Add community map records and telemetry API; record Workshop 0.0.126

tests/test_telemetry_credentials.py

@@ -0,0 +1,89 @@
+"""Execute production credential persistence with storage/JSON boundary doubles."""
+from policy_harness import ROOT, body, run
+
+p = ROOT / 'addons/core/Scripts/Game/ERR/00_Core/ERR_TelemetryCredentials.c'
+methods = '\n'.join(body(p, s) for s in ['static bool Valid(', 'static bool Resolve('])
+for a, b in [
+    ('out string token', 'string& token'),
+    ('ref array<ref ERR_TelemetryCredential> entries = {};', 'Entries entries;'),
+    ('ERR_TelemetryCredential entry', 'Credential* entry'),
+    ('ERR_TelemetryCredential known', 'Credential* known'),
+    ('ERR_TelemetryCredential created = new ERR_TelemetryCredential()', 'Credential* created = new Credential()'),
+    ('JsonLoadContext loaded = new JsonLoadContext()', 'JsonLoadContext loaded'),
+    ('JsonSaveContext saved = new JsonSaveContext()', 'JsonSaveContext saved'),
+    ('foreach (Credential* known :', 'for (Credential* known :'),
+    ('entry.', 'entry->'), ('known.', 'known->'), ('created.', 'created->'),
+    ('FileIO.', 'FileIO::'), ('UUID.', 'UUID::'), ('ERR_ProfileConfig.', 'Profile::'),
+]:
+    methods = methods.replace(a, b)
+run(r'''
+#include <cassert>
+#include <string>
+#include <vector>
+#include <map>
+struct string : std::string {
+ using std::string::string; using std::string::operator=;
+ string(std::string s):std::string(s){} bool IsEmpty() const{return empty();} int Length()const{return size();}
+};
+struct Credential {string endpoint,serverId,token;};
+struct Entries:std::vector<Credential*> {
+ int Count(){return size();} void Insert(Credential* v){push_back(v);} bool operator!(){return false;}
+};
+std::map<std::string,string> files;
+std::map<std::string,Entries> documents;
+bool failSave=false,failCopy=false,failRead=false;int generated=0,serial=0;
+namespace UUID {bool IsUUID(string s){return s=="server"||s=="other";}
+ string GenV4(){generated++;return string(36, char('a'+generated%20));}}
+namespace FileIO {
+ bool FileExists(string p){return files.count(p);}
+ bool CopyFile(string a,string b){if(failCopy)return false;files[b]=files[a];return true;}
+ void DeleteFile(string p){files.erase(p);}
+}
+namespace Profile {bool Text(string p,string& text){if(failRead||!files.count(p))return false;text=files[p];return true;}}
+struct JsonLoadContext {
+ string raw;
+ bool LoadFromFile(string p){raw=files[p];return documents.count(raw);}
+ bool ReadValue(string,Entries& e){e=documents[raw];return true;}
+};
+struct JsonSaveContext {
+ string raw;
+ void EnableTypeDiscriminator(bool){}
+ void WriteValue(string,Entries e){raw="document-"+std::to_string(++serial);documents[raw]=e;}
+ bool SaveToFile(string p){if(failSave)return false;files[p]=raw;return true;}
+ string SaveToString(){return raw;}
+};
+struct Credentials {
+ static inline string PATH="credentials.json";
+'''+methods+r'''
+};
+int main(){
+ string token;
+ assert(Credentials::Resolve("https://one", "server", token));
+ assert(token.Length()==72&&generated==2&&files.count(Credentials::PATH));
+ string first=token;assert(!files.count(Credentials::PATH+".tmp"));
+ token="";assert(Credentials::Resolve("https://one", "server", token));
+ assert(token==first&&generated==2); // mission restart reuses the durable secret
+ assert(Credentials::Resolve("https://two", "server", token)&&token!=first);
+ assert(Credentials::Resolve("https://one", "server", token)&&token==first); // endpoint isolation
+ assert(Credentials::Resolve("https://one", "other", token)&&token!=first); // identity isolation
+ failSave=true;assert(!Credentials::Resolve("https://save-fail", "server", token)&&token.IsEmpty());failSave=false;
+ failCopy=true;assert(!Credentials::Resolve("https://copy-fail", "server", token)&&token.IsEmpty());failCopy=false;
+ failRead=true;assert(!Credentials::Resolve("https://verify-fail", "server", token)&&token.IsEmpty());failRead=false;
+ assert(Credentials::Resolve("https://one", "server", token)&&token==first);
+ auto before=generated;files[Credentials::PATH]="corrupt";
+ assert(!Credentials::Resolve("https://one", "server", token)&&token.IsEmpty()&&generated==before);
+ assert(files[Credentials::PATH]=="corrupt"); // preserve damaged evidence; do not silently rotate
+ files.clear();documents.clear();
+ for(int i=0;i<16;i++)assert(Credentials::Resolve("endpoint-"+std::to_string(i),"server",token));
+ assert(!Credentials::Resolve("endpoint-overflow","server",token)&&token.IsEmpty());
+}
+''')
+sender = p.with_name('ERR_Telemetry.c')
+pulse = sender.read_text().split('protected void Pulse(', 1)[1].split('protected void Delivered(', 1)[0]
+assert pulse.index('if (!Enabled()) return;') < pulse.index('ERR_TelemetryCredentials.Resolve')
+assert pulse.index('if (m_Dirty && !Save())') < pulse.index('ERR_TelemetryCredentials.Resolve') < pulse.index('m_Context.POST(')
+assert 'if (m_Config.Token.IsEmpty())' in pulse
+assert 'Token' not in body(sender, 'protected void Event(')
+assert 'Credentials' not in body(sender, 'protected void Purge(')  # opt-out keeps identity, deletes queued personal data
+assert 'https://co10escape-telemetry.zacekjakub.workers.dev/api/mission-events' in (ROOT/'addons/core/Configs/ERR/Telemetry.conf').read_text()
+print('PASS: durable installation credential, restart/endpoint/identity isolation, write failure, corruption, bounded retention and disabled-send gates')