feat: bind evidence credentials through local files

2026-08-09 19:03:36 +02:00
parent c7a369f436
commit 7126b567b0
11 changed files with 839 additions and 18 deletions
@@ -1,8 +1,8 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, expect, test } from "vitest";
-import { resolveBinding, resolveRuntimeBindings } from "../src/workspaces/bindings.js";
+import { resolveBinding, resolveEvidenceBinding, resolveRuntimeBindings, supportsSessionRuntime } from "../src/workspaces/bindings.js";
 import { parseWorkspaceYaml } from "../src/workspaces/schema.js";

 const workspace = parseWorkspaceYaml(`workspace:
@@ -254,3 +254,118 @@ test("schema v3 ignores external semantic binding variables and reports only DWH
  expect(bindings.vector.values).toEqual({});
  expect(bindings.embedding.values).toEqual({});
 });
+
+
+function withEvidence(source: Record<string, unknown>) {
+  return parseWorkspaceYaml(`workspace:
+  schema_version: 3
+  id: psd-clinical
+  name: Policlinico San Donato
+  language: it
+dwh:
+  engine: postgres
+  database: postgres
+  schema: datawarehouse
+  supported_transports: [postgres_direct]
+semantic_index:
+  vector_store: { engine: qdrant, collection: psd-clinical, dimensions: 1024, distance: cosine }
+  embedding: { provider: ollama_internal, model: qwen3-embedding:0.6b, dimensions: 1024 }
+llm_policy: { allowed: [zai/glm-5.2] }
+evidence:
+  source: ${JSON.stringify(source)}
+`);
+}
+
+const evidenceVariable = (suffix: string) => `THT_WS_PSD_CLINICAL_EVIDENCE_${suffix}`;
+
+test.each([
+  { type: "filesystem", uri: "workspace-content/psd-clinical/evidence" },
+  { type: "http", uris: ["https://evidence.example.test/guide.md"], authentication: "none" },
+  { type: "s3", uri: "s3://clinical-evidence/published/", credentials: "ambient" },
+])("does not resolve Evidence variables for $type modes without file credentials", (source) => {
+  expect(resolveEvidenceBinding(withEvidence(source), {
+    [evidenceVariable("SIGNED_URLS_FILE")]: "/CANARY/http",
+    [evidenceVariable("ACCESS_KEY_FILE")]: "/CANARY/access",
+  }, ["/run/secrets"])).toEqual({ values: {}, missing: [] });
+});
+
+test("requires only a safe HTTP signed-URL file and never reads its contents", () => {
+  const signed = secretPath("evidence-signed-urls");
+  writeFileSync(signed.path, "CANARY-SIGNED-URL-CONTENT");
+  const source = withEvidence({
+    type: "http",
+    uris: ["https://evidence.example.test/guide.md"],
+    authentication: "signed_urls_file",
+  });
+  const variable = evidenceVariable("SIGNED_URLS_FILE");
+
+  expect(resolveEvidenceBinding(source, {}, [signed.root]).missing).toEqual([variable]);
+  const resolved = resolveEvidenceBinding(source, {
+    [variable]: signed.path,
+    [evidenceVariable("ACCESS_KEY_FILE")]: signed.path,
+  }, [signed.root]);
+  expect(resolved).toEqual({ values: { [variable]: signed.path }, missing: [] });
+  expect(JSON.stringify(resolved)).not.toContain("CANARY-SIGNED-URL-CONTENT");
+});
+
+test("requires S3 access and secret files together while accepting an optional safe session token", () => {
+  const access = secretPath("evidence-access");
+  const secret = secretPath("evidence-secret");
+  const token = secretPath("evidence-token");
+  const source = withEvidence({
+    type: "s3", uri: "s3://clinical-evidence/published/", credentials: "static_files",
+  });
+  const env = {
+    [evidenceVariable("ACCESS_KEY_FILE")]: access.path,
+    [evidenceVariable("SECRET_KEY_FILE")]: secret.path,
+    [evidenceVariable("SESSION_TOKEN_FILE")]: token.path,
+    [evidenceVariable("SIGNED_URLS_FILE")]: access.path,
+  };
+
+  expect(resolveEvidenceBinding(source, {
+    [evidenceVariable("ACCESS_KEY_FILE")]: access.path,
+  }, [access.root]).missing).toEqual([evidenceVariable("SECRET_KEY_FILE")]);
+  expect(resolveEvidenceBinding(source, env, [access.root, secret.root, token.root])).toEqual({
+    values: {
+      [evidenceVariable("ACCESS_KEY_FILE")]: access.path,
+      [evidenceVariable("SECRET_KEY_FILE")]: secret.path,
+      [evidenceVariable("SESSION_TOKEN_FILE")]: token.path,
+    },
+    missing: [],
+  });
+});
+
+test("rejects relative, missing, directory, unreadable, and escaping symlink Evidence paths", () => {
+  const allowed = secretPath("valid");
+  const outside = secretPath("outside");
+  const directory = join(allowed.root, "directory");
+  mkdirSync(directory);
+  const link = join(allowed.root, "escape");
+  symlinkSync(outside.path, link);
+  const unreadable = join(allowed.root, "unreadable");
+  writeFileSync(unreadable, "secret");
+  chmodSync(unreadable, 0o000);
+  const source = withEvidence({
+    type: "http", uris: ["https://evidence.example.test/guide.md"], authentication: "signed_urls_file",
+  });
+  const variable = evidenceVariable("SIGNED_URLS_FILE");
+
+  for (const path of ["relative", join(allowed.root, "missing"), directory, unreadable, link]) {
+    expect(resolveEvidenceBinding(source, { [variable]: path }, [allowed.root])).toEqual({
+      values: {}, missing: [variable],
+    });
+  }
+  chmodSync(unreadable, 0o600);
+});
+
+test("includes Evidence binding completeness in session runtime support without changing v3 compatibility", () => {
+  const unsigned = resolveRuntimeBindings(workspaceV3, {}, ["/run/secrets"]);
+  expect(unsigned.evidence).toEqual({ values: {}, missing: [] });
+  expect(supportsSessionRuntime(unsigned)).toBe(true);
+
+  const signed = resolveRuntimeBindings(withEvidence({
+    type: "http", uris: ["https://evidence.example.test/guide.md"], authentication: "signed_urls_file",
+  }), {}, ["/run/secrets"]);
+  expect(signed.evidence.missing).toEqual([evidenceVariable("SIGNED_URLS_FILE")]);
+  expect(supportsSessionRuntime(signed)).toBe(false);
+});