425 lines
19 KiB
Python
425 lines
19 KiB
Python
# ============================================================
|
||
# P3 偏差⑦⑧ 攻击面专项（Agent-N 验证员补网，全部确定性）：
|
||
# 偏差⑦ harness.refresh_confirmation_world_fingerprint 信封哈希同步重算
|
||
# —— 攻击面：第二张及以后确认卡的旧信封伪造/篡改/重放必须被拒。
|
||
# 偏差⑧ S6 兄弟卡世界指纹重锚 _reanchor_s6_sibling_cards
|
||
# —— 攻击面：非兄弟（跨 run / 审批窗口内业务）改动不得借重锚混过漂移检测。
|
||
# 手法与 test_fallback_highrisk.py 一致：fake runner / FakeStore / tmp 隔离。
|
||
# ============================================================
|
||
from __future__ import annotations
|
||
|
||
import copy
|
||
import json
|
||
from pathlib import Path
|
||
from typing import ClassVar
|
||
|
||
import pytest
|
||
|
||
from server.agent_core import fallback_lane, harness
|
||
from server.agent_core.providers import reset_provider
|
||
from server.aps_domain.workflow import execute_confirmed
|
||
from server.contracts import IntentResult
|
||
from server.state.checkpoints import CheckpointStore
|
||
from server.state.seed import seed_world
|
||
|
||
DEMO_PRODUCT = "CTRL-A"
|
||
|
||
|
||
@pytest.fixture(autouse=True)
|
||
def _isolate(tmp_path, monkeypatch):
|
||
monkeypatch.setenv("APS_FALLBACK_DIR", str(tmp_path / "fb"))
|
||
monkeypatch.setenv("APS_FEATURES_PATH", str(tmp_path / "features.json"))
|
||
monkeypatch.setenv("APS_FALLBACK_HIGHRISK_PATH", str(tmp_path / "fallback-highrisk.json"))
|
||
monkeypatch.delenv("LLM_API_KEY", raising=False)
|
||
monkeypatch.delenv("LLM_BASE_URL", raising=False)
|
||
monkeypatch.delenv("LLM_MODEL", raising=False)
|
||
monkeypatch.delenv("LLM_PROVIDER", raising=False)
|
||
reset_provider()
|
||
from server.state import checkpoints as _cp_mod
|
||
from server.state import store as _store_mod
|
||
kept_scoped = dict(_store_mod._stores)
|
||
kept_cps = dict(_cp_mod._checkpoints)
|
||
yield
|
||
_store_mod._stores.clear()
|
||
_store_mod._stores.update(kept_scoped)
|
||
_cp_mod._checkpoints.clear()
|
||
_cp_mod._checkpoints.update(kept_cps)
|
||
reset_provider()
|
||
|
||
|
||
class FakeStore:
|
||
_KIND_TABLE: ClassVar[dict[str, str]] = {
|
||
"salesOrder": "salesOrders", "material": "materials",
|
||
"audit": "auditEvents", "importBatch": "importBatches"}
|
||
|
||
def __init__(self, tmp_path: Path):
|
||
self.data = seed_world()
|
||
self._counters: dict[str, int] = {}
|
||
self.tenant_uuid = "platform"
|
||
self.world_key = "default"
|
||
self.path = str(tmp_path / "world.json")
|
||
self.checkpoints = CheckpointStore(str(tmp_path / "checkpoints.json"))
|
||
|
||
def next_id(self, kind: str) -> int:
|
||
if kind not in self._counters:
|
||
table = self._KIND_TABLE.get(kind)
|
||
self._counters[kind] = max(
|
||
(x.get("id", 0) for x in self.data.get(table, [])
|
||
if isinstance(x.get("id"), int)), default=0) if table else 0
|
||
self._counters[kind] += 1
|
||
return self._counters[kind]
|
||
|
||
def save(self) -> None:
|
||
pass
|
||
|
||
def restore(self, world: dict) -> None:
|
||
self.data = copy.deepcopy(world)
|
||
self._counters.clear()
|
||
|
||
|
||
def _cfg(tmp_path: Path) -> fallback_lane.FallbackConfig:
|
||
return fallback_lane.FallbackConfig(pi_home=str(tmp_path / "pi-home"))
|
||
|
||
|
||
def _write_features(tmp_path: Path) -> None:
|
||
(tmp_path / "features.json").write_text(
|
||
json.dumps({"version": 1, "features": {"fallback": True}}, ensure_ascii=False),
|
||
encoding="utf-8")
|
||
|
||
|
||
def _write_whitelist(tmp_path: Path) -> None:
|
||
doc = {"whitelistVersion": 1, "updatedAt": "2026-09-05T10:00:00",
|
||
"updatedBy": "attack-test",
|
||
"scenarios": {
|
||
"S4": {"enabled": True,
|
||
"intents": ["flex.simulate_due", "flex.compare",
|
||
"scenario.compare", "scenario.sensitivity"],
|
||
"roles": ["planner", "admin"]},
|
||
"S6": {"enabled": True, "intents": ["mes.report"],
|
||
"roles": ["planner", "admin"]},
|
||
"S7": {"enabled": True,
|
||
"intents": ["agent.fallback.ops.config.apply",
|
||
"agent.fallback.policy.update"],
|
||
"roles": ["ops", "admin"]}}}
|
||
(tmp_path / "fallback-highrisk.json").write_text(
|
||
json.dumps(doc, ensure_ascii=False), encoding="utf-8")
|
||
|
||
|
||
def _intent(query: str) -> IntentResult:
|
||
return IntentResult(intent="unknown", params={"query": query},
|
||
confidence=0.1, source="LLM")
|
||
|
||
|
||
def _fp(world: dict) -> str:
|
||
return harness.world_fingerprint(world)
|
||
|
||
|
||
def _pending(confirm_id: str) -> dict:
|
||
return harness._approval_store.pending[confirm_id]
|
||
|
||
|
||
def _make_plan_runner(plan_builder):
|
||
def runner(task: str, work_dir: Path):
|
||
run_dir = work_dir.parent
|
||
plan = plan_builder(run_dir)
|
||
(run_dir / "outbox").mkdir(parents=True, exist_ok=True)
|
||
(run_dir / "outbox" / "plan.json").write_text(
|
||
json.dumps(plan, ensure_ascii=False), encoding="utf-8")
|
||
yield {"type": "message_end", "message": {"role": "assistant",
|
||
"stopReason": "stop", "content": [{"type": "text", "text": "ok"}]}}
|
||
yield {"type": "agent_end", "messages": []}
|
||
return runner
|
||
|
||
|
||
async def _stage(store: FakeStore, tmp_path: Path, plan: dict, query: str):
|
||
reply = await fallback_lane.propose_reply(
|
||
store, "s1", _intent(query), runner=_make_plan_runner(lambda rd: plan),
|
||
config=_cfg(tmp_path))
|
||
confirm_ids = [b.props["confirmId"] for b in (reply.blocks or [])
|
||
if getattr(b, "type", "") == "confirm-card"] if reply else []
|
||
return reply, confirm_ids
|
||
|
||
|
||
def _approve(store: FakeStore, confirm_id: str, *, approve: bool = True) -> str:
|
||
return execute_confirmed(store, confirm_id, approve=approve, actor="attacker-test")
|
||
|
||
|
||
def _seed_s6_world(store: FakeStore, items: list[tuple]) -> None:
|
||
store.data.setdefault("workOrders", [])
|
||
store.data.setdefault("mesLinks", [])
|
||
for wo_id, ext_id, status, pct, qty in items:
|
||
store.data["workOrders"].append({
|
||
"id": wo_id, "mesExternalId": ext_id, "status": status,
|
||
"progressPct": pct, "qtyDone": qty, "productCode": DEMO_PRODUCT})
|
||
store.data["mesLinks"].append({
|
||
"kind": "dispatch", "woId": wo_id, "externalWoId": ext_id,
|
||
"idemKey": f"idem-{wo_id}"})
|
||
|
||
|
||
def _seed_mes_mirror(tmp_path: Path, monkeypatch, count: int):
|
||
from server.integrations import mes_stub
|
||
from server.integrations.mes_stub import MockMesClient
|
||
client = MockMesClient(tmp_path / "mes_mirror.json")
|
||
monkeypatch.setattr(mes_stub, "_client", client)
|
||
for i in range(count):
|
||
client.create_work_order({"productCode": DEMO_PRODUCT}, idem_key=f"idem-m-{i}")
|
||
return client
|
||
|
||
|
||
def _s6_plan(items: list[dict]) -> dict:
|
||
return {"planVersion": 1, "scenario": "S6", "goal": "MES 断连补录",
|
||
"steps": [{"seq": i + 1, "mode": "frozen", "intent": "mes.report",
|
||
"summary": f"补录工单 {p['woId']}", "params": p,
|
||
"constraints": {}, "expected": []}
|
||
for i, p in enumerate(items)]}
|
||
|
||
|
||
def _s3_plan() -> dict:
|
||
rows = [{"customerName": "锐扬精密", "productCode": DEMO_PRODUCT,
|
||
"quantity": 10, "deliveryDate": "2026-09-20", "orderNo": "RY-9001"}]
|
||
return {"planVersion": 1, "scenario": "S3", "goal": "导入订单",
|
||
"steps": [{"seq": 1, "mode": "frozen", "intent": "import.commit",
|
||
"summary": "导入订单批 1 行",
|
||
"params": {"batches": [{"kind": "orders", "rows": rows}]},
|
||
"constraints": {"kinds": ["orders"], "maxRows": 500},
|
||
"expected": [{"table": "salesOrders", "added": 1}]}]}
|
||
|
||
|
||
def _setup(tmp_path: Path, monkeypatch, wo_ids=(9001, 9002)):
|
||
_write_features(tmp_path)
|
||
_write_whitelist(tmp_path)
|
||
store = FakeStore(tmp_path)
|
||
_seed_mes_mirror(tmp_path, monkeypatch, len(wo_ids))
|
||
_seed_s6_world(store, [
|
||
(w, f"MES-WO-{i + 1:04d}", "RUNNING", 0, 0) for i, w in enumerate(wo_ids)])
|
||
return store
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 偏差⑦ A-1：第二张确认卡信封完整（核心回归——修复前第二张卡 100% 信封自破）
|
||
# ---------------------------------------------------------------------------
|
||
|
||
|
||
async def test_a71_second_card_envelope_intact_after_refresh(tmp_path, monkeypatch):
|
||
store = _setup(tmp_path, monkeypatch)
|
||
items = [{"woId": 9001, "progressPct": 80, "track": "fixed"},
|
||
{"woId": 9002, "progressPct": 60, "track": "fixed"}]
|
||
_reply, confirm_ids = await _stage(
|
||
store, tmp_path, _s6_plan(items), "MES 连不上了，今天的报工帮我补一下")
|
||
assert len(confirm_ids) == 2
|
||
|
||
# 两张卡的信封在出卡指纹推进后都必须通过完整性校验
|
||
# （修复前：第二张卡 stage 时捕获到非空 beforeFingerprint，refresh 推进后
|
||
# envelopeHash 冻结 → verify_confirmation_envelope 必抛 PermissionError）
|
||
for cid in confirm_ids:
|
||
harness.verify_confirmation_envelope(_pending(cid)) # 不抛即过
|
||
|
||
# 先批第二张（乱序审批——S6 逐笔独立语义的直接压力面）
|
||
msg2 = _approve(store, confirm_ids[1])
|
||
assert "执行完成" in msg2
|
||
wos = {w["id"]: w for w in store.data["workOrders"]}
|
||
assert wos[9002]["progressPct"] == 60
|
||
# 再批第一张（兄弟重锚后信封仍须完整）
|
||
harness.verify_confirmation_envelope(_pending(confirm_ids[0]))
|
||
msg1 = _approve(store, confirm_ids[0])
|
||
assert "执行完成" in msg1
|
||
assert wos[9001]["progressPct"] == 80
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 偏差⑦ A-2：伪造指纹推进（直改 beforeFingerprint 不重算信封）→ 信封拒绝
|
||
# ---------------------------------------------------------------------------
|
||
|
||
|
||
async def test_a72_forged_fingerprint_advance_rejected(tmp_path, monkeypatch):
|
||
store = _setup(tmp_path, monkeypatch, wo_ids=(9001,))
|
||
_reply, confirm_ids = await _stage(
|
||
store, tmp_path,
|
||
_s6_plan([{"woId": 9001, "progressPct": 80, "track": "fixed"}]),
|
||
"MES 连不上了帮我补录")
|
||
assert len(confirm_ids) == 1
|
||
cid = confirm_ids[0]
|
||
fp_before = _fp(store.data)
|
||
|
||
# 攻击：绕过 refresh_confirmation_world_fingerprint，直接改写冻结指纹并落盘
|
||
# （等价于直接篡改 approvals.json——decide 每次事务从磁盘刷新，纯内存篡改
|
||
# 会被刷新抹掉，本身就是一层防御；这里按真实攻击面改盘）
|
||
_pending(cid)["beforeFingerprint"] = "0" * 64
|
||
harness._approval_store.save()
|
||
with pytest.raises(PermissionError, match="完整性校验失败"):
|
||
harness.verify_confirmation_envelope(_pending(cid))
|
||
message = _approve(store, cid)
|
||
assert "确认信封证据校验未通过" in message
|
||
assert _fp(store.data) == fp_before # 零写入
|
||
wos = {w["id"]: w for w in store.data["workOrders"]}
|
||
assert wos[9001]["progressPct"] == 0
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 偏差⑦ A-3：篡改冻结参数（progressPct 80→100）→ 参数摘要拒绝
|
||
# ---------------------------------------------------------------------------
|
||
|
||
|
||
async def test_a73_tampered_params_rejected(tmp_path, monkeypatch):
|
||
store = _setup(tmp_path, monkeypatch, wo_ids=(9001,))
|
||
_reply, confirm_ids = await _stage(
|
||
store, tmp_path,
|
||
_s6_plan([{"woId": 9001, "progressPct": 80, "track": "fixed"}]),
|
||
"MES 连不上了帮我补录")
|
||
cid = confirm_ids[0]
|
||
fp_before = _fp(store.data)
|
||
|
||
_pending(cid)["params"]["plan"]["steps"][0]["params"]["progressPct"] = 100
|
||
harness._approval_store.save() # 篡改落盘（真实攻击面）
|
||
with pytest.raises(PermissionError, match="参数摘要不一致"):
|
||
harness.verify_confirmation_envelope(_pending(cid))
|
||
message = _approve(store, cid)
|
||
assert "确认信封证据校验未通过" in message
|
||
assert _fp(store.data) == fp_before
|
||
wos = {w["id"]: w for w in store.data["workOrders"]}
|
||
assert wos[9001]["progressPct"] == 0 # 未按篡改值落账
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 偏差⑦ A-4：重放已执行的确认卡 → 明确失效，不重复落账
|
||
# ---------------------------------------------------------------------------
|
||
|
||
|
||
async def test_a74_replay_executed_card_rejected(tmp_path, monkeypatch):
|
||
store = _setup(tmp_path, monkeypatch, wo_ids=(9001,))
|
||
_reply, confirm_ids = await _stage(
|
||
store, tmp_path,
|
||
_s6_plan([{"woId": 9001, "progressPct": 80, "track": "fixed"}]),
|
||
"MES 连不上了帮我补录")
|
||
cid = confirm_ids[0]
|
||
msg = _approve(store, cid)
|
||
assert "执行完成" in msg
|
||
wos = {w["id"]: w for w in store.data["workOrders"]}
|
||
assert wos[9001]["progressPct"] == 80
|
||
|
||
replay = _approve(store, cid) # 同 confirmId 重放
|
||
assert "已失效" in replay
|
||
assert wos[9001]["progressPct"] == 80 # 未重复落账
|
||
exec_audits = [e for e in store.data.get("auditEvents", [])
|
||
if e.get("action") == "agent.fallback.execute"
|
||
and e.get("category") == "WORLD_WRITE"
|
||
and e.get("result") == "SUCCESS"]
|
||
assert len(exec_audits) == 1 # 只有首次执行的成功总账
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 偏差⑧ B-1：重锚只认同 run 兄弟卡——跨 run 卡指纹不推进，漂移检测照常拦
|
||
# ---------------------------------------------------------------------------
|
||
|
||
|
||
async def test_b81_reanchor_only_touches_same_run_siblings(tmp_path, monkeypatch):
|
||
store = _setup(tmp_path, monkeypatch, wo_ids=(9001, 9002, 9003))
|
||
# run A：两笔补录
|
||
_reply_a, cards_a = await _stage(
|
||
store, tmp_path,
|
||
_s6_plan([{"woId": 9001, "progressPct": 80, "track": "fixed"},
|
||
{"woId": 9002, "progressPct": 60, "track": "fixed"}]),
|
||
"MES 连不上了，今天的报工帮我补一下")
|
||
# run B：另一轮补录（跨 run 非兄弟）
|
||
_reply_b, cards_b = await _stage(
|
||
store, tmp_path,
|
||
_s6_plan([{"woId": 9003, "progressPct": 50, "track": "fixed"}]),
|
||
"MES 连不上了，今天的报工帮我补一下")
|
||
assert len(cards_a) == 2 and len(cards_b) == 1
|
||
run_a = _pending(cards_a[0])["params"]["runId"]
|
||
run_b = _pending(cards_b[0])["params"]["runId"]
|
||
assert run_a != run_b
|
||
fp_b_frozen = _pending(cards_b[0])["beforeFingerprint"]
|
||
|
||
msg_a0 = _approve(store, cards_a[0]) # 执行 A 第一笔
|
||
assert "执行完成" in msg_a0
|
||
|
||
# 兄弟卡 A2 被重锚：指纹推进到当前世界且信封完整 → 可正常批准
|
||
assert _pending(cards_a[1])["beforeFingerprint"] == _fp(store.data)
|
||
harness.verify_confirmation_envelope(_pending(cards_a[1]))
|
||
msg_a1 = _approve(store, cards_a[1])
|
||
assert "执行完成" in msg_a1
|
||
|
||
# 跨 run 卡 B 未被重锚（指纹停留原值）→ 漂移检测拦截，fail-closed
|
||
assert _pending(cards_b[0])["beforeFingerprint"] == fp_b_frozen
|
||
assert _pending(cards_b[0])["beforeFingerprint"] != _fp(store.data)
|
||
msg_b = _approve(store, cards_b[0])
|
||
assert "世界指纹漂移" in msg_b
|
||
wos = {w["id"]: w for w in store.data["workOrders"]}
|
||
assert wos[9003]["progressPct"] == 0 # B 未落账
|
||
assert wos[9001]["progressPct"] == 80 # A 已落账不受影响
|
||
denied = [e for e in store.data.get("auditEvents", [])
|
||
if e.get("action") == "agent.fallback.execute"
|
||
and e.get("category") == "WORLD_WRITE"
|
||
and e.get("result") == "DENIED"]
|
||
assert denied # 漂移拒绝有 DENIED 审计
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 偏差⑧ B-2（核心攻击）：重锚后审批窗口内的非兄弟业务改动仍被漂移检测拦下
|
||
# ---------------------------------------------------------------------------
|
||
|
||
|
||
async def test_b82_non_sibling_business_change_still_blocked(tmp_path, monkeypatch):
|
||
store = _setup(tmp_path, monkeypatch)
|
||
items = [{"woId": 9001, "progressPct": 80, "track": "fixed"},
|
||
{"woId": 9002, "progressPct": 60, "track": "fixed"}]
|
||
_reply, confirm_ids = await _stage(
|
||
store, tmp_path, _s6_plan(items), "MES 连不上了，今天的报工帮我补一下")
|
||
assert len(confirm_ids) == 2
|
||
|
||
msg1 = _approve(store, confirm_ids[0]) # 第一笔落账 → 兄弟重锚
|
||
assert "执行完成" in msg1
|
||
assert _pending(confirm_ids[1])["beforeFingerprint"] == _fp(store.data)
|
||
|
||
# 攻击/并发事实：重锚之后、第二笔批准之前，发生非兄弟业务改动
|
||
# （另一用户的正常业务写——若借重锚混过检测，第二笔将按过时口径落账）
|
||
store.data.setdefault("salesOrders", []).append(
|
||
{"id": 777001, "orderNo": "ATTACK-WINDOW", "productCode": DEMO_PRODUCT,
|
||
"quantity": 1, "deliveryDate": "2026-09-25"})
|
||
store.save()
|
||
|
||
msg2 = _approve(store, confirm_ids[1])
|
||
assert "世界指纹漂移" in msg2 # 被拦下：重锚没有放行非兄弟改动
|
||
wos = {w["id"]: w for w in store.data["workOrders"]}
|
||
assert wos[9002]["progressPct"] == 0 # 第二笔未落账
|
||
assert wos[9001]["progressPct"] == 80 # 第一笔已落账不动
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 偏差⑧ B-3：伪造兄弟（篡改 runId 蹭重锚）→ 参数摘要破损，信封层拒绝
|
||
# ---------------------------------------------------------------------------
|
||
|
||
|
||
async def test_b83_forged_sibling_runid_rejected(tmp_path, monkeypatch):
|
||
store = _setup(tmp_path, monkeypatch)
|
||
_reply_a, cards_a = await _stage(
|
||
store, tmp_path,
|
||
_s6_plan([{"woId": 9001, "progressPct": 80, "track": "fixed"},
|
||
{"woId": 9002, "progressPct": 60, "track": "fixed"}]),
|
||
"MES 连不上了，今天的报工帮我补一下")
|
||
_reply_b, cards_b = await _stage(
|
||
store, tmp_path, _s3_plan(), "把这份客户表格导进来")
|
||
assert len(cards_a) == 2 and len(cards_b) == 1
|
||
run_a = _pending(cards_a[0])["params"]["runId"]
|
||
orders_before = len(store.data.get("salesOrders") or [])
|
||
|
||
# 攻击：把非兄弟卡（S3 导入卡）的 runId 篡改为 S6 run 并落盘，试图让重锚
|
||
# 免费推进它的冻结指纹、混过漂移检测
|
||
_pending(cards_b[0])["params"]["runId"] = run_a
|
||
harness._approval_store.save()
|
||
msg_a0 = _approve(store, cards_a[0]) # 触发重锚
|
||
assert "执行完成" in msg_a0
|
||
# 重锚按匹配条件确实推进了被篡改卡（机制如实运作）……
|
||
assert _pending(cards_b[0])["beforeFingerprint"] == _fp(store.data)
|
||
# ……但 params 被篡改 → paramsHash 破损，信封层物理拒绝
|
||
msg_b = _approve(store, cards_b[0])
|
||
assert "确认信封证据校验未通过" in msg_b
|
||
assert len(store.data.get("salesOrders") or []) == orders_before # 导入未执行
|
||
|
||
# 真兄弟卡不受伪造事件影响，仍可正常批准落账
|
||
msg_a1 = _approve(store, cards_a[1])
|
||
assert "执行完成" in msg_a1
|
||
wos = {w["id"]: w for w in store.data["workOrders"]}
|
||
assert wos[9002]["progressPct"] == 60
|