Initial Commit

packages/networking/drive/drive-template/tests/template-untrusted-issuer.test.ts

@@ -0,0 +1,98 @@
+/**
+ * DTP-05 step 5 — TEMPLATE_UNTRUSTED_ISSUER rejection.
+ */
+
+import { describe, expect, it } from "@suaveplan/testing/runner";
+import {
+    type DriveTemplateError,
+    DTP_CODES,
+    signTemplate,
+    TemplateNonceLru,
+    validateTemplate,
+} from "../src/index.js";
+import { buildTemplate, emptyRoot, makeKeys } from "./_helpers.js";
+
+describe("DTP-05 step 5 — trusted issuer gate", () => {
+    it("issuer not in trustedKeyAuthorities rejected", {
+        timeout: 5000,
+    }, () => {
+        const keys = makeKeys();
+        const tpl = signTemplate(
+            {
+                ...buildTemplate({ issuer: keys.publicHex }),
+                policy: {
+                    defaultPolicy: {
+                        autoDownload: false,
+                        meshAllowed: true,
+                        cdnAllowed: true,
+                    },
+                    trustedKeyAuthorities: ["someone-else"],
+                },
+            },
+            keys.secret
+        );
+        const ctx = {
+            clock: () => Date.now(),
+            nonceLru: new TemplateNonceLru(),
+        };
+        try {
+            validateTemplate(tpl, ctx);
+            throw new Error("expected UNTRUSTED_ISSUER");
+        } catch (err) {
+            expect((err as DriveTemplateError).code).toBe(
+                DTP_CODES.TEMPLATE_UNTRUSTED_ISSUER
+            );
+        }
+    });
+
+    it("empty trustedKeyAuthorities permits any issuer (no allowlist)", {
+        timeout: 5000,
+    }, () => {
+        const keys = makeKeys();
+        const tpl = signTemplate(
+            {
+                ...buildTemplate({ issuer: keys.publicHex }),
+                policy: {
+                    defaultPolicy: {
+                        autoDownload: false,
+                        meshAllowed: true,
+                        cdnAllowed: true,
+                    },
+                    trustedKeyAuthorities: [],
+                },
+            },
+            keys.secret
+        );
+        const ctx = {
+            clock: () => Date.now(),
+            nonceLru: new TemplateNonceLru(),
+        };
+        expect(() => validateTemplate(tpl, ctx)).not.toThrow();
+    });
+
+    it("issuer in allowlist accepted", { timeout: 5000 }, () => {
+        const keys = makeKeys();
+        const tpl = signTemplate(
+            {
+                ...buildTemplate({
+                    issuer: keys.publicHex,
+                    rootFolder: emptyRoot(),
+                }),
+                policy: {
+                    defaultPolicy: {
+                        autoDownload: false,
+                        meshAllowed: true,
+                        cdnAllowed: true,
+                    },
+                    trustedKeyAuthorities: [keys.publicHex],
+                },
+            },
+            keys.secret
+        );
+        const ctx = {
+            clock: () => Date.now(),
+            nonceLru: new TemplateNonceLru(),
+        };
+        expect(() => validateTemplate(tpl, ctx)).not.toThrow();
+    });
+});