@blamejs/blamejs-shop 0.3.40 → 0.3.41

package/lib/vendor/blamejs/test/layer-0-primitives/archive-wrap.test.js

@@ -134,6 +134,179 @@ async function testTenantStrategyRoundTrip() {
   }
 }
 
+async function testRewrapTenantRotationRoundTrip() {
+  // A recipient: "tenant" blob is keyed off the vault root. Rotating
+  // the vault keypair changes the root, so the old envelope no longer
+  // opens — the operator must re-wrap each stored blob old-root ->
+  // new-root via b.archive.rewrapTenant before retiring the old keypair.
+  var oldDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-aw-rewrap-old-"));
+  var newDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-aw-rewrap-new-"));
+  try {
+    await helpers.setupVaultOnly(oldDir);
+    var oldRoot = b.vault.getKeysJson();
+    var src = Buffer.from("per-tenant sealed archive bytes ".repeat(40));
+    var sealedOld = b.archive.wrap(src, { recipient: "tenant", tenantId: "alpha" });
+    check("rewrapTenant: pre-rotation blob opens under the old root",
+      b.archive.unwrap(sealedOld, { tenantId: "alpha" }).equals(src));
+
+    // Simulate a vault rotation: a fresh keypair (new dir) is now live.
+    await helpers.setupVaultOnly(newDir);
+    var newRoot = b.vault.getKeysJson();
+    check("rewrapTenant: rotation produced a distinct vault root", oldRoot !== newRoot);
+
+    // The old blob is now stranded under the live (new) root — this is
+    // the data-loss class the primitive defends.
+    var stranded = null;
+    try { b.archive.unwrap(sealedOld, { tenantId: "alpha" }); } catch (e) { stranded = e; }
+    check("rewrapTenant: old blob no longer opens under the new live root",
+      stranded && /decrypt-failed/.test(stranded.code || stranded.message));
+
+    var rewrapped = b.archive.rewrapTenant({
+      blob:        sealedOld,
+      oldRootJson: oldRoot,
+      newRootJson: newRoot,
+      tenantId:    "alpha",
+    });
+    check("rewrapTenant: output carries BAWRP magic",
+      rewrapped.slice(0, 5).toString("ascii") === "BAWRP");
+    check("rewrapTenant: output keeps the tenant version byte 0x02",
+      rewrapped[5] === 0x02);
+    check("rewrapTenant: re-wrapped blob opens under the new live root via standard unwrap",
+      b.archive.unwrap(rewrapped, { tenantId: "alpha" }).equals(src));
+
+    // Cross-tenant isolation survives the re-wrap: another tenant's key
+    // (and AAD) cannot open the re-wrapped envelope.
+    var crossErr = null;
+    try { b.archive.unwrap(rewrapped, { tenantId: "beta" }); } catch (e) { crossErr = e; }
+    check("rewrapTenant: re-wrapped blob refuses another tenant",
+      crossErr && /decrypt-failed/.test(crossErr.code || crossErr.message));
+  } finally {
+    helpers.teardownVaultOnly(oldDir);
+    helpers.teardownVaultOnly(newDir);
+  }
+}
+
+async function testRewrapTenantRefusals() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-aw-rewrap-refuse-"));
+  try {
+    await helpers.setupVaultOnly(tmpDir);
+    var root = b.vault.getKeysJson();
+    var src = Buffer.from("tenant bytes");
+
+    // Non-tenant envelope (a key-pair recipient, version 0x01) must be
+    // refused — rewrapTenant only handles root-keyed tenant blobs.
+    var pair = b.crypto.generateEncryptionKeyPair();
+    var recipientBlob = b.archive.wrap(src, { recipient: pair });
+    var notTenantErr = null;
+    try {
+      b.archive.rewrapTenant({ blob: recipientBlob, oldRootJson: root, newRootJson: root, tenantId: "alpha" });
+    } catch (e) { notTenantErr = e; }
+    check("rewrapTenant: refuses a recipient (key-pair) envelope",
+      notTenantErr && /not-tenant-envelope/.test(notTenantErr.code || notTenantErr.message));
+
+    // A passphrase envelope (different magic) is refused with bad-magic.
+    var passBlob = await b.archive.wrapWithPassphrase(src, {
+      passphrase:     "operator-supplied-long-passphrase-2026",
+      minEntropyBits: 0,
+    });
+    var badMagicErr = null;
+    try {
+      b.archive.rewrapTenant({ blob: passBlob, oldRootJson: root, newRootJson: root, tenantId: "alpha" });
+    } catch (e) { badMagicErr = e; }
+    check("rewrapTenant: refuses a passphrase (BAWPP) envelope with bad-magic",
+      badMagicErr && /bad-magic/.test(badMagicErr.code || badMagicErr.message));
+
+    // Wrong old root → the blob does not open → decrypt-failed.
+    var sealed = b.archive.wrap(src, { recipient: "tenant", tenantId: "alpha" });
+    var wrongRootJson = b.vault.getKeysJson().replace(/[A-Za-z]/, function (c) {
+      return c === "A" ? "B" : "A";
+    });
+    var wrongRootErr = null;
+    try {
+      b.archive.rewrapTenant({ blob: sealed, oldRootJson: wrongRootJson, newRootJson: root, tenantId: "alpha" });
+    } catch (e) { wrongRootErr = e; }
+    check("rewrapTenant: wrong old root refused with decrypt-failed",
+      wrongRootErr && /decrypt-failed/.test(wrongRootErr.code || wrongRootErr.message));
+
+    // Missing roots / tenantId throw config errors.
+    var noRootErr = null;
+    try {
+      b.archive.rewrapTenant({ blob: sealed, newRootJson: root, tenantId: "alpha" });
+    } catch (e) { noRootErr = e; }
+    check("rewrapTenant: missing oldRootJson throws bad-root",
+      noRootErr && /bad-root/.test(noRootErr.code || noRootErr.message));
+
+    var noIdErr = null;
+    try {
+      b.archive.rewrapTenant({ blob: sealed, oldRootJson: root, newRootJson: root });
+    } catch (e) { noIdErr = e; }
+    check("rewrapTenant: missing tenantId throws no-tenant-id",
+      noIdErr && /no-tenant-id/.test(noIdErr.code || noIdErr.message));
+
+    var badBlobErr = null;
+    try {
+      b.archive.rewrapTenant({ blob: "not a buffer", oldRootJson: root, newRootJson: root, tenantId: "alpha" });
+    } catch (e) { badBlobErr = e; }
+    check("rewrapTenant: non-Buffer blob throws bad-input",
+      badBlobErr && /bad-input/.test(badBlobErr.code || badBlobErr.message));
+  } finally {
+    helpers.teardownVaultOnly(tmpDir);
+  }
+}
+
+async function testAadRotationDescriptor() {
+  var aw = require("../../lib/archive-wrap");
+  var desc = aw.AAD_ROTATION;
+  check("AAD_ROTATION: descriptor present", desc && typeof desc === "object");
+  check("AAD_ROTATION: backend is external (operator-placed blobs)", desc.backend === "external");
+  check("AAD_ROTATION: rowIdField + schemaVersion + table declared",
+    desc.table === "archive-wrap:tenant-blobs" && desc.rowIdField === "id" && desc.schemaVersion === "1");
+  check("AAD_ROTATION: reseal is a function", typeof desc.reseal === "function");
+
+  var oldDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-aw-reseal-old-"));
+  var newDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-aw-reseal-new-"));
+  try {
+    await helpers.setupVaultOnly(oldDir);
+    var oldRoot = b.vault.getKeysJson();
+    var srcA = Buffer.from("alpha archive ".repeat(20));
+    var srcB = Buffer.from("beta archive ".repeat(20));
+    var blobs = {
+      a1: b.archive.wrap(srcA, { recipient: "tenant", tenantId: "alpha" }),
+      b1: b.archive.wrap(srcB, { recipient: "tenant", tenantId: "beta" }),
+    };
+
+    await helpers.setupVaultOnly(newDir);
+    var newRoot = b.vault.getKeysJson();
+
+    // Operator-supplied backing store: list() enumerates the blobs the
+    // operator placed; put() writes the re-wrapped bytes back.
+    var store = {
+      list: function () {
+        return [
+          { id: "a1", blob: blobs.a1, tenantId: "alpha" },
+          { id: "b1", blob: blobs.b1, tenantId: "beta" },
+        ];
+      },
+      put: function (id, blob) { blobs[id] = blob; },
+    };
+    var result = desc.reseal({ store: store, oldRootJson: oldRoot, newRootJson: newRoot });
+    check("AAD_ROTATION.reseal: re-sealed every store entry", result.resealed === 2);
+    check("AAD_ROTATION.reseal: alpha blob opens under the new root",
+      b.archive.unwrap(blobs.a1, { tenantId: "alpha" }).equals(srcA));
+    check("AAD_ROTATION.reseal: beta blob opens under the new root",
+      b.archive.unwrap(blobs.b1, { tenantId: "beta" }).equals(srcB));
+
+    var badStoreErr = null;
+    try { desc.reseal({ store: {}, oldRootJson: oldRoot, newRootJson: newRoot }); }
+    catch (e) { badStoreErr = e; }
+    check("AAD_ROTATION.reseal: store without list/put refused",
+      badStoreErr && /bad-store/.test(badStoreErr.code || badStoreErr.message));
+  } finally {
+    helpers.teardownVaultOnly(oldDir);
+    helpers.teardownVaultOnly(newDir);
+  }
+}
+
 async function testBackupRecipientRoundTrip() {
   var pair = b.crypto.generateEncryptionKeyPair();
   var src = fs.mkdtempSync(path.join(os.tmpdir(), "bjs-wrap-src-"));
@@ -203,6 +376,9 @@ async function run() {
   await testWrapRefusesPartialStaticRecipient();
   await testWrapRequiresRecipient();
   await testTenantStrategyRoundTrip();
+  await testRewrapTenantRotationRoundTrip();
+  await testRewrapTenantRefusals();
+  await testAadRotationDescriptor();
   await testBackupRecipientRoundTrip();
   await testBackupRecipientStrategyRequiresKeys();
   await testBackupRecipientDirectoryRefused();

package/lib/vendor/blamejs/test/layer-0-primitives/cluster-vault-rotation.test.js

@@ -0,0 +1,243 @@
+"use strict";
+/**
+ * cluster vault-key rotation acceptance.
+ *
+ * After a vault-key rotation (b.vault.rotate) the SHA3-512 fingerprint of
+ * the vault PUBLIC keys changes on every node, but the rotation only
+ * re-seals the local dataDir — the external coordination row
+ * (_blamejs_cluster_state.vaultKeyFp) keeps the OLD fingerprint. Without
+ * a way to declare the change legitimate, cluster.init's
+ * _checkVaultKeyConsistency throws VAULT_KEY_DRIFT (FATAL) and every node
+ * refuses boot.
+ *
+ * acceptVaultKeyRotation: true is the operator's signed-off declaration
+ * "the fingerprint changed via rotation": the booting node advances the
+ * canonical row to its own fingerprint and bumps a monotonic
+ * rotationEpoch. expectedVaultKeyFp narrows the adoption to a single
+ * blessed fingerprint. The strict cross-node drift refusal stays in force
+ * whenever the rotation is NOT declared.
+ *
+ * These tests model "canonical is stale after a rotation" by booting once
+ * (which records the LIVE fingerprint), then overwriting the row with a
+ * different fingerprint — the same end-state a rotation produces, without
+ * hardcoding the fingerprint domain-separation literal here (the cluster
+ * module owns that; we read the live value back instead).
+ *
+ * Run standalone: `node test/layer-0-primitives/cluster-vault-rotation.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var fs      = require("node:fs");
+var os      = require("node:os");
+var path    = require("node:path");
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+var setupTestDb        = helpers.setupTestDb;
+var teardownTestDb     = helpers.teardownTestDb;
+var _makeSqliteDriver  = helpers._makeSqliteDriver;
+
+var SECONDS = b.constants.TIME.seconds;
+var BOGUS_FP = "abad1dea".repeat(16);   // 128-char lowercase hex, ≠ any live key
+
+function _initOpts(nodeId, extra) {
+  return Object.assign({
+    nodeId:            nodeId,
+    externalDbBackend: "ops",
+    dialect:           "sqlite",
+    leaseTtl:          SECONDS(30),
+    heartbeatInterval: SECONDS(10),
+  }, extra || {});
+}
+
+async function _setup() {
+  b.cluster._resetForTest();
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-vk-rotate-"));
+  var dbPath = path.join(tmpDir, "ext.db");
+  var driver = _makeSqliteDriver(dbPath);
+  await setupTestDb(tmpDir);            // initializes the vault
+  b.externalDb.init({
+    backends: { "ops": { connect: driver.connect, query: driver.query, close: driver.close } },
+  });
+  await b.frameworkSchema.ensureSchema({ externalDbBackend: "ops", dialect: "sqlite" });
+  return {
+    tmpDir: tmpDir,
+    driver: driver,
+    teardown: async function () {
+      try { await b.cluster.shutdown(); } catch (_e) {}
+      try { await b.externalDb.shutdown(); } catch (_e) {}
+      driver._close();
+      await teardownTestDb(tmpDir);
+    },
+  };
+}
+
+async function _readState() {
+  var r = await b.externalDb.query(
+    "SELECT vaultKeyFp, recordedByNode, rotationEpoch FROM _blamejs_cluster_state WHERE scope='state'",
+    [], { backend: "ops" }
+  );
+  return (r.rows && r.rows[0]) || null;
+}
+
+// Record the LIVE fingerprint (first boot), then stamp the row with a
+// stale fingerprint — the post-rotation canonical state.
+async function _recordLiveThenStale() {
+  await b.cluster.init(_initOpts("vk-seed"));
+  var live = (await _readState()).vaultKeyFp;
+  // shutdown() releases the DB lease so the next init can acquire; it
+  // also sets the terminated flag (post-graceful-exit, isLeader stays
+  // false). _resetForTest clears that flag so the SUBSEQUENT init boots
+  // as a fresh process would, with isLeader reflecting the new lease.
+  await b.cluster.shutdown();
+  b.cluster._resetForTest();
+  await b.externalDb.query(
+    "UPDATE _blamejs_cluster_state SET vaultKeyFp = ?, recordedByNode = 'old-node', rotationEpoch = 7 WHERE scope='state'",
+    [BOGUS_FP], { backend: "ops" }
+  );
+  return live;
+}
+
+function testSurface() {
+  check("cluster namespace", typeof b.cluster === "object");
+  check("cluster.init fn",   typeof b.cluster.init === "function");
+}
+
+async function testRotationAccepted() {
+  var ctx = await _setup();
+  try {
+    var liveFp = await _recordLiveThenStale();
+    check("seeded fingerprint is stale (≠ live)", liveFp !== BOGUS_FP);
+
+    var threw = null;
+    try { await b.cluster.init(_initOpts("vk-rotated", { acceptVaultKeyRotation: true })); }
+    catch (e) { threw = e; }
+    check("rotation-accept boots without VAULT_KEY_DRIFT", threw === null);
+    check("rotated node holds the lease",                  b.cluster.isLeader() === true);
+
+    var post = await _readState();
+    check("canonical fingerprint advanced to live key", post.vaultKeyFp === liveFp);
+    check("canonical recorded by the rotated node",     post.recordedByNode === "vk-rotated");
+    check("rotation epoch bumped past the stale 7",      Number(post.rotationEpoch) === 8);
+  } finally { await ctx.teardown(); }
+}
+
+async function testNoDeclarationStillRefuses() {
+  // The cross-node drift case is untouched: an undeclared mismatch is
+  // still FATAL so genuine drift can't silently seal unreadable columns.
+  var ctx = await _setup();
+  try {
+    await _recordLiveThenStale();
+    var threw = null;
+    try { await b.cluster.init(_initOpts("vk-undeclared")); }
+    catch (e) { threw = e; }
+    check("undeclared mismatch throws", threw !== null);
+    check("undeclared mismatch is VAULT_KEY_DRIFT", threw && threw.code === "VAULT_KEY_DRIFT");
+    var post = await _readState();
+    check("undeclared mismatch left the canonical row untouched", post.vaultKeyFp === BOGUS_FP);
+  } finally { await ctx.teardown(); }
+}
+
+async function testExpectedFpMatchAdopts() {
+  var ctx = await _setup();
+  try {
+    var liveFp = await _recordLiveThenStale();
+    var threw = null;
+    try {
+      await b.cluster.init(_initOpts("vk-blessed", {
+        acceptVaultKeyRotation: true,
+        expectedVaultKeyFp:     liveFp,
+      }));
+    } catch (e) { threw = e; }
+    check("blessed-fingerprint rotation adopts cleanly", threw === null);
+    var post = await _readState();
+    check("blessed-fingerprint canonical advanced", post.vaultKeyFp === liveFp);
+  } finally { await ctx.teardown(); }
+}
+
+async function testExpectedFpMismatchRefuses() {
+  // acceptVaultKeyRotation is set, but the blessed fingerprint is NOT the
+  // key this node actually holds — a stale / wrong key file. Refuse.
+  var ctx = await _setup();
+  try {
+    await _recordLiveThenStale();
+    var threw = null;
+    try {
+      await b.cluster.init(_initOpts("vk-wrongkey", {
+        acceptVaultKeyRotation: true,
+        expectedVaultKeyFp:     "feedface".repeat(16),   // ≠ live, ≠ stale
+      }));
+    } catch (e) { threw = e; }
+    check("blessed-but-wrong key throws", threw !== null);
+    check("blessed-but-wrong key is VAULT_KEY_ROTATION_MISMATCH",
+          threw && threw.code === "VAULT_KEY_ROTATION_MISMATCH");
+    var post = await _readState();
+    check("blessed-but-wrong key left the canonical row untouched", post.vaultKeyFp === BOGUS_FP);
+  } finally { await ctx.teardown(); }
+}
+
+async function testSameKeyReInitIsClean() {
+  // Once adopted, a fresh init with the SAME (now-canonical) key passes
+  // the consistency check without declaring a rotation and without
+  // bumping the epoch.
+  var ctx = await _setup();
+  try {
+    var liveFp = await _recordLiveThenStale();
+    await b.cluster.init(_initOpts("vk-adopt", { acceptVaultKeyRotation: true }));
+    var epochAfterAdopt = Number((await _readState()).rotationEpoch);
+    await b.cluster.shutdown();
+
+    var threw = null;
+    try { await b.cluster.init(_initOpts("vk-rejoin")); }
+    catch (e) { threw = e; }
+    check("re-init on the adopted key needs no rotation declaration", threw === null);
+    var post = await _readState();
+    check("re-init left fingerprint at the live key", post.vaultKeyFp === liveFp);
+    check("re-init did NOT bump the epoch", Number(post.rotationEpoch) === epochAfterAdopt);
+  } finally { await ctx.teardown(); }
+}
+
+async function testConfigValidation() {
+  var ctx = await _setup();
+  try {
+    var t1 = null;
+    try { await b.cluster.init(_initOpts("vk-cfg1", { acceptVaultKeyRotation: "yes" })); }
+    catch (e) { t1 = e; }
+    check("non-boolean acceptVaultKeyRotation throws", t1 && t1.code === "INVALID_CONFIG");
+
+    b.cluster._resetForTest();
+    var t2 = null;
+    try { await b.cluster.init(_initOpts("vk-cfg2", { expectedVaultKeyFp: "not-hex" })); }
+    catch (e) { t2 = e; }
+    check("non-hex expectedVaultKeyFp throws", t2 && t2.code === "INVALID_CONFIG");
+
+    b.cluster._resetForTest();
+    var t3 = null;
+    try { await b.cluster.init(_initOpts("vk-cfg3", { expectedVaultKeyFp: BOGUS_FP })); }
+    catch (e) { t3 = e; }
+    check("expectedVaultKeyFp without acceptVaultKeyRotation throws", t3 && t3.code === "INVALID_CONFIG");
+  } finally { await ctx.teardown(); }
+}
+
+async function run() {
+  testSurface();
+  await testRotationAccepted();
+  await testNoDeclarationStillRefuses();
+  await testExpectedFpMatchAdopts();
+  await testExpectedFpMismatchRefuses();
+  await testSameKeyReInitIsClean();
+  await testConfigValidation();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[cluster-vault-rotation] OK — " + helpers.getChecks() + " checks passed"); },
+    // Rethrow rather than console.error(e): setupTestDb seeds a vault
+    // passphrase, and logging the error object trips CodeQL's clear-text-
+    // logging taint. Let Node print the uncaught error + stack and exit
+    // non-zero, with no logging sink for the taint to reach.
+    function (e) { process.exitCode = 1; throw e; }
+  );
+}