Jesse_Chen
338 lines
15 KiB
TypeScript
338 lines
15 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import { readFileSync } from "node:fs";
|
|
import test from "node:test";
|
|
import {
|
|
computeEvidenceHash,
|
|
safeParseServerReportDocument,
|
|
parseServerReportDocument,
|
|
} from "../src/lib/personal-report-contract.server-core.ts";
|
|
import {
|
|
findBlockedDeterministicClaims,
|
|
findChartSetViolations,
|
|
findDanglingEvidenceRefs,
|
|
findDuplicateEvidenceIds,
|
|
CURRENT_REPORT_DOCUMENT_SCHEMA_VERSION,
|
|
LEGACY_REPORT_DOCUMENT_SCHEMA_VERSION,
|
|
REPORT_DOCUMENT_SCHEMA_VERSION,
|
|
findForbiddenContent,
|
|
findThemeCoverageViolations,
|
|
findUnsupportedDateClaims,
|
|
parseReportDocument,
|
|
REPORT_DOCUMENT_MAX_BYTES,
|
|
safeParseReportDocument,
|
|
serializedReportDocumentBytes,
|
|
type ReportDocumentV1,
|
|
type ReportDocumentV2,
|
|
} from "../src/lib/personal-report-contract.ts";
|
|
import { ReportDocumentValidationError } from "../src/lib/personal-report-contract.ts";
|
|
|
|
const fixtureText = readFileSync(
|
|
new URL("../../tests/fixtures/personal_report_document.v1.json", import.meta.url),
|
|
"utf8",
|
|
);
|
|
const fixture: ReportDocumentV1 = JSON.parse(fixtureText);
|
|
const clone = () => structuredClone(fixture) as ReportDocumentV1;
|
|
|
|
const v2FixtureText = readFileSync(
|
|
new URL("../../tests/fixtures/personal_report_document.v2.json", import.meta.url),
|
|
"utf8",
|
|
);
|
|
const v2Fixture: ReportDocumentV2 = JSON.parse(v2FixtureText);
|
|
const cloneV2 = () => structuredClone(v2Fixture) as ReportDocumentV2;
|
|
|
|
test("fixture passes isomorphic parse and stays under the 1.5 MiB cap", () => {
|
|
const result = safeParseReportDocument(fixture);
|
|
assert.equal(result.ok, true);
|
|
assert.ok(serializedReportDocumentBytes(fixture) <= REPORT_DOCUMENT_MAX_BYTES);
|
|
assert.ok(serializedReportDocumentBytes(fixture) < 100_000);
|
|
});
|
|
|
|
test("isomorphic parse rejects extra keys, missing keys, and bad enums", () => {
|
|
const extra = clone();
|
|
(extra.subject as Record<string, unknown>).hometown = "上海";
|
|
assert.equal(safeParseReportDocument(extra).ok, false);
|
|
|
|
const missing = clone();
|
|
delete (missing as Partial<ReportDocumentV1>).disclaimer;
|
|
assert.equal(safeParseReportDocument(missing).ok, false);
|
|
|
|
const badEnum = clone();
|
|
badEnum.subject.birthTimeStatus = "guessed" as ReportDocumentV1["subject"]["birthTimeStatus"];
|
|
assert.equal(safeParseReportDocument(badEnum).ok, false);
|
|
});
|
|
|
|
test("charts must contain exactly one D1 with all twelve houses", () => {
|
|
const zeroD1 = clone();
|
|
zeroD1.charts = zeroD1.charts.filter((chart) => chart.id !== "D1");
|
|
assert.deepEqual(findChartSetViolations(zeroD1), ["charts must contain exactly one D1 chart, found 0"]);
|
|
assert.equal(safeParseReportDocument(zeroD1).ok, false);
|
|
|
|
const twoD1 = clone();
|
|
twoD1.charts.push(structuredClone(twoD1.charts[0]));
|
|
const violations = findChartSetViolations(twoD1);
|
|
assert.ok(violations.some((v) => v.includes("duplicate chart id")));
|
|
assert.ok(violations.some((v) => v.includes("exactly one D1")));
|
|
assert.equal(safeParseReportDocument(twoD1).ok, false);
|
|
|
|
const elevenHouses = clone();
|
|
elevenHouses.charts[0].houses = elevenHouses.charts[0].houses.slice(0, 11);
|
|
assert.ok(findChartSetViolations(elevenHouses).some((v) => v.includes("all twelve house numbers")));
|
|
assert.equal(safeParseReportDocument(elevenHouses).ok, false);
|
|
});
|
|
|
|
test("duplicate house numbers are rejected per chart", () => {
|
|
const duplicated = clone();
|
|
duplicated.charts[0].houses[11].houseNumber = 1;
|
|
const result = safeParseReportDocument(duplicated);
|
|
assert.equal(result.ok, false);
|
|
});
|
|
|
|
test("longitude is [0, 360)", () => {
|
|
const at360 = clone();
|
|
at360.charts[0].planets![0].longitudeDegrees = 360;
|
|
assert.equal(safeParseReportDocument(at360).ok, false);
|
|
|
|
const near360 = clone();
|
|
near360.charts[0].planets![0].longitudeDegrees = 359.999;
|
|
assert.equal(safeParseReportDocument(near360).ok, true);
|
|
});
|
|
|
|
test("evidence ids must be globally unique across the appendix", () => {
|
|
const duplicated = clone();
|
|
duplicated.evidenceAppendix.conflicts[0].id = duplicated.evidenceAppendix.techniqueAudit[0].id;
|
|
assert.ok(findDuplicateEvidenceIds(duplicated).some((v) => v.includes("ev-mevg-web")));
|
|
assert.equal(safeParseReportDocument(duplicated).ok, false);
|
|
});
|
|
|
|
test("dangling evidenceRefs are rejected", () => {
|
|
const dangling = clone();
|
|
dangling.thematicNarrative[0].evidenceRefs = ["ev-no-such-evidence"];
|
|
assert.deepEqual(findDanglingEvidenceRefs(dangling), ["career:ev-no-such-evidence"]);
|
|
assert.equal(safeParseReportDocument(dangling).ok, false);
|
|
});
|
|
|
|
test("blocked sections reject deterministic predictions", () => {
|
|
const deterministic = clone();
|
|
deterministic.thematicNarrative[3].narrative = "这个事件必然会发生在明年，一定会成功。";
|
|
assert.ok(findBlockedDeterministicClaims(deterministic).length > 0);
|
|
assert.equal(safeParseReportDocument(deterministic).ok, false);
|
|
|
|
const nonDeterministic = clone();
|
|
nonDeterministic.thematicNarrative[3].narrative = "需要更多历史事件校准后才能评估，具体应期暂不提供。";
|
|
assert.equal(findBlockedDeterministicClaims(nonDeterministic).length, 0);
|
|
assert.equal(safeParseReportDocument(nonDeterministic).ok, true);
|
|
});
|
|
|
|
const forbiddenSamples = [
|
|
"<script>alert(1)</script>",
|
|
"javascript:alert(1)",
|
|
"file:///Users/jesse/private/chart.json",
|
|
"参考 ${process.env.SUPABASE_SERVICE_ROLE_KEY}",
|
|
"onerror=alert(1)",
|
|
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.abc",
|
|
"node:internal/modules/cjs/loader",
|
|
"Traceback (most recent call last)",
|
|
"__dirname/secret",
|
|
"__proto__ pollution",
|
|
"C:\\Users\\jesse\\chart.json",
|
|
"tool_call_id: call_123",
|
|
];
|
|
|
|
test("forbidden content patterns reject executable and internal material", () => {
|
|
for (const poison of forbiddenSamples) {
|
|
const poisoned = clone();
|
|
poisoned.disclaimer = poison;
|
|
assert.ok(
|
|
findForbiddenContent(poison).length > 0,
|
|
`expected ${poison} to be flagged`,
|
|
);
|
|
assert.equal(safeParseReportDocument(poisoned).ok, false, `poison: ${poison}`);
|
|
}
|
|
});
|
|
|
|
test("ordinary Chinese report text is not flagged as forbidden", () => {
|
|
assert.equal(findForbiddenContent("事业与财富主题的多系统证据较一致。").length, 0);
|
|
assert.equal(findForbiddenContent("A < B 的比较关系不属于 HTML 标签").length, 0);
|
|
});
|
|
|
|
test("serialization size cap rejects oversized documents", () => {
|
|
const oversized = clone();
|
|
oversized.disclaimer = "字".repeat(REPORT_DOCUMENT_MAX_BYTES);
|
|
assert.equal(safeParseReportDocument(oversized).ok, false);
|
|
});
|
|
|
|
test("JSON object key order is not validated (display order is a typed contract)", () => {
|
|
const reordered: Record<string, unknown> = {};
|
|
for (const key of Object.keys(fixture).reverse()) {
|
|
reordered[key] = (fixture as Record<string, unknown>)[key];
|
|
}
|
|
assert.equal(safeParseReportDocument(reordered).ok, true);
|
|
});
|
|
|
|
test("ReportDocument v1 keeps legacy Skill identity compatibility", () => {
|
|
assert.equal(fixture.provenance.skillName, undefined);
|
|
assert.equal(fixture.provenance.skillVersion, undefined);
|
|
assert.equal(safeParseReportDocument(fixture).ok, true);
|
|
});
|
|
|
|
test("optional Skill name and version accept registry identity and reject malformed values", () => {
|
|
const current = clone();
|
|
current.provenance.skillName = "jyotish-vedic-astrology";
|
|
current.provenance.skillVersion = "6.9.14";
|
|
assert.equal(safeParseReportDocument(current).ok, true);
|
|
|
|
const badName = clone();
|
|
badName.provenance.skillName = "Bad Package";
|
|
assert.equal(safeParseReportDocument(badName).ok, false);
|
|
|
|
const badVersion = clone();
|
|
badVersion.provenance.skillVersion = "v6";
|
|
assert.equal(safeParseReportDocument(badVersion).ok, false);
|
|
});
|
|
|
|
test("server parse recomputes the evidence hash and rejects self-reported mismatches", () => {
|
|
// The fixture hash is the canonical cross-language value; recomputation must agree.
|
|
assert.equal(computeEvidenceHash(fixture.evidenceAppendix), fixture.provenance.evidenceHash);
|
|
assert.equal(
|
|
computeEvidenceHash(fixture.evidenceAppendix),
|
|
"a830bcb22ce287d2637ffc91f9f951d5f24b19cb067712db2687fd23437f13f4",
|
|
);
|
|
assert.equal(safeParseServerReportDocument(fixture).ok, true);
|
|
|
|
// Tampered evidence with the self-reported hash left unchanged must fail.
|
|
const tampered = clone();
|
|
tampered.evidenceAppendix.calculationEvidence[0].value = "篡改后的证据值";
|
|
const result = safeParseServerReportDocument(tampered);
|
|
assert.equal(result.ok, false);
|
|
assert.ok(result.errors.some((error) => error.path === "provenance.evidenceHash"));
|
|
assert.throws(() => parseServerReportDocument(tampered), ReportDocumentValidationError);
|
|
|
|
// The isomorphic parse alone does not verify the hash (server-only duty).
|
|
assert.equal(safeParseReportDocument(tampered).ok, true);
|
|
});
|
|
|
|
test("parseReportDocument throws a typed validation error on guard failures", () => {
|
|
const bad = clone();
|
|
bad.thematicNarrative[0].evidenceRefs = ["ev-missing"];
|
|
assert.throws(() => parseReportDocument(bad), ReportDocumentValidationError);
|
|
const parsed = parseReportDocument(fixture);
|
|
assert.equal(parsed.schemaVersion, "report_document.v1");
|
|
});
|
|
|
|
|
|
test("ReportDocument v2 is canonical and fixture passes all guards", () => {
|
|
assert.equal(LEGACY_REPORT_DOCUMENT_SCHEMA_VERSION, "report_document.v1");
|
|
assert.equal(REPORT_DOCUMENT_SCHEMA_VERSION, "report_document.v2");
|
|
assert.equal(CURRENT_REPORT_DOCUMENT_SCHEMA_VERSION, REPORT_DOCUMENT_SCHEMA_VERSION);
|
|
assert.equal(v2Fixture.schemaVersion, REPORT_DOCUMENT_SCHEMA_VERSION);
|
|
assert.equal(v2Fixture.depth, "standard");
|
|
assert.deepEqual(findThemeCoverageViolations(v2Fixture), []);
|
|
assert.deepEqual(findDanglingEvidenceRefs(v2Fixture), []);
|
|
assert.deepEqual(findUnsupportedDateClaims(v2Fixture), []);
|
|
assert.equal(safeParseReportDocument(v2Fixture).ok, true);
|
|
assert.ok(serializedReportDocumentBytes(v2Fixture) <= REPORT_DOCUMENT_MAX_BYTES);
|
|
});
|
|
|
|
test("ReportDocument v2 server read recomputes evidence hash", () => {
|
|
assert.equal(computeEvidenceHash(v2Fixture.evidenceAppendix), v2Fixture.provenance.evidenceHash);
|
|
assert.equal(
|
|
computeEvidenceHash(v2Fixture.evidenceAppendix),
|
|
"b4f6d95916b5253054a9c64958eb3deec6ee5b54b0286465e7a986ba701132cf",
|
|
);
|
|
assert.equal(safeParseServerReportDocument(v2Fixture).ok, true);
|
|
|
|
const tampered = cloneV2();
|
|
tampered.evidenceAppendix.calculationEvidence[0].value = "tampered-v2";
|
|
const result = safeParseServerReportDocument(tampered);
|
|
assert.equal(result.ok, false);
|
|
assert.ok(result.errors.some((error) => error.path === "provenance.evidenceHash"));
|
|
});
|
|
|
|
test("every requested v2 theme has exactly one section or blocked disclosure", () => {
|
|
const missing = cloneV2();
|
|
missing.blockedConflictDisclosure = missing.blockedConflictDisclosure.filter(
|
|
(section) => section.theme !== "career",
|
|
);
|
|
assert.ok(findThemeCoverageViolations(missing).some((error) => error.includes("career") && error.includes("found 0")));
|
|
assert.equal(safeParseReportDocument(missing).ok, false);
|
|
|
|
const doubleCovered = cloneV2();
|
|
doubleCovered.thematicNarrative.push({
|
|
...structuredClone(doubleCovered.thematicNarrative[0]),
|
|
id: "theme-career",
|
|
theme: "career",
|
|
});
|
|
assert.ok(findThemeCoverageViolations(doubleCovered).some((error) => error.includes("career") && error.includes("found 2")));
|
|
assert.equal(safeParseReportDocument(doubleCovered).ok, false);
|
|
|
|
const duplicatedRequest = cloneV2();
|
|
duplicatedRequest.requestedThemes.push("general");
|
|
assert.ok(findThemeCoverageViolations(duplicatedRequest).some((error) => error.includes("requestedThemes must contain general exactly once, found 2")));
|
|
assert.equal(safeParseReportDocument(duplicatedRequest).ok, false);
|
|
});
|
|
|
|
test("v2 thematic sections require their real structured divisional charts", () => {
|
|
const unsupportedCareer = cloneV2();
|
|
unsupportedCareer.blockedConflictDisclosure = unsupportedCareer.blockedConflictDisclosure.filter(
|
|
(section) => section.theme !== "career",
|
|
);
|
|
unsupportedCareer.thematicNarrative.push({
|
|
...structuredClone(unsupportedCareer.thematicNarrative[0]),
|
|
id: "theme-career",
|
|
theme: "career",
|
|
});
|
|
assert.ok(findThemeCoverageViolations(unsupportedCareer).some((error) => error.includes("requires structured D10")));
|
|
assert.equal(safeParseReportDocument(unsupportedCareer).ok, false);
|
|
assert.equal(safeParseReportDocument(v2Fixture).ok, true);
|
|
});
|
|
|
|
test("v2 evidence references close across all new sections and charts", () => {
|
|
const mutations: Array<[string, (document: ReportDocumentV2) => void]> = [
|
|
["executiveSummary", (document) => { document.executiveSummary.evidenceRefs = ["ev-missing"]; }],
|
|
["natalFoundation", (document) => { document.natalFoundation.evidenceRefs = ["ev-missing"]; }],
|
|
["currentPhase", (document) => { document.currentPhase!.evidenceRefs = ["ev-missing"]; }],
|
|
["actionNotes", (document) => { document.actionNotes[0].evidenceRefs = ["ev-missing"]; }],
|
|
["charts", (document) => { document.charts[0].evidenceRefs = ["ev-missing"]; }],
|
|
["thematicNarrative", (document) => { document.thematicNarrative[0].evidenceRefs = ["ev-missing"]; }],
|
|
["blockedConflictDisclosure", (document) => { document.blockedConflictDisclosure[0].evidenceRefs = ["ev-missing"]; }],
|
|
];
|
|
for (const [label, mutate] of mutations) {
|
|
const dangling = cloneV2();
|
|
mutate(dangling);
|
|
assert.ok(findDanglingEvidenceRefs(dangling).some((entry) => entry.includes("ev-missing")), label);
|
|
assert.equal(safeParseReportDocument(dangling).ok, false, label);
|
|
}
|
|
});
|
|
|
|
test("v2 guard rejects unsupported dates, medical diagnoses, and deterministic financial promises", () => {
|
|
const unsupportedDate = cloneV2();
|
|
unsupportedDate.blockedConflictDisclosure[0].reason = "结论将在2031年5月发生。";
|
|
unsupportedDate.blockedConflictDisclosure[0].evidenceRefs = [];
|
|
assert.ok(findUnsupportedDateClaims(unsupportedDate).some((error) => error.includes("blockedConflictDisclosure[0]")));
|
|
assert.equal(safeParseReportDocument(unsupportedDate).ok, false);
|
|
|
|
const medical = cloneV2();
|
|
medical.actionNotes[0].note = "你已经患有糖尿病。";
|
|
assert.ok(findForbiddenContent(medical.actionNotes[0].note).includes("medical_diagnosis"));
|
|
assert.equal(safeParseReportDocument(medical).ok, false);
|
|
|
|
const financial = cloneV2();
|
|
financial.actionNotes[0].note = "这个方案保证收益并且稳赚不赔。";
|
|
assert.ok(findForbiddenContent(financial.actionNotes[0].note).includes("deterministic_financial_promise"));
|
|
assert.equal(safeParseReportDocument(financial).ok, false);
|
|
});
|
|
|
|
test("v2 guard rejects HTML and CSS while allowing ordinary Chinese prose", () => {
|
|
for (const poison of ["<div>报告</div>", "body { color: red; }", 'style="color:red"']) {
|
|
const document = cloneV2();
|
|
document.actionNotes[0].note = poison;
|
|
assert.ok(findForbiddenContent(poison).length > 0, poison);
|
|
assert.equal(safeParseReportDocument(document).ok, false, poison);
|
|
}
|
|
|
|
const ordinary = cloneV2();
|
|
ordinary.actionNotes[0].note = "记录真实事件日期，并把观察与证据逐项核对。";
|
|
assert.equal(findForbiddenContent(ordinary.actionNotes[0].note).length, 0);
|
|
assert.equal(safeParseReportDocument(ordinary).ok, true);
|
|
});
|