refactor(javascript): own graph Evidence envelope validation

This commit is contained in:
morluto
2026-10-22 08:27:39 +08:00
parent a2805bc934
commit c9f95eaf90
2 changed files with 97 additions and 16 deletions
@@ -184,15 +184,12 @@ const staticRuntimeSource = (
evidence.normalized_result,
[...path, "normalized_result"],
);
const unmatchedLink = result.evidence_links.find(
(evidenceId) => !evidence.evidence_links.includes(evidenceId),
assertResultEvidenceLinksInEnvelope(
result.evidence_links,
evidence,
path,
"Runtime reconciliation result",
);
if (unmatchedLink !== undefined)
throw invalidEvidence(
[...path, "normalized_result"],
"evidence_links",
`Runtime reconciliation result references Evidence ${unmatchedLink} outside its envelope.`,
);
const applicationLayer = result.static_layers.find(
({ role }) => role === "application",
);
@@ -229,15 +226,12 @@ const managedApplicationSource = (
evidence.normalized_result,
[...path, "normalized_result"],
);
const unmatchedLink = result.evidence_links.find(
(evidenceId) => !evidence.evidence_links.includes(evidenceId),
assertResultEvidenceLinksInEnvelope(
result.evidence_links,
evidence,
path,
"Managed application graph result",
);
if (unmatchedLink !== undefined)
throw invalidEvidence(
[...path, "normalized_result"],
"evidence_links",
`Managed application graph result references Evidence ${unmatchedLink} outside its envelope.`,
);
return {
evidence,
graph: result.graph,
@@ -247,6 +241,25 @@ const managedApplicationSource = (
};
};
const assertResultEvidenceLinksInEnvelope = (
resultEvidenceLinks: readonly string[],
evidence: Evidence,
path: readonly (string | number)[],
resultLabel:
| "Runtime reconciliation result"
| "Managed application graph result",
): void => {
const unmatchedLink = resultEvidenceLinks.find(
(evidenceId) => !evidence.evidence_links.includes(evidenceId),
);
if (unmatchedLink !== undefined)
throw invalidEvidence(
[...path, "normalized_result"],
"evidence_links",
`${resultLabel} references Evidence ${unmatchedLink} outside its envelope.`,
);
};
const assertApplicationSubject = (
evidence: Evidence,
result: JavaScriptApplicationAnalysisResult,