53 lines
4.7 KiB
PHP
53 lines
4.7 KiB
PHP
<?php
|
|
// Final read-only checks of the LocalService QA clone after its task has been removed.
|
|
ini_set('zend.exception_ignore_args', '1');
|
|
$root=dirname(__DIR__); $private=$root.'/storage/app/private/investmoz-v2/portal-audit';
|
|
$plan=json_decode(file_get_contents($private.'/consolidated-localservice-plan.json'), true, 512, JSON_THROW_ON_ERROR);
|
|
$app=(static fn($p)=>require $p)($plan['source'].'/tools/upgrade-runtime.php');
|
|
throw_unless(config('queue.connections.database.queue')==='localservice-qa' && config('database.connections.pgsql.port')==55441, RuntimeException::class);
|
|
$directory=$plan['source'].'/storage/qa-proof';
|
|
$fixture=json_decode(file_get_contents($directory.'/fixture.json'),true,512,JSON_THROW_ON_ERROR);
|
|
$parse=static fn($p)=>array_map(fn($line)=>json_decode($line,true,512,JSON_THROW_ON_ERROR),file($p, FILE_IGNORE_NEW_LINES|FILE_SKIP_EMPTY_LINES));
|
|
$principals=$parse($directory.'/principals.jsonl'); $workers=$parse($directory.'/worker-results.jsonl');
|
|
$registration=json_decode(file_get_contents($private.'/consolidated-localservice-registration.json'),true,512,JSON_THROW_ON_ERROR);
|
|
throw_unless(count($principals)===5 && count($workers)===5 && $registration['result']==='task_executed_five_times'
|
|
&& $registration['own_task_removed'] && (int)$registration['last_task_result']===0, RuntimeException::class);
|
|
foreach($principals as $identity) throw_unless($identity['sid']==='S-1-5-19',RuntimeException::class);
|
|
foreach($workers as $work) throw_unless($work['status']===0 && $work['target']===$plan['target']['database'].':55441'
|
|
&& $work['failed_jobs']===0 && !in_array(false,$work['authorized_writes'],true)
|
|
&& !in_array(false,$work['negative_access'],true),RuntimeException::class);
|
|
throw_unless(array_column($workers,'jobs_before')===[4,3,2,1,0] && array_column($workers,'jobs_after')===[3,2,1,0,0],RuntimeException::class);
|
|
$db=Illuminate\Support\Facades\DB::connection();$db->getPdo()->exec('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
|
|
throw_unless($db->table('documents')->count()===$fixture['documents_before']
|
|
&& $db->table('opportunity_documents')->count()===$fixture['resources_before']['documents']
|
|
&& $db->table('opportunity_images')->count()===$fixture['resources_before']['images']
|
|
&& $db->table('jobs')->count()===0 && $db->table('failed_jobs')->count()===0,RuntimeException::class);
|
|
$documents=[];
|
|
foreach($fixture['documents'] as $before){
|
|
$row=$db->table('documents')->where('id',$before['id'])->first();
|
|
$path=$plan['source'].'/storage/app/private/'.$row->storage_key;
|
|
throw_unless($row->status==='active' && $row->malware_scan_status==='clean'
|
|
&& trim($row->malware_scanned_sha256)===$before['sha256'] && trim($row->sha256)===$before['sha256']
|
|
&& hash_file('sha256',$path)===$before['cipher_sha256'],RuntimeException::class);
|
|
$plain=Illuminate\Support\Facades\Crypt::decryptString(file_get_contents($path));
|
|
throw_unless(hash('sha256',$plain)===$before['sha256'] && strlen($plain)===$before['bytes'],RuntimeException::class);
|
|
unset($plain);
|
|
$documents[]=[...$before,'status'=>'clean','cipher_preserved'=>true,'plain_hash_verified'=>true];
|
|
}
|
|
$db->getPdo()->exec('ROLLBACK');
|
|
$proof=['result'=>'passed','verified_at'=>gmdate('c'),'scope'=>'Real Windows LocalService scheduled execution in isolated QA only',
|
|
'target'=>$plan['target'],'principal_sid'=>'S-1-5-19','invocations'=>5,'queue'=>'localservice-qa',
|
|
'queue_before_counts'=>[4,3,2,1,0],'queue_after_counts'=>[3,2,1,0,0],
|
|
'four_documents_processed'=>$documents,'new_documents_or_resources'=>0,'failed_jobs'=>0,
|
|
'configuration_read_verified'=>true,'authorized_directory_writes'=>$workers[0]['authorized_writes'],
|
|
'negative_access'=>$workers[0]['negative_access'],'scanner'=>$workers[0]['scanner'],
|
|
'worker_php'=>$workers[0]['php'],'worker_max_peak_bytes'=>max(array_column($workers,'peak_bytes')),
|
|
'execution_time_limit_seconds'=>180,'last_task_result'=>0,'own_task_removed'=>true,
|
|
'external_notifications_enabled'=>false,'destination_tasks_or_ACLs_changed'=>0,'active_jobs_consumed'=>0,'active_writes'=>0,
|
|
'limitations'=>['QA scanner port13310; target scanner3310 still requires its service intervention',
|
|
'ACLs applied only to the own new QA tree; no claim that destination ACLs are already restricted',
|
|
'Actual hard-limit and recovery210s proofs reused from prior interactive QA; no new LocalService stall injected']];
|
|
file_put_contents($private.'/consolidated-localservice-proof.json',json_encode($proof,JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE|JSON_THROW_ON_ERROR));
|
|
echo json_encode(['result'=>'passed','principal'=>'S-1-5-19','scans'=>4,'repetition_empty_queue'=>true,
|
|
'max_peak_bytes'=>$proof['worker_max_peak_bytes'],'active_writes'=>0],JSON_THROW_ON_ERROR).PHP_EOL;
|