@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/layer-0-primitives/fido-mds3.test.js

@@ -0,0 +1,432 @@
+"use strict";
+/**
+ * b.auth.fidoMds3 — FIDO MDS3 metadata BLOB verifier + AAGUID lookup.
+ *
+ * Covers:
+ *   - lookupAaguid: dashed/undashed match, non-existent AAGUID, bad input.
+ *   - verifyAuthenticator: clean accept, REVOKED refusal,
+ *     USER_KEY_PHYSICAL_COMPROMISE refusal, certified-level surfacing,
+ *     unknown AAGUID accept-with-statement-null path.
+ *   - fetch: JWS round-trip with a synthetic BLOB (self-signed cert
+ *     used as both leaf and trust root via the caCertificate override),
+ *     httpClient mocked at the require-cache level.
+ *   - Error class: FidoMds3Error reachable via framework-error.
+ *
+ * Standing up a real MDS3 BLOB is intractable for a primitive test
+ * (~5 MB JSON, JWS-signed with a real CA chain). The synthetic BLOB
+ * exercises the full verify path with a self-signed leaf; the
+ * caCertificate override is the operator escape hatch the primitive
+ * itself documents.
+ */
+
+var nodeCrypto = require("node:crypto");
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+var fwkErr = require("../../lib/framework-error");
+
+// Mint an RSA self-signed cert + matching private-key PEM via the
+// vendored pki bundle. RS256 keeps the JWS verification path simple
+// and matches the real FIDO Alliance BLOB shape. The same cert is
+// used as both the JWS leaf (x5c[0]) and the trust root passed via
+// caCertificate so the chain anchors against itself — this is the
+// operator escape-hatch path the primitive itself documents.
+async function _makeSelfSignedRsaCert() {
+  var pki = require("../../lib/vendor/pki.cjs");
+  var x509 = pki.x509;
+  var keys = await nodeCrypto.webcrypto.subtle.generateKey(
+    { name:           "RSASSA-PKCS1-v1_5",
+      modulusLength:  2048,                                                        // allow:raw-byte-literal — RSA modulus bits
+      publicExponent: new Uint8Array([1, 0, 1]),                                   // allow:raw-byte-literal — RSA F4 exponent
+      hash:           "SHA-256" },
+    true, ["sign", "verify"]);
+  var now = new Date();
+  var notAfter = new Date(now.getTime() + 7 * 86400000);                           // allow:raw-byte-literal — fixture validity ms
+  var cert = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber:     "01",
+    name:             "CN=blamejs-mds3-test-root",
+    notBefore:        now,
+    notAfter:         notAfter,
+    signingAlgorithm: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    keys:             keys,
+    extensions:       [
+      new x509.BasicConstraintsExtension(true, 0, true),
+      new x509.KeyUsagesExtension(
+        x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.digitalSignature,
+        true),
+    ],
+  });
+  var pkcs8 = await nodeCrypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  var pkB64 = Buffer.from(pkcs8).toString("base64").match(/.{1,64}/g).join("\n");  // allow:raw-byte-literal — RFC 7468 line width
+  var keyPem = "-----BEGIN PRIVATE KEY-----\n" + pkB64 + "\n-----END PRIVATE KEY-----\n";
+  return { keyPem: keyPem, certPem: cert.toString("pem") };
+}
+
+function _b64url(buf) {
+  return Buffer.from(buf).toString("base64url");
+}
+
+// Build a synthetic JWS-signed MDS3 BLOB. payload is the inner JSON;
+// keyPem signs it with RS256; certPem is the leaf x5c entry.
+function _makeBlob(payload, keyPem, certPem) {
+  // Strip PEM markers + whitespace from cert to get DER-base64.
+  var derB64 = certPem
+    .replace(/-----BEGIN CERTIFICATE-----/g, "")
+    .replace(/-----END CERTIFICATE-----/g, "")
+    .replace(/\s+/g, "");
+  var header = { alg: "RS256", typ: "JWT", x5c: [derB64] };
+  var headerB64  = _b64url(JSON.stringify(header));
+  var payloadB64 = _b64url(JSON.stringify(payload));
+  var signingInput = headerB64 + "." + payloadB64;
+  var sig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "ascii"), {
+    key:     keyPem,
+    padding: nodeCrypto.constants.RSA_PKCS1_PADDING,
+  });
+  return signingInput + "." + _b64url(sig);
+}
+
+// In-future date (YYYY-MM-DD) so nextUpdate parsing succeeds.
+function _futureDateString(daysFromNow) {
+  var d = new Date(Date.now() + daysFromNow * 86400000);                           // allow:raw-byte-literal — ms-per-day
+  return d.toISOString().slice(0, 10);                                             // allow:raw-byte-literal — ISO date prefix length
+}
+
+// ---- surface ----
+
+function testSurface() {
+  check("auth.fidoMds3 namespace present", typeof b.auth.fidoMds3 === "object");
+  check("fidoMds3.fetch is a function",               typeof b.auth.fidoMds3.fetch === "function");
+  check("fidoMds3.lookupAaguid is a function",        typeof b.auth.fidoMds3.lookupAaguid === "function");
+  check("fidoMds3.verifyAuthenticator is a function", typeof b.auth.fidoMds3.verifyAuthenticator === "function");
+  check("FidoMds3Error registered in framework-error",
+        typeof fwkErr.FidoMds3Error === "function");
+  // Smoke: error carries the standard isXxxError flag + code/message.
+  var e = new fwkErr.FidoMds3Error("fido-mds3/test", "test message");
+  check("FidoMds3Error carries isFidoMds3Error",      e.isFidoMds3Error === true);
+  check("FidoMds3Error carries code",                 e.code === "fido-mds3/test");
+  check("FidoMds3Error always permanent",             e.permanent === true);
+}
+
+// ---- lookupAaguid ----
+
+function testLookupAaguid() {
+  var blob = {
+    entries: [
+      {
+        aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+        metadataStatement: { description: "Test A" },
+        statusReports: [],
+      },
+      {
+        // Undashed AAGUID — some BLOBs ship in this form for status
+        // reports. lookupAaguid normalizes both sides.
+        aaguid: "fedcba9876543210fedcba9876543210",
+        metadataStatement: { description: "Test B" },
+        statusReports: [],
+      },
+    ],
+  };
+  var a = b.auth.fidoMds3.lookupAaguid(blob, "01234567-89ab-cdef-0123-456789abcdef");
+  check("lookupAaguid finds dashed entry",
+        a && a.metadataStatement.description === "Test A");
+
+  // Same AAGUID without dashes resolves the same entry.
+  var aUndashed = b.auth.fidoMds3.lookupAaguid(blob, "0123456789abcdef0123456789abcdef");
+  check("lookupAaguid normalizes dashes on input",
+        aUndashed && aUndashed.metadataStatement.description === "Test A");
+
+  // Reverse: dashed input against undashed entry.
+  var bm = b.auth.fidoMds3.lookupAaguid(blob, "fedcba98-7654-3210-fedc-ba9876543210");
+  check("lookupAaguid normalizes dashes on stored entries",
+        bm && bm.metadataStatement.description === "Test B");
+
+  // Not present.
+  var miss = b.auth.fidoMds3.lookupAaguid(blob, "00000000-0000-0000-0000-000000000000");
+  check("lookupAaguid returns null on miss", miss === null);
+
+  // Bad inputs.
+  var threw = null;
+  try { b.auth.fidoMds3.lookupAaguid(null, "00000000-0000-0000-0000-000000000000"); }
+  catch (e) { threw = e; }
+  check("lookupAaguid throws on null blob",
+        threw && /bad-blob/.test(threw.code || ""));
+
+  threw = null;
+  try { b.auth.fidoMds3.lookupAaguid(blob, ""); } catch (e) { threw = e; }
+  check("lookupAaguid throws on empty aaguid",
+        threw && /bad-aaguid/.test(threw.code || ""));
+
+  threw = null;
+  try { b.auth.fidoMds3.lookupAaguid(blob, "not-a-uuid"); } catch (e) { threw = e; }
+  check("lookupAaguid throws on non-UUID input",
+        threw && /bad-aaguid/.test(threw.code || ""));
+}
+
+// ---- verifyAuthenticator ----
+
+function testVerifyAuthenticatorClean() {
+  var blob = {
+    entries: [
+      {
+        aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+        metadataStatement: { description: "Test A" },
+        statusReports: [
+          { status: "FIDO_CERTIFIED_L1" },
+          { status: "FIDO_CERTIFIED_L2" },
+        ],
+      },
+    ],
+  };
+  var rv = b.auth.fidoMds3.verifyAuthenticator(blob, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  });
+  check("verifyAuthenticator ok=true on clean entry", rv.ok === true);
+  check("verifyAuthenticator surfaces statement",
+        rv.statement && rv.statement.description === "Test A");
+  check("verifyAuthenticator certifiedLevel reflects highest report",
+        rv.certifiedLevel.level === 2 && rv.certifiedLevel.plus === false);
+}
+
+function testVerifyAuthenticatorRevoked() {
+  var blob = {
+    entries: [
+      {
+        aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+        metadataStatement: { description: "Test A" },
+        statusReports: [
+          { status: "FIDO_CERTIFIED_L1" },
+          { status: "REVOKED", effectiveDate: "2023-01-01" },
+        ],
+      },
+    ],
+  };
+  var rv = b.auth.fidoMds3.verifyAuthenticator(blob, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  });
+  check("verifyAuthenticator ok=false on REVOKED status",
+        rv.ok === false);
+  check("verifyAuthenticator reason mentions REVOKED",
+        rv.reason && /REVOKED/.test(rv.reason));
+}
+
+function testVerifyAuthenticatorPhysicalCompromise() {
+  var blob = {
+    entries: [
+      {
+        aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+        statusReports: [{ status: "USER_KEY_PHYSICAL_COMPROMISE" }],
+      },
+    ],
+  };
+  var rv = b.auth.fidoMds3.verifyAuthenticator(blob, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  });
+  check("verifyAuthenticator ok=false on USER_KEY_PHYSICAL_COMPROMISE",
+        rv.ok === false);
+}
+
+function testVerifyAuthenticatorRemoteCompromise() {
+  var blob = {
+    entries: [
+      {
+        aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+        statusReports: [{ status: "USER_KEY_REMOTE_COMPROMISE" }],
+      },
+    ],
+  };
+  var rv = b.auth.fidoMds3.verifyAuthenticator(blob, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  });
+  check("verifyAuthenticator ok=false on USER_KEY_REMOTE_COMPROMISE",
+        rv.ok === false);
+}
+
+function testVerifyAuthenticatorUnknownAaguid() {
+  var blob = { entries: [] };
+  // v0.9.2 fail-closed default: an AAGUID not in the BLOB now
+  // refuses by default. Operators who genuinely accept unknown
+  // authenticators (test fixtures, pre-certification pilots) opt
+  // in via allowUnknownAaguid: true.
+  var rvDefault = b.auth.fidoMds3.verifyAuthenticator(blob, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  });
+  check("verifyAuthenticator ok=false on unknown AAGUID (fail-closed default)",
+        rvDefault.ok === false);
+  check("verifyAuthenticator reason='aaguid-not-in-blob' on unknown",
+        rvDefault.reason === "aaguid-not-in-blob");
+  // Opt-in fail-open for unknown AAGUIDs.
+  var rvOptIn = b.auth.fidoMds3.verifyAuthenticator(blob, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  }, { allowUnknownAaguid: true });
+  check("verifyAuthenticator ok=true with allowUnknownAaguid",
+        rvOptIn.ok === true);
+  check("verifyAuthenticator statement=null on unknown AAGUID",
+        rvOptIn.statement === null);
+  check("verifyAuthenticator reason notes operator opt-in",
+        /allowUnknownAaguid/.test(rvOptIn.reason));
+}
+
+function testVerifyAuthenticatorBadInputs() {
+  var threw = null;
+  try { b.auth.fidoMds3.verifyAuthenticator(null, { aaguid: "x" }); }
+  catch (e) { threw = e; }
+  check("verifyAuthenticator throws on null blob",
+        threw && /bad-blob/.test(threw.code || ""));
+
+  threw = null;
+  try { b.auth.fidoMds3.verifyAuthenticator({ entries: [] }, null); }
+  catch (e) { threw = e; }
+  check("verifyAuthenticator throws on null registrationInfo",
+        threw && /bad-registrationinfo/.test(threw.code || ""));
+
+  threw = null;
+  try { b.auth.fidoMds3.verifyAuthenticator({ entries: [] }, {}); }
+  catch (e) { threw = e; }
+  check("verifyAuthenticator throws on missing aaguid",
+        threw && /bad-registrationinfo/.test(threw.code || ""));
+}
+
+function testCertifiedLevelPlus() {
+  var blob = {
+    entries: [
+      {
+        aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+        statusReports: [
+          { status: "FIDO_CERTIFIED_L3" },
+          { status: "FIDO_CERTIFIED_L3_PLUS" },
+        ],
+      },
+    ],
+  };
+  var rv = b.auth.fidoMds3.verifyAuthenticator(blob, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  });
+  check("certifiedLevel L3 plus surfaced",
+        rv.certifiedLevel.level === 3 && rv.certifiedLevel.plus === true);
+}
+
+// ---- fetch (synthetic BLOB) ----
+
+async function testFetchRoundTrip() {
+  var pair = await _makeSelfSignedRsaCert();
+  var payload = {
+    legalHeader: "Test BLOB",
+    no: 42,
+    nextUpdate: _futureDateString(7),                                              // allow:raw-byte-literal — fixture days-out
+    entries: [
+      {
+        aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+        metadataStatement: { description: "Test entry" },
+        statusReports: [{ status: "FIDO_CERTIFIED_L2" }],
+      },
+    ],
+  };
+  var token = _makeBlob(payload, pair.keyPem, pair.certPem);
+
+  // Mock httpClient.request via require-cache override.
+  var hcPath = require.resolve("../../lib/http-client");
+  var origHc = require.cache[hcPath].exports;
+  require.cache[hcPath].exports = Object.assign({}, origHc, {
+    request: async function () {
+      return { statusCode: 200, headers: {}, body: Buffer.from(token, "ascii") }; // allow:raw-byte-literal — HTTP success
+    },
+  });
+
+  // Force fido-mds3 to re-resolve httpClient.
+  var fmPath = require.resolve("../../lib/auth/fido-mds3");
+  delete require.cache[fmPath];
+  var fm = require(fmPath);
+
+  try {
+    var blob = await fm.fetch({
+      url:           "https://test.invalid/mds3",
+      caCertificate: pair.certPem,
+      force:         true,
+    });
+    check("fetch returns parsed BLOB with entries", Array.isArray(blob.entries) && blob.entries.length === 1);
+    check("fetch returns no=42",                    blob.no === 42);                // allow:raw-byte-literal — fixture identifier
+    check("fetch parses nextUpdate to Date",        blob.nextUpdate instanceof Date);
+
+    // Compose with verifyAuthenticator using the synthetic blob.
+    var rv = fm.verifyAuthenticator(blob, {
+      aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+    });
+    check("verifyAuthenticator over fetched blob ok=true", rv.ok === true);
+    check("verifyAuthenticator over fetched blob L2",
+          rv.certifiedLevel.level === 2);
+  } finally {
+    require.cache[hcPath].exports = origHc;
+    delete require.cache[fmPath];
+  }
+}
+
+async function testFetchRejectsNonHttps() {
+  var threw = null;
+  try { await b.auth.fidoMds3.fetch({ url: "http://insecure.example/mds3" }); }
+  catch (e) { threw = e; }
+  check("fetch rejects non-HTTPS url",
+        threw && /bad-url/.test(threw.code || ""));
+}
+
+async function testFetchRejectsEmptyUrl() {
+  var threw = null;
+  try { await b.auth.fidoMds3.fetch({ url: "" }); } catch (e) { threw = e; }
+  // Empty url falls back to default (https), so this should NOT throw on bad-url
+  // Actually url is "" (falsy) -> default URL (https) -> won't reach bad-url.
+  // Validate by passing a bad url with a non-string instead.
+  threw = null;
+  try { await b.auth.fidoMds3.fetch({ url: 5 }); } catch (e) { threw = e; }
+  check("fetch rejects non-string url",
+        threw && /bad-url/.test(threw.code || ""));
+}
+
+async function testFetchRejectsBadTimeout() {
+  var threw = null;
+  try { await b.auth.fidoMds3.fetch({ timeoutMs: -1 }); }                          // allow:raw-byte-literal — invalid timeout
+  catch (e) { threw = e; }
+  check("fetch rejects negative timeoutMs",
+        threw && /bad-timeout/.test(threw.code || ""));
+}
+
+async function testInternalVerifyRejectsBadJws() {
+  // Smoke the inner verifier with garbage input — the public surface
+  // hits this path through fetch but the inner is exercised in tests
+  // for shape coverage.
+  var fm = require("../../lib/auth/fido-mds3");
+  var threw = null;
+  try { fm._verifyAndParseBlob(""); } catch (e) { threw = e; }
+  check("_verifyAndParseBlob rejects empty string",
+        threw && /bad-jws/.test(threw.code || ""));
+
+  threw = null;
+  try { fm._verifyAndParseBlob("a.b"); } catch (e) { threw = e; }
+  check("_verifyAndParseBlob rejects 2-part JWS",
+        threw && /bad-jws/.test(threw.code || ""));
+}
+
+// ---- run ----
+
+async function run() {
+  testSurface();
+  testLookupAaguid();
+  testVerifyAuthenticatorClean();
+  testVerifyAuthenticatorRevoked();
+  testVerifyAuthenticatorPhysicalCompromise();
+  testVerifyAuthenticatorRemoteCompromise();
+  testVerifyAuthenticatorUnknownAaguid();
+  testVerifyAuthenticatorBadInputs();
+  testCertifiedLevelPlus();
+  await testFetchRoundTrip();
+  await testFetchRejectsNonHttps();
+  await testFetchRejectsEmptyUrl();
+  await testFetchRejectsBadTimeout();
+  await testInternalVerifyRejectsBadJws();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/file-type.test.js

@@ -0,0 +1,81 @@
+"use strict";
+
+var helpers = require("../helpers");
+var b      = helpers.b;
+var check  = helpers.check;
+
+function _png()  { return Buffer.concat([Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]), Buffer.alloc(20)]); }
+function _jpeg() { return Buffer.concat([Buffer.from([0xFF, 0xD8, 0xFF, 0xE0]), Buffer.alloc(20)]); }
+function _pdf()  { return Buffer.concat([Buffer.from("%PDF-1.7\n", "ascii"),  Buffer.alloc(20)]); }
+function _gz()   { return Buffer.concat([Buffer.from([0x1F, 0x8B]), Buffer.alloc(20)]); }
+function _pe()   { return Buffer.concat([Buffer.from([0x4D, 0x5A]), Buffer.alloc(20)]); }
+function _elf()  { return Buffer.concat([Buffer.from([0x7F, 0x45, 0x4C, 0x46]), Buffer.alloc(20)]); }
+function _polyglot() {
+  // PNG header followed by what an attacker might claim is HTML.
+  // Magic-byte check should still classify as PNG (the actual format).
+  return Buffer.concat([Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
+    Buffer.from("<script>alert(1)</script>", "utf8")]);
+}
+
+async function run() {
+  check("fileType namespace present",                typeof b.fileType === "object");
+  check("fileType.detect is fn",                     typeof b.fileType.detect === "function");
+  check("fileType.assertOneOf is fn",                typeof b.fileType.assertOneOf === "function");
+
+  // ---- Detection round-trips ----
+  var pngDet = b.fileType.detect(_png());
+  check("detect: PNG",                pngDet && pngDet.mime === "image/png" && pngDet.category === "image");
+  var jpegDet = b.fileType.detect(_jpeg());
+  check("detect: JPEG",               jpegDet && jpegDet.mime === "image/jpeg");
+  var pdfDet = b.fileType.detect(_pdf());
+  check("detect: PDF",                pdfDet && pdfDet.mime === "application/pdf" && pdfDet.category === "document");
+  var gzDet = b.fileType.detect(_gz());
+  check("detect: gzip",               gzDet && gzDet.category === "archive");
+  var peDet = b.fileType.detect(_pe());
+  check("detect: PE/Windows exe",     peDet && peDet.category === "executable");
+  var elfDet = b.fileType.detect(_elf());
+  check("detect: ELF",                elfDet && elfDet.category === "executable");
+
+  // ---- Polyglot defense ----
+  var poly = b.fileType.detect(_polyglot());
+  check("detect: polyglot still PNG", poly && poly.mime === "image/png");
+
+  // ---- assertOneOf happy path ----
+  var ok = b.fileType.assertOneOf(_png(), ["image/png", "image/jpeg"]);
+  check("assertOneOf: PNG passes",    ok && ok.mime === "image/png");
+  var imgCat = b.fileType.assertOneOf(_jpeg(), ["image"]);
+  check("assertOneOf: category match", imgCat && imgCat.mime === "image/jpeg");
+
+  // ---- assertOneOf rejection ----
+  var threwExe = null;
+  try { b.fileType.assertOneOf(_pe(), ["image/png", "application/pdf"]); }
+  catch (e) { threwExe = e; }
+  check("assertOneOf: PE rejected",   threwExe && /DISALLOWED_TYPE/.test(threwExe.code || ""));
+
+  var threwUnknown = null;
+  try { b.fileType.assertOneOf(Buffer.from("not-a-real-format-bytes"), ["image/png"]); }
+  catch (e) { threwUnknown = e; }
+  check("assertOneOf: unknown format", threwUnknown && /UNKNOWN_TYPE/.test(threwUnknown.code || ""));
+
+  var threwEmpty = null;
+  try { b.fileType.assertOneOf(Buffer.alloc(0), ["image/png"]); }
+  catch (e) { threwEmpty = e; }
+  check("assertOneOf: zero-byte rejected by default", threwEmpty && /EMPTY/.test(threwEmpty.code || ""));
+
+  var allowEmpty = b.fileType.assertOneOf(Buffer.alloc(0), ["image/png"], { allowEmpty: true });
+  check("assertOneOf: zero-byte allowed when opted in", allowEmpty === null);
+
+  // ---- detect() returns null for non-buffers and unrecognised content ----
+  check("detect: null for non-buffer",  b.fileType.detect("not a buffer") === null);
+  check("detect: null for empty",       b.fileType.detect(Buffer.alloc(0)) === null);
+  check("detect: null for unknown",     b.fileType.detect(Buffer.from("not-a-real-format-bytes")) === null);
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[file-type] OK"); },
+    function (e) { console.error(e); process.exit(1); }
+  );
+}