99 lines
2.9 KiB
TypeScript
99 lines
2.9 KiB
TypeScript
/**
|
|
* DTP-05 step 5 — TEMPLATE_UNTRUSTED_ISSUER rejection.
|
|
*/
|
|
|
|
import { describe, expect, it } from "@suaveplan/testing/runner";
|
|
import {
|
|
type DriveTemplateError,
|
|
DTP_CODES,
|
|
signTemplate,
|
|
TemplateNonceLru,
|
|
validateTemplate,
|
|
} from "../src/index.js";
|
|
import { buildTemplate, emptyRoot, makeKeys } from "./_helpers.js";
|
|
|
|
describe("DTP-05 step 5 — trusted issuer gate", () => {
|
|
it("issuer not in trustedKeyAuthorities rejected", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const keys = makeKeys();
|
|
const tpl = signTemplate(
|
|
{
|
|
...buildTemplate({ issuer: keys.publicHex }),
|
|
policy: {
|
|
defaultPolicy: {
|
|
autoDownload: false,
|
|
meshAllowed: true,
|
|
cdnAllowed: true,
|
|
},
|
|
trustedKeyAuthorities: ["someone-else"],
|
|
},
|
|
},
|
|
keys.secret
|
|
);
|
|
const ctx = {
|
|
clock: () => Date.now(),
|
|
nonceLru: new TemplateNonceLru(),
|
|
};
|
|
try {
|
|
validateTemplate(tpl, ctx);
|
|
throw new Error("expected UNTRUSTED_ISSUER");
|
|
} catch (err) {
|
|
expect((err as DriveTemplateError).code).toBe(
|
|
DTP_CODES.TEMPLATE_UNTRUSTED_ISSUER
|
|
);
|
|
}
|
|
});
|
|
|
|
it("empty trustedKeyAuthorities permits any issuer (no allowlist)", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const keys = makeKeys();
|
|
const tpl = signTemplate(
|
|
{
|
|
...buildTemplate({ issuer: keys.publicHex }),
|
|
policy: {
|
|
defaultPolicy: {
|
|
autoDownload: false,
|
|
meshAllowed: true,
|
|
cdnAllowed: true,
|
|
},
|
|
trustedKeyAuthorities: [],
|
|
},
|
|
},
|
|
keys.secret
|
|
);
|
|
const ctx = {
|
|
clock: () => Date.now(),
|
|
nonceLru: new TemplateNonceLru(),
|
|
};
|
|
expect(() => validateTemplate(tpl, ctx)).not.toThrow();
|
|
});
|
|
|
|
it("issuer in allowlist accepted", { timeout: 5000 }, () => {
|
|
const keys = makeKeys();
|
|
const tpl = signTemplate(
|
|
{
|
|
...buildTemplate({
|
|
issuer: keys.publicHex,
|
|
rootFolder: emptyRoot(),
|
|
}),
|
|
policy: {
|
|
defaultPolicy: {
|
|
autoDownload: false,
|
|
meshAllowed: true,
|
|
cdnAllowed: true,
|
|
},
|
|
trustedKeyAuthorities: [keys.publicHex],
|
|
},
|
|
},
|
|
keys.secret
|
|
);
|
|
const ctx = {
|
|
clock: () => Date.now(),
|
|
nonceLru: new TemplateNonceLru(),
|
|
};
|
|
expect(() => validateTemplate(tpl, ctx)).not.toThrow();
|
|
});
|
|
});
|