionError('auth_context_stale', '目标页面的 Cookie Store 或隔离上下文已经变化');
|
||||
}
|
||||
if (current.target.documentId !== binding.target.documentId
|
||||
|| current.origin !== binding.origin
|
||||
|| current.fingerprint !== binding.fingerprint) {
|
||||
throw new ExtensionError('auth_context_stale', '目标文档、来源或认证材料已经变化');
|
||||
}
|
||||
}
|
||||
|
||||
export async function captureAuthContextHandle(input: {
|
||||
slotId: 'left' | 'right';
|
||||
accountLabel?: string;
|
||||
isolationProofId: string;
|
||||
target: BrowserTarget;
|
||||
grantId: string;
|
||||
grantExpiresAt: number;
|
||||
}): Promise<BrowserAuthContextHandle> {
|
||||
await loadHandles();
|
||||
const proof = await getBrowserIsolationProof(input.isolationProofId);
|
||||
if (proof.level === 'none') {
|
||||
throw new ExtensionError('isolation_unresolved', '当前证明没有建立两个身份的隔离关系，不能创建认证句柄');
|
||||
}
|
||||
const expectedTabId = input.slotId === 'left' ? proof.leftTabId : proof.rightTabId;
|
||||
if (input.target.tabId !== expectedTabId) {
|
||||
throw new ExtensionError('target_denied', '认证上下文目标与隔离证明中的身份槽位不一致');
|
||||
}
|
||||
const expectedContextId = input.slotId === 'left'
|
||||
? proof.leftContextId
|
||||
: proof.rightContextId;
|
||||
const snapshot = await captureAuthContextSnapshot(input.target);
|
||||
if (snapshot.isolationContextId !== expectedContextId) {
|
||||
throw new ExtensionError('isolation_stale', '目标页面的隔离上下文已经变化，请重新执行预检');
|
||||
}
|
||||
const now = Date.now();
|
||||
const handle: BrowserAuthContextHandle = {
|
||||
version: 1,
|
||||
id: crypto.randomUUID(),
|
||||
slotId: input.slotId,
|
||||
accountLabel: input.accountLabel?.trim().slice(0, 80) || undefined,
|
||||
...snapshot,
|
||||
isolationProofId: proof.id,
|
||||
grantId: input.grantId,
|
||||
createdAt: now,
|
||||
expiresAt: Math.min(now + AUTH_CONTEXT_TTL_MS, proof.expiresAt, input.grantExpiresAt),
|
||||
};
|
||||
if (handle.expiresAt <= now) throw new ExtensionError('grant_expired', '共享会话或隔离证明已经过期');
|
||||
purgeHandles(now, 1);
|
||||
handles.set(handle.id, handle);
|
||||
await saveHandles();
|
||||
return handle;
|
||||
}
|
||||
|
||||
export async function getAuthContextHandle(id: string, grantId: string): Promise<BrowserAuthContextHandle> {
|
||||
await loadHandles();
|
||||
if (purgeHandles()) await saveHandles();
|
||||
const handle = handles.get(id);
|
||||
if (!handle || handle.grantId !== grantId) {
|
||||
throw new ExtensionError('auth_context_stale', '认证上下文句柄不存在、已过期或不属于当前共享会话');
|
||||
}
|
||||
try {
|
||||
const proof = await getBrowserIsolationProof(handle.isolationProofId);
|
||||
if (proof.level === 'none') throw new ExtensionError('auth_context_stale', '身份隔离证明已经失效');
|
||||
const expectedTabId = handle.slotId === 'left' ? proof.leftTabId : proof.rightTabId;
|
||||
const expectedContextId = handle.slotId === 'left' ? proof.leftContextId : proof.rightContextId;
|
||||
if (handle.target.tabId !== expectedTabId || handle.isolationContextId !== expectedContextId) {
|
||||
throw new ExtensionError('auth_context_stale', '认证句柄与当前隔离证明不一致');
|
||||
}
|
||||
await validateAuthContextBinding(handle);
|
||||
return handle;
|
||||
} catch (error) {
|
||||
handles.delete(id);
|
||||
await saveHandles();
|
||||
if (error instanceof ExtensionError && error.code === 'auth_context_stale') throw error;
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
throw new ExtensionError('auth_context_stale', `认证上下文实时复核失败：${message}`);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,108 @@
|
||||
import type { PageContext, PageStorageSummary } from '@/types/models';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
|
||||
const MAX_COOKIE_COUNT = 500;
|
||||
const MAX_COOKIE_VALUE_BYTES = 1024 * 1_024;
|
||||
|
||||
function authRelated(name: string): boolean {
|
||||
return /(auth|token|jwt|session|login|csrf|xsrf|sid|credential|bearer)/i.test(name);
|
||||
}
|
||||
|
||||
function likelyCredentialValue(value: string): boolean {
|
||||
const trimmed = value.trim();
|
||||
return /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/.test(trimmed)
|
||||
|| /^Bearer\s+\S+/i.test(trimmed)
|
||||
|| /^[A-Fa-f0-9]{32,}$/.test(trimmed);
|
||||
}
|
||||
|
||||
function requireCompleteStorage(
|
||||
area: 'local' | 'session',
|
||||
summary: PageStorageSummary | undefined,
|
||||
): PageStorageSummary {
|
||||
if (!summary?.supported || summary.error) {
|
||||
throw new ExtensionError(
|
||||
'auth_context_storage_unavailable',
|
||||
`${area === 'local' ? 'localStorage' : 'sessionStorage'} 无法完整读取，不能生成可靠的认证指纹`,
|
||||
);
|
||||
}
|
||||
if (summary.truncated || summary.entries.some((entry) => entry.truncated)) {
|
||||
throw new ExtensionError(
|
||||
'auth_context_too_large',
|
||||
`${area === 'local' ? 'localStorage' : 'sessionStorage'} 快照发生截断，已拒绝生成不完整认证指纹`,
|
||||
);
|
||||
}
|
||||
return summary;
|
||||
}
|
||||
|
||||
function cookieCanonical(context: PageContext): Array<Record<string, unknown>> {
|
||||
const cookies = context.cookies || [];
|
||||
if (cookies.length > MAX_COOKIE_COUNT) {
|
||||
throw new ExtensionError(
|
||||
'auth_context_too_large',
|
||||
`目标来源包含超过 ${MAX_COOKIE_COUNT} 个 Cookie，已拒绝生成不完整认证指纹`,
|
||||
);
|
||||
}
|
||||
const totalBytes = cookies.reduce(
|
||||
(total, cookie) => total + new TextEncoder().encode(cookie.value).byteLength,
|
||||
0,
|
||||
);
|
||||
if (totalBytes > MAX_COOKIE_VALUE_BYTES) {
|
||||
throw new ExtensionError(
|
||||
'auth_context_too_large',
|
||||
'目标来源 Cookie 值总量超过 1 MiB，已拒绝生成不完整认证指纹',
|
||||
);
|
||||
}
|
||||
return cookies
|
||||
.map((cookie) => ({
|
||||
name: cookie.name,
|
||||
value: cookie.value,
|
||||
domain: cookie.domain,
|
||||
path: cookie.path,
|
||||
secure: cookie.secure,
|
||||
httpOnly: cookie.httpOnly,
|
||||
sameSite: cookie.sameSite,
|
||||
session: cookie.session,
|
||||
storeId: cookie.storeId,
|
||||
partitionKey: cookie.partitionKey,
|
||||
}))
|
||||
.sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
|
||||
}
|
||||
|
||||
export function authenticationStorageEntries(context: PageContext): Array<{
|
||||
area: 'local' | 'session';
|
||||
key: string;
|
||||
value: string;
|
||||
}> {
|
||||
const local = requireCompleteStorage('local', context.document.localStorage);
|
||||
const session = requireCompleteStorage('session', context.document.sessionStorage);
|
||||
return [
|
||||
...local.entries
|
||||
.filter((entry) => entry.authRelated || authRelated(entry.key) || likelyCredentialValue(entry.value))
|
||||
.map((entry) => ({ area: 'local' as const, key: entry.key, value: entry.value })),
|
||||
...session.entries
|
||||
.filter((entry) => entry.authRelated || authRelated(entry.key) || likelyCredentialValue(entry.value))
|
||||
.map((entry) => ({ area: 'session' as const, key: entry.key, value: entry.value })),
|
||||
].sort((left, right) => `${left.area}:${left.key}`.localeCompare(`${right.area}:${right.key}`));
|
||||
}
|
||||
|
||||
export async function authenticationFingerprint(
|
||||
context: PageContext,
|
||||
signer: (value: string) => Promise<string>,
|
||||
): Promise<string> {
|
||||
const cookies = await Promise.all(cookieCanonical(context).map(async (cookie) => ({
|
||||
...cookie,
|
||||
value: await signer(String(cookie.value)),
|
||||
})));
|
||||
const storage = await Promise.all(authenticationStorageEntries(context).map(async (entry) => ({
|
||||
area: entry.area,
|
||||
key: entry.key,
|
||||
value: await signer(entry.value),
|
||||
})));
|
||||
const canonical = JSON.stringify({
|
||||
version: 1,
|
||||
origin: new URL(context.document.url).origin,
|
||||
cookies,
|
||||
storage,
|
||||
});
|
||||
return `hmac-sha256:${await signer(canonical)}`;
|
||||
}
|
||||
@@ -0,0 +1,392 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import {
|
||||
applyAuthorizationTransformExecution,
|
||||
authorizationRequestToTransformPacket,
|
||||
compileAuthorizationBaselineRequest,
|
||||
extractAuthorizationResourceValue,
|
||||
parseAuthorizationRequestPacket,
|
||||
replaceAuthorizationResourceValue,
|
||||
} from './baseline-execution';
|
||||
import { fingerprintAuthorizationComparisonValue } from './baseline-metadata';
|
||||
|
||||
function base64(value: string): string {
|
||||
return btoa(value);
|
||||
}
|
||||
|
||||
describe('authorization baseline execution primitives', () => {
|
||||
it('parses a bounded request packet without discarding captured credentials', () => {
|
||||
const packet = parseAuthorizationRequestPacket(base64([
|
||||
'GET /api/orders/42 HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Cookie: session=secret',
|
||||
'Authorization: Bearer secret',
|
||||
'X-CSRF-Token: csrf-secret',
|
||||
'Sec-Fetch-Site: same-origin',
|
||||
'',
|
||||
'',
|
||||
].join('\r\n')));
|
||||
expect(packet.method).toBe('GET');
|
||||
expect(packet.headers).toEqual([
|
||||
{ name: 'Host', value: 'example.test' },
|
||||
{ name: 'Cookie', value: 'session=secret' },
|
||||
{ name: 'Authorization', value: 'Bearer secret' },
|
||||
{ name: 'X-CSRF-Token', value: 'csrf-secret' },
|
||||
{ name: 'Sec-Fetch-Site', value: 'same-origin' },
|
||||
]);
|
||||
});
|
||||
|
||||
it('extracts and replaces a normalized path resource without changing the origin', () => {
|
||||
const value = extractAuthorizationResourceValue(
|
||||
'https://example.test/api/orders/42?view=full',
|
||||
'',
|
||||
'baseline-left',
|
||||
{ location: 'path', path: 'path.segment[2]' },
|
||||
'workspace-hmac-sha256:a'.padEnd(86, 'a'),
|
||||
);
|
||||
const replaced = replaceAuthorizationResourceValue(
|
||||
'https://example.test/api/orders/42?view=full',
|
||||
{ location: 'path', path: 'path.segment[2]' },
|
||||
'84',
|
||||
);
|
||||
|
||||
expect(atob(value.valueBase64)).toBe('42');
|
||||
expect(replaced).toBe('https://example.test/api/orders/84?view=full');
|
||||
});
|
||||
|
||||
it('addresses repeated query parameters by occurrence', () => {
|
||||
const url = 'https://example.test/api/orders?id=42&view=full&id=84';
|
||||
const value = extractAuthorizationResourceValue(
|
||||
url,
|
||||
'',
|
||||
'baseline-right',
|
||||
{ location: 'query', path: 'query.id[1]' },
|
||||
'workspace-hmac-sha256:b'.padEnd(86, 'b'),
|
||||
);
|
||||
const replaced = replaceAuthorizationResourceValue(
|
||||
url,
|
||||
{ location: 'query', path: 'query.id[1]' },
|
||||
'126',
|
||||
);
|
||||
|
||||
expect(atob(value.valueBase64)).toBe('84');
|
||||
expect(replaced).toBe('https://example.test/api/orders?id=42&view=full&id=126');
|
||||
expect(() => extractAuthorizationResourceValue(
|
||||
url,
|
||||
'',
|
||||
'baseline-right',
|
||||
{ location: 'query', path: 'query.id' },
|
||||
'workspace-hmac-sha256:b'.padEnd(86, 'b'),
|
||||
)).toThrow('多个同名值');
|
||||
});
|
||||
|
||||
it('compiles a read-only request while retaining the exact captured header block', async () => {
|
||||
const comparisonKey = btoa(String.fromCharCode(...new Uint8Array(32).fill(7)))
|
||||
.replace(/\+/g, '-')
|
||||
.replace(/\//g, '_')
|
||||
.replace(/=+$/, '');
|
||||
const valueFingerprint = await fingerprintAuthorizationComparisonValue(comparisonKey, '84');
|
||||
const raw = [
|
||||
'GET /api/orders/42 HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Cookie: session=secret',
|
||||
'Authorization: Bearer secret',
|
||||
'',
|
||||
'',
|
||||
].join('\r\n');
|
||||
const compiled = await compileAuthorizationBaselineRequest({
|
||||
baselineId: 'baseline-left',
|
||||
rawRequestBase64: base64(raw),
|
||||
requestUrl: 'https://example.test/api/orders/42',
|
||||
publicUrl: 'https://example.test/api/orders/:resource',
|
||||
selector: { source: 'wire', location: 'path', path: 'path.segment[2]' },
|
||||
replacement: {
|
||||
version: 1,
|
||||
baselineId: 'baseline-right',
|
||||
source: 'wire',
|
||||
location: 'path',
|
||||
path: 'path.segment[2]',
|
||||
valueType: 'string',
|
||||
byteLength: 2,
|
||||
valueBase64: base64('84'),
|
||||
valueFingerprint,
|
||||
},
|
||||
comparisonKey,
|
||||
isHttps: true,
|
||||
});
|
||||
|
||||
const request = atob(compiled.rawRequestBase64);
|
||||
expect(request).toContain('GET /api/orders/84 HTTP/1.1\r\n');
|
||||
expect(request).toContain('Cookie: session=secret\r\n');
|
||||
expect(request).toContain('Authorization: Bearer secret\r\n');
|
||||
expect(compiled.resourceValueFingerprint).toBe(valueFingerprint);
|
||||
});
|
||||
|
||||
it('replaces an explicit resource Header without copying another identity credential', async () => {
|
||||
const comparisonKey = btoa(String.fromCharCode(...new Uint8Array(32).fill(11)))
|
||||
.replace(/\+/g, '-')
|
||||
.replace(/\//g, '_')
|
||||
.replace(/=+$/, '');
|
||||
const valueFingerprint = await fingerprintAuthorizationComparisonValue(comparisonKey, 'tenant-b');
|
||||
const raw = [
|
||||
'GET /api/orders HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Cookie: session=identity-a',
|
||||
'X-Tenant-Id: tenant-a',
|
||||
'',
|
||||
'',
|
||||
].join('\r\n');
|
||||
const resource = extractAuthorizationResourceValue(
|
||||
'https://example.test/api/orders',
|
||||
base64(raw),
|
||||
'baseline-left',
|
||||
{ location: 'header', path: 'header.x-tenant-id' },
|
||||
await fingerprintAuthorizationComparisonValue(comparisonKey, 'tenant-a'),
|
||||
);
|
||||
const compiled = await compileAuthorizationBaselineRequest({
|
||||
baselineId: 'baseline-left',
|
||||
rawRequestBase64: base64(raw),
|
||||
requestUrl: 'https://example.test/api/orders',
|
||||
publicUrl: 'https://example.test/api/orders',
|
||||
selector: { source: 'wire', location: 'header', path: 'header.x-tenant-id' },
|
||||
replacement: {
|
||||
version: 1,
|
||||
baselineId: 'baseline-right',
|
||||
source: 'wire',
|
||||
location: 'header',
|
||||
path: 'header.x-tenant-id',
|
||||
valueType: 'string',
|
||||
byteLength: 8,
|
||||
valueBase64: base64('tenant-b'),
|
||||
valueFingerprint,
|
||||
},
|
||||
comparisonKey,
|
||||
isHttps: true,
|
||||
});
|
||||
|
||||
expect(atob(resource.valueBase64)).toBe('tenant-a');
|
||||
expect(atob(compiled.rawRequestBase64)).toContain('X-Tenant-Id: tenant-b\r\n');
|
||||
expect(atob(compiled.rawRequestBase64)).toContain('Cookie: session=identity-a\r\n');
|
||||
expect(atob(compiled.rawRequestBase64)).not.toContain('session=identity-b');
|
||||
});
|
||||
|
||||
it('replaces one GraphQL variable in a reviewed POST without changing the operation or credentials', async () => {
|
||||
const comparisonKey = btoa(String.fromCharCode(...new Uint8Array(32).fill(13)))
|
||||
.replace(/\+/g, '-')
|
||||
.replace(/\//g, '_')
|
||||
.replace(/=+$/, '');
|
||||
const valueFingerprint = await fingerprintAuthorizationComparisonValue(
|
||||
comparisonKey,
|
||||
'84',
|
||||
);
|
||||
const body = JSON.stringify({
|
||||
operationName: 'Order',
|
||||
query: 'query Order($orderId: ID!) { order(id: $orderId) { id total } }',
|
||||
variables: {
|
||||
orderId: 42,
|
||||
includeAudit: true,
|
||||
},
|
||||
});
|
||||
const raw = [
|
||||
'POST /graphql HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/json',
|
||||
`Content-Length: ${new TextEncoder().encode(body).byteLength}`,
|
||||
'Cookie: session=identity-a',
|
||||
'',
|
||||
body,
|
||||
].join('\r\n');
|
||||
|
||||
const compiled = await compileAuthorizationBaselineRequest({
|
||||
baselineId: 'baseline-left',
|
||||
rawRequestBase64: base64(raw),
|
||||
requestUrl: 'https://example.test/graphql',
|
||||
publicUrl: 'https://example.test/graphql',
|
||||
selector: {
|
||||
source: 'wire',
|
||||
location: 'body',
|
||||
path: 'body.variables.orderId',
|
||||
},
|
||||
replacement: {
|
||||
version: 1,
|
||||
baselineId: 'baseline-right',
|
||||
source: 'wire',
|
||||
location: 'body',
|
||||
path: 'body.variables.orderId',
|
||||
valueType: 'number',
|
||||
byteLength: 2,
|
||||
valueBase64: base64('84'),
|
||||
valueFingerprint,
|
||||
},
|
||||
comparisonKey,
|
||||
isHttps: true,
|
||||
});
|
||||
|
||||
const compiledPacket = parseAuthorizationRequestPacket(compiled.rawRequestBase64);
|
||||
const compiledBody = JSON.parse(new TextDecoder().decode(
|
||||
compiledPacket.bytes.subarray(compiledPacket.bodyOffset),
|
||||
));
|
||||
expect(compiledBody.variables).toEqual({
|
||||
orderId: 84,
|
||||
includeAudit: true,
|
||||
});
|
||||
expect(compiledBody.query).toBe(
|
||||
'query Order($orderId: ID!) { order(id: $orderId) { id total } }',
|
||||
);
|
||||
expect(atob(compiled.rawRequestBase64)).toContain('Cookie: session=identity-a\r\n');
|
||||
expect(compiledPacket.headers.find(
|
||||
(header) => header.name.toLowerCase() === 'content-length',
|
||||
)?.value).toBe(String(new TextEncoder().encode(JSON.stringify(compiledBody)).byteLength));
|
||||
});
|
||||
|
||||
it('addresses a GraphQL batch variable by its ordered operation index', async () => {
|
||||
const comparisonKey = btoa(String.fromCharCode(...new Uint8Array(32).fill(17)))
|
||||
.replace(/\+/g, '-')
|
||||
.replace(/\//g, '_')
|
||||
.replace(/=+$/, '');
|
||||
const valueFingerprint = await fingerprintAuthorizationComparisonValue(
|
||||
comparisonKey,
|
||||
'user-b',
|
||||
);
|
||||
const body = JSON.stringify([
|
||||
{
|
||||
operationName: 'Viewer',
|
||||
query: 'query Viewer { viewer { id } }',
|
||||
variables: {},
|
||||
},
|
||||
{
|
||||
operationName: 'User',
|
||||
query: 'query User($userId: ID!) { user(id: $userId) { id } }',
|
||||
variables: { userId: 'user-a' },
|
||||
},
|
||||
]);
|
||||
const raw = [
|
||||
'POST /graphql HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/json',
|
||||
`Content-Length: ${new TextEncoder().encode(body).byteLength}`,
|
||||
'Cookie: session=identity-a',
|
||||
'',
|
||||
body,
|
||||
].join('\r\n');
|
||||
|
||||
const compiled = await compileAuthorizationBaselineRequest({
|
||||
baselineId: 'baseline-left',
|
||||
rawRequestBase64: base64(raw),
|
||||
requestUrl: 'https://example.test/graphql',
|
||||
publicUrl: 'https://example.test/graphql',
|
||||
selector: {
|
||||
source: 'wire',
|
||||
location: 'body',
|
||||
path: 'body[1].variables.userId',
|
||||
},
|
||||
replacement: {
|
||||
version: 1,
|
||||
baselineId: 'baseline-right',
|
||||
source: 'wire',
|
||||
location: 'body',
|
||||
path: 'body[1].variables.userId',
|
||||
valueType: 'string',
|
||||
byteLength: 6,
|
||||
valueBase64: base64('user-b'),
|
||||
valueFingerprint,
|
||||
},
|
||||
comparisonKey,
|
||||
isHttps: true,
|
||||
});
|
||||
|
||||
const compiledPacket = parseAuthorizationRequestPacket(compiled.rawRequestBase64);
|
||||
const compiledBody = JSON.parse(new TextDecoder().decode(
|
||||
compiledPacket.bytes.subarray(compiledPacket.bodyOffset),
|
||||
));
|
||||
expect(compiledBody.map((operation: { operationName: string }) => operation.operationName))
|
||||
.toEqual(['Viewer', 'User']);
|
||||
expect(compiledBody[1].variables.userId).toBe('user-b');
|
||||
});
|
||||
|
||||
it('applies an identity-bound query signature without changing captured credentials', async () => {
|
||||
const raw = base64([
|
||||
'GET /api/orders/84?nonce=old&signature=old HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Cookie: session=identity-a',
|
||||
'Authorization: Bearer identity-a',
|
||||
'',
|
||||
'',
|
||||
].join('\r\n'));
|
||||
const packet = authorizationRequestToTransformPacket(raw, 'https://example.test');
|
||||
const compiled = await applyAuthorizationTransformExecution({
|
||||
compiled: {
|
||||
version: 1,
|
||||
baselineId: 'baseline-left',
|
||||
selector: { source: 'wire', location: 'path', path: 'path.segment[2]' },
|
||||
method: 'GET',
|
||||
url: 'https://example.test/api/orders/:resource',
|
||||
isHttps: true,
|
||||
rawRequestBase64: raw,
|
||||
resourceValueFingerprint: 'workspace-hmac-sha256:a'.padEnd(88, 'a'),
|
||||
packetFingerprint: `sha256:${'a'.repeat(64)}`,
|
||||
},
|
||||
execution: {
|
||||
profileId: 'profile-left',
|
||||
direction: 'request',
|
||||
url: 'https://example.test/api/orders/84?nonce=fresh&signature=signed-84',
|
||||
bodyBase64: packet.bodyBase64,
|
||||
setHeaders: [],
|
||||
removeHeaders: [],
|
||||
logicalInput: {},
|
||||
logicalOutput: {},
|
||||
nodeDurations: [],
|
||||
nodeTrace: [],
|
||||
fieldChanges: [],
|
||||
durationMs: 1,
|
||||
},
|
||||
origin: 'https://example.test',
|
||||
allowedDestinations: ['query.nonce', 'query.signature'],
|
||||
});
|
||||
|
||||
const request = atob(compiled.rawRequestBase64);
|
||||
expect(request).toContain('GET /api/orders/84?nonce=fresh&signature=signed-84 HTTP/1.1');
|
||||
expect(request).toContain('Cookie: session=identity-a');
|
||||
expect(request).toContain('Authorization: Bearer identity-a');
|
||||
});
|
||||
|
||||
it('rejects dynamic transforms that touch authentication headers', async () => {
|
||||
const raw = base64([
|
||||
'GET /api/orders/84?signature=old HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Cookie: session=identity-a',
|
||||
'',
|
||||
'',
|
||||
].join('\r\n'));
|
||||
const packet = authorizationRequestToTransformPacket(raw, 'https://example.test');
|
||||
|
||||
await expect(applyAuthorizationTransformExecution({
|
||||
compiled: {
|
||||
version: 1,
|
||||
baselineId: 'baseline-left',
|
||||
selector: { source: 'wire', location: 'path', path: 'path.segment[2]' },
|
||||
method: 'GET',
|
||||
url: 'https://example.test/api/orders/:resource',
|
||||
isHttps: true,
|
||||
rawRequestBase64: raw,
|
||||
resourceValueFingerprint: 'workspace-hmac-sha256:a'.padEnd(88, 'a'),
|
||||
packetFingerprint: `sha256:${'a'.repeat(64)}`,
|
||||
},
|
||||
execution: {
|
||||
profileId: 'profile-left',
|
||||
direction: 'request',
|
||||
url: packet.url,
|
||||
bodyBase64: packet.bodyBase64,
|
||||
setHeaders: [{ name: 'Cookie', value: 'session=identity-b' }],
|
||||
removeHeaders: [],
|
||||
logicalInput: {},
|
||||
logicalOutput: {},
|
||||
nodeDurations: [],
|
||||
nodeTrace: [],
|
||||
fieldChanges: [],
|
||||
durationMs: 1,
|
||||
},
|
||||
origin: 'https://example.test',
|
||||
allowedDestinations: ['header.cookie'],
|
||||
})).rejects.toThrow('认证材料');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,571 @@
|
||||
import type {
|
||||
BrowserAuthorizationCompiledRequest,
|
||||
BrowserAuthorizationResourceSelector,
|
||||
BrowserAuthorizationResourceValue,
|
||||
BrowserTransformExecution,
|
||||
BrowserTransformPacket,
|
||||
} from '@/types/models';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import { fingerprintAuthorizationComparisonValue } from './baseline-metadata';
|
||||
import {
|
||||
replaceStructuredAuthorizationBodyValue,
|
||||
} from './structured-body';
|
||||
|
||||
const MAX_RESOURCE_VALUE_BYTES = 8 * 1_024;
|
||||
|
||||
interface ParsedAuthorizationRequest {
|
||||
method: string;
|
||||
requestTarget: string;
|
||||
protocol: string;
|
||||
headers: Array<{ name: string; value: string }>;
|
||||
bytes: Uint8Array;
|
||||
bodyOffset: number;
|
||||
}
|
||||
|
||||
function base64ToBytes(value: string): Uint8Array {
|
||||
let binary: string;
|
||||
try {
|
||||
binary = atob(value);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_value_invalid', '授权资源值不是有效的 Base64');
|
||||
}
|
||||
return Uint8Array.from(binary, (character) => character.charCodeAt(0));
|
||||
}
|
||||
|
||||
function bytesToBase64(bytes: Uint8Array): string {
|
||||
let binary = '';
|
||||
const chunkSize = 0x8000;
|
||||
for (let offset = 0; offset < bytes.length; offset += chunkSize) {
|
||||
binary += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
|
||||
}
|
||||
return btoa(binary);
|
||||
}
|
||||
|
||||
function packetBodyOffset(bytes: Uint8Array): number {
|
||||
for (let index = 0; index <= bytes.length - 4; index += 1) {
|
||||
if (bytes[index] === 13 && bytes[index + 1] === 10
|
||||
&& bytes[index + 2] === 13 && bytes[index + 3] === 10) {
|
||||
return index + 4;
|
||||
}
|
||||
}
|
||||
throw new ExtensionError('authorization_baseline_invalid', '授权基线缺少 HTTP Header 分隔符');
|
||||
}
|
||||
|
||||
export function parseAuthorizationRequestPacket(
|
||||
rawRequestBase64: string,
|
||||
): ParsedAuthorizationRequest {
|
||||
const bytes = base64ToBytes(rawRequestBase64);
|
||||
const offset = packetBodyOffset(bytes);
|
||||
let head: string;
|
||||
try {
|
||||
head = new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, offset - 4));
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_baseline_invalid', '授权基线请求头不是有效的 UTF-8');
|
||||
}
|
||||
const lines = head.split('\r\n');
|
||||
const requestLine = lines.shift()?.split(/\s+/) || [];
|
||||
if (requestLine.length !== 3 || !/^[A-Z]{1,16}$/.test(requestLine[0])) {
|
||||
throw new ExtensionError('authorization_baseline_invalid', '授权基线请求行无效');
|
||||
}
|
||||
const headers = lines.slice(0, 256).flatMap((line) => {
|
||||
const separator = line.indexOf(':');
|
||||
if (separator <= 0) return [];
|
||||
const name = line.slice(0, separator).trim().slice(0, 256);
|
||||
const value = line.slice(separator + 1).trim().slice(0, 16_384);
|
||||
return name ? [{ name, value }] : [];
|
||||
});
|
||||
return {
|
||||
method: requestLine[0],
|
||||
requestTarget: requestLine[1],
|
||||
protocol: requestLine[2],
|
||||
headers,
|
||||
bytes,
|
||||
bodyOffset: offset,
|
||||
};
|
||||
}
|
||||
|
||||
function parameterSelector(
|
||||
location: 'header' | 'query',
|
||||
path: string,
|
||||
): { name: string; index?: number } {
|
||||
const prefix = `${location}.`;
|
||||
if (!path.startsWith(prefix)) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权资源字段路径与位置不匹配');
|
||||
}
|
||||
const raw = path.slice(prefix.length);
|
||||
const indexed = raw.match(/^(.*)\[(\d+)]$/);
|
||||
const name = indexed ? indexed[1] : raw;
|
||||
const index = indexed ? Number(indexed[2]) : undefined;
|
||||
if (!name || (index !== undefined && (!Number.isSafeInteger(index) || index < 0))) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权资源字段路径无效');
|
||||
}
|
||||
return { name, index };
|
||||
}
|
||||
|
||||
function pathSegmentSelector(path: string): number {
|
||||
const matched = path.match(/^path\.segment\[(\d+)]$/);
|
||||
const index = matched ? Number(matched[1]) : -1;
|
||||
if (!Number.isSafeInteger(index) || index < 0) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权路径资源字段无效');
|
||||
}
|
||||
return index;
|
||||
}
|
||||
|
||||
function valuesForQuery(url: URL, name: string): string[] {
|
||||
return [...url.searchParams].filter(([key]) => key === name).map(([, value]) => value);
|
||||
}
|
||||
|
||||
export function extractAuthorizationResourceValue(
|
||||
requestUrl: string,
|
||||
rawRequestBase64: string,
|
||||
baselineId: string,
|
||||
selector: { location: 'header' | 'path' | 'query'; path: string },
|
||||
valueFingerprint: string,
|
||||
): BrowserAuthorizationResourceValue {
|
||||
const url = new URL(requestUrl);
|
||||
let value: string;
|
||||
if (selector.location === 'header') {
|
||||
const selected = parameterSelector('header', selector.path);
|
||||
const values = parseAuthorizationRequestPacket(rawRequestBase64).headers
|
||||
.filter((header) => header.name.toLowerCase() === selected.name.toLowerCase())
|
||||
.map((header) => header.value);
|
||||
if (selected.index === undefined && values.length !== 1) {
|
||||
throw new ExtensionError('authorization_selector_ambiguous', '授权 Header 字段存在多个同名值，必须选择带序号的字段');
|
||||
}
|
||||
const index = selected.index ?? 0;
|
||||
if (index >= values.length) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权 Header 资源字段不存在');
|
||||
}
|
||||
value = values[index];
|
||||
} else if (selector.location === 'path') {
|
||||
const index = pathSegmentSelector(selector.path);
|
||||
const segments = url.pathname.split('/').filter(Boolean);
|
||||
if (index >= segments.length) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权路径资源字段不存在');
|
||||
}
|
||||
try {
|
||||
value = decodeURIComponent(segments[index]);
|
||||
} catch {
|
||||
value = segments[index];
|
||||
}
|
||||
} else {
|
||||
const selected = parameterSelector('query', selector.path);
|
||||
const values = valuesForQuery(url, selected.name);
|
||||
if (selected.index === undefined && values.length !== 1) {
|
||||
throw new ExtensionError('authorization_selector_ambiguous', '授权查询字段存在多个同名值，必须选择带序号的字段');
|
||||
}
|
||||
const index = selected.index ?? 0;
|
||||
if (index >= values.length) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权查询资源字段不存在');
|
||||
}
|
||||
value = values[index];
|
||||
}
|
||||
const bytes = new TextEncoder().encode(value);
|
||||
if (bytes.byteLength > MAX_RESOURCE_VALUE_BYTES) {
|
||||
throw new ExtensionError('authorization_value_too_large', '授权资源值超过 8 KiB 上限');
|
||||
}
|
||||
return {
|
||||
version: 1,
|
||||
baselineId,
|
||||
source: 'wire',
|
||||
location: selector.location,
|
||||
path: selector.path,
|
||||
valueType: 'string',
|
||||
byteLength: bytes.byteLength,
|
||||
valueBase64: bytesToBase64(bytes),
|
||||
valueFingerprint,
|
||||
};
|
||||
}
|
||||
|
||||
export function replaceAuthorizationResourceValue(
|
||||
requestUrl: string,
|
||||
selector: { location: 'path' | 'query'; path: string },
|
||||
replacement: string,
|
||||
): string {
|
||||
const url = new URL(requestUrl);
|
||||
if (selector.location === 'path') {
|
||||
const selectedIndex = pathSegmentSelector(selector.path);
|
||||
let currentIndex = -1;
|
||||
const segments = url.pathname.split('/');
|
||||
const next = segments.map((segment) => {
|
||||
if (!segment) return segment;
|
||||
currentIndex += 1;
|
||||
return currentIndex === selectedIndex ? encodeURIComponent(replacement) : segment;
|
||||
});
|
||||
if (currentIndex < selectedIndex) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权路径资源字段不存在');
|
||||
}
|
||||
url.pathname = next.join('/');
|
||||
return url.toString();
|
||||
}
|
||||
|
||||
const selected = parameterSelector('query', selector.path);
|
||||
const entries = [...url.searchParams];
|
||||
const matchingIndexes = entries.flatMap(([name], index) => name === selected.name ? [index] : []);
|
||||
if (selected.index === undefined && matchingIndexes.length !== 1) {
|
||||
throw new ExtensionError('authorization_selector_ambiguous', '授权查询字段存在多个同名值，必须选择带序号的字段');
|
||||
}
|
||||
const occurrence = selected.index ?? 0;
|
||||
if (occurrence >= matchingIndexes.length) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权查询资源字段不存在');
|
||||
}
|
||||
entries[matchingIndexes[occurrence]][1] = replacement;
|
||||
url.search = '';
|
||||
for (const [name, value] of entries) url.searchParams.append(name, value);
|
||||
return url.toString();
|
||||
}
|
||||
|
||||
export async function compileAuthorizationBaselineRequest(input: {
|
||||
baselineId: string;
|
||||
rawRequestBase64: string;
|
||||
requestUrl: string;
|
||||
publicUrl: string;
|
||||
selector: BrowserAuthorizationResourceSelector & { source: 'wire' };
|
||||
replacement: BrowserAuthorizationResourceValue;
|
||||
comparisonKey: string;
|
||||
isHttps: boolean;
|
||||
}): Promise<BrowserAuthorizationCompiledRequest> {
|
||||
const packet = parseAuthorizationRequestPacket(input.rawRequestBase64);
|
||||
const method = packet.method.toUpperCase();
|
||||
if (input.replacement.source !== 'wire'
|
||||
|| input.replacement.location !== input.selector.location
|
||||
|| input.replacement.path !== input.selector.path
|
||||
|| !['string', 'number', 'boolean'].includes(input.replacement.valueType)) {
|
||||
throw new ExtensionError('authorization_value_invalid', '授权资源值与矩阵选择器不匹配');
|
||||
}
|
||||
const replacementBytes = base64ToBytes(input.replacement.valueBase64);
|
||||
if (replacementBytes.byteLength !== input.replacement.byteLength
|
||||
|| replacementBytes.byteLength > MAX_RESOURCE_VALUE_BYTES) {
|
||||
throw new ExtensionError('authorization_value_invalid', '授权资源值长度无效');
|
||||
}
|
||||
let replacementText: string;
|
||||
try {
|
||||
replacementText = new TextDecoder('utf-8', { fatal: true }).decode(replacementBytes);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_value_invalid', '授权资源值不是有效的 UTF-8 字符串');
|
||||
}
|
||||
let replacement: string | number | boolean;
|
||||
if (input.replacement.valueType === 'string') {
|
||||
replacement = replacementText;
|
||||
} else if (input.replacement.valueType === 'number') {
|
||||
try {
|
||||
const parsed: unknown = JSON.parse(replacementText);
|
||||
if (
|
||||
typeof parsed !== 'number'
|
||||
|| !Number.isFinite(parsed)
|
||||
|| JSON.stringify(parsed) !== replacementText
|
||||
) {
|
||||
throw new Error('not canonical');
|
||||
}
|
||||
replacement = parsed;
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_value_invalid', '授权数字资源值不是规范 JSON 数字');
|
||||
}
|
||||
} else if (replacementText === 'true' || replacementText === 'false') {
|
||||
replacement = replacementText === 'true';
|
||||
} else {
|
||||
throw new ExtensionError('authorization_value_invalid', '授权布尔资源值必须是 true 或 false');
|
||||
}
|
||||
const fingerprint = await fingerprintAuthorizationComparisonValue(
|
||||
input.comparisonKey,
|
||||
replacementText,
|
||||
);
|
||||
if (fingerprint !== input.replacement.valueFingerprint) {
|
||||
throw new ExtensionError('authorization_value_invalid', '授权资源值指纹校验失败');
|
||||
}
|
||||
const selector = input.selector;
|
||||
const selectorLocation = selector.location;
|
||||
if (selectorLocation === 'body') {
|
||||
const origin = new URL(input.requestUrl).origin;
|
||||
const transformed = replaceStructuredAuthorizationBodyValue({
|
||||
packet: authorizationRequestToTransformPacket(input.rawRequestBase64, origin),
|
||||
path: selector.path,
|
||||
replacement,
|
||||
});
|
||||
const rawBytes = base64ToBytes(input.rawRequestBase64);
|
||||
const compiled: BrowserAuthorizationCompiledRequest = {
|
||||
version: 1,
|
||||
baselineId: input.baselineId,
|
||||
selector,
|
||||
method: method as BrowserAuthorizationCompiledRequest['method'],
|
||||
url: input.publicUrl,
|
||||
isHttps: input.isHttps,
|
||||
rawRequestBase64: input.rawRequestBase64,
|
||||
resourceValueFingerprint: input.replacement.valueFingerprint,
|
||||
packetFingerprint: `sha256:${[...new Uint8Array(await crypto.subtle.digest(
|
||||
'SHA-256',
|
||||
Uint8Array.from(rawBytes).buffer,
|
||||
))].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`,
|
||||
};
|
||||
return applyAuthorizationTransformExecution({
|
||||
compiled,
|
||||
execution: {
|
||||
profileId: 'authorization-structured-body',
|
||||
direction: 'request',
|
||||
url: transformed.url,
|
||||
bodyBase64: transformed.bodyBase64,
|
||||
setHeaders: [],
|
||||
removeHeaders: [],
|
||||
logicalInput: undefined,
|
||||
logicalOutput: undefined,
|
||||
nodeDurations: [],
|
||||
nodeTrace: [],
|
||||
fieldChanges: [],
|
||||
durationMs: 0,
|
||||
},
|
||||
origin,
|
||||
allowedDestinations: [selector.path],
|
||||
allowBody: true,
|
||||
});
|
||||
}
|
||||
if (typeof replacement !== 'string') {
|
||||
throw new ExtensionError(
|
||||
'authorization_value_invalid',
|
||||
'Header、Path 与 Query 资源替换只接受字符串',
|
||||
);
|
||||
}
|
||||
if (selectorLocation === 'header' && /[\u0000\r\n]/.test(replacement as string)) {
|
||||
throw new ExtensionError('authorization_value_invalid', '授权 Header 资源值包含非法控制字符');
|
||||
}
|
||||
const requestUrl = selectorLocation === 'header'
|
||||
? input.requestUrl
|
||||
: replaceAuthorizationResourceValue(
|
||||
input.requestUrl,
|
||||
{ location: selectorLocation, path: selector.path },
|
||||
replacement as string,
|
||||
);
|
||||
const originalOrigin = new URL(input.requestUrl).origin;
|
||||
if (new URL(requestUrl).origin !== originalOrigin) {
|
||||
throw new ExtensionError('authorization_origin_changed', '资源替换不能改变请求来源');
|
||||
}
|
||||
const url = new URL(requestUrl);
|
||||
const target = selectorLocation === 'header'
|
||||
? packet.requestTarget
|
||||
: `${url.pathname || '/'}${url.search}`;
|
||||
const requestLine = new TextEncoder().encode(`${method} ${target} ${packet.protocol}\r\n`);
|
||||
const firstLineEnd = packet.bytes.findIndex(
|
||||
(byte, index) => byte === 13 && packet.bytes[index + 1] === 10,
|
||||
);
|
||||
if (firstLineEnd < 0 || firstLineEnd >= packet.bodyOffset - 4) {
|
||||
throw new ExtensionError('authorization_baseline_invalid', '授权基线请求行边界无效');
|
||||
}
|
||||
let remainder = packet.bytes.subarray(firstLineEnd + 2);
|
||||
if (selectorLocation === 'header') {
|
||||
const selected = parameterSelector('header', selector.path);
|
||||
const headerBytes = packet.bytes.subarray(firstLineEnd + 2, packet.bodyOffset - 4);
|
||||
const headerLines = new TextDecoder('utf-8', { fatal: true }).decode(headerBytes).split('\r\n');
|
||||
const matching = headerLines.flatMap((line, index) => {
|
||||
const separator = line.indexOf(':');
|
||||
return separator > 0 && line.slice(0, separator).trim().toLowerCase() === selected.name.toLowerCase()
|
||||
? [index]
|
||||
: [];
|
||||
});
|
||||
if (selected.index === undefined && matching.length !== 1) {
|
||||
throw new ExtensionError('authorization_selector_ambiguous', '授权 Header 字段存在多个同名值，必须选择带序号的字段');
|
||||
}
|
||||
const occurrence = selected.index ?? 0;
|
||||
if (occurrence >= matching.length) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '授权 Header 资源字段不存在');
|
||||
}
|
||||
const lineIndex = matching[occurrence];
|
||||
const separator = headerLines[lineIndex].indexOf(':');
|
||||
headerLines[lineIndex] = `${headerLines[lineIndex].slice(0, separator)}: ${replacement as string}`;
|
||||
const rewrittenHeaders = new TextEncoder().encode(`${headerLines.join('\r\n')}\r\n\r\n`);
|
||||
const body = packet.bytes.subarray(packet.bodyOffset);
|
||||
remainder = new Uint8Array(rewrittenHeaders.byteLength + body.byteLength);
|
||||
remainder.set(rewrittenHeaders);
|
||||
remainder.set(body, rewrittenHeaders.byteLength);
|
||||
}
|
||||
const compiled = new Uint8Array(requestLine.byteLength + remainder.byteLength);
|
||||
compiled.set(requestLine);
|
||||
compiled.set(remainder, requestLine.byteLength);
|
||||
return {
|
||||
version: 1,
|
||||
baselineId: input.baselineId,
|
||||
selector,
|
||||
method: method as BrowserAuthorizationCompiledRequest['method'],
|
||||
url: input.publicUrl,
|
||||
isHttps: input.isHttps,
|
||||
rawRequestBase64: bytesToBase64(compiled),
|
||||
resourceValueFingerprint: input.replacement.valueFingerprint,
|
||||
packetFingerprint: `sha256:${[...new Uint8Array(await crypto.subtle.digest(
|
||||
'SHA-256',
|
||||
Uint8Array.from(compiled).buffer,
|
||||
))].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`,
|
||||
};
|
||||
}
|
||||
|
||||
function normalizedTransformDestination(destination: string): string {
|
||||
const trimmed = destination.trim();
|
||||
if (trimmed.toLowerCase().startsWith('header.')) {
|
||||
return `header.${trimmed.slice(7).trim().toLowerCase()}`;
|
||||
}
|
||||
return trimmed;
|
||||
}
|
||||
|
||||
function queryValueMap(url: URL): Map<string, string[]> {
|
||||
const output = new Map<string, string[]>();
|
||||
for (const [name, value] of url.searchParams) {
|
||||
output.set(name, [...(output.get(name) || []), value]);
|
||||
}
|
||||
return output;
|
||||
}
|
||||
|
||||
function sameStringValues(left: string[] | undefined, right: string[] | undefined): boolean {
|
||||
return JSON.stringify(left || []) === JSON.stringify(right || []);
|
||||
}
|
||||
|
||||
export function authorizationRequestToTransformPacket(
|
||||
rawRequestBase64: string,
|
||||
origin: string,
|
||||
): BrowserTransformPacket {
|
||||
const parsed = parseAuthorizationRequestPacket(rawRequestBase64);
|
||||
let url: URL;
|
||||
try {
|
||||
url = new URL(parsed.requestTarget, origin);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_baseline_invalid', '授权基线请求目标无法转换为页面报文');
|
||||
}
|
||||
if (url.origin !== origin || url.hash) {
|
||||
throw new ExtensionError('authorization_origin_changed', '授权基线请求目标超出了认证来源');
|
||||
}
|
||||
return {
|
||||
method: parsed.method,
|
||||
url: url.toString(),
|
||||
headers: parsed.headers,
|
||||
bodyBase64: bytesToBase64(parsed.bytes.subarray(parsed.bodyOffset)),
|
||||
};
|
||||
}
|
||||
|
||||
export async function applyAuthorizationTransformExecution(input: {
|
||||
compiled: BrowserAuthorizationCompiledRequest;
|
||||
execution: BrowserTransformExecution;
|
||||
origin: string;
|
||||
allowedDestinations: string[];
|
||||
allowBody?: boolean;
|
||||
}): Promise<BrowserAuthorizationCompiledRequest> {
|
||||
const packet = parseAuthorizationRequestPacket(input.compiled.rawRequestBase64);
|
||||
const baselinePacket = authorizationRequestToTransformPacket(
|
||||
input.compiled.rawRequestBase64,
|
||||
input.origin,
|
||||
);
|
||||
const allowed = new Set(input.allowedDestinations.map(normalizedTransformDestination));
|
||||
const bodyChanged = input.execution.bodyBase64 !== baselinePacket.bodyBase64;
|
||||
const bodyAllowed = input.allowBody && [...allowed].some(
|
||||
(destination) => destination === 'body'
|
||||
|| destination.startsWith('body.')
|
||||
|| destination.startsWith('body['),
|
||||
);
|
||||
if (bodyChanged && !bodyAllowed) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_unsupported',
|
||||
'授权动态重算只有在逻辑明文绑定后才能改写 Body',
|
||||
);
|
||||
}
|
||||
let transformedURL: URL;
|
||||
const originalURL = new URL(baselinePacket.url);
|
||||
try {
|
||||
transformedURL = new URL(input.execution.url);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_transform_invalid', 'Transform Profile 返回了无效 URL');
|
||||
}
|
||||
if (
|
||||
transformedURL.origin !== input.origin
|
||||
|| transformedURL.pathname !== originalURL.pathname
|
||||
|| transformedURL.hash
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_invalid',
|
||||
'动态重算不能改变请求来源、路径或 fragment',
|
||||
);
|
||||
}
|
||||
const originalQuery = queryValueMap(originalURL);
|
||||
const transformedQuery = queryValueMap(transformedURL);
|
||||
const queryNames = new Set([...originalQuery.keys(), ...transformedQuery.keys()]);
|
||||
for (const name of queryNames) {
|
||||
if (
|
||||
!sameStringValues(originalQuery.get(name), transformedQuery.get(name))
|
||||
&& !allowed.has(`query.${name}`)
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_invalid',
|
||||
`Transform Profile 改写了未声明的查询字段: ${name}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
const forbiddenHeaders = new Set(['authorization', 'cookie', 'proxy-authorization', 'host']);
|
||||
const removed = new Set<string>();
|
||||
for (const name of input.execution.removeHeaders) {
|
||||
const normalized = name.trim().toLowerCase();
|
||||
if (
|
||||
forbiddenHeaders.has(normalized)
|
||||
|| !allowed.has(`header.${normalized}`)
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_invalid',
|
||||
`Transform Profile 尝试删除认证材料或未声明 Header: ${name}`,
|
||||
);
|
||||
}
|
||||
removed.add(normalized);
|
||||
}
|
||||
const replacements = new Map<string, { name: string; value: string }>();
|
||||
for (const header of input.execution.setHeaders) {
|
||||
const normalized = header.name.trim().toLowerCase();
|
||||
if (
|
||||
!normalized
|
||||
|| /[\r\n:]/.test(header.name)
|
||||
|| /[\r\n]/.test(header.value)
|
||||
|| forbiddenHeaders.has(normalized)
|
||||
|| !allowed.has(`header.${normalized}`)
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_invalid',
|
||||
`Transform Profile 尝试改写认证材料或未声明 Header: ${header.name}`,
|
||||
);
|
||||
}
|
||||
replacements.set(normalized, { name: header.name.trim(), value: header.value });
|
||||
removed.delete(normalized);
|
||||
}
|
||||
|
||||
let headers = packet.headers.filter(
|
||||
(header) => !removed.has(header.name.toLowerCase())
|
||||
&& !replacements.has(header.name.toLowerCase()),
|
||||
);
|
||||
headers.push(...replacements.values());
|
||||
const host = headers.find((header) => header.name.toLowerCase() === 'host')?.value;
|
||||
if (!host || host !== transformedURL.host) {
|
||||
throw new ExtensionError('authorization_transform_invalid', '动态重算后的 Host 与认证来源不一致');
|
||||
}
|
||||
const body = bodyChanged
|
||||
? base64ToBytes(input.execution.bodyBase64)
|
||||
: packet.bytes.subarray(packet.bodyOffset);
|
||||
if (body.byteLength > 2 * 1_024 * 1_024) {
|
||||
throw new ExtensionError('authorization_transform_invalid', '动态重算后的请求 Body 超过 2 MiB 上限');
|
||||
}
|
||||
if (bodyChanged) {
|
||||
headers = headers.filter((header) => {
|
||||
const name = header.name.toLowerCase();
|
||||
return name !== 'content-length' && name !== 'transfer-encoding';
|
||||
});
|
||||
headers.push({ name: 'Content-Length', value: String(body.byteLength) });
|
||||
}
|
||||
const head = [
|
||||
`${packet.method} ${transformedURL.pathname || '/'}${transformedURL.search} ${packet.protocol}`,
|
||||
...headers.map((header) => `${header.name}: ${header.value}`),
|
||||
'',
|
||||
'',
|
||||
].join('\r\n');
|
||||
const headBytes = new TextEncoder().encode(head);
|
||||
const raw = new Uint8Array(headBytes.byteLength + body.byteLength);
|
||||
raw.set(headBytes);
|
||||
raw.set(body, headBytes.byteLength);
|
||||
return {
|
||||
...input.compiled,
|
||||
rawRequestBase64: bytesToBase64(raw),
|
||||
packetFingerprint: `sha256:${[...new Uint8Array(await crypto.subtle.digest(
|
||||
'SHA-256',
|
||||
Uint8Array.from(raw).buffer,
|
||||
))].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`,
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,262 @@
|
||||
import { beforeEach, describe, expect, it, vi } from 'vitest';
|
||||
|
||||
const mocks = vi.hoisted(() => ({
|
||||
session: {} as Record<string, unknown>,
|
||||
getContext: vi.fn(),
|
||||
loadLogicalBinding: vi.fn(),
|
||||
listNetworkRequests: vi.fn(),
|
||||
exportNetworkRequest: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock('wxt/browser', () => ({
|
||||
browser: {
|
||||
storage: {
|
||||
session: {
|
||||
async get(key: string) {
|
||||
return key in mocks.session
|
||||
? { [key]: structuredClone(mocks.session[key]) }
|
||||
: {};
|
||||
},
|
||||
async set(values: Record<string, unknown>) {
|
||||
Object.assign(mocks.session, structuredClone(values));
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}));
|
||||
|
||||
vi.mock('./auth-context', () => ({
|
||||
getAuthContextHandle: (...args: unknown[]) => mocks.getContext(...args),
|
||||
}));
|
||||
|
||||
vi.mock('./auth-attestation', () => ({
|
||||
getAuthContextAttestation: (...args: unknown[]) => mocks.getContext(...args),
|
||||
}));
|
||||
|
||||
vi.mock('@/features/network-capture/service', () => ({
|
||||
exportNetworkRequest: (...args: unknown[]) => mocks.exportNetworkRequest(...args),
|
||||
listNetworkRequests: (...args: unknown[]) => mocks.listNetworkRequests(...args),
|
||||
}));
|
||||
|
||||
vi.mock('@/features/browser-transform/service', () => ({
|
||||
executeBrowserTransform: vi.fn(),
|
||||
getBrowserTransformProfile: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock('@/features/browser-transform/replay-draft', () => ({
|
||||
browserTransformReplayDraftToPacket: vi.fn(),
|
||||
getBrowserTransformReplayDraft: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock('./logical-binding', () => ({
|
||||
assertAuthorizationLogicalPacketStructure: vi.fn(),
|
||||
authorizationPacketFingerprint: vi.fn(),
|
||||
buildAuthorizationLogicalRequestBinding: vi.fn(),
|
||||
decodeAndVerifyLogicalReplacement: vi.fn(),
|
||||
loadAuthorizationLogicalRequestBinding: (...args: unknown[]) => (
|
||||
mocks.loadLogicalBinding(...args)
|
||||
),
|
||||
readAuthorizationLogicalResource: vi.fn(),
|
||||
replaceAuthorizationLogicalResource: vi.fn(),
|
||||
}));
|
||||
|
||||
const storageKey = 'browser.authorization.baselines.v1';
|
||||
const expiresAt = 4_102_444_800_000;
|
||||
const fingerprint = `sha256:${'a'.repeat(64)}`;
|
||||
|
||||
function target(documentId = 'document-a') {
|
||||
return { tabId: 7, frameId: 0, documentId };
|
||||
}
|
||||
|
||||
function context(documentId = 'document-a') {
|
||||
return {
|
||||
version: 1,
|
||||
id: 'context-a',
|
||||
slotId: 'left',
|
||||
deviceId: 'device-a',
|
||||
installationId: 'installation-a',
|
||||
isolationContextId: 'isolation-a',
|
||||
isolationProofId: 'proof-a',
|
||||
cookieStoreId: 'store-a',
|
||||
origin: 'https://example.test',
|
||||
grantId: 'grant-a',
|
||||
target: target(documentId),
|
||||
fingerprint,
|
||||
authentication: {
|
||||
status: 'authenticated',
|
||||
cookieCount: 1,
|
||||
storageEntryCount: 0,
|
||||
authCookieNames: ['session'],
|
||||
authStorageKeys: [],
|
||||
},
|
||||
createdAt: 1,
|
||||
expiresAt,
|
||||
};
|
||||
}
|
||||
|
||||
function storedBaseline(withLogicalBinding = false) {
|
||||
const request = {
|
||||
method: 'GET',
|
||||
url: 'https://example.test/account',
|
||||
path: '/account',
|
||||
contentType: '',
|
||||
actionFingerprint: fingerprint,
|
||||
headerNames: ['cookie'],
|
||||
fields: [],
|
||||
};
|
||||
const snapshot = {
|
||||
version: 1,
|
||||
id: 'baseline-a',
|
||||
deviceId: 'device-a',
|
||||
installationId: 'installation-a',
|
||||
isolationContextId: 'isolation-a',
|
||||
cookieStoreId: 'store-a',
|
||||
origin: 'https://example.test',
|
||||
grantId: 'grant-a',
|
||||
target: target(),
|
||||
authContextReference: { kind: 'handle', id: 'context-a' },
|
||||
networkRequestId: 'request-a',
|
||||
request,
|
||||
createdAt: 1,
|
||||
expiresAt,
|
||||
...(withLogicalBinding ? {
|
||||
logicalRequest: {
|
||||
version: 1,
|
||||
source: 'local-replay-draft',
|
||||
baselineId: 'baseline-a',
|
||||
profileId: 'profile-a',
|
||||
profileName: 'account gateway',
|
||||
isolationContextId: 'isolation-a',
|
||||
cookieStoreId: 'store-a',
|
||||
target: target(),
|
||||
origin: 'https://example.test',
|
||||
request,
|
||||
outputDestinations: ['body.encryptedData'],
|
||||
validation: {
|
||||
proofLevel: 'structure',
|
||||
summary: 'validated',
|
||||
warnings: [],
|
||||
},
|
||||
bindingFingerprint: fingerprint,
|
||||
profileUpdatedAt: 2,
|
||||
replayUpdatedAt: 2,
|
||||
createdAt: 2,
|
||||
expiresAt,
|
||||
},
|
||||
} : {}),
|
||||
};
|
||||
return {
|
||||
snapshot,
|
||||
rawRequestBase64: btoa('GET /account HTTP/1.1\r\nHost: example.test\r\n\r\n'),
|
||||
requestUrl: 'https://example.test/account',
|
||||
isHttps: true,
|
||||
};
|
||||
}
|
||||
|
||||
async function loadService() {
|
||||
return import('./baseline');
|
||||
}
|
||||
|
||||
describe('authorization baseline lifecycle recovery', () => {
|
||||
beforeEach(() => {
|
||||
vi.resetModules();
|
||||
for (const key of Object.keys(mocks.session)) delete mocks.session[key];
|
||||
mocks.getContext.mockReset().mockResolvedValue(context());
|
||||
mocks.loadLogicalBinding.mockReset().mockResolvedValue({});
|
||||
mocks.listNetworkRequests.mockReset().mockResolvedValue([]);
|
||||
mocks.exportNetworkRequest.mockReset();
|
||||
});
|
||||
|
||||
it('invalidates and removes a baseline after its page document changes', async () => {
|
||||
mocks.session[storageKey] = [storedBaseline()];
|
||||
mocks.getContext.mockResolvedValue(context('document-b'));
|
||||
const { getAuthorizationBaseline } = await loadService();
|
||||
|
||||
await expect(
|
||||
getAuthorizationBaseline('baseline-a', 'grant-a'),
|
||||
).rejects.toMatchObject({ code: 'authorization_baseline_stale' });
|
||||
expect(mocks.session[storageKey]).toEqual([]);
|
||||
});
|
||||
|
||||
it('invalidates and removes a baseline after its isolation context disappears', async () => {
|
||||
mocks.session[storageKey] = [storedBaseline()];
|
||||
mocks.getContext.mockRejectedValue(new Error('context unavailable'));
|
||||
const { getAuthorizationBaseline } = await loadService();
|
||||
|
||||
await expect(
|
||||
getAuthorizationBaseline('baseline-a', 'grant-a'),
|
||||
).rejects.toMatchObject({ code: 'authorization_baseline_stale' });
|
||||
expect(mocks.session[storageKey]).toEqual([]);
|
||||
});
|
||||
|
||||
it('drops only the logical binding when its callable or Profile proof changes', async () => {
|
||||
mocks.session[storageKey] = [storedBaseline(true)];
|
||||
mocks.loadLogicalBinding.mockRejectedValue(new Error('binding changed'));
|
||||
const { getAuthorizationBaseline } = await loadService();
|
||||
|
||||
const baseline = await getAuthorizationBaseline('baseline-a', 'grant-a');
|
||||
|
||||
expect(baseline.logicalRequest).toBeUndefined();
|
||||
const retained = mocks.session[storageKey] as Array<{
|
||||
snapshot: { logicalRequest?: unknown };
|
||||
}>;
|
||||
expect(retained).toHaveLength(1);
|
||||
expect(retained[0].snapshot.logicalRequest).toBeUndefined();
|
||||
});
|
||||
|
||||
it('shows same-site WebSocket handshakes as an explicit fail-closed boundary', async () => {
|
||||
mocks.listNetworkRequests.mockResolvedValue([{
|
||||
id: 'socket-a',
|
||||
requestId: 'request-socket-a',
|
||||
tabId: 7,
|
||||
frameId: 0,
|
||||
documentId: 'document-a',
|
||||
url: 'wss://example.test/events?tenant=alpha',
|
||||
method: 'GET',
|
||||
resourceType: 'websocket',
|
||||
startedAt: 100,
|
||||
completedAt: 101,
|
||||
statusCode: 101,
|
||||
requestHeadersCaptured: true,
|
||||
requestBodyCaptured: true,
|
||||
redirects: [],
|
||||
}]);
|
||||
const { listAuthorizationBaselineCandidates } = await loadService();
|
||||
|
||||
const candidates = await listAuthorizationBaselineCandidates({
|
||||
target: target(),
|
||||
grantId: 'grant-a',
|
||||
authContextKind: 'handle',
|
||||
authContextId: 'context-a',
|
||||
limit: 20,
|
||||
});
|
||||
|
||||
expect(candidates).toHaveLength(1);
|
||||
expect(candidates[0]).toMatchObject({
|
||||
id: 'socket-a',
|
||||
resourceType: 'websocket',
|
||||
eligible: false,
|
||||
});
|
||||
expect(candidates[0].reasons[0]).toContain('不会进入 HTTP 授权矩阵');
|
||||
});
|
||||
|
||||
it('rejects a WebSocket handshake even when called outside candidate selection', async () => {
|
||||
mocks.exportNetworkRequest.mockResolvedValue({
|
||||
id: 'socket-a',
|
||||
url: 'wss://example.test/events',
|
||||
isHttps: true,
|
||||
rawRequestBase64: btoa('GET /events HTTP/1.1\r\nHost: example.test\r\n\r\n'),
|
||||
limitations: [],
|
||||
});
|
||||
const { captureAuthorizationBaseline } = await loadService();
|
||||
|
||||
await expect(captureAuthorizationBaseline({
|
||||
target: target(),
|
||||
grantId: 'grant-a',
|
||||
authContextKind: 'handle',
|
||||
authContextId: 'context-a',
|
||||
networkRequestId: 'socket-a',
|
||||
comparisonKey: 'A'.repeat(43),
|
||||
})).rejects.toMatchObject({ code: 'authorization_protocol_unsupported' });
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,289 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import { parseAuthorizationBaselineRequest } from './baseline-metadata';
|
||||
|
||||
const comparisonKey = 'A'.repeat(43);
|
||||
|
||||
function base64(value: string): string {
|
||||
const bytes = new TextEncoder().encode(value);
|
||||
let binary = '';
|
||||
for (const byte of bytes) binary += String.fromCharCode(byte);
|
||||
return btoa(binary);
|
||||
}
|
||||
|
||||
function request(orderId: number, token: string): string {
|
||||
const body = JSON.stringify({
|
||||
orderId,
|
||||
profile: { userId: `user-${orderId}` },
|
||||
password: `password-${orderId}`,
|
||||
clientSecret: `client-secret-${orderId}`,
|
||||
note: 'visible-business-value',
|
||||
});
|
||||
return [
|
||||
'POST /api/orders?tenantId=tenant-a HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/json',
|
||||
`Authorization: Bearer ${token}`,
|
||||
`Cookie: session=${token}`,
|
||||
'X-CSRF-Token: csrf-secret',
|
||||
`X-Tenant-Id: tenant-${orderId}`,
|
||||
'',
|
||||
body,
|
||||
].join('\r\n');
|
||||
}
|
||||
|
||||
function pathRequest(orderId: number): string {
|
||||
return [
|
||||
`GET /api/orders/${orderId} HTTP/1.1`,
|
||||
'Host: example.test',
|
||||
'Accept: application/json',
|
||||
'',
|
||||
'',
|
||||
].join('\r\n');
|
||||
}
|
||||
|
||||
function graphqlRequest(input: {
|
||||
operationName: string;
|
||||
query: string;
|
||||
orderId: number;
|
||||
password?: string;
|
||||
}): string {
|
||||
const body = JSON.stringify({
|
||||
operationName: input.operationName,
|
||||
query: input.query,
|
||||
variables: {
|
||||
orderId: input.orderId,
|
||||
password: input.password || `password-${input.orderId}`,
|
||||
},
|
||||
});
|
||||
return [
|
||||
'POST /graphql HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/json',
|
||||
'',
|
||||
body,
|
||||
].join('\r\n');
|
||||
}
|
||||
|
||||
describe('authorization baseline request metadata', () => {
|
||||
it('returns structural evidence and comparable fingerprints without raw values', async () => {
|
||||
const metadata = await parseAuthorizationBaselineRequest(
|
||||
base64(request(42, 'token-secret')),
|
||||
'https://example.test/api/orders?tenantId=tenant-a',
|
||||
comparisonKey,
|
||||
);
|
||||
const serialized = JSON.stringify(metadata);
|
||||
|
||||
expect(metadata.method).toBe('POST');
|
||||
expect(metadata.url).toBe('https://example.test/api/orders');
|
||||
expect(metadata.path).toBe('/api/orders');
|
||||
expect(serialized).not.toContain('token-secret');
|
||||
expect(serialized).not.toContain('csrf-secret');
|
||||
expect(serialized).not.toContain('visible-business-value');
|
||||
expect(metadata.fields.find((field) => field.path === 'header.authorization')).toMatchObject({
|
||||
category: 'authentication',
|
||||
valueType: 'string',
|
||||
});
|
||||
expect(metadata.fields.find((field) => field.path === 'header.x-csrf-token')).toMatchObject({
|
||||
category: 'csrf',
|
||||
});
|
||||
expect(metadata.fields.find((field) => field.path === 'body.orderId')).toMatchObject({
|
||||
category: 'resource',
|
||||
valueType: 'number',
|
||||
});
|
||||
expect(metadata.fields.find((field) => field.path === 'body.password')).toMatchObject({
|
||||
category: 'authentication',
|
||||
});
|
||||
expect(metadata.fields.find((field) => field.path === 'body.clientSecret')).toMatchObject({
|
||||
category: 'authentication',
|
||||
});
|
||||
expect(metadata.fields.find((field) => field.path === 'header.x-tenant-id')).toMatchObject({
|
||||
category: 'resource',
|
||||
valueType: 'string',
|
||||
});
|
||||
});
|
||||
|
||||
it('keeps action shape stable while exposing value changes through a shared workspace HMAC', async () => {
|
||||
const left = await parseAuthorizationBaselineRequest(
|
||||
base64(request(42, 'token-left')),
|
||||
'https://example.test/api/orders?tenantId=tenant-a',
|
||||
comparisonKey,
|
||||
);
|
||||
const right = await parseAuthorizationBaselineRequest(
|
||||
base64(request(84, 'token-right')),
|
||||
'https://example.test/api/orders?tenantId=tenant-a',
|
||||
comparisonKey,
|
||||
);
|
||||
const leftOrder = left.fields.find((field) => field.path === 'body.orderId');
|
||||
const rightOrder = right.fields.find((field) => field.path === 'body.orderId');
|
||||
const leftTenant = left.fields.find((field) => field.path === 'query.tenantId');
|
||||
const rightTenant = right.fields.find((field) => field.path === 'query.tenantId');
|
||||
|
||||
expect(left.actionFingerprint).toBe(right.actionFingerprint);
|
||||
expect(leftOrder?.valueFingerprint).not.toBe(rightOrder?.valueFingerprint);
|
||||
expect(leftTenant?.valueFingerprint).toBe(rightTenant?.valueFingerprint);
|
||||
});
|
||||
|
||||
it('rejects caller-supplied comparison keys with the wrong size', async () => {
|
||||
await expect(parseAuthorizationBaselineRequest(
|
||||
base64(request(42, 'token')),
|
||||
'https://example.test/api/orders',
|
||||
'A'.repeat(42),
|
||||
)).rejects.toThrow('32 字节');
|
||||
});
|
||||
|
||||
it('normalizes path identifiers while retaining a comparable resource selector', async () => {
|
||||
const left = await parseAuthorizationBaselineRequest(
|
||||
base64(pathRequest(42)),
|
||||
'https://example.test/api/orders/42',
|
||||
comparisonKey,
|
||||
);
|
||||
const right = await parseAuthorizationBaselineRequest(
|
||||
base64(pathRequest(84)),
|
||||
'https://example.test/api/orders/84',
|
||||
comparisonKey,
|
||||
);
|
||||
const leftResource = left.fields.find((field) => field.path === 'path.segment[2]');
|
||||
const rightResource = right.fields.find((field) => field.path === 'path.segment[2]');
|
||||
|
||||
expect(left.path).toBe('/api/orders/:resource');
|
||||
expect(left.url).toBe('https://example.test/api/orders/:resource');
|
||||
expect(left.actionFingerprint).toBe(right.actionFingerprint);
|
||||
expect(leftResource).toMatchObject({ location: 'path', category: 'resource' });
|
||||
expect(leftResource?.valueFingerprint).not.toBe(rightResource?.valueFingerprint);
|
||||
});
|
||||
|
||||
it('pairs the same GraphQL operation while exposing variables as typed resource fields', async () => {
|
||||
const query = 'query Order($orderId: ID!) { order(id: $orderId) { id total } }';
|
||||
const left = await parseAuthorizationBaselineRequest(
|
||||
base64(graphqlRequest({
|
||||
operationName: 'Order',
|
||||
query,
|
||||
orderId: 42,
|
||||
})),
|
||||
'https://example.test/graphql',
|
||||
comparisonKey,
|
||||
);
|
||||
const right = await parseAuthorizationBaselineRequest(
|
||||
base64(graphqlRequest({
|
||||
operationName: 'Order',
|
||||
query,
|
||||
orderId: 84,
|
||||
})),
|
||||
'https://example.test/graphql',
|
||||
comparisonKey,
|
||||
);
|
||||
|
||||
expect(left).toMatchObject({
|
||||
protocol: 'graphql',
|
||||
operationNames: ['Order'],
|
||||
});
|
||||
expect(left.operationFingerprint).toBe(right.operationFingerprint);
|
||||
expect(left.actionFingerprint).toBe(right.actionFingerprint);
|
||||
expect(left.fields.find((item) => item.path === 'body.variables.orderId')).toMatchObject({
|
||||
location: 'body',
|
||||
category: 'resource',
|
||||
valueType: 'number',
|
||||
});
|
||||
expect(left.fields.find((item) => item.path === 'body.variables.password')).toMatchObject({
|
||||
category: 'authentication',
|
||||
});
|
||||
expect(JSON.stringify(left)).not.toContain(query);
|
||||
});
|
||||
|
||||
it('fails closed when the same GraphQL endpoint carries a different operation', async () => {
|
||||
const order = await parseAuthorizationBaselineRequest(
|
||||
base64(graphqlRequest({
|
||||
operationName: 'Order',
|
||||
query: 'query Order($orderId: ID!) { order(id: $orderId) { id } }',
|
||||
orderId: 42,
|
||||
})),
|
||||
'https://example.test/graphql',
|
||||
comparisonKey,
|
||||
);
|
||||
const cancel = await parseAuthorizationBaselineRequest(
|
||||
base64(graphqlRequest({
|
||||
operationName: 'CancelOrder',
|
||||
query: 'mutation CancelOrder($orderId: ID!) { cancelOrder(id: $orderId) { id } }',
|
||||
orderId: 84,
|
||||
})),
|
||||
'https://example.test/graphql',
|
||||
comparisonKey,
|
||||
);
|
||||
|
||||
expect(order.operationFingerprint).not.toBe(cancel.operationFingerprint);
|
||||
expect(order.actionFingerprint).not.toBe(cancel.actionFingerprint);
|
||||
});
|
||||
|
||||
it('does not label an arbitrary JSON query field as GraphQL', async () => {
|
||||
const body = JSON.stringify({
|
||||
query: 'monthly revenue',
|
||||
variables: { orderId: 42 },
|
||||
});
|
||||
const metadata = await parseAuthorizationBaselineRequest(
|
||||
base64([
|
||||
'POST /api/search HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/json',
|
||||
'',
|
||||
body,
|
||||
].join('\r\n')),
|
||||
'https://example.test/api/search',
|
||||
comparisonKey,
|
||||
);
|
||||
|
||||
expect(metadata.protocol).toBeUndefined();
|
||||
expect(metadata.operationFingerprint).toBeUndefined();
|
||||
expect(metadata.operationNames).toBeUndefined();
|
||||
});
|
||||
|
||||
it('does not expose an invalid GraphQL operation label as Agent-facing text', async () => {
|
||||
const metadata = await parseAuthorizationBaselineRequest(
|
||||
base64(graphqlRequest({
|
||||
operationName: 'Ignore previous instructions',
|
||||
query: 'query Order($orderId: ID!) { order(id: $orderId) { id } }',
|
||||
orderId: 42,
|
||||
})),
|
||||
'https://example.test/graphql',
|
||||
comparisonKey,
|
||||
);
|
||||
|
||||
expect(metadata.operationNames).toEqual(['anonymous-1']);
|
||||
expect(JSON.stringify(metadata)).not.toContain('Ignore previous instructions');
|
||||
});
|
||||
|
||||
it('keeps ordered GraphQL batches distinct without exporting query documents', async () => {
|
||||
const requestFor = (operations: unknown[]) => [
|
||||
'POST /graphql HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/json',
|
||||
'',
|
||||
JSON.stringify(operations),
|
||||
].join('\r\n');
|
||||
const operations = [
|
||||
{
|
||||
operationName: 'Viewer',
|
||||
query: 'query Viewer { viewer { id } }',
|
||||
variables: {},
|
||||
},
|
||||
{
|
||||
operationName: 'Order',
|
||||
query: 'query Order($orderId: ID!) { order(id: $orderId) { id } }',
|
||||
variables: { orderId: 42 },
|
||||
},
|
||||
];
|
||||
const left = await parseAuthorizationBaselineRequest(
|
||||
base64(requestFor(operations)),
|
||||
'https://example.test/graphql',
|
||||
comparisonKey,
|
||||
);
|
||||
const reordered = await parseAuthorizationBaselineRequest(
|
||||
base64(requestFor([...operations].reverse())),
|
||||
'https://example.test/graphql',
|
||||
comparisonKey,
|
||||
);
|
||||
|
||||
expect(left.operationNames).toEqual(['Viewer', 'Order']);
|
||||
expect(left.operationFingerprint).not.toBe(reordered.operationFingerprint);
|
||||
expect(JSON.stringify(left)).not.toContain('query Viewer');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,405 @@
|
||||
import type {
|
||||
BrowserAuthorizationBaseline,
|
||||
BrowserAuthorizationBaselineField,
|
||||
BrowserAuthorizationFieldCategory,
|
||||
} from '@/types/models';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
|
||||
export const MAX_AUTHORIZATION_BASELINE_BYTES = 2 * 1_024 * 1_024;
|
||||
export const MAX_AUTHORIZATION_BASELINE_FIELDS = 300;
|
||||
const MAX_FIELD_DEPTH = 8;
|
||||
const MAX_GRAPHQL_OPERATIONS = 32;
|
||||
const AUTHENTICATION_FIELD_PATTERN =
|
||||
/(auth|access.?token|api.?key|session|jwt|bearer|credential|password|passwd|passcode|(^|[_.-])pwd($|[_.-])|client.?secret|private.?key|secret.?key|one.?time.?password|(^|[_.-])otp($|[_.-])|mfa.?code|verification.?code|(^|[_.-])pin($|[_.-])|captcha)/;
|
||||
|
||||
function base64ToBytes(value: string): Uint8Array {
|
||||
const binary = atob(value);
|
||||
return Uint8Array.from(binary, (character) => character.charCodeAt(0));
|
||||
}
|
||||
|
||||
function base64UrlToBytes(value: string): Uint8Array {
|
||||
const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
|
||||
return base64ToBytes(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '='));
|
||||
}
|
||||
|
||||
function bytesToHex(bytes: Uint8Array): string {
|
||||
return [...bytes].map((byte) => byte.toString(16).padStart(2, '0')).join('');
|
||||
}
|
||||
|
||||
async function comparisonSigner(
|
||||
encodedKey: string,
|
||||
): Promise<(value: string | Uint8Array) => Promise<string>> {
|
||||
let keyBytes: Uint8Array;
|
||||
try {
|
||||
keyBytes = base64UrlToBytes(encodedKey);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_invalid', '基线比较密钥格式无效');
|
||||
}
|
||||
if (keyBytes.byteLength !== 32) {
|
||||
throw new ExtensionError('authorization_invalid', '基线比较密钥必须为 32 字节');
|
||||
}
|
||||
const key = await crypto.subtle.importKey(
|
||||
'raw',
|
||||
Uint8Array.from(keyBytes).buffer,
|
||||
{ name: 'HMAC', hash: 'SHA-256' },
|
||||
false,
|
||||
['sign'],
|
||||
);
|
||||
return async (value: string | Uint8Array) => {
|
||||
const bytes = typeof value === 'string'
|
||||
? new TextEncoder().encode(value)
|
||||
: Uint8Array.from(value);
|
||||
const signature = await crypto.subtle.sign(
|
||||
'HMAC',
|
||||
key,
|
||||
bytes.buffer,
|
||||
);
|
||||
return `workspace-hmac-sha256:${bytesToHex(new Uint8Array(signature))}`;
|
||||
};
|
||||
}
|
||||
|
||||
export async function fingerprintAuthorizationComparisonValue(
|
||||
encodedKey: string,
|
||||
value: string | Uint8Array,
|
||||
): Promise<string> {
|
||||
return (await comparisonSigner(encodedKey))(value);
|
||||
}
|
||||
|
||||
async function sha256(value: string): Promise<string> {
|
||||
const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
|
||||
return bytesToHex(new Uint8Array(digest));
|
||||
}
|
||||
|
||||
interface GraphQLProtocolMetadata {
|
||||
protocol: 'graphql';
|
||||
operationFingerprint: string;
|
||||
operationNames: string[];
|
||||
}
|
||||
|
||||
function graphqlPersistedQueryHash(value: Record<string, unknown>): string {
|
||||
const extensions = value.extensions;
|
||||
if (!extensions || typeof extensions !== 'object' || Array.isArray(extensions)) return '';
|
||||
const persisted = (extensions as Record<string, unknown>).persistedQuery;
|
||||
if (!persisted || typeof persisted !== 'object' || Array.isArray(persisted)) return '';
|
||||
const hash = (persisted as Record<string, unknown>).sha256Hash;
|
||||
return typeof hash === 'string' && /^[a-f0-9]{64}$/i.test(hash) ? hash.toLowerCase() : '';
|
||||
}
|
||||
|
||||
function looksLikeGraphQLDocument(value: string): boolean {
|
||||
const normalized = value
|
||||
.replace(/^\uFEFF/, '')
|
||||
.replace(/(?:^|\n)\s*#[^\n]*/g, '\n')
|
||||
.trimStart();
|
||||
return /^(?:query|mutation|subscription|fragment)\b/.test(normalized)
|
||||
|| normalized.startsWith('{');
|
||||
}
|
||||
|
||||
function displayGraphQLOperationName(value: unknown, index: number): string {
|
||||
if (typeof value !== 'string') return `anonymous-${index + 1}`;
|
||||
const normalized = value.trim();
|
||||
return /^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(normalized)
|
||||
? normalized
|
||||
: `anonymous-${index + 1}`;
|
||||
}
|
||||
|
||||
async function graphqlProtocolMetadata(value: unknown): Promise<GraphQLProtocolMetadata | undefined> {
|
||||
const operations = Array.isArray(value) ? value : [value];
|
||||
if (!operations.length) return undefined;
|
||||
if (operations.length > MAX_GRAPHQL_OPERATIONS) {
|
||||
const allGraphQL = operations.every((operation) => {
|
||||
if (!operation || typeof operation !== 'object' || Array.isArray(operation)) return false;
|
||||
const envelope = operation as Record<string, unknown>;
|
||||
return (
|
||||
typeof envelope.query === 'string'
|
||||
&& looksLikeGraphQLDocument(envelope.query)
|
||||
) || Boolean(graphqlPersistedQueryHash(envelope));
|
||||
});
|
||||
if (!allGraphQL) return undefined;
|
||||
const serialized = JSON.stringify(value);
|
||||
return {
|
||||
protocol: 'graphql',
|
||||
operationFingerprint: `sha256:${await sha256(serialized)}`,
|
||||
operationNames: [`batch-overflow-${operations.length}`],
|
||||
};
|
||||
}
|
||||
const descriptors: Array<{
|
||||
operationNameFingerprint: string;
|
||||
queryFingerprint: string;
|
||||
persistedQueryFingerprint: string;
|
||||
}> = [];
|
||||
const operationNames: string[] = [];
|
||||
for (const [index, operation] of operations.entries()) {
|
||||
if (!operation || typeof operation !== 'object' || Array.isArray(operation)) return undefined;
|
||||
const envelope = operation as Record<string, unknown>;
|
||||
const query = typeof envelope.query === 'string'
|
||||
&& looksLikeGraphQLDocument(envelope.query)
|
||||
? envelope.query
|
||||
: '';
|
||||
const persistedQueryHash = graphqlPersistedQueryHash(envelope);
|
||||
if (!query && !persistedQueryHash) return undefined;
|
||||
const operationName = typeof envelope.operationName === 'string'
|
||||
? envelope.operationName
|
||||
: '';
|
||||
descriptors.push({
|
||||
operationNameFingerprint: await sha256(operationName),
|
||||
queryFingerprint: query ? await sha256(query.replace(/\r\n?/g, '\n').trim()) : '',
|
||||
persistedQueryFingerprint: persistedQueryHash ? await sha256(persistedQueryHash) : '',
|
||||
});
|
||||
operationNames.push(displayGraphQLOperationName(envelope.operationName, index));
|
||||
}
|
||||
return {
|
||||
protocol: 'graphql',
|
||||
operationFingerprint: `sha256:${await sha256(JSON.stringify({
|
||||
version: 1,
|
||||
operations: descriptors,
|
||||
}))}`,
|
||||
operationNames: operationNames.slice(0, 16),
|
||||
};
|
||||
}
|
||||
|
||||
function category(name: string): BrowserAuthorizationFieldCategory {
|
||||
const normalized = name.toLowerCase();
|
||||
if (normalized === 'authorization'
|
||||
|| normalized === 'cookie'
|
||||
|| AUTHENTICATION_FIELD_PATTERN.test(normalized)) {
|
||||
return 'authentication';
|
||||
}
|
||||
if (/(csrf|xsrf)/.test(normalized)) return 'csrf';
|
||||
if (/(signature|(^|[_.-])sign(ed)?($|[_.-])|hmac)/.test(normalized)) return 'signature';
|
||||
if (/(nonce|random|request.?id|trace.?id|correlation.?id|idempotency)/.test(normalized)) return 'nonce';
|
||||
if (/(timestamp|(^|[_.-])time($|[_.-])|(^|[_.-])date($|[_.-]))/.test(normalized)) return 'timestamp';
|
||||
if (/(^|[_.\-[\]])(id|uid|user.?id|account.?id|tenant.?id|org(anization)?.?id|workspace.?id|project.?id|team.?id|customer.?id|order.?id|resource.?id|object.?id|record.?id|document.?id|file.?id|invoice.?id)($|[_.\-[\]])/.test(normalized)) {
|
||||
return 'resource';
|
||||
}
|
||||
return 'unknown';
|
||||
}
|
||||
|
||||
function primitiveType(value: unknown): BrowserAuthorizationBaselineField['valueType'] {
|
||||
if (value === null) return 'null';
|
||||
if (typeof value === 'number') return 'number';
|
||||
if (typeof value === 'boolean') return 'boolean';
|
||||
return 'string';
|
||||
}
|
||||
|
||||
function primitiveText(value: unknown): string {
|
||||
if (value === null) return 'null';
|
||||
if (typeof value === 'string') return value;
|
||||
return JSON.stringify(value);
|
||||
}
|
||||
|
||||
async function field(
|
||||
location: BrowserAuthorizationBaselineField['location'],
|
||||
path: string,
|
||||
value: unknown,
|
||||
sign: (value: string | Uint8Array) => Promise<string>,
|
||||
valueType: BrowserAuthorizationBaselineField['valueType'] = primitiveType(value),
|
||||
categoryOverride?: BrowserAuthorizationFieldCategory,
|
||||
): Promise<BrowserAuthorizationBaselineField> {
|
||||
const text = primitiveText(value);
|
||||
return {
|
||||
location,
|
||||
path,
|
||||
valueType,
|
||||
byteLength: new TextEncoder().encode(text).byteLength,
|
||||
valueFingerprint: await sign(text),
|
||||
category: categoryOverride ?? category(path),
|
||||
};
|
||||
}
|
||||
|
||||
async function flattenJSON(
|
||||
value: unknown,
|
||||
sign: (value: string | Uint8Array) => Promise<string>,
|
||||
): Promise<BrowserAuthorizationBaselineField[]> {
|
||||
const pending: Array<{ value: unknown; path: string; depth: number }> = [{
|
||||
value,
|
||||
path: 'body',
|
||||
depth: 0,
|
||||
}];
|
||||
const output: BrowserAuthorizationBaselineField[] = [];
|
||||
while (pending.length && output.length < MAX_AUTHORIZATION_BASELINE_FIELDS) {
|
||||
const current = pending.shift()!;
|
||||
if (current.depth > MAX_FIELD_DEPTH) continue;
|
||||
if (Array.isArray(current.value)) {
|
||||
current.value.slice(0, 50).forEach((child, index) => {
|
||||
pending.push({ value: child, path: `${current.path}[${index}]`, depth: current.depth + 1 });
|
||||
});
|
||||
continue;
|
||||
}
|
||||
if (current.value && typeof current.value === 'object') {
|
||||
Object.entries(current.value as Record<string, unknown>)
|
||||
.slice(0, 100)
|
||||
.forEach(([key, child]) => {
|
||||
pending.push({ value: child, path: `${current.path}.${key}`, depth: current.depth + 1 });
|
||||
});
|
||||
continue;
|
||||
}
|
||||
output.push(await field('body', current.path, current.value, sign));
|
||||
}
|
||||
return output;
|
||||
}
|
||||
|
||||
function headerValues(lines: string[]): Array<{ name: string; value: string }> {
|
||||
const output: Array<{ name: string; value: string }> = [];
|
||||
for (const line of lines) {
|
||||
const separator = line.indexOf(':');
|
||||
if (separator <= 0) continue;
|
||||
output.push({
|
||||
name: line.slice(0, separator).trim().slice(0, 512),
|
||||
value: line.slice(separator + 1).trim(),
|
||||
});
|
||||
}
|
||||
return output;
|
||||
}
|
||||
|
||||
function indexedFieldPaths(
|
||||
entries: Array<[string, string]>,
|
||||
prefix: 'header' | 'query' | 'body',
|
||||
): Array<{ path: string; value: string }> {
|
||||
const totals = new Map<string, number>();
|
||||
for (const [name] of entries) totals.set(name, (totals.get(name) || 0) + 1);
|
||||
const indexes = new Map<string, number>();
|
||||
return entries.map(([name, value]) => {
|
||||
const index = indexes.get(name) || 0;
|
||||
indexes.set(name, index + 1);
|
||||
return {
|
||||
path: totals.get(name) === 1 ? `${prefix}.${name}` : `${prefix}.${name}[${index}]`,
|
||||
value,
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
function decodePathSegment(value: string): string {
|
||||
try {
|
||||
return decodeURIComponent(value);
|
||||
} catch {
|
||||
return value;
|
||||
}
|
||||
}
|
||||
|
||||
function dynamicPathSegment(value: string): boolean {
|
||||
const decoded = decodePathSegment(value);
|
||||
return /^\d+$/.test(decoded)
|
||||
|| /^[0-9a-f]{8}-[0-9a-f-]{27,}$/i.test(decoded)
|
||||
|| /^[0-9a-f]{12,}$/i.test(decoded)
|
||||
|| /^[A-Za-z0-9_-]{16,}$/.test(decoded);
|
||||
}
|
||||
|
||||
export function normalizeAuthorizationPath(pathname: string): {
|
||||
normalized: string;
|
||||
resources: Array<{ path: string; value: string }>;
|
||||
} {
|
||||
const segments = pathname.split('/').filter(Boolean);
|
||||
const resources: Array<{ path: string; value: string }> = [];
|
||||
const normalized = segments.map((segment, index) => {
|
||||
if (!dynamicPathSegment(segment)) return segment;
|
||||
resources.push({
|
||||
path: `path.segment[${index}]`,
|
||||
value: decodePathSegment(segment),
|
||||
});
|
||||
return ':resource';
|
||||
});
|
||||
return {
|
||||
normalized: `/${normalized.join('/')}`,
|
||||
resources,
|
||||
};
|
||||
}
|
||||
|
||||
function bodyOffset(bytes: Uint8Array): number {
|
||||
for (let index = 0; index <= bytes.length - 4; index += 1) {
|
||||
if (bytes[index] === 13 && bytes[index + 1] === 10
|
||||
&& bytes[index + 2] === 13 && bytes[index + 3] === 10) {
|
||||
return index + 4;
|
||||
}
|
||||
}
|
||||
throw new ExtensionError('authorization_baseline_invalid', '捕获请求缺少 HTTP Header 分隔符');
|
||||
}
|
||||
|
||||
export async function parseAuthorizationBaselineRequest(
|
||||
rawRequestBase64: string,
|
||||
requestUrl: string,
|
||||
encodedComparisonKey: string,
|
||||
): Promise<BrowserAuthorizationBaseline['request']> {
|
||||
const bytes = base64ToBytes(rawRequestBase64);
|
||||
if (!bytes.length || bytes.byteLength > MAX_AUTHORIZATION_BASELINE_BYTES) {
|
||||
throw new ExtensionError('authorization_baseline_too_large', '授权基线请求必须在 1 字节到 2 MiB 之间');
|
||||
}
|
||||
const offset = bodyOffset(bytes);
|
||||
const head = new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, offset - 4));
|
||||
const lines = head.split('\r\n');
|
||||
const requestLine = lines.shift()?.split(/\s+/) || [];
|
||||
if (requestLine.length !== 3) {
|
||||
throw new ExtensionError('authorization_baseline_invalid', '授权基线请求行无效');
|
||||
}
|
||||
const method = requestLine[0].toUpperCase().slice(0, 32);
|
||||
const parsedUrl = new URL(requestUrl);
|
||||
const shapedPath = normalizeAuthorizationPath(parsedUrl.pathname);
|
||||
const headers = headerValues(lines);
|
||||
const contentType = headers.find((header) => header.name.toLowerCase() === 'content-type')?.value || '';
|
||||
const sign = await comparisonSigner(encodedComparisonKey);
|
||||
const fields: BrowserAuthorizationBaselineField[] = [];
|
||||
const indexedHeaders = indexedFieldPaths(
|
||||
headers.slice(0, 256).map((header) => [header.name.toLowerCase(), header.value]),
|
||||
'header',
|
||||
);
|
||||
for (const header of indexedHeaders) {
|
||||
fields.push(await field('header', header.path, header.value, sign));
|
||||
}
|
||||
for (const resource of shapedPath.resources) {
|
||||
fields.push(await field(
|
||||
'path',
|
||||
resource.path,
|
||||
resource.value,
|
||||
sign,
|
||||
primitiveType(resource.value),
|
||||
'resource',
|
||||
));
|
||||
}
|
||||
for (const parameter of indexedFieldPaths([...parsedUrl.searchParams], 'query')) {
|
||||
if (fields.length >= MAX_AUTHORIZATION_BASELINE_FIELDS) break;
|
||||
fields.push(await field('query', parameter.path, parameter.value, sign));
|
||||
}
|
||||
const body = bytes.subarray(offset);
|
||||
let protocolMetadata: GraphQLProtocolMetadata | undefined;
|
||||
if (body.byteLength && fields.length < MAX_AUTHORIZATION_BASELINE_FIELDS) {
|
||||
if (contentType.toLowerCase().includes('json')) {
|
||||
try {
|
||||
const decoded = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body));
|
||||
protocolMetadata = await graphqlProtocolMetadata(decoded);
|
||||
fields.push(...await flattenJSON(decoded, sign));
|
||||
} catch {
|
||||
fields.push(await field('body', 'body', bytesToHex(body), sign, 'binary'));
|
||||
}
|
||||
} else if (contentType.toLowerCase().includes('application/x-www-form-urlencoded')) {
|
||||
const params = indexedFieldPaths([
|
||||
...new URLSearchParams(new TextDecoder().decode(body)),
|
||||
], 'body');
|
||||
for (const parameter of params) {
|
||||
if (fields.length >= MAX_AUTHORIZATION_BASELINE_FIELDS) break;
|
||||
fields.push(await field('body', parameter.path, parameter.value, sign));
|
||||
}
|
||||
} else {
|
||||
fields.push(await field('body', 'body', bytesToHex(body), sign, 'binary'));
|
||||
}
|
||||
}
|
||||
const boundedFields = fields.slice(0, MAX_AUTHORIZATION_BASELINE_FIELDS);
|
||||
const actionShape = JSON.stringify({
|
||||
version: 2,
|
||||
method,
|
||||
origin: parsedUrl.origin,
|
||||
path: shapedPath.normalized,
|
||||
contentType: contentType.split(';')[0].trim().toLowerCase(),
|
||||
protocol: protocolMetadata?.protocol || '',
|
||||
operationFingerprint: protocolMetadata?.operationFingerprint || '',
|
||||
fields: boundedFields.map((item) => `${item.location}:${item.path}`).sort(),
|
||||
});
|
||||
return {
|
||||
method,
|
||||
url: `${parsedUrl.origin}${shapedPath.normalized}`,
|
||||
path: shapedPath.normalized,
|
||||
contentType: contentType.slice(0, 512),
|
||||
...protocolMetadata,
|
||||
actionFingerprint: `sha256:${await sha256(actionShape)}`,
|
||||
headerNames: headers.map((header) => header.name).slice(0, 256),
|
||||
fields: boundedFields,
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,117 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import type {
|
||||
BrowserAuthorizationBaseline,
|
||||
BrowserTransformPipelineNode,
|
||||
BrowserTransformProfile,
|
||||
} from '@/types/models';
|
||||
import { authorizationDynamicTransformDestinations } from './baseline-transform';
|
||||
|
||||
function baseline(): BrowserAuthorizationBaseline {
|
||||
return {
|
||||
version: 1,
|
||||
id: 'baseline-left',
|
||||
deviceId: 'device-left',
|
||||
installationId: 'installation-left',
|
||||
isolationContextId: 'browser-profile:store-left',
|
||||
cookieStoreId: 'store-left',
|
||||
origin: 'https://example.test',
|
||||
grantId: 'grant-left',
|
||||
target: { tabId: 11, frameId: 0, documentId: 'document-left' },
|
||||
authContextReference: { kind: 'handle', id: 'auth-left' },
|
||||
networkRequestId: 'request-left',
|
||||
request: {
|
||||
method: 'GET',
|
||||
url: 'https://example.test/api/orders/:resource',
|
||||
path: '/api/orders/:resource',
|
||||
contentType: '',
|
||||
actionFingerprint: `sha256:${'a'.repeat(64)}`,
|
||||
headerNames: ['Host', 'Cookie'],
|
||||
fields: [
|
||||
{
|
||||
location: 'path',
|
||||
path: 'path.segment[2]',
|
||||
valueType: 'string',
|
||||
byteLength: 2,
|
||||
valueFingerprint: `workspace-hmac-sha256:${'a'.repeat(64)}`,
|
||||
category: 'resource',
|
||||
},
|
||||
{
|
||||
location: 'query',
|
||||
path: 'query.nonce',
|
||||
valueType: 'string',
|
||||
byteLength: 8,
|
||||
valueFingerprint: `workspace-hmac-sha256:${'b'.repeat(64)}`,
|
||||
category: 'nonce',
|
||||
},
|
||||
{
|
||||
location: 'header',
|
||||
path: 'header.x-signature',
|
||||
valueType: 'string',
|
||||
byteLength: 64,
|
||||
valueFingerprint: `workspace-hmac-sha256:${'c'.repeat(64)}`,
|
||||
category: 'signature',
|
||||
},
|
||||
],
|
||||
},
|
||||
createdAt: 1,
|
||||
expiresAt: Date.now() + 60_000,
|
||||
};
|
||||
}
|
||||
|
||||
function profile(outputs: string[]): BrowserTransformProfile {
|
||||
const nodes: BrowserTransformPipelineNode[] = [
|
||||
{
|
||||
id: 'literal',
|
||||
name: '动态值',
|
||||
kind: 'builtin',
|
||||
operation: 'value.literal',
|
||||
inputs: [],
|
||||
options: { value: 'fresh' },
|
||||
},
|
||||
...outputs.map((destination, index): BrowserTransformPipelineNode => ({
|
||||
id: `output-${index}`,
|
||||
name: destination,
|
||||
kind: 'output.write',
|
||||
destination,
|
||||
source: { nodeId: 'literal' },
|
||||
encoding: 'text',
|
||||
})),
|
||||
];
|
||||
return {
|
||||
id: 'profile-left',
|
||||
name: '身份 A 动态签名',
|
||||
enabled: true,
|
||||
target: { tabId: 11, frameId: 0, documentId: 'document-left' },
|
||||
isolationContextId: 'browser-profile:store-left',
|
||||
cookieStoreId: 'store-left',
|
||||
origin: 'https://example.test',
|
||||
match: { methods: ['GET'], urlPattern: '*/api/orders/*' },
|
||||
request: { enabled: true, nodes },
|
||||
response: { enabled: false, nodes: [] },
|
||||
failMode: 'closed',
|
||||
maxConcurrency: 1,
|
||||
createdAt: 1,
|
||||
updatedAt: 2,
|
||||
};
|
||||
}
|
||||
|
||||
describe('authorization identity-bound transform contracts', () => {
|
||||
it('requires the profile to cover every dynamic Header and Query field', () => {
|
||||
expect(authorizationDynamicTransformDestinations(
|
||||
baseline(),
|
||||
profile(['query.nonce', 'header.X-Signature']),
|
||||
)).toEqual(['header.x-signature', 'query.nonce']);
|
||||
|
||||
expect(() => authorizationDynamicTransformDestinations(
|
||||
baseline(),
|
||||
profile(['query.nonce']),
|
||||
)).toThrow('尚未覆盖动态字段');
|
||||
});
|
||||
|
||||
it('keeps encrypted Body envelopes fail-closed until a logical plaintext binding exists', () => {
|
||||
expect(() => authorizationDynamicTransformDestinations(
|
||||
baseline(),
|
||||
profile(['query.nonce', 'header.X-Signature', 'body.encryptedData']),
|
||||
)).toThrow('Body 加密 envelope');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,77 @@
|
||||
import type {
|
||||
BrowserAuthorizationBaseline,
|
||||
BrowserTransformProfile,
|
||||
} from '@/types/models';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
|
||||
const DYNAMIC_FIELD_CATEGORIES = new Set(['signature', 'nonce', 'timestamp', 'csrf']);
|
||||
|
||||
function normalizedTransformDestination(destination: string): string {
|
||||
const trimmed = destination.trim();
|
||||
if (trimmed.toLowerCase().startsWith('header.')) {
|
||||
return `header.${trimmed.slice(7).trim().toLowerCase()}`;
|
||||
}
|
||||
return trimmed;
|
||||
}
|
||||
|
||||
export function authorizationDynamicTransformDestinations(
|
||||
baseline: BrowserAuthorizationBaseline,
|
||||
profile: BrowserTransformProfile,
|
||||
): string[] {
|
||||
if (!profile.enabled || !profile.request.enabled) {
|
||||
throw new ExtensionError('authorization_transform_unavailable', '所选明文网关未启用请求转换');
|
||||
}
|
||||
if (profile.recovery && profile.recovery.state !== 'ready') {
|
||||
throw new ExtensionError('authorization_transform_stale', '所选明文网关正在等待文档恢复或重新验证');
|
||||
}
|
||||
const dynamicFields = new Map(
|
||||
baseline.request.fields
|
||||
.filter((field) => DYNAMIC_FIELD_CATEGORIES.has(field.category))
|
||||
.map((field) => [
|
||||
normalizedTransformDestination(field.path),
|
||||
field,
|
||||
]),
|
||||
);
|
||||
const required = [...dynamicFields.keys()].filter((path) => {
|
||||
const field = dynamicFields.get(path);
|
||||
return field?.category === 'signature'
|
||||
|| field?.category === 'nonce'
|
||||
|| field?.category === 'timestamp';
|
||||
});
|
||||
if (!required.length) {
|
||||
throw new ExtensionError('authorization_transform_unnecessary', '当前授权基线没有需要动态重算的签名、Nonce 或时间字段');
|
||||
}
|
||||
const destinations = profile.request.nodes
|
||||
.filter((node) => node.kind === 'output.write')
|
||||
.map((node) => normalizedTransformDestination(node.destination));
|
||||
if (!destinations.length) {
|
||||
throw new ExtensionError('authorization_transform_invalid', '所选明文网关没有请求输出节点');
|
||||
}
|
||||
for (const destination of destinations) {
|
||||
if (
|
||||
destination === 'body'
|
||||
|| destination.startsWith('body.')
|
||||
|| (!destination.startsWith('header.') && !destination.startsWith('query.'))
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_unsupported',
|
||||
'首批授权动态重算只接受 Header/Query 签名字段；Body 加密 envelope 需要逻辑明文绑定',
|
||||
);
|
||||
}
|
||||
if (!dynamicFields.has(destination)) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_invalid',
|
||||
`明文网关输出未对应基线中的动态字段: ${destination}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
const output = [...new Set(destinations)];
|
||||
const missing = required.find((path) => !output.includes(path));
|
||||
if (missing) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_incomplete',
|
||||
`明文网关尚未覆盖动态字段: ${missing}`,
|
||||
);
|
||||
}
|
||||
return output.sort();
|
||||
}
|
||||
@@ -0,0 +1,779 @@
|
||||
import { browser } from 'wxt/browser';
|
||||
import type {
|
||||
BrowserAuthContextAttestation,
|
||||
BrowserAuthContextHandle,
|
||||
BrowserAuthorizationBaseline,
|
||||
BrowserAuthorizationBaselineCandidate,
|
||||
BrowserAuthorizationBaselinePacket,
|
||||
BrowserAuthorizationCompiledRequest,
|
||||
BrowserAuthorizationLogicalRequestBinding,
|
||||
BrowserAuthorizationResourceSelector,
|
||||
BrowserAuthorizationResourceValue,
|
||||
BrowserAuthorizationTransformBinding,
|
||||
BrowserTarget,
|
||||
BrowserTransformProfile,
|
||||
} from '@/types/models';
|
||||
import {
|
||||
exportNetworkRequest,
|
||||
listNetworkRequests,
|
||||
} from '@/features/network-capture/service';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import { getAuthContextHandle } from './auth-context';
|
||||
import { getAuthContextAttestation } from './auth-attestation';
|
||||
import {
|
||||
MAX_AUTHORIZATION_BASELINE_BYTES,
|
||||
MAX_AUTHORIZATION_BASELINE_FIELDS,
|
||||
normalizeAuthorizationPath,
|
||||
parseAuthorizationBaselineRequest,
|
||||
} from './baseline-metadata';
|
||||
import {
|
||||
applyAuthorizationTransformExecution,
|
||||
authorizationRequestToTransformPacket,
|
||||
compileAuthorizationBaselineRequest,
|
||||
extractAuthorizationResourceValue,
|
||||
} from './baseline-execution';
|
||||
import {
|
||||
executeBrowserTransform,
|
||||
getBrowserTransformProfile,
|
||||
} from '@/features/browser-transform/service';
|
||||
import { assertTransformRoute } from '@/features/browser-transform/mapping';
|
||||
import { authorizationDynamicTransformDestinations } from './baseline-transform';
|
||||
import {
|
||||
assertAuthorizationLogicalPacketStructure,
|
||||
authorizationPacketFingerprint,
|
||||
buildAuthorizationLogicalRequestBinding,
|
||||
decodeAndVerifyLogicalReplacement,
|
||||
loadAuthorizationLogicalRequestBinding,
|
||||
readAuthorizationLogicalResource,
|
||||
replaceAuthorizationLogicalResource,
|
||||
} from './logical-binding';
|
||||
import {
|
||||
browserTransformReplayDraftToPacket,
|
||||
getBrowserTransformReplayDraft,
|
||||
} from '@/features/browser-transform/replay-draft';
|
||||
import {
|
||||
readStructuredAuthorizationBodyValue,
|
||||
} from './structured-body';
|
||||
|
||||
const MAX_BASELINES = 16;
|
||||
const MAX_BASELINE_STORAGE_BYTES = 8 * 1_024 * 1_024;
|
||||
const STORAGE_KEY = 'browser.authorization.baselines.v1';
|
||||
|
||||
function authorizationBytesToBase64(bytes: Uint8Array): string {
|
||||
let binary = '';
|
||||
const chunkSize = 0x8000;
|
||||
for (let offset = 0; offset < bytes.length; offset += chunkSize) {
|
||||
binary += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
|
||||
}
|
||||
return btoa(binary);
|
||||
}
|
||||
|
||||
interface StoredAuthorizationBaseline {
|
||||
snapshot: BrowserAuthorizationBaseline;
|
||||
rawRequestBase64: string;
|
||||
requestUrl: string;
|
||||
isHttps: boolean;
|
||||
}
|
||||
|
||||
const baselines = new Map<string, StoredAuthorizationBaseline>();
|
||||
let loaded = false;
|
||||
|
||||
function validAuthorizationRequestProtocol(value: {
|
||||
protocol?: unknown;
|
||||
operationFingerprint?: unknown;
|
||||
operationNames?: unknown;
|
||||
} | undefined): boolean {
|
||||
if (!value) return false;
|
||||
if (value.protocol === undefined) {
|
||||
return value.operationFingerprint === undefined && value.operationNames === undefined;
|
||||
}
|
||||
return value.protocol === 'graphql'
|
||||
&& /^sha256:[a-f0-9]{64}$/.test(String(value.operationFingerprint))
|
||||
&& Array.isArray(value.operationNames)
|
||||
&& value.operationNames.length > 0
|
||||
&& value.operationNames.length <= 16
|
||||
&& value.operationNames.every((name) => (
|
||||
typeof name === 'string'
|
||||
&& (
|
||||
/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(name)
|
||||
|| /^(?:anonymous|batch-overflow)-[1-9][0-9]*$/.test(name)
|
||||
)
|
||||
));
|
||||
}
|
||||
|
||||
function validLogicalRequestBinding(
|
||||
value: unknown,
|
||||
snapshot: Partial<BrowserAuthorizationBaseline>,
|
||||
): value is BrowserAuthorizationLogicalRequestBinding {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
|
||||
const binding = value as Partial<BrowserAuthorizationLogicalRequestBinding>;
|
||||
return binding.version === 1
|
||||
&& binding.source === 'local-replay-draft'
|
||||
&& binding.baselineId === snapshot.id
|
||||
&& typeof binding.profileId === 'string'
|
||||
&& binding.profileId.length > 0
|
||||
&& typeof binding.profileName === 'string'
|
||||
&& binding.profileName.length > 0
|
||||
&& binding.isolationContextId === snapshot.isolationContextId
|
||||
&& binding.cookieStoreId === snapshot.cookieStoreId
|
||||
&& binding.origin === snapshot.origin
|
||||
&& binding.target?.tabId === snapshot.target?.tabId
|
||||
&& binding.target?.frameId === snapshot.target?.frameId
|
||||
&& binding.target?.documentId === snapshot.target?.documentId
|
||||
&& Boolean(binding.request)
|
||||
&& validAuthorizationRequestProtocol(binding.request)
|
||||
&& /^sha256:[a-f0-9]{64}$/.test(String(binding.request?.actionFingerprint))
|
||||
&& Array.isArray(binding.request?.fields)
|
||||
&& binding.request.fields.length <= MAX_AUTHORIZATION_BASELINE_FIELDS
|
||||
&& Array.isArray(binding.outputDestinations)
|
||||
&& binding.outputDestinations.length > 0
|
||||
&& binding.outputDestinations.length <= 32
|
||||
&& /^sha256:[a-f0-9]{64}$/.test(String(binding.bindingFingerprint))
|
||||
&& typeof binding.profileUpdatedAt === 'number'
|
||||
&& typeof binding.replayUpdatedAt === 'number'
|
||||
&& binding.expiresAt === snapshot.expiresAt;
|
||||
}
|
||||
|
||||
function validStoredBaseline(value: unknown): value is StoredAuthorizationBaseline {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
|
||||
const entry = value as Partial<StoredAuthorizationBaseline>;
|
||||
const snapshot = entry.snapshot as Partial<BrowserAuthorizationBaseline> | undefined;
|
||||
return snapshot?.version === 1
|
||||
&& typeof snapshot.id === 'string'
|
||||
&& snapshot.id.length > 0
|
||||
&& typeof snapshot.deviceId === 'string'
|
||||
&& typeof snapshot.installationId === 'string'
|
||||
&& typeof snapshot.isolationContextId === 'string'
|
||||
&& snapshot.isolationContextId.length > 0
|
||||
&& typeof snapshot.cookieStoreId === 'string'
|
||||
&& snapshot.cookieStoreId.length > 0
|
||||
&& typeof snapshot.origin === 'string'
|
||||
&& typeof snapshot.grantId === 'string'
|
||||
&& typeof snapshot.networkRequestId === 'string'
|
||||
&& Boolean(snapshot.target?.documentId)
|
||||
&& ['handle', 'attestation'].includes(String(snapshot.authContextReference?.kind))
|
||||
&& typeof snapshot.authContextReference?.id === 'string'
|
||||
&& Boolean(snapshot.request)
|
||||
&& validAuthorizationRequestProtocol(snapshot.request)
|
||||
&& /^sha256:[a-f0-9]{64}$/.test(String(snapshot.request?.actionFingerprint))
|
||||
&& Array.isArray(snapshot.request?.fields)
|
||||
&& snapshot.request.fields.length <= MAX_AUTHORIZATION_BASELINE_FIELDS
|
||||
&& typeof snapshot.createdAt === 'number'
|
||||
&& typeof snapshot.expiresAt === 'number'
|
||||
&& snapshot.expiresAt > snapshot.createdAt
|
||||
&& typeof entry.rawRequestBase64 === 'string'
|
||||
&& entry.rawRequestBase64.length <= Math.ceil(MAX_AUTHORIZATION_BASELINE_BYTES / 3) * 4 + 4
|
||||
&& typeof entry.requestUrl === 'string'
|
||||
&& entry.requestUrl.length <= 8_192
|
||||
&& typeof entry.isHttps === 'boolean'
|
||||
&& (
|
||||
snapshot.logicalRequest === undefined
|
||||
|| validLogicalRequestBinding(snapshot.logicalRequest, snapshot)
|
||||
);
|
||||
}
|
||||
|
||||
function purge(now = Date.now(), reserve = 0): boolean {
|
||||
let changed = false;
|
||||
for (const [id, baseline] of baselines) {
|
||||
if (baseline.snapshot.expiresAt <= now) {
|
||||
baselines.delete(id);
|
||||
changed = true;
|
||||
}
|
||||
}
|
||||
while (baselines.size > MAX_BASELINES - reserve) {
|
||||
const oldest = baselines.keys().next().value as string | undefined;
|
||||
if (!oldest) break;
|
||||
baselines.delete(oldest);
|
||||
changed = true;
|
||||
}
|
||||
return changed;
|
||||
}
|
||||
|
||||
async function load(): Promise<void> {
|
||||
if (loaded) return;
|
||||
loaded = true;
|
||||
try {
|
||||
const stored = await browser.storage.session.get(STORAGE_KEY);
|
||||
const values = stored[STORAGE_KEY];
|
||||
if (!Array.isArray(values)) return;
|
||||
for (const value of values.slice(-MAX_BASELINES)) {
|
||||
if (validStoredBaseline(value)) baselines.set(value.snapshot.id, value);
|
||||
}
|
||||
purge();
|
||||
} catch {
|
||||
// The bounded in-memory registry remains available.
|
||||
}
|
||||
}
|
||||
|
||||
async function save(): Promise<void> {
|
||||
try {
|
||||
const retained: StoredAuthorizationBaseline[] = [];
|
||||
for (const baseline of [...baselines.values()].reverse()) {
|
||||
const candidate = [baseline, ...retained];
|
||||
if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_BASELINE_STORAGE_BYTES) break;
|
||||
retained.unshift(baseline);
|
||||
}
|
||||
baselines.clear();
|
||||
for (const baseline of retained) baselines.set(baseline.snapshot.id, baseline);
|
||||
await browser.storage.session.set({ [STORAGE_KEY]: retained });
|
||||
} catch {
|
||||
// The bounded in-memory registry remains available.
|
||||
}
|
||||
}
|
||||
|
||||
async function authContext(
|
||||
kind: 'handle' | 'attestation',
|
||||
id: string,
|
||||
grantId: string,
|
||||
): Promise<BrowserAuthContextHandle | BrowserAuthContextAttestation> {
|
||||
return kind === 'handle'
|
||||
? getAuthContextHandle(id, grantId)
|
||||
: getAuthContextAttestation(id, grantId);
|
||||
}
|
||||
|
||||
function sameTarget(
|
||||
left: BrowserTarget,
|
||||
right: BrowserTarget,
|
||||
): boolean {
|
||||
return left.tabId === right.tabId
|
||||
&& left.frameId === right.frameId
|
||||
&& left.documentId === right.documentId;
|
||||
}
|
||||
|
||||
function authorizationDocumentOrigin(url: URL): string {
|
||||
if (url.protocol === 'ws:') return `http://${url.host}`;
|
||||
if (url.protocol === 'wss:') return `https://${url.host}`;
|
||||
return url.origin;
|
||||
}
|
||||
|
||||
export async function captureAuthorizationBaseline(input: {
|
||||
target: BrowserTarget;
|
||||
grantId: string;
|
||||
authContextKind: 'handle' | 'attestation';
|
||||
authContextId: string;
|
||||
networkRequestId: string;
|
||||
comparisonKey: string;
|
||||
}): Promise<BrowserAuthorizationBaseline> {
|
||||
await load();
|
||||
const context = await authContext(input.authContextKind, input.authContextId, input.grantId);
|
||||
if (!sameTarget(context.target, input.target)) {
|
||||
throw new ExtensionError('target_denied', '授权基线请求与认证上下文不属于同一页面文档');
|
||||
}
|
||||
const exported = await exportNetworkRequest(input.target, input.networkRequestId);
|
||||
const exportedURL = new URL(exported.url);
|
||||
if (exportedURL.protocol === 'ws:' || exportedURL.protocol === 'wss:') {
|
||||
throw new ExtensionError(
|
||||
'authorization_protocol_unsupported',
|
||||
'WebSocket 握手不能作为 HTTP 授权基线；请在录制中检查消息帧，当前版本不会把握手误当成可重放业务请求',
|
||||
);
|
||||
}
|
||||
if (authorizationDocumentOrigin(exportedURL) !== context.origin) {
|
||||
throw new ExtensionError('origin_changed', '授权基线请求与认证上下文来源不一致');
|
||||
}
|
||||
if (exported.limitations.length) {
|
||||
throw new ExtensionError(
|
||||
'authorization_baseline_incomplete',
|
||||
`捕获请求不完整：${exported.limitations.join('；')}`,
|
||||
);
|
||||
}
|
||||
const now = Date.now();
|
||||
const snapshot: BrowserAuthorizationBaseline = {
|
||||
version: 1,
|
||||
id: crypto.randomUUID(),
|
||||
deviceId: context.deviceId,
|
||||
installationId: context.installationId,
|
||||
isolationContextId: context.isolationContextId,
|
||||
cookieStoreId: context.cookieStoreId,
|
||||
origin: context.origin,
|
||||
grantId: context.grantId,
|
||||
target: context.target,
|
||||
authContextReference: {
|
||||
kind: input.authContextKind,
|
||||
id: context.id,
|
||||
},
|
||||
networkRequestId: input.networkRequestId,
|
||||
request: await parseAuthorizationBaselineRequest(
|
||||
exported.rawRequestBase64,
|
||||
exported.url,
|
||||
input.comparisonKey,
|
||||
),
|
||||
createdAt: now,
|
||||
expiresAt: context.expiresAt,
|
||||
};
|
||||
if (snapshot.expiresAt <= now) {
|
||||
throw new ExtensionError('auth_context_stale', '认证上下文已经过期');
|
||||
}
|
||||
purge(now, 1);
|
||||
baselines.set(snapshot.id, {
|
||||
snapshot,
|
||||
rawRequestBase64: exported.rawRequestBase64,
|
||||
requestUrl: exported.url,
|
||||
isHttps: exported.isHttps,
|
||||
});
|
||||
await save();
|
||||
return snapshot;
|
||||
}
|
||||
|
||||
export async function listAuthorizationBaselineCandidates(input: {
|
||||
target: BrowserTarget;
|
||||
grantId: string;
|
||||
authContextKind: 'handle' | 'attestation';
|
||||
authContextId: string;
|
||||
limit: number;
|
||||
}): Promise<BrowserAuthorizationBaselineCandidate[]> {
|
||||
const context = await authContext(input.authContextKind, input.authContextId, input.grantId);
|
||||
if (!sameTarget(context.target, input.target)) {
|
||||
throw new ExtensionError('target_denied', '网络候选与认证上下文不属于同一页面文档');
|
||||
}
|
||||
const records = await listNetworkRequests(input.target, input.limit);
|
||||
return records.flatMap((record) => {
|
||||
let parsed: URL;
|
||||
try {
|
||||
parsed = new URL(record.url);
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
if (authorizationDocumentOrigin(parsed) !== context.origin) return [];
|
||||
const shapedPath = normalizeAuthorizationPath(parsed.pathname);
|
||||
const reasons: string[] = [];
|
||||
if (record.resourceType === 'websocket' || parsed.protocol === 'ws:' || parsed.protocol === 'wss:') {
|
||||
reasons.push('WebSocket 当前仅保留握手与消息帧证据，不会进入 HTTP 授权矩阵');
|
||||
}
|
||||
if (!record.requestHeadersCaptured) reasons.push('未捕获实际请求头');
|
||||
if (!['GET', 'HEAD', 'OPTIONS'].includes(record.method.toUpperCase())
|
||||
&& !record.requestBody) {
|
||||
reasons.push(record.requestBodyCaptured ? '浏览器未提供请求体' : '未捕获请求体');
|
||||
}
|
||||
if (record.requestBody?.truncated) reasons.push('请求体已截断');
|
||||
if (record.requestBody?.reconstructed) reasons.push('请求体由浏览器字段重建');
|
||||
if (record.error) reasons.push(`请求失败：${record.error}`);
|
||||
return [{
|
||||
id: record.id,
|
||||
method: record.method,
|
||||
url: `${parsed.origin}${shapedPath.normalized}`,
|
||||
path: shapedPath.normalized,
|
||||
resourceType: record.resourceType,
|
||||
startedAt: record.startedAt,
|
||||
completedAt: record.completedAt,
|
||||
durationMs: record.durationMs,
|
||||
statusCode: record.statusCode,
|
||||
error: record.error,
|
||||
eligible: reasons.length === 0,
|
||||
reasons,
|
||||
}];
|
||||
});
|
||||
}
|
||||
|
||||
async function validatedStoredBaseline(
|
||||
id: string,
|
||||
grantId: string,
|
||||
validateLogicalBinding = true,
|
||||
): Promise<StoredAuthorizationBaseline> {
|
||||
await load();
|
||||
if (purge()) await save();
|
||||
const baseline = baselines.get(id);
|
||||
if (!baseline || baseline.snapshot.grantId !== grantId) {
|
||||
throw new ExtensionError('authorization_baseline_stale', '授权基线不存在、已过期或不属于当前共享会话');
|
||||
}
|
||||
try {
|
||||
const context = await authContext(
|
||||
baseline.snapshot.authContextReference.kind,
|
||||
baseline.snapshot.authContextReference.id,
|
||||
grantId,
|
||||
);
|
||||
if (!sameTarget(context.target, baseline.snapshot.target)) {
|
||||
throw new ExtensionError('authorization_baseline_stale', '授权基线的认证上下文已经变化');
|
||||
}
|
||||
} catch (error) {
|
||||
baselines.delete(id);
|
||||
await save();
|
||||
if (error instanceof ExtensionError && error.code === 'authorization_baseline_stale') throw error;
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
throw new ExtensionError('authorization_baseline_stale', `授权基线实时复核失败：${message}`);
|
||||
}
|
||||
if (validateLogicalBinding && baseline.snapshot.logicalRequest) {
|
||||
try {
|
||||
await loadAuthorizationLogicalRequestBinding({ baseline: baseline.snapshot });
|
||||
} catch {
|
||||
baseline.snapshot = {
|
||||
...baseline.snapshot,
|
||||
logicalRequest: undefined,
|
||||
};
|
||||
baselines.set(id, baseline);
|
||||
await save();
|
||||
}
|
||||
}
|
||||
return baseline;
|
||||
}
|
||||
|
||||
export async function getAuthorizationBaseline(
|
||||
id: string,
|
||||
grantId: string,
|
||||
): Promise<BrowserAuthorizationBaseline> {
|
||||
return (await validatedStoredBaseline(id, grantId)).snapshot;
|
||||
}
|
||||
|
||||
export async function bindAuthorizationBaselineLogicalRequest(input: {
|
||||
id: string;
|
||||
grantId: string;
|
||||
profileId: string;
|
||||
comparisonKey: string;
|
||||
}): Promise<BrowserAuthorizationBaseline> {
|
||||
const baseline = await validatedStoredBaseline(input.id, input.grantId, false);
|
||||
const profile = await getBrowserTransformProfile(input.profileId);
|
||||
const draft = await getBrowserTransformReplayDraft(
|
||||
profile.id,
|
||||
'request',
|
||||
baseline.snapshot.origin,
|
||||
);
|
||||
if (!draft) {
|
||||
throw new ExtensionError(
|
||||
'authorization_logical_missing',
|
||||
'所选明文网关没有本机请求回放草稿，请先在明文网关中保存并验证回放输入',
|
||||
);
|
||||
}
|
||||
const logicalRequest = await buildAuthorizationLogicalRequestBinding({
|
||||
baseline: baseline.snapshot,
|
||||
rawRequestBase64: baseline.rawRequestBase64,
|
||||
profile,
|
||||
draft,
|
||||
comparisonKey: input.comparisonKey,
|
||||
});
|
||||
baseline.snapshot = {
|
||||
...baseline.snapshot,
|
||||
logicalRequest,
|
||||
};
|
||||
baselines.set(baseline.snapshot.id, baseline);
|
||||
await save();
|
||||
return baseline.snapshot;
|
||||
}
|
||||
|
||||
function selectedBaselineField(
|
||||
baseline: BrowserAuthorizationBaseline,
|
||||
selector: BrowserAuthorizationResourceSelector,
|
||||
) {
|
||||
const sourceFields = selector.source === 'logical'
|
||||
? baseline.logicalRequest?.request.fields
|
||||
: baseline.request.fields;
|
||||
const fields = (sourceFields || []).filter(
|
||||
(field) => field.location === selector.location && field.path === selector.path,
|
||||
);
|
||||
if (fields.length !== 1) {
|
||||
throw new ExtensionError(
|
||||
fields.length ? 'authorization_selector_ambiguous' : 'authorization_selector_invalid',
|
||||
fields.length ? '授权资源字段在基线中不唯一' : '授权资源字段不属于该请求基线',
|
||||
);
|
||||
}
|
||||
if (!['string', 'number', 'boolean'].includes(fields[0].valueType)) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'自动矩阵仅支持字符串、数字或布尔资源值',
|
||||
);
|
||||
}
|
||||
return fields[0];
|
||||
}
|
||||
|
||||
export async function readAuthorizationBaselineResource(input: {
|
||||
id: string;
|
||||
grantId: string;
|
||||
selector: BrowserAuthorizationResourceSelector;
|
||||
}): Promise<BrowserAuthorizationResourceValue> {
|
||||
const baseline = await validatedStoredBaseline(input.id, input.grantId);
|
||||
const selected = selectedBaselineField(baseline.snapshot, input.selector);
|
||||
if (input.selector.source === 'logical') {
|
||||
return readAuthorizationLogicalResource({
|
||||
baseline: baseline.snapshot,
|
||||
selector: input.selector,
|
||||
});
|
||||
}
|
||||
if (input.selector.location === 'body') {
|
||||
const value = readStructuredAuthorizationBodyValue(
|
||||
authorizationRequestToTransformPacket(
|
||||
baseline.rawRequestBase64,
|
||||
baseline.snapshot.origin,
|
||||
),
|
||||
input.selector.path,
|
||||
);
|
||||
const bytes = new TextEncoder().encode(value.text);
|
||||
if (bytes.byteLength > 8 * 1_024) {
|
||||
throw new ExtensionError(
|
||||
'authorization_value_too_large',
|
||||
'授权 Body 资源值超过 8 KiB 上限',
|
||||
);
|
||||
}
|
||||
return {
|
||||
version: 1,
|
||||
baselineId: baseline.snapshot.id,
|
||||
source: 'wire',
|
||||
location: 'body',
|
||||
path: input.selector.path,
|
||||
valueType: value.valueType,
|
||||
byteLength: bytes.byteLength,
|
||||
valueBase64: authorizationBytesToBase64(bytes),
|
||||
valueFingerprint: selected.valueFingerprint,
|
||||
};
|
||||
}
|
||||
const wireSelector = {
|
||||
location: input.selector.location,
|
||||
path: input.selector.path,
|
||||
};
|
||||
return extractAuthorizationResourceValue(
|
||||
baseline.requestUrl,
|
||||
baseline.rawRequestBase64,
|
||||
baseline.snapshot.id,
|
||||
wireSelector,
|
||||
selected.valueFingerprint,
|
||||
);
|
||||
}
|
||||
|
||||
export async function compileAuthorizationBaseline(input: {
|
||||
id: string;
|
||||
grantId: string;
|
||||
selector: BrowserAuthorizationResourceSelector;
|
||||
replacement: BrowserAuthorizationResourceValue;
|
||||
comparisonKey: string;
|
||||
}): Promise<BrowserAuthorizationCompiledRequest> {
|
||||
const baseline = await validatedStoredBaseline(input.id, input.grantId);
|
||||
if (input.selector.source !== 'wire') {
|
||||
throw new ExtensionError('authorization_selector_invalid', '直接编译只接受线上报文资源字段');
|
||||
}
|
||||
const wireSelector = {
|
||||
source: 'wire' as const,
|
||||
location: input.selector.location,
|
||||
path: input.selector.path,
|
||||
};
|
||||
selectedBaselineField(baseline.snapshot, input.selector);
|
||||
return compileAuthorizationBaselineRequest({
|
||||
baselineId: baseline.snapshot.id,
|
||||
rawRequestBase64: baseline.rawRequestBase64,
|
||||
requestUrl: baseline.requestUrl,
|
||||
publicUrl: baseline.snapshot.request.url,
|
||||
selector: wireSelector,
|
||||
replacement: input.replacement,
|
||||
comparisonKey: input.comparisonKey,
|
||||
isHttps: baseline.isHttps,
|
||||
});
|
||||
}
|
||||
|
||||
export async function compileAuthorizationBaselinePacket(input: {
|
||||
id: string;
|
||||
grantId: string;
|
||||
}): Promise<BrowserAuthorizationBaselinePacket> {
|
||||
const baseline = await validatedStoredBaseline(input.id, input.grantId);
|
||||
return {
|
||||
version: 1,
|
||||
baselineId: baseline.snapshot.id,
|
||||
method: baseline.snapshot.request.method,
|
||||
url: baseline.snapshot.request.url,
|
||||
isHttps: baseline.isHttps,
|
||||
rawRequestBase64: baseline.rawRequestBase64,
|
||||
packetFingerprint: await authorizationPacketFingerprint(baseline.rawRequestBase64),
|
||||
};
|
||||
}
|
||||
|
||||
async function authorizationTransformFingerprint(input: {
|
||||
baselineId: string;
|
||||
profileId: string;
|
||||
profileUpdatedAt: number;
|
||||
documentId: string;
|
||||
isolationContextId: string;
|
||||
cookieStoreId: string;
|
||||
dynamicPaths: string[];
|
||||
logicalBindingFingerprint?: string;
|
||||
}): Promise<string> {
|
||||
const digest = await crypto.subtle.digest(
|
||||
'SHA-256',
|
||||
new TextEncoder().encode(JSON.stringify(input)),
|
||||
);
|
||||
return `sha256:${[...new Uint8Array(digest)]
|
||||
.map((byte) => byte.toString(16).padStart(2, '0'))
|
||||
.join('')}`;
|
||||
}
|
||||
|
||||
async function validatedAuthorizationTransform(input: {
|
||||
id: string;
|
||||
grantId: string;
|
||||
profileId: string;
|
||||
}): Promise<{
|
||||
baseline: StoredAuthorizationBaseline;
|
||||
profile: BrowserTransformProfile;
|
||||
binding: BrowserAuthorizationTransformBinding;
|
||||
logical?: Awaited<ReturnType<typeof loadAuthorizationLogicalRequestBinding>>;
|
||||
}> {
|
||||
const baseline = await validatedStoredBaseline(input.id, input.grantId);
|
||||
const profile = await getBrowserTransformProfile(input.profileId);
|
||||
const target = baseline.snapshot.target;
|
||||
if (
|
||||
profile.target.tabId !== target.tabId
|
||||
|| profile.target.frameId !== target.frameId
|
||||
|| profile.target.documentId !== target.documentId
|
||||
|| profile.origin !== baseline.snapshot.origin
|
||||
|| profile.isolationContextId !== baseline.snapshot.isolationContextId
|
||||
|| profile.cookieStoreId !== baseline.snapshot.cookieStoreId
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_target_mismatch',
|
||||
'明文网关必须绑定授权基线所属的同一身份、Frame 与页面文档',
|
||||
);
|
||||
}
|
||||
const logical = baseline.snapshot.logicalRequest?.profileId === profile.id
|
||||
? await loadAuthorizationLogicalRequestBinding({
|
||||
baseline: baseline.snapshot,
|
||||
profileId: profile.id,
|
||||
})
|
||||
: undefined;
|
||||
const packet = logical
|
||||
? browserTransformReplayDraftToPacket(logical.draft)
|
||||
: authorizationRequestToTransformPacket(
|
||||
baseline.rawRequestBase64,
|
||||
baseline.snapshot.origin,
|
||||
);
|
||||
assertTransformRoute(
|
||||
profile.match.methods,
|
||||
profile.match.urlPattern,
|
||||
packet,
|
||||
profile.origin,
|
||||
);
|
||||
const dynamicPaths = logical
|
||||
? logical.binding.outputDestinations
|
||||
: authorizationDynamicTransformDestinations(baseline.snapshot, profile);
|
||||
const createdAt = Date.now();
|
||||
const binding: BrowserAuthorizationTransformBinding = {
|
||||
version: 1,
|
||||
baselineId: baseline.snapshot.id,
|
||||
profileId: profile.id,
|
||||
profileName: profile.name,
|
||||
isolationContextId: baseline.snapshot.isolationContextId,
|
||||
cookieStoreId: baseline.snapshot.cookieStoreId,
|
||||
target,
|
||||
origin: baseline.snapshot.origin,
|
||||
dynamicPaths,
|
||||
bindingFingerprint: await authorizationTransformFingerprint({
|
||||
baselineId: baseline.snapshot.id,
|
||||
profileId: profile.id,
|
||||
profileUpdatedAt: profile.updatedAt,
|
||||
documentId: target.documentId,
|
||||
isolationContextId: baseline.snapshot.isolationContextId,
|
||||
cookieStoreId: baseline.snapshot.cookieStoreId,
|
||||
dynamicPaths,
|
||||
logicalBindingFingerprint: logical?.binding.bindingFingerprint,
|
||||
}),
|
||||
createdAt,
|
||||
expiresAt: baseline.snapshot.expiresAt,
|
||||
};
|
||||
return { baseline, profile, binding, logical };
|
||||
}
|
||||
|
||||
export async function inspectAuthorizationBaselineTransform(input: {
|
||||
id: string;
|
||||
grantId: string;
|
||||
profileId: string;
|
||||
}): Promise<BrowserAuthorizationTransformBinding> {
|
||||
return (await validatedAuthorizationTransform(input)).binding;
|
||||
}
|
||||
|
||||
export async function compileAuthorizationBaselineWithTransform(input: {
|
||||
id: string;
|
||||
grantId: string;
|
||||
selector: BrowserAuthorizationResourceSelector;
|
||||
replacement: BrowserAuthorizationResourceValue;
|
||||
comparisonKey: string;
|
||||
profileId: string;
|
||||
bindingFingerprint: string;
|
||||
}): Promise<BrowserAuthorizationCompiledRequest> {
|
||||
const {
|
||||
baseline,
|
||||
profile,
|
||||
binding,
|
||||
logical,
|
||||
} = await validatedAuthorizationTransform(input);
|
||||
if (binding.bindingFingerprint !== input.bindingFingerprint) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_changed',
|
||||
'明文网关或页面文档已变化，请重新编译授权矩阵',
|
||||
);
|
||||
}
|
||||
selectedBaselineField(baseline.snapshot, input.selector);
|
||||
if (input.selector.source === 'logical') {
|
||||
if (!logical || input.selector.location !== 'body') {
|
||||
throw new ExtensionError(
|
||||
'authorization_logical_missing',
|
||||
'逻辑资源编译当前要求同一明文网关绑定下的 JSON/Form Body 字段',
|
||||
);
|
||||
}
|
||||
const replacement = await decodeAndVerifyLogicalReplacement({
|
||||
replacement: input.replacement,
|
||||
selector: input.selector,
|
||||
comparisonKey: input.comparisonKey,
|
||||
});
|
||||
const logicalPacket = replaceAuthorizationLogicalResource({
|
||||
packet: browserTransformReplayDraftToPacket(logical.draft),
|
||||
selector: input.selector,
|
||||
replacement,
|
||||
});
|
||||
const execution = await executeBrowserTransform({
|
||||
profileId: profile.id,
|
||||
direction: 'request',
|
||||
packet: logicalPacket,
|
||||
});
|
||||
const compiled: BrowserAuthorizationCompiledRequest = {
|
||||
version: 1,
|
||||
baselineId: baseline.snapshot.id,
|
||||
selector: input.selector,
|
||||
method: baseline.snapshot.request.method,
|
||||
url: baseline.snapshot.request.url,
|
||||
isHttps: baseline.isHttps,
|
||||
rawRequestBase64: baseline.rawRequestBase64,
|
||||
resourceValueFingerprint: input.replacement.valueFingerprint,
|
||||
logicalBindingFingerprint: logical.binding.bindingFingerprint,
|
||||
packetFingerprint: await authorizationPacketFingerprint(baseline.rawRequestBase64),
|
||||
};
|
||||
const compiledWithTransform = await applyAuthorizationTransformExecution({
|
||||
compiled,
|
||||
execution,
|
||||
origin: baseline.snapshot.origin,
|
||||
allowedDestinations: binding.dynamicPaths,
|
||||
allowBody: true,
|
||||
});
|
||||
assertAuthorizationLogicalPacketStructure(
|
||||
authorizationRequestToTransformPacket(
|
||||
compiledWithTransform.rawRequestBase64,
|
||||
baseline.snapshot.origin,
|
||||
),
|
||||
authorizationRequestToTransformPacket(
|
||||
baseline.rawRequestBase64,
|
||||
baseline.snapshot.origin,
|
||||
),
|
||||
);
|
||||
return compiledWithTransform;
|
||||
}
|
||||
const wireSelector = {
|
||||
source: 'wire' as const,
|
||||
location: input.selector.location,
|
||||
path: input.selector.path,
|
||||
};
|
||||
const compiled = await compileAuthorizationBaselineRequest({
|
||||
baselineId: baseline.snapshot.id,
|
||||
rawRequestBase64: baseline.rawRequestBase64,
|
||||
requestUrl: baseline.requestUrl,
|
||||
publicUrl: baseline.snapshot.request.url,
|
||||
selector: wireSelector,
|
||||
replacement: input.replacement,
|
||||
comparisonKey: input.comparisonKey,
|
||||
isHttps: baseline.isHttps,
|
||||
});
|
||||
const execution = await executeBrowserTransform({
|
||||
profileId: profile.id,
|
||||
direction: 'request',
|
||||
packet: authorizationRequestToTransformPacket(
|
||||
compiled.rawRequestBase64,
|
||||
baseline.snapshot.origin,
|
||||
),
|
||||
});
|
||||
return applyAuthorizationTransformExecution({
|
||||
compiled,
|
||||
execution,
|
||||
origin: baseline.snapshot.origin,
|
||||
allowedDestinations: binding.dynamicPaths,
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import { browserAuthorizationWorkspaceRecovery } from './engine';
|
||||
|
||||
describe('browser authorization workspace lifecycle recovery', () => {
|
||||
it.each([
|
||||
['expired', '自然过期'],
|
||||
['evicted', '容量达到上限'],
|
||||
['engine_instance_changed', '引擎已经重启'],
|
||||
['not_found', '引擎中不存在'],
|
||||
['replaced', '新工作区替换'],
|
||||
] as const)('maps %s to an actionable message', (reason, expected) => {
|
||||
const error = new ExtensionError(
|
||||
`authorization_workspace_${reason}`,
|
||||
'server message',
|
||||
{
|
||||
reason,
|
||||
workspaceId: 'workspace-old',
|
||||
engineInstanceId: 'engine-current',
|
||||
replacementWorkspaceId: reason === 'replaced' ? 'workspace-new' : undefined,
|
||||
},
|
||||
);
|
||||
|
||||
expect(browserAuthorizationWorkspaceRecovery(error)).toMatchObject({
|
||||
reason,
|
||||
message: expect.stringContaining(expected),
|
||||
});
|
||||
});
|
||||
|
||||
it('does not reinterpret unrelated bridge errors', () => {
|
||||
expect(browserAuthorizationWorkspaceRecovery(
|
||||
new ExtensionError('bridge_disconnected', 'offline'),
|
||||
)).toBeUndefined();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,342 @@
|
||||
import { request } from '@/platform/messaging/runtime';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import { normalizeBrowserAuthorizationTaskResult } from './protocol';
|
||||
|
||||
export type BrowserAuthorizationMode = 'horizontal' | 'vertical';
|
||||
export type BrowserAuthorizationSide = 'left' | 'right';
|
||||
|
||||
export interface BrowserAuthorizationBaselineCandidate {
|
||||
id: string;
|
||||
method: string;
|
||||
url: string;
|
||||
path: string;
|
||||
resourceType: string;
|
||||
startedAt: number;
|
||||
completedAt?: number;
|
||||
durationMs?: number;
|
||||
statusCode?: number;
|
||||
error?: string;
|
||||
eligible: boolean;
|
||||
reasons: string[];
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationBaseline {
|
||||
id: string;
|
||||
networkRequestId: string;
|
||||
request: {
|
||||
method: string;
|
||||
url: string;
|
||||
path: string;
|
||||
contentType: string;
|
||||
actionFingerprint: string;
|
||||
};
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationResourceCandidate {
|
||||
id: string;
|
||||
source: 'wire' | 'logical';
|
||||
location: 'header' | 'path' | 'query' | 'body';
|
||||
path: string;
|
||||
category: string;
|
||||
confidence: 'high' | 'medium' | 'low';
|
||||
requiresLogicalBinding: boolean;
|
||||
reasons: string[];
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationOperationCandidate {
|
||||
id: string;
|
||||
method: string;
|
||||
path: string;
|
||||
eligible: boolean;
|
||||
sideEffect: boolean;
|
||||
requiresDynamicRebuild: boolean;
|
||||
authenticationPaths: string[];
|
||||
dynamicPaths: string[];
|
||||
reasons: string[];
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationWorkspace {
|
||||
version: 1;
|
||||
id: string;
|
||||
engineInstanceId: string;
|
||||
mode: BrowserAuthorizationMode;
|
||||
state: 'ready' | 'conditional' | 'blocked' | 'stale';
|
||||
left: {
|
||||
accountLabel?: string;
|
||||
origin: string;
|
||||
target: { tabId: number; frameId: number; documentId: string };
|
||||
authentication: {
|
||||
status: 'authenticated' | 'unauthenticated' | 'unknown';
|
||||
cookieCount: number;
|
||||
storageEntryCount: number;
|
||||
};
|
||||
};
|
||||
right: BrowserAuthorizationWorkspace['left'];
|
||||
proof: {
|
||||
level: 'strong' | 'conditional' | 'none';
|
||||
sameOrigin: boolean;
|
||||
cookieStoreRelation: 'different' | 'same' | 'unknown';
|
||||
accountEvidenceRelation: 'different' | 'same' | 'unknown';
|
||||
requestCredentialRelation: 'different' | 'same' | 'unknown';
|
||||
refreshCheck: 'passed' | 'failed' | 'not-required';
|
||||
reasons: string[];
|
||||
};
|
||||
baselines: {
|
||||
left?: BrowserAuthorizationBaseline;
|
||||
right?: BrowserAuthorizationBaseline;
|
||||
verification?: BrowserAuthorizationBaseline;
|
||||
};
|
||||
baselinePair: {
|
||||
state: 'waiting' | 'matched' | 'mismatch';
|
||||
reasons: string[];
|
||||
resourceCandidates: BrowserAuthorizationResourceCandidate[];
|
||||
operationCandidates: BrowserAuthorizationOperationCandidate[];
|
||||
};
|
||||
plan?: {
|
||||
id: string;
|
||||
mode: BrowserAuthorizationMode;
|
||||
candidateId: string;
|
||||
state: 'ready' | 'review-required' | 'blocked';
|
||||
selector: {
|
||||
source: 'wire' | 'logical' | 'operation';
|
||||
location: 'header' | 'path' | 'query' | 'body' | 'request';
|
||||
path: string;
|
||||
};
|
||||
cases: Array<{
|
||||
id: string;
|
||||
label: string;
|
||||
authContextSide: 'left' | 'right';
|
||||
resourceValueSide: 'left' | 'right' | '';
|
||||
method: string;
|
||||
path: string;
|
||||
sideEffect: boolean;
|
||||
}>;
|
||||
requestBudget: number;
|
||||
requiresDynamicRebuild: boolean;
|
||||
reasons: string[];
|
||||
};
|
||||
execution?: {
|
||||
id: string;
|
||||
state: 'completed' | 'partial';
|
||||
verdict: 'confirmed' | 'likely' | 'protected' | 'inconclusive' | 'invalid-controls';
|
||||
confidence: 'high' | 'medium' | 'low' | 'none';
|
||||
requestCount: number;
|
||||
cases: Array<{
|
||||
id: string;
|
||||
label: string;
|
||||
state: 'completed' | 'failed' | 'skipped';
|
||||
result?: {
|
||||
method: string;
|
||||
url: string;
|
||||
status: number;
|
||||
statusText: string;
|
||||
outcome: 'success' | 'denied' | 'redirect' | 'client-error' | 'server-error' | 'opaque';
|
||||
durationMs: number;
|
||||
timing: BrowserAuthorizationRequestTiming;
|
||||
response: {
|
||||
contentType: string;
|
||||
contentEncoding?: string;
|
||||
capturedBytes: number;
|
||||
analysisBytes?: number;
|
||||
declaredBytes?: number;
|
||||
truncated: boolean;
|
||||
decoded?: boolean;
|
||||
analysisState?: 'identity' | 'decoded' | 'encoded-unavailable';
|
||||
analysisRepresentation?: 'json' | 'html' | 'form' | 'text' | 'binary' | 'encoded';
|
||||
};
|
||||
};
|
||||
error?: string;
|
||||
}>;
|
||||
evidence: Array<{
|
||||
direction: string;
|
||||
path: string;
|
||||
valueFingerprint: string;
|
||||
source: string;
|
||||
}>;
|
||||
evidenceAvailable: boolean;
|
||||
reasons: string[];
|
||||
};
|
||||
expiresAt: number;
|
||||
staleReason?: string;
|
||||
recovery?: {
|
||||
code: string;
|
||||
scope: string;
|
||||
message: string;
|
||||
automatic: false;
|
||||
};
|
||||
}
|
||||
|
||||
export type BrowserAuthorizationWorkspaceLifecycleReason =
|
||||
| 'expired'
|
||||
| 'evicted'
|
||||
| 'engine_instance_changed'
|
||||
| 'not_found'
|
||||
| 'replaced';
|
||||
|
||||
export interface BrowserAuthorizationWorkspaceLifecycleDetails {
|
||||
reason: BrowserAuthorizationWorkspaceLifecycleReason;
|
||||
workspaceId: string;
|
||||
engineInstanceId: string;
|
||||
expiresAt?: number;
|
||||
replacementWorkspaceId?: string;
|
||||
}
|
||||
|
||||
function parseWorkspaceLifecycleDetails(input: unknown): BrowserAuthorizationWorkspaceLifecycleDetails | undefined {
|
||||
if (!input || typeof input !== 'object' || Array.isArray(input)) return undefined;
|
||||
const value = input as Record<string, unknown>;
|
||||
if (!['expired', 'evicted', 'engine_instance_changed', 'not_found', 'replaced'].includes(String(value.reason))) return undefined;
|
||||
if (typeof value.workspaceId !== 'string' || typeof value.engineInstanceId !== 'string') return undefined;
|
||||
return value as unknown as BrowserAuthorizationWorkspaceLifecycleDetails;
|
||||
}
|
||||
|
||||
export function browserAuthorizationWorkspaceRecovery(error: unknown): {
|
||||
reason: BrowserAuthorizationWorkspaceLifecycleReason;
|
||||
message: string;
|
||||
details?: BrowserAuthorizationWorkspaceLifecycleDetails;
|
||||
} | undefined {
|
||||
if (!(error instanceof ExtensionError) || !error.code.startsWith('authorization_workspace_')) return undefined;
|
||||
const details = parseWorkspaceLifecycleDetails(error.details);
|
||||
const reason = (details?.reason || error.code.slice('authorization_workspace_'.length)) as BrowserAuthorizationWorkspaceLifecycleReason;
|
||||
const messages: Record<BrowserAuthorizationWorkspaceLifecycleReason, string> = {
|
||||
expired: '授权工作区已自然过期。A/B 登录页不会受影响，请点击“新建”重新验证身份。',
|
||||
evicted: '该工作区因引擎内存容量达到上限而被淘汰。请点击“新建”重新建立，已有页面登录态不会丢失。',
|
||||
engine_instance_changed: 'Yak 引擎已经重启，旧工作区不能跨进程恢复。请确认引擎在线后点击“新建”。',
|
||||
not_found: '当前页面缓存的工作区在引擎中不存在。请点击“新建”重新建立身份工作区。',
|
||||
replaced: details?.replacementWorkspaceId
|
||||
? '该工作区已被同一组身份的新工作区替换。请刷新页面状态，或点击“新建”重新建立。'
|
||||
: '该工作区已被更新的身份工作区替换。请点击“新建”重新建立。',
|
||||
};
|
||||
if (!(reason in messages)) return undefined;
|
||||
return { reason, message: messages[reason], details };
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationRequestTiming {
|
||||
dnsMs: number;
|
||||
connectMs: number;
|
||||
tlsMs: number;
|
||||
ttfbMs: number;
|
||||
transferMs: number;
|
||||
totalMs: number;
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationEvidenceCase {
|
||||
id: string;
|
||||
label: string;
|
||||
authContextSide: 'left' | 'right';
|
||||
resourceValueSide: 'left' | 'right' | '';
|
||||
state: 'completed' | 'failed' | 'skipped';
|
||||
status?: number;
|
||||
outcome?: string;
|
||||
timing: BrowserAuthorizationRequestTiming;
|
||||
requestAvailable: boolean;
|
||||
responseAvailable: boolean;
|
||||
response?: {
|
||||
contentType: string;
|
||||
contentEncoding?: string;
|
||||
capturedBytes: number;
|
||||
analysisBytes?: number;
|
||||
declaredBytes?: number;
|
||||
truncated: boolean;
|
||||
decoded?: boolean;
|
||||
analysisState?: 'identity' | 'decoded' | 'encoded-unavailable';
|
||||
analysisRepresentation?: 'json' | 'html' | 'form' | 'text' | 'binary' | 'encoded';
|
||||
};
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationEvidenceComparison {
|
||||
id: string;
|
||||
label: string;
|
||||
leftCaseId: string;
|
||||
rightCaseId: string;
|
||||
purpose: 'control' | 'authorization' | 'state-change';
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationEvidenceBundle {
|
||||
version: 1;
|
||||
workspaceId: string;
|
||||
executionId: string;
|
||||
mode: BrowserAuthorizationMode;
|
||||
verdict: NonNullable<BrowserAuthorizationWorkspace['execution']>['verdict'];
|
||||
confidence: NonNullable<BrowserAuthorizationWorkspace['execution']>['confidence'];
|
||||
cases: BrowserAuthorizationEvidenceCase[];
|
||||
comparisons: BrowserAuthorizationEvidenceComparison[];
|
||||
semantic: NonNullable<BrowserAuthorizationWorkspace['execution']>['evidence'];
|
||||
representations: string[];
|
||||
expiresAt: number;
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationEvidenceDiff {
|
||||
version: 1;
|
||||
workspaceId: string;
|
||||
executionId: string;
|
||||
leftCaseId: string;
|
||||
rightCaseId: string;
|
||||
scope: 'request' | 'response';
|
||||
view: 'redacted' | 'raw';
|
||||
representation: 'structured' | 'raw';
|
||||
equal: boolean;
|
||||
entries: Array<{
|
||||
path: string;
|
||||
kind: 'added' | 'removed' | 'changed';
|
||||
left?: string;
|
||||
right?: string;
|
||||
volatile: boolean;
|
||||
sensitive: boolean;
|
||||
semantic: boolean;
|
||||
}>;
|
||||
omitted: number;
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationEvidencePacket {
|
||||
version: 1;
|
||||
workspaceId: string;
|
||||
executionId: string;
|
||||
caseId: string;
|
||||
side: 'request' | 'response';
|
||||
view: 'redacted' | 'raw';
|
||||
packetBase64: string;
|
||||
capturedBytes: number;
|
||||
truncated: boolean;
|
||||
}
|
||||
|
||||
export interface BrowserAuthorizationEvidenceValidation {
|
||||
version: 1;
|
||||
workspaceId: string;
|
||||
executionId: string;
|
||||
direction: 'a-to-b' | 'b-to-a' | 'low-to-privileged' | 'post-state';
|
||||
verified: boolean;
|
||||
evidence: NonNullable<BrowserAuthorizationWorkspace['execution']>['evidence'];
|
||||
rejectedPaths: string[];
|
||||
verdict: NonNullable<BrowserAuthorizationWorkspace['execution']>['verdict'];
|
||||
confidence: NonNullable<BrowserAuthorizationWorkspace['execution']>['confidence'];
|
||||
verdictChanged: boolean;
|
||||
reason: string;
|
||||
}
|
||||
|
||||
export type BrowserAuthorizationTaskSchema =
|
||||
| 'authorization.workspace.create'
|
||||
| 'authorization.workspace.inspect'
|
||||
| 'authorization.baseline.candidates'
|
||||
| 'authorization.baseline.bind'
|
||||
| 'authorization.logical.bind'
|
||||
| 'authorization.plan.create'
|
||||
| 'authorization.plan.execute'
|
||||
| 'authorization.evidence.inspect'
|
||||
| 'authorization.evidence.packet'
|
||||
| 'authorization.evidence.diff'
|
||||
| 'authorization.evidence.validate';
|
||||
|
||||
export async function runBrowserAuthorizationTask<T>(
|
||||
schema: BrowserAuthorizationTaskSchema,
|
||||
payload: Record<string, unknown>,
|
||||
timeoutMs = 30_000,
|
||||
): Promise<T> {
|
||||
try {
|
||||
const result = await request('authorization.engine.task', { schema, payload, timeoutMs });
|
||||
return normalizeBrowserAuthorizationTaskResult<T>(schema, result);
|
||||
} catch (error) {
|
||||
const recovery = browserAuthorizationWorkspaceRecovery(error);
|
||||
if (!recovery || !(error instanceof ExtensionError)) throw error;
|
||||
throw new ExtensionError(error.code, recovery.message, recovery.details);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,228 @@
|
||||
import { browser, type Browser } from 'wxt/browser';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import type { BrowserFirefoxManagedContainer } from '@/types/models';
|
||||
|
||||
const STORAGE_KEY = 'browser.authorization.managed-firefox-containers.v1';
|
||||
const MAX_MANAGED_CONTAINERS = 16;
|
||||
const COLORS = ['blue', 'turquoise', 'green', 'orange', 'purple', 'pink'] as const;
|
||||
|
||||
interface FirefoxContextualIdentity {
|
||||
cookieStoreId: string;
|
||||
name: string;
|
||||
color: string;
|
||||
icon: string;
|
||||
}
|
||||
|
||||
interface FirefoxContextualIdentitiesAPI {
|
||||
create(details: {
|
||||
name: string;
|
||||
color: string;
|
||||
icon: string;
|
||||
}): Promise<FirefoxContextualIdentity>;
|
||||
query(details: Record<string, never>): Promise<FirefoxContextualIdentity[]>;
|
||||
remove(cookieStoreId: string): Promise<FirefoxContextualIdentity>;
|
||||
}
|
||||
|
||||
interface ManagedFirefoxContainer {
|
||||
version: 1;
|
||||
cookieStoreId: string;
|
||||
name: string;
|
||||
color: string;
|
||||
createdAt: number;
|
||||
}
|
||||
|
||||
export interface FirefoxContainerDescriptor extends FirefoxContextualIdentity {
|
||||
managed: boolean;
|
||||
}
|
||||
|
||||
function contextualIdentities(): FirefoxContextualIdentitiesAPI | undefined {
|
||||
if (!import.meta.env.FIREFOX) return undefined;
|
||||
return (browser as unknown as {
|
||||
contextualIdentities?: FirefoxContextualIdentitiesAPI;
|
||||
}).contextualIdentities;
|
||||
}
|
||||
|
||||
function validManagedContainer(value: unknown): value is ManagedFirefoxContainer {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
|
||||
const container = value as Partial<ManagedFirefoxContainer>;
|
||||
return container.version === 1
|
||||
&& typeof container.cookieStoreId === 'string'
|
||||
&& /^firefox-container-[0-9]+$/.test(container.cookieStoreId)
|
||||
&& typeof container.name === 'string'
|
||||
&& container.name.length > 0
|
||||
&& container.name.length <= 50
|
||||
&& typeof container.color === 'string'
|
||||
&& container.color.length <= 32
|
||||
&& typeof container.createdAt === 'number'
|
||||
&& Number.isFinite(container.createdAt);
|
||||
}
|
||||
|
||||
async function readManagedContainers(): Promise<ManagedFirefoxContainer[]> {
|
||||
const stored = (await browser.storage.local.get(STORAGE_KEY))[STORAGE_KEY];
|
||||
if (!Array.isArray(stored)) return [];
|
||||
return stored.filter(validManagedContainer).slice(-MAX_MANAGED_CONTAINERS);
|
||||
}
|
||||
|
||||
async function writeManagedContainers(
|
||||
containers: ManagedFirefoxContainer[],
|
||||
): Promise<void> {
|
||||
await browser.storage.local.set({
|
||||
[STORAGE_KEY]: containers.slice(-MAX_MANAGED_CONTAINERS),
|
||||
});
|
||||
}
|
||||
|
||||
export function firefoxContainerManagementAvailable(): boolean {
|
||||
return Boolean(contextualIdentities());
|
||||
}
|
||||
|
||||
export async function listFirefoxContainerDescriptors(): Promise<FirefoxContainerDescriptor[]> {
|
||||
const api = contextualIdentities();
|
||||
if (!api) return [];
|
||||
const [containers, managed] = await Promise.all([
|
||||
api.query({}),
|
||||
readManagedContainers(),
|
||||
]);
|
||||
const managedIDs = new Set(managed.map((container) => container.cookieStoreId));
|
||||
return containers.slice(0, 128).map((container) => ({
|
||||
...container,
|
||||
managed: managedIDs.has(container.cookieStoreId),
|
||||
}));
|
||||
}
|
||||
|
||||
export async function listManagedFirefoxContainerIdentities(): Promise<BrowserFirefoxManagedContainer[]> {
|
||||
const api = contextualIdentities();
|
||||
if (!api) return [];
|
||||
const [containers, managed, tabs] = await Promise.all([
|
||||
api.query({}),
|
||||
readManagedContainers(),
|
||||
browser.tabs.query({}),
|
||||
]);
|
||||
const currentContainers = new Map(
|
||||
containers.map((container) => [container.cookieStoreId, container]),
|
||||
);
|
||||
const retained = managed.filter((container) => currentContainers.has(container.cookieStoreId));
|
||||
if (retained.length !== managed.length) await writeManagedContainers(retained);
|
||||
const tabCounts = new Map<string, number>();
|
||||
for (const tab of tabs) {
|
||||
const cookieStoreId = (tab as Browser.tabs.Tab & { cookieStoreId?: string }).cookieStoreId;
|
||||
if (!cookieStoreId) continue;
|
||||
tabCounts.set(cookieStoreId, (tabCounts.get(cookieStoreId) || 0) + 1);
|
||||
}
|
||||
return retained
|
||||
.slice()
|
||||
.sort((left, right) => right.createdAt - left.createdAt)
|
||||
.map((entry) => {
|
||||
const container = currentContainers.get(entry.cookieStoreId)!;
|
||||
return {
|
||||
cookieStoreId: entry.cookieStoreId,
|
||||
name: container.name,
|
||||
color: container.color,
|
||||
createdAt: entry.createdAt,
|
||||
tabCount: tabCounts.get(entry.cookieStoreId) || 0,
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
export async function createFirefoxContainerIdentity(input: {
|
||||
url: string;
|
||||
name?: string;
|
||||
}): Promise<{
|
||||
tab: Browser.tabs.Tab;
|
||||
container: FirefoxContainerDescriptor & { managed: true };
|
||||
}> {
|
||||
const api = contextualIdentities();
|
||||
if (!api) {
|
||||
throw new ExtensionError(
|
||||
'channel_unavailable',
|
||||
'当前浏览器没有开放 Firefox Container 管理能力',
|
||||
);
|
||||
}
|
||||
let url: URL;
|
||||
try {
|
||||
url = new URL(input.url);
|
||||
} catch {
|
||||
throw new ExtensionError('isolation_invalid', 'Container 身份页面 URL 无效');
|
||||
}
|
||||
if (!['http:', 'https:'].includes(url.protocol)) {
|
||||
throw new ExtensionError('isolation_invalid', 'Container 身份页面只能使用 HTTP(S) URL');
|
||||
}
|
||||
const managed = await readManagedContainers();
|
||||
if (managed.length >= MAX_MANAGED_CONTAINERS) {
|
||||
throw new ExtensionError(
|
||||
'isolation_limit',
|
||||
`最多保留 ${MAX_MANAGED_CONTAINERS} 个由 Yakit 创建的临时 Container，请先清理不用的身份`,
|
||||
);
|
||||
}
|
||||
const name = (input.name || `Yakit 测试身份 ${managed.length + 1}`)
|
||||
.trim()
|
||||
.slice(0, 50);
|
||||
if (!name) throw new ExtensionError('isolation_invalid', 'Container 身份名称不能为空');
|
||||
const color = COLORS[managed.length % COLORS.length];
|
||||
const container = await api.create({
|
||||
name,
|
||||
color,
|
||||
icon: 'fingerprint',
|
||||
});
|
||||
const entry: ManagedFirefoxContainer = {
|
||||
version: 1,
|
||||
cookieStoreId: container.cookieStoreId,
|
||||
name: container.name,
|
||||
color: container.color,
|
||||
createdAt: Date.now(),
|
||||
};
|
||||
await writeManagedContainers([...managed, entry]);
|
||||
try {
|
||||
const tab = await (browser.tabs.create as unknown as (details: {
|
||||
url: string;
|
||||
active: boolean;
|
||||
cookieStoreId: string;
|
||||
}) => Promise<Browser.tabs.Tab>)({
|
||||
url: url.href,
|
||||
active: true,
|
||||
cookieStoreId: container.cookieStoreId,
|
||||
});
|
||||
return {
|
||||
tab,
|
||||
container: {
|
||||
...container,
|
||||
managed: true,
|
||||
},
|
||||
};
|
||||
} catch (error) {
|
||||
await api.remove(container.cookieStoreId).catch(() => undefined);
|
||||
await writeManagedContainers(
|
||||
managed.filter((candidate) => candidate.cookieStoreId !== container.cookieStoreId),
|
||||
);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
export async function removeFirefoxContainerIdentity(
|
||||
cookieStoreId: string,
|
||||
): Promise<{ cookieStoreId: string; removedTabs: number }> {
|
||||
const api = contextualIdentities();
|
||||
if (!api) {
|
||||
throw new ExtensionError(
|
||||
'channel_unavailable',
|
||||
'当前浏览器没有开放 Firefox Container 管理能力',
|
||||
);
|
||||
}
|
||||
const managed = await readManagedContainers();
|
||||
if (!managed.some((container) => container.cookieStoreId === cookieStoreId)) {
|
||||
throw new ExtensionError(
|
||||
'target_denied',
|
||||
'只能清理由 Yakit 创建的临时 Firefox Container',
|
||||
);
|
||||
}
|
||||
const tabs = await browser.tabs.query({});
|
||||
const tabIDs = tabs.flatMap((tab) => {
|
||||
const storeID = (tab as Browser.tabs.Tab & { cookieStoreId?: string }).cookieStoreId;
|
||||
return storeID === cookieStoreId && tab.id ? [tab.id] : [];
|
||||
});
|
||||
if (tabIDs.length) await browser.tabs.remove(tabIDs);
|
||||
await api.remove(cookieStoreId);
|
||||
await writeManagedContainers(
|
||||
managed.filter((container) => container.cookieStoreId !== cookieStoreId),
|
||||
);
|
||||
return { cookieStoreId, removedTabs: tabIDs.length };
|
||||
}
|
||||
@@ -0,0 +1,201 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import type { ActiveTabInfo, BrowserIsolationContext } from '@/types/models';
|
||||
import {
|
||||
activeTabInfo,
|
||||
applyTabLocalAuthenticationEvidence,
|
||||
buildIsolationProof,
|
||||
isolationContextForTab,
|
||||
type IsolationCookieStore,
|
||||
type IsolationTabDescriptor,
|
||||
} from './isolation';
|
||||
|
||||
function tab(id: number, incognito: boolean, url = 'https://example.test/account'): IsolationTabDescriptor {
|
||||
return { id, windowId: incognito ? 2 : 1, title: incognito ? 'B' : 'A', url, incognito };
|
||||
}
|
||||
|
||||
function asActive(
|
||||
descriptor: IsolationTabDescriptor,
|
||||
context: BrowserIsolationContext,
|
||||
): ActiveTabInfo {
|
||||
return activeTabInfo(descriptor, context);
|
||||
}
|
||||
|
||||
describe('browser identity isolation', () => {
|
||||
it('proves a Chromium regular/incognito pair with different opaque Cookie Stores', () => {
|
||||
const stores: IsolationCookieStore[] = [
|
||||
{ id: 'opaque-regular', tabIds: [1, 3] },
|
||||
{ id: 'opaque-private', tabIds: [2] },
|
||||
];
|
||||
const leftDescriptor = tab(1, false);
|
||||
const rightDescriptor = tab(2, true);
|
||||
const leftContext = isolationContextForTab(leftDescriptor, stores, 'chromium');
|
||||
const rightContext = isolationContextForTab(rightDescriptor, stores, 'chromium');
|
||||
const proof = buildIsolationProof(
|
||||
asActive(leftDescriptor, leftContext),
|
||||
asActive(rightDescriptor, rightContext),
|
||||
[leftContext, rightContext],
|
||||
1_000,
|
||||
'proof-1',
|
||||
);
|
||||
|
||||
expect(leftContext).toEqual(expect.objectContaining({
|
||||
kind: 'browser-profile',
|
||||
cookieStoreId: 'opaque-regular',
|
||||
tabIds: [1, 3],
|
||||
}));
|
||||
expect(rightContext).toEqual(expect.objectContaining({
|
||||
kind: 'chrome-incognito-store',
|
||||
cookieStoreId: 'opaque-private',
|
||||
incognito: true,
|
||||
}));
|
||||
expect(proof).toEqual(expect.objectContaining({
|
||||
id: 'proof-1',
|
||||
level: 'strong',
|
||||
cookieStoreRelation: 'different',
|
||||
sameOrigin: true,
|
||||
refreshCheck: 'not-required',
|
||||
}));
|
||||
expect(proof.expiresAt).toBe(1_000 + 30 * 60_000);
|
||||
});
|
||||
|
||||
it('fails closed when two ordinary tabs share one Cookie Store', () => {
|
||||
const stores: IsolationCookieStore[] = [{ id: 'shared-store', tabIds: [1, 2] }];
|
||||
const leftDescriptor = tab(1, false);
|
||||
const rightDescriptor = tab(2, false);
|
||||
const leftContext = isolationContextForTab(leftDescriptor, stores, 'chromium');
|
||||
const rightContext = isolationContextForTab(rightDescriptor, stores, 'chromium');
|
||||
const proof = buildIsolationProof(
|
||||
asActive(leftDescriptor, leftContext),
|
||||
asActive(rightDescriptor, rightContext),
|
||||
[leftContext, rightContext],
|
||||
1_000,
|
||||
'proof-shared',
|
||||
);
|
||||
|
||||
expect(leftContext.contextId).toBe(rightContext.contextId);
|
||||
expect(proof.level).toBe('none');
|
||||
expect(proof.cookieStoreRelation).toBe('same');
|
||||
expect(proof.reasons.join(' ')).toContain('不同 tabId 不代表不同登录态');
|
||||
});
|
||||
|
||||
it('upgrades same-store tabs only when authentication is sessionStorage-local and distinct', () => {
|
||||
const stores: IsolationCookieStore[] = [{ id: 'shared-store', tabIds: [1, 2] }];
|
||||
const leftDescriptor = tab(1, false);
|
||||
const rightDescriptor = tab(2, false);
|
||||
const leftContext = isolationContextForTab(leftDescriptor, stores, 'chromium');
|
||||
const rightContext = isolationContextForTab(rightDescriptor, stores, 'chromium');
|
||||
const proof = buildIsolationProof(
|
||||
asActive(leftDescriptor, leftContext),
|
||||
asActive(rightDescriptor, rightContext),
|
||||
[leftContext, rightContext],
|
||||
1_000,
|
||||
'proof-tab-local',
|
||||
);
|
||||
|
||||
const upgraded = applyTabLocalAuthenticationEvidence(
|
||||
proof,
|
||||
{
|
||||
origin: 'https://example.test',
|
||||
status: 'authenticated',
|
||||
authCookieNames: [],
|
||||
authLocalStorageKeys: [],
|
||||
authSessionStorageKeys: ['access_token'],
|
||||
fingerprint: 'left-fingerprint',
|
||||
},
|
||||
{
|
||||
origin: 'https://example.test',
|
||||
status: 'authenticated',
|
||||
authCookieNames: [],
|
||||
authLocalStorageKeys: [],
|
||||
authSessionStorageKeys: ['access_token'],
|
||||
fingerprint: 'right-fingerprint',
|
||||
},
|
||||
);
|
||||
|
||||
expect(upgraded.level).toBe('conditional');
|
||||
expect(upgraded.accountEvidenceRelation).toBe('different');
|
||||
expect(upgraded.requestCredentialRelation).toBe('unknown');
|
||||
expect(upgraded.refreshCheck).toBe('passed');
|
||||
});
|
||||
|
||||
it('keeps same-store tabs blocked when shared Cookie or localStorage carries authentication', () => {
|
||||
const stores: IsolationCookieStore[] = [{ id: 'shared-store', tabIds: [1, 2] }];
|
||||
const leftDescriptor = tab(1, false);
|
||||
const rightDescriptor = tab(2, false);
|
||||
const leftContext = isolationContextForTab(leftDescriptor, stores, 'chromium');
|
||||
const rightContext = isolationContextForTab(rightDescriptor, stores, 'chromium');
|
||||
const proof = buildIsolationProof(
|
||||
asActive(leftDescriptor, leftContext),
|
||||
asActive(rightDescriptor, rightContext),
|
||||
[leftContext, rightContext],
|
||||
1_000,
|
||||
'proof-shared-auth',
|
||||
);
|
||||
const shared = {
|
||||
origin: 'https://example.test',
|
||||
status: 'authenticated' as const,
|
||||
authCookieNames: ['session'],
|
||||
authLocalStorageKeys: ['auth'],
|
||||
authSessionStorageKeys: ['access_token'],
|
||||
};
|
||||
|
||||
const blocked = applyTabLocalAuthenticationEvidence(
|
||||
proof,
|
||||
{ ...shared, fingerprint: 'left' },
|
||||
{ ...shared, fingerprint: 'right' },
|
||||
);
|
||||
|
||||
expect(blocked.level).toBe('none');
|
||||
expect(blocked.reasons.join(' ')).toContain('共享 Cookie Store');
|
||||
});
|
||||
|
||||
it('recognizes Firefox Container identities without hard-coding tab IDs', () => {
|
||||
const stores: IsolationCookieStore[] = [
|
||||
{ id: 'firefox-container-12', tabIds: [7] },
|
||||
{ id: 'firefox-container-29', tabIds: [8] },
|
||||
];
|
||||
const leftDescriptor = { ...tab(7, false), cookieStoreId: 'firefox-container-12' };
|
||||
const rightDescriptor = { ...tab(8, false), cookieStoreId: 'firefox-container-29' };
|
||||
const leftContext = isolationContextForTab(leftDescriptor, stores, 'firefox', [{
|
||||
cookieStoreId: 'firefox-container-12',
|
||||
name: 'Yakit 身份 A',
|
||||
color: 'blue',
|
||||
icon: 'fingerprint',
|
||||
managed: true,
|
||||
}]);
|
||||
const rightContext = isolationContextForTab(rightDescriptor, stores, 'firefox');
|
||||
const proof = buildIsolationProof(
|
||||
asActive(leftDescriptor, leftContext),
|
||||
asActive(rightDescriptor, rightContext),
|
||||
[leftContext, rightContext],
|
||||
1_000,
|
||||
'proof-container',
|
||||
);
|
||||
|
||||
expect(leftContext.kind).toBe('firefox-container');
|
||||
expect(leftContext.containerId).toBe('firefox-container-12');
|
||||
expect(leftContext).toEqual(expect.objectContaining({
|
||||
containerName: 'Yakit 身份 A',
|
||||
containerColor: 'blue',
|
||||
managed: true,
|
||||
}));
|
||||
expect(proof.level).toBe('strong');
|
||||
});
|
||||
|
||||
it('does not invent isolation when Cookie Store resolution is unavailable', () => {
|
||||
const descriptor = tab(9, false);
|
||||
const context = isolationContextForTab(descriptor, [], 'chromium');
|
||||
|
||||
expect(context.level).toBe('none');
|
||||
expect(context.cookieStoreId).toBeUndefined();
|
||||
expect(context.guarantees.cookies).toBe('unknown');
|
||||
});
|
||||
|
||||
it('rejects assigning the same page to both identity slots', () => {
|
||||
const descriptor = tab(1, false);
|
||||
const context = isolationContextForTab(descriptor, [{ id: 'store', tabIds: [1] }], 'chromium');
|
||||
const active = asActive(descriptor, context);
|
||||
|
||||
expect(() => buildIsolationProof(active, active, [context])).toThrow('不能选择同一个标签页');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,495 @@
|
||||
import { browser } from 'wxt/browser';
|
||||
import type {
|
||||
ActiveTabInfo,
|
||||
BrowserFirefoxContainerIdentityResult,
|
||||
BrowserFirefoxManagedContainer,
|
||||
BrowserIncognitoIdentityResult,
|
||||
BrowserIsolationContext,
|
||||
BrowserIsolationInspection,
|
||||
BrowserIsolationProof,
|
||||
BrowserTarget,
|
||||
PageContext,
|
||||
PageContextOptions,
|
||||
} from '@/types/models';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import {
|
||||
authenticationFingerprint,
|
||||
authenticationStorageEntries,
|
||||
} from './auth-fingerprint';
|
||||
import {
|
||||
activeTabInfo,
|
||||
browserTabDescriptor,
|
||||
isolationContextForTab,
|
||||
listIsolationCookieStores,
|
||||
resolveTabCookieStoreId as resolveCookieStoreId,
|
||||
uniqueTabIds,
|
||||
type IsolationCookieStore,
|
||||
type IsolationTabDescriptor,
|
||||
} from '@/platform/browser/isolation';
|
||||
import {
|
||||
createFirefoxContainerIdentity,
|
||||
firefoxContainerManagementAvailable,
|
||||
listFirefoxContainerDescriptors,
|
||||
listManagedFirefoxContainerIdentities,
|
||||
removeFirefoxContainerIdentity,
|
||||
} from './firefox-container';
|
||||
import { AUTHORIZATION_WORKSPACE_TTL_MS } from './lifetime';
|
||||
|
||||
export {
|
||||
activeTabInfo,
|
||||
isolationContextForTab,
|
||||
type IsolationCookieStore,
|
||||
type IsolationTabDescriptor,
|
||||
} from '@/platform/browser/isolation';
|
||||
|
||||
const PROOF_TTL_MS = AUTHORIZATION_WORKSPACE_TTL_MS;
|
||||
const MAX_PROOFS = 32;
|
||||
const MAX_PROOF_STORAGE_BYTES = 64 * 1_024;
|
||||
const PROOF_STORAGE_KEY = 'browser.authorization.isolation-proofs.v1';
|
||||
const proofs = new Map<string, BrowserIsolationProof>();
|
||||
let proofsLoaded = false;
|
||||
|
||||
type AuthorizationPageContextCapture = (
|
||||
options: PageContextOptions,
|
||||
target?: BrowserTarget | number,
|
||||
) => Promise<PageContext>;
|
||||
|
||||
let authorizationPageContextCapture: AuthorizationPageContextCapture | undefined;
|
||||
|
||||
export function configureAuthorizationPageContextCapture(
|
||||
capture: AuthorizationPageContextCapture,
|
||||
): void {
|
||||
authorizationPageContextCapture = capture;
|
||||
}
|
||||
|
||||
export interface TabLocalAuthenticationEvidence {
|
||||
origin: string;
|
||||
status: 'authenticated' | 'unauthenticated' | 'unknown';
|
||||
authCookieNames: string[];
|
||||
authLocalStorageKeys: string[];
|
||||
authSessionStorageKeys: string[];
|
||||
fingerprint: string;
|
||||
}
|
||||
|
||||
function appendProofReason(
|
||||
proof: BrowserIsolationProof,
|
||||
reason: string,
|
||||
): BrowserIsolationProof {
|
||||
const reasons = [...proof.reasons];
|
||||
if (!reasons.includes(reason)) reasons.push(reason);
|
||||
return {
|
||||
...proof,
|
||||
reasons: reasons.slice(-16),
|
||||
};
|
||||
}
|
||||
|
||||
export function applyTabLocalAuthenticationEvidence(
|
||||
proof: BrowserIsolationProof,
|
||||
left: TabLocalAuthenticationEvidence,
|
||||
right: TabLocalAuthenticationEvidence,
|
||||
): BrowserIsolationProof {
|
||||
if (!proof.sameOrigin
|
||||
|| proof.cookieStoreRelation !== 'same'
|
||||
|| left.origin !== right.origin) {
|
||||
return proof;
|
||||
}
|
||||
if (left.status === 'unauthenticated' || right.status === 'unauthenticated') {
|
||||
return appendProofReason(proof, '至少一个普通 Tab 明确未登录，不能建立 Tab-local 条件隔离');
|
||||
}
|
||||
if (left.authCookieNames.length || right.authCookieNames.length) {
|
||||
return appendProofReason(proof, '检测到认证 Cookie；普通 Tab 共享 Cookie Store，已拒绝伪造 Tab-local 隔离');
|
||||
}
|
||||
if (left.authLocalStorageKeys.length || right.authLocalStorageKeys.length) {
|
||||
return appendProofReason(proof, '检测到 localStorage 认证材料；普通 Tab 共享站点存储，已拒绝 Tab-local 隔离');
|
||||
}
|
||||
if (!left.authSessionStorageKeys.length || !right.authSessionStorageKeys.length) {
|
||||
return appendProofReason(proof, '没有在两个 Tab 中同时发现独立 sessionStorage 认证材料');
|
||||
}
|
||||
if (!left.fingerprint || !right.fingerprint || left.fingerprint === right.fingerprint) {
|
||||
return appendProofReason(proof, '两个 Tab 的认证快照不能证明不同登录态');
|
||||
}
|
||||
return {
|
||||
...proof,
|
||||
accountEvidenceRelation: 'different',
|
||||
requestCredentialRelation: 'unknown',
|
||||
refreshCheck: 'passed',
|
||||
level: 'conditional',
|
||||
reasons: [
|
||||
...proof.reasons.filter((reason) => !reason.includes('不同 tabId 不代表不同登录态')),
|
||||
'两个普通 Tab 共享 Cookie Store，但认证材料仅存在于各自 sessionStorage',
|
||||
'两个 Tab 的认证快照不同；仍需 A/B 正常请求证明实际发送的认证字段不同',
|
||||
].slice(-16),
|
||||
};
|
||||
}
|
||||
|
||||
function authRelated(name: string): boolean {
|
||||
return /(auth|token|jwt|session|login|csrf|xsrf|sid|credential|bearer)/i.test(name);
|
||||
}
|
||||
|
||||
async function sha256(value: string): Promise<string> {
|
||||
const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
|
||||
return [...new Uint8Array(digest)]
|
||||
.map((byte) => byte.toString(16).padStart(2, '0'))
|
||||
.join('');
|
||||
}
|
||||
|
||||
async function tabLocalAuthenticationEvidence(
|
||||
context: PageContext,
|
||||
): Promise<TabLocalAuthenticationEvidence> {
|
||||
const storage = authenticationStorageEntries(context);
|
||||
return {
|
||||
origin: new URL(context.document.url).origin,
|
||||
status: context.authentication.status,
|
||||
authCookieNames: (context.cookies || [])
|
||||
.filter((cookie) => authRelated(cookie.name))
|
||||
.map((cookie) => cookie.name)
|
||||
.slice(0, 100),
|
||||
authLocalStorageKeys: storage
|
||||
.filter((entry) => entry.area === 'local')
|
||||
.map((entry) => entry.key)
|
||||
.slice(0, 100),
|
||||
authSessionStorageKeys: storage
|
||||
.filter((entry) => entry.area === 'session')
|
||||
.map((entry) => entry.key)
|
||||
.slice(0, 100),
|
||||
fingerprint: await authenticationFingerprint(context, sha256),
|
||||
};
|
||||
}
|
||||
|
||||
async function inspectTabLocalIsolation(
|
||||
proof: BrowserIsolationProof,
|
||||
): Promise<BrowserIsolationProof> {
|
||||
if (proof.level !== 'none'
|
||||
|| proof.cookieStoreRelation !== 'same'
|
||||
|| !proof.sameOrigin) {
|
||||
return proof;
|
||||
}
|
||||
if (!authorizationPageContextCapture) {
|
||||
return appendProofReason(proof, 'Tab-local 认证预检能力尚未初始化');
|
||||
}
|
||||
try {
|
||||
const [leftContext, rightContext] = await Promise.all([
|
||||
authorizationPageContextCapture(
|
||||
{ includeDom: false, includeStorage: true, includeCookies: true },
|
||||
proof.leftTabId,
|
||||
),
|
||||
authorizationPageContextCapture(
|
||||
{ includeDom: false, includeStorage: true, includeCookies: true },
|
||||
proof.rightTabId,
|
||||
),
|
||||
]);
|
||||
const [left, right] = await Promise.all([
|
||||
tabLocalAuthenticationEvidence(leftContext),
|
||||
tabLocalAuthenticationEvidence(rightContext),
|
||||
]);
|
||||
return applyTabLocalAuthenticationEvidence(proof, left, right);
|
||||
} catch (error) {
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
return appendProofReason(
|
||||
proof,
|
||||
`Tab-local 认证预检未通过：${message}`.slice(0, 500),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
function originOf(url: string): string | undefined {
|
||||
try {
|
||||
const parsed = new URL(url);
|
||||
return ['http:', 'https:'].includes(parsed.protocol) ? parsed.origin : undefined;
|
||||
} catch {
|
||||
return undefined;
|
||||
}
|
||||
}
|
||||
|
||||
export function buildIsolationProof(
|
||||
left: ActiveTabInfo,
|
||||
right: ActiveTabInfo,
|
||||
contexts: readonly BrowserIsolationContext[],
|
||||
now = Date.now(),
|
||||
id: string = crypto.randomUUID(),
|
||||
): BrowserIsolationProof {
|
||||
if (left.id === right.id) throw new ExtensionError('isolation_invalid', '双身份槽位不能选择同一个标签页');
|
||||
const leftContext = contexts.find((context) => context.contextId === left.isolationContextId);
|
||||
const rightContext = contexts.find((context) => context.contextId === right.isolationContextId);
|
||||
const leftStore = leftContext?.cookieStoreId;
|
||||
const rightStore = rightContext?.cookieStoreId;
|
||||
const cookieStoreRelation = leftStore && rightStore
|
||||
? leftStore === rightStore ? 'same' : 'different'
|
||||
: 'unknown';
|
||||
const sameOrigin = Boolean(originOf(left.url) && originOf(left.url) === originOf(right.url));
|
||||
const reasons: string[] = [];
|
||||
let level: BrowserIsolationProof['level'] = 'none';
|
||||
if (!leftContext || !rightContext || cookieStoreRelation === 'unknown') {
|
||||
reasons.push('至少一个身份无法解析 Cookie Store，不能证明隔离');
|
||||
} else if (leftContext.contextId === rightContext.contextId || cookieStoreRelation === 'same') {
|
||||
reasons.push('两个标签页共享同一个 Cookie Store；不同 tabId 不代表不同登录态');
|
||||
} else {
|
||||
level = 'strong';
|
||||
reasons.push('两个身份使用不同的浏览器 Cookie Store');
|
||||
if (left.incognito !== right.incognito) reasons.push('普通与无痕浏览上下文已分离');
|
||||
if (leftContext.kind === 'firefox-container' || rightContext.kind === 'firefox-container') {
|
||||
reasons.push('Firefox Container 上下文已分离');
|
||||
}
|
||||
}
|
||||
if (!sameOrigin) reasons.push('两个页面来源不同，后续授权差异计划必须显式确认跨来源语义');
|
||||
return {
|
||||
version: 1,
|
||||
id,
|
||||
leftContextId: leftContext?.contextId || left.isolationContextId || `unresolved:${left.id}`,
|
||||
rightContextId: rightContext?.contextId || right.isolationContextId || `unresolved:${right.id}`,
|
||||
leftTabId: left.id,
|
||||
rightTabId: right.id,
|
||||
sameOrigin,
|
||||
cookieStoreRelation,
|
||||
accountEvidenceRelation: 'unknown',
|
||||
requestCredentialRelation: 'unknown',
|
||||
refreshCheck: level === 'strong' ? 'not-required' : 'failed',
|
||||
level,
|
||||
reasons,
|
||||
createdAt: now,
|
||||
expiresAt: now + PROOF_TTL_MS,
|
||||
};
|
||||
}
|
||||
|
||||
async function incognitoAccess(): Promise<BrowserIsolationInspection['capabilities']['incognitoAccess']> {
|
||||
if (import.meta.env.FIREFOX) return 'unsupported';
|
||||
return await browser.extension.isAllowedIncognitoAccess() ? 'allowed' : 'denied';
|
||||
}
|
||||
|
||||
export async function inspectBrowserIsolation(tabIds?: readonly number[]): Promise<BrowserIsolationInspection> {
|
||||
const requested = tabIds?.length ? new Set(uniqueTabIds(tabIds)) : undefined;
|
||||
const [rawTabs, stores, access, containers] = await Promise.all([
|
||||
requested
|
||||
? Promise.all([...requested].map((tabId) => browser.tabs.get(tabId)))
|
||||
: browser.tabs.query({}),
|
||||
listIsolationCookieStores(),
|
||||
incognitoAccess(),
|
||||
listFirefoxContainerDescriptors(),
|
||||
]);
|
||||
const descriptors = rawTabs.map(browserTabDescriptor).filter((tab): tab is IsolationTabDescriptor => Boolean(tab));
|
||||
if (requested && descriptors.length !== requested.size) {
|
||||
throw new ExtensionError('target_unavailable', '至少一个身份标签页已经关闭或不是 HTTP(S) 页面');
|
||||
}
|
||||
const browserKind: BrowserIsolationInspection['browser'] = import.meta.env.FIREFOX ? 'firefox' : 'chromium';
|
||||
const contextById = new Map<string, BrowserIsolationContext>();
|
||||
const tabs = descriptors.map((tab) => {
|
||||
const context = isolationContextForTab(tab, stores, browserKind, containers);
|
||||
contextById.set(context.contextId, context);
|
||||
return activeTabInfo(tab, context);
|
||||
});
|
||||
return {
|
||||
version: 1,
|
||||
inspectedAt: Date.now(),
|
||||
browser: browserKind,
|
||||
capabilities: {
|
||||
incognitoAccess: access,
|
||||
containerTabs: browserKind === 'firefox' && firefoxContainerManagementAvailable(),
|
||||
managedProfiles: false,
|
||||
},
|
||||
contexts: [...contextById.values()],
|
||||
tabs,
|
||||
};
|
||||
}
|
||||
|
||||
export async function resolveTabCookieStoreId(tabId: number): Promise<string> {
|
||||
return resolveCookieStoreId(tabId);
|
||||
}
|
||||
|
||||
function purgeProofs(now = Date.now(), reserve = 0): boolean {
|
||||
let changed = false;
|
||||
for (const [id, proof] of proofs) {
|
||||
if (proof.expiresAt <= now) {
|
||||
proofs.delete(id);
|
||||
changed = true;
|
||||
}
|
||||
}
|
||||
while (proofs.size > MAX_PROOFS - reserve) {
|
||||
const oldest = proofs.keys().next().value as string | undefined;
|
||||
if (!oldest) break;
|
||||
proofs.delete(oldest);
|
||||
changed = true;
|
||||
}
|
||||
return changed;
|
||||
}
|
||||
|
||||
function validStoredProof(value: unknown): value is BrowserIsolationProof {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
|
||||
const proof = value as Partial<BrowserIsolationProof>;
|
||||
return proof.version === 1
|
||||
&& typeof proof.id === 'string'
|
||||
&& proof.id.length > 0
|
||||
&& proof.id.length <= 160
|
||||
&& typeof proof.leftContextId === 'string'
|
||||
&& proof.leftContextId.length > 0
|
||||
&& proof.leftContextId.length <= 320
|
||||
&& typeof proof.rightContextId === 'string'
|
||||
&& proof.rightContextId.length > 0
|
||||
&& proof.rightContextId.length <= 320
|
||||
&& Number.isSafeInteger(proof.leftTabId)
|
||||
&& Number(proof.leftTabId) > 0
|
||||
&& Number.isSafeInteger(proof.rightTabId)
|
||||
&& Number(proof.rightTabId) > 0
|
||||
&& proof.leftTabId !== proof.rightTabId
|
||||
&& typeof proof.sameOrigin === 'boolean'
|
||||
&& ['different', 'same', 'unknown'].includes(String(proof.cookieStoreRelation))
|
||||
&& ['different', 'same', 'unknown'].includes(String(proof.accountEvidenceRelation))
|
||||
&& ['different', 'same', 'unknown'].includes(String(proof.requestCredentialRelation))
|
||||
&& ['passed', 'failed', 'not-required'].includes(String(proof.refreshCheck))
|
||||
&& ['strong', 'conditional', 'none'].includes(String(proof.level))
|
||||
&& Array.isArray(proof.reasons)
|
||||
&& proof.reasons.length <= 16
|
||||
&& proof.reasons.every((reason) => typeof reason === 'string' && reason.length <= 500)
|
||||
&& typeof proof.createdAt === 'number'
|
||||
&& typeof proof.expiresAt === 'number'
|
||||
&& proof.expiresAt > proof.createdAt
|
||||
&& proof.expiresAt - proof.createdAt <= PROOF_TTL_MS;
|
||||
}
|
||||
|
||||
async function loadProofs(): Promise<void> {
|
||||
if (proofsLoaded) return;
|
||||
proofsLoaded = true;
|
||||
try {
|
||||
const stored = await browser.storage.session.get(PROOF_STORAGE_KEY);
|
||||
const values = stored[PROOF_STORAGE_KEY];
|
||||
if (!Array.isArray(values)) return;
|
||||
for (const value of values.slice(-MAX_PROOFS)) {
|
||||
if (validStoredProof(value)) proofs.set(value.id, value);
|
||||
}
|
||||
purgeProofs();
|
||||
} catch {
|
||||
// Firefox MV2 and tests may not expose storage.session; the bounded in-memory registry remains available.
|
||||
}
|
||||
}
|
||||
|
||||
async function saveProofs(): Promise<void> {
|
||||
try {
|
||||
const retained: BrowserIsolationProof[] = [];
|
||||
for (const proof of [...proofs.values()].reverse()) {
|
||||
const candidate = [proof, ...retained];
|
||||
if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_PROOF_STORAGE_BYTES) break;
|
||||
retained.unshift(proof);
|
||||
}
|
||||
proofs.clear();
|
||||
for (const proof of retained) proofs.set(proof.id, proof);
|
||||
await browser.storage.session.set({
|
||||
[PROOF_STORAGE_KEY]: retained,
|
||||
});
|
||||
} catch {
|
||||
// The in-memory copy remains the fallback when storage.session is unavailable.
|
||||
}
|
||||
}
|
||||
|
||||
export async function createBrowserIsolationProof(leftTabId: number, rightTabId: number): Promise<BrowserIsolationProof> {
|
||||
await loadProofs();
|
||||
const inspection = await inspectBrowserIsolation([leftTabId, rightTabId]);
|
||||
const left = inspection.tabs.find((tab) => tab.id === leftTabId);
|
||||
const right = inspection.tabs.find((tab) => tab.id === rightTabId);
|
||||
if (!left || !right) throw new ExtensionError('target_unavailable', '双身份标签页已经失效');
|
||||
const proof = await inspectTabLocalIsolation(
|
||||
buildIsolationProof(left, right, inspection.contexts),
|
||||
);
|
||||
purgeProofs(proof.createdAt, 1);
|
||||
proofs.set(proof.id, proof);
|
||||
await saveProofs();
|
||||
return proof;
|
||||
}
|
||||
|
||||
export async function getBrowserIsolationProof(id: string): Promise<BrowserIsolationProof> {
|
||||
await loadProofs();
|
||||
if (purgeProofs()) await saveProofs();
|
||||
const proof = proofs.get(id);
|
||||
if (!proof) throw new ExtensionError('isolation_stale', '身份隔离证明不存在或已经过期，请重新执行预检');
|
||||
const inspection = await inspectBrowserIsolation([proof.leftTabId, proof.rightTabId]);
|
||||
const left = inspection.tabs.find((tab) => tab.id === proof.leftTabId);
|
||||
const right = inspection.tabs.find((tab) => tab.id === proof.rightTabId);
|
||||
if (!left || !right) throw new ExtensionError('isolation_stale', '身份页面已经关闭，请重新执行隔离预检');
|
||||
const current = await inspectTabLocalIsolation(
|
||||
buildIsolationProof(left, right, inspection.contexts, proof.createdAt, proof.id),
|
||||
);
|
||||
if (current.leftContextId !== proof.leftContextId
|
||||
|| current.rightContextId !== proof.rightContextId
|
||||
|| current.cookieStoreRelation !== proof.cookieStoreRelation
|
||||
|| current.level !== proof.level) {
|
||||
proofs.delete(id);
|
||||
await saveProofs();
|
||||
throw new ExtensionError('isolation_stale', '身份页面的 Cookie Store 或隔离关系已经变化，请重新执行预检');
|
||||
}
|
||||
return proof;
|
||||
}
|
||||
|
||||
export async function openIncognitoIdentity(url: string): Promise<BrowserIncognitoIdentityResult> {
|
||||
let parsed: URL;
|
||||
try {
|
||||
parsed = new URL(url);
|
||||
} catch {
|
||||
throw new ExtensionError('isolation_invalid', '身份页面 URL 无效');
|
||||
}
|
||||
if (!['http:', 'https:'].includes(parsed.protocol)) {
|
||||
throw new ExtensionError('isolation_invalid', '身份页面只能使用 HTTP(S) URL');
|
||||
}
|
||||
if (import.meta.env.FIREFOX) {
|
||||
throw new ExtensionError('channel_unavailable', 'Firefox 双身份应使用 Container Tab，而不是 Chrome 无痕路径');
|
||||
}
|
||||
if (!await browser.extension.isAllowedIncognitoAccess()) {
|
||||
throw new ExtensionError('incognito_access_denied', '请先在扩展详情中开启“允许在无痕模式下运行”');
|
||||
}
|
||||
const created = await browser.windows.create({ url: parsed.href, incognito: true, focused: true });
|
||||
if (!created) throw new ExtensionError('target_unavailable', '浏览器拒绝创建无痕身份窗口');
|
||||
const createdTabs = created.tabs || (created.id ? await browser.tabs.query({ windowId: created.id }) : []);
|
||||
const tab = createdTabs.find((candidate) => candidate.id && candidate.incognito);
|
||||
if (!tab?.id) throw new ExtensionError('target_unavailable', '无痕窗口已创建，但无法定位身份页面');
|
||||
for (let attempt = 0; attempt < 20; attempt += 1) {
|
||||
const inspection = await inspectBrowserIsolation([tab.id]);
|
||||
const activeTab = inspection.tabs[0];
|
||||
const context = inspection.contexts.find((candidate) => candidate.contextId === activeTab?.isolationContextId);
|
||||
if (activeTab && context?.cookieStoreId) return { tab: activeTab, context };
|
||||
await new Promise((resolve) => globalThis.setTimeout(resolve, 50));
|
||||
}
|
||||
throw new ExtensionError('target_unavailable', '无痕页面尚未获得独立 Cookie Store，请稍后重试');
|
||||
}
|
||||
|
||||
export async function openFirefoxContainerIdentity(input: {
|
||||
url: string;
|
||||
name?: string;
|
||||
}): Promise<BrowserFirefoxContainerIdentityResult> {
|
||||
const created = await createFirefoxContainerIdentity(input);
|
||||
if (!created.tab.id) {
|
||||
await removeFirefoxContainerIdentity(created.container.cookieStoreId).catch(() => undefined);
|
||||
throw new ExtensionError('target_unavailable', 'Container 已创建，但无法定位身份页面');
|
||||
}
|
||||
for (let attempt = 0; attempt < 20; attempt += 1) {
|
||||
const inspection = await inspectBrowserIsolation([created.tab.id]);
|
||||
const tab = inspection.tabs[0];
|
||||
const context = inspection.contexts.find(
|
||||
(candidate) => candidate.contextId === tab?.isolationContextId,
|
||||
);
|
||||
if (tab && context?.cookieStoreId === created.container.cookieStoreId) {
|
||||
return {
|
||||
tab,
|
||||
context,
|
||||
container: {
|
||||
cookieStoreId: created.container.cookieStoreId,
|
||||
name: created.container.name,
|
||||
color: created.container.color,
|
||||
managed: true,
|
||||
},
|
||||
};
|
||||
}
|
||||
await new Promise((resolve) => globalThis.setTimeout(resolve, 50));
|
||||
}
|
||||
await removeFirefoxContainerIdentity(created.container.cookieStoreId).catch(() => undefined);
|
||||
throw new ExtensionError(
|
||||
'target_unavailable',
|
||||
'Container 页面尚未获得独立 Cookie Store，请稍后重试',
|
||||
);
|
||||
}
|
||||
|
||||
export async function deleteFirefoxContainerIdentity(
|
||||
cookieStoreId: string,
|
||||
): Promise<{ cookieStoreId: string; removedTabs: number }> {
|
||||
return removeFirefoxContainerIdentity(cookieStoreId);
|
||||
}
|
||||
|
||||
export async function listFirefoxContainerIdentities(): Promise<BrowserFirefoxManagedContainer[]> {
|
||||
return listManagedFirefoxContainerIdentities();
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
export const AUTHORIZATION_WORKSPACE_TTL_MS = 30 * 60_000;
|
||||
@@ -0,0 +1,404 @@
|
||||
import { beforeEach, describe, expect, it, vi } from 'vitest';
|
||||
import type {
|
||||
BrowserAuthorizationBaseline,
|
||||
BrowserTransformExecution,
|
||||
BrowserTransformProfile,
|
||||
} from '@/types/models';
|
||||
import type { BrowserTransformReplayDraft } from '@/features/browser-transform/replay-draft';
|
||||
import {
|
||||
assertAuthorizationLogicalProtocol,
|
||||
assertAuthorizationLogicalPacketStructure,
|
||||
authorizationTransformOutputDestinations,
|
||||
buildAuthorizationLogicalRequestBinding,
|
||||
replaceAuthorizationLogicalResource,
|
||||
} from './logical-binding';
|
||||
|
||||
const executeBrowserTransform = vi.fn();
|
||||
|
||||
vi.mock('wxt/browser', () => {
|
||||
const event = { addListener: vi.fn() };
|
||||
return {
|
||||
browser: {
|
||||
tabs: { onRemoved: event, onCreated: event },
|
||||
webNavigation: {
|
||||
onBeforeNavigate: event,
|
||||
onCommitted: event,
|
||||
onDOMContentLoaded: event,
|
||||
onCompleted: event,
|
||||
onHistoryStateUpdated: event,
|
||||
onReferenceFragmentUpdated: event,
|
||||
onErrorOccurred: event,
|
||||
},
|
||||
},
|
||||
};
|
||||
});
|
||||
|
||||
vi.mock('@/features/browser-transform/service', () => ({
|
||||
executeBrowserTransform: (...args: unknown[]) => executeBrowserTransform(...args),
|
||||
getBrowserTransformProfile: vi.fn(),
|
||||
}));
|
||||
|
||||
function base64(value: string): string {
|
||||
const bytes = new TextEncoder().encode(value);
|
||||
return btoa(String.fromCharCode(...bytes));
|
||||
}
|
||||
|
||||
function comparisonKey(): string {
|
||||
return btoa(String.fromCharCode(...new Uint8Array(32).fill(23)))
|
||||
.replace(/\+/g, '-')
|
||||
.replace(/\//g, '_')
|
||||
.replace(/=+$/, '');
|
||||
}
|
||||
|
||||
function profile(outputs = ['body.encryptedData', 'header.Content-Type']): BrowserTransformProfile {
|
||||
return {
|
||||
id: 'profile-left',
|
||||
name: '登录请求加密',
|
||||
enabled: true,
|
||||
target: { tabId: 11, frameId: 0, documentId: 'document-left' },
|
||||
isolationContextId: 'browser-profile:store-left',
|
||||
cookieStoreId: 'store-left',
|
||||
origin: 'https://example.test',
|
||||
match: { methods: ['POST'], urlPattern: '*/api/login' },
|
||||
request: {
|
||||
enabled: true,
|
||||
nodes: outputs.map((destination, index) => ({
|
||||
id: `output-${index}`,
|
||||
name: destination,
|
||||
kind: 'output.write' as const,
|
||||
destination,
|
||||
source: { nodeId: 'callable' },
|
||||
encoding: 'text' as const,
|
||||
})),
|
||||
},
|
||||
response: { enabled: false, nodes: [] },
|
||||
failMode: 'closed',
|
||||
maxConcurrency: 1,
|
||||
createdAt: 1,
|
||||
updatedAt: 2,
|
||||
};
|
||||
}
|
||||
|
||||
function baseline(): BrowserAuthorizationBaseline {
|
||||
return {
|
||||
version: 1,
|
||||
id: 'baseline-left',
|
||||
deviceId: 'device-left',
|
||||
installationId: 'installation-left',
|
||||
isolationContextId: 'browser-profile:store-left',
|
||||
cookieStoreId: 'store-left',
|
||||
origin: 'https://example.test',
|
||||
grantId: 'grant-left',
|
||||
target: { tabId: 11, frameId: 0, documentId: 'document-left' },
|
||||
authContextReference: { kind: 'handle', id: 'auth-left' },
|
||||
networkRequestId: 'request-left',
|
||||
request: {
|
||||
method: 'POST',
|
||||
url: 'https://example.test/api/login',
|
||||
path: '/api/login',
|
||||
contentType: 'application/x-www-form-urlencoded',
|
||||
actionFingerprint: `sha256:${'a'.repeat(64)}`,
|
||||
headerNames: ['Host', 'Content-Type', 'Cookie'],
|
||||
fields: [{
|
||||
location: 'body',
|
||||
path: 'body.encryptedData',
|
||||
valueType: 'string',
|
||||
byteLength: 32,
|
||||
valueFingerprint: `workspace-hmac-sha256:${'b'.repeat(64)}`,
|
||||
category: 'unknown',
|
||||
}],
|
||||
},
|
||||
createdAt: 1,
|
||||
expiresAt: Date.now() + 60_000,
|
||||
};
|
||||
}
|
||||
|
||||
function draft(): BrowserTransformReplayDraft {
|
||||
return {
|
||||
version: 1,
|
||||
profileId: 'profile-left',
|
||||
direction: 'request',
|
||||
origin: 'https://example.test',
|
||||
method: 'POST',
|
||||
url: 'https://example.test/api/login',
|
||||
headers: '{"Content-Type":"application/json"}',
|
||||
body: '{"username":"alice","orderId":"order-a"}',
|
||||
updatedAt: 3,
|
||||
};
|
||||
}
|
||||
|
||||
describe('authorization logical plaintext binding', () => {
|
||||
beforeEach(() => {
|
||||
executeBrowserTransform.mockReset();
|
||||
});
|
||||
|
||||
it('rejects a logical replay that changes the observed GraphQL operation', () => {
|
||||
const observed = baseline().request;
|
||||
observed.protocol = 'graphql';
|
||||
observed.operationFingerprint = `sha256:${'1'.repeat(64)}`;
|
||||
observed.operationNames = ['Order'];
|
||||
const logical = {
|
||||
...observed,
|
||||
operationFingerprint: `sha256:${'2'.repeat(64)}`,
|
||||
operationNames: ['CancelOrder'],
|
||||
};
|
||||
|
||||
expect(() => assertAuthorizationLogicalProtocol(observed, logical)).toThrow(
|
||||
'GraphQL operation 与线上基线不一致',
|
||||
);
|
||||
});
|
||||
|
||||
it('allows a logical GraphQL envelope when the encrypted wire baseline has no protocol metadata', () => {
|
||||
const observed = baseline().request;
|
||||
const logical = {
|
||||
...observed,
|
||||
protocol: 'graphql' as const,
|
||||
operationFingerprint: `sha256:${'1'.repeat(64)}`,
|
||||
operationNames: ['Order'],
|
||||
};
|
||||
|
||||
expect(() => assertAuthorizationLogicalProtocol(observed, logical)).not.toThrow();
|
||||
});
|
||||
|
||||
it('binds private plaintext field metadata only after the generated wire shape matches', async () => {
|
||||
executeBrowserTransform.mockResolvedValue({
|
||||
profileId: 'profile-left',
|
||||
direction: 'request',
|
||||
url: 'https://example.test/api/login',
|
||||
bodyBase64: base64('encryptedData=ciphertext'),
|
||||
setHeaders: [{ name: 'Content-Type', value: 'application/x-www-form-urlencoded' }],
|
||||
removeHeaders: [],
|
||||
logicalInput: {},
|
||||
logicalOutput: {},
|
||||
nodeDurations: [],
|
||||
nodeTrace: [],
|
||||
fieldChanges: [],
|
||||
durationMs: 1,
|
||||
} satisfies BrowserTransformExecution);
|
||||
const raw = base64([
|
||||
'POST /api/login HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/x-www-form-urlencoded',
|
||||
'Cookie: session=identity-a',
|
||||
'',
|
||||
'encryptedData=observed-ciphertext',
|
||||
].join('\r\n'));
|
||||
|
||||
const binding = await buildAuthorizationLogicalRequestBinding({
|
||||
baseline: baseline(),
|
||||
rawRequestBase64: raw,
|
||||
profile: profile(),
|
||||
draft: draft(),
|
||||
comparisonKey: comparisonKey(),
|
||||
});
|
||||
|
||||
expect(binding.request.fields).toEqual(expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
location: 'body',
|
||||
path: 'body.orderId',
|
||||
valueType: 'string',
|
||||
category: 'resource',
|
||||
}),
|
||||
]));
|
||||
expect(binding.outputDestinations).toEqual(['body.encryptedData', 'header.content-type']);
|
||||
expect(binding.bindingFingerprint).toMatch(/^sha256:[a-f0-9]{64}$/);
|
||||
expect(JSON.stringify(binding)).not.toContain('order-a');
|
||||
expect(JSON.stringify(binding)).not.toContain('alice');
|
||||
});
|
||||
|
||||
it('keeps a multi-output AES plus RSA envelope tied to one logical business object', async () => {
|
||||
executeBrowserTransform.mockResolvedValue({
|
||||
profileId: 'profile-left',
|
||||
direction: 'request',
|
||||
url: 'https://example.test/api/login',
|
||||
bodyBase64: base64([
|
||||
'encryptedData=aes-ciphertext',
|
||||
'encryptedKey=rsa-wrapped-key',
|
||||
'encryptedIv=rsa-wrapped-iv',
|
||||
].join('&')),
|
||||
setHeaders: [{ name: 'Content-Type', value: 'application/x-www-form-urlencoded' }],
|
||||
removeHeaders: [],
|
||||
logicalInput: {},
|
||||
logicalOutput: {},
|
||||
nodeDurations: [],
|
||||
nodeTrace: [],
|
||||
fieldChanges: [],
|
||||
durationMs: 1,
|
||||
} satisfies BrowserTransformExecution);
|
||||
const raw = base64([
|
||||
'POST /api/login HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/x-www-form-urlencoded',
|
||||
'Cookie: session=identity-a',
|
||||
'',
|
||||
[
|
||||
'encryptedData=observed-aes-ciphertext',
|
||||
'encryptedKey=observed-rsa-key',
|
||||
'encryptedIv=observed-rsa-iv',
|
||||
].join('&'),
|
||||
].join('\r\n'));
|
||||
|
||||
const binding = await buildAuthorizationLogicalRequestBinding({
|
||||
baseline: baseline(),
|
||||
rawRequestBase64: raw,
|
||||
profile: profile([
|
||||
'body.encryptedData',
|
||||
'body.encryptedKey',
|
||||
'body.encryptedIv',
|
||||
'header.Content-Type',
|
||||
]),
|
||||
draft: draft(),
|
||||
comparisonKey: comparisonKey(),
|
||||
});
|
||||
|
||||
expect(binding.outputDestinations).toEqual([
|
||||
'body.encryptedData',
|
||||
'body.encryptedIv',
|
||||
'body.encryptedKey',
|
||||
'header.content-type',
|
||||
]);
|
||||
expect(binding.request.fields).toEqual(expect.arrayContaining([
|
||||
expect.objectContaining({ path: 'body.orderId', category: 'resource' }),
|
||||
expect.objectContaining({ path: 'body.username' }),
|
||||
]));
|
||||
expect(binding.validation.proofLevel).toBe('structure');
|
||||
});
|
||||
|
||||
it('rejects a gateway whose generated serialization does not match the captured request', async () => {
|
||||
executeBrowserTransform.mockResolvedValue({
|
||||
profileId: 'profile-left',
|
||||
direction: 'request',
|
||||
url: 'https://example.test/api/login',
|
||||
bodyBase64: base64('{"encryptedData":"ciphertext"}'),
|
||||
setHeaders: [{ name: 'Content-Type', value: 'application/json' }],
|
||||
removeHeaders: [],
|
||||
logicalInput: {},
|
||||
logicalOutput: {},
|
||||
nodeDurations: [],
|
||||
nodeTrace: [],
|
||||
fieldChanges: [],
|
||||
durationMs: 1,
|
||||
} satisfies BrowserTransformExecution);
|
||||
const raw = base64([
|
||||
'POST /api/login HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/x-www-form-urlencoded',
|
||||
'',
|
||||
'encryptedData=observed-ciphertext',
|
||||
].join('\r\n'));
|
||||
|
||||
await expect(buildAuthorizationLogicalRequestBinding({
|
||||
baseline: baseline(),
|
||||
rawRequestBase64: raw,
|
||||
profile: profile(),
|
||||
draft: draft(),
|
||||
comparisonKey: comparisonKey(),
|
||||
})).rejects.toThrow('结构不一致');
|
||||
});
|
||||
|
||||
it('rejects compressed request bodies because their logical structure cannot be proven', async () => {
|
||||
executeBrowserTransform.mockResolvedValue({
|
||||
profileId: 'profile-left',
|
||||
direction: 'request',
|
||||
url: 'https://example.test/api/login',
|
||||
bodyBase64: base64('encryptedData=ciphertext'),
|
||||
setHeaders: [{ name: 'Content-Type', value: 'application/x-www-form-urlencoded' }],
|
||||
removeHeaders: [],
|
||||
logicalInput: {},
|
||||
logicalOutput: {},
|
||||
nodeDurations: [],
|
||||
nodeTrace: [],
|
||||
fieldChanges: [],
|
||||
durationMs: 1,
|
||||
} satisfies BrowserTransformExecution);
|
||||
const raw = base64([
|
||||
'POST /api/login HTTP/1.1',
|
||||
'Host: example.test',
|
||||
'Content-Type: application/x-www-form-urlencoded',
|
||||
'Content-Encoding: gzip',
|
||||
'',
|
||||
'encryptedData=observed-ciphertext',
|
||||
].join('\r\n'));
|
||||
|
||||
await expect(buildAuthorizationLogicalRequestBinding({
|
||||
baseline: baseline(),
|
||||
rawRequestBase64: raw,
|
||||
profile: profile(),
|
||||
draft: draft(),
|
||||
comparisonKey: comparisonKey(),
|
||||
})).rejects.toThrow('压缩或编码后的请求 Body');
|
||||
});
|
||||
|
||||
it('rejects a conditionally changed output envelope during later matrix compilation', () => {
|
||||
const observed = {
|
||||
method: 'POST',
|
||||
url: 'https://example.test/api/login',
|
||||
headers: [{ name: 'Content-Type', value: 'application/x-www-form-urlencoded' }],
|
||||
bodyBase64: base64('encryptedData=observed-ciphertext'),
|
||||
};
|
||||
const generated = {
|
||||
...observed,
|
||||
bodyBase64: base64('encryptedData=generated-ciphertext&unexpected=side-channel'),
|
||||
};
|
||||
|
||||
expect(() => assertAuthorizationLogicalPacketStructure(
|
||||
generated,
|
||||
observed,
|
||||
)).toThrow('Body 字段与类型结构');
|
||||
});
|
||||
|
||||
it('replaces one explicit JSON plaintext field without touching its siblings', () => {
|
||||
const packet = {
|
||||
method: 'POST',
|
||||
url: 'https://example.test/api/orders',
|
||||
headers: [{ name: 'Content-Type', value: 'application/json' }],
|
||||
bodyBase64: base64('{"orderId":"order-a","note":"keep"}'),
|
||||
};
|
||||
const replaced = replaceAuthorizationLogicalResource({
|
||||
packet,
|
||||
selector: { source: 'logical', location: 'body', path: 'body.orderId' },
|
||||
replacement: 'order-b',
|
||||
});
|
||||
|
||||
expect(JSON.parse(new TextDecoder().decode(
|
||||
Uint8Array.from(atob(replaced.bodyBase64), (character) => character.charCodeAt(0)),
|
||||
))).toEqual({ orderId: 'order-b', note: 'keep' });
|
||||
});
|
||||
|
||||
it('preserves the primitive type of a numeric logical resource', () => {
|
||||
const packet = {
|
||||
method: 'POST',
|
||||
url: 'https://example.test/graphql',
|
||||
headers: [{ name: 'Content-Type', value: 'application/json' }],
|
||||
bodyBase64: base64('{"variables":{"orderId":42},"query":"query Order { order { id } }"}'),
|
||||
};
|
||||
const replaced = replaceAuthorizationLogicalResource({
|
||||
packet,
|
||||
selector: {
|
||||
source: 'logical',
|
||||
location: 'body',
|
||||
path: 'body.variables.orderId',
|
||||
},
|
||||
replacement: 84,
|
||||
});
|
||||
|
||||
expect(JSON.parse(new TextDecoder().decode(
|
||||
Uint8Array.from(atob(replaced.bodyBase64), (character) => character.charCodeAt(0)),
|
||||
)).variables.orderId).toBe(84);
|
||||
expect(() => replaceAuthorizationLogicalResource({
|
||||
packet,
|
||||
selector: {
|
||||
source: 'logical',
|
||||
location: 'body',
|
||||
path: 'body.variables.orderId',
|
||||
},
|
||||
replacement: '84',
|
||||
})).toThrow('不能改变字段类型');
|
||||
});
|
||||
|
||||
it('refuses profiles that attempt to synthesize authentication headers', () => {
|
||||
expect(() => authorizationTransformOutputDestinations(
|
||||
profile(['header.Authorization']),
|
||||
)).toThrow('认证 Header');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,621 @@
|
||||
import type {
|
||||
BrowserAuthorizationBaseline,
|
||||
BrowserAuthorizationLogicalRequestBinding,
|
||||
BrowserAuthorizationResourceSelector,
|
||||
BrowserAuthorizationResourceValue,
|
||||
BrowserTransformExecution,
|
||||
BrowserTransformPacket,
|
||||
BrowserTransformProfile,
|
||||
} from '@/types/models';
|
||||
import {
|
||||
applyTransformExecution,
|
||||
compareBrowserPackets,
|
||||
} from '@/features/browser-analysis/service';
|
||||
import {
|
||||
browserTransformReplayDraftToPacket,
|
||||
getBrowserTransformReplayDraft,
|
||||
type BrowserTransformReplayDraft,
|
||||
} from '@/features/browser-transform/replay-draft';
|
||||
import {
|
||||
executeBrowserTransform,
|
||||
getBrowserTransformProfile,
|
||||
} from '@/features/browser-transform/service';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import {
|
||||
fingerprintAuthorizationComparisonValue,
|
||||
parseAuthorizationBaselineRequest,
|
||||
} from './baseline-metadata';
|
||||
import {
|
||||
authorizationRequestToTransformPacket,
|
||||
} from './baseline-execution';
|
||||
import {
|
||||
readStructuredAuthorizationBodyValue,
|
||||
replaceStructuredAuthorizationBodyValue,
|
||||
type StructuredAuthorizationPrimitive,
|
||||
} from './structured-body';
|
||||
|
||||
const MAX_LOGICAL_RESOURCE_BYTES = 8 * 1_024;
|
||||
const MAX_TRANSFORM_BODY_BYTES = 2 * 1_024 * 1_024;
|
||||
const FORBIDDEN_OUTPUT_HEADERS = new Set([
|
||||
'authorization',
|
||||
'cookie',
|
||||
'host',
|
||||
'proxy-authorization',
|
||||
]);
|
||||
|
||||
function bytesToBase64(bytes: Uint8Array): string {
|
||||
let binary = '';
|
||||
const chunkSize = 0x8000;
|
||||
for (let offset = 0; offset < bytes.length; offset += chunkSize) {
|
||||
binary += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
|
||||
}
|
||||
return btoa(binary);
|
||||
}
|
||||
|
||||
function base64ToBytes(value: string): Uint8Array {
|
||||
let binary: string;
|
||||
try {
|
||||
binary = atob(value);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_value_invalid', '逻辑请求 Body 不是有效的 Base64');
|
||||
}
|
||||
return Uint8Array.from(binary, (character) => character.charCodeAt(0));
|
||||
}
|
||||
|
||||
async function sha256(value: string | Uint8Array): Promise<string> {
|
||||
const bytes = typeof value === 'string' ? new TextEncoder().encode(value) : value;
|
||||
const digest = await crypto.subtle.digest('SHA-256', Uint8Array.from(bytes).buffer);
|
||||
return `sha256:${[...new Uint8Array(digest)]
|
||||
.map((byte) => byte.toString(16).padStart(2, '0'))
|
||||
.join('')}`;
|
||||
}
|
||||
|
||||
function normalizedDestination(destination: string): string {
|
||||
const trimmed = destination.trim();
|
||||
if (trimmed.toLowerCase().startsWith('header.')) {
|
||||
return `header.${trimmed.slice(7).trim().toLowerCase()}`;
|
||||
}
|
||||
return trimmed;
|
||||
}
|
||||
|
||||
export function authorizationTransformOutputDestinations(
|
||||
profile: BrowserTransformProfile,
|
||||
): string[] {
|
||||
if (!profile.enabled || !profile.request.enabled) {
|
||||
throw new ExtensionError('authorization_transform_unavailable', '所选明文网关未启用请求转换');
|
||||
}
|
||||
if (profile.recovery && profile.recovery.state !== 'ready') {
|
||||
throw new ExtensionError('authorization_transform_stale', '所选明文网关正在等待文档恢复或重新验证');
|
||||
}
|
||||
const destinations = [...new Set(profile.request.nodes.flatMap((node) => {
|
||||
if (node.kind !== 'output.write') return [];
|
||||
const destination = normalizedDestination(node.destination);
|
||||
if (destination.toLowerCase().startsWith('header.')) {
|
||||
const name = destination.slice(7).toLowerCase();
|
||||
if (FORBIDDEN_OUTPUT_HEADERS.has(name)) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_invalid',
|
||||
`授权明文网关不能生成或覆盖认证 Header: ${name}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
return [destination];
|
||||
}))].sort();
|
||||
if (!destinations.length || destinations.length > 32) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_invalid',
|
||||
'授权明文网关必须声明 1 到 32 个确定性请求输出',
|
||||
);
|
||||
}
|
||||
return destinations;
|
||||
}
|
||||
|
||||
export function authorizationTransformPacketToRawRequest(
|
||||
packet: BrowserTransformPacket,
|
||||
): string {
|
||||
const method = packet.method?.trim().toUpperCase() || '';
|
||||
if (!/^[A-Z]{1,16}$/.test(method)) {
|
||||
throw new ExtensionError('authorization_logical_invalid', '逻辑请求缺少有效的 HTTP 方法');
|
||||
}
|
||||
let url: URL;
|
||||
try {
|
||||
url = new URL(packet.url);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_logical_invalid', '逻辑请求 URL 无效');
|
||||
}
|
||||
if (!['http:', 'https:'].includes(url.protocol) || url.hash) {
|
||||
throw new ExtensionError('authorization_logical_invalid', '逻辑请求必须使用无 fragment 的 HTTP(S) URL');
|
||||
}
|
||||
const headers = packet.headers.filter((header) => header.name.toLowerCase() !== 'host');
|
||||
for (const header of headers) {
|
||||
if (
|
||||
!header.name
|
||||
|| !/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(header.name)
|
||||
|| /[\r\n]/.test(header.value)
|
||||
) {
|
||||
throw new ExtensionError('authorization_logical_invalid', `逻辑请求包含无效 Header: ${header.name}`);
|
||||
}
|
||||
}
|
||||
const body = base64ToBytes(packet.bodyBase64);
|
||||
if (body.byteLength > MAX_TRANSFORM_BODY_BYTES) {
|
||||
throw new ExtensionError('authorization_logical_invalid', '逻辑请求 Body 超过 2 MiB 上限');
|
||||
}
|
||||
const head = new TextEncoder().encode([
|
||||
`${method} ${url.pathname || '/'}${url.search} HTTP/1.1`,
|
||||
`Host: ${url.host}`,
|
||||
...headers.map((header) => `${header.name}: ${header.value}`),
|
||||
'',
|
||||
'',
|
||||
].join('\r\n'));
|
||||
const raw = new Uint8Array(head.byteLength + body.byteLength);
|
||||
raw.set(head);
|
||||
raw.set(body, head.byteLength);
|
||||
return bytesToBase64(raw);
|
||||
}
|
||||
|
||||
function sameTarget(
|
||||
baseline: BrowserAuthorizationBaseline,
|
||||
profile: BrowserTransformProfile,
|
||||
): boolean {
|
||||
return profile.target.tabId === baseline.target.tabId
|
||||
&& profile.target.frameId === baseline.target.frameId
|
||||
&& profile.target.documentId === baseline.target.documentId
|
||||
&& profile.origin === baseline.origin
|
||||
&& profile.isolationContextId === baseline.isolationContextId
|
||||
&& profile.cookieStoreId === baseline.cookieStoreId;
|
||||
}
|
||||
|
||||
function assertLogicalProfileIdentity(
|
||||
baseline: BrowserAuthorizationBaseline,
|
||||
profile: BrowserTransformProfile,
|
||||
): void {
|
||||
if (!sameTarget(baseline, profile)) {
|
||||
throw new ExtensionError(
|
||||
'authorization_transform_target_mismatch',
|
||||
'逻辑明文必须使用授权基线所属同一身份、Frame 与页面文档的明文网关',
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
function assertGeneratedRoute(
|
||||
baseline: BrowserAuthorizationBaseline,
|
||||
execution: BrowserTransformExecution,
|
||||
): void {
|
||||
let generated: URL;
|
||||
try {
|
||||
generated = new URL(execution.url);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_transform_invalid', '明文网关生成了无效 URL');
|
||||
}
|
||||
// The structural packet comparison below performs the exact route check.
|
||||
// This early guard blocks obvious origin/fragment escapes before comparison.
|
||||
if (generated.origin !== baseline.origin || generated.hash) {
|
||||
throw new ExtensionError('authorization_origin_changed', '明文网关不能改变授权请求来源或 fragment');
|
||||
}
|
||||
}
|
||||
|
||||
function assertIdentityContentEncoding(
|
||||
packet: BrowserTransformPacket,
|
||||
label: string,
|
||||
): void {
|
||||
const encodings = packet.headers
|
||||
.filter((header) => header.name.toLowerCase() === 'content-encoding')
|
||||
.flatMap((header) => header.value.split(','))
|
||||
.map((encoding) => encoding.trim().toLowerCase())
|
||||
.filter(Boolean);
|
||||
if (encodings.some((encoding) => encoding !== 'identity')) {
|
||||
throw new ExtensionError(
|
||||
'authorization_content_encoding_unsupported',
|
||||
`${label}使用了压缩或编码后的请求 Body，当前不能建立可验证的逻辑明文绑定`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
export function assertAuthorizationLogicalPacketStructure(
|
||||
generated: BrowserTransformPacket,
|
||||
observed: BrowserTransformPacket,
|
||||
): { summary: string; warnings: string[] } {
|
||||
assertIdentityContentEncoding(generated, '明文网关生成报文');
|
||||
assertIdentityContentEncoding(observed, '线上基线');
|
||||
const comparison = compareBrowserPackets(generated, observed, 'structure');
|
||||
if (!comparison.equivalent) {
|
||||
const failures = comparison.checks
|
||||
.filter((check) => check.status === 'fail')
|
||||
.map((check) => check.label.replace(/一致$/, ''))
|
||||
.join('、');
|
||||
throw new ExtensionError(
|
||||
'authorization_logical_mismatch',
|
||||
`明文网关生成报文与线上基线结构不一致：${failures || comparison.summary}`,
|
||||
);
|
||||
}
|
||||
return {
|
||||
summary: comparison.summary,
|
||||
warnings: comparison.checks
|
||||
.filter((check) => check.status === 'warning')
|
||||
.map((check) => check.label),
|
||||
};
|
||||
}
|
||||
|
||||
export function assertAuthorizationLogicalProtocol(
|
||||
observed: BrowserAuthorizationBaseline['request'],
|
||||
logical: BrowserAuthorizationBaseline['request'],
|
||||
): void {
|
||||
if (
|
||||
observed.protocol
|
||||
&& (
|
||||
logical.protocol !== observed.protocol
|
||||
|| logical.operationFingerprint !== observed.operationFingerprint
|
||||
)
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_logical_mismatch',
|
||||
'明文网关回放的 GraphQL operation 与线上基线不一致',
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
export async function buildAuthorizationLogicalRequestBinding(input: {
|
||||
baseline: BrowserAuthorizationBaseline;
|
||||
rawRequestBase64: string;
|
||||
profile: BrowserTransformProfile;
|
||||
draft: BrowserTransformReplayDraft;
|
||||
comparisonKey: string;
|
||||
}): Promise<BrowserAuthorizationLogicalRequestBinding> {
|
||||
assertLogicalProfileIdentity(input.baseline, input.profile);
|
||||
if (
|
||||
input.draft.profileId !== input.profile.id
|
||||
|| input.draft.direction !== 'request'
|
||||
|| input.draft.origin !== input.baseline.origin
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_logical_invalid',
|
||||
'所选明文网关没有与当前身份来源匹配的本机请求回放草稿',
|
||||
);
|
||||
}
|
||||
const logicalPacket = browserTransformReplayDraftToPacket(input.draft);
|
||||
const execution = await executeBrowserTransform({
|
||||
profileId: input.profile.id,
|
||||
direction: 'request',
|
||||
packet: logicalPacket,
|
||||
});
|
||||
assertGeneratedRoute(input.baseline, execution);
|
||||
const generated = applyTransformExecution(logicalPacket, execution);
|
||||
const observed = authorizationRequestToTransformPacket(
|
||||
input.rawRequestBase64,
|
||||
input.baseline.origin,
|
||||
);
|
||||
const validation = assertAuthorizationLogicalPacketStructure(generated, observed);
|
||||
const request = await parseAuthorizationBaselineRequest(
|
||||
authorizationTransformPacketToRawRequest(logicalPacket),
|
||||
logicalPacket.url,
|
||||
input.comparisonKey,
|
||||
);
|
||||
assertAuthorizationLogicalProtocol(input.baseline.request, request);
|
||||
const outputDestinations = authorizationTransformOutputDestinations(input.profile);
|
||||
const createdAt = Date.now();
|
||||
const bindingFingerprint = await sha256(JSON.stringify({
|
||||
version: 1,
|
||||
baselineId: input.baseline.id,
|
||||
profileId: input.profile.id,
|
||||
profileUpdatedAt: input.profile.updatedAt,
|
||||
replayUpdatedAt: input.draft.updatedAt,
|
||||
isolationContextId: input.baseline.isolationContextId,
|
||||
cookieStoreId: input.baseline.cookieStoreId,
|
||||
documentId: input.baseline.target.documentId,
|
||||
actionFingerprint: request.actionFingerprint,
|
||||
fields: request.fields.map((field) => ({
|
||||
location: field.location,
|
||||
path: field.path,
|
||||
valueType: field.valueType,
|
||||
valueFingerprint: field.valueFingerprint,
|
||||
})),
|
||||
outputDestinations,
|
||||
warnings: validation.warnings,
|
||||
}));
|
||||
return {
|
||||
version: 1,
|
||||
source: 'local-replay-draft',
|
||||
baselineId: input.baseline.id,
|
||||
profileId: input.profile.id,
|
||||
profileName: input.profile.name,
|
||||
isolationContextId: input.baseline.isolationContextId,
|
||||
cookieStoreId: input.baseline.cookieStoreId,
|
||||
target: input.baseline.target,
|
||||
origin: input.baseline.origin,
|
||||
request,
|
||||
outputDestinations,
|
||||
validation: {
|
||||
proofLevel: 'structure',
|
||||
summary: validation.summary,
|
||||
warnings: validation.warnings,
|
||||
},
|
||||
bindingFingerprint,
|
||||
profileUpdatedAt: input.profile.updatedAt,
|
||||
replayUpdatedAt: input.draft.updatedAt,
|
||||
createdAt,
|
||||
expiresAt: input.baseline.expiresAt,
|
||||
};
|
||||
}
|
||||
|
||||
export async function loadAuthorizationLogicalRequestBinding(input: {
|
||||
baseline: BrowserAuthorizationBaseline;
|
||||
profileId?: string;
|
||||
}): Promise<{
|
||||
binding: BrowserAuthorizationLogicalRequestBinding;
|
||||
profile: BrowserTransformProfile;
|
||||
draft: BrowserTransformReplayDraft;
|
||||
}> {
|
||||
const binding = input.baseline.logicalRequest;
|
||||
if (!binding || (input.profileId && binding.profileId !== input.profileId)) {
|
||||
throw new ExtensionError('authorization_logical_missing', '授权基线尚未绑定逻辑明文请求');
|
||||
}
|
||||
const profile = await getBrowserTransformProfile(binding.profileId);
|
||||
assertLogicalProfileIdentity(input.baseline, profile);
|
||||
const draft = await getBrowserTransformReplayDraft(profile.id, 'request', input.baseline.origin);
|
||||
if (
|
||||
!draft
|
||||
|| profile.updatedAt !== binding.profileUpdatedAt
|
||||
|| draft.updatedAt !== binding.replayUpdatedAt
|
||||
|| binding.baselineId !== input.baseline.id
|
||||
|| binding.bindingFingerprint.length !== 71
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_logical_changed',
|
||||
'明文网关或本机回放草稿已变化，请重新绑定逻辑明文',
|
||||
);
|
||||
}
|
||||
return { binding, profile, draft };
|
||||
}
|
||||
|
||||
function indexedName(path: string, prefix: 'header' | 'query' | 'body'): {
|
||||
name: string;
|
||||
index?: number;
|
||||
} {
|
||||
if (!path.startsWith(`${prefix}.`)) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑资源字段路径与位置不匹配');
|
||||
}
|
||||
const raw = path.slice(prefix.length + 1);
|
||||
const matched = raw.match(/^(.*)\[(\d+)]$/);
|
||||
const name = matched ? matched[1] : raw;
|
||||
const index = matched ? Number(matched[2]) : undefined;
|
||||
if (!name || (index !== undefined && !Number.isSafeInteger(index))) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑资源字段路径无效');
|
||||
}
|
||||
return { name, index };
|
||||
}
|
||||
|
||||
function selectedOccurrence(
|
||||
entries: Array<[string, string]>,
|
||||
name: string,
|
||||
index?: number,
|
||||
): { entryIndex: number; value: string } {
|
||||
const matches = entries.flatMap(([key, value], entryIndex) => (
|
||||
key === name ? [{ entryIndex, value }] : []
|
||||
));
|
||||
if (index === undefined && matches.length !== 1) {
|
||||
throw new ExtensionError('authorization_selector_ambiguous', '逻辑资源字段存在多个同名值，必须选择带序号的字段');
|
||||
}
|
||||
const selected = matches[index ?? 0];
|
||||
if (!selected) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑资源字段不存在');
|
||||
}
|
||||
return selected;
|
||||
}
|
||||
|
||||
function logicalResourceText(
|
||||
packet: BrowserTransformPacket,
|
||||
selector: BrowserAuthorizationResourceSelector,
|
||||
): string {
|
||||
if (selector.source !== 'logical') {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑资源读取器只接受 logical 选择器');
|
||||
}
|
||||
if (selector.location === 'body') {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'逻辑 Body 资源必须通过结构化读取器读取',
|
||||
);
|
||||
}
|
||||
if (selector.location === 'query') {
|
||||
const selected = indexedName(selector.path, 'query');
|
||||
return selectedOccurrence(
|
||||
[...new URL(packet.url).searchParams],
|
||||
selected.name,
|
||||
selected.index,
|
||||
).value;
|
||||
}
|
||||
if (selector.location === 'header') {
|
||||
const selected = indexedName(selector.path, 'header');
|
||||
return selectedOccurrence(
|
||||
packet.headers.map((header) => [header.name.toLowerCase(), header.value]),
|
||||
selected.name.toLowerCase(),
|
||||
selected.index,
|
||||
).value;
|
||||
}
|
||||
const matched = selector.path.match(/^path\.segment\[(\d+)]$/);
|
||||
const index = matched ? Number(matched[1]) : -1;
|
||||
const segment = new URL(packet.url).pathname.split('/').filter(Boolean)[index];
|
||||
if (segment === undefined) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑路径资源字段不存在');
|
||||
}
|
||||
try {
|
||||
return decodeURIComponent(segment);
|
||||
} catch {
|
||||
return segment;
|
||||
}
|
||||
}
|
||||
|
||||
export async function readAuthorizationLogicalResource(input: {
|
||||
baseline: BrowserAuthorizationBaseline;
|
||||
selector: BrowserAuthorizationResourceSelector;
|
||||
}): Promise<BrowserAuthorizationResourceValue> {
|
||||
const { binding, draft } = await loadAuthorizationLogicalRequestBinding({
|
||||
baseline: input.baseline,
|
||||
});
|
||||
const packet = browserTransformReplayDraftToPacket(draft);
|
||||
const value = (() => {
|
||||
if (input.selector.location === 'body') {
|
||||
return readStructuredAuthorizationBodyValue(packet, input.selector.path);
|
||||
}
|
||||
const text = logicalResourceText(packet, input.selector);
|
||||
return { value: text, valueType: 'string' as const, text };
|
||||
})();
|
||||
const bytes = new TextEncoder().encode(value.text);
|
||||
if (bytes.byteLength > MAX_LOGICAL_RESOURCE_BYTES) {
|
||||
throw new ExtensionError('authorization_value_too_large', '逻辑授权资源值超过 8 KiB 上限');
|
||||
}
|
||||
const field = binding.request.fields.filter((candidate) => (
|
||||
candidate.location === input.selector.location
|
||||
&& candidate.path === input.selector.path
|
||||
));
|
||||
if (
|
||||
field.length !== 1
|
||||
|| !['string', 'number', 'boolean'].includes(field[0].valueType)
|
||||
|| field[0].valueType !== value.valueType
|
||||
) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑资源字段不属于当前明文绑定');
|
||||
}
|
||||
return {
|
||||
version: 1,
|
||||
baselineId: input.baseline.id,
|
||||
source: 'logical',
|
||||
location: input.selector.location,
|
||||
path: input.selector.path,
|
||||
valueType: value.valueType,
|
||||
byteLength: bytes.byteLength,
|
||||
valueBase64: bytesToBase64(bytes),
|
||||
valueFingerprint: field[0].valueFingerprint,
|
||||
logicalBindingFingerprint: binding.bindingFingerprint,
|
||||
};
|
||||
}
|
||||
|
||||
export function replaceAuthorizationLogicalResource(input: {
|
||||
packet: BrowserTransformPacket;
|
||||
selector: BrowserAuthorizationResourceSelector;
|
||||
replacement: StructuredAuthorizationPrimitive;
|
||||
}): BrowserTransformPacket {
|
||||
const { packet, selector, replacement } = input;
|
||||
if (selector.source !== 'logical') {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑资源替换器只接受 logical 选择器');
|
||||
}
|
||||
if (selector.location === 'body') {
|
||||
return replaceStructuredAuthorizationBodyValue({
|
||||
packet,
|
||||
path: selector.path,
|
||||
replacement,
|
||||
});
|
||||
}
|
||||
if (selector.location === 'query') {
|
||||
if (typeof replacement !== 'string') {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑 Query 资源替换只接受字符串');
|
||||
}
|
||||
const selected = indexedName(selector.path, 'query');
|
||||
const url = new URL(packet.url);
|
||||
const entries = [...url.searchParams];
|
||||
const occurrence = selectedOccurrence(entries, selected.name, selected.index);
|
||||
entries[occurrence.entryIndex][1] = replacement;
|
||||
url.search = '';
|
||||
entries.forEach(([name, value]) => url.searchParams.append(name, value));
|
||||
return { ...packet, url: url.toString() };
|
||||
}
|
||||
if (selector.location === 'header') {
|
||||
if (typeof replacement !== 'string') {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑 Header 资源替换只接受字符串');
|
||||
}
|
||||
const selected = indexedName(selector.path, 'header');
|
||||
const matching = packet.headers.flatMap((header, index) => (
|
||||
header.name.toLowerCase() === selected.name.toLowerCase() ? [index] : []
|
||||
));
|
||||
if (selected.index === undefined && matching.length !== 1) {
|
||||
throw new ExtensionError('authorization_selector_ambiguous', '逻辑 Header 存在多个同名值');
|
||||
}
|
||||
const headerIndex = matching[selected.index ?? 0];
|
||||
if (headerIndex === undefined) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑 Header 资源字段不存在');
|
||||
}
|
||||
const headers = packet.headers.slice();
|
||||
headers[headerIndex] = { ...headers[headerIndex], value: replacement };
|
||||
return { ...packet, headers };
|
||||
}
|
||||
const matched = selector.path.match(/^path\.segment\[(\d+)]$/);
|
||||
if (typeof replacement !== 'string') {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑 Path 资源替换只接受字符串');
|
||||
}
|
||||
const index = matched ? Number(matched[1]) : -1;
|
||||
const url = new URL(packet.url);
|
||||
let current = -1;
|
||||
const segments = url.pathname.split('/').map((segment) => {
|
||||
if (!segment) return segment;
|
||||
current += 1;
|
||||
return current === index ? encodeURIComponent(replacement) : segment;
|
||||
});
|
||||
if (current < index || index < 0) {
|
||||
throw new ExtensionError('authorization_selector_invalid', '逻辑路径资源字段不存在');
|
||||
}
|
||||
url.pathname = segments.join('/');
|
||||
return { ...packet, url: url.toString() };
|
||||
}
|
||||
|
||||
export async function decodeAndVerifyLogicalReplacement(input: {
|
||||
replacement: BrowserAuthorizationResourceValue;
|
||||
selector: BrowserAuthorizationResourceSelector;
|
||||
comparisonKey: string;
|
||||
}): Promise<StructuredAuthorizationPrimitive> {
|
||||
if (
|
||||
input.replacement.source !== 'logical'
|
||||
|| input.replacement.location !== input.selector.location
|
||||
|| input.replacement.path !== input.selector.path
|
||||
|| !['string', 'number', 'boolean'].includes(input.replacement.valueType)
|
||||
) {
|
||||
throw new ExtensionError('authorization_value_invalid', '逻辑授权资源值与选择器不匹配');
|
||||
}
|
||||
const bytes = base64ToBytes(input.replacement.valueBase64);
|
||||
if (
|
||||
bytes.byteLength !== input.replacement.byteLength
|
||||
|| bytes.byteLength > MAX_LOGICAL_RESOURCE_BYTES
|
||||
) {
|
||||
throw new ExtensionError('authorization_value_invalid', '逻辑授权资源值长度无效');
|
||||
}
|
||||
let text: string;
|
||||
try {
|
||||
text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
|
||||
} catch {
|
||||
throw new ExtensionError('authorization_value_invalid', '逻辑授权资源值不是有效的 UTF-8');
|
||||
}
|
||||
let value: StructuredAuthorizationPrimitive;
|
||||
if (input.replacement.valueType === 'string') {
|
||||
value = text;
|
||||
} else if (input.replacement.valueType === 'number') {
|
||||
try {
|
||||
const parsed: unknown = JSON.parse(text);
|
||||
if (
|
||||
typeof parsed !== 'number'
|
||||
|| !Number.isFinite(parsed)
|
||||
|| JSON.stringify(parsed) !== text
|
||||
) {
|
||||
throw new Error('not canonical');
|
||||
}
|
||||
value = parsed;
|
||||
} catch {
|
||||
throw new ExtensionError(
|
||||
'authorization_value_invalid',
|
||||
'逻辑授权数字资源值不是规范 JSON 数字',
|
||||
);
|
||||
}
|
||||
} else if (text === 'true' || text === 'false') {
|
||||
value = text === 'true';
|
||||
} else {
|
||||
throw new ExtensionError(
|
||||
'authorization_value_invalid',
|
||||
'逻辑授权布尔资源值必须是 true 或 false',
|
||||
);
|
||||
}
|
||||
const fingerprint = await fingerprintAuthorizationComparisonValue(input.comparisonKey, text);
|
||||
if (fingerprint !== input.replacement.valueFingerprint) {
|
||||
throw new ExtensionError('authorization_value_invalid', '逻辑授权资源值指纹校验失败');
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
export async function authorizationPacketFingerprint(rawRequestBase64: string): Promise<string> {
|
||||
return sha256(base64ToBytes(rawRequestBase64));
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import { normalizeBrowserAuthorizationTaskResult } from './protocol';
|
||||
|
||||
function context(side: 'left' | 'right') {
|
||||
return {
|
||||
side,
|
||||
target: {tabId: side === 'left' ? 1 : 2, frameId: 0, documentId: `document-${side}`},
|
||||
authentication: {
|
||||
status: 'authenticated',
|
||||
cookieCount: 1,
|
||||
storageEntryCount: 0,
|
||||
authCookieNames: null,
|
||||
authStorageKeys: null,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function workspace(extra: Record<string, unknown> = {}) {
|
||||
return {
|
||||
version: 1,
|
||||
id: 'workspace-1',
|
||||
engineInstanceId: 'engine-1',
|
||||
mode: 'horizontal',
|
||||
state: 'ready',
|
||||
left: context('left'),
|
||||
right: context('right'),
|
||||
proof: {level: 'strong', reasons: null},
|
||||
baselines: {},
|
||||
baselinePair: {state: 'waiting', reasons: null, resourceCandidates: null, operationCandidates: null},
|
||||
createdAt: Date.now(),
|
||||
expiresAt: Date.now() + 60_000,
|
||||
...extra,
|
||||
};
|
||||
}
|
||||
|
||||
describe('authorization task response protocol', () => {
|
||||
it('normalizes nullable collections before the workspace reaches React', () => {
|
||||
const result = normalizeBrowserAuthorizationTaskResult<ReturnType<typeof workspace>>(
|
||||
'authorization.workspace.inspect',
|
||||
workspace(),
|
||||
);
|
||||
expect(result.baselinePair.resourceCandidates).toEqual([]);
|
||||
expect(result.proof.reasons).toEqual([]);
|
||||
expect(result.left.authentication.authCookieNames).toEqual([]);
|
||||
});
|
||||
|
||||
it('normalizes a null candidate list and candidate reasons', () => {
|
||||
expect(normalizeBrowserAuthorizationTaskResult(
|
||||
'authorization.baseline.candidates',
|
||||
null,
|
||||
)).toEqual([]);
|
||||
expect(normalizeBrowserAuthorizationTaskResult(
|
||||
'authorization.baseline.candidates',
|
||||
[{id: 'candidate-1', reasons: null}],
|
||||
)).toEqual([{id: 'candidate-1', reasons: []}]);
|
||||
});
|
||||
|
||||
it('rejects old versions, extra fields, and wrong collection types with field paths', () => {
|
||||
expect(() => normalizeBrowserAuthorizationTaskResult(
|
||||
'authorization.workspace.inspect',
|
||||
workspace({version: 0}),
|
||||
)).toThrow('$.version');
|
||||
expect(() => normalizeBrowserAuthorizationTaskResult(
|
||||
'authorization.workspace.inspect',
|
||||
workspace({legacy: true}),
|
||||
)).toThrow('$.legacy');
|
||||
expect(() => normalizeBrowserAuthorizationTaskResult(
|
||||
'authorization.workspace.inspect',
|
||||
workspace({baselinePair: {state: 'waiting', resourceCandidates: {}, operationCandidates: []}}),
|
||||
)).toThrow('$.baselinePair.resourceCandidates');
|
||||
});
|
||||
|
||||
it('uses a stable schema mismatch code', () => {
|
||||
try {
|
||||
normalizeBrowserAuthorizationTaskResult('authorization.workspace.inspect', null);
|
||||
throw new Error('expected failure');
|
||||
} catch (error) {
|
||||
expect(error).toBeInstanceOf(ExtensionError);
|
||||
expect((error as ExtensionError).code).toBe('authorization_protocol_schema_mismatch');
|
||||
}
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,240 @@
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
import type { BrowserAuthorizationTaskSchema } from './engine';
|
||||
|
||||
type JSONObject = Record<string, unknown>;
|
||||
|
||||
function mismatch(schema: string, path: string, expected: string): never {
|
||||
throw new ExtensionError(
|
||||
'authorization_protocol_schema_mismatch',
|
||||
`授权测试协议 v1 / ${schema} 在 ${path} 不匹配：应为${expected}。请确认 Yak 与插件来自同一版本并重新建立工作区。`,
|
||||
{ schema, path, protocolVersion: 1 },
|
||||
);
|
||||
}
|
||||
|
||||
function objectValue(value: unknown, schema: string, path: string): JSONObject {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) mismatch(schema, path, '对象');
|
||||
return value as JSONObject;
|
||||
}
|
||||
|
||||
function strictKeys(value: JSONObject, allowed: readonly string[], schema: string, path: string): void {
|
||||
const keys = new Set(allowed);
|
||||
for (const key of Object.keys(value)) {
|
||||
if (!keys.has(key)) mismatch(schema, `${path}.${key}`, '协议声明字段');
|
||||
}
|
||||
}
|
||||
|
||||
function requiredString(value: JSONObject, key: string, schema: string, path: string): string {
|
||||
const result = value[key];
|
||||
if (typeof result !== 'string' || !result) mismatch(schema, `${path}.${key}`, '非空字符串');
|
||||
return result;
|
||||
}
|
||||
|
||||
function requiredNumber(value: JSONObject, key: string, schema: string, path: string): number {
|
||||
const result = value[key];
|
||||
if (typeof result !== 'number' || !Number.isFinite(result)) mismatch(schema, `${path}.${key}`, '有限数字');
|
||||
return result;
|
||||
}
|
||||
|
||||
function requiredBoolean(value: JSONObject, key: string, schema: string, path: string): boolean {
|
||||
const result = value[key];
|
||||
if (typeof result !== 'boolean') mismatch(schema, `${path}.${key}`, '布尔值');
|
||||
return result;
|
||||
}
|
||||
|
||||
function collection(value: JSONObject, key: string, schema: string, path: string): unknown[] {
|
||||
const result = value[key];
|
||||
if (result === undefined || result === null) return [];
|
||||
if (!Array.isArray(result)) mismatch(schema, `${path}.${key}`, '数组或空值');
|
||||
return result;
|
||||
}
|
||||
|
||||
function strings(value: JSONObject, key: string, schema: string, path: string): string[] {
|
||||
return collection(value, key, schema, path).map((item, index) => {
|
||||
if (typeof item !== 'string') mismatch(schema, `${path}.${key}[${index}]`, '字符串');
|
||||
return item;
|
||||
});
|
||||
}
|
||||
|
||||
function objects(
|
||||
value: JSONObject,
|
||||
key: string,
|
||||
schema: string,
|
||||
path: string,
|
||||
normalize: (item: JSONObject, itemPath: string) => JSONObject,
|
||||
): JSONObject[] {
|
||||
return collection(value, key, schema, path).map((item, index) => {
|
||||
const itemPath = `${path}.${key}[${index}]`;
|
||||
return normalize(objectValue(item, schema, itemPath), itemPath);
|
||||
});
|
||||
}
|
||||
|
||||
function normalizeContext(value: JSONObject, schema: string, path: string): JSONObject {
|
||||
const target = objectValue(value.target, schema, `${path}.target`);
|
||||
requiredNumber(target, 'tabId', schema, `${path}.target`);
|
||||
requiredNumber(target, 'frameId', schema, `${path}.target`);
|
||||
requiredString(target, 'documentId', schema, `${path}.target`);
|
||||
const authentication = objectValue(value.authentication, schema, `${path}.authentication`);
|
||||
requiredString(authentication, 'status', schema, `${path}.authentication`);
|
||||
requiredNumber(authentication, 'cookieCount', schema, `${path}.authentication`);
|
||||
requiredNumber(authentication, 'storageEntryCount', schema, `${path}.authentication`);
|
||||
return {
|
||||
...value,
|
||||
target,
|
||||
authentication: {
|
||||
...authentication,
|
||||
authCookieNames: strings(authentication, 'authCookieNames', schema, `${path}.authentication`),
|
||||
authStorageKeys: strings(authentication, 'authStorageKeys', schema, `${path}.authentication`),
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function normalizeBaseline(value: unknown, schema: string, path: string): JSONObject | undefined {
|
||||
if (value === undefined || value === null) return undefined;
|
||||
const baseline = objectValue(value, schema, path);
|
||||
const request = objectValue(baseline.request, schema, `${path}.request`);
|
||||
const logical = baseline.logicalRequest === undefined || baseline.logicalRequest === null
|
||||
? undefined
|
||||
: objectValue(baseline.logicalRequest, schema, `${path}.logicalRequest`);
|
||||
return {
|
||||
...baseline,
|
||||
request: {
|
||||
...request,
|
||||
operationNames: strings(request, 'operationNames', schema, `${path}.request`),
|
||||
headerNames: strings(request, 'headerNames', schema, `${path}.request`),
|
||||
fields: collection(request, 'fields', schema, `${path}.request`),
|
||||
},
|
||||
logicalRequest: logical ? {
|
||||
...logical,
|
||||
outputDestinations: strings(logical, 'outputDestinations', schema, `${path}.logicalRequest`),
|
||||
} : undefined,
|
||||
};
|
||||
}
|
||||
|
||||
function normalizeWorkspace(value: unknown, schema: string): JSONObject {
|
||||
const workspace = objectValue(value, schema, '$');
|
||||
strictKeys(workspace, [
|
||||
'version', 'id', 'engineInstanceId', 'mode', 'state', 'left', 'right', 'proof', 'baselines',
|
||||
'baselinePair', 'plan', 'execution', 'createdAt', 'expiresAt', 'staleReason', 'recovery',
|
||||
], schema, '$');
|
||||
if (requiredNumber(workspace, 'version', schema, '$') !== 1) mismatch(schema, '$.version', '版本 1');
|
||||
for (const key of ['id', 'engineInstanceId', 'mode', 'state']) requiredString(workspace, key, schema, '$');
|
||||
requiredNumber(workspace, 'createdAt', schema, '$');
|
||||
requiredNumber(workspace, 'expiresAt', schema, '$');
|
||||
const proof = objectValue(workspace.proof, schema, '$.proof');
|
||||
requiredString(proof, 'level', schema, '$.proof');
|
||||
const baselines = objectValue(workspace.baselines, schema, '$.baselines');
|
||||
const pair = objectValue(workspace.baselinePair, schema, '$.baselinePair');
|
||||
requiredString(pair, 'state', schema, '$.baselinePair');
|
||||
const resourceCandidates = objects(pair, 'resourceCandidates', schema, '$.baselinePair', (item, path) => {
|
||||
for (const key of ['id', 'source', 'location', 'path', 'category', 'confidence']) requiredString(item, key, schema, path);
|
||||
requiredBoolean(item, 'requiresLogicalBinding', schema, path);
|
||||
return { ...item, reasons: strings(item, 'reasons', schema, path) };
|
||||
});
|
||||
const operationCandidates = objects(pair, 'operationCandidates', schema, '$.baselinePair', (item, path) => {
|
||||
for (const key of ['id', 'method', 'path']) requiredString(item, key, schema, path);
|
||||
requiredBoolean(item, 'eligible', schema, path);
|
||||
requiredBoolean(item, 'sideEffect', schema, path);
|
||||
requiredBoolean(item, 'requiresDynamicRebuild', schema, path);
|
||||
return {
|
||||
...item,
|
||||
authenticationPaths: strings(item, 'authenticationPaths', schema, path),
|
||||
dynamicPaths: strings(item, 'dynamicPaths', schema, path),
|
||||
reasons: strings(item, 'reasons', schema, path),
|
||||
};
|
||||
});
|
||||
let plan = workspace.plan;
|
||||
if (plan !== undefined && plan !== null) {
|
||||
const input = objectValue(plan, schema, '$.plan');
|
||||
plan = {
|
||||
...input,
|
||||
canaryPaths: strings(input, 'canaryPaths', schema, '$.plan'),
|
||||
cases: collection(input, 'cases', schema, '$.plan'),
|
||||
reasons: strings(input, 'reasons', schema, '$.plan'),
|
||||
};
|
||||
}
|
||||
let execution = workspace.execution;
|
||||
if (execution !== undefined && execution !== null) {
|
||||
const input = objectValue(execution, schema, '$.execution');
|
||||
execution = {
|
||||
...input,
|
||||
cases: collection(input, 'cases', schema, '$.execution'),
|
||||
evidence: collection(input, 'evidence', schema, '$.execution'),
|
||||
reasons: strings(input, 'reasons', schema, '$.execution'),
|
||||
};
|
||||
}
|
||||
return {
|
||||
...workspace,
|
||||
left: normalizeContext(objectValue(workspace.left, schema, '$.left'), schema, '$.left'),
|
||||
right: normalizeContext(objectValue(workspace.right, schema, '$.right'), schema, '$.right'),
|
||||
proof: { ...proof, reasons: strings(proof, 'reasons', schema, '$.proof') },
|
||||
baselines: {
|
||||
...baselines,
|
||||
left: normalizeBaseline(baselines.left, schema, '$.baselines.left'),
|
||||
right: normalizeBaseline(baselines.right, schema, '$.baselines.right'),
|
||||
verification: normalizeBaseline(baselines.verification, schema, '$.baselines.verification'),
|
||||
},
|
||||
baselinePair: {
|
||||
...pair,
|
||||
reasons: strings(pair, 'reasons', schema, '$.baselinePair'),
|
||||
resourceCandidates,
|
||||
operationCandidates,
|
||||
},
|
||||
plan,
|
||||
execution,
|
||||
};
|
||||
}
|
||||
|
||||
function normalizeEvidence(value: unknown, schema: string): JSONObject {
|
||||
const result = objectValue(value, schema, '$');
|
||||
strictKeys(result, [
|
||||
'version', 'workspaceId', 'executionId', 'mode', 'verdict', 'confidence', 'cases', 'comparisons',
|
||||
'semantic', 'representations', 'expiresAt', 'leftCaseId', 'rightCaseId', 'scope', 'view',
|
||||
'representation', 'equal', 'entries', 'omitted', 'caseId', 'side', 'packetBase64', 'capturedBytes',
|
||||
'truncated', 'direction', 'verified', 'evidence', 'rejectedPaths', 'verdictChanged', 'reason',
|
||||
], schema, '$');
|
||||
if (requiredNumber(result, 'version', schema, '$') !== 1) mismatch(schema, '$.version', '版本 1');
|
||||
requiredString(result, 'workspaceId', schema, '$');
|
||||
requiredString(result, 'executionId', schema, '$');
|
||||
if (schema === 'authorization.evidence.inspect') return {
|
||||
...result,
|
||||
cases: collection(result, 'cases', schema, '$'),
|
||||
comparisons: collection(result, 'comparisons', schema, '$'),
|
||||
semantic: collection(result, 'semantic', schema, '$'),
|
||||
representations: strings(result, 'representations', schema, '$'),
|
||||
};
|
||||
if (schema === 'authorization.evidence.diff') return {
|
||||
...result,
|
||||
entries: collection(result, 'entries', schema, '$'),
|
||||
};
|
||||
if (schema === 'authorization.evidence.validate') return {
|
||||
...result,
|
||||
evidence: collection(result, 'evidence', schema, '$'),
|
||||
rejectedPaths: strings(result, 'rejectedPaths', schema, '$'),
|
||||
};
|
||||
requiredString(result, 'packetBase64', schema, '$');
|
||||
return result;
|
||||
}
|
||||
|
||||
export function normalizeBrowserAuthorizationTaskResult<T>(
|
||||
schema: BrowserAuthorizationTaskSchema,
|
||||
value: unknown,
|
||||
): T {
|
||||
if (schema === 'authorization.baseline.candidates') {
|
||||
if (value === undefined || value === null) return [] as T;
|
||||
if (!Array.isArray(value)) mismatch(schema, '$', '数组或空值');
|
||||
return value.map((candidate, index) => {
|
||||
const item = objectValue(candidate, schema, `$[${index}]`);
|
||||
requiredString(item, 'id', schema, `$[${index}]`);
|
||||
return { ...item, reasons: strings(item, 'reasons', schema, `$[${index}]`) };
|
||||
}) as T;
|
||||
}
|
||||
if ([
|
||||
'authorization.workspace.create',
|
||||
'authorization.workspace.inspect',
|
||||
'authorization.baseline.bind',
|
||||
'authorization.logical.bind',
|
||||
'authorization.plan.create',
|
||||
'authorization.plan.execute',
|
||||
].includes(schema)) return normalizeWorkspace(value, schema) as T;
|
||||
return normalizeEvidence(value, schema) as T;
|
||||
}
|
||||
@@ -0,0 +1,301 @@
|
||||
import type { BrowserTransformPacket } from '@/types/models';
|
||||
import { ExtensionError } from '@/shared/errors';
|
||||
|
||||
const RESERVED_PATH_SEGMENTS = new Set(['__proto__', 'prototype', 'constructor']);
|
||||
const MAX_BODY_PATH_DEPTH = 64;
|
||||
|
||||
type ValuePathSegment = string | number;
|
||||
export type StructuredAuthorizationPrimitive = string | number | boolean;
|
||||
|
||||
export interface StructuredAuthorizationBodyValue {
|
||||
value: StructuredAuthorizationPrimitive;
|
||||
valueType: 'string' | 'number' | 'boolean';
|
||||
text: string;
|
||||
}
|
||||
|
||||
function structuredPrimitive(value: unknown): StructuredAuthorizationBodyValue {
|
||||
if (typeof value === 'string') {
|
||||
return { value, valueType: 'string', text: value };
|
||||
}
|
||||
if (typeof value === 'number' && Number.isFinite(value)) {
|
||||
return { value, valueType: 'number', text: JSON.stringify(value) };
|
||||
}
|
||||
if (typeof value === 'boolean') {
|
||||
return { value, valueType: 'boolean', text: JSON.stringify(value) };
|
||||
}
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'自动矩阵只接受字符串、数字或布尔 Body 资源值',
|
||||
);
|
||||
}
|
||||
|
||||
function base64ToUTF8(value: string): string {
|
||||
let binary: string;
|
||||
try {
|
||||
binary = atob(value);
|
||||
} catch {
|
||||
throw new ExtensionError(
|
||||
'authorization_value_invalid',
|
||||
'结构化请求 Body 不是有效的 Base64',
|
||||
);
|
||||
}
|
||||
try {
|
||||
return new TextDecoder('utf-8', { fatal: true }).decode(
|
||||
Uint8Array.from(binary, (character) => character.charCodeAt(0)),
|
||||
);
|
||||
} catch {
|
||||
throw new ExtensionError(
|
||||
'authorization_value_invalid',
|
||||
'结构化请求 Body 不是有效的 UTF-8',
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
function utf8ToBase64(value: string): string {
|
||||
const bytes = new TextEncoder().encode(value);
|
||||
let binary = '';
|
||||
const chunkSize = 0x8000;
|
||||
for (let offset = 0; offset < bytes.length; offset += chunkSize) {
|
||||
binary += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
|
||||
}
|
||||
return btoa(binary);
|
||||
}
|
||||
|
||||
function packetContentType(packet: BrowserTransformPacket): string {
|
||||
return packet.headers.find((header) => header.name.toLowerCase() === 'content-type')
|
||||
?.value.toLowerCase() || '';
|
||||
}
|
||||
|
||||
function parseBodyPath(path: string): ValuePathSegment[] {
|
||||
if (!path.startsWith('body.') && !path.startsWith('body[')) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'结构化 Body 资源路径必须从 body. 或 body[ 开始',
|
||||
);
|
||||
}
|
||||
const input = path.slice(4);
|
||||
const segments: ValuePathSegment[] = [];
|
||||
const pattern = /(?:^|\.)([A-Za-z0-9_-]+)|\[(\d+)]/g;
|
||||
let offset = 0;
|
||||
for (const match of input.matchAll(pattern)) {
|
||||
if (match.index !== offset) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'结构化 Body 资源路径包含不支持的字段',
|
||||
);
|
||||
}
|
||||
const segment = match[1] ?? Number(match[2]);
|
||||
if (
|
||||
typeof segment === 'string'
|
||||
&& RESERVED_PATH_SEGMENTS.has(segment.toLowerCase())
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'结构化 Body 资源路径包含保留字段',
|
||||
);
|
||||
}
|
||||
segments.push(segment);
|
||||
offset = match.index + match[0].length;
|
||||
}
|
||||
if (
|
||||
offset !== input.length
|
||||
|| !segments.length
|
||||
|| segments.length > MAX_BODY_PATH_DEPTH
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'结构化 Body 资源路径无效或过深',
|
||||
);
|
||||
}
|
||||
return segments;
|
||||
}
|
||||
|
||||
function parseIndexedFormPath(path: string): { name: string; index?: number } {
|
||||
if (!path.startsWith('body.')) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'Form Body 资源路径必须从 body. 开始',
|
||||
);
|
||||
}
|
||||
const raw = path.slice(5);
|
||||
const matched = raw.match(/^(.*)\[(\d+)]$/);
|
||||
const name = matched ? matched[1] : raw;
|
||||
const index = matched ? Number(matched[2]) : undefined;
|
||||
if (
|
||||
!name
|
||||
|| RESERVED_PATH_SEGMENTS.has(name.toLowerCase())
|
||||
|| (index !== undefined && (!Number.isSafeInteger(index) || index < 0))
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'Form Body 资源路径无效',
|
||||
);
|
||||
}
|
||||
return { name, index };
|
||||
}
|
||||
|
||||
function selectedFormOccurrence(
|
||||
entries: Array<[string, string]>,
|
||||
name: string,
|
||||
index?: number,
|
||||
): { entryIndex: number; value: string } {
|
||||
const matches = entries.flatMap(([key, value], entryIndex) => (
|
||||
key === name ? [{ entryIndex, value }] : []
|
||||
));
|
||||
if (index === undefined && matches.length !== 1) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_ambiguous',
|
||||
'Form Body 存在多个同名资源字段，必须选择带序号的字段',
|
||||
);
|
||||
}
|
||||
const selected = matches[index ?? 0];
|
||||
if (!selected) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'Form Body 资源字段不存在',
|
||||
);
|
||||
}
|
||||
return selected;
|
||||
}
|
||||
|
||||
function readJSONBodyValue(
|
||||
packet: BrowserTransformPacket,
|
||||
path: string,
|
||||
): StructuredAuthorizationBodyValue {
|
||||
let value: unknown;
|
||||
try {
|
||||
value = JSON.parse(base64ToUTF8(packet.bodyBase64));
|
||||
} catch (error) {
|
||||
if (error instanceof ExtensionError) throw error;
|
||||
throw new ExtensionError(
|
||||
'authorization_structured_body_invalid',
|
||||
'请求 JSON Body 无法解析',
|
||||
);
|
||||
}
|
||||
for (const segment of parseBodyPath(path)) {
|
||||
if (!value || typeof value !== 'object' || !(segment in value)) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'JSON Body 资源字段不存在',
|
||||
);
|
||||
}
|
||||
value = (value as Record<string | number, unknown>)[segment];
|
||||
}
|
||||
return structuredPrimitive(value);
|
||||
}
|
||||
|
||||
function replaceJSONBodyValue(
|
||||
packet: BrowserTransformPacket,
|
||||
path: string,
|
||||
replacement: StructuredAuthorizationPrimitive,
|
||||
): BrowserTransformPacket {
|
||||
let root: unknown;
|
||||
try {
|
||||
root = JSON.parse(base64ToUTF8(packet.bodyBase64));
|
||||
} catch (error) {
|
||||
if (error instanceof ExtensionError) throw error;
|
||||
throw new ExtensionError(
|
||||
'authorization_structured_body_invalid',
|
||||
'请求 JSON Body 无法解析',
|
||||
);
|
||||
}
|
||||
const segments = parseBodyPath(path);
|
||||
let parent = root;
|
||||
for (const segment of segments.slice(0, -1)) {
|
||||
if (!parent || typeof parent !== 'object' || !(segment in parent)) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'JSON Body 资源字段不存在',
|
||||
);
|
||||
}
|
||||
parent = (parent as Record<string | number, unknown>)[segment];
|
||||
}
|
||||
const leaf = segments.at(-1);
|
||||
if (
|
||||
leaf === undefined
|
||||
|| !parent
|
||||
|| typeof parent !== 'object'
|
||||
|| !(leaf in parent)
|
||||
) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'JSON Body 资源字段不存在',
|
||||
);
|
||||
}
|
||||
const current = structuredPrimitive(
|
||||
(parent as Record<string | number, unknown>)[leaf],
|
||||
);
|
||||
if (current.valueType !== typeof replacement) {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'JSON Body 资源替换不能改变字段类型',
|
||||
);
|
||||
}
|
||||
(parent as Record<string | number, unknown>)[leaf] = replacement;
|
||||
return {
|
||||
...packet,
|
||||
bodyBase64: utf8ToBase64(JSON.stringify(root)),
|
||||
};
|
||||
}
|
||||
|
||||
export function isStructuredAuthorizationBody(packet: BrowserTransformPacket): boolean {
|
||||
const contentType = packetContentType(packet);
|
||||
return contentType.includes('json')
|
||||
|| contentType.includes('application/x-www-form-urlencoded');
|
||||
}
|
||||
|
||||
export function readStructuredAuthorizationBodyValue(
|
||||
packet: BrowserTransformPacket,
|
||||
path: string,
|
||||
): StructuredAuthorizationBodyValue {
|
||||
const contentType = packetContentType(packet);
|
||||
if (contentType.includes('json')) {
|
||||
return readJSONBodyValue(packet, path);
|
||||
}
|
||||
if (contentType.includes('application/x-www-form-urlencoded')) {
|
||||
const selected = parseIndexedFormPath(path);
|
||||
const value = selectedFormOccurrence(
|
||||
[...new URLSearchParams(base64ToUTF8(packet.bodyBase64))],
|
||||
selected.name,
|
||||
selected.index,
|
||||
).value;
|
||||
return { value, valueType: 'string', text: value };
|
||||
}
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'直接 Body 资源替换仅支持 JSON 或 Form 请求',
|
||||
);
|
||||
}
|
||||
|
||||
export function replaceStructuredAuthorizationBodyValue(input: {
|
||||
packet: BrowserTransformPacket;
|
||||
path: string;
|
||||
replacement: StructuredAuthorizationPrimitive;
|
||||
}): BrowserTransformPacket {
|
||||
const contentType = packetContentType(input.packet);
|
||||
if (contentType.includes('json')) {
|
||||
return replaceJSONBodyValue(input.packet, input.path, input.replacement);
|
||||
}
|
||||
if (contentType.includes('application/x-www-form-urlencoded')) {
|
||||
if (typeof input.replacement !== 'string') {
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'Form Body 资源替换只接受字符串',
|
||||
);
|
||||
}
|
||||
const selected = parseIndexedFormPath(input.path);
|
||||
const entries = [...new URLSearchParams(base64ToUTF8(input.packet.bodyBase64))];
|
||||
const occurrence = selectedFormOccurrence(entries, selected.name, selected.index);
|
||||
entries[occurrence.entryIndex][1] = input.replacement;
|
||||
const form = new URLSearchParams();
|
||||
entries.forEach(([name, value]) => form.append(name, value));
|
||||
return {
|
||||
...input.packet,
|
||||
bodyBase64: utf8ToBase64(form.toString()),
|
||||
};
|
||||
}
|
||||
throw new ExtensionError(
|
||||
'authorization_selector_invalid',
|
||||
'直接 Body 资源替换仅支持 JSON 或 Form 请求',
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,365 @@
|
||||
import { useEffect, useState } from 'react';
|
||||
import {
|
||||
AlertTriangle, ArrowRight, Check, CircleCheck, Code2, FileDiff, FileText, Timer,
|
||||
} from 'lucide-react';
|
||||
import { errorMessage } from '@/platform/messaging/runtime';
|
||||
import {
|
||||
runBrowserAuthorizationTask,
|
||||
type BrowserAuthorizationEvidenceBundle,
|
||||
type BrowserAuthorizationEvidenceDiff,
|
||||
type BrowserAuthorizationEvidencePacket,
|
||||
type BrowserAuthorizationEvidenceValidation,
|
||||
type BrowserAuthorizationWorkspace,
|
||||
} from '../engine';
|
||||
|
||||
function decodeEvidencePacket(packetBase64: string): string {
|
||||
const binary = atob(packetBase64);
|
||||
const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
|
||||
return new TextDecoder().decode(bytes);
|
||||
}
|
||||
|
||||
export function compactDuration(value: number): string {
|
||||
if (!Number.isFinite(value)) return '—';
|
||||
if (value < 1) return `${value.toFixed(2)} ms`;
|
||||
if (value < 100) return `${value.toFixed(1)} ms`;
|
||||
return `${Math.round(value)} ms`;
|
||||
}
|
||||
|
||||
function formatResponseAnalysis(response?: BrowserAuthorizationEvidenceBundle['cases'][number]['response']): string {
|
||||
if (!response) return '';
|
||||
if (response.analysisState === 'encoded-unavailable') return ' · 编码正文不可分析';
|
||||
if (response.analysisRepresentation === 'binary') return ' · 二进制摘要';
|
||||
if (response.decoded) {
|
||||
const encoding = response.contentEncoding || '压缩内容';
|
||||
const representation = response.analysisRepresentation?.toUpperCase() || '正文';
|
||||
return ` · ${encoding} → ${representation}`;
|
||||
}
|
||||
return '';
|
||||
}
|
||||
|
||||
export function AuthorizationEvidenceWorkbench({
|
||||
workspace,
|
||||
onWorkspaceChange,
|
||||
}: {
|
||||
workspace: BrowserAuthorizationWorkspace;
|
||||
onWorkspaceChange: (workspace: BrowserAuthorizationWorkspace) => void;
|
||||
}) {
|
||||
const execution = workspace.execution!;
|
||||
const [bundle, setBundle] = useState<BrowserAuthorizationEvidenceBundle>();
|
||||
const [comparisonId, setComparisonId] = useState('');
|
||||
const [diff, setDiff] = useState<BrowserAuthorizationEvidenceDiff>();
|
||||
const [packet, setPacket] = useState<BrowserAuthorizationEvidencePacket>();
|
||||
const [packetTitle, setPacketTitle] = useState('');
|
||||
const [view, setView] = useState<'redacted' | 'raw'>('redacted');
|
||||
const [showVolatile, setShowVolatile] = useState(false);
|
||||
const [loading, setLoading] = useState(false);
|
||||
const [validatingPath, setValidatingPath] = useState('');
|
||||
const [validationMessage, setValidationMessage] = useState('');
|
||||
const [error, setError] = useState('');
|
||||
|
||||
useEffect(() => {
|
||||
let disposed = false;
|
||||
setLoading(true);
|
||||
setError('');
|
||||
setBundle(undefined);
|
||||
setDiff(undefined);
|
||||
setPacket(undefined);
|
||||
void runBrowserAuthorizationTask<BrowserAuthorizationEvidenceBundle>(
|
||||
'authorization.evidence.inspect',
|
||||
{ workspaceId: workspace.id, executionId: execution.id },
|
||||
).then((next) => {
|
||||
if (disposed) return;
|
||||
setBundle(next);
|
||||
const preferred = next.comparisons.find((item) => item.purpose === 'authorization')
|
||||
|| next.comparisons[0];
|
||||
setComparisonId(preferred?.id || '');
|
||||
}).catch((cause) => {
|
||||
if (!disposed) setError(errorMessage(cause));
|
||||
}).finally(() => {
|
||||
if (!disposed) setLoading(false);
|
||||
});
|
||||
return () => { disposed = true; };
|
||||
}, [execution.id, workspace.id]);
|
||||
|
||||
const comparison = bundle?.comparisons.find((item) => item.id === comparisonId);
|
||||
const comparisonCases = comparison
|
||||
? bundle?.cases.filter((item) => item.id === comparison.leftCaseId || item.id === comparison.rightCaseId) || []
|
||||
: [];
|
||||
const comparisonTruncated = comparisonCases.some((item) => item.response?.truncated);
|
||||
const comparisonEncodedUnavailable = comparisonCases.some(
|
||||
(item) => item.response?.analysisState === 'encoded-unavailable',
|
||||
);
|
||||
const rawDiffEntries = diff?.entries;
|
||||
const diffEntries = Array.isArray(rawDiffEntries) ? rawDiffEntries : [];
|
||||
const diffRepresentationLabel = diff?.representation === 'structured'
|
||||
? '结构化字段差异'
|
||||
: diffEntries.some((entry) => entry.path.includes('.body.binary.'))
|
||||
? '二进制摘要差异'
|
||||
: diffEntries.some((entry) => entry.path.includes('.body.encoded.'))
|
||||
? '编码正文元数据差异'
|
||||
: '原始文本差异';
|
||||
const volatileCount = diffEntries.filter((entry) => entry.volatile).length;
|
||||
const visibleEntries = diffEntries.filter((entry) => showVolatile || !entry.volatile);
|
||||
const executionEvidence = Array.isArray(execution.evidence) ? execution.evidence : [];
|
||||
const validationDirections: BrowserAuthorizationEvidenceValidation['direction'][] = comparison?.id === 'controls'
|
||||
? ['a-to-b', 'b-to-a']
|
||||
: comparison?.id === 'a-to-b'
|
||||
? ['a-to-b']
|
||||
: comparison?.id === 'b-to-a'
|
||||
? ['b-to-a']
|
||||
: comparison?.id === 'low-vs-privileged' || comparison?.id === 'probe-vs-privileged'
|
||||
? ['low-to-privileged']
|
||||
: comparison?.id === 'post-state'
|
||||
? ['post-state']
|
||||
: [];
|
||||
|
||||
useEffect(() => {
|
||||
if (!comparison) return;
|
||||
let disposed = false;
|
||||
setLoading(true);
|
||||
setError('');
|
||||
setPacket(undefined);
|
||||
void runBrowserAuthorizationTask<BrowserAuthorizationEvidenceDiff>(
|
||||
'authorization.evidence.diff',
|
||||
{
|
||||
workspaceId: workspace.id,
|
||||
executionId: execution.id,
|
||||
leftCaseId: comparison.leftCaseId,
|
||||
rightCaseId: comparison.rightCaseId,
|
||||
scope: 'response',
|
||||
view,
|
||||
},
|
||||
).then((next) => {
|
||||
if (!disposed) setDiff(next);
|
||||
}).catch((cause) => {
|
||||
if (!disposed) setError(errorMessage(cause));
|
||||
}).finally(() => {
|
||||
if (!disposed) setLoading(false);
|
||||
});
|
||||
return () => { disposed = true; };
|
||||
}, [comparison?.id, execution.id, view, workspace.id]);
|
||||
|
||||
const changeView = (next: 'redacted' | 'raw') => {
|
||||
if (next === 'raw' && !window.confirm(
|
||||
'原始证据可能包含 Cookie、Authorization 与业务敏感值。仅在当前授权测试确有需要时显示。',
|
||||
)) return;
|
||||
setView(next);
|
||||
setPacket(undefined);
|
||||
};
|
||||
|
||||
const openPacket = async (
|
||||
caseId: string,
|
||||
side: 'request' | 'response',
|
||||
label: string,
|
||||
) => {
|
||||
setLoading(true);
|
||||
setError('');
|
||||
try {
|
||||
const next = await runBrowserAuthorizationTask<BrowserAuthorizationEvidencePacket>(
|
||||
'authorization.evidence.packet',
|
||||
{
|
||||
workspaceId: workspace.id,
|
||||
executionId: execution.id,
|
||||
caseId,
|
||||
side,
|
||||
view,
|
||||
},
|
||||
);
|
||||
setPacket(next);
|
||||
setPacketTitle(`${label} · ${side === 'request' ? '请求' : '响应'}`);
|
||||
} catch (cause) {
|
||||
setError(errorMessage(cause));
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
};
|
||||
|
||||
const validatePath = async (
|
||||
path: string,
|
||||
direction: BrowserAuthorizationEvidenceValidation['direction'],
|
||||
) => {
|
||||
const validationKey = `${direction}:${path}`;
|
||||
setValidatingPath(validationKey);
|
||||
setValidationMessage('');
|
||||
setError('');
|
||||
try {
|
||||
const validation = await runBrowserAuthorizationTask<BrowserAuthorizationEvidenceValidation>(
|
||||
'authorization.evidence.validate',
|
||||
{
|
||||
workspaceId: workspace.id,
|
||||
executionId: execution.id,
|
||||
direction,
|
||||
paths: [path],
|
||||
},
|
||||
);
|
||||
setValidationMessage(validation.reason);
|
||||
const validationEvidence = Array.isArray(validation.evidence) ? validation.evidence : [];
|
||||
const additions = validationEvidence.filter((candidate) => !executionEvidence.some((current) => (
|
||||
current.direction === candidate.direction
|
||||
&& current.path === candidate.path
|
||||
&& current.source === candidate.source
|
||||
)));
|
||||
onWorkspaceChange({
|
||||
...workspace,
|
||||
execution: {
|
||||
...execution,
|
||||
verdict: validation.verdict,
|
||||
confidence: validation.confidence,
|
||||
evidence: [...executionEvidence, ...additions],
|
||||
reasons: validation.verdictChanged
|
||||
? [...execution.reasons, validation.reason]
|
||||
: execution.reasons,
|
||||
},
|
||||
});
|
||||
} catch (cause) {
|
||||
setError(errorMessage(cause));
|
||||
} finally {
|
||||
setValidatingPath('');
|
||||
}
|
||||
};
|
||||
|
||||
return <div className="authorization-evidence-workbench">
|
||||
<div className="authorization-evidence-title">
|
||||
<div>
|
||||
<span>短时证据包</span>
|
||||
<strong>交叉请求与业务归属证据</strong>
|
||||
<small>
|
||||
报文仅在当前工作区短时保留；差异默认脱敏，时间戳与请求 ID 会单独降噪。
|
||||
{bundle ? ` · 保留至 ${new Date(bundle.expiresAt).toLocaleTimeString()}` : ''}
|
||||
</small>
|
||||
</div>
|
||||
<div className="authorization-evidence-view">
|
||||
<button className={view === 'redacted' ? 'active' : ''} onClick={() => changeView('redacted')}>脱敏</button>
|
||||
<button className={view === 'raw' ? 'active raw' : ''} onClick={() => changeView('raw')}>原始值</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{bundle && <div className="authorization-evidence-trace" aria-label="测试请求执行顺序">
|
||||
{bundle.cases.map((item, index) => <div key={item.id}>
|
||||
<span>{String(index + 1).padStart(2, '0')}</span>
|
||||
<strong>{item.label}</strong>
|
||||
<small>
|
||||
{item.status || '—'} · {compactDuration(item.timing.totalMs)}
|
||||
{item.timing.ttfbMs > 0 ? ` · 首字节 ${compactDuration(item.timing.ttfbMs)}` : ''}
|
||||
{formatResponseAnalysis(item.response)}
|
||||
</small>
|
||||
<nav>
|
||||
<button disabled={!item.requestAvailable || loading} onClick={() => void openPacket(item.id, 'request', item.label)}>
|
||||
<Code2 size={12} />请求
|
||||
</button>
|
||||
<button disabled={!item.responseAvailable || loading} onClick={() => void openPacket(item.id, 'response', item.label)}>
|
||||
<FileText size={12} />响应
|
||||
</button>
|
||||
</nav>
|
||||
</div>)}
|
||||
</div>}
|
||||
|
||||
<div className="authorization-evidence-body">
|
||||
<aside>
|
||||
<span>比较关系</span>
|
||||
{bundle?.comparisons.map((item) => <button
|
||||
key={item.id}
|
||||
className={item.id === comparisonId ? 'active' : ''}
|
||||
onClick={() => {
|
||||
setComparisonId(item.id);
|
||||
setPacket(undefined);
|
||||
}}
|
||||
>
|
||||
<i>{item.purpose === 'authorization' ? '关键' : item.purpose === 'state-change' ? '状态' : '对照'}</i>
|
||||
<strong>{item.label}</strong>
|
||||
</button>)}
|
||||
</aside>
|
||||
<main>
|
||||
<header>
|
||||
<div>
|
||||
{packet ? <FileText size={16} /> : <FileDiff size={16} />}
|
||||
<span><strong>{packet ? packetTitle : comparison?.label || '响应差异'}</strong>
|
||||
<small>{packet
|
||||
? `${packet.view === 'raw' ? '原始' : '脱敏'}报文${packet.truncated ? ' · 已截断' : ''}`
|
||||
: diffRepresentationLabel}</small>
|
||||
</span>
|
||||
</div>
|
||||
{packet
|
||||
? <button onClick={() => setPacket(undefined)}><FileDiff size={13} />返回差异</button>
|
||||
: volatileCount > 0 && <button onClick={() => setShowVolatile((current) => !current)}>
|
||||
{showVolatile ? '隐藏' : '显示'}动态噪声 · {volatileCount}
|
||||
</button>}
|
||||
</header>
|
||||
|
||||
{loading && <div className="authorization-evidence-empty"><Timer size={17} />正在读取证据…</div>}
|
||||
{!loading && error && <div className="authorization-evidence-empty error"><AlertTriangle size={17} />{error}</div>}
|
||||
{!loading && !error && packet && <pre>{decodeEvidencePacket(packet.packetBase64)}</pre>}
|
||||
{!loading && !error && !packet && diff?.equal && <div className="authorization-evidence-empty">
|
||||
<CircleCheck size={17} />{comparison?.purpose === 'authorization'
|
||||
? comparisonTruncated
|
||||
? '两项响应已捕获部分一致，但至少一项已截断，不能据此判断资源归属。'
|
||||
: comparisonEncodedUnavailable
|
||||
? '两项线上编码正文指纹一致，但正文未能在预算内解码，不能据此提升授权结论。'
|
||||
: '交叉响应与目标身份响应完全一致；如结论尚未确认，请切换到“身份 A 自有资源 ↔ 身份 B 自有资源”，选择稳定业务字段验证。'
|
||||
: comparison?.purpose === 'state-change'
|
||||
? '操作前后的稳定业务字段没有变化。'
|
||||
: '双方正常响应完全一致，当前对照没有可用于区分资源归属的字段。'}
|
||||
</div>}
|
||||
{!loading && !error && !packet && diff && !diff.equal
|
||||
&& visibleEntries.length === 0 && volatileCount > 0 && !showVolatile
|
||||
&& <div className="authorization-evidence-empty">
|
||||
<Timer size={17} />当前差异只有 {volatileCount} 项动态噪声，已默认折叠。
|
||||
</div>}
|
||||
{!packet && validationMessage && <div className="authorization-evidence-validation">
|
||||
<Check size={13} />{validationMessage}
|
||||
</div>}
|
||||
{!loading && !error && !packet && diff && !diff.equal && visibleEntries.length > 0 && <div className="authorization-diff-list">
|
||||
{visibleEntries.slice(0, 80).map((entry) => {
|
||||
const pendingDirections = validationDirections.filter((direction) => !executionEvidence.some((item) => (
|
||||
item.path === entry.path && item.direction === direction
|
||||
)));
|
||||
const alreadyVerified = pendingDirections.length < validationDirections.length;
|
||||
const canValidate = Boolean(
|
||||
pendingDirections.length
|
||||
&& diff.scope === 'response'
|
||||
&& entry.path.startsWith('body.')
|
||||
&& !entry.volatile
|
||||
&& !entry.sensitive
|
||||
);
|
||||
return <div
|
||||
key={`${entry.path}-${entry.kind}`}
|
||||
className={`${entry.semantic || alreadyVerified ? 'semantic' : ''} ${entry.volatile ? 'volatile' : ''}`}
|
||||
>
|
||||
<div>
|
||||
<code>{entry.path}</code>
|
||||
<span>{alreadyVerified
|
||||
? pendingDirections.length ? '部分已验证' : '已验证'
|
||||
: entry.semantic ? '归属候选' : entry.volatile ? '动态噪声' : entry.sensitive ? '敏感字段' : entry.kind}</span>
|
||||
{canValidate && pendingDirections.map((direction) => {
|
||||
const validationKey = `${direction}:${entry.path}`;
|
||||
const label = direction === 'a-to-b'
|
||||
? '验证 A→B'
|
||||
: direction === 'b-to-a'
|
||||
? '验证 B→A'
|
||||
: direction === 'post-state'
|
||||
? '验证状态变化'
|
||||
: '核对低权探测';
|
||||
return <button
|
||||
key={direction}
|
||||
disabled={Boolean(validatingPath)}
|
||||
onClick={() => void validatePath(entry.path, direction)}
|
||||
>
|
||||
{validatingPath === validationKey ? '验证中…' : label}
|
||||
</button>;
|
||||
})}
|
||||
</div>
|
||||
<section>
|
||||
<p><b>左</b><span title={entry.left}>{entry.left || '—'}</span></p>
|
||||
<ArrowRight size={13} />
|
||||
<p><b>右</b><span title={entry.right}>{entry.right || '—'}</span></p>
|
||||
</section>
|
||||
</div>;
|
||||
})}
|
||||
{(visibleEntries.length > 80 || diff.omitted > 0) && <small className="authorization-diff-omitted">
|
||||
当前展示前 80 项，另有 {Math.max(0, visibleEntries.length - 80) + diff.omitted} 项未展开
|
||||
</small>}
|
||||
</div>}
|
||||
</main>
|
||||
</div>
|
||||
</div>;
|
||||
}
|
||||
@@ -0,0 +1,977 @@
|
||||
import { useCallback, useEffect, useMemo, useReducer, useState } from 'react';
|
||||
import { browser } from 'wxt/browser';
|
||||
import {
|
||||
AlertTriangle, ArrowRight, Check, CircleCheck, ExternalLink, Fingerprint,
|
||||
LockKeyhole, Play, RefreshCw, RotateCcw, ShieldAlert, Square, UserRoundPlus,
|
||||
} from 'lucide-react';
|
||||
import { Button } from '@/components/ui/button';
|
||||
import { authorizationShareGrantInput } from '@/features/grants/gateway-share';
|
||||
import { errorMessage, request } from '@/platform/messaging/runtime';
|
||||
import type {
|
||||
ActiveTabInfo, BridgeStatus, BrowserIsolationContext, BrowserIsolationInspection,
|
||||
ExtensionState, NetworkCaptureStatus,
|
||||
} from '@/types/models';
|
||||
import {
|
||||
runBrowserAuthorizationTask,
|
||||
type BrowserAuthorizationBaselineCandidate,
|
||||
type BrowserAuthorizationMode,
|
||||
type BrowserAuthorizationSide,
|
||||
type BrowserAuthorizationWorkspace,
|
||||
} from '../engine';
|
||||
import './authorization-testing-workspace.css';
|
||||
import {
|
||||
authorizationIdentityOptionDisabledReason,
|
||||
normalizeAuthorizationIdentityTabSelection,
|
||||
} from './identity-selection';
|
||||
import {
|
||||
authorizationWorkspaceUIReducer,
|
||||
INITIAL_AUTHORIZATION_WORKSPACE_UI,
|
||||
persistedAuthorizationWorkspaceUI,
|
||||
} from './workspace-reducer';
|
||||
import {
|
||||
AuthorizationEvidenceWorkbench,
|
||||
compactDuration,
|
||||
} from './AuthorizationEvidenceWorkbench';
|
||||
import { IdentitySlot } from './IdentitySlot';
|
||||
|
||||
const SESSION_KEY = 'session.authorization-testing-workspace-ui.v1';
|
||||
|
||||
interface AuthorizationTestingWorkspaceProps {
|
||||
state: ExtensionState;
|
||||
setState: (state: ExtensionState) => void;
|
||||
tabs: ActiveTabInfo[];
|
||||
activeTab?: ActiveTabInfo;
|
||||
bridge: BridgeStatus;
|
||||
refreshTabs: () => Promise<void>;
|
||||
run: (task: () => Promise<void>, success?: string) => Promise<void>;
|
||||
busy: boolean;
|
||||
}
|
||||
|
||||
function tabOrigin(tab?: ActiveTabInfo): string {
|
||||
try {
|
||||
return tab ? new URL(tab.url).origin : '';
|
||||
} catch {
|
||||
return '';
|
||||
}
|
||||
}
|
||||
|
||||
function shortHost(tab?: ActiveTabInfo): string {
|
||||
try {
|
||||
return tab ? new URL(tab.url).host : '未选择页面';
|
||||
} catch {
|
||||
return '未选择页面';
|
||||
}
|
||||
}
|
||||
|
||||
function formatWorkspaceRemaining(expiresAt: number, now: number): string {
|
||||
const remainingSeconds = Math.max(0, Math.ceil((expiresAt - now) / 1_000));
|
||||
if (remainingSeconds < 60) return `${remainingSeconds} 秒`;
|
||||
const minutes = Math.ceil(remainingSeconds / 60);
|
||||
return minutes < 60 ? `${minutes} 分钟` : `${Math.floor(minutes / 60)} 小时 ${minutes % 60} 分钟`;
|
||||
}
|
||||
|
||||
function contextForTab(
|
||||
inspection: BrowserIsolationInspection | undefined,
|
||||
tabId: number | undefined,
|
||||
): BrowserIsolationContext | undefined {
|
||||
return inspection?.contexts.find((context) => tabId && context.tabIds.includes(tabId));
|
||||
}
|
||||
|
||||
function proofLabel(workspace?: BrowserAuthorizationWorkspace): string {
|
||||
if (!workspace) return '尚未验证';
|
||||
if (workspace.proof.level === 'strong') return '强隔离';
|
||||
if (workspace.proof.level === 'conditional') return '条件隔离';
|
||||
return '隔离不足';
|
||||
}
|
||||
|
||||
function relationLabel(value: 'different' | 'same' | 'unknown'): string {
|
||||
if (value === 'different') return '不同';
|
||||
if (value === 'same') return '相同';
|
||||
return '待确认';
|
||||
}
|
||||
|
||||
function authenticationStatusLabel(
|
||||
value: BrowserAuthorizationWorkspace['left']['authentication']['status'],
|
||||
): string {
|
||||
if (value === 'authenticated') return '已识别登录态';
|
||||
if (value === 'unauthenticated') return '未检测到登录态';
|
||||
return '登录信号待识别';
|
||||
}
|
||||
|
||||
function verdictCopy(
|
||||
verdict: NonNullable<BrowserAuthorizationWorkspace['execution']>['verdict'],
|
||||
mode: BrowserAuthorizationMode,
|
||||
): {
|
||||
title: string;
|
||||
detail: string;
|
||||
tone: 'danger' | 'success' | 'warning' | 'muted';
|
||||
} {
|
||||
switch (verdict) {
|
||||
case 'confirmed':
|
||||
return {
|
||||
title: mode === 'vertical' ? '已确认低权限操作生效' : '已确认跨身份数据访问',
|
||||
detail: mode === 'vertical'
|
||||
? '低权限身份发起操作后出现了独立可验证的业务状态变化；是否违反策略仍需结合角色定义。'
|
||||
: '一个身份用自己的登录态取得了另一身份正常响应中的稳定业务数据；是否构成缺陷取决于两身份权限关系与业务策略。',
|
||||
tone: 'warning',
|
||||
};
|
||||
case 'likely':
|
||||
return {
|
||||
title: mode === 'vertical' ? '低权限操作可能被接受' : '观察到跨身份响应吻合',
|
||||
detail: mode === 'vertical'
|
||||
? '低权限探测被服务端接受，但还缺少独立的操作后状态证据。'
|
||||
: '交叉响应与目标身份的正常响应精确吻合，但尚缺稳定归属字段与同权限策略证据。',
|
||||
tone: 'warning',
|
||||
};
|
||||
case 'protected':
|
||||
return {
|
||||
title: '当前样本受到保护',
|
||||
detail: mode === 'vertical'
|
||||
? '正常控制成立，低权限身份执行目标高权限动作时被明确拒绝。'
|
||||
: '双方正常访问成立，两项交叉访问均未取得对方资源。',
|
||||
tone: 'success',
|
||||
};
|
||||
case 'invalid-controls':
|
||||
return { title: '对照样本无效', detail: '正常对照没有建立，不能据此判断授权边界。', tone: 'warning' };
|
||||
default:
|
||||
return { title: '证据不足', detail: '本轮结果不能形成稳定结论，请检查基线和响应语义。', tone: 'muted' };
|
||||
}
|
||||
}
|
||||
|
||||
function confidenceLabel(
|
||||
confidence: NonNullable<BrowserAuthorizationWorkspace['execution']>['confidence'],
|
||||
): string {
|
||||
if (confidence === 'high') return '高';
|
||||
if (confidence === 'medium') return '中';
|
||||
if (confidence === 'low') return '低';
|
||||
return '无';
|
||||
}
|
||||
|
||||
function authorizationOutcomeLabel(value?: string): string {
|
||||
if (value === 'success') return '成功';
|
||||
if (value === 'denied') return '明确拒绝';
|
||||
if (value === 'redirect') return '重定向';
|
||||
if (value === 'client-error') return '客户端错误';
|
||||
if (value === 'server-error') return '服务端错误';
|
||||
if (value === 'opaque') return '响应不可读';
|
||||
if (value === 'completed') return '已完成';
|
||||
if (value === 'failed') return '失败';
|
||||
if (value === 'skipped') return '已跳过';
|
||||
return value || '未执行';
|
||||
}
|
||||
|
||||
function candidateLabel(candidate: BrowserAuthorizationBaselineCandidate): string {
|
||||
const status = candidate.statusCode ? ` · ${candidate.statusCode}` : '';
|
||||
let target = candidate.path;
|
||||
try {
|
||||
const parsed = new URL(candidate.url);
|
||||
target = `${parsed.pathname}${parsed.search}`;
|
||||
} catch {
|
||||
// The bounded path supplied by Yak remains the fallback.
|
||||
}
|
||||
return `${candidate.method} ${target}${status}`;
|
||||
}
|
||||
|
||||
function authorizationCandidateRoute(candidate: BrowserAuthorizationBaselineCandidate): string {
|
||||
try {
|
||||
const parsed = new URL(candidate.url);
|
||||
const normalizedPath = parsed.pathname
|
||||
.split('/')
|
||||
.map((segment) => {
|
||||
if (/^[0-9]+$/.test(segment)) return ':number';
|
||||
if (/^[0-9a-f]{8}-[0-9a-f-]{27,}$/i.test(segment)) return ':uuid';
|
||||
if (/^[0-9a-f]{16,}$/i.test(segment)) return ':opaque';
|
||||
return segment;
|
||||
})
|
||||
.join('/');
|
||||
return [
|
||||
candidate.method.toUpperCase(),
|
||||
normalizedPath,
|
||||
[...parsed.searchParams.keys()].sort().join(','),
|
||||
candidate.resourceType,
|
||||
].join(' ');
|
||||
} catch {
|
||||
return `${candidate.method.toUpperCase()} ${candidate.path} ${candidate.resourceType}`;
|
||||
}
|
||||
}
|
||||
|
||||
function newestComparableAuthorizationPair(
|
||||
left: BrowserAuthorizationBaselineCandidate[],
|
||||
right: BrowserAuthorizationBaselineCandidate[],
|
||||
): { left: BrowserAuthorizationBaselineCandidate; right: BrowserAuthorizationBaselineCandidate } | undefined {
|
||||
const eligibleLeft = left.filter((item) => item.eligible);
|
||||
const eligibleRight = right.filter((item) => item.eligible);
|
||||
const pairs = eligibleLeft.flatMap((leftItem) => eligibleRight
|
||||
.filter((rightItem) => authorizationCandidateRoute(leftItem) === authorizationCandidateRoute(rightItem))
|
||||
.map((rightItem) => ({
|
||||
left: leftItem,
|
||||
right: rightItem,
|
||||
recency: Math.min(leftItem.startedAt, rightItem.startedAt),
|
||||
})));
|
||||
return pairs.sort((a, b) => b.recency - a.recency)[0];
|
||||
}
|
||||
|
||||
export function AuthorizationTestingWorkspace({
|
||||
state,
|
||||
setState,
|
||||
tabs,
|
||||
activeTab,
|
||||
bridge,
|
||||
refreshTabs,
|
||||
run,
|
||||
busy,
|
||||
}: AuthorizationTestingWorkspaceProps) {
|
||||
const eligibleTabs = useMemo(
|
||||
() => tabs.filter((item) => item.url.startsWith('http://') || item.url.startsWith('https://')),
|
||||
[tabs],
|
||||
);
|
||||
const [hydrated, setHydrated] = useState(false);
|
||||
const [ui, dispatch] = useReducer(
|
||||
authorizationWorkspaceUIReducer,
|
||||
INITIAL_AUTHORIZATION_WORKSPACE_UI,
|
||||
);
|
||||
const {
|
||||
mode,
|
||||
leftTabId,
|
||||
rightTabId,
|
||||
leftLabel,
|
||||
rightLabel,
|
||||
inspection,
|
||||
workspace,
|
||||
candidates,
|
||||
selected,
|
||||
capture,
|
||||
selectedPlanCandidateId,
|
||||
canaryPaths,
|
||||
} = ui;
|
||||
const [localError, setLocalError] = useState('');
|
||||
const [identityNotice, setIdentityNotice] = useState('');
|
||||
const [clock, setClock] = useState(Date.now());
|
||||
|
||||
const leftTab = eligibleTabs.find((item) => item.id === leftTabId);
|
||||
const rightTab = eligibleTabs.find((item) => item.id === rightTabId);
|
||||
const leftContext = contextForTab(inspection, leftTabId);
|
||||
const rightContext = contextForTab(inspection, rightTabId);
|
||||
const leftIsolationContextId = leftContext?.contextId || leftTab?.isolationContextId;
|
||||
const rightIsolationContextId = rightContext?.contextId || rightTab?.isolationContextId;
|
||||
const identityContextsSeparated = Boolean(
|
||||
leftIsolationContextId
|
||||
&& rightIsolationContextId
|
||||
&& leftIsolationContextId !== rightIsolationContextId,
|
||||
);
|
||||
const sameOrigin = Boolean(leftTab && rightTab && tabOrigin(leftTab) === tabOrigin(rightTab));
|
||||
const capabilityReady = bridge.state === 'connected'
|
||||
&& Boolean(bridge.capabilities?.includes('yakit.browser_authorization.task'));
|
||||
|
||||
const refreshInspection = useCallback(async () => {
|
||||
const next = await request('isolation.inspect', {
|
||||
tabIds: eligibleTabs.length > 0 ? eligibleTabs.map((item) => item.id) : undefined,
|
||||
});
|
||||
dispatch({ type: 'patch', value: { inspection: next } });
|
||||
}, [eligibleTabs]);
|
||||
|
||||
useEffect(() => {
|
||||
void (async () => {
|
||||
try {
|
||||
const stored = await browser.storage.session.get(SESSION_KEY);
|
||||
dispatch({ type: 'hydrate', value: stored[SESSION_KEY] });
|
||||
} catch {
|
||||
// Session persistence is an ergonomic optimization.
|
||||
} finally {
|
||||
setHydrated(true);
|
||||
}
|
||||
})();
|
||||
}, []);
|
||||
|
||||
useEffect(() => {
|
||||
if (!hydrated || workspace) return;
|
||||
const normalized = normalizeAuthorizationIdentityTabSelection({
|
||||
eligibleTabIds: eligibleTabs.map((item) => item.id),
|
||||
activeTabId: activeTab?.id,
|
||||
leftTabId,
|
||||
rightTabId,
|
||||
});
|
||||
if (normalized.leftTabId !== leftTabId || normalized.rightTabId !== rightTabId) {
|
||||
dispatch({
|
||||
type: 'patch',
|
||||
value: {
|
||||
leftTabId: normalized.leftTabId,
|
||||
rightTabId: normalized.rightTabId,
|
||||
},
|
||||
});
|
||||
}
|
||||
}, [activeTab?.id, eligibleTabs, hydrated, leftTabId, rightTabId, workspace]);
|
||||
|
||||
useEffect(() => {
|
||||
if (!hydrated) return;
|
||||
const value = persistedAuthorizationWorkspaceUI(ui);
|
||||
void browser.storage.session.set({ [SESSION_KEY]: value }).catch(() => undefined);
|
||||
}, [
|
||||
canaryPaths, candidates, hydrated, leftLabel, leftTabId, mode, rightLabel, rightTabId,
|
||||
selected, selectedPlanCandidateId, workspace,
|
||||
]);
|
||||
|
||||
useEffect(() => {
|
||||
void refreshInspection().catch((error) => setLocalError(errorMessage(error)));
|
||||
}, [refreshInspection]);
|
||||
|
||||
useEffect(() => {
|
||||
if (!hydrated || workspace || !leftTab || !rightTab) return;
|
||||
const reason = authorizationIdentityOptionDisabledReason({
|
||||
candidateTabId: rightTab.id,
|
||||
candidateIsolationContextId: rightIsolationContextId,
|
||||
otherTabId: leftTab.id,
|
||||
otherIsolationContextId: leftIsolationContextId,
|
||||
otherLabel: '身份 A',
|
||||
});
|
||||
if (!reason) return;
|
||||
dispatch({ type: 'patch', value: { rightTabId: undefined } });
|
||||
setIdentityNotice(
|
||||
leftTab.id === rightTab.id
|
||||
? '身份 B 已清空：同一个页面不能同时代表两个身份'
|
||||
: '身份 B 已清空：该页面与身份 A 共享同一登录态',
|
||||
);
|
||||
}, [
|
||||
hydrated,
|
||||
leftIsolationContextId,
|
||||
leftTab?.id,
|
||||
rightIsolationContextId,
|
||||
rightTab?.id,
|
||||
workspace,
|
||||
]);
|
||||
|
||||
useEffect(() => {
|
||||
if (!workspace) return;
|
||||
void Promise.all((['left', 'right'] as const).map(async (side) => {
|
||||
const target = workspace[side].target;
|
||||
const status = await request('network.capture.status', target);
|
||||
dispatch({ type: 'capture.update', side, status });
|
||||
})).catch(() => undefined);
|
||||
}, [workspace?.id]);
|
||||
|
||||
useEffect(() => {
|
||||
const listener = (message: unknown) => {
|
||||
const input = message as { action?: string; payload?: { tabId?: number } };
|
||||
if (input?.action !== 'network.capture.changed') return;
|
||||
const side = input.payload?.tabId === workspace?.left.target.tabId
|
||||
? 'left'
|
||||
: input.payload?.tabId === workspace?.right.target.tabId ? 'right' : undefined;
|
||||
if (!side || !workspace) return;
|
||||
void request('network.capture.status', workspace[side].target)
|
||||
.then((status) => dispatch({ type: 'capture.update', side, status }))
|
||||
.catch(() => undefined);
|
||||
};
|
||||
browser.runtime.onMessage.addListener(listener);
|
||||
return () => browser.runtime.onMessage.removeListener(listener);
|
||||
}, [workspace]);
|
||||
|
||||
useEffect(() => {
|
||||
if (!workspace) return undefined;
|
||||
setClock(Date.now());
|
||||
const timer = globalThis.setInterval(() => setClock(Date.now()), 30_000);
|
||||
return () => globalThis.clearInterval(timer);
|
||||
}, [workspace?.id]);
|
||||
|
||||
const resetWorkspace = async () => {
|
||||
dispatch({ type: 'workspace.reset' });
|
||||
setLocalError('');
|
||||
await browser.storage.session.remove(SESSION_KEY).catch(() => undefined);
|
||||
};
|
||||
|
||||
const assignIdentityTab = (side: BrowserAuthorizationSide, nextTabId: number | undefined) => {
|
||||
setLocalError('');
|
||||
setIdentityNotice('');
|
||||
dispatch({
|
||||
type: 'patch',
|
||||
value: side === 'left' ? { leftTabId: nextTabId } : { rightTabId: nextTabId },
|
||||
});
|
||||
};
|
||||
|
||||
const openIncognitoSettings = () => run(async () => {
|
||||
await browser.tabs.create({ url: `chrome://extensions/?id=${browser.runtime.id}` });
|
||||
}, '已打开扩展详情，请开启“允许在无痕模式下运行”');
|
||||
|
||||
const recheckIsolationCapability = () => run(async () => {
|
||||
await refreshTabs();
|
||||
await refreshInspection();
|
||||
}, '浏览器隔离能力已重新检测');
|
||||
|
||||
const createIsolatedIdentity = () => run(async () => {
|
||||
if (!leftTab) throw new Error('请先选择身份 A 的页面');
|
||||
const result = inspection?.browser === 'firefox'
|
||||
? await request('isolation.container.open', { url: leftTab.url, name: rightLabel || '账号 B' })
|
||||
: await request('isolation.incognito.open', { url: leftTab.url });
|
||||
await refreshTabs();
|
||||
dispatch({ type: 'patch', value: { rightTabId: result.tab.id } });
|
||||
await refreshInspection();
|
||||
}, inspection?.browser === 'firefox' ? '已创建独立 Container，请在新页面登录身份 B' : '已打开无痕身份页面，请在新页面登录身份 B');
|
||||
|
||||
const prepareWorkspace = () => run(async () => {
|
||||
setLocalError('');
|
||||
if (!leftTab || !rightTab) throw new Error('请选择身份 A 和身份 B 的页面');
|
||||
if (leftTab.id === rightTab.id) throw new Error('A/B 身份不能使用同一个标签页');
|
||||
if (!sameOrigin) throw new Error('A/B 页面必须属于同一站点 Origin');
|
||||
if (!capabilityReady) throw new Error('当前 Yak 引擎不支持插件授权测试任务，请更新并重新连接引擎');
|
||||
|
||||
const nextState = await request('grant.create', authorizationShareGrantInput(state, [leftTab, rightTab]));
|
||||
setState(nextState);
|
||||
const nextWorkspace = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.workspace.create',
|
||||
{
|
||||
mode,
|
||||
left: { tabId: leftTab.id, frameId: 0, accountLabel: leftLabel.trim() || '账号 A' },
|
||||
right: { tabId: rightTab.id, frameId: 0, accountLabel: rightLabel.trim() || '账号 B' },
|
||||
},
|
||||
);
|
||||
dispatch({ type: 'workspace.initialize', workspace: nextWorkspace });
|
||||
if (nextWorkspace.state === 'ready' || nextWorkspace.state === 'conditional') {
|
||||
const [leftStatus, rightStatus] = await Promise.all([
|
||||
request('network.capture.start', {
|
||||
...nextWorkspace.left.target,
|
||||
captureHeaders: true,
|
||||
captureBody: true,
|
||||
maxEntries: 200,
|
||||
maxBodyBytes: 64 * 1024,
|
||||
}),
|
||||
request('network.capture.start', {
|
||||
...nextWorkspace.right.target,
|
||||
captureHeaders: true,
|
||||
captureBody: true,
|
||||
maxEntries: 200,
|
||||
maxBodyBytes: 64 * 1024,
|
||||
}),
|
||||
]);
|
||||
dispatch({ type: 'capture.replace', capture: { left: leftStatus, right: rightStatus } });
|
||||
}
|
||||
}, 'A/B 身份已验证，双方请求捕获已开始');
|
||||
|
||||
const refreshWorkspaceDocuments = async (): Promise<BrowserAuthorizationWorkspace> => {
|
||||
if (!workspace || !leftTab || !rightTab) throw new Error('请先建立 A/B 工作区');
|
||||
const nextState = await request('grant.refresh');
|
||||
setState(nextState);
|
||||
const grant = nextState.activeGrant;
|
||||
const leftTarget = grant?.targets.find((target) => (
|
||||
target.tabId === workspace.left.target.tabId
|
||||
&& target.frameId === workspace.left.target.frameId
|
||||
));
|
||||
const rightTarget = grant?.targets.find((target) => (
|
||||
target.tabId === workspace.right.target.tabId
|
||||
&& target.frameId === workspace.right.target.frameId
|
||||
));
|
||||
if (!leftTarget || !rightTarget) {
|
||||
throw new Error('当前共享会话已不再包含身份 A/B，请重新建立工作区');
|
||||
}
|
||||
const documentChanged = (
|
||||
leftTarget.documentId !== workspace.left.target.documentId
|
||||
|| rightTarget.documentId !== workspace.right.target.documentId
|
||||
);
|
||||
if (!documentChanged && workspace.expiresAt > Date.now()) return workspace;
|
||||
|
||||
const renewed = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.workspace.create',
|
||||
{
|
||||
mode: workspace.mode,
|
||||
left: {
|
||||
tabId: leftTab.id,
|
||||
frameId: 0,
|
||||
accountLabel: workspace.left.accountLabel || leftLabel.trim() || '账号 A',
|
||||
},
|
||||
right: {
|
||||
tabId: rightTab.id,
|
||||
frameId: 0,
|
||||
accountLabel: workspace.right.accountLabel || rightLabel.trim() || '账号 B',
|
||||
},
|
||||
},
|
||||
);
|
||||
dispatch({ type: 'workspace.initialize', workspace: renewed });
|
||||
const [leftStatus, rightStatus] = await Promise.all([
|
||||
request('network.capture.status', renewed.left.target),
|
||||
request('network.capture.status', renewed.right.target),
|
||||
]);
|
||||
dispatch({ type: 'capture.replace', capture: { left: leftStatus, right: rightStatus } });
|
||||
return renewed;
|
||||
};
|
||||
|
||||
const refreshCandidates = () => run(async () => {
|
||||
const currentWorkspace = await refreshWorkspaceDocuments();
|
||||
const [left, right] = await Promise.all([
|
||||
runBrowserAuthorizationTask<BrowserAuthorizationBaselineCandidate[]>(
|
||||
'authorization.baseline.candidates',
|
||||
{ workspaceId: currentWorkspace.id, side: 'left', limit: 50 },
|
||||
),
|
||||
runBrowserAuthorizationTask<BrowserAuthorizationBaselineCandidate[]>(
|
||||
'authorization.baseline.candidates',
|
||||
{ workspaceId: currentWorkspace.id, side: 'right', limit: 50 },
|
||||
),
|
||||
]);
|
||||
dispatch({
|
||||
type: 'baselines.loaded',
|
||||
candidates: { left, right },
|
||||
selected: {
|
||||
left: left.some((item) => item.id === selected.left)
|
||||
? selected.left
|
||||
: left.find((item) => item.eligible)?.id || '',
|
||||
right: right.some((item) => item.id === selected.right)
|
||||
? selected.right
|
||||
: right.find((item) => item.eligible)?.id || '',
|
||||
},
|
||||
});
|
||||
}, mode === 'horizontal' ? '已读取双方请求，请确认它们属于同一业务动作' : '已读取低权限控制请求与高权限目标动作');
|
||||
|
||||
const bindBaselines = () => run(async () => {
|
||||
if (!workspace || !selected.left || !selected.right) throw new Error('请为 A/B 双方各选择一条正常请求');
|
||||
let next = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.baseline.bind',
|
||||
{ workspaceId: workspace.id, side: 'left', networkRequestId: selected.left },
|
||||
);
|
||||
next = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.baseline.bind',
|
||||
{ workspaceId: workspace.id, side: 'right', networkRequestId: selected.right },
|
||||
);
|
||||
const suggested = next.mode === 'horizontal'
|
||||
? next.baselinePair.resourceCandidates.find((item) => !item.requiresLogicalBinding)
|
||||
: next.baselinePair.operationCandidates.find((item) => item.eligible && !item.requiresDynamicRebuild);
|
||||
dispatch({
|
||||
type: 'baselines.bound',
|
||||
workspace: next,
|
||||
selectedPlanCandidateId: suggested?.id || '',
|
||||
});
|
||||
}, '双方正常请求已封存为授权基线');
|
||||
|
||||
const autoAnalyzeBaselines = () => run(async () => {
|
||||
const currentWorkspace = await refreshWorkspaceDocuments();
|
||||
const [leftCandidates, rightCandidates] = await Promise.all([
|
||||
runBrowserAuthorizationTask<BrowserAuthorizationBaselineCandidate[]>(
|
||||
'authorization.baseline.candidates',
|
||||
{ workspaceId: currentWorkspace.id, side: 'left', limit: 50 },
|
||||
),
|
||||
runBrowserAuthorizationTask<BrowserAuthorizationBaselineCandidate[]>(
|
||||
'authorization.baseline.candidates',
|
||||
{ workspaceId: currentWorkspace.id, side: 'right', limit: 50 },
|
||||
),
|
||||
]);
|
||||
const pair = mode === 'horizontal'
|
||||
? newestComparableAuthorizationPair(leftCandidates, rightCandidates)
|
||||
: {
|
||||
left: leftCandidates.find((item) => item.eligible),
|
||||
right: rightCandidates.find((item) => item.eligible),
|
||||
};
|
||||
if (!pair?.left || !pair.right) {
|
||||
throw new Error(mode === 'horizontal'
|
||||
? '还没有发现 A/B 双方可比较的同类操作。请分别执行一次相同业务动作后重试。'
|
||||
: '还没有同时发现低权限控制请求与高权限目标动作。请在 A/B 页面各执行一次后重试。');
|
||||
}
|
||||
dispatch({
|
||||
type: 'baselines.loaded',
|
||||
candidates: { left: leftCandidates, right: rightCandidates },
|
||||
selected: { left: pair.left.id, right: pair.right.id },
|
||||
});
|
||||
let next = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.baseline.bind',
|
||||
{ workspaceId: currentWorkspace.id, side: 'left', networkRequestId: pair.left.id },
|
||||
);
|
||||
next = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.baseline.bind',
|
||||
{ workspaceId: currentWorkspace.id, side: 'right', networkRequestId: pair.right.id },
|
||||
);
|
||||
const suggested = next.mode === 'horizontal'
|
||||
? next.baselinePair.resourceCandidates.find((item) => !item.requiresLogicalBinding)
|
||||
: next.baselinePair.operationCandidates.find((item) => item.eligible && !item.requiresDynamicRebuild);
|
||||
dispatch({
|
||||
type: 'baselines.bound',
|
||||
workspace: next,
|
||||
selectedPlanCandidateId: suggested?.id || '',
|
||||
});
|
||||
if (next.baselinePair.state !== 'matched') {
|
||||
throw new Error(`最新两项操作不可比较：${next.baselinePair.reasons[0] || '业务路由或请求结构不同'}`);
|
||||
}
|
||||
}, mode === 'horizontal'
|
||||
? '已自动找到并绑定双方最近一次同类业务操作'
|
||||
: '已自动绑定低权限控制请求与高权限目标动作');
|
||||
|
||||
const createPlan = () => run(async () => {
|
||||
if (!workspace || !selectedPlanCandidateId) throw new Error('请选择测试目标');
|
||||
const next = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.plan.create',
|
||||
{
|
||||
workspaceId: workspace.id,
|
||||
candidateId: selectedPlanCandidateId,
|
||||
canaryPaths: canaryPaths.split(',').map((item) => item.trim()).filter(Boolean),
|
||||
},
|
||||
);
|
||||
dispatch({ type: 'workspace.updated', workspace: next });
|
||||
}, '确定性测试计划已生成，请先审阅再执行');
|
||||
|
||||
const executePlan = () => run(async () => {
|
||||
if (!workspace?.plan) throw new Error('请先生成测试计划');
|
||||
if (workspace.plan.state === 'blocked') throw new Error('当前计划被阻止，请根据原因补充证据');
|
||||
const sideEffect = workspace.plan.cases.some((item) => item.sideEffect);
|
||||
const approved = window.confirm(
|
||||
`${workspace.mode === 'vertical' ? '垂直' : '水平'}授权测试将发送 ${workspace.plan.requestBudget} 个真实请求`
|
||||
+ `${sideEffect ? '，其中包含可能改变业务状态的请求' : ''}。仅应对你有权测试的目标继续。`,
|
||||
);
|
||||
if (!approved) return;
|
||||
const next = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.plan.execute',
|
||||
{
|
||||
workspaceId: workspace.id,
|
||||
planId: workspace.plan.id,
|
||||
approveSideEffects: sideEffect,
|
||||
},
|
||||
120_000,
|
||||
);
|
||||
dispatch({ type: 'workspace.updated', workspace: next });
|
||||
}, '授权测试矩阵执行完成');
|
||||
|
||||
const stopCapture = (side: BrowserAuthorizationSide) => run(async () => {
|
||||
if (!workspace) return;
|
||||
const status = await request('network.capture.stop', {
|
||||
tabId: workspace[side].target.tabId,
|
||||
frameId: workspace[side].target.frameId,
|
||||
});
|
||||
dispatch({ type: 'capture.update', side, status });
|
||||
}, `${side === 'left' ? leftLabel : rightLabel} 的请求捕获已停止`);
|
||||
|
||||
const refreshWorkspace = () => run(async () => {
|
||||
if (!workspace) return;
|
||||
const currentWorkspace = await refreshWorkspaceDocuments();
|
||||
const next = await runBrowserAuthorizationTask<BrowserAuthorizationWorkspace>(
|
||||
'authorization.workspace.inspect',
|
||||
{ workspaceId: currentWorkspace.id, revalidate: true },
|
||||
);
|
||||
dispatch({ type: 'workspace.updated', workspace: next });
|
||||
}, '工作区状态已复核');
|
||||
|
||||
const planCandidates = workspace?.mode === 'horizontal'
|
||||
? workspace.baselinePair.resourceCandidates
|
||||
: workspace?.baselinePair.operationCandidates;
|
||||
const executionCopy = workspace?.execution
|
||||
? verdictCopy(workspace.execution.verdict, workspace.mode)
|
||||
: undefined;
|
||||
const incognitoAccessDenied = inspection?.browser === 'chromium'
|
||||
&& inspection.capabilities.incognitoAccess === 'denied';
|
||||
const firefoxContainerUnavailable = inspection?.browser === 'firefox'
|
||||
&& !inspection.capabilities.containerTabs;
|
||||
const identityStageReady = Boolean(
|
||||
leftTab && rightTab && sameOrigin && identityContextsSeparated && capabilityReady,
|
||||
);
|
||||
const prepareHint = !leftTab
|
||||
? '先选择当前登录页作为身份 A'
|
||||
: !rightTab
|
||||
? '还需要一个隔离登录的身份 B'
|
||||
: !sameOrigin
|
||||
? 'A/B 页面必须属于同一站点'
|
||||
: !leftIsolationContextId || !rightIsolationContextId
|
||||
? '正在确认两个页面的登录态边界'
|
||||
: !identityContextsSeparated
|
||||
? 'A/B 页面仍然共享同一登录态'
|
||||
: !capabilityReady
|
||||
? '请先连接支持授权测试的 Yak 引擎'
|
||||
: '两个身份页面已就绪';
|
||||
|
||||
return <div className="section-view authorization-workspace">
|
||||
<div className="page-heading authorization-heading">
|
||||
<div>
|
||||
<span className="page-eyebrow">Browser-native authorization testing</span>
|
||||
<h1>授权测试工作区</h1>
|
||||
<p>从已经登录的两个页面建立身份隔离证明，录制双方正常请求，再由 Yak 生成并执行最小交叉矩阵。</p>
|
||||
</div>
|
||||
<div className="authorization-heading-actions">
|
||||
<span className={`authorization-engine-state ${capabilityReady ? 'ready' : ''}`}>
|
||||
<i />{capabilityReady ? '引擎可用' : '引擎能力不可用'}
|
||||
</span>
|
||||
{workspace && <span
|
||||
className="authorization-workspace-lifetime"
|
||||
title={`引擎实例 ${workspace.engineInstanceId} · 到期时间 ${new Date(workspace.expiresAt).toLocaleString()}`}
|
||||
>
|
||||
工作区剩余 {formatWorkspaceRemaining(workspace.expiresAt, clock)}
|
||||
</span>}
|
||||
{workspace && <Button variant="ghost" disabled={busy} onClick={() => void refreshWorkspace()}>
|
||||
<RefreshCw size={15} />复核状态
|
||||
</Button>}
|
||||
{workspace && bridge.capabilities?.includes('yakit.browser_authorization.open') && <Button
|
||||
variant="ghost"
|
||||
disabled={busy}
|
||||
onClick={() => void run(
|
||||
async () => { await request('authorization.yakit.open', { workspaceId: workspace.id }); },
|
||||
'已在 Yakit 打开完整证据工作区',
|
||||
)}
|
||||
>
|
||||
<ExternalLink size={15} />在 Yakit 深入分析
|
||||
</Button>}
|
||||
<Button variant="ghost" disabled={busy} onClick={() => void resetWorkspace()}>
|
||||
<RotateCcw size={15} />新建
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{localError && <div className="authorization-inline-error">
|
||||
<AlertTriangle size={16} />{localError}
|
||||
<Button size="sm" variant="ghost" onClick={() => setLocalError('')}>关闭</Button>
|
||||
</div>}
|
||||
|
||||
<div className="authorization-flow-strip" aria-label="授权测试步骤">
|
||||
{[
|
||||
['1', '身份与隔离', Boolean(workspace)],
|
||||
['2', '正常请求', Boolean(workspace?.baselines.left && workspace?.baselines.right)],
|
||||
['3', '确定性计划', Boolean(workspace?.plan)],
|
||||
['4', '结果证据', Boolean(workspace?.execution)],
|
||||
].map(([index, label, complete], position) => <div className={complete ? 'complete' : ''} key={String(label)}>
|
||||
<span>{complete ? <Check size={13} /> : index}</span><strong>{label}</strong>
|
||||
{position < 3 && <ArrowRight size={14} />}
|
||||
</div>)}
|
||||
</div>
|
||||
|
||||
{!workspace ? <section className="authorization-identity-stage">
|
||||
<div className="authorization-mode">
|
||||
<span>测试类型</span>
|
||||
<div role="radiogroup" aria-label="测试类型">
|
||||
<button type="button" role="radio" aria-checked={mode === 'horizontal'} className={mode === 'horizontal' ? 'active' : ''} onClick={() => dispatch({ type: 'patch', value: { mode: 'horizontal' } })}>
|
||||
<strong>水平越权</strong>
|
||||
</button>
|
||||
<button type="button" role="radio" aria-checked={mode === 'vertical'} className={mode === 'vertical' ? 'active' : ''} onClick={() => dispatch({ type: 'patch', value: { mode: 'vertical' } })}>
|
||||
<strong>垂直越权</strong>
|
||||
</button>
|
||||
</div>
|
||||
<small className="authorization-mode-description">{mode === 'horizontal'
|
||||
? '同权限不同账号，交换资源标识'
|
||||
: '低权限身份尝试高权限业务动作'}</small>
|
||||
</div>
|
||||
|
||||
<div className="authorization-identity-guide" aria-label="准备两个身份">
|
||||
<span className={leftTab ? 'complete' : 'current'}><b>{leftTab ? <Check size={12} /> : '1'}</b>当前登录页作为 A</span>
|
||||
<ArrowRight size={14} />
|
||||
<span className={rightTab ? 'complete' : leftTab ? 'current' : ''}><b>{rightTab ? <Check size={12} /> : '2'}</b>隔离页面登录 B</span>
|
||||
<ArrowRight size={14} />
|
||||
<span className={identityStageReady ? 'complete' : ''}><b>{identityStageReady ? <Check size={12} /> : '3'}</b>验证并开始捕获</span>
|
||||
</div>
|
||||
|
||||
<div className="authorization-identity-rail">
|
||||
<IdentitySlot
|
||||
side="A"
|
||||
title={mode === 'vertical' ? '低权限身份' : '身份 A'}
|
||||
label={leftLabel}
|
||||
setLabel={(value) => dispatch({ type: 'patch', value: { leftLabel: value } })}
|
||||
tabId={leftTabId}
|
||||
setTabId={(value) => assignIdentityTab('left', value)}
|
||||
tabs={eligibleTabs}
|
||||
context={leftContext}
|
||||
disabledReason={(item) => authorizationIdentityOptionDisabledReason({
|
||||
candidateTabId: item.id,
|
||||
candidateIsolationContextId: contextForTab(inspection, item.id)?.contextId || item.isolationContextId,
|
||||
otherTabId: rightTabId,
|
||||
otherIsolationContextId: rightIsolationContextId,
|
||||
otherLabel: '身份 B',
|
||||
})}
|
||||
emptyHint="选择你现在已经登录的页面，作为基准身份 A"
|
||||
/>
|
||||
<div className="authorization-isolation-axis" aria-live="polite">
|
||||
<Fingerprint size={23} />
|
||||
<strong>{incognitoAccessDenied ? '需要无痕权限' : !leftTab ? '先准备身份 A' : !rightTab ? '再准备身份 B' : '浏览器隔离'}</strong>
|
||||
<span className={sameOrigin ? 'valid' : ''}>{sameOrigin ? '已是同一站点' : leftTab ? 'B 需打开同一站点' : '选择当前登录页'}</span>
|
||||
<span>{identityContextsSeparated ? '浏览上下文已分离' : rightTab ? '等待隔离验证' : 'A/B 不能共用登录态'}</span>
|
||||
{incognitoAccessDenied ? <div className="authorization-isolation-actions">
|
||||
<Button size="sm" variant="secondary" disabled={busy} onClick={() => void openIncognitoSettings()}>
|
||||
<ExternalLink size={14} />开启无痕权限
|
||||
</Button>
|
||||
<button type="button" disabled={busy} onClick={() => void recheckIsolationCapability()}>已开启，重新检测</button>
|
||||
</div> : <Button
|
||||
size="sm"
|
||||
variant="secondary"
|
||||
disabled={busy || !leftTab || !inspection || firefoxContainerUnavailable}
|
||||
onClick={() => void createIsolatedIdentity()}
|
||||
>
|
||||
<UserRoundPlus size={14} />{!inspection
|
||||
? '正在检测隔离能力'
|
||||
: inspection.browser === 'firefox'
|
||||
? `${rightTab ? '重新创建' : '创建'} Container 身份 B`
|
||||
: `${rightTab ? '重新创建' : '创建'}无痕身份 B`}
|
||||
</Button>}
|
||||
</div>
|
||||
<IdentitySlot
|
||||
side="B"
|
||||
title={mode === 'vertical' ? '高权限身份' : '身份 B'}
|
||||
label={rightLabel}
|
||||
setLabel={(value) => dispatch({ type: 'patch', value: { rightLabel: value } })}
|
||||
tabId={rightTabId}
|
||||
setTabId={(value) => assignIdentityTab('right', value)}
|
||||
tabs={eligibleTabs}
|
||||
context={rightContext}
|
||||
disabledReason={(item) => authorizationIdentityOptionDisabledReason({
|
||||
candidateTabId: item.id,
|
||||
candidateIsolationContextId: contextForTab(inspection, item.id)?.contextId || item.isolationContextId,
|
||||
otherTabId: leftTabId,
|
||||
otherIsolationContextId: leftIsolationContextId,
|
||||
otherLabel: '身份 A',
|
||||
})}
|
||||
emptyHint={identityNotice || '在中间创建隔离页面，登录另一个账号后会自动选为身份 B'}
|
||||
/>
|
||||
</div>
|
||||
|
||||
<div className="authorization-prepare-bar">
|
||||
<div>
|
||||
<LockKeyhole size={18} />
|
||||
<span><strong>原始 Cookie、Storage 与请求值不会进入界面</strong><small>Yak 只接收短时上下文句柄、字段指纹和用户选择的真实请求。</small></span>
|
||||
</div>
|
||||
<div className="authorization-prepare-action">
|
||||
<small>{prepareHint}</small>
|
||||
<Button
|
||||
variant="primary"
|
||||
disabled={busy || !identityStageReady}
|
||||
onClick={() => void prepareWorkspace()}
|
||||
>
|
||||
<Fingerprint size={16} />验证身份并开始捕获
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
</section> : <>
|
||||
<section className={`authorization-proof-band ${workspace.state}`}>
|
||||
<div>
|
||||
{workspace.proof.level === 'strong' ? <CircleCheck size={20} /> : <ShieldAlert size={20} />}
|
||||
<span><strong>{proofLabel(workspace)}</strong><small>{workspace.proof.reasons[0] || '身份隔离证明已建立'}</small></span>
|
||||
</div>
|
||||
<dl>
|
||||
<div><dt>Origin</dt><dd>{workspace.proof.sameOrigin ? '一致' : '不一致'}</dd></div>
|
||||
<div><dt>Cookie Store</dt><dd>{relationLabel(workspace.proof.cookieStoreRelation)}</dd></div>
|
||||
<div><dt>账号证据</dt><dd>{relationLabel(workspace.proof.accountEvidenceRelation)}</dd></div>
|
||||
<div><dt>请求认证</dt><dd>{relationLabel(workspace.proof.requestCredentialRelation)}</dd></div>
|
||||
<div><dt>刷新复核</dt><dd>{workspace.proof.refreshCheck === 'passed'
|
||||
? '通过'
|
||||
: workspace.proof.refreshCheck === 'not-required' ? '无需' : '失败'}</dd></div>
|
||||
</dl>
|
||||
</section>
|
||||
|
||||
{workspace.state === 'stale' || workspace.state === 'blocked' ? <section className="authorization-recovery">
|
||||
<ShieldAlert size={20} />
|
||||
<div><strong>{workspace.state === 'stale' ? '工作区已经失效' : '当前身份隔离不足'}</strong><p>{workspace.recovery?.message || workspace.staleReason || workspace.proof.reasons.join('；')}</p></div>
|
||||
<Button variant="primary" onClick={() => void resetWorkspace()}>重新选择身份</Button>
|
||||
</section> : <>
|
||||
<section className="authorization-baseline-stage">
|
||||
<div className="authorization-section-heading">
|
||||
<div><span>STEP 02</span><h2>执行目标动作，插件自动识别</h2><p>{mode === 'horizontal'
|
||||
? '分别在 A/B 页面执行一次相同业务动作；插件会从最近请求中自动配对同一路由，不需要手工挑四项矩阵。'
|
||||
: '在 A 页面执行低权限正常动作，在 B 页面执行目标高权限动作；插件会自动封存最近样本。'}</p></div>
|
||||
<Button variant="primary" disabled={busy} onClick={() => void autoAnalyzeBaselines()}>
|
||||
<RefreshCw size={15} />自动分析最新操作
|
||||
</Button>
|
||||
</div>
|
||||
<div className="authorization-baseline-lanes">
|
||||
{(['left', 'right'] as const).map((side) => {
|
||||
const slot = workspace[side];
|
||||
const sideCandidates = candidates[side];
|
||||
const sideCapture = capture[side];
|
||||
return <div className="authorization-baseline-lane" key={side}>
|
||||
<header>
|
||||
<span>{side === 'left' ? 'A' : 'B'}</span>
|
||||
<div><strong>{slot.accountLabel || (side === 'left' ? leftLabel : rightLabel)}</strong><small>{authenticationStatusLabel(slot.authentication.status)} · {shortHost(side === 'left' ? leftTab : rightTab)}</small></div>
|
||||
<span className={`authorization-capture-dot ${sideCapture?.active ? 'active' : ''}`}>
|
||||
<i />{sideCapture?.active ? `${sideCapture.count} 条` : '已停止'}
|
||||
</span>
|
||||
{sideCapture?.active && <Button size="icon" variant="ghost" title="停止捕获" onClick={() => void stopCapture(side)}><Square size={14} /></Button>}
|
||||
</header>
|
||||
{sideCandidates.length === 0 ? <div className="authorization-candidate-empty">
|
||||
<Play size={17} /><span>回到该页面执行一次业务动作，再点击上方“自动分析最新操作”。</span>
|
||||
</div> : <div className="authorization-candidate-list">
|
||||
{sideCandidates.slice(0, 8).map((candidate) => <label className={`${selected[side] === candidate.id ? 'selected' : ''} ${candidate.eligible ? '' : 'disabled'}`} key={candidate.id}>
|
||||
<input
|
||||
type="radio"
|
||||
name={`authorization-${side}-candidate`}
|
||||
checked={selected[side] === candidate.id}
|
||||
disabled={!candidate.eligible}
|
||||
onChange={() => dispatch({
|
||||
type: 'patch',
|
||||
value: { selected: { ...selected, [side]: candidate.id } },
|
||||
})}
|
||||
/>
|
||||
<span><strong>{candidateLabel(candidate)}</strong><small>{candidate.eligible ? new URL(candidate.url).host : candidate.reasons[0]}</small></span>
|
||||
</label>)}
|
||||
</div>}
|
||||
</div>;
|
||||
})}
|
||||
</div>
|
||||
<div className="authorization-baseline-confirm">
|
||||
<span>{selected.left && selected.right ? '如需调整，可在上方手动选择其他请求' : '自动识别失败时，可展开候选手动选择'}</span>
|
||||
<Button variant="secondary" disabled={busy || !selected.left || !selected.right} onClick={() => void bindBaselines()}>
|
||||
<Check size={15} />使用当前选择
|
||||
</Button>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
{workspace.baselinePair.state !== 'waiting' && <section className="authorization-plan-stage">
|
||||
<div className="authorization-section-heading">
|
||||
<div><span>STEP 03</span><h2>{mode === 'horizontal' ? '选择资源边界' : '选择高权限动作'}</h2><p>{workspace.baselinePair.reasons[0]}</p></div>
|
||||
<span className={`authorization-pair-state ${workspace.baselinePair.state}`}>{workspace.baselinePair.state === 'matched' ? '基线已匹配' : '基线不匹配'}</span>
|
||||
</div>
|
||||
{workspace.baselinePair.state === 'matched' && planCandidates && planCandidates.length > 0 ? <div className="authorization-plan-layout">
|
||||
<div className="authorization-plan-candidates">
|
||||
{planCandidates.map((candidate) => {
|
||||
const blocked = 'requiresLogicalBinding' in candidate
|
||||
? candidate.requiresLogicalBinding
|
||||
: !candidate.eligible || candidate.requiresDynamicRebuild;
|
||||
const title = 'location' in candidate
|
||||
? `${candidate.location}.${candidate.path}`
|
||||
: `${candidate.method} ${candidate.path}`;
|
||||
const meta = 'confidence' in candidate
|
||||
? `${candidate.source === 'logical' ? '明文逻辑字段' : '线上字段'} · ${candidate.confidence}`
|
||||
: `${candidate.sideEffect ? '可能有副作用' : '只读候选'}${candidate.requiresDynamicRebuild ? ' · 需要动态重建' : ''}`;
|
||||
return <button
|
||||
key={candidate.id}
|
||||
className={selectedPlanCandidateId === candidate.id ? 'selected' : ''}
|
||||
disabled={blocked}
|
||||
onClick={() => dispatch({
|
||||
type: 'patch',
|
||||
value: { selectedPlanCandidateId: candidate.id },
|
||||
})}
|
||||
>
|
||||
<span className="authorization-radio-mark" />
|
||||
<span><strong>{title}</strong><small>{meta}</small><em>{candidate.reasons[0]}</em></span>
|
||||
{blocked && <span className="authorization-advanced-label">需明文网关</span>}
|
||||
</button>;
|
||||
})}
|
||||
</div>
|
||||
<div className="authorization-plan-review">
|
||||
<label><span>响应语义路径 <small>可选，逗号分隔</small></span><input value={canaryPaths} onChange={(event) => dispatch({ type: 'patch', value: { canaryPaths: event.target.value } })} placeholder="data.owner.id, data.account" /></label>
|
||||
{!workspace.plan ? <div className="authorization-plan-placeholder">
|
||||
<LockKeyhole size={19} /><strong>先编译，后发送</strong><p>Yak 会固定请求预算、交叉方向和只允许替换的字段，不由 UI 临时拼接请求。</p>
|
||||
</div> : <div className={`authorization-plan-summary ${workspace.plan.state}`}>
|
||||
<strong>{workspace.plan.state === 'blocked' ? '计划被阻止' : `${workspace.plan.requestBudget} 个真实请求`}</strong>
|
||||
<span>{workspace.plan.cases.map((item) => item.label).join(' → ')}</span>
|
||||
<small>{workspace.plan.reasons[0]}</small>
|
||||
</div>}
|
||||
<div className="authorization-plan-actions">
|
||||
<Button disabled={busy || !selectedPlanCandidateId} onClick={() => void createPlan()}>生成测试计划</Button>
|
||||
<Button variant="primary" disabled={busy || !workspace.plan || workspace.plan.state === 'blocked'} onClick={() => void executePlan()}>
|
||||
<Play size={15} />审阅并执行
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
</div> : workspace.baselinePair.state === 'matched' ? <div className="authorization-no-candidates">
|
||||
<ShieldAlert size={20} /><div><strong>没有可直接执行的确定性候选</strong><p>当前请求可能使用加密 Body、签名或动态字段。请先在“网络活动 → 明文网关”建立转换证据，再回到这里刷新工作区。</p></div>
|
||||
<a href="#network"><ExternalLink size={14} />打开明文网关</a>
|
||||
</div> : <div className="authorization-no-candidates">
|
||||
<AlertTriangle size={20} /><div><strong>A/B 不是同一类业务请求</strong><p>{workspace.baselinePair.reasons.join('；')}</p></div>
|
||||
</div>}
|
||||
</section>}
|
||||
|
||||
{workspace.execution && executionCopy && <section className={`authorization-result ${executionCopy.tone}`}>
|
||||
<header>
|
||||
<div><Fingerprint size={23} /><span><strong>{executionCopy.title}</strong><small>{executionCopy.detail}</small></span></div>
|
||||
<div><strong>{confidenceLabel(workspace.execution.confidence)}</strong><small>证据置信度</small></div>
|
||||
</header>
|
||||
<div className="authorization-result-cases">
|
||||
{workspace.execution.cases.map((item, index) => <div key={item.id}>
|
||||
<span>{String(index + 1).padStart(2, '0')}</span>
|
||||
<div><strong>{item.label}</strong><small>{item.result ? `${item.result.status} ${item.result.statusText} · ${compactDuration(item.result.durationMs)}` : item.error || authorizationOutcomeLabel(item.state)}</small></div>
|
||||
<em className={item.result?.outcome || item.state}>{authorizationOutcomeLabel(item.result?.outcome || item.state)}</em>
|
||||
</div>)}
|
||||
</div>
|
||||
{workspace.execution.reasons.length > 0 && <p>{workspace.execution.reasons.join('；')}</p>}
|
||||
{workspace.execution.evidenceAvailable && <AuthorizationEvidenceWorkbench
|
||||
workspace={workspace}
|
||||
onWorkspaceChange={(next) => dispatch({ type: 'workspace.updated', workspace: next })}
|
||||
/>}
|
||||
</section>}
|
||||
</>}
|
||||
</>}
|
||||
</div>;
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
import type { ActiveTabInfo, BrowserIsolationContext } from '@/types/models';
|
||||
|
||||
function shortPageAddress(tab: ActiveTabInfo): string {
|
||||
try {
|
||||
const parsed = new URL(tab.url);
|
||||
return `${parsed.host}${parsed.pathname}${parsed.search}`;
|
||||
} catch {
|
||||
return tab.url;
|
||||
}
|
||||
}
|
||||
|
||||
function contextKindLabel(
|
||||
context: BrowserIsolationContext | undefined,
|
||||
selectedTab: ActiveTabInfo | undefined,
|
||||
): string {
|
||||
if (!selectedTab) return '等待选择页面';
|
||||
switch (context?.kind) {
|
||||
case 'chrome-incognito-store': return '无痕隔离上下文';
|
||||
case 'firefox-container':
|
||||
return context.containerName ? `Container · ${context.containerName}` : 'Container 隔离上下文';
|
||||
case 'managed-ephemeral-profile': return '独立浏览器 Profile';
|
||||
case 'verified-tab-local': return '标签页局部上下文';
|
||||
case 'sequential-auth-snapshot': return '顺序身份快照';
|
||||
default: return selectedTab.incognito ? '无痕浏览上下文' : '普通浏览上下文';
|
||||
}
|
||||
}
|
||||
|
||||
function windowKindLabel(tab: ActiveTabInfo): string {
|
||||
return tab.incognito ? '无痕窗口' : '普通窗口';
|
||||
}
|
||||
|
||||
export function IdentitySlot({
|
||||
side, title, label, setLabel, tabId, setTabId, tabs, context, disabledReason, emptyHint,
|
||||
}: {
|
||||
side: 'A' | 'B';
|
||||
title: string;
|
||||
label: string;
|
||||
setLabel: (value: string) => void;
|
||||
tabId?: number;
|
||||
setTabId: (value: number | undefined) => void;
|
||||
tabs: ActiveTabInfo[];
|
||||
context?: BrowserIsolationContext;
|
||||
disabledReason: (tab: ActiveTabInfo) => string | undefined;
|
||||
emptyHint: string;
|
||||
}) {
|
||||
const selectedTab = tabs.find((item) => item.id === tabId);
|
||||
return <div className={`authorization-identity-slot ${selectedTab ? 'is-selected' : 'is-empty'}`}>
|
||||
<header><span>{side}</span><div><strong>{title}</strong><small>{contextKindLabel(context, selectedTab)}</small></div></header>
|
||||
<label><span>账号备注</span><input value={label} maxLength={80} onChange={(event) => setLabel(event.target.value)} placeholder={side === 'A' ? '例如：普通用户' : '例如：另一个用户'} /></label>
|
||||
<label><span>{side === 'A' ? '当前已登录页面' : '另一个已登录页面'}</span><select
|
||||
aria-label={`身份 ${side} 的已登录页面`}
|
||||
value={selectedTab?.id || ''}
|
||||
onChange={(event) => setTabId(event.target.value ? Number(event.target.value) : undefined)}
|
||||
>
|
||||
<option value="">{side === 'A' ? '选择当前登录页面' : '选择页面，或在中间创建隔离身份'}</option>
|
||||
{tabs.map((item) => {
|
||||
const reason = disabledReason(item);
|
||||
return <option value={item.id} key={item.id} disabled={Boolean(reason)}>
|
||||
{item.title} · {shortPageAddress(item)} · {windowKindLabel(item)}{reason ? ` · ${reason}` : ''}
|
||||
</option>;
|
||||
})}
|
||||
</select></label>
|
||||
<div className="authorization-identity-meta">
|
||||
<span><i className={context?.level || ''} />{selectedTab
|
||||
? context?.level === 'strong'
|
||||
? '强隔离上下文'
|
||||
: context?.level === 'conditional'
|
||||
? '条件隔离上下文'
|
||||
: '隔离待验证'
|
||||
: '尚未选择页面'}</span>
|
||||
<code title={selectedTab?.url || emptyHint}>
|
||||
{selectedTab ? `${windowKindLabel(selectedTab)} · ${selectedTab.url}` : emptyHint}
|
||||
</code>
|
||||
</div>
|
||||
</div>;
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,96 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import {
|
||||
authorizationIdentityOptionDisabledReason,
|
||||
normalizeAuthorizationIdentityTabSelection,
|
||||
} from './identity-selection';
|
||||
|
||||
describe('normalizeAuthorizationIdentityTabSelection', () => {
|
||||
it('moves the only surviving persisted page to identity A', () => {
|
||||
expect(normalizeAuthorizationIdentityTabSelection({
|
||||
eligibleTabIds: [22],
|
||||
activeTabId: 22,
|
||||
leftTabId: 11,
|
||||
rightTabId: 22,
|
||||
})).toEqual({
|
||||
leftTabId: 22,
|
||||
rightTabId: undefined,
|
||||
});
|
||||
});
|
||||
|
||||
it('clears stale selections without visually falling back to another page', () => {
|
||||
expect(normalizeAuthorizationIdentityTabSelection({
|
||||
eligibleTabIds: [],
|
||||
leftTabId: 11,
|
||||
rightTabId: 22,
|
||||
})).toEqual({
|
||||
leftTabId: undefined,
|
||||
rightTabId: undefined,
|
||||
});
|
||||
});
|
||||
|
||||
it('keeps two different valid user selections', () => {
|
||||
expect(normalizeAuthorizationIdentityTabSelection({
|
||||
eligibleTabIds: [11, 22],
|
||||
activeTabId: 22,
|
||||
leftTabId: 11,
|
||||
rightTabId: 22,
|
||||
})).toEqual({
|
||||
leftTabId: 11,
|
||||
rightTabId: 22,
|
||||
});
|
||||
});
|
||||
|
||||
it('uses the active page for A while preserving a different B page', () => {
|
||||
expect(normalizeAuthorizationIdentityTabSelection({
|
||||
eligibleTabIds: [11, 22],
|
||||
activeTabId: 11,
|
||||
leftTabId: 99,
|
||||
rightTabId: 22,
|
||||
})).toEqual({
|
||||
leftTabId: 11,
|
||||
rightTabId: 22,
|
||||
});
|
||||
});
|
||||
|
||||
it('does not automatically treat a second ordinary tab as identity B', () => {
|
||||
expect(normalizeAuthorizationIdentityTabSelection({
|
||||
eligibleTabIds: [11, 22],
|
||||
activeTabId: 11,
|
||||
})).toEqual({
|
||||
leftTabId: 11,
|
||||
rightTabId: undefined,
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('authorizationIdentityOptionDisabledReason', () => {
|
||||
it('disables the exact page already assigned to the other identity', () => {
|
||||
expect(authorizationIdentityOptionDisabledReason({
|
||||
candidateTabId: 11,
|
||||
candidateIsolationContextId: 'profile:normal',
|
||||
otherTabId: 11,
|
||||
otherIsolationContextId: 'profile:normal',
|
||||
otherLabel: '身份 A',
|
||||
})).toBe('已用于身份 A');
|
||||
});
|
||||
|
||||
it('disables another page that shares the other identity login context', () => {
|
||||
expect(authorizationIdentityOptionDisabledReason({
|
||||
candidateTabId: 22,
|
||||
candidateIsolationContextId: 'profile:normal',
|
||||
otherTabId: 11,
|
||||
otherIsolationContextId: 'profile:normal',
|
||||
otherLabel: '身份 A',
|
||||
})).toBe('与身份 A 共享登录态');
|
||||
});
|
||||
|
||||
it('keeps pages from another isolation context selectable', () => {
|
||||
expect(authorizationIdentityOptionDisabledReason({
|
||||
candidateTabId: 22,
|
||||
candidateIsolationContextId: 'profile:incognito',
|
||||
otherTabId: 11,
|
||||
otherIsolationContextId: 'profile:normal',
|
||||
otherLabel: '身份 A',
|
||||
})).toBeUndefined();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,67 @@
|
||||
export interface AuthorizationIdentityTabSelection {
|
||||
leftTabId?: number;
|
||||
rightTabId?: number;
|
||||
}
|
||||
|
||||
export interface NormalizeAuthorizationIdentityTabSelectionInput
|
||||
extends AuthorizationIdentityTabSelection {
|
||||
eligibleTabIds: readonly number[];
|
||||
activeTabId?: number;
|
||||
}
|
||||
|
||||
export interface AuthorizationIdentityOptionConflictInput {
|
||||
candidateTabId: number;
|
||||
candidateIsolationContextId?: string;
|
||||
otherTabId?: number;
|
||||
otherIsolationContextId?: string;
|
||||
otherLabel: string;
|
||||
}
|
||||
|
||||
export function authorizationIdentityOptionDisabledReason({
|
||||
candidateTabId,
|
||||
candidateIsolationContextId,
|
||||
otherTabId,
|
||||
otherIsolationContextId,
|
||||
otherLabel,
|
||||
}: AuthorizationIdentityOptionConflictInput): string | undefined {
|
||||
if (otherTabId !== undefined && candidateTabId === otherTabId) {
|
||||
return `已用于${otherLabel}`;
|
||||
}
|
||||
if (
|
||||
candidateIsolationContextId
|
||||
&& otherIsolationContextId
|
||||
&& candidateIsolationContextId === otherIsolationContextId
|
||||
) {
|
||||
return `与${otherLabel} 共享登录态`;
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
|
||||
export function normalizeAuthorizationIdentityTabSelection({
|
||||
eligibleTabIds,
|
||||
activeTabId,
|
||||
leftTabId,
|
||||
rightTabId,
|
||||
}: NormalizeAuthorizationIdentityTabSelectionInput): AuthorizationIdentityTabSelection {
|
||||
const available = new Set(
|
||||
eligibleTabIds.filter((tabId) => Number.isSafeInteger(tabId) && tabId > 0),
|
||||
);
|
||||
const existing = (tabId?: number): number | undefined => (
|
||||
tabId !== undefined && available.has(tabId) ? tabId : undefined
|
||||
);
|
||||
|
||||
let left = existing(leftTabId);
|
||||
let right = existing(rightTabId);
|
||||
|
||||
if (left !== undefined && left === right) right = undefined;
|
||||
|
||||
if (left === undefined) {
|
||||
left = existing(activeTabId) ?? right ?? eligibleTabIds.find((tabId) => available.has(tabId));
|
||||
if (left === right) right = undefined;
|
||||
}
|
||||
|
||||
return {
|
||||
leftTabId: left,
|
||||
rightTabId: right,
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,262 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import type { BrowserAuthorizationWorkspace } from '../engine';
|
||||
import {
|
||||
authorizationWorkspaceUIReducer,
|
||||
authorizationWorkspaceStage,
|
||||
INITIAL_AUTHORIZATION_WORKSPACE_UI,
|
||||
normalizePersistedAuthorizationWorkspaceUI,
|
||||
persistedAuthorizationWorkspaceUI,
|
||||
} from './workspace-reducer';
|
||||
|
||||
function fixtureWorkspace(): BrowserAuthorizationWorkspace {
|
||||
return {
|
||||
version: 1,
|
||||
id: 'workspace-1',
|
||||
engineInstanceId: 'engine-1',
|
||||
mode: 'horizontal',
|
||||
state: 'ready',
|
||||
left: {
|
||||
accountLabel: '账号 A',
|
||||
origin: 'https://example.test',
|
||||
target: { tabId: 11, frameId: 0, documentId: 'document-a' },
|
||||
authentication: { status: 'authenticated', cookieCount: 1, storageEntryCount: 0 },
|
||||
},
|
||||
right: {
|
||||
accountLabel: '账号 B',
|
||||
origin: 'https://example.test',
|
||||
target: { tabId: 22, frameId: 0, documentId: 'document-b' },
|
||||
authentication: { status: 'authenticated', cookieCount: 1, storageEntryCount: 0 },
|
||||
},
|
||||
proof: {
|
||||
level: 'strong',
|
||||
sameOrigin: true,
|
||||
cookieStoreRelation: 'different',
|
||||
accountEvidenceRelation: 'different',
|
||||
requestCredentialRelation: 'different',
|
||||
refreshCheck: 'passed',
|
||||
reasons: ['隔离成立'],
|
||||
},
|
||||
baselines: {},
|
||||
baselinePair: {
|
||||
state: 'waiting',
|
||||
reasons: ['等待正常请求'],
|
||||
resourceCandidates: [],
|
||||
operationCandidates: [],
|
||||
},
|
||||
expiresAt: Date.now() + 60_000,
|
||||
};
|
||||
}
|
||||
|
||||
describe('authorization workspace UI reducer', () => {
|
||||
it('initializes a renewed workspace and clears evidence tied to the old document', () => {
|
||||
const workspace = { id: 'renewed' } as BrowserAuthorizationWorkspace;
|
||||
const previous = {
|
||||
...INITIAL_AUTHORIZATION_WORKSPACE_UI,
|
||||
candidates: { left: [{ id: 'old-left' }], right: [{ id: 'old-right' }] } as never,
|
||||
selected: { left: 'old-left', right: 'old-right' },
|
||||
selectedPlanCandidateId: 'old-plan',
|
||||
};
|
||||
|
||||
const next = authorizationWorkspaceUIReducer(previous, {
|
||||
type: 'workspace.initialize',
|
||||
workspace,
|
||||
});
|
||||
|
||||
expect(next.workspace).toBe(workspace);
|
||||
expect(next.candidates).toEqual({ left: [], right: [] });
|
||||
expect(next.selected).toEqual({ left: '', right: '' });
|
||||
expect(next.selectedPlanCandidateId).toBe('');
|
||||
});
|
||||
|
||||
it('resets workflow evidence without discarding the selected identities', () => {
|
||||
const previous = {
|
||||
...INITIAL_AUTHORIZATION_WORKSPACE_UI,
|
||||
leftTabId: 11,
|
||||
rightTabId: 12,
|
||||
workspace: { id: 'old' } as BrowserAuthorizationWorkspace,
|
||||
capture: { left: { active: true } } as never,
|
||||
};
|
||||
const next = authorizationWorkspaceUIReducer(previous, { type: 'workspace.reset' });
|
||||
|
||||
expect(next.leftTabId).toBe(11);
|
||||
expect(next.rightTabId).toBe(12);
|
||||
expect(next.workspace).toBeUndefined();
|
||||
expect(next.capture).toEqual({});
|
||||
});
|
||||
|
||||
it('persists only durable workflow state', () => {
|
||||
const value = persistedAuthorizationWorkspaceUI({
|
||||
...INITIAL_AUTHORIZATION_WORKSPACE_UI,
|
||||
inspection: { version: 1 } as never,
|
||||
capture: { left: { active: true } } as never,
|
||||
});
|
||||
expect(value).not.toHaveProperty('inspection');
|
||||
expect(value).not.toHaveProperty('capture');
|
||||
});
|
||||
|
||||
it('fails closed when a restarted UI session contains a malformed workspace', () => {
|
||||
const next = authorizationWorkspaceUIReducer(INITIAL_AUTHORIZATION_WORKSPACE_UI, {
|
||||
type: 'hydrate',
|
||||
value: {
|
||||
mode: 'vertical',
|
||||
leftTabId: 11,
|
||||
rightTabId: 'not-a-tab',
|
||||
leftLabel: '低权限账号',
|
||||
workspace: { id: 'truncated-before-storage-write' },
|
||||
candidates: { left: [null], right: { invalid: true } },
|
||||
selected: null,
|
||||
},
|
||||
});
|
||||
|
||||
expect(next).toMatchObject({
|
||||
mode: 'vertical',
|
||||
leftTabId: 11,
|
||||
leftLabel: '低权限账号',
|
||||
workspace: undefined,
|
||||
candidates: { left: [], right: [] },
|
||||
selected: { left: '', right: '' },
|
||||
});
|
||||
expect(next.rightTabId).toBeUndefined();
|
||||
});
|
||||
|
||||
it('normalizes a valid persisted workflow but drops invalid candidate entries', () => {
|
||||
const workspace = {
|
||||
...fixtureWorkspace(),
|
||||
createdAt: Date.now(),
|
||||
};
|
||||
const normalized = normalizePersistedAuthorizationWorkspaceUI({
|
||||
mode: 'horizontal',
|
||||
leftTabId: 11,
|
||||
rightTabId: 22,
|
||||
leftLabel: '账号 A',
|
||||
rightLabel: '账号 B',
|
||||
workspace,
|
||||
candidates: {
|
||||
left: [{
|
||||
id: 'left-request',
|
||||
method: 'GET',
|
||||
url: 'https://example.test/api/profile?id=1',
|
||||
path: '/api/profile',
|
||||
resourceType: 'xmlhttprequest',
|
||||
startedAt: Date.now(),
|
||||
eligible: true,
|
||||
reasons: [],
|
||||
}, { id: 'invalid-url', url: 'javascript:alert(1)' }],
|
||||
right: [],
|
||||
},
|
||||
selected: { left: 'left-request', right: '' },
|
||||
selectedPlanCandidateId: '',
|
||||
canaryPaths: 'data.owner.id',
|
||||
});
|
||||
|
||||
expect(normalized?.workspace?.id).toBe('workspace-1');
|
||||
expect(normalized?.candidates?.left).toEqual([
|
||||
expect.objectContaining({ id: 'left-request' }),
|
||||
]);
|
||||
expect(normalized?.selected?.left).toBe('left-request');
|
||||
});
|
||||
|
||||
it('models the complete identity-to-evidence workflow without losing capture state', () => {
|
||||
let current = INITIAL_AUTHORIZATION_WORKSPACE_UI;
|
||||
expect(authorizationWorkspaceStage(current)).toBe('identity');
|
||||
const initial = fixtureWorkspace();
|
||||
current = authorizationWorkspaceUIReducer(current, {
|
||||
type: 'workspace.initialize',
|
||||
workspace: initial,
|
||||
});
|
||||
current = authorizationWorkspaceUIReducer(current, {
|
||||
type: 'capture.replace',
|
||||
capture: {
|
||||
left: { active: true, count: 1 } as never,
|
||||
right: { active: true, count: 1 } as never,
|
||||
},
|
||||
});
|
||||
expect(authorizationWorkspaceStage(current)).toBe('normal-requests');
|
||||
|
||||
const baseline = {
|
||||
id: 'baseline',
|
||||
networkRequestId: 'request',
|
||||
request: {
|
||||
method: 'GET',
|
||||
url: 'https://example.test/api/profile?id=1',
|
||||
path: '/api/profile',
|
||||
contentType: 'application/json',
|
||||
actionFingerprint: 'fingerprint',
|
||||
},
|
||||
};
|
||||
const bound = {
|
||||
...initial,
|
||||
baselines: { left: { ...baseline, id: 'left' }, right: { ...baseline, id: 'right' } },
|
||||
baselinePair: {
|
||||
state: 'matched' as const,
|
||||
reasons: ['同类请求'],
|
||||
resourceCandidates: [{
|
||||
id: 'resource-id',
|
||||
source: 'wire' as const,
|
||||
location: 'query' as const,
|
||||
path: 'query.id',
|
||||
category: 'identifier',
|
||||
confidence: 'high' as const,
|
||||
requiresLogicalBinding: false,
|
||||
reasons: ['A/B 值不同'],
|
||||
}],
|
||||
operationCandidates: [],
|
||||
},
|
||||
};
|
||||
current = authorizationWorkspaceUIReducer(current, {
|
||||
type: 'baselines.loaded',
|
||||
candidates: {
|
||||
left: [{ id: 'left-request' }] as never,
|
||||
right: [{ id: 'right-request' }] as never,
|
||||
},
|
||||
selected: { left: 'left-request', right: 'right-request' },
|
||||
});
|
||||
current = authorizationWorkspaceUIReducer(current, {
|
||||
type: 'baselines.bound',
|
||||
workspace: bound,
|
||||
selectedPlanCandidateId: 'resource-id',
|
||||
});
|
||||
expect(authorizationWorkspaceStage(current)).toBe('plan');
|
||||
|
||||
const planned = {
|
||||
...bound,
|
||||
plan: {
|
||||
id: 'plan-1',
|
||||
mode: 'horizontal' as const,
|
||||
candidateId: 'resource-id',
|
||||
state: 'ready' as const,
|
||||
selector: { source: 'wire' as const, location: 'query' as const, path: 'query.id' },
|
||||
cases: [],
|
||||
requestBudget: 4,
|
||||
requiresDynamicRebuild: false,
|
||||
reasons: ['固定四项矩阵'],
|
||||
},
|
||||
};
|
||||
current = authorizationWorkspaceUIReducer(current, {
|
||||
type: 'workspace.updated',
|
||||
workspace: planned,
|
||||
});
|
||||
expect(authorizationWorkspaceStage(current)).toBe('execution');
|
||||
|
||||
current = authorizationWorkspaceUIReducer(current, {
|
||||
type: 'workspace.updated',
|
||||
workspace: {
|
||||
...planned,
|
||||
execution: {
|
||||
id: 'execution-1',
|
||||
state: 'completed',
|
||||
verdict: 'protected',
|
||||
confidence: 'high',
|
||||
requestCount: 4,
|
||||
cases: [],
|
||||
evidence: [],
|
||||
evidenceAvailable: true,
|
||||
reasons: ['交叉访问均被拒绝'],
|
||||
},
|
||||
},
|
||||
});
|
||||
expect(authorizationWorkspaceStage(current)).toBe('evidence');
|
||||
expect(current.capture.left?.active).toBe(true);
|
||||
expect(persistedAuthorizationWorkspaceUI(current)).not.toHaveProperty('capture');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,364 @@
|
||||
import type {
|
||||
BrowserIsolationInspection,
|
||||
NetworkCaptureStatus,
|
||||
} from '@/types/models';
|
||||
import type {
|
||||
BrowserAuthorizationBaselineCandidate,
|
||||
BrowserAuthorizationMode,
|
||||
BrowserAuthorizationSide,
|
||||
BrowserAuthorizationWorkspace,
|
||||
} from '../engine';
|
||||
import { normalizeBrowserAuthorizationTaskResult } from '../protocol';
|
||||
|
||||
export const EMPTY_AUTHORIZATION_CANDIDATES: Record<
|
||||
BrowserAuthorizationSide,
|
||||
BrowserAuthorizationBaselineCandidate[]
|
||||
> = { left: [], right: [] };
|
||||
|
||||
const EMPTY_SELECTION: Record<BrowserAuthorizationSide, string> = { left: '', right: '' };
|
||||
|
||||
export interface PersistedAuthorizationWorkspaceUI {
|
||||
mode: BrowserAuthorizationMode;
|
||||
leftTabId?: number;
|
||||
rightTabId?: number;
|
||||
leftLabel: string;
|
||||
rightLabel: string;
|
||||
workspace?: BrowserAuthorizationWorkspace;
|
||||
candidates: Record<BrowserAuthorizationSide, BrowserAuthorizationBaselineCandidate[]>;
|
||||
selected: Record<BrowserAuthorizationSide, string>;
|
||||
selectedPlanCandidateId: string;
|
||||
canaryPaths: string;
|
||||
}
|
||||
|
||||
export interface AuthorizationWorkspaceUIState extends PersistedAuthorizationWorkspaceUI {
|
||||
inspection?: BrowserIsolationInspection;
|
||||
capture: Partial<Record<BrowserAuthorizationSide, NetworkCaptureStatus>>;
|
||||
}
|
||||
|
||||
export const INITIAL_AUTHORIZATION_WORKSPACE_UI: AuthorizationWorkspaceUIState = {
|
||||
mode: 'horizontal',
|
||||
leftLabel: '账号 A',
|
||||
rightLabel: '账号 B',
|
||||
candidates: EMPTY_AUTHORIZATION_CANDIDATES,
|
||||
selected: EMPTY_SELECTION,
|
||||
selectedPlanCandidateId: '',
|
||||
canaryPaths: '',
|
||||
capture: {},
|
||||
};
|
||||
|
||||
export type AuthorizationWorkspaceUIAction =
|
||||
| { type: 'hydrate'; value?: unknown }
|
||||
| { type: 'patch'; value: Partial<AuthorizationWorkspaceUIState> }
|
||||
| { type: 'workspace.initialize'; workspace: BrowserAuthorizationWorkspace }
|
||||
| { type: 'workspace.updated'; workspace: BrowserAuthorizationWorkspace }
|
||||
| { type: 'workspace.reset' }
|
||||
| {
|
||||
type: 'baselines.loaded';
|
||||
candidates: Record<BrowserAuthorizationSide, BrowserAuthorizationBaselineCandidate[]>;
|
||||
selected: Record<BrowserAuthorizationSide, string>;
|
||||
}
|
||||
| {
|
||||
type: 'baselines.bound';
|
||||
workspace: BrowserAuthorizationWorkspace;
|
||||
selectedPlanCandidateId: string;
|
||||
}
|
||||
| { type: 'capture.replace'; capture: AuthorizationWorkspaceUIState['capture'] }
|
||||
| { type: 'capture.update'; side: BrowserAuthorizationSide; status: NetworkCaptureStatus };
|
||||
|
||||
export type AuthorizationWorkspaceStage =
|
||||
| 'identity'
|
||||
| 'recovery'
|
||||
| 'normal-requests'
|
||||
| 'plan'
|
||||
| 'execution'
|
||||
| 'evidence';
|
||||
|
||||
export function authorizationWorkspaceStage(
|
||||
state: AuthorizationWorkspaceUIState,
|
||||
): AuthorizationWorkspaceStage {
|
||||
const workspace = state.workspace;
|
||||
if (!workspace) return 'identity';
|
||||
if (workspace.state === 'stale' || workspace.state === 'blocked') return 'recovery';
|
||||
if (!workspace.baselines.left || !workspace.baselines.right) return 'normal-requests';
|
||||
if (!workspace.plan) return 'plan';
|
||||
if (!workspace.execution) return 'execution';
|
||||
return 'evidence';
|
||||
}
|
||||
|
||||
function normalizedCandidates(
|
||||
value: PersistedAuthorizationWorkspaceUI['candidates'] | undefined,
|
||||
): PersistedAuthorizationWorkspaceUI['candidates'] {
|
||||
return {
|
||||
left: Array.isArray(value?.left) ? value.left : [],
|
||||
right: Array.isArray(value?.right) ? value.right : [],
|
||||
};
|
||||
}
|
||||
|
||||
function record(value: unknown): Record<string, unknown> | undefined {
|
||||
return value && typeof value === 'object' && !Array.isArray(value)
|
||||
? value as Record<string, unknown>
|
||||
: undefined;
|
||||
}
|
||||
|
||||
function stringArray(value: unknown, max = 100): boolean {
|
||||
return Array.isArray(value) && value.length <= max && value.every((item) => typeof item === 'string');
|
||||
}
|
||||
|
||||
function safeWorkspaceForUI(input: unknown): BrowserAuthorizationWorkspace | undefined {
|
||||
let workspace: BrowserAuthorizationWorkspace;
|
||||
try {
|
||||
workspace = normalizeBrowserAuthorizationTaskResult<BrowserAuthorizationWorkspace>(
|
||||
'authorization.workspace.inspect',
|
||||
input,
|
||||
);
|
||||
} catch {
|
||||
return undefined;
|
||||
}
|
||||
const value = workspace as unknown as Record<string, unknown>;
|
||||
const left = record(value.left);
|
||||
const right = record(value.right);
|
||||
const proof = record(value.proof);
|
||||
const baselines = record(value.baselines);
|
||||
const pair = record(value.baselinePair);
|
||||
const validSide = (side: Record<string, unknown> | undefined) => {
|
||||
const target = record(side?.target);
|
||||
const authentication = record(side?.authentication);
|
||||
return Boolean(side && target && authentication
|
||||
&& Number.isSafeInteger(target.tabId) && Number(target.tabId) > 0
|
||||
&& Number.isSafeInteger(target.frameId) && Number(target.frameId) >= 0
|
||||
&& typeof target.documentId === 'string' && target.documentId
|
||||
&& ['authenticated', 'unauthenticated', 'unknown'].includes(String(authentication.status))
|
||||
&& Number.isFinite(authentication.cookieCount)
|
||||
&& Number.isFinite(authentication.storageEntryCount));
|
||||
};
|
||||
if (value.version !== 1 || typeof value.id !== 'string' || !value.id
|
||||
|| typeof value.engineInstanceId !== 'string' || !value.engineInstanceId
|
||||
|| !['horizontal', 'vertical'].includes(String(value.mode))
|
||||
|| !['ready', 'conditional', 'blocked', 'stale'].includes(String(value.state))
|
||||
|| !Number.isFinite(value.expiresAt)
|
||||
|| !validSide(left) || !validSide(right) || !proof || !baselines || !pair
|
||||
|| !['strong', 'conditional', 'none'].includes(String(proof.level))
|
||||
|| typeof proof.sameOrigin !== 'boolean'
|
||||
|| !['different', 'same', 'unknown'].includes(String(proof.cookieStoreRelation))
|
||||
|| !['different', 'same', 'unknown'].includes(String(proof.accountEvidenceRelation))
|
||||
|| !['different', 'same', 'unknown'].includes(String(proof.requestCredentialRelation))
|
||||
|| !['passed', 'failed', 'not-required'].includes(String(proof.refreshCheck))
|
||||
|| !stringArray(proof.reasons)
|
||||
|| !['waiting', 'matched', 'mismatch'].includes(String(pair.state))
|
||||
|| !stringArray(pair.reasons)
|
||||
|| !Array.isArray(pair.resourceCandidates) || !Array.isArray(pair.operationCandidates)) return undefined;
|
||||
|
||||
const resourceCandidatesValid = pair.resourceCandidates.every((item) => {
|
||||
const candidate = record(item);
|
||||
return Boolean(candidate && typeof candidate.id === 'string' && candidate.id
|
||||
&& ['wire', 'logical'].includes(String(candidate.source))
|
||||
&& ['header', 'path', 'query', 'body'].includes(String(candidate.location))
|
||||
&& typeof candidate.path === 'string' && typeof candidate.category === 'string'
|
||||
&& ['high', 'medium', 'low'].includes(String(candidate.confidence))
|
||||
&& typeof candidate.requiresLogicalBinding === 'boolean'
|
||||
&& stringArray(candidate.reasons));
|
||||
});
|
||||
const operationCandidatesValid = pair.operationCandidates.every((item) => {
|
||||
const candidate = record(item);
|
||||
return Boolean(candidate && typeof candidate.id === 'string' && candidate.id
|
||||
&& typeof candidate.method === 'string' && typeof candidate.path === 'string'
|
||||
&& typeof candidate.eligible === 'boolean' && typeof candidate.sideEffect === 'boolean'
|
||||
&& typeof candidate.requiresDynamicRebuild === 'boolean'
|
||||
&& stringArray(candidate.authenticationPaths) && stringArray(candidate.dynamicPaths)
|
||||
&& stringArray(candidate.reasons));
|
||||
});
|
||||
if (!resourceCandidatesValid || !operationCandidatesValid) return undefined;
|
||||
|
||||
if (value.plan !== undefined) {
|
||||
const plan = record(value.plan);
|
||||
const selector = record(plan?.selector);
|
||||
if (!plan || !selector || typeof plan.id !== 'string' || !plan.id
|
||||
|| !['horizontal', 'vertical'].includes(String(plan.mode))
|
||||
|| typeof plan.candidateId !== 'string'
|
||||
|| !['ready', 'review-required', 'blocked'].includes(String(plan.state))
|
||||
|| typeof selector.source !== 'string' || typeof selector.location !== 'string'
|
||||
|| typeof selector.path !== 'string' || !Array.isArray(plan.cases)
|
||||
|| !Number.isSafeInteger(plan.requestBudget) || Number(plan.requestBudget) < 0
|
||||
|| typeof plan.requiresDynamicRebuild !== 'boolean' || !stringArray(plan.reasons)
|
||||
|| !plan.cases.every((item) => {
|
||||
const testCase = record(item);
|
||||
return Boolean(testCase && typeof testCase.id === 'string' && typeof testCase.label === 'string'
|
||||
&& ['left', 'right'].includes(String(testCase.authContextSide))
|
||||
&& ['left', 'right', ''].includes(String(testCase.resourceValueSide))
|
||||
&& typeof testCase.method === 'string' && typeof testCase.path === 'string'
|
||||
&& typeof testCase.sideEffect === 'boolean');
|
||||
})) return undefined;
|
||||
}
|
||||
|
||||
if (value.execution !== undefined) {
|
||||
const execution = record(value.execution);
|
||||
if (!execution || typeof execution.id !== 'string' || !execution.id
|
||||
|| !['completed', 'partial'].includes(String(execution.state))
|
||||
|| !['confirmed', 'likely', 'protected', 'inconclusive', 'invalid-controls'].includes(String(execution.verdict))
|
||||
|| !['high', 'medium', 'low', 'none'].includes(String(execution.confidence))
|
||||
|| !Number.isSafeInteger(execution.requestCount) || Number(execution.requestCount) < 0
|
||||
|| typeof execution.evidenceAvailable !== 'boolean'
|
||||
|| !Array.isArray(execution.cases) || !Array.isArray(execution.evidence)
|
||||
|| !stringArray(execution.reasons)
|
||||
|| !execution.cases.every((item) => {
|
||||
const testCase = record(item);
|
||||
const result = record(testCase?.result);
|
||||
return Boolean(testCase && typeof testCase.id === 'string' && typeof testCase.label === 'string'
|
||||
&& ['completed', 'failed', 'skipped'].includes(String(testCase.state))
|
||||
&& (!result || (Number.isFinite(result.status) && typeof result.statusText === 'string'
|
||||
&& typeof result.outcome === 'string' && Number.isFinite(result.durationMs))));
|
||||
})) return undefined;
|
||||
}
|
||||
return workspace;
|
||||
}
|
||||
|
||||
function normalizePersistedCandidate(input: unknown): BrowserAuthorizationBaselineCandidate | undefined {
|
||||
const candidate = record(input);
|
||||
if (!candidate || typeof candidate.id !== 'string' || !candidate.id
|
||||
|| typeof candidate.method !== 'string' || !candidate.method
|
||||
|| typeof candidate.url !== 'string' || typeof candidate.path !== 'string'
|
||||
|| typeof candidate.resourceType !== 'string' || !Number.isFinite(candidate.startedAt)
|
||||
|| typeof candidate.eligible !== 'boolean' || !stringArray(candidate.reasons)) return undefined;
|
||||
try {
|
||||
const parsed = new URL(candidate.url);
|
||||
if (!['http:', 'https:'].includes(parsed.protocol)) return undefined;
|
||||
} catch {
|
||||
return undefined;
|
||||
}
|
||||
return {
|
||||
id: candidate.id.slice(0, 240),
|
||||
method: candidate.method.slice(0, 32),
|
||||
url: candidate.url.slice(0, 8_192),
|
||||
path: candidate.path.slice(0, 4_096),
|
||||
resourceType: candidate.resourceType.slice(0, 120),
|
||||
startedAt: Number(candidate.startedAt),
|
||||
completedAt: Number.isFinite(candidate.completedAt) ? Number(candidate.completedAt) : undefined,
|
||||
durationMs: Number.isFinite(candidate.durationMs) ? Number(candidate.durationMs) : undefined,
|
||||
statusCode: Number.isSafeInteger(candidate.statusCode) ? Number(candidate.statusCode) : undefined,
|
||||
error: typeof candidate.error === 'string' ? candidate.error.slice(0, 1_024) : undefined,
|
||||
eligible: candidate.eligible,
|
||||
reasons: (candidate.reasons as string[]).slice(0, 20).map((item) => item.slice(0, 1_024)),
|
||||
};
|
||||
}
|
||||
|
||||
export function normalizePersistedAuthorizationWorkspaceUI(
|
||||
input: unknown,
|
||||
): Partial<PersistedAuthorizationWorkspaceUI> | undefined {
|
||||
const value = record(input);
|
||||
if (!value) return undefined;
|
||||
const workspace = value.workspace === undefined ? undefined : safeWorkspaceForUI(value.workspace);
|
||||
const candidateInput = record(value.candidates);
|
||||
const candidates = workspace ? {
|
||||
left: (Array.isArray(candidateInput?.left) ? candidateInput.left : [])
|
||||
.slice(0, 50).map(normalizePersistedCandidate)
|
||||
.filter((item): item is BrowserAuthorizationBaselineCandidate => Boolean(item)),
|
||||
right: (Array.isArray(candidateInput?.right) ? candidateInput.right : [])
|
||||
.slice(0, 50).map(normalizePersistedCandidate)
|
||||
.filter((item): item is BrowserAuthorizationBaselineCandidate => Boolean(item)),
|
||||
} : EMPTY_AUTHORIZATION_CANDIDATES;
|
||||
const selectedInput = record(value.selected);
|
||||
const selected = {
|
||||
left: typeof selectedInput?.left === 'string'
|
||||
&& candidates.left.some((item) => item.id === selectedInput.left) ? selectedInput.left : '',
|
||||
right: typeof selectedInput?.right === 'string'
|
||||
&& candidates.right.some((item) => item.id === selectedInput.right) ? selectedInput.right : '',
|
||||
};
|
||||
return {
|
||||
mode: value.mode === 'vertical' ? 'vertical' : 'horizontal',
|
||||
leftTabId: Number.isSafeInteger(value.leftTabId) && Number(value.leftTabId) > 0 ? Number(value.leftTabId) : undefined,
|
||||
rightTabId: Number.isSafeInteger(value.rightTabId) && Number(value.rightTabId) > 0 ? Number(value.rightTabId) : undefined,
|
||||
leftLabel: typeof value.leftLabel === 'string' ? value.leftLabel.slice(0, 80) : '账号 A',
|
||||
rightLabel: typeof value.rightLabel === 'string' ? value.rightLabel.slice(0, 80) : '账号 B',
|
||||
workspace,
|
||||
candidates,
|
||||
selected,
|
||||
selectedPlanCandidateId: workspace && typeof value.selectedPlanCandidateId === 'string'
|
||||
? value.selectedPlanCandidateId.slice(0, 240)
|
||||
: '',
|
||||
canaryPaths: typeof value.canaryPaths === 'string' ? value.canaryPaths.slice(0, 4_096) : '',
|
||||
};
|
||||
}
|
||||
|
||||
export function authorizationWorkspaceUIReducer(
|
||||
state: AuthorizationWorkspaceUIState,
|
||||
action: AuthorizationWorkspaceUIAction,
|
||||
): AuthorizationWorkspaceUIState {
|
||||
switch (action.type) {
|
||||
case 'hydrate': {
|
||||
const value = normalizePersistedAuthorizationWorkspaceUI(action.value);
|
||||
if (!value) return state;
|
||||
return {
|
||||
...state,
|
||||
mode: value.mode === 'vertical' ? 'vertical' : 'horizontal',
|
||||
leftTabId: value.leftTabId,
|
||||
rightTabId: value.rightTabId,
|
||||
leftLabel: value.leftLabel || '账号 A',
|
||||
rightLabel: value.rightLabel || '账号 B',
|
||||
workspace: value.workspace,
|
||||
candidates: normalizedCandidates(value.candidates),
|
||||
selected: {
|
||||
left: value.selected?.left || '',
|
||||
right: value.selected?.right || '',
|
||||
},
|
||||
selectedPlanCandidateId: value.selectedPlanCandidateId || '',
|
||||
canaryPaths: value.canaryPaths || '',
|
||||
};
|
||||
}
|
||||
case 'patch': return { ...state, ...action.value };
|
||||
case 'workspace.initialize':
|
||||
return {
|
||||
...state,
|
||||
workspace: action.workspace,
|
||||
candidates: EMPTY_AUTHORIZATION_CANDIDATES,
|
||||
selected: EMPTY_SELECTION,
|
||||
selectedPlanCandidateId: '',
|
||||
};
|
||||
case 'workspace.updated':
|
||||
return { ...state, workspace: action.workspace };
|
||||
case 'workspace.reset':
|
||||
return {
|
||||
...state,
|
||||
workspace: undefined,
|
||||
candidates: EMPTY_AUTHORIZATION_CANDIDATES,
|
||||
selected: EMPTY_SELECTION,
|
||||
selectedPlanCandidateId: '',
|
||||
capture: {},
|
||||
};
|
||||
case 'baselines.loaded':
|
||||
return {
|
||||
...state,
|
||||
candidates: action.candidates,
|
||||
selected: action.selected,
|
||||
};
|
||||
case 'baselines.bound':
|
||||
return {
|
||||
...state,
|
||||
workspace: action.workspace,
|
||||
selectedPlanCandidateId: action.selectedPlanCandidateId,
|
||||
};
|
||||
case 'capture.replace':
|
||||
return { ...state, capture: action.capture };
|
||||
case 'capture.update':
|
||||
return {
|
||||
...state,
|
||||
capture: { ...state.capture, [action.side]: action.status },
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
export function persistedAuthorizationWorkspaceUI(
|
||||
state: AuthorizationWorkspaceUIState,
|
||||
): PersistedAuthorizationWorkspaceUI {
|
||||
return {
|
||||
mode: state.mode,
|
||||
leftTabId: state.leftTabId,
|
||||
rightTabId: state.rightTabId,
|
||||
leftLabel: state.leftLabel,
|
||||
rightLabel: state.rightLabel,
|
||||
workspace: state.workspace,
|
||||
candidates: state.candidates,
|
||||
selected: state.selected,
|
||||
selectedPlanCandidateId: state.selectedPlanCandidateId,
|
||||
canaryPaths: state.canaryPaths,
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user