@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/http-message-signature.test.js

@@ -543,6 +543,628 @@ function testRequiredComponentsCoverage() {
         rightParam.valid === true);
 }
 
+// Shared fixtures for the branch-coverage suite below. Every test drives the
+// exported b.crypto.httpSig.{sign,verify,contentDigest} consumer path; nothing
+// reaches for a private function.
+function _reqBase(extra) {
+  return Object.assign({
+    method:  "GET",
+    url:     "https://api.example.com/x",
+    headers: { host: "api.example.com" },
+  }, extra || {});
+}
+function _withSig(msg, signed) {
+  return Object.assign({}, msg, { headers: Object.assign({}, msg.headers, signed.headers) });
+}
+
+// _sfQuotedString refuses any parameter byte outside printable-ASCII
+// (RFC 8941 §3.3.3): a control byte in a signature parameter (here `nonce`)
+// makes sign() throw BAD_PARAM rather than emit a header that would mis-parse
+// on the wire. Constructed via fromCharCode so no literal control byte lands
+// in the test source.
+function testNonPrintableParamRejected() {
+  var keys = _genEd25519();
+  var ctl = String.fromCharCode(1);
+  var err = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase(), {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+      covered: ["@method", "@target-uri"], nonce: "bad" + ctl + "nonce",
+    });
+  } catch (e) { err = e; }
+  check("sign refuses a control byte in a signature parameter (BAD_PARAM)",
+        err && err.code === "BAD_PARAM");
+}
+
+// RFC 9421 §2.2 derived components — @scheme / @request-target / @path /
+// @query / @authority all resolve into the signature base and round-trip.
+// @status (a response component) resolves from a numeric status; covering it
+// with no status throws MISSING_STATUS; an unknown @-component throws
+// UNKNOWN_DERIVED.
+function testDerivedComponents() {
+  var keys = _genEd25519();
+  var msg = {
+    method:  "GET",
+    url:     "https://api.example.com/a/b?q=1",
+    headers: { host: "api.example.com" },
+  };
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@scheme", "@authority", "@request-target", "@path", "@query"],
+  });
+  var verified = b.crypto.httpSig.verify(_withSig(msg, signed),
+    { keyResolver: function () { return keys.publicKey; }, requiredComponents: [] });
+  check("all §2.2 derived components (@scheme/@authority/@request-target/@path/@query) round-trip",
+        verified.valid === true);
+
+  // @status resolves from a numeric status (response-style message).
+  var respMsg = {
+    method:  "GET",
+    url:     "https://api.example.com/a",
+    headers: { host: "api.example.com" },
+    status:  200,
+  };
+  var respSigned = b.crypto.httpSig.sign(respMsg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri", "@status"],
+  });
+  var respVerified = b.crypto.httpSig.verify(_withSig(respMsg, respSigned),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("@status resolves from a numeric status and round-trips", respVerified.valid === true);
+
+  // A URL with NO query exercises the empty-query branches: @request-target
+  // omits the (absent) query, and @query defaults to "?".
+  var noQueryMsg = _reqBase({ url: "https://api.example.com/x" });
+  var noQuerySigned = b.crypto.httpSig.sign(noQueryMsg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@request-target", "@query"],
+  });
+  var noQueryVerified = b.crypto.httpSig.verify(_withSig(noQueryMsg, noQuerySigned),
+    { keyResolver: function () { return keys.publicKey; }, requiredComponents: [] });
+  check("@request-target/@query on a query-less URL round-trip (@query → '?')",
+        noQueryVerified.valid === true);
+
+  // @status covered but message carries no status → MISSING_STATUS.
+  var statusErr = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase(), {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey, covered: ["@status"],
+    });
+  } catch (e) { statusErr = e; }
+  check("@status without a numeric status throws MISSING_STATUS",
+        statusErr && statusErr.code === "MISSING_STATUS");
+
+  // Unknown @-component → UNKNOWN_DERIVED.
+  var derivedErr = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase(), {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+      covered: ["@method", "@bogus-derived"],
+    });
+  } catch (e) { derivedErr = e; }
+  check("an unknown @-derived component throws UNKNOWN_DERIVED",
+        derivedErr && derivedErr.code === "UNKNOWN_DERIVED");
+}
+
+// RFC 9421 §2.3 signature parameters — nonce / tag / expires / explicit label
+// all serialize into Signature-Input, and an explicit `now` feeds `created`.
+// verify surfaces created / expires / nonce on the valid result.
+function testSignatureParameters() {
+  var keys = _genEd25519();
+  var nowMs = Date.now();
+  var nowSec = Math.floor(nowMs / 1000);
+  var msg = _reqBase();
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri"],
+    label:   "custom-label",
+    nonce:   "n-0123",
+    tag:     "app-a",
+    expires: nowSec + 300,
+    now:     function () { return nowMs; },
+  });
+  var si = signed.headers["Signature-Input"];
+  check("Signature-Input carries the custom label", si.indexOf("custom-label=") === 0);
+  check("Signature-Input serializes nonce + tag + expires + created",
+        /;created=/.test(si) && /;expires=/.test(si) &&
+        /;nonce="n-0123"/.test(si) && /;tag="app-a"/.test(si));
+  var verified = b.crypto.httpSig.verify(_withSig(msg, signed),
+    { keyResolver: function () { return keys.publicKey; },
+      now: function () { return nowMs; } });
+  check("parameterized signature round-trips + surfaces nonce/expires/created",
+        verified.valid === true && verified.label === "custom-label" &&
+        verified.nonce === "n-0123" && verified.expires === nowSec + 300 &&
+        verified.created === nowSec);
+}
+
+// @query-param sign-time failure modes (defensive resolution throws at base
+// build): no query string at all, the named param absent, and a bare
+// @query-param with no ;name parameter.
+function testQueryParamSignFailures() {
+  var keys = _genEd25519();
+  var noQueryErr = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase(), {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+      covered: ["@query-param;name=\"x\""],
+    });
+  } catch (e) { noQueryErr = e; }
+  check("@query-param on a URL with no query throws MISSING_QUERY",
+        noQueryErr && noQueryErr.code === "MISSING_QUERY");
+
+  var absentErr = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase({ url: "https://api.example.com/x?present=1" }), {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+      covered: ["@query-param;name=\"absent\""],
+    });
+  } catch (e) { absentErr = e; }
+  check("@query-param naming an absent param throws MISSING_QUERY_PARAM",
+        absentErr && absentErr.code === "MISSING_QUERY_PARAM");
+
+  var bareErr = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase({ url: "https://api.example.com/x?present=1" }), {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+      covered: ["@query-param"],
+    });
+  } catch (e) { bareErr = e; }
+  check("a bare @query-param with no ;name parameter throws BAD_QUERY_PARAM",
+        bareErr && bareErr.code === "BAD_QUERY_PARAM");
+}
+
+// RFC 9421 §2.2.8 — a valueless query member (`?flag&ref=1`) resolves to the
+// empty string for its value, matching on the name only (the `eq === -1`
+// branches for both the wire name and the returned value).
+function testQueryParamValuelessFlag() {
+  var keys = _genEd25519();
+  var msg = _reqBase({ url: "https://api.example.com/x?flag&ref=1" });
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@query-param;name=\"flag\""],
+  });
+  var verified = b.crypto.httpSig.verify(_withSig(msg, signed),
+    { keyResolver: function () { return keys.publicKey; }, requiredComponents: [] });
+  check("a valueless @query-param flag (name only, empty value) round-trips",
+        verified.valid === true);
+}
+
+// A covered header that is not present in the message throws MISSING_HEADER at
+// base build (sign side).
+function testMissingCoveredHeader() {
+  var keys = _genEd25519();
+  var err = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase(), {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+      covered: ["@method", "x-absent-header"],
+    });
+  } catch (e) { err = e; }
+  check("covering a header absent from the message throws MISSING_HEADER",
+        err && err.code === "MISSING_HEADER");
+}
+
+// RFC 9421 §2.1 — a multi-valued header (array) is obs-folded into one
+// ", "-joined value in the base, and round-trips on both sides.
+function testArrayHeaderValue() {
+  var keys = _genEd25519();
+  var msg = _reqBase({ headers: { host: "api.example.com", "x-multi": ["a", "b"] } });
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "x-multi"],
+  });
+  var verified = b.crypto.httpSig.verify(_withSig(msg, signed),
+    { keyResolver: function () { return keys.publicKey; }, requiredComponents: [] });
+  check("a multi-valued (array) header obs-folds and round-trips", verified.valid === true);
+}
+
+// contentDigest accepts a string or Buffer and refuses any other body type.
+function testContentDigestFunction() {
+  check("contentDigest(string) returns the sha3-512 structured field",
+        /^sha3-512=:.+:$/.test(b.crypto.httpSig.contentDigest("abc")));
+  check("contentDigest(Buffer) returns the sha3-512 structured field",
+        /^sha3-512=:.+:$/.test(b.crypto.httpSig.contentDigest(Buffer.from("abc"))));
+  check("contentDigest of a Buffer equals contentDigest of the equivalent string",
+        b.crypto.httpSig.contentDigest(Buffer.from("abc")) ===
+        b.crypto.httpSig.contentDigest("abc"));
+  var err = null;
+  try { b.crypto.httpSig.contentDigest(12345); } catch (e) { err = e; }
+  check("contentDigest of a non-string/Buffer body throws BAD_BODY",
+        err && err.code === "BAD_BODY");
+}
+
+// sign()-side option / message failures: a message with no headers, a covered
+// content-digest with no body, and an unparseable private key (SIGN_FAILED).
+function testSignFailures() {
+  var keys = _genEd25519();
+  var headersErr = null;
+  try {
+    b.crypto.httpSig.sign({ method: "GET", url: "https://api.example.com/x" }, {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey, covered: ["@method"],
+    });
+  } catch (e) { headersErr = e; }
+  check("a message with no headers throws BAD_OPT", headersErr && headersErr.code === "BAD_OPT");
+
+  var bodyErr = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase({ method: "POST", url: "https://api.example.com/o" }), {
+      keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+      covered: ["@method", "content-digest"],
+    });
+  } catch (e) { bodyErr = e; }
+  check("covering content-digest with no body throws BAD_OPT",
+        bodyErr && bodyErr.code === "BAD_OPT");
+
+  var signErr = null;
+  try {
+    b.crypto.httpSig.sign(_reqBase(), {
+      keyid: "k1", alg: "ed25519", privateKey: "-----BEGIN PRIVATE KEY-----\nnot-real\n-----END PRIVATE KEY-----\n",
+      covered: ["@method", "@target-uri"],
+    });
+  } catch (e) { signErr = e; }
+  check("an unparseable private key throws SIGN_FAILED", signErr && signErr.code === "SIGN_FAILED");
+}
+
+// verify()-side option / presence gates that return a verdict (never throw,
+// except the keyResolver contract): no keyResolver, no Signature-Input, no
+// Signature.
+function testVerifyPresenceGates() {
+  var keys = _genEd25519();
+  var signed = b.crypto.httpSig.sign(_reqBase(), {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey, covered: ["@method", "@target-uri"],
+  });
+  var resolverErr = null;
+  try { b.crypto.httpSig.verify(_reqBase(), {}); } catch (e) { resolverErr = e; }
+  check("verify without a keyResolver throws BAD_OPT", resolverErr && resolverErr.code === "BAD_OPT");
+
+  // verify with no opts argument at all defaults opts to {} then hits the same
+  // keyResolver contract.
+  var noOptsErr = null;
+  try { b.crypto.httpSig.verify(_reqBase()); } catch (e) { noOptsErr = e; }
+  check("verify with no opts argument throws BAD_OPT (opts defaults to {})",
+        noOptsErr && noOptsErr.code === "BAD_OPT");
+
+  var noInput = b.crypto.httpSig.verify(_reqBase(),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("verify with no Signature-Input returns missing-signature-input",
+        noInput.valid === false && noInput.reason === "missing-signature-input");
+
+  var onlyInput = b.crypto.httpSig.verify(
+    _reqBase({ headers: { host: "api.example.com", "Signature-Input": signed.headers["Signature-Input"] } }),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("verify with Signature-Input but no Signature returns missing-signature",
+        onlyInput.valid === false && onlyInput.reason === "missing-signature");
+}
+
+// Malformed Signature-Input header shapes all return the bad-signature-input
+// verdict (the _parseSignatureInput throw is caught): missing '=', a covered
+// list not starting with '(', a covered list missing ')', and an unterminated
+// quoted token.
+function testMalformedSignatureInput() {
+  var keys = _genEd25519();
+  var cases = [
+    ["missing '='",            "no-equals-here"],
+    ["covered not '('",        "sig1=notparen"],
+    ["covered missing ')'",    "sig1=(no-close"],
+    ["unterminated quote",     "sig1=(\"@method);alg=\"ed25519\""],
+  ];
+  for (var i = 0; i < cases.length; i++) {
+    var v = b.crypto.httpSig.verify(
+      _reqBase({ headers: {
+        host: "api.example.com",
+        "Signature-Input": cases[i][1],
+        "Signature": "sig1=:AAAA:",
+      } }),
+      { keyResolver: function () { return keys.publicKey; } });
+    check("malformed Signature-Input (" + cases[i][0] + ") → bad-signature-input",
+          v.valid === false && v.reason === "bad-signature-input");
+  }
+}
+
+// A forward-compat peer MAY transmit bare (unquoted) covered tokens; the parser
+// tolerates them and — because the base re-quotes each bare name — the
+// signature still verifies.
+function testBareUnquotedCoveredTokens() {
+  var keys = _genEd25519();
+  var msg = _reqBase();
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey, covered: ["@method", "@target-uri"],
+  });
+  var bareInput = signed.headers["Signature-Input"]
+    .replace("(\"@method\" \"@target-uri\")", "(@method @target-uri)");
+  check("the rewrite produced bare unquoted covered tokens",
+        /\(@method @target-uri\)/.test(bareInput));
+  var verified = b.crypto.httpSig.verify(
+    _withSig(msg, { headers: Object.assign({}, signed.headers, { "Signature-Input": bareInput }) }),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("bare (unquoted) covered tokens still verify (base re-quotes them)",
+        verified.valid === true);
+}
+
+// parsed-parameter gates: an unsupported alg and a missing/empty keyid each
+// return a verdict before any crypto runs.
+function testParsedParamGates() {
+  var keys = _genEd25519();
+  var badAlg = b.crypto.httpSig.verify(
+    _reqBase({ headers: {
+      host: "api.example.com",
+      "Signature-Input": "sig1=(\"@method\");created=1;keyid=\"k1\";alg=\"rsa-pss-sha512\"",
+      "Signature": "sig1=:AAAA:",
+    } }),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("an unsupported alg in Signature-Input → unsupported-alg",
+        badAlg.valid === false && badAlg.reason === "unsupported-alg");
+
+  var noKeyid = b.crypto.httpSig.verify(
+    _reqBase({ headers: {
+      host: "api.example.com",
+      "Signature-Input": "sig1=(\"@method\");created=1;alg=\"ed25519\"",
+      "Signature": "sig1=:AAAA:",
+    } }),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("a Signature-Input with no keyid → missing-keyid",
+        noKeyid.valid === false && noKeyid.reason === "missing-keyid");
+}
+
+// RFC 9421 §3.2.4 — a future-dated `created` beyond the clock-skew window is
+// refused (`future`), and an already-passed `expires` is refused
+// (`expires-passed`); a malformed clockSkewMs falls back to the default window.
+function testTimeGates() {
+  var keys = _genEd25519();
+  var nowSec = Math.floor(Date.now() / 1000);
+
+  var futureSigned = b.crypto.httpSig.sign(_reqBase(), {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri"], created: nowSec + 3600,
+  });
+  var future = b.crypto.httpSig.verify(_withSig(_reqBase(), futureSigned),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("a far-future created is refused (future)",
+        future.valid === false && future.reason === "future");
+
+  var expiredSigned = b.crypto.httpSig.sign(_reqBase(), {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri"], created: nowSec, expires: nowSec - 10,
+  });
+  var expires = b.crypto.httpSig.verify(_withSig(_reqBase(), expiredSigned),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("an already-passed expires is refused (expires-passed)",
+        expires.valid === false && expires.reason === "expires-passed");
+
+  // A near-future created (within the default skew) verifies even when a
+  // malformed clockSkewMs is supplied (it falls back to the default window).
+  var nearSigned = b.crypto.httpSig.sign(_reqBase(), {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri"], created: nowSec + 2,
+  });
+  var near = b.crypto.httpSig.verify(_withSig(_reqBase(), nearSigned),
+    { keyResolver: function () { return keys.publicKey; }, clockSkewMs: NaN });
+  check("a malformed clockSkewMs falls back to the default skew (near-future accepted)",
+        near.valid === true);
+
+  // An explicit, valid clockSkewMs is honored: a signature ~5 minutes in the
+  // future is refused under a tight 1-minute skew but accepted under a 10-minute
+  // skew.
+  var aheadSigned = b.crypto.httpSig.sign(_reqBase(), {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri"], created: nowSec + 300,
+  });
+  var tightSkew = b.crypto.httpSig.verify(_withSig(_reqBase(), aheadSigned),
+    { keyResolver: function () { return keys.publicKey; },
+      clockSkewMs: b.constants.TIME.minutes(1) });
+  check("a 5-min-future signature is refused under a tight explicit clockSkewMs",
+        tightSkew.valid === false && tightSkew.reason === "future");
+  var wideSkew = b.crypto.httpSig.verify(_withSig(_reqBase(), aheadSigned),
+    { keyResolver: function () { return keys.publicKey; },
+      clockSkewMs: b.constants.TIME.minutes(10) });
+  check("the same 5-min-future signature is accepted under a wide explicit clockSkewMs",
+        wideSkew.valid === true);
+}
+
+// A keyResolver that throws is caught and reported (key-resolver-threw), never
+// propagated out of verify.
+function testKeyResolverThrows() {
+  var keys = _genEd25519();
+  var signed = b.crypto.httpSig.sign(_reqBase(), {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey, covered: ["@method", "@target-uri"],
+  });
+  var v = b.crypto.httpSig.verify(_withSig(_reqBase(), signed),
+    { keyResolver: function () { throw new Error("resolver down"); } });
+  check("a throwing keyResolver is caught and reported (key-resolver-threw)",
+        v.valid === false && v.reason === "key-resolver-threw");
+}
+
+// verify-side content-digest branches: covered but no body
+// (content-digest-no-body), covered with body but the header stripped
+// (content-digest-header-missing), and a multi-member Content-Digest whose
+// sha3-512 member matches after skipping a malformed and a non-sha3-512 member.
+function testContentDigestVerifyBranches() {
+  var keys = _genEd25519();
+  var wb = {
+    method: "POST", url: "https://api.example.com/o",
+    headers: { host: "api.example.com" }, body: "B",
+  };
+  var cdSigned = b.crypto.httpSig.sign(wb, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri", "content-digest"],
+  });
+
+  // Body dropped at verify → content-digest-no-body (covered set still names it).
+  var noBody = b.crypto.httpSig.verify(
+    { method: "POST", url: "https://api.example.com/o",
+      headers: Object.assign({}, wb.headers, cdSigned.headers) },
+    { keyResolver: function () { return keys.publicKey; }, requiredComponents: [] });
+  check("content-digest covered but the verified message has no body → content-digest-no-body",
+        noBody.valid === false && noBody.reason === "content-digest-no-body");
+
+  // Body present but the Content-Digest header stripped → header-missing.
+  var strippedHeaders = Object.assign({}, wb.headers, cdSigned.headers);
+  delete strippedHeaders["Content-Digest"];
+  var headerMissing = b.crypto.httpSig.verify(
+    { method: "POST", url: "https://api.example.com/o", headers: strippedHeaders, body: "B" },
+    { keyResolver: function () { return keys.publicKey; }, requiredComponents: [] });
+  check("content-digest covered, body present, header stripped → content-digest-header-missing",
+        headerMissing.valid === false && headerMissing.reason === "content-digest-header-missing");
+
+  // A multi-member Content-Digest (malformed member + a non-sha3-512 member +
+  // the real sha3-512 member) supplied at BOTH sign and verify verifies: the
+  // parser skips the first two members and matches the sha3-512 one.
+  var realDigest = b.crypto.httpSig.contentDigest("B");
+  var multiHeader = "malformedmember, sha-256=:AAAA:, " + realDigest;
+  var multiMsg = {
+    method: "POST", url: "https://api.example.com/o",
+    headers: { host: "api.example.com", "content-digest": multiHeader }, body: "B",
+  };
+  var multiSigned = b.crypto.httpSig.sign(multiMsg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri", "content-digest"],
+  });
+  var multi = b.crypto.httpSig.verify(_withSig(multiMsg, multiSigned),
+    { keyResolver: function () { return keys.publicKey; }, requiredComponents: [] });
+  check("a multi-member Content-Digest matches its sha3-512 member (skipping malformed + non-sha3-512)",
+        multi.valid === true);
+}
+
+// The Signature header may carry multiple comma-separated labels; verify picks
+// the one named by Signature-Input's label. A decoy-prefixed header still
+// verifies; a header with no matching label returns bad-signature-header.
+function testMultiLabelSignature() {
+  var keys = _genEd25519();
+  var msg = _reqBase();
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey, covered: ["@method", "@target-uri"],
+  });
+  var decoyHeaders = Object.assign({}, signed.headers,
+    { "Signature": "decoy=:AAAA:, " + signed.headers["Signature"] });
+  var found = b.crypto.httpSig.verify(_withSig(msg, { headers: decoyHeaders }),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("verify finds the correct label among comma-separated Signature entries",
+        found.valid === true);
+
+  var wrongHeaders = Object.assign({}, signed.headers, { "Signature": "other=:AAAA:" });
+  var missing = b.crypto.httpSig.verify(_withSig(msg, { headers: wrongHeaders }),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("a Signature header with no entry for the label → bad-signature-header",
+        missing.valid === false && missing.reason === "bad-signature-header");
+}
+
+// The final crypto verdict: a cryptographically-wrong signature (valid key,
+// wrong signer) returns bad-signature; a resolver returning a non-key string
+// makes node's verify throw, caught as verify-threw.
+function testCryptoVerdicts() {
+  var keys = _genEd25519();
+  var other = _genEd25519();
+  var msg = _reqBase();
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey, covered: ["@method", "@target-uri"],
+  });
+  var wrongKey = b.crypto.httpSig.verify(_withSig(msg, signed),
+    { keyResolver: function () { return other.publicKey; } });
+  check("a signature checked against the wrong (valid) public key → bad-signature",
+        wrongKey.valid === false && wrongKey.reason === "bad-signature");
+
+  var garbageKey = b.crypto.httpSig.verify(_withSig(msg, signed),
+    { keyResolver: function () { return "not-a-real-key-pem"; } });
+  check("a resolver returning a non-key string makes node's verify throw → verify-threw",
+        garbageKey.valid === false && garbageKey.reason === "verify-threw");
+}
+
+// If base construction fails at verify (a covered header present at sign but
+// stripped before verify), verify returns build-base-failed rather than
+// throwing.
+function testBuildBaseFailed() {
+  var keys = _genEd25519();
+  var msg = _reqBase({ headers: { host: "api.example.com", "x-custom": "v" } });
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey,
+    covered: ["@method", "@target-uri", "x-custom"],
+  });
+  var strippedHeaders = Object.assign({}, msg.headers, signed.headers);
+  delete strippedHeaders["x-custom"];
+  var v = b.crypto.httpSig.verify(
+    { method: "GET", url: "https://api.example.com/x", headers: strippedHeaders },
+    { keyResolver: function () { return keys.publicKey; }, requiredComponents: [] });
+  check("a covered header stripped before verify → build-base-failed",
+        v.valid === false && v.reason === "build-base-failed");
+}
+
+// RFC 8941 §3.1.2 parameter parsing tolerance: verify rebuilds the canonical
+// @signature-params terminator from the parsed values, so a transmitted
+// Signature-Input with a trailing ';' (empty parameter) or an unquoted string
+// parameter (a conformant peer's serialization variant) still verifies.
+function testSignatureInputParamTolerance() {
+  var keys = _genEd25519();
+  var msg = _reqBase();
+
+  var signed = b.crypto.httpSig.sign(msg, {
+    keyid: "k1", alg: "ed25519", privateKey: keys.privateKey, covered: ["@method", "@target-uri"],
+  });
+  var trailingInput = signed.headers["Signature-Input"] + ";";
+  var trailing = b.crypto.httpSig.verify(
+    _withSig(msg, { headers: Object.assign({}, signed.headers, { "Signature-Input": trailingInput }) }),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("a trailing ';' (empty parameter) in Signature-Input is tolerated and still verifies",
+        trailing.valid === true);
+
+  // A conformant peer signs the canonical base (quoted tag) but transmits the
+  // tag parameter unquoted — verify parses it as a plain string, rebuilds the
+  // canonical (quoted) terminator, and the signature matches.
+  var created = Math.floor(Date.now() / 1000);
+  var coveredSf = "(\"@method\" \"@target-uri\")";
+  var canonicalBase =
+    "\"@method\": GET\n" +
+    "\"@target-uri\": https://api.example.com/x\n" +
+    "\"@signature-params\": " + coveredSf +
+    ";created=" + created + ";alg=\"ed25519\";keyid=\"k1\";tag=\"mytag\"";
+  var sig = nodeCrypto.sign(null, Buffer.from(canonicalBase, "utf8"), keys.privateKey);
+  var unquotedInput = "sig1=" + coveredSf +
+    ";created=" + created + ";alg=\"ed25519\";keyid=\"k1\";tag=mytag";   // tag unquoted
+  var unquoted = b.crypto.httpSig.verify(
+    _withSig(msg, { headers: {
+      "Signature-Input": unquotedInput,
+      "Signature": "sig1=:" + sig.toString("base64") + ":",
+    } }),
+    { keyResolver: function () { return keys.publicKey; } });
+  check("an unquoted string parameter (tag=mytag) parses as a string and verifies",
+        unquoted.valid === true);
+}
+
+function testAlgKeyBinding() {
+  // Alg-confusion (CWE-347): the declared alg is only an authenticated label
+  // unless it is bound to the key's real type. SUPPORTED_ALGS names ARE the
+  // node asymmetricKeyType values, so sign() must refuse to emit a mislabeled
+  // token and verify() must refuse a key whose type differs from the declared
+  // alg -- a classical ed25519 key must never pass under a declared PQC alg.
+  var e = _genEd25519();
+  var m = _genMlDsa65();
+  var msg = {
+    method:  "POST",
+    url:     "https://api.example.com/x",
+    headers: { host: "api.example.com" },
+    body:    "{}",
+  };
+  var cov = ["@method", "@target-uri", "@authority", "content-digest"];
+
+  var signThrew = false;
+  try {
+    b.crypto.httpSig.sign(msg, { keyid: "k", alg: "ml-dsa-65", privateKey: e.privateKey, covered: cov });
+  } catch (err) { signThrew = (err && err.code === "BAD_OPT"); }
+  check("httpSig.sign: ed25519 key declared alg=ml-dsa-65 refused (BAD_OPT)", signThrew);
+
+  var signed = b.crypto.httpSig.sign(msg, { keyid: "k", alg: "ed25519", privateKey: e.privateKey, covered: cov });
+  var full = Object.assign({}, msg, { headers: Object.assign({}, msg.headers, signed.headers) });
+  var mismatch = b.crypto.httpSig.verify(full, { keyResolver: function () { return m.publicKey; } });
+  check("httpSig.verify: declared alg != resolved key type refused (alg-key-mismatch)",
+        mismatch.valid === false && mismatch.reason === "alg-key-mismatch");
+
+  var okEd = b.crypto.httpSig.verify(full, { keyResolver: function () { return e.publicKey; } });
+  check("httpSig: legit ed25519 round-trip still verifies", okEd.valid === true);
+  var s2 = b.crypto.httpSig.sign(msg, { keyid: "k2", alg: "ml-dsa-65", privateKey: m.privateKey, covered: cov });
+  var f2 = Object.assign({}, msg, { headers: Object.assign({}, msg.headers, s2.headers) });
+  var okMl = b.crypto.httpSig.verify(f2, { keyResolver: function () { return m.publicKey; } });
+  check("httpSig: legit ml-dsa-65 round-trip still verifies", okMl.valid === true);
+}
+
 async function run() {
   testSurface();
   testRoundTripEd25519();
@@ -560,6 +1182,27 @@ async function run() {
   testQueryParamRfc9421PublishedVectors();
   testQueryParamDecodedNameWithDelimiter();
   testRequiredComponentsCoverage();
+  testNonPrintableParamRejected();
+  testDerivedComponents();
+  testSignatureParameters();
+  testQueryParamSignFailures();
+  testQueryParamValuelessFlag();
+  testMissingCoveredHeader();
+  testArrayHeaderValue();
+  testContentDigestFunction();
+  testSignFailures();
+  testVerifyPresenceGates();
+  testMalformedSignatureInput();
+  testBareUnquotedCoveredTokens();
+  testParsedParamGates();
+  testTimeGates();
+  testKeyResolverThrows();
+  testAlgKeyBinding();
+  testContentDigestVerifyBranches();
+  testMultiLabelSignature();
+  testCryptoVerdicts();
+  testBuildBaseFailed();
+  testSignatureInputParamTolerance();
 }
 
 module.exports = { run: run };