@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/fal.test.js

@@ -96,6 +96,26 @@ function testFromAssertionRefusesBadShape() {
   expectCode("bad hokBinding", function () { b.auth.fal.fromAssertion({ channel: "back", hokBinding: "kerberos" }); }, "auth/bad-fal-opts");
 }
 
+function testIsValidBand() {
+  // isValidBand is the exact-match predicate the rest of the family
+  // (meets / requireFal / fromAssertion) gates on. Drive it directly.
+  check("b.auth.fal.isValidBand: FAL1 valid", b.auth.fal.isValidBand("FAL1") === true);
+  check("b.auth.fal.isValidBand: FAL2 valid", b.auth.fal.isValidBand("FAL2") === true);
+  check("b.auth.fal.isValidBand: FAL3 valid", b.auth.fal.isValidBand("FAL3") === true);
+
+  // Anything that is not one of the three documented band strings is
+  // false — an unknown / mis-cased / empty / non-string value must never
+  // read as a valid band (operators branch on this for authz).
+  check("b.auth.fal.isValidBand: unknown band invalid", b.auth.fal.isValidBand("FALX") === false);
+  check("b.auth.fal.isValidBand: FAL0 invalid",         b.auth.fal.isValidBand("FAL0") === false);
+  check("b.auth.fal.isValidBand: lowercase invalid",    b.auth.fal.isValidBand("fal2") === false);
+  check("b.auth.fal.isValidBand: empty string invalid", b.auth.fal.isValidBand("") === false);
+  check("b.auth.fal.isValidBand: null invalid",         b.auth.fal.isValidBand(null) === false);
+  check("b.auth.fal.isValidBand: undefined invalid",    b.auth.fal.isValidBand(undefined) === false);
+  check("b.auth.fal.isValidBand: number invalid",       b.auth.fal.isValidBand(2) === false);
+  check("b.auth.fal.isValidBand: object invalid",       b.auth.fal.isValidBand({ band: "FAL2" }) === false);
+}
+
 function testMeets() {
   check("FAL3 meets FAL2",  b.auth.fal.meets("FAL3", "FAL2") === true);
   check("FAL3 meets FAL3",  b.auth.fal.meets("FAL3", "FAL3") === true);
@@ -134,6 +154,7 @@ async function run() {
   testFromAssertion();
   testBearerOnlyAlias();
   testFromAssertionRefusesBadShape();
+  testIsValidBand();
   testMeets();
   testRequireFal();
 }

package/lib/vendor/blamejs/test/layer-0-primitives/fedcm-dbsc.test.js

@@ -106,6 +106,32 @@ function testDbscErrorClass() {
 
 function _newSecret() { return nodeCrypto.randomBytes(32); }
 
+// Sign a real ES256 DBSC binding-assertion (header carries the embedded
+// binding-key jwk; signature is the JWT raw r||s form the verifier expects).
+// Shared by the round-trip + freshness tests so the DER→raw conversion lives
+// in one place.
+function _signEs256Assertion(kp, payload) {
+  var jwk = kp.publicKey.export({ format: "jwk" });
+  var header  = Buffer.from(JSON.stringify({ alg: "ES256", typ: "JWT", jwk: jwk }), "utf8").toString("base64url");
+  var payloadB = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  var signingInput = header + "." + payloadB;
+  var derSig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "utf8"), kp.privateKey);
+  // DER SEQUENCE(INTEGER r, INTEGER s) → fixed-width raw r||s.
+  var off = 2;
+  if (derSig[1] & 0x80) off = 2 + (derSig[1] & 0x7f);
+  var rLen = derSig[off + 1];
+  var r = derSig.slice(off + 2, off + 2 + rLen);
+  off = off + 2 + rLen;
+  var sLen = derSig[off + 1];
+  var s = derSig.slice(off + 2, off + 2 + sLen);
+  if (r.length > 32 && r[0] === 0) r = r.slice(1);
+  if (s.length > 32 && s[0] === 0) s = s.slice(1);
+  var raw = Buffer.alloc(64);
+  r.copy(raw, 32 - r.length);
+  s.copy(raw, 64 - s.length);
+  return signingInput + "." + raw.toString("base64url");
+}
+
 function testDbscChallengeRoundtrip() {
   var secret = _newSecret();
   var c = b.dbsc.challenge({ secretKey: secret });
@@ -167,26 +193,7 @@ function testDbscBindingAssertionRoundtrip() {
   // Generate a real ECDSA-P256 key, sign a JWT properly, verify.
   var secret = _newSecret();
   var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
-  var jwk = kp.publicKey.export({ format: "jwk" });
-  var header  = Buffer.from(JSON.stringify({ alg: "ES256", typ: "JWT", jwk: jwk }), "utf8").toString("base64url");
-  var payload = Buffer.from(JSON.stringify({ aud: "https://rp.example", iat: Math.floor(Date.now() / 1000) }), "utf8").toString("base64url");
-  var signingInput = header + "." + payload;
-  var derSig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "utf8"), kp.privateKey);
-  // DER → raw r||s for JWT.
-  // Use a quick inline conversion: nodeCrypto.sign for "ec" produces DER.
-  var off = 2;
-  if (derSig[1] & 0x80) off = 2 + (derSig[1] & 0x7f);
-  var rLen = derSig[off + 1];
-  var r = derSig.slice(off + 2, off + 2 + rLen);
-  off = off + 2 + rLen;
-  var sLen = derSig[off + 1];
-  var s = derSig.slice(off + 2, off + 2 + sLen);
-  if (r.length > 32 && r[0] === 0) r = r.slice(1);
-  if (s.length > 32 && s[0] === 0) s = s.slice(1);
-  var raw = Buffer.alloc(64);
-  r.copy(raw, 32 - r.length);
-  s.copy(raw, 64 - s.length);
-  var jwt = signingInput + "." + raw.toString("base64url");
+  var jwt = _signEs256Assertion(kp, { aud: "https://rp.example", iat: Math.floor(Date.now() / 1000) });
   var v = b.dbsc.verifyBindingAssertion(jwt, {
     secretKey: secret, expectedAud: "https://rp.example",
   });
@@ -194,6 +201,24 @@ function testDbscBindingAssertionRoundtrip() {
   check("verify returns JWK thumbprint",    typeof v.jkt === "string" && v.jkt.length > 0);
 }
 
+function testDbscBindingAssertionFutureIat() {
+  // Freshness fail-open: an assertion whose `iat` is far in the FUTURE must
+  // be refused. The stale check only rejects a too-OLD iat
+  // (Date.now() - iat*1000 > maxAge); a forward-dated iat makes that
+  // difference negative, so it never trips and the assertion stays "fresh"
+  // indefinitely — defeating the maxAge replay bound. Siblings bound the
+  // future too (b.auth.jwt.verifyExternal → iat-future; dpop → ±window).
+  var secret = _newSecret();
+  var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  var future = Math.floor(Date.now() / 1000) + 100000000;   // ~3 years ahead
+  var jwt = _signEs256Assertion(kp, { aud: "https://rp.example", iat: future });
+  var threw = null;
+  try {
+    b.dbsc.verifyBindingAssertion(jwt, { secretKey: secret, expectedAud: "https://rp.example" });
+  } catch (e) { threw = e.code; }
+  check("far-future iat binding-assertion refused", threw === "dbsc/iat-future");
+}
+
 function run() {
   testFedcmWellKnown();
   testFedcmConfig();
@@ -209,6 +234,7 @@ function run() {
   testDbscBindingAssertionAlgConfusion();
   testDbscBindingAssertionMissingJwk();
   testDbscBindingAssertionRoundtrip();
+  testDbscBindingAssertionFutureIat();
 }
 
 if (require.main === module) {

package/lib/vendor/blamejs/test/layer-0-primitives/federation-vc-suite.test.js

@@ -378,9 +378,21 @@ async function testFederationSubordinateVerifiedAgainstAttestedKeys() {
         threw && (threw.code === "auth-openid-federation/bad-signature" ||
                   threw.code === "auth-openid-federation/no-matching-kid"));
 
-  // Positive control: when the leaf statement is signed by the REAL
-  // (anchor-attested) intermediate key, the chain builds.
+  // Positive control: a fully anchor-attested chain builds. Per OIDF 1.0 §9
+  // the intermediate's OWN self-config must also be signed by a superior-
+  // attested key (not just the downward leaf statement), so the good chain
+  // serves an intermediate config signed by interReal -- the attacker-signed
+  // interCfg above is now refused at the intermediate node, not merely
+  // overridden for the next link.
+  var interCfgGood = _signEntityStatement(interReal,
+    { iss: INT, sub: INT, jwks: interReal.jwks, authority_hints: [ANCHOR] });
   var subAboutLeafGood = _signEntityStatement(interReal, { iss: INT, sub: LEAF, jwks: leaf.jwks });
+  function _fetcherGood(url) {
+    if (url === ANCHOR + "/.well-known/openid-federation") return Promise.resolve(anchorCfg);
+    if (url === INT + "/.well-known/openid-federation")    return Promise.resolve(interCfgGood);
+    if (url === LEAF + "/.well-known/openid-federation")   return Promise.resolve(leafCfg);
+    return Promise.reject(new Error("404 " + url));
+  }
   function _fetchSubordinateGood(authority, sub) {
     if (authority === ANCHOR && sub === INT)  return Promise.resolve(subAboutInter);
     if (authority === INT    && sub === LEAF) return Promise.resolve(subAboutLeafGood);
@@ -389,7 +401,7 @@ async function testFederationSubordinateVerifiedAgainstAttestedKeys() {
   var built = await b.auth.openidFederation.buildTrustChain({
     leafEntityId: LEAF,
     trustAnchors: { "https://anchor.example": anchor.jwks },
-    fetcher: _fetcher,
+    fetcher: _fetcherGood,
     fetchSubordinate: _fetchSubordinateGood,
   });
   check("federation M5: leaf statement signed by anchor-attested key builds",
@@ -403,6 +415,136 @@ async function testFederationSubordinateVerifiedAgainstAttestedKeys() {
         built[1].claims.jwks.keys[0].x !== interEvil.jwks.keys[0].x);
 }
 
+// ---- OpenID Federation verifyEntityStatement (single-statement JWS) ---
+
+function testFederationVerifyEntityStatement() {
+  var LEAF = "https://leaf.example";
+  var leaf = _fedEntity("leaf-key-1");
+  // A self-signed entity configuration: the entity signs a statement over
+  // its own published JWKS with its own key (iss === sub).
+  var stmt = _signEntityStatement(leaf, { iss: LEAF, sub: LEAF, jwks: leaf.jwks });
+
+  // Success: verify against the entity's own JWKS → the parsed claims.
+  var claims = b.auth.openidFederation.verifyEntityStatement(stmt, leaf.jwks);
+  check("b.auth.openidFederation.verifyEntityStatement: self-signed statement verifies",
+        claims && claims.iss === LEAF && claims.sub === LEAF &&
+        claims.jwks && Array.isArray(claims.jwks.keys));
+
+  // Wrong key: a DIFFERENT keypair published under the SAME kid — the kid
+  // lookup matches the key slot, but the signature was made by the real
+  // key, so verification MUST fail closed (bad-signature), never accept.
+  var wrong = _fedEntity("leaf-key-1");
+  var threwSig = null;
+  try { b.auth.openidFederation.verifyEntityStatement(stmt, wrong.jwks); }
+  catch (e) { threwSig = e; }
+  check("b.auth.openidFederation.verifyEntityStatement: wrong-key JWKS refused (bad signature)",
+        threwSig && threwSig.code === "auth-openid-federation/bad-signature");
+
+  // No matching kid in the supplied JWKS → typed refusal (not a silent
+  // lone-key fallback).
+  var other = _fedEntity("some-other-kid");
+  var threwKid = null;
+  try { b.auth.openidFederation.verifyEntityStatement(stmt, other.jwks); }
+  catch (e) { threwKid = e; }
+  check("b.auth.openidFederation.verifyEntityStatement: no-matching-kid refused",
+        threwKid && threwKid.code === "auth-openid-federation/no-matching-kid");
+}
+
+// ---- OID4VP verifier round-trip (createRequest → verifyResponse) ------
+
+async function testOid4vpVerifierRoundTrip() {
+  var issuerKp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var holderKp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var CLIENT_ID = "https://verifier.example";
+
+  var verifier = b.auth.oid4vp.verifier.create({
+    clientId:          CLIENT_ID,
+    responseUri:       "https://verifier.example/vp",
+    issuerKeyResolver: async function () { return issuerKp.publicKey; },
+  });
+  check("b.auth.oid4vp.verifier.create: returns a verifier object",
+        verifier && typeof verifier.createRequest === "function" &&
+        typeof verifier.verifyResponse === "function");
+
+  var dcql = {
+    credentials: [
+      { id: "id-card", format: "vc+sd-jwt",
+        meta: { vct_values: ["https://example.com/vct/identity"] },
+        claims: [{ path: ["given_name"] }] },
+    ],
+  };
+
+  // createRequest mints the nonce + state the wallet echoes back.
+  var reqObj = verifier.createRequest({ dcql: dcql });
+  check("b.auth.oid4vp.verifier.createRequest: request carries response_type + client_id + nonce",
+        reqObj.request && reqObj.request.response_type === "vp_token" &&
+        reqObj.request.client_id === CLIENT_ID &&
+        typeof reqObj.nonce === "string" && reqObj.nonce.length > 0 &&
+        typeof reqObj.state === "string" && reqObj.state.length > 0);
+  check("b.auth.oid4vp.verifier.createRequest: embeds the DCQL query",
+        reqObj.request.dcql_query === dcql);
+
+  // Wallet side: issue an SD-JWT VC bound to the holder key, then present
+  // it with a KB-JWT for THIS verifier's audience (clientId) + nonce.
+  var holderJwk = holderKp.publicKey.export({ format: "jwk" });
+  var sd = b.auth.sdJwtVc.issue({
+    issuer:   "https://issuer", vct: "https://example.com/vct/identity",
+    claims:   { given_name: "Alice", family_name: "Smith" },
+    selectivelyDisclosed: ["given_name", "family_name"],
+    issuerKey: issuerKp.privateKey, algorithm: "ES256",
+    holderKey: holderJwk,
+  });
+  var pres = b.auth.sdJwtVc.present({
+    sdJwt:               sd.token,
+    disclosedClaimNames: ["given_name"],
+    audience:            CLIENT_ID,
+    nonce:               reqObj.nonce,
+    holderKey:           holderKp.privateKey,
+    algorithm:           "ES256",
+  });
+
+  // Success: vp_token keyed by DCQL credential id verifies + matches.
+  var result = await verifier.verifyResponse({
+    vpToken: { "id-card": pres.presentation },
+    dcql:    dcql,
+    nonce:   reqObj.nonce,
+  });
+  check("b.auth.oid4vp.verifier.verifyResponse: round-trip valid",
+        result.valid === true && result.errors.length === 0);
+  check("b.auth.oid4vp.verifier.verifyResponse: disclosed claim surfaced, held-back withheld",
+        result.presentations.length === 1 &&
+        result.presentations[0].claims.given_name === "Alice" &&
+        result.presentations[0].claims.family_name === undefined);
+  check("b.auth.oid4vp.verifier.verifyResponse: DCQL matched map populated",
+        !!result.matched["id-card"]);
+
+  // Tampered response: flip a byte in the issuer-JWS signature segment —
+  // the presentation must fail verification (valid:false, error recorded),
+  // never silently pass.
+  var segs = pres.presentation.split("~");
+  var jwtParts = segs[0].split(".");
+  var sig = jwtParts[2];
+  jwtParts[2] = sig.slice(0, -1) + (sig.slice(-1) === "A" ? "B" : "A");
+  segs[0] = jwtParts.join(".");
+  var tamperedResult = await verifier.verifyResponse({
+    vpToken: { "id-card": segs.join("~") },
+    dcql:    dcql,
+    nonce:   reqObj.nonce,
+  });
+  check("b.auth.oid4vp.verifier.verifyResponse: tampered presentation refused",
+        tamperedResult.valid === false && tamperedResult.errors.length > 0);
+
+  // Replay defense: the honest presentation replayed under a DIFFERENT
+  // nonce than its KB-JWT was bound to must be refused.
+  var replayResult = await verifier.verifyResponse({
+    vpToken: { "id-card": pres.presentation },
+    dcql:    dcql,
+    nonce:   "a-different-nonce-than-was-presented",
+  });
+  check("b.auth.oid4vp.verifier.verifyResponse: nonce-mismatch (replay) refused",
+        replayResult.valid === false && replayResult.errors.length > 0);
+}
+
 // ---- OID4VP DCQL ------------------------------------------------------
 
 function testDcqlMatch() {
@@ -1143,6 +1285,8 @@ async function run() {
   await testFederationTrustChainMultiElement();
   await testFederationSubsetOfRefusesWidening();
   await testFederationSubordinateVerifiedAgainstAttestedKeys();
+  testFederationVerifyEntityStatement();
+  await testOid4vpVerifierRoundTrip();
   testDcqlMatch();
   testOid4vciIssuerConfig();
   await testOid4vciKidResolver();