Initial Commit

packages/security-stack/crypto/crypto-hash/tests/native-stubs.test.ts

@@ -0,0 +1,90 @@
+/**
+ * Native-impl stubs currently throw `PrimitiveNotImplemented`. They ship
+ * alongside the noble impls so `crypto.config.ts` can be flipped to
+ * `'native'` per primitive once in-house implementations land. Until then
+ * this suite holds the stubs at the documented throw-contract and keeps
+ * them off the 0%-coverage list without silencing them via istanbul
+ * excludes.
+ */
+import { describe, expect, it } from "@suaveplan/testing/runner";
+import { argon2id } from "../src/primitives/argon2id/impl/argon2id.native/argon2id.native.js";
+import { hkdf } from "../src/primitives/hkdf/impl/hkdf.native/hkdf.native.js";
+import { hmac } from "../src/primitives/hmac/impl/hmac.native/hmac.native.js";
+import { pbkdf2 } from "../src/primitives/pbkdf2/impl/pbkdf2.native/pbkdf2.native.js";
+import { sha256 } from "../src/primitives/sha256/impl/sha256.native/sha256.native.js";
+import { sha384 } from "../src/primitives/sha384/impl/sha384.native/sha384.native.js";
+import { sha512 } from "../src/primitives/sha512/impl/sha512.native/sha512.native.js";
+
+const NOT_IMPLEMENTED_CODE = "CRYPTO.UTILS.PRIMITIVE_NOT_IMPLEMENTED";
+const data = new Uint8Array([1, 2, 3]);
+const salt = new Uint8Array([4, 5, 6]);
+
+function assertNotImplemented(fn: () => unknown, id: string): void {
+    try {
+        fn();
+        throw new Error(`${id}.native did not throw`);
+    } catch (err) {
+        expect((err as { code?: string }).code).toBe(NOT_IMPLEMENTED_CODE);
+    }
+}
+
+describe("crypto-hash native stubs", () => {
+    it("sha256.native throws PrimitiveNotImplemented", {
+        timeout: 5000,
+    }, () => {
+        assertNotImplemented(() => sha256(data), "sha256");
+    });
+
+    it("sha384.native throws PrimitiveNotImplemented", {
+        timeout: 5000,
+    }, () => {
+        assertNotImplemented(() => sha384(data), "sha384");
+    });
+
+    it("sha512.native throws PrimitiveNotImplemented", {
+        timeout: 5000,
+    }, () => {
+        assertNotImplemented(() => sha512(data), "sha512");
+    });
+
+    it("hmac.native throws PrimitiveNotImplemented", { timeout: 5000 }, () => {
+        assertNotImplemented(() => hmac("SHA-256", data, data), "hmac");
+    });
+
+    it("hkdf.native throws PrimitiveNotImplemented", { timeout: 5000 }, () => {
+        assertNotImplemented(
+            () => hkdf("SHA-256", data, { salt, info: data, length: 32 }),
+            "hkdf"
+        );
+    });
+
+    it("pbkdf2.native throws PrimitiveNotImplemented", {
+        timeout: 5000,
+    }, () => {
+        assertNotImplemented(
+            () =>
+                pbkdf2("SHA-256", data, {
+                    salt,
+                    iterations: 1000,
+                    length: 32,
+                }),
+            "pbkdf2"
+        );
+    });
+
+    it("argon2id.native throws PrimitiveNotImplemented", {
+        timeout: 5000,
+    }, () => {
+        assertNotImplemented(
+            () =>
+                argon2id(data, {
+                    salt,
+                    timeCost: 2,
+                    memoryCost: 4096,
+                    parallelism: 1,
+                    length: 32,
+                }),
+            "argon2id"
+        );
+    });
+});

packages/security-stack/crypto/crypto-hash/tests/no-disallowed.test.ts

@@ -0,0 +1,35 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "@suaveplan/testing/runner";
+
+const SRC = join(__dirname, "..", "src");
+
+const BANNED: ReadonlyArray<RegExp> = [
+    /\bMath\.random\b/,
+    /\bDate\.now\b/,
+    /\bcrypto\.getRandomValues\b/,
+];
+
+function* walk(dir: string): Generator<string> {
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        const st = statSync(full);
+        if (st.isDirectory()) yield* walk(full);
+        else if (full.endsWith(".ts") && !full.endsWith(".test.ts")) yield full;
+    }
+}
+
+describe("no-disallowed", () => {
+    it("src/ contains no Math.random, Date.now, or crypto.getRandomValues", {
+        timeout: 5000,
+    }, () => {
+        const hits: string[] = [];
+        for (const file of walk(SRC)) {
+            const content = readFileSync(file, "utf8");
+            for (const pattern of BANNED) {
+                if (pattern.test(content)) hits.push(`${file}: ${pattern}`);
+            }
+        }
+        expect(hits).toEqual([]);
+    });
+});

packages/security-stack/crypto/crypto-hash/tests/setup/polyfills.ts

@@ -0,0 +1,7 @@
+import { webcrypto } from "node:crypto";
+
+type WritableGlobal = { crypto?: Crypto };
+const g = globalThis as WritableGlobal;
+if (g.crypto === undefined) {
+    g.crypto = webcrypto as unknown as Crypto;
+}

packages/security-stack/crypto/crypto-hash/tests/spec-conformance.test.ts

@@ -0,0 +1,93 @@
+/**
+ * Spec-conformance tests for `openspec/specs/crypto-hash/spec.md`.
+ *
+ * Pins the structural scenarios that the regular per-primitive
+ * unit tests do not cover directly: package-name identity, every
+ * primitive having both `noble` and `native` impl files, generated
+ * banner on `*.select.ts`, and absence of `@suaveplan/hash` import
+ * specifiers anywhere in the workspace.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "@suaveplan/testing/runner";
+
+const ROOT = join(__dirname, "..");
+const SRC = join(ROOT, "src");
+const PRIMITIVES = join(SRC, "primitives");
+const _REPO_ROOT = join(ROOT, "..", "..", "..", "..");
+
+const PRIMITIVE_IDS = [
+    "sha256",
+    "sha384",
+    "sha512",
+    "hmac",
+    "hkdf",
+    "pbkdf2",
+    "argon2id",
+] as const;
+
+function* _walk(dir: string): Generator<string> {
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        const st = statSync(full);
+        if (
+            st.isDirectory() &&
+            !full.includes("node_modules") &&
+            !full.includes("dist") &&
+            !full.endsWith("/.git")
+        ) {
+            yield* _walk(full);
+        } else if (
+            (full.endsWith(".ts") || full.endsWith(".json")) &&
+            !full.endsWith(".test.ts")
+        ) {
+            yield full;
+        }
+    }
+}
+
+describe("crypto-hash — package identity", () => {
+    it("package.json name is @suaveplan/crypto-hash", {
+        timeout: 5000,
+    }, () => {
+        const pkg = JSON.parse(
+            readFileSync(join(ROOT, "package.json"), "utf8")
+        );
+        expect(pkg.name).toBe("@suaveplan/crypto-hash");
+    });
+});
+
+describe("crypto-hash — per-primitive replaceability layout", () => {
+    for (const id of PRIMITIVE_IDS) {
+        it(`${id} has both noble.ts and native.ts impl files`, {
+            timeout: 5000,
+        }, () => {
+            const noble = join(
+                PRIMITIVES,
+                id,
+                "impl",
+                `${id}.noble`,
+                `${id}.noble.ts`
+            );
+            const native = join(
+                PRIMITIVES,
+                id,
+                "impl",
+                `${id}.native`,
+                `${id}.native.ts`
+            );
+            expect(existsSync(noble)).toBe(true);
+            expect(existsSync(native)).toBe(true);
+        });
+
+        it(`${id}.select.ts carries the GENERATED banner`, {
+            timeout: 5000,
+        }, () => {
+            const sel = join(PRIMITIVES, id, `${id}.select`, `${id}.select.ts`);
+            expect(existsSync(sel)).toBe(true);
+            const content = readFileSync(sel, "utf8");
+            expect(content).toMatch(/GENERATED/);
+            expect(content).toMatch(/DO NOT EDIT/);
+        });
+    }
+});

packages/security-stack/crypto/crypto-hash/tests/tree-shake.test.ts

@@ -0,0 +1,73 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "@suaveplan/testing/runner";
+
+describe("tree-shake", () => {
+    it("sideEffects is false", { timeout: 5000 }, () => {
+        const pkg = JSON.parse(
+            readFileSync(join(__dirname, "..", "package.json"), "utf8")
+        ) as { sideEffects?: boolean };
+        expect(pkg.sideEffects).toBe(false);
+    });
+
+    it("exposes per-feature subpath exports", { timeout: 5000 }, () => {
+        const pkg = JSON.parse(
+            readFileSync(join(__dirname, "..", "package.json"), "utf8")
+        ) as { exports?: Record<string, unknown> };
+        const keys = Object.keys(pkg.exports ?? {});
+        // Expect: ".", "./hash", "./mac", "./kdf", "./encoding", "./errors", "./package.json"
+        expect(keys.length).toBeGreaterThanOrEqual(6);
+        expect(keys).toContain("./hash");
+        expect(keys).toContain("./mac");
+        expect(keys).toContain("./kdf");
+        expect(keys).toContain("./encoding");
+        expect(keys).toContain("./errors");
+    });
+
+    it("hash subpath export works", { timeout: 30000 }, async () => {
+        const { sha256 } = await import("../src/hash/sha2/sha2.js");
+        expect(sha256(new Uint8Array([1, 2, 3])).length).toBe(32);
+    });
+
+    it("mac subpath export works", { timeout: 30000 }, async () => {
+        const { hmac } = await import("../src/mac/hmac/hmac.js");
+        expect(
+            hmac("SHA-256", new Uint8Array(32), new Uint8Array([1])).length
+        ).toBe(32);
+    });
+
+    it("kdf subpath export works", { timeout: 30000 }, async () => {
+        const { hkdf } = await import("../src/kdf/hkdf/hkdf.js");
+        expect(
+            hkdf("SHA-256", new Uint8Array(32), {
+                salt: new Uint8Array(16),
+                info: new Uint8Array(0),
+                length: 32,
+            }).length
+        ).toBe(32);
+    });
+
+    it("encoding subpath export works", { timeout: 30000 }, async () => {
+        const { toHex, fromHex } = await import("../src/encoding/hex/hex.js");
+        expect(fromHex(toHex(new Uint8Array([1, 2, 3])))).toEqual(
+            new Uint8Array([1, 2, 3])
+        );
+    });
+
+    it("errors subpath export works", { timeout: 30000 }, async () => {
+        const { HashError, HASH_CODES } = await import(
+            "../src/errors/index.js"
+        );
+        expect(HASH_CODES["KDF.INVALID_PARAMS"]).toBe(
+            "HASH.KDF.INVALID_PARAMS"
+        );
+        expect(HASH_CODES["ALGORITHM.UNSUPPORTED"]).toBe(
+            "HASH.ALGORITHM.UNSUPPORTED"
+        );
+        expect(HASH_CODES["ENCODING.INVALID_INPUT"]).toBe(
+            "HASH.ENCODING.INVALID_INPUT"
+        );
+        const err = new HashError(HASH_CODES["ENCODING.INVALID_INPUT"], "test");
+        expect(err).toBeInstanceOf(HashError);
+    });
+});