feat: harden orchestrator execution runtime

2026-07-24 23:53:32 +08:00
parent 396bb78200
commit f6f2cd0933
55 changed files with 5122 additions and 194 deletions
@@ -0,0 +1,67 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createExecutorAdmissionPolicy } from './executor-admission-policy.mjs';
+import {
+  createExecutorGateway,
+  createInMemoryExecutorJobStore,
+  createPhase5ExecutorAdapterRegistry,
+} from './executor-gateway.mjs';
+
+function request(overrides = {}) {
+  return {
+    jobId: 'job-1',
+    idempotencyKey: 'idem-1',
+    executor: 'goosed',
+    task: {
+      instruction: 'do it',
+      workspaceRef: { kind: 'workspace-alias', id: 'canary' },
+    },
+    subject: { tenantId: 'tenant-1', userId: 'user-1' },
+    authorization: { executionAllowed: true },
+    policy: { sideEffectsAllowed: true },
+    ...overrides,
+  };
+}
+
+test('admission policy enforces allowlists, workspace kinds and durable-store quotas', async () => {
+  const store = createInMemoryExecutorJobStore();
+  const policy = createExecutorAdmissionPolicy({
+    store,
+    config: {
+      tenantAllowlist: ['tenant-1'],
+      userAllowlist: ['user-1'],
+      maxUserActive: 1,
+    },
+  });
+  assert.equal((await policy.evaluate(request())).allowed, true);
+  assert.equal(
+    (await policy.evaluate(request({
+      subject: { tenantId: 'tenant-2', userId: 'user-1' },
+    }))).reason,
+    'executor_tenant_not_allowed',
+  );
+  assert.equal(
+    (await policy.evaluate(request({
+      task: {
+        instruction: 'do it',
+        workspaceRef: { kind: 'absolute-path', id: '/tmp/repo' },
+      },
+    }))).reason,
+    'executor_workspace_kind_not_allowed',
+  );
+
+  const gateway = createExecutorGateway({
+    store,
+    registry: createPhase5ExecutorAdapterRegistry({ enabledExecutors: ['goosed'] }),
+    executionEnabled: true,
+    admissionPolicy: policy,
+  });
+  const first = await gateway.createJob(request());
+  assert.equal(first.job.status, 'queued');
+  const second = await gateway.createJob(request({
+    jobId: 'job-2',
+    idempotencyKey: 'idem-2',
+  }));
+  assert.equal(second.job.status, 'blocked');
+  assert.equal(second.job.reason, 'executor_user_concurrency_limited');
+});