20 lines
1.2 KiB
TypeScript
20 lines
1.2 KiB
TypeScript
import assert from "node:assert/strict"
|
|
import { pool } from "../../db/index.js"
|
|
import { MikrotikClient } from "../../services/mikrotik.js"
|
|
import { executeRosStep } from "./resources.js"
|
|
import { McpError } from "./security.js"
|
|
|
|
// Retired generic steps may exist in old sealed inverse plans. Refuse them
|
|
// before even resolving a device, instead of relying only on a UI/tool alias.
|
|
const query = pool.query, fromServer = MikrotikClient.fromServer
|
|
let attempts = 0
|
|
pool.query = (() => { attempts++; throw Error("unexpected SQL") }) as typeof pool.query
|
|
MikrotikClient.fromServer = (() => { attempts++; throw Error("unexpected native client") }) as typeof MikrotikClient.fromServer
|
|
try {
|
|
for (const resource of ["certificate", "ipsec_peer"]) for (const action of ["create", "update", "delete"] as const) {
|
|
await assert.rejects(executeRosStep({ serverId: 1, resource, action, ...(action === "create" ? {} : { id: "*a" }), fields: {} }), error => error instanceof McpError && error.code === "UNSUPPORTED_CAPABILITY")
|
|
}
|
|
assert.equal(attempts, 0)
|
|
} finally { pool.query = query; MikrotikClient.fromServer = fromServer }
|
|
console.log("Retired generic IPsec writes and inverses refuse before SQL/native access; full private service proofs are mandatory")
|