郎速科技
932 lines
43 KiB
PowerShell
932 lines
43 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Za-z0-9][A-Za-z0-9_.-]{7,63}$')]
|
|
[string]$CampaignId,
|
|
|
|
[Parameter(Mandatory = $true)][string]$UatAuthorizationFile,
|
|
[Parameter(Mandatory = $true)][string]$VerifierCliPath,
|
|
[Parameter(Mandatory = $true)][string]$RuntimeCliPath,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Fa-f0-9]{64}$')]
|
|
[string]$ExpectedUatAuthorizationSha256,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Fa-f0-9]{64}$')]
|
|
[string]$ExpectedVerifierCliSha256,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4}$')]
|
|
[string]$ExpectedRuntimeCliVersion,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Fa-f0-9]{64}$')]
|
|
[string]$ExpectedRuntimeCliSha256,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Fa-f0-9]{40}$')]
|
|
[string]$ExpectedVerifierSignerThumbprint,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Fa-f0-9]{40}$')]
|
|
[string]$ExpectedRuntimeSignerThumbprint,
|
|
[string]$CaseCatalogFile = (Join-Path $PSScriptRoot `
|
|
'workflow-write-uat-case-catalog.v1.json'),
|
|
[Parameter(Mandatory = $true)][string]$OutputRoot,
|
|
[ValidateRange(1000, 60000)][int]$CliTimeoutMilliseconds = 30000
|
|
)
|
|
|
|
Set-StrictMode -Version 2.0
|
|
$ErrorActionPreference = 'Stop'
|
|
if ($PSVersionTable.PSVersion -lt [Version]'5.1' -or
|
|
[string]$PSVersionTable.PSEdition -ne 'Desktop' -or
|
|
[string]::IsNullOrWhiteSpace($env:SystemRoot)) {
|
|
throw 'workflow_uat_campaign_failed:windows_powershell_51_required'
|
|
}
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
|
|
if (-not $principal.IsInRole(
|
|
[Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'workflow_uat_campaign_failed:elevated_operator_required'
|
|
}
|
|
|
|
$utf8 = [Text.UTF8Encoding]::new($false, $true)
|
|
$maximumResponseCharacters = 4 * 1024 * 1024
|
|
$locks = New-Object System.Collections.Generic.List[IO.FileStream]
|
|
$campaignDirectory = $null
|
|
$expectedCaseCatalogSha256 = `
|
|
'23eb6c4f308d4904bf3920ed37499f05521beebde9422026f9732983c16002d5'
|
|
|
|
function Throw-CampaignError([string]$Code) {
|
|
throw ('workflow_uat_campaign_failed:' + $Code)
|
|
}
|
|
|
|
function Test-ExactProperties([object]$Value, [string[]]$Expected) {
|
|
if ($null -eq $Value) { return $false }
|
|
$names = @($Value.PSObject.Properties | ForEach-Object { $_.Name })
|
|
if ($names.Count -ne $Expected.Count) { return $false }
|
|
foreach ($name in $Expected) {
|
|
if ($names -cnotcontains $name) { return $false }
|
|
}
|
|
return $true
|
|
}
|
|
|
|
function Test-ExactStringArray([object[]]$Actual, [string[]]$Expected) {
|
|
$values = @($Actual)
|
|
if ($values.Count -ne $Expected.Count) { return $false }
|
|
for ($index = 0; $index -lt $Expected.Count; $index++) {
|
|
if ([string]$values[$index] -cne $Expected[$index]) { return $false }
|
|
}
|
|
return $true
|
|
}
|
|
|
|
function Assert-NoReparseDirectoryChain([string]$Directory, [string]$Code) {
|
|
try {
|
|
$current = [IO.DirectoryInfo]::new([IO.Path]::GetFullPath($Directory))
|
|
while ($null -ne $current) {
|
|
if (-not $current.Exists -or
|
|
(($current.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
|
|
Throw-CampaignError $Code
|
|
}
|
|
$current = $current.Parent
|
|
}
|
|
}
|
|
catch {
|
|
if ($_.Exception.Message.StartsWith('workflow_uat_campaign_failed:')) { throw }
|
|
Throw-CampaignError $Code
|
|
}
|
|
}
|
|
|
|
function Open-LockedRegularFile(
|
|
[string]$Path,
|
|
[long]$MaximumBytes,
|
|
[string]$ExpectedFileName,
|
|
[string]$Code
|
|
) {
|
|
try {
|
|
$full = [IO.Path]::GetFullPath($Path)
|
|
if (-not [IO.File]::Exists($full)) { Throw-CampaignError $Code }
|
|
$item = Get-Item -LiteralPath $full -Force
|
|
if ($item.Length -le 0 -or $item.Length -gt $MaximumBytes -or
|
|
(($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) -or
|
|
(-not [string]::IsNullOrWhiteSpace($ExpectedFileName) -and
|
|
[IO.Path]::GetFileName($full) -cne $ExpectedFileName)) {
|
|
Throw-CampaignError $Code
|
|
}
|
|
Assert-NoReparseDirectoryChain ([IO.Path]::GetDirectoryName($full)) $Code
|
|
$stream = [IO.File]::Open(
|
|
$full, [IO.FileMode]::Open, [IO.FileAccess]::Read, [IO.FileShare]::Read)
|
|
$script:locks.Add($stream)
|
|
return [pscustomobject]@{ Path = $full; Stream = $stream }
|
|
}
|
|
catch {
|
|
if ($_.Exception.Message.StartsWith('workflow_uat_campaign_failed:')) { throw }
|
|
Throw-CampaignError $Code
|
|
}
|
|
}
|
|
|
|
function Get-Sha256Hex([byte[]]$Bytes) {
|
|
$sha = [Security.Cryptography.SHA256]::Create()
|
|
try {
|
|
return ([BitConverter]::ToString($sha.ComputeHash($Bytes))).Replace('-', '').ToLowerInvariant()
|
|
}
|
|
finally { $sha.Dispose() }
|
|
}
|
|
|
|
function Get-LockedSha256([IO.FileStream]$Stream) {
|
|
$sha = [Security.Cryptography.SHA256]::Create()
|
|
try {
|
|
$Stream.Position = 0
|
|
$value = ([BitConverter]::ToString($sha.ComputeHash($Stream))).Replace('-', '').ToLowerInvariant()
|
|
$Stream.Position = 0
|
|
return $value
|
|
}
|
|
finally { $sha.Dispose() }
|
|
}
|
|
|
|
function Read-LockedJson([object]$LockedFile, [string]$Code) {
|
|
try {
|
|
$LockedFile.Stream.Position = 0
|
|
$reader = New-Object IO.StreamReader(
|
|
$LockedFile.Stream, $utf8, $true, 4096, $true)
|
|
try { $text = $reader.ReadToEnd() } finally { $reader.Dispose() }
|
|
$LockedFile.Stream.Position = 0
|
|
return $text | ConvertFrom-Json
|
|
}
|
|
catch {
|
|
if ($_.Exception.Message.StartsWith('workflow_uat_campaign_failed:')) { throw }
|
|
Throw-CampaignError $Code
|
|
}
|
|
}
|
|
|
|
function ConvertTo-UnixSeconds([object]$Value) {
|
|
$timestamp = ([DateTimeOffset]$Value).ToUniversalTime()
|
|
$epoch = [DateTimeOffset]::new(
|
|
1970, 1, 1, 0, 0, 0, [TimeSpan]::Zero)
|
|
return [int64][Math]::Floor(($timestamp - $epoch).TotalSeconds)
|
|
}
|
|
|
|
function ConvertTo-WindowsProcessArgument([string]$Value) {
|
|
if ($null -eq $Value -or $Value.Length -eq 0) { return '""' }
|
|
if (-not [Text.RegularExpressions.Regex]::IsMatch($Value, '[\s"]')) { return $Value }
|
|
$builder = New-Object Text.StringBuilder
|
|
[void]$builder.Append([char]34)
|
|
$slashes = 0
|
|
foreach ($character in $Value.ToCharArray()) {
|
|
if ([int]$character -eq 92) { $slashes++; continue }
|
|
if ([int]$character -eq 34) {
|
|
for ($index = 0; $index -lt (($slashes * 2) + 1); $index++) {
|
|
[void]$builder.Append([char]92)
|
|
}
|
|
[void]$builder.Append([char]34)
|
|
}
|
|
else {
|
|
for ($index = 0; $index -lt $slashes; $index++) {
|
|
[void]$builder.Append([char]92)
|
|
}
|
|
[void]$builder.Append($character)
|
|
}
|
|
$slashes = 0
|
|
}
|
|
for ($index = 0; $index -lt ($slashes * 2); $index++) {
|
|
[void]$builder.Append([char]92)
|
|
}
|
|
[void]$builder.Append([char]34)
|
|
return $builder.ToString()
|
|
}
|
|
|
|
function Invoke-TrustedCli([string]$CliPath, [string[]]$Arguments) {
|
|
$process = New-Object Diagnostics.Process
|
|
try {
|
|
$start = New-Object Diagnostics.ProcessStartInfo
|
|
$start.FileName = $CliPath
|
|
$start.WorkingDirectory = [IO.Path]::GetDirectoryName($CliPath)
|
|
$start.UseShellExecute = $false
|
|
$start.CreateNoWindow = $true
|
|
$start.RedirectStandardOutput = $true
|
|
$start.RedirectStandardError = $true
|
|
$start.RedirectStandardInput = $true
|
|
$start.StandardOutputEncoding = $utf8
|
|
$start.StandardErrorEncoding = $utf8
|
|
$start.Arguments = (($Arguments | ForEach-Object {
|
|
ConvertTo-WindowsProcessArgument ([string]$_)
|
|
}) -join ' ')
|
|
$process.StartInfo = $start
|
|
if (-not $process.Start()) { Throw-CampaignError 'cli_process_start_failed' }
|
|
$stdoutTask = $process.StandardOutput.ReadToEndAsync()
|
|
$stderrTask = $process.StandardError.ReadToEndAsync()
|
|
$process.StandardInput.Close()
|
|
if (-not $process.WaitForExit($CliTimeoutMilliseconds)) {
|
|
try { $process.Kill() } catch { }
|
|
Throw-CampaignError 'cli_timeout'
|
|
}
|
|
$process.WaitForExit()
|
|
$stdout = $stdoutTask.Result
|
|
$stderr = $stderrTask.Result
|
|
if ($process.ExitCode -ne 0 -or
|
|
[string]::IsNullOrWhiteSpace($stdout) -or
|
|
-not [string]::IsNullOrWhiteSpace($stderr) -or
|
|
$stdout.Length -gt $maximumResponseCharacters) {
|
|
Throw-CampaignError 'uat_authorization_verification_failed'
|
|
}
|
|
try { $envelope = $stdout | ConvertFrom-Json }
|
|
catch { Throw-CampaignError 'cli_response_invalid' }
|
|
if (-not (Test-ExactProperties $envelope @('ok', 'correlationId', 'data')) -or
|
|
$envelope.ok -ne $true -or
|
|
([string]$envelope.correlationId) -cnotmatch '^[A-Za-z0-9_.:-]{8,128}$') {
|
|
Throw-CampaignError 'cli_response_invalid'
|
|
}
|
|
return $envelope.data
|
|
}
|
|
finally { $process.Dispose() }
|
|
}
|
|
|
|
function Assert-RestrictedDirectoryAcl([string]$Path) {
|
|
try {
|
|
$sections = [Security.AccessControl.AccessControlSections]::All
|
|
$acl = [IO.Directory]::GetAccessControl($Path, $sections)
|
|
$owner = $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value
|
|
$currentSid = $identity.User.Value
|
|
$systemSid = [Security.Principal.SecurityIdentifier]::new(
|
|
[Security.Principal.WellKnownSidType]::LocalSystemSid, $null).Value
|
|
$rules = @($acl.GetAccessRules(
|
|
$true, $false, [Security.Principal.SecurityIdentifier]))
|
|
$seen = @{}
|
|
foreach ($rule in $rules) {
|
|
$sid = $rule.IdentityReference.Value
|
|
if ($rule.AccessControlType -ne
|
|
[Security.AccessControl.AccessControlType]::Allow -or
|
|
$sid -cnotin @($currentSid, $systemSid) -or
|
|
(($rule.FileSystemRights -band
|
|
[Security.AccessControl.FileSystemRights]::FullControl) -ne
|
|
[Security.AccessControl.FileSystemRights]::FullControl) -or
|
|
$seen.ContainsKey($sid)) {
|
|
Throw-CampaignError 'campaign_directory_acl_invalid'
|
|
}
|
|
$seen[$sid] = $true
|
|
}
|
|
$sddl = $acl.GetSecurityDescriptorSddlForm($sections)
|
|
if (-not $acl.AreAccessRulesProtected -or $owner -cne $currentSid -or
|
|
$rules.Count -ne 2 -or -not $seen.ContainsKey($currentSid) -or
|
|
-not $seen.ContainsKey($systemSid) -or
|
|
$sddl -cnotmatch
|
|
'S:.*\(ML;(?=[A-Z]*OI)(?=[A-Z]*CI)[A-Z]*;NW;;;HI\)') {
|
|
Throw-CampaignError 'campaign_directory_acl_invalid'
|
|
}
|
|
}
|
|
catch {
|
|
if ($_.Exception.Message.StartsWith('workflow_uat_campaign_failed:')) { throw }
|
|
Throw-CampaignError 'campaign_directory_acl_invalid'
|
|
}
|
|
}
|
|
|
|
function New-RestrictedCampaignDirectory([string]$Root, [string]$Name) {
|
|
$fullRoot = [IO.Path]::GetFullPath($Root)
|
|
if (-not [IO.Directory]::Exists($fullRoot)) {
|
|
Throw-CampaignError 'output_root_invalid'
|
|
}
|
|
Assert-NoReparseDirectoryChain $fullRoot 'output_root_invalid'
|
|
$target = Join-Path $fullRoot $Name
|
|
if ([IO.File]::Exists($target) -or [IO.Directory]::Exists($target)) {
|
|
Throw-CampaignError 'campaign_directory_exists'
|
|
}
|
|
[IO.Directory]::CreateDirectory($target) | Out-Null
|
|
$currentUser = $identity.User
|
|
$localSystem = [Security.Principal.SecurityIdentifier]::new(
|
|
[Security.Principal.WellKnownSidType]::LocalSystemSid, $null)
|
|
$security = New-Object Security.AccessControl.DirectorySecurity
|
|
$security.SetOwner($currentUser)
|
|
$security.SetAccessRuleProtection($true, $false)
|
|
$inheritance = [Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
|
|
[Security.AccessControl.InheritanceFlags]::ObjectInherit
|
|
foreach ($principalSid in @($currentUser, $localSystem)) {
|
|
$rule = [Security.AccessControl.FileSystemAccessRule]::new(
|
|
$principalSid,
|
|
[Security.AccessControl.FileSystemRights]::FullControl,
|
|
$inheritance,
|
|
[Security.AccessControl.PropagationFlags]::None,
|
|
[Security.AccessControl.AccessControlType]::Allow)
|
|
$security.AddAccessRule($rule)
|
|
}
|
|
[IO.Directory]::SetAccessControl($target, $security)
|
|
& "$env:SystemRoot\System32\icacls.exe" `
|
|
$target '/setintegritylevel' '(OI)(CI)H' | Out-Null
|
|
if ($LASTEXITCODE -ne 0) { Throw-CampaignError 'campaign_directory_acl_invalid' }
|
|
Assert-RestrictedDirectoryAcl $target
|
|
return $target
|
|
}
|
|
|
|
function Write-NewJson([string]$Path, [object]$Value, [int]$Depth) {
|
|
$bytes = $utf8.GetBytes(($Value | ConvertTo-Json -Depth $Depth) + [Environment]::NewLine)
|
|
$stream = [IO.File]::Open(
|
|
$Path, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
|
|
try { $stream.Write($bytes, 0, $bytes.Length); $stream.Flush() }
|
|
finally { $stream.Dispose() }
|
|
}
|
|
|
|
$purchaseCases = @(
|
|
'purchase_unique_match_commit', 'purchase_ambiguous_match_blocked',
|
|
'purchase_overallocation_blocked', 'purchase_permission_denied',
|
|
'purchase_database_permission_recheck_denied',
|
|
'purchase_currency_field_missing_blocked',
|
|
'purchase_currency_crosswalk_unapproved_blocked',
|
|
'purchase_row_scope_denied', 'purchase_runtime_recheck_blocked',
|
|
'purchase_transaction_rollback', 'purchase_idempotency_replay',
|
|
'purchase_idempotency_conflict', 'purchase_audit_correlated'
|
|
)
|
|
$leaveCases = @(
|
|
'leave_natural_language_resolution', 'leave_multi_day_calendar_resolution',
|
|
'leave_resolution_proof_bypass_blocked', 'leave_ambiguous_type_blocked',
|
|
'leave_ambiguous_flow_type_blocked', 'leave_time_segment_required_blocked',
|
|
'leave_local_time_zone_rejected', 'leave_other_employee_denied',
|
|
'leave_permission_denied', 'leave_database_permission_recheck_denied',
|
|
'leave_create_draft_commit', 'leave_submit_separate_confirmation',
|
|
'leave_overlap_blocked', 'leave_stale_flow_type_blocked',
|
|
'leave_runtime_recheck_blocked', 'leave_transaction_rollback',
|
|
'leave_idempotency_replay', 'leave_idempotency_conflict',
|
|
'leave_audit_correlated'
|
|
)
|
|
$executeCases = @(
|
|
'purchase_unique_match_commit',
|
|
'purchase_database_permission_recheck_denied',
|
|
'purchase_currency_field_missing_blocked',
|
|
'purchase_currency_crosswalk_unapproved_blocked',
|
|
'purchase_row_scope_denied', 'purchase_runtime_recheck_blocked',
|
|
'purchase_transaction_rollback', 'purchase_idempotency_replay',
|
|
'purchase_idempotency_conflict',
|
|
'leave_database_permission_recheck_denied', 'leave_create_draft_commit',
|
|
'leave_submit_separate_confirmation', 'leave_stale_flow_type_blocked',
|
|
'leave_runtime_recheck_blocked', 'leave_transaction_rollback',
|
|
'leave_idempotency_replay', 'leave_idempotency_conflict'
|
|
)
|
|
$derivedCases = @('purchase_audit_correlated', 'leave_audit_correlated')
|
|
$postPlanStagingCases = @(
|
|
'purchase_runtime_recheck_blocked',
|
|
'leave_stale_flow_type_blocked',
|
|
'leave_runtime_recheck_blocked'
|
|
)
|
|
|
|
function Get-ExpectedCommand([string]$CaseCode) {
|
|
if ($CaseCode.StartsWith('purchase_', [StringComparison]::Ordinal)) {
|
|
return 'purchase.invoice.create'
|
|
}
|
|
if ($CaseCode -in @(
|
|
'leave_natural_language_resolution',
|
|
'leave_multi_day_calendar_resolution',
|
|
'leave_ambiguous_type_blocked',
|
|
'leave_ambiguous_flow_type_blocked',
|
|
'leave_time_segment_required_blocked',
|
|
'leave_other_employee_denied')) {
|
|
return 'hr.leave.resolve'
|
|
}
|
|
if ($CaseCode -eq 'leave_submit_separate_confirmation') {
|
|
return 'hr.leave.submit'
|
|
}
|
|
return 'hr.leave.create'
|
|
}
|
|
|
|
function Get-AllowedCommands([string]$CommandName) {
|
|
if ($CommandName -eq 'purchase.invoice.create') {
|
|
return @('purchase.invoice.resolve', 'purchase.invoice.create')
|
|
}
|
|
if ($CommandName -eq 'hr.leave.create') {
|
|
return @('hr.leave.resolve', 'hr.leave.create')
|
|
}
|
|
return @($CommandName)
|
|
}
|
|
|
|
function Get-Dependency([string]$CaseCode) {
|
|
if ($CaseCode -in @(
|
|
'purchase_idempotency_replay', 'purchase_idempotency_conflict',
|
|
'purchase_audit_correlated')) {
|
|
return 'purchase_unique_match_commit'
|
|
}
|
|
if ($CaseCode -in @(
|
|
'leave_submit_separate_confirmation', 'leave_idempotency_replay',
|
|
'leave_idempotency_conflict', 'leave_audit_correlated')) {
|
|
return 'leave_create_draft_commit'
|
|
}
|
|
return $null
|
|
}
|
|
|
|
function Get-IdempotencyPolicy([string]$CaseCode, [string]$CaptureMode) {
|
|
if ($CaptureMode -eq 'plan_only') { return 'not_applicable' }
|
|
if ($CaptureMode -eq 'derived_audit') { return 'derived_no_execute' }
|
|
if ($CaseCode.EndsWith('_idempotency_replay', [StringComparison]::Ordinal)) {
|
|
return 'reuse_dependency_key_and_input'
|
|
}
|
|
if ($CaseCode.EndsWith('_idempotency_conflict', [StringComparison]::Ordinal)) {
|
|
return 'reuse_dependency_key_with_different_input'
|
|
}
|
|
return 'new_unique_key'
|
|
}
|
|
|
|
function Test-SafeCatalogText([object]$Value, [int]$MaximumLength) {
|
|
if ($null -eq $Value) { return $false }
|
|
$text = [string]$Value
|
|
if ([string]::IsNullOrWhiteSpace($text) -or
|
|
$text.Length -gt $MaximumLength -or
|
|
$text -cne $text.Trim() -or
|
|
[Text.RegularExpressions.Regex]::IsMatch($text, '[\x00-\x1f\x7f]') -or
|
|
[Text.RegularExpressions.Regex]::IsMatch(
|
|
$text,
|
|
'(?i)(?:https?|jdbc|file)://|\b(?:password|passwd|secret|api[_ -]?key|token)\b|\b(?:\d{1,3}\.){3}\d{1,3}\b|sk-[A-Za-z0-9_-]{8,}|\b(?:insert\s+into|update\s+\S+\s+set|delete\s+from|drop\s+table|truncate\s+table|alter\s+table)\b')) {
|
|
return $false
|
|
}
|
|
return $true
|
|
}
|
|
|
|
function Test-SafeCatalogTextArray(
|
|
[object]$Value,
|
|
[int]$MinimumCount,
|
|
[int]$MaximumCount
|
|
) {
|
|
if ($null -eq $Value -or -not ($Value -is [Array])) { return $false }
|
|
$items = @($Value)
|
|
if ($items.Count -lt $MinimumCount -or $items.Count -gt $MaximumCount) {
|
|
return $false
|
|
}
|
|
foreach ($item in $items) {
|
|
if (-not (Test-SafeCatalogText $item 500)) { return $false }
|
|
}
|
|
return $true
|
|
}
|
|
|
|
function Assert-CaseCatalog([object]$Catalog) {
|
|
if (-not (Test-ExactProperties $Catalog @(
|
|
'schemaVersion', 'packageType', 'safety', 'workflows')) -or
|
|
[string]$Catalog.schemaVersion -cne '1.0' -or
|
|
[string]$Catalog.packageType -cne 'workflow_write_uat_case_catalog' -or
|
|
-not (Test-ExactProperties $Catalog.safety @(
|
|
'productionUseProhibited',
|
|
'automaticDatabaseOrConfigurationChanges',
|
|
'approvedRestorePointRequired', 'containsCredentials',
|
|
'containsBusinessIdentifiers', 'executableInstructionsIncluded')) -or
|
|
$Catalog.safety.productionUseProhibited -ne $true -or
|
|
$Catalog.safety.automaticDatabaseOrConfigurationChanges -ne $false -or
|
|
$Catalog.safety.approvedRestorePointRequired -ne $true -or
|
|
$Catalog.safety.containsCredentials -ne $false -or
|
|
$Catalog.safety.containsBusinessIdentifiers -ne $false -or
|
|
$Catalog.safety.executableInstructionsIncluded -ne $false) {
|
|
Throw-CampaignError 'case_catalog_safety_invalid'
|
|
}
|
|
|
|
$workflows = @($Catalog.workflows)
|
|
if ($workflows.Count -ne 2) {
|
|
Throw-CampaignError 'case_catalog_workflow_coverage_invalid'
|
|
}
|
|
$lookup = @{}
|
|
for ($workflowIndex = 0; $workflowIndex -lt 2; $workflowIndex++) {
|
|
$workflowName = if ($workflowIndex -eq 0) { 'purchase' } else { 'leave' }
|
|
$expectedCases = if ($workflowName -eq 'purchase') {
|
|
$purchaseCases
|
|
} else { $leaveCases }
|
|
$workflow = $workflows[$workflowIndex]
|
|
if (-not (Test-ExactProperties $workflow @(
|
|
'workflow', 'caseCount', 'cases')) -or
|
|
[string]$workflow.workflow -cne $workflowName -or
|
|
[int]$workflow.caseCount -ne $expectedCases.Count) {
|
|
Throw-CampaignError 'case_catalog_workflow_contract_invalid'
|
|
}
|
|
$cases = @($workflow.cases)
|
|
if ($cases.Count -ne $expectedCases.Count) {
|
|
Throw-CampaignError 'case_catalog_case_coverage_invalid'
|
|
}
|
|
for ($index = 0; $index -lt $expectedCases.Count; $index++) {
|
|
$caseCode = $expectedCases[$index]
|
|
$case = $cases[$index]
|
|
$expectedCommand = Get-ExpectedCommand $caseCode
|
|
$expectedCaptureMode = if ($caseCode -in $derivedCases) {
|
|
'derived_audit'
|
|
} elseif ($caseCode -in $executeCases) {
|
|
'execute'
|
|
} else { 'plan_only' }
|
|
$expectedMutation = if ($caseCode -in @(
|
|
'purchase_unique_match_commit', 'leave_create_draft_commit',
|
|
'leave_submit_separate_confirmation')) {
|
|
'positive'
|
|
} else { 'zero' }
|
|
$expectedConfirmation = if ($expectedCaptureMode -eq 'derived_audit') {
|
|
'inherited_required'
|
|
} elseif ($expectedCaptureMode -eq 'execute') {
|
|
'required'
|
|
} else { 'prohibited' }
|
|
$expectedSourceProof = $caseCode -in @(
|
|
'purchase_unique_match_commit', 'purchase_idempotency_replay',
|
|
'purchase_audit_correlated')
|
|
if (-not (Test-ExactProperties $case @(
|
|
'sequence', 'caseCode', 'title', 'commandName',
|
|
'captureMode', 'expectedResultCode', 'expectedIssueCode',
|
|
'expectedMutationPolicy', 'nativeConfirmationPolicy',
|
|
'minimumAuditEventCount', 'sourceDocumentProofRequired',
|
|
'primaryRole', 'supportingRoles', 'fixtureCode',
|
|
'preconditions', 'operatorSteps', 'dbaReadOnlyChecks',
|
|
'cleanupSteps', 'retryPolicy')) -or
|
|
[int]$case.sequence -ne ($index + 1) -or
|
|
[string]$case.caseCode -cne $caseCode -or
|
|
[string]$case.commandName -cne $expectedCommand -or
|
|
[string]$case.captureMode -cne $expectedCaptureMode -or
|
|
([string]$case.expectedResultCode) -cnotmatch
|
|
'^[a-z][a-z0-9_]{2,95}$' -or
|
|
($null -ne $case.expectedIssueCode -and
|
|
([string]$case.expectedIssueCode) -cnotmatch
|
|
'^[a-z][a-z0-9_]{2,95}$') -or
|
|
[string]$case.expectedMutationPolicy -cne $expectedMutation -or
|
|
[string]$case.nativeConfirmationPolicy -cne $expectedConfirmation -or
|
|
[int]$case.minimumAuditEventCount -ne
|
|
$(if ($expectedCaptureMode -eq 'plan_only') { 1 } else { 2 }) -or
|
|
[bool]$case.sourceDocumentProofRequired -ne $expectedSourceProof -or
|
|
-not (Test-SafeCatalogText $case.title 120) -or
|
|
([string]$case.primaryRole) -cnotmatch '^[a-z][a-z0-9_]{2,63}$' -or
|
|
([string]$case.fixtureCode) -cnotmatch '^[a-z][a-z0-9_]{2,95}$' -or
|
|
([string]$case.retryPolicy) -cnotin @(
|
|
'single_success_then_relationship_cases_only',
|
|
'new_capture_allowed_while_authorization_active',
|
|
'new_plan_and_new_key_required',
|
|
'dependency_key_relationship_required',
|
|
'derived_with_dependency_only') -or
|
|
-not (Test-SafeCatalogTextArray $case.preconditions 1 12) -or
|
|
-not (Test-SafeCatalogTextArray $case.operatorSteps 1 12) -or
|
|
-not (Test-SafeCatalogTextArray $case.dbaReadOnlyChecks 1 12) -or
|
|
-not (Test-SafeCatalogTextArray $case.cleanupSteps 1 12) -or
|
|
$lookup.ContainsKey($caseCode)) {
|
|
Throw-CampaignError 'case_catalog_case_contract_invalid'
|
|
}
|
|
if (-not ($case.supportingRoles -is [Array])) {
|
|
Throw-CampaignError 'case_catalog_case_contract_invalid'
|
|
}
|
|
$roles = @($case.supportingRoles)
|
|
if ($roles.Count -lt 1 -or $roles.Count -gt 8 -or
|
|
@($roles | Select-Object -Unique).Count -ne $roles.Count) {
|
|
Throw-CampaignError 'case_catalog_case_contract_invalid'
|
|
}
|
|
foreach ($role in $roles) {
|
|
if ([string]$role -cnotmatch '^[a-z][a-z0-9_]{2,63}$' -or
|
|
[string]$role -ceq [string]$case.primaryRole) {
|
|
Throw-CampaignError 'case_catalog_case_contract_invalid'
|
|
}
|
|
}
|
|
$lookup[$caseCode] = $case
|
|
}
|
|
}
|
|
if ($lookup.Count -ne 32) {
|
|
Throw-CampaignError 'case_catalog_case_coverage_invalid'
|
|
}
|
|
return $lookup
|
|
}
|
|
|
|
try {
|
|
$caseCatalog = Open-LockedRegularFile `
|
|
$CaseCatalogFile (256KB) 'workflow-write-uat-case-catalog.v1.json' `
|
|
'case_catalog_file_invalid'
|
|
$authorization = Open-LockedRegularFile `
|
|
$UatAuthorizationFile (512KB) '' 'uat_authorization_file_invalid'
|
|
$verifierCli = Open-LockedRegularFile `
|
|
$VerifierCliPath (128MB) 'lserp-cli.exe' 'verifier_cli_invalid'
|
|
$runtimeCli = Open-LockedRegularFile `
|
|
$RuntimeCliPath (128MB) 'lserp-agent-cli.exe' 'runtime_cli_invalid'
|
|
if ($verifierCli.Path -ieq $runtimeCli.Path) {
|
|
Throw-CampaignError 'cli_role_path_conflict'
|
|
}
|
|
$caseCatalogHash = Get-LockedSha256 $caseCatalog.Stream
|
|
if ($caseCatalogHash -cne $expectedCaseCatalogSha256) {
|
|
Throw-CampaignError 'case_catalog_hash_mismatch'
|
|
}
|
|
$caseCatalogJson = Read-LockedJson $caseCatalog 'case_catalog_json_invalid'
|
|
$catalogCaseByCode = Assert-CaseCatalog $caseCatalogJson
|
|
$authorizationSourceHash = Get-LockedSha256 $authorization.Stream
|
|
if ($authorizationSourceHash -cne
|
|
$ExpectedUatAuthorizationSha256.ToLowerInvariant()) {
|
|
Throw-CampaignError 'uat_authorization_hash_mismatch'
|
|
}
|
|
$verifierCliHash = Get-LockedSha256 $verifierCli.Stream
|
|
$runtimeCliHash = Get-LockedSha256 $runtimeCli.Stream
|
|
if ($verifierCliHash -cne
|
|
$ExpectedVerifierCliSha256.ToLowerInvariant()) {
|
|
Throw-CampaignError 'verifier_cli_hash_mismatch'
|
|
}
|
|
if ($runtimeCliHash -cne $ExpectedRuntimeCliSha256.ToLowerInvariant()) {
|
|
Throw-CampaignError 'runtime_cli_hash_mismatch'
|
|
}
|
|
$verifierSignature = Get-AuthenticodeSignature -LiteralPath $verifierCli.Path
|
|
$verifierSigner = if ($null -eq $verifierSignature.SignerCertificate) { '' } else {
|
|
([string]$verifierSignature.SignerCertificate.Thumbprint).Replace(' ', '').ToUpperInvariant()
|
|
}
|
|
if ($verifierSignature.Status -ne
|
|
[Management.Automation.SignatureStatus]::Valid -or
|
|
$verifierSigner -cne
|
|
$ExpectedVerifierSignerThumbprint.ToUpperInvariant()) {
|
|
Throw-CampaignError 'verifier_cli_signature_invalid'
|
|
}
|
|
$runtimeSignature = Get-AuthenticodeSignature -LiteralPath $runtimeCli.Path
|
|
$runtimeSigner = if ($null -eq $runtimeSignature.SignerCertificate) { '' } else {
|
|
([string]$runtimeSignature.SignerCertificate.Thumbprint).Replace(' ', '').ToUpperInvariant()
|
|
}
|
|
if ($runtimeSignature.Status -ne
|
|
[Management.Automation.SignatureStatus]::Valid -or
|
|
$runtimeSigner -cne
|
|
$ExpectedRuntimeSignerThumbprint.ToUpperInvariant()) {
|
|
Throw-CampaignError 'runtime_cli_signature_invalid'
|
|
}
|
|
|
|
$runtimeIdentity = Invoke-TrustedCli $runtimeCli.Path @(
|
|
'version', '--correlation-id',
|
|
('campaign-runtime-' + [Guid]::NewGuid().ToString('N'))
|
|
)
|
|
if (-not (Test-ExactProperties $runtimeIdentity @(
|
|
'component', 'version', 'protocolVersion', 'bridgeOnly',
|
|
'databaseDirectAccess', 'sessionSource')) -or
|
|
[string]$runtimeIdentity.component -cne 'lserp-agent-cli' -or
|
|
[string]$runtimeIdentity.version -cne $ExpectedRuntimeCliVersion -or
|
|
[string]$runtimeIdentity.protocolVersion -cne '1.0' -or
|
|
$runtimeIdentity.bridgeOnly -ne $true -or
|
|
$runtimeIdentity.databaseDirectAccess -ne $false -or
|
|
[string]$runtimeIdentity.sessionSource -cne
|
|
'current_logged_in_erp_process') {
|
|
Throw-CampaignError 'runtime_cli_identity_invalid'
|
|
}
|
|
|
|
$verified = Invoke-TrustedCli $verifierCli.Path @(
|
|
'acceptance', 'verify-uat-authorization', '--input', $authorization.Path,
|
|
'--correlation-id', ('campaign-auth-' + [Guid]::NewGuid().ToString('N'))
|
|
)
|
|
$verifiedProperties = @(
|
|
'packageType', 'schemaVersion', 'sourceSha256', 'contentSha256',
|
|
'authorizationId', 'authorizationIdSha256', 'customerId',
|
|
'environmentId', 'environmentClass', 'erpScope',
|
|
'runtimeConfigurationSha256', 'customerProfileSha256',
|
|
'rolloutPolicySha256', 'sourceCommit', 'packageSha256',
|
|
'erpExecutable', 'runtimeCli', 'verifierCli', 'workflows', 'issuedAtUtc',
|
|
'expiresAtUtc', 'approvedBy', 'signatureVerified', 'uatAuthorized',
|
|
'productionReady', 'note'
|
|
)
|
|
if (-not (Test-ExactProperties $verified $verifiedProperties) -or
|
|
$verified.packageType -cne 'workflow_write_uat_authorization' -or
|
|
$verified.schemaVersion -cne '1.2' -or
|
|
[string]$verified.sourceSha256 -cne $authorizationSourceHash -or
|
|
-not (Test-ExactProperties $verified.runtimeCli @(
|
|
'fileName', 'version', 'sha256', 'signerThumbprint',
|
|
'requiresElevation', 'bridgeOnly', 'databaseDirectAccess',
|
|
'sessionSource')) -or
|
|
[string]$verified.runtimeCli.fileName -cne 'lserp-agent-cli.exe' -or
|
|
[string]$verified.runtimeCli.version -cne $ExpectedRuntimeCliVersion -or
|
|
[string]$verified.runtimeCli.sha256 -cne $runtimeCliHash -or
|
|
([string]$verified.runtimeCli.signerThumbprint).ToUpperInvariant() -cne
|
|
$runtimeSigner -or
|
|
$verified.runtimeCli.requiresElevation -ne $false -or
|
|
$verified.runtimeCli.bridgeOnly -ne $true -or
|
|
$verified.runtimeCli.databaseDirectAccess -ne $false -or
|
|
[string]$verified.runtimeCli.sessionSource -cne
|
|
'current_logged_in_erp_process' -or
|
|
[string]$verified.verifierCli.sha256 -cne $verifierCliHash -or
|
|
([string]$verified.verifierCli.signerThumbprint).ToUpperInvariant() -cne
|
|
$verifierSigner -or
|
|
$verified.verifierCli.requiresElevation -ne $true -or
|
|
$verified.environmentClass -cne 'recoverable_uat' -or
|
|
$verified.signatureVerified -ne $true -or
|
|
$verified.uatAuthorized -ne $true -or
|
|
$verified.productionReady -ne $false) {
|
|
Throw-CampaignError 'uat_authorization_contract_mismatch'
|
|
}
|
|
|
|
$authorization.Stream.Position = 0
|
|
$reader = New-Object IO.StreamReader($authorization.Stream, $utf8, $true, 4096, $true)
|
|
try { $authorizationText = $reader.ReadToEnd() } finally { $reader.Dispose() }
|
|
try { $authorizationJson = $authorizationText | ConvertFrom-Json }
|
|
catch { Throw-CampaignError 'uat_authorization_json_invalid' }
|
|
if (-not (Test-ExactProperties $authorizationJson @(
|
|
'schemaVersion', 'contentSha256', 'signatureAlgorithm',
|
|
'certificateThumbprint', 'signatureBase64', 'content')) -or
|
|
[string]$authorizationJson.schemaVersion -cne '1.2' -or
|
|
[string]$authorizationJson.contentSha256 -cne [string]$verified.contentSha256) {
|
|
Throw-CampaignError 'uat_authorization_json_invalid'
|
|
}
|
|
$content = $authorizationJson.content
|
|
if (-not (Test-ExactProperties $content @(
|
|
'packageType', 'authorizationId', 'customerId', 'environmentId',
|
|
'environmentClass', 'erpScope', 'runtimeConfigurationSha256',
|
|
'customerProfileSha256', 'rolloutPolicySha256', 'sourceCommit',
|
|
'packageSha256', 'erpExecutable', 'runtimeCli', 'verifierCli', 'safety',
|
|
'workflows', 'issuedAtUtc', 'expiresAtUtc', 'approvedBy', 'note')) -or
|
|
-not (Test-ExactProperties $content.erpScope @(
|
|
'accountBook', 'subSystemId', 'userId', 'userName',
|
|
'databaseScopeFingerprint')) -or
|
|
[string]$content.erpScope.databaseScopeFingerprint -cne
|
|
[string]$verified.erpScope.databaseScopeFingerprint -or
|
|
-not (Test-ExactProperties $content.safety @(
|
|
'databaseBackupVerified', 'restoreProcedureVerified',
|
|
'nonProductionEnvironmentVerified', 'productionUseProhibited',
|
|
'nativeConfirmationRequired', 'transactionAndAuditRequired',
|
|
'maximumPlanAttemptsPerCase', 'maximumExecuteAttemptsPerCase')) -or
|
|
$content.safety.databaseBackupVerified -ne $true -or
|
|
$content.safety.restoreProcedureVerified -ne $true -or
|
|
$content.safety.nonProductionEnvironmentVerified -ne $true -or
|
|
$content.safety.productionUseProhibited -ne $true -or
|
|
$content.safety.nativeConfirmationRequired -ne $true -or
|
|
$content.safety.transactionAndAuditRequired -ne $true -or
|
|
[int]$content.safety.maximumPlanAttemptsPerCase -ne 6 -or
|
|
[int]$content.safety.maximumExecuteAttemptsPerCase -ne 3) {
|
|
Throw-CampaignError 'uat_authorization_safety_invalid'
|
|
}
|
|
|
|
$workflowNames = @($verified.workflows | ForEach-Object { [string]$_.workflow })
|
|
if ($workflowNames.Count -lt 1 -or $workflowNames.Count -gt 2 -or
|
|
@($workflowNames | Select-Object -Unique).Count -ne $workflowNames.Count -or
|
|
@($workflowNames | Where-Object { $_ -cnotin @('purchase', 'leave') }).Count -ne 0) {
|
|
Throw-CampaignError 'uat_authorization_workflows_invalid'
|
|
}
|
|
$seenTokenHashes = @{}
|
|
$campaignWorkflows = New-Object System.Collections.Generic.List[object]
|
|
foreach ($workflowName in @('purchase', 'leave')) {
|
|
if ($workflowNames -cnotcontains $workflowName) { continue }
|
|
$expectedCases = if ($workflowName -eq 'purchase') { $purchaseCases } else { $leaveCases }
|
|
$sourceWorkflow = @($content.workflows | Where-Object {
|
|
[string]$_.workflow -ceq $workflowName
|
|
})
|
|
$verifiedWorkflow = @($verified.workflows | Where-Object {
|
|
[string]$_.workflow -ceq $workflowName
|
|
})
|
|
if ($sourceWorkflow.Count -ne 1 -or $verifiedWorkflow.Count -ne 1 -or
|
|
-not (Test-ExactProperties $sourceWorkflow[0] @(
|
|
'workflow', 'moduleCode', 'adapterId', 'adapterVersion', 'cases')) -or
|
|
[int]$verifiedWorkflow[0].caseCount -ne $expectedCases.Count -or
|
|
[string]$sourceWorkflow[0].moduleCode -cne [string]$verifiedWorkflow[0].moduleCode) {
|
|
Throw-CampaignError 'uat_authorization_workflow_contract_invalid'
|
|
}
|
|
$sourceCases = @($sourceWorkflow[0].cases)
|
|
if ($sourceCases.Count -ne $expectedCases.Count) {
|
|
Throw-CampaignError 'uat_authorization_case_coverage_invalid'
|
|
}
|
|
$campaignCases = New-Object System.Collections.Generic.List[object]
|
|
for ($index = 0; $index -lt $expectedCases.Count; $index++) {
|
|
$caseCode = $expectedCases[$index]
|
|
$sourceCase = $sourceCases[$index]
|
|
$commandName = Get-ExpectedCommand $caseCode
|
|
$catalogCase = $catalogCaseByCode[$caseCode]
|
|
$allowedCommands = @(Get-AllowedCommands $commandName)
|
|
if (-not (Test-ExactProperties $sourceCase @(
|
|
'caseCode', 'expectedCommandName', 'allowedCommands', 'tokenSha256')) -or
|
|
[string]$sourceCase.caseCode -cne $caseCode -or
|
|
[string]$sourceCase.expectedCommandName -cne $commandName -or
|
|
[string]$catalogCase.commandName -cne $commandName -or
|
|
-not (Test-ExactStringArray @($sourceCase.allowedCommands) $allowedCommands) -or
|
|
([string]$sourceCase.tokenSha256) -cnotmatch '^[a-f0-9]{64}$' -or
|
|
$seenTokenHashes.ContainsKey([string]$sourceCase.tokenSha256)) {
|
|
Throw-CampaignError 'uat_authorization_case_contract_invalid'
|
|
}
|
|
$seenTokenHashes[[string]$sourceCase.tokenSha256] = $true
|
|
$captureMode = if ($caseCode -in $derivedCases) {
|
|
'derived_audit'
|
|
} elseif ($caseCode -in $executeCases) {
|
|
'execute'
|
|
} else { 'plan_only' }
|
|
if ([string]$catalogCase.captureMode -cne $captureMode) {
|
|
Throw-CampaignError 'case_catalog_case_contract_invalid'
|
|
}
|
|
$dependency = Get-Dependency $caseCode
|
|
$auditOutput = if ($caseCode -eq 'purchase_unique_match_commit') {
|
|
'purchase_audit_correlated.json'
|
|
} elseif ($caseCode -eq 'leave_create_draft_commit') {
|
|
'leave_audit_correlated.json'
|
|
} else { $null }
|
|
$operatorStage = if ($captureMode -eq 'derived_audit') {
|
|
'derived_from_dependency'
|
|
} elseif ($caseCode -in $postPlanStagingCases) {
|
|
'post_plan_change_required'
|
|
} elseif ($caseCode.EndsWith('_transaction_rollback', [StringComparison]::Ordinal)) {
|
|
'controlled_failure_fixture_required'
|
|
} elseif ($null -ne $dependency) {
|
|
'relationship_fixture_required'
|
|
} else { 'case_fixture_required' }
|
|
$campaignCases.Add([pscustomobject][ordered]@{
|
|
sequence = $index + 1
|
|
caseCode = $caseCode
|
|
commandName = $commandName
|
|
captureMode = $captureMode
|
|
execute = ($captureMode -eq 'execute')
|
|
pauseAfterPlanForOperatorStaging = ($caseCode -in $postPlanStagingCases)
|
|
operatorStage = $operatorStage
|
|
dependencyCaseCode = $dependency
|
|
idempotencyPolicy = Get-IdempotencyPolicy $caseCode $captureMode
|
|
inputFile = if ($captureMode -eq 'derived_audit') {
|
|
$null
|
|
} else { 'private-input/' + $caseCode + '.json' }
|
|
evidenceFile = $caseCode + '.json'
|
|
correlatedAuditEvidenceFile = $auditOutput
|
|
requiresDbaReadOnlyObservation = $true
|
|
expectedBusinessMutation =
|
|
[string]$catalogCase.expectedMutationPolicy
|
|
})
|
|
}
|
|
$campaignWorkflows.Add([pscustomobject][ordered]@{
|
|
workflow = $workflowName
|
|
moduleCode = [string]$sourceWorkflow[0].moduleCode
|
|
caseCount = $expectedCases.Count
|
|
caseIndexFile = 'evidence/' + $workflowName + '-index.json'
|
|
assembledCasesFile = 'evidence/' + $workflowName + '-cases.json'
|
|
cases = @($campaignCases)
|
|
})
|
|
}
|
|
if ($campaignWorkflows.Count -ne $workflowNames.Count) {
|
|
Throw-CampaignError 'uat_authorization_workflows_invalid'
|
|
}
|
|
|
|
$campaignDirectory = New-RestrictedCampaignDirectory $OutputRoot $CampaignId
|
|
$privateInputDirectory = Join-Path $campaignDirectory 'private-input'
|
|
$evidenceDirectory = Join-Path $campaignDirectory 'evidence'
|
|
[IO.Directory]::CreateDirectory($privateInputDirectory) | Out-Null
|
|
[IO.Directory]::CreateDirectory($evidenceDirectory) | Out-Null
|
|
Assert-RestrictedDirectoryAcl $campaignDirectory
|
|
|
|
$createdAtUnixSeconds = ConvertTo-UnixSeconds ([DateTimeOffset]::UtcNow)
|
|
$manifestContent = [pscustomobject][ordered]@{
|
|
packageType = 'workflow_write_uat_campaign'
|
|
campaignId = $CampaignId
|
|
createdAtUnixSeconds = $createdAtUnixSeconds
|
|
caseCatalogSha256 = $caseCatalogHash
|
|
authorization = [pscustomobject][ordered]@{
|
|
sourceSha256 = [string]$verified.sourceSha256
|
|
contentSha256 = [string]$verified.contentSha256
|
|
authorizationIdSha256 = [string]$verified.authorizationIdSha256
|
|
customerId = [string]$verified.customerId
|
|
environmentId = [string]$verified.environmentId
|
|
environmentClass = 'recoverable_uat'
|
|
issuedAtUnixSeconds = ConvertTo-UnixSeconds $verified.issuedAtUtc
|
|
expiresAtUnixSeconds = ConvertTo-UnixSeconds $verified.expiresAtUtc
|
|
verifierCliSha256 = $verifierCliHash
|
|
verifierCliSignerThumbprint = $verifierSigner
|
|
runtimeCliVersion = $ExpectedRuntimeCliVersion
|
|
runtimeCliSha256 = $runtimeCliHash
|
|
runtimeCliSignerThumbprint = $runtimeSigner
|
|
userIdSha256 = [string]$verified.erpScope.userIdSha256
|
|
userNameSha256 = [string]$verified.erpScope.userNameSha256
|
|
databaseScopeFingerprint =
|
|
[string]$verified.erpScope.databaseScopeFingerprint
|
|
}
|
|
safety = [pscustomobject][ordered]@{
|
|
productionUseProhibited = $true
|
|
automaticDatabaseWrites = $false
|
|
oneCaseAtATime = $true
|
|
operatorStagingRequired = $true
|
|
authorizationReverificationRequiredBeforeResume = $true
|
|
tokenMaterialIncluded = $false
|
|
idempotencyMaterialIncluded = $false
|
|
privateBusinessInputIncluded = $false
|
|
resumeStateDerivedOnlyFromEvidence = $true
|
|
}
|
|
directories = [pscustomobject][ordered]@{
|
|
privateInput = 'private-input'
|
|
evidence = 'evidence'
|
|
}
|
|
workflows = @($campaignWorkflows)
|
|
productionReady = $false
|
|
}
|
|
$manifestContentJson = $manifestContent | ConvertTo-Json -Depth 14 -Compress
|
|
$manifestContentSha256 = Get-Sha256Hex $utf8.GetBytes($manifestContentJson)
|
|
$manifest = [pscustomobject][ordered]@{
|
|
schemaVersion = '1.1'
|
|
contentSha256 = $manifestContentSha256
|
|
content = $manifestContent
|
|
}
|
|
Write-NewJson (Join-Path $campaignDirectory 'campaign.json') $manifest 16
|
|
foreach ($workflow in $campaignWorkflows) {
|
|
$indexDocument = [pscustomobject][ordered]@{
|
|
schemaVersion = '1.0'
|
|
workflow = [string]$workflow.workflow
|
|
caseFiles = @($workflow.cases | ForEach-Object { [string]$_.evidenceFile })
|
|
}
|
|
Write-NewJson `
|
|
(Join-Path $evidenceDirectory ([string]$workflow.workflow + '-index.json')) `
|
|
$indexDocument 5
|
|
}
|
|
$campaignCaseCount = 0
|
|
foreach ($workflow in $campaignWorkflows) {
|
|
$campaignCaseCount += @($workflow.cases).Count
|
|
}
|
|
|
|
[pscustomobject][ordered]@{
|
|
campaignFile = Join-Path $campaignDirectory 'campaign.json'
|
|
campaignId = $CampaignId
|
|
campaignContentSha256 = $manifestContentSha256
|
|
caseCatalogSha256 = $caseCatalogHash
|
|
workflowCount = $campaignWorkflows.Count
|
|
caseCount = $campaignCaseCount
|
|
authorizationSignatureVerified = $true
|
|
verifierCliSha256 = $verifierCliHash
|
|
runtimeCliVersion = $ExpectedRuntimeCliVersion
|
|
runtimeCliSha256 = $runtimeCliHash
|
|
runtimeCliSignerThumbprint = $runtimeSigner
|
|
automaticDatabaseWrites = $false
|
|
tokenMaterialIncluded = $false
|
|
readyForOneCaseAtATimeCapture = $true
|
|
productionReady = $false
|
|
} | ConvertTo-Json -Depth 5
|
|
}
|
|
catch {
|
|
if ($null -ne $campaignDirectory -and
|
|
[IO.Directory]::Exists($campaignDirectory)) {
|
|
try { [IO.Directory]::Delete($campaignDirectory, $true) } catch { }
|
|
}
|
|
throw
|
|
}
|
|
finally {
|
|
foreach ($lock in @($locks)) {
|
|
if ($null -ne $lock) { $lock.Dispose() }
|
|
}
|
|
}
|