feat: complete TASK-WP2-06 generation terminal states

2026-08-03 01:06:28 +08:00
parent c8643c080d
commit 2bb4f86d04
18 changed files with 1419 additions and 14 deletions
@@ -0,0 +1,47 @@
+import type BetterSqlite3 from "better-sqlite3";
+
+const auditRefPattern = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/;
+const safeStringPattern = /^[A-Za-z0-9_.:@-]{1,160}$/;
+const forbiddenKeys = new Set([
+  "absolute_path", "api_key", "body", "code_hmac", "content", "credential", "email", "image",
+  "image_content", "password", "path", "prompt", "secret", "session_token", "verification_code", "whitelist",
+]);
+const forbiddenKeyFragments = ["content", "credential", "email", "image", "password", "path", "prompt", "secret", "token"];
+
+function safeSummaryValue(value: unknown, depth: number): boolean {
+  if (depth > 3) return false;
+  if (value === null || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isSafeInteger(value);
+  if (typeof value === "string") return safeStringPattern.test(value) && !value.includes("@");
+  if (Array.isArray(value)) return value.length <= 20 && value.every((entry) => safeSummaryValue(entry, depth + 1));
+  if (!value || typeof value !== "object") return false;
+  const entries = Object.entries(value);
+  return entries.length <= 32 && entries.every(([key, entry]) => (
+    auditRefPattern.test(key)
+    && !forbiddenKeys.has(key.toLowerCase())
+    && !forbiddenKeyFragments.some((fragment) => key.toLowerCase().includes(fragment))
+    && safeSummaryValue(entry, depth + 1)
+  ));
+}
+
+export function configureWorkerDatabase(database: BetterSqlite3.Database) {
+  database.pragma("journal_mode = WAL");
+  database.pragma("foreign_keys = ON");
+  database.pragma("synchronous = FULL");
+  database.pragma("busy_timeout = 5000");
+  database.function("dada_audit_ref_is_safe", { deterministic: true }, (value: unknown) => (
+    typeof value === "string" && auditRefPattern.test(value) ? 1 : 0
+  ));
+  database.function("dada_audit_summary_is_safe", { deterministic: true }, (value: unknown) => {
+    if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > 2_048) return 0;
+    try {
+      return safeSummaryValue(JSON.parse(value), 0) ? 1 : 0;
+    } catch {
+      return 0;
+    }
+  });
+  database.function("dada_allow_retention_purge", { deterministic: false }, () => 0);
+  database.function("dada_retention_purge_now", { deterministic: false }, () => 0);
+  database.function("dada_allow_privacy_purge", { deterministic: false }, () => 0);
+  database.function("dada_privacy_purge_subject", { deterministic: false }, () => "");
+}