feat: complete Windows client control and recovery paths

2026-09-06 13:37:32 +00:00
parent 56b15c7f4f
commit 486894557d
38 changed files with 2188 additions and 106 deletions
@@ -30,3 +30,25 @@ func TestStartSpecValidation_BH_SUPERVISOR_01(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestWindowsIdentityMapsSelectionEvidence_HP_SUPERVISOR_05(t *testing.T) {
+	t.Parallel()
+	identity := EffectiveIdentity{
+		Context:           "ACTIVE_SYSTEM",
+		SessionID:         7,
+		SessionUserSID:    "S-1-5-21-user",
+		UserSID:           "S-1-5-18",
+		AttemptedContexts: []string{"ACTIVE_USER_ELEVATED", "ACTIVE_SYSTEM"},
+		SelectionDetail:   "ACTIVE_USER_ELEVATED: ELEVATION_UNAVAILABLE",
+	}
+	encoded := identity.WindowsIdentity()
+	if encoded == nil || encoded.GetEffectiveContext() != rvboxv1.WindowsExecutionContext_WINDOWS_EXECUTION_CONTEXT_ACTIVE_SYSTEM || encoded.GetSessionId() != 7 || encoded.GetSessionUserSid() != "S-1-5-21-user" || encoded.GetEffectiveUserSid() != "S-1-5-18" {
+		t.Fatalf("mapped identity = %#v", encoded)
+	}
+	if len(encoded.GetAttemptedContexts()) != 2 || encoded.GetAttemptedContexts()[0] != rvboxv1.WindowsExecutionContext_WINDOWS_EXECUTION_CONTEXT_ACTIVE_USER_ELEVATED {
+		t.Fatalf("attempted contexts = %v", encoded.GetAttemptedContexts())
+	}
+	if got := (EffectiveIdentity{AttemptedContexts: []string{"not-a-context"}}).WindowsIdentity(); got != nil {
+		t.Fatalf("unknown context evidence = %#v", got)
+	}
+}