306 lines
9.7 KiB
TypeScript
306 lines
9.7 KiB
TypeScript
/**
|
|
* Branch-coverage filler for canonical.ts encryption / retention /
|
|
* optional-field paths and other defence-in-depth code that the
|
|
* spec-tied tests don't exercise.
|
|
*/
|
|
|
|
import { describe, expect, it } from "@suaveplan/testing/runner";
|
|
import { canonicalSerialize } from "../src/codec/canonical.js";
|
|
import type {
|
|
DriveTemplate,
|
|
FileTemplate,
|
|
FolderTemplate,
|
|
} from "../src/index.js";
|
|
import { TemplateNonceLru, validateTemplate } from "../src/index.js";
|
|
import {
|
|
DEFAULT_POLICY,
|
|
emptyRoot,
|
|
makeKeys,
|
|
makeNonce,
|
|
signed,
|
|
} from "./_helpers.js";
|
|
|
|
const baseFile: FileTemplate = {
|
|
name: "x.bin",
|
|
fileLocId: "loc-1",
|
|
fileId: "f".repeat(64),
|
|
size: 100,
|
|
totalChunks: 1,
|
|
chunkSize: 1024,
|
|
checksum: "sha256:abcdef",
|
|
flags: DEFAULT_POLICY,
|
|
manifestKey: "manifest:f",
|
|
manifestSig: new Uint8Array(64).fill(1),
|
|
};
|
|
|
|
describe("canonicalSerialize encryption branches", () => {
|
|
it("file with kind:inline encryption serializes", { timeout: 5000 }, () => {
|
|
const tpl: Omit<DriveTemplate, "serverSignature"> = {
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
policy: { defaultPolicy: DEFAULT_POLICY },
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: makeNonce(),
|
|
rootFolder: {
|
|
name: "/",
|
|
children: [
|
|
{
|
|
...baseFile,
|
|
encryption: {
|
|
algorithm: "xchacha20-poly1305",
|
|
keyDistribution: {
|
|
kind: "inline",
|
|
wrappedKey: new Uint8Array(80).fill(0xab),
|
|
},
|
|
},
|
|
},
|
|
],
|
|
},
|
|
};
|
|
expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
|
|
});
|
|
|
|
it("file with kind:retroactive encryption serializes", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const tpl: Omit<DriveTemplate, "serverSignature"> = {
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
policy: { defaultPolicy: DEFAULT_POLICY },
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: makeNonce(),
|
|
rootFolder: {
|
|
name: "/",
|
|
children: [
|
|
{
|
|
...baseFile,
|
|
encryption: {
|
|
algorithm: "xchacha20-poly1305",
|
|
keyDistribution: {
|
|
kind: "retroactive",
|
|
keyAuthority: "auth-1",
|
|
},
|
|
},
|
|
},
|
|
],
|
|
},
|
|
};
|
|
expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
|
|
});
|
|
|
|
it("retention 'permanent' / 'lru' / { maxAgeMs } / undefined serialize", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
for (const retention of [
|
|
undefined,
|
|
"permanent" as const,
|
|
"lru" as const,
|
|
{ maxAgeMs: 1000 },
|
|
]) {
|
|
const tpl: Omit<DriveTemplate, "serverSignature"> = {
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
policy: {
|
|
defaultPolicy: { ...DEFAULT_POLICY, retention },
|
|
},
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: makeNonce(),
|
|
rootFolder: emptyRoot(),
|
|
};
|
|
expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
|
|
}
|
|
});
|
|
|
|
it("GlobalPolicy with maxLocalCacheBytes / maxConcurrentFetches set", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const tpl: Omit<DriveTemplate, "serverSignature"> = {
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
policy: {
|
|
defaultPolicy: DEFAULT_POLICY,
|
|
maxLocalCacheBytes: 1_000_000,
|
|
maxConcurrentFetches: 4,
|
|
trustedKeyAuthorities: ["a", "b"],
|
|
},
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: makeNonce(),
|
|
rootFolder: emptyRoot(),
|
|
};
|
|
expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
|
|
});
|
|
|
|
it("CdnFallbackConfig with optional uploadEndpoint serialises", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const tpl: Omit<DriveTemplate, "serverSignature"> = {
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
policy: { defaultPolicy: DEFAULT_POLICY },
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: makeNonce(),
|
|
rootFolder: emptyRoot(),
|
|
cdnFallback: {
|
|
baseUrl: "https://example.com",
|
|
pathScheme: "reverse-id",
|
|
levels: 3,
|
|
padding: 9,
|
|
uploadEndpoint: "https://upload.example.com",
|
|
},
|
|
};
|
|
expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
|
|
});
|
|
|
|
it("CdnFallbackConfig WITHOUT uploadEndpoint covers optional false branch", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const tpl: Omit<DriveTemplate, "serverSignature"> = {
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
policy: { defaultPolicy: DEFAULT_POLICY },
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: makeNonce(),
|
|
rootFolder: emptyRoot(),
|
|
cdnFallback: {
|
|
baseUrl: "https://example.com",
|
|
pathScheme: "reverse-id",
|
|
levels: 3,
|
|
padding: 9,
|
|
},
|
|
};
|
|
expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
|
|
});
|
|
|
|
it("nested folder serialises with TAG_FOLDER recursion", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const inner: FolderTemplate = { name: "deep", children: [] };
|
|
const outer: FolderTemplate = { name: "/", children: [inner] };
|
|
const tpl: Omit<DriveTemplate, "serverSignature"> = {
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
policy: { defaultPolicy: DEFAULT_POLICY },
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: makeNonce(),
|
|
rootFolder: outer,
|
|
};
|
|
expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
|
|
});
|
|
});
|
|
|
|
describe("schema invocation coverage", () => {
|
|
it("DriveTemplateSchema rejects nonce of wrong length", {
|
|
timeout: 5000,
|
|
}, async () => {
|
|
const { DriveTemplateSchema } = await import("../src/index.js");
|
|
const r = DriveTemplateSchema.safeParse({
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
rootFolder: { name: "/", children: [] },
|
|
policy: { defaultPolicy: DEFAULT_POLICY },
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: new Uint8Array(8), // wrong length
|
|
serverSignature: new Uint8Array(64),
|
|
});
|
|
expect(r.success).toBe(false);
|
|
});
|
|
|
|
it("DriveTemplateSchema accepts a well-formed payload", {
|
|
timeout: 5000,
|
|
}, async () => {
|
|
const { DriveTemplateSchema } = await import("../src/index.js");
|
|
const r = DriveTemplateSchema.safeParse({
|
|
schemaVersion: 1,
|
|
driveId: "d",
|
|
rootFolder: { name: "/", children: [] },
|
|
policy: { defaultPolicy: DEFAULT_POLICY },
|
|
issuer: "00".repeat(32),
|
|
issuedAt: 1,
|
|
expiresAt: 1_000,
|
|
nonce: makeNonce(),
|
|
serverSignature: new Uint8Array(64),
|
|
});
|
|
expect(r.success).toBe(true);
|
|
});
|
|
|
|
it("FolderTemplateSchema parses recursive folder/file mix", {
|
|
timeout: 5000,
|
|
}, async () => {
|
|
const { FolderTemplateSchema } = await import("../src/index.js");
|
|
const r = FolderTemplateSchema.safeParse({
|
|
name: "/",
|
|
children: [
|
|
{
|
|
name: "subfolder",
|
|
children: [],
|
|
},
|
|
{
|
|
name: "file.bin",
|
|
fileLocId: "loc",
|
|
fileId: "fid",
|
|
size: 1,
|
|
totalChunks: 1,
|
|
chunkSize: 1024,
|
|
checksum: "blake3:abcd",
|
|
flags: DEFAULT_POLICY,
|
|
manifestKey: "k",
|
|
manifestSig: new Uint8Array(64),
|
|
},
|
|
],
|
|
});
|
|
expect(r.success).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("depth check accepts a folder containing a file", () => {
|
|
it("walk descends into folder, returns from file branch", {
|
|
timeout: 5000,
|
|
}, async () => {
|
|
const { assertFolderDepth } = await import("../src/index.js");
|
|
const tree: FolderTemplate = {
|
|
name: "/",
|
|
children: [baseFile],
|
|
};
|
|
expect(() => assertFolderDepth(tree)).not.toThrow();
|
|
});
|
|
});
|
|
|
|
describe("validate.replay LRU empty-on-evict edge", () => {
|
|
it("LRU eviction on size==capacity is a no-op pre-add", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const keys = makeKeys();
|
|
const ctx = {
|
|
clock: () => Date.now(),
|
|
nonceLru: new TemplateNonceLru(2),
|
|
};
|
|
const tpl1 = signed(
|
|
{ issuer: keys.publicHex, nonce: makeNonce(1) },
|
|
keys
|
|
);
|
|
const tpl2 = signed(
|
|
{ issuer: keys.publicHex, nonce: makeNonce(2) },
|
|
keys
|
|
);
|
|
validateTemplate(tpl1, ctx);
|
|
validateTemplate(tpl2, ctx);
|
|
expect(ctx.nonceLru.size).toBe(2);
|
|
});
|
|
});
|