@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/cookies.test.js

@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.cookies.parseSafe — threat-detecting inbound-cookie parser.
+ *
+ * Drives the advertised `{ jar, issues }` contract against clean and
+ * hostile Cookie headers: duplicate names (cookie-tossing), a
+ * `__proto__` key (prototype-pollution attempt), CR/LF/NUL injection,
+ * oversized header / name / value, malformed pairs, and non-string
+ * input.
+ *
+ * Run standalone: `node test/layer-0-primitives/cookies.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function testCleanHeaderParses() {
+  var rv = b.cookies.parseSafe("a=1; b=two; c=three");
+  check("parseSafe: clean header yields no issues", rv.issues.length === 0);
+  check("parseSafe: jar carries every pair", rv.jar.a === "1" && rv.jar.b === "two" && rv.jar.c === "three");
+}
+
+function testEmptyHeader() {
+  var rv = b.cookies.parseSafe("");
+  check("parseSafe: empty header → empty jar, no issues",
+    rv.issues.length === 0 && Object.keys(rv.jar).length === 0);
+}
+
+function testDuplicateNameCookieTossing() {
+  // A parent-domain cookie shadowing the legitimate one appears twice;
+  // browsers apply last-write-wins. parseSafe surfaces it as a HIGH
+  // issue so the middleware can refuse (cookie-tossing class).
+  var rv = b.cookies.parseSafe("session=abc; session=evil");
+  check("parseSafe: duplicate-name surfaced", rv.issues.length === 1);
+  check("parseSafe: duplicate-name is HIGH severity",
+    rv.issues[0].kind === "duplicate-name" && rv.issues[0].severity === "high");
+  check("parseSafe: duplicate-name issue names the cookie", rv.issues[0].name === "session");
+  check("parseSafe: jar reflects last-write-wins (browser parity)", rv.jar.session === "evil");
+}
+
+function testProtoKeyDoesNotPollute() {
+  // A hostile `__proto__` cookie name must NOT reach Object.prototype.
+  // The jar is a null-prototype object so the key lands as an OWN data
+  // property and the global prototype is untouched.
+  var rv = b.cookies.parseSafe("a=1; __proto__=polluted; b=2");
+  check("parseSafe: global Object.prototype not polluted",
+    ({}).polluted === undefined && Object.prototype.polluted === undefined);
+  check("parseSafe: jar has null prototype (pollution-proof)",
+    Object.getPrototypeOf(rv.jar) === null);
+  check("parseSafe: legitimate pairs still parse alongside the hostile key",
+    rv.jar.a === "1" && rv.jar.b === "2");
+  // The __proto__ value lands as an own data property, not a prototype swap.
+  check("parseSafe: __proto__ captured as an own data property",
+    Object.prototype.hasOwnProperty.call(rv.jar, "__proto__") && rv.jar.__proto__ === "polluted");
+}
+
+function testControlByteInjection() {
+  // CR / LF / NUL smuggled through a proxy is a header-injection vector;
+  // parseSafe refuses the whole header (empty jar) with a HIGH issue.
+  var rv = b.cookies.parseSafe("a=1\r\nSet-Cookie: evil=1");
+  check("parseSafe: control byte → header-control-byte HIGH issue",
+    rv.issues.length === 1 && rv.issues[0].kind === "header-control-byte" &&
+    rv.issues[0].severity === "high");
+  check("parseSafe: control-byte header yields empty jar (fail-closed)",
+    Object.keys(rv.jar).length === 0);
+}
+
+function testNonStringInput() {
+  var rv = b.cookies.parseSafe(12345);
+  check("parseSafe: non-string input → bad-input HIGH issue",
+    rv.issues.length === 1 && rv.issues[0].kind === "bad-input" &&
+    rv.issues[0].severity === "high");
+  check("parseSafe: non-string input → empty jar", Object.keys(rv.jar).length === 0);
+}
+
+function testHeaderCap() {
+  var big = "x=" + "A".repeat(200);
+  var rv = b.cookies.parseSafe(big, { maxHeaderBytes: 64 });
+  check("parseSafe: oversized header → header-cap HIGH issue",
+    rv.issues.length === 1 && rv.issues[0].kind === "header-cap" &&
+    rv.issues[0].severity === "high");
+  check("parseSafe: over-cap header parses no pairs", rv.jar.x === undefined);
+}
+
+function testNameAndValueCap() {
+  var rvName = b.cookies.parseSafe("thisnameistoolong=v", { maxNameBytes: 4 });
+  check("parseSafe: over-long name → name-cap HIGH issue",
+    rvName.issues.some(function (i) { return i.kind === "name-cap" && i.severity === "high"; }));
+  check("parseSafe: over-cap name not admitted to jar", rvName.jar.thisnameistoolong === undefined);
+
+  var rvVal = b.cookies.parseSafe("k=" + "V".repeat(50), { maxValueBytes: 8 });
+  check("parseSafe: over-long value → value-cap HIGH issue",
+    rvVal.issues.some(function (i) { return i.kind === "value-cap" && i.severity === "high"; }));
+  check("parseSafe: over-cap value not admitted to jar", rvVal.jar.k === undefined);
+}
+
+function testMalformedAndEmptyName() {
+  var rvMalformed = b.cookies.parseSafe("novalue; a=1");
+  check("parseSafe: pair missing `=` → pair-malformed WARN",
+    rvMalformed.issues.some(function (i) { return i.kind === "pair-malformed" && i.severity === "warn"; }));
+  check("parseSafe: malformed pair skipped but valid pair still parses",
+    rvMalformed.jar.a === "1");
+
+  var rvEmpty = b.cookies.parseSafe("=orphan; b=2");
+  check("parseSafe: empty name → pair-empty-name WARN",
+    rvEmpty.issues.some(function (i) { return i.kind === "pair-empty-name" && i.severity === "warn"; }));
+  check("parseSafe: empty-name pair skipped, valid pair parses", rvEmpty.jar.b === "2");
+}
+
+function testUrlDecodeAndQuoteStrip() {
+  var rv = b.cookies.parseSafe('greeting="hello%20world"');
+  check("parseSafe: double-quotes stripped + percent-decoded",
+    rv.jar.greeting === "hello world" && rv.issues.length === 0);
+}
+
+function run() {
+  testCleanHeaderParses();
+  testEmptyHeader();
+  testDuplicateNameCookieTossing();
+  testProtoKeyDoesNotPollute();
+  testControlByteInjection();
+  testNonStringInput();
+  testHeaderCap();
+  testNameAndValueCap();
+  testMalformedAndEmptyName();
+  testUrlDecodeAndQuoteStrip();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  Promise.resolve().then(run).then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cose.test.js

@@ -14,6 +14,8 @@ var check = helpers.check;
 var nodeCrypto = require("node:crypto");
 
 var EC = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+var EC384 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "secp384r1" });
+var EC521 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "secp521r1" });
 var ED = nodeCrypto.generateKeyPairSync("ed25519");
 var ML = nodeCrypto.generateKeyPairSync("ml-dsa-87");
 
@@ -247,6 +249,24 @@ async function testImportKey() {
   var secpBad = null;
   try { b.cose.importKey(new Map([[1, 2], [-1, 8], [-2, Buffer.from(k1jwk.x, "base64url")], [-3, Buffer.from(k1jwk.y, "base64url")]])); } catch (e) { secpBad = e; }
   check("importKey: secp256k1 refused (no ES256K binding)", secpBad && secpBad.code === "cose/unsupported-key");
+
+  // A plain object (integer-string keys) is coerced to a COSE_Key map and
+  // imports the same key — the non-Map input path.
+  var objKey = { 1: 2, "-1": 1, "-2": Buffer.from(jwk.x, "base64url"), "-3": Buffer.from(jwk.y, "base64url") };
+  check("importKey: plain-object COSE_Key coerced + imported", b.cose.importKey(objKey).asymmetricKeyType === "ec");
+
+  // A non-object / non-map (number, array) is refused rather than coerced.
+  var notObj = null;
+  try { b.cose.importKey(42); } catch (e) { notObj = e; }
+  check("importKey: non-object COSE_Key refused", notObj && notObj.code === "cose/bad-cose-key");
+  var arrKey = null;
+  try { b.cose.importKey([1, 2, 3]); } catch (e) { arrKey = e; }
+  check("importKey: array COSE_Key refused", arrKey && arrKey.code === "cose/bad-cose-key");
+
+  // OKP with a non-Ed25519 curve id is refused.
+  var okpBad = null;
+  try { b.cose.importKey(new Map([[1, 1], [-1, 99], [-2, Buffer.alloc(32)]])); } catch (e) { okpBad = e; }
+  check("importKey: OKP non-Ed25519 curve refused", okpBad && okpBad.code === "cose/unsupported-key");
 }
 
 async function testExportKey() {
@@ -288,21 +308,408 @@ async function testExportKey() {
   var badAlg = null;
   try { b.cose.exportKey(EC.publicKey, { alg: "NOPE" }); } catch (e) { badAlg = e; }
   check("exportKey: unknown alg refused", badAlg && badAlg.code === "cose/unknown-alg");
+
+  // An OKP key on a non-Ed25519 curve (X25519) has no COSE alg here and
+  // is refused rather than emitting a COSE_Key no verifier would accept.
+  var x = nodeCrypto.generateKeyPairSync("x25519");
+  var xBad = null;
+  try { b.cose.exportKey(x.publicKey); } catch (e) { xBad = e; }
+  check("exportKey: X25519 (OKP non-Ed25519) refused", xBad && xBad.code === "cose/unsupported-key");
+
+  // A non-EC / non-OKP key type (RSA) is refused.
+  var rsa = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var rsaBad = null;
+  try { b.cose.exportKey(rsa.publicKey); } catch (e) { rsaBad = e; }
+  check("exportKey: RSA key type refused", rsaBad && rsaBad.code === "cose/unsupported-key");
+
+  // kid supplied as a Buffer is stored verbatim as COSE_Key label 2.
+  var kidBuf = Buffer.from([0x01, 0x02, 0x03]);
+  var withKidBuf = b.cbor.decode(b.cose.exportKey(EC.publicKey, { kid: kidBuf }));
+  check("exportKey: Buffer kid stored as label 2", Buffer.isBuffer(withKidBuf.get(2)) && withKidBuf.get(2).equals(kidBuf));
+
+  // kid that is neither a Buffer nor a string is refused.
+  var badKid = null;
+  try { b.cose.exportKey(EC.publicKey, { kid: 123 }); } catch (e) { badKid = e; }
+  check("exportKey: non-Buffer/string kid refused", badKid && badKid.code === "cose/bad-kid");
+}
+
+async function testAlgKeyTypeConfusion() {
+  // Null-digest alg/key-type confusion: EdDSA and ML-DSA-87 both sign
+  // with a null digest, so node:crypto dispatches verify() on the KEY
+  // type and ignores the declared COSE alg. Without a key-type binding an
+  // EdDSA signature is accepted under an ML-DSA-87-only ("PQC-only")
+  // allowlist, and an ML-DSA-87 signature under an EdDSA-only allowlist —
+  // a full alg-allowlist bypass (the allowlist is the security control).
+  // The forged bytes are built by hand because b.cose.sign now refuses to
+  // emit a mislabeled token.
+  function forge(algId, signKey, payloadStr) {
+    var protectedBstr = b.cbor.encode(new Map([[1, algId]]));
+    var payload = Buffer.from(payloadStr, "utf8");
+    var ss = b.cbor.encode(["Signature1", protectedBstr, Buffer.alloc(0), payload]);
+    var sig = nodeCrypto.sign(null, ss, signKey);
+    return b.cbor.encode(new b.cbor.Tag(18, [protectedBstr, new Map(), payload, sig]));
+  }
+  // EdDSA signature, DECLARED ML-DSA-87 (-50), verified against an
+  // Ed25519 key under a PQC-only allowlist.
+  var e1 = null;
+  try { await b.cose.verify(forge(-50, ED.privateKey, "forged"), { algorithms: ["ML-DSA-87"], publicKey: ED.publicKey }); } catch (e) { e1 = e; }
+  check("verify: EdDSA sig rejected under ML-DSA-87-only allowlist (alg/key confusion)", e1 && e1.code === "cose/alg-key-mismatch");
+
+  // ML-DSA-87 signature, DECLARED EdDSA (-8), verified against an ML-DSA
+  // key under an EdDSA-only allowlist.
+  var e2 = null;
+  try { await b.cose.verify(forge(-8, ML.privateKey, "forged2"), { algorithms: ["EdDSA"], publicKey: ML.publicKey }); } catch (e) { e2 = e; }
+  check("verify: ML-DSA-87 sig rejected under EdDSA-only allowlist (alg/key confusion)", e2 && e2.code === "cose/alg-key-mismatch");
+
+  // Sign side: naming one alg but supplying the other key type must be
+  // refused, never emit a mislabeled token.
+  var e3 = null;
+  try { await b.cose.sign(Buffer.from("x"), { alg: "EdDSA", privateKey: ML.privateKey }); } catch (e) { e3 = e; }
+  check("sign: EdDSA alg with an ML-DSA key refused (no mislabeled token)", e3 && e3.code === "cose/alg-key-mismatch");
+  var e4 = null;
+  try { await b.cose.sign(Buffer.from("x"), { alg: "ML-DSA-87", privateKey: ED.privateKey }); } catch (e) { e4 = e; }
+  check("sign: ML-DSA-87 alg with an Ed25519 key refused", e4 && e4.code === "cose/alg-key-mismatch");
+
+  // Regression: the legitimate pairings still verify.
+  var okEd = await b.cose.sign(Buffer.from("ed-ok"), { alg: "EdDSA", privateKey: ED.privateKey });
+  check("EdDSA legit pairing still verifies", (await b.cose.verify(okEd, { algorithms: ["EdDSA"], publicKey: ED.publicKey })).payload.toString() === "ed-ok");
+  var okMl = await b.cose.sign(Buffer.from("ml-ok"), { alg: "ML-DSA-87", privateKey: ML.privateKey });
+  check("ML-DSA-87 legit pairing still verifies", (await b.cose.verify(okMl, { algorithms: ["ML-DSA-87"], publicKey: ML.publicKey })).payload.toString() === "ml-ok");
+}
+
+async function testEcAlgCurveVerify() {
+  // A COSE_Sign1 DECLARING ES512 (-36) but carrying a P-256 key: node
+  // verifies a sha512 signature against the P-256 key as self-consistent,
+  // so the alg->curve binding must refuse it even when ES512 is
+  // allowlisted (RFC 9053 §2 alg/curve confusion).
+  var protectedBstr = b.cbor.encode(new Map([[1, -36]]));
+  var payload = Buffer.from("es512-over-p256");
+  var ss = b.cbor.encode(["Signature1", protectedBstr, Buffer.alloc(0), payload]);
+  var sig = nodeCrypto.sign("sha512", ss, { key: EC.privateKey, dsaEncoding: "ieee-p1363" });
+  var forged = b.cbor.encode(new b.cbor.Tag(18, [protectedBstr, new Map(), payload, sig]));
+  var refused = null;
+  try { await b.cose.verify(forged, { algorithms: ["ES512"], publicKey: EC.publicKey }); } catch (e) { refused = e; }
+  check("verify: ES512 declared over a P-256 key refused (alg/curve binding)", refused && refused.code === "cose/alg-curve-mismatch");
+}
+
+async function testUnprotectedAlgNotHonored() {
+  // alg (label 1) is integrity-read from the PROTECTED header only. A
+  // token with an empty protected header but a valid-looking alg smuggled
+  // into the UNPROTECTED bucket must NOT be honored — it is refused as an
+  // unknown protected alg, never verified under the smuggled alg (even
+  // though the signature and key would otherwise match).
+  var payload = Buffer.from("no-protected-alg");
+  var ss = b.cbor.encode(["Signature1", Buffer.alloc(0), Buffer.alloc(0), payload]);
+  var sig = nodeCrypto.sign(null, ss, ED.privateKey);
+  var forged = b.cbor.encode(new b.cbor.Tag(18, [Buffer.alloc(0), new Map([[1, -8]]), payload, sig]));
+  var refused = null;
+  try { await b.cose.verify(forged, { algorithms: ["EdDSA"], publicKey: ED.publicKey }); } catch (e) { refused = e; }
+  check("verify: alg in the unprotected bucket is not honored", refused && refused.code === "cose/unknown-alg");
+}
+
+async function testBareUntagged() {
+  // RFC 9052 permits an untagged COSE_Sign1 (a bare 4-element array). The
+  // verifier accepts both the tagged (18) and bare forms.
+  var tagged = await b.cose.sign(Buffer.from("bare"), { alg: "ES256", privateKey: EC.privateKey });
+  var arr = b.cbor.decode(tagged, { allowedTags: [18] }).value;
+  var bare = b.cbor.encode(arr);
+  check("verify: bare form is a raw CBOR array (no 0xd2 tag)", bare[0] !== 0xd2);
+  var out = await b.cose.verify(bare, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("verify: bare (untagged) COSE_Sign1 verifies", out.payload.toString() === "bare");
+}
+
+async function testKeyResolver() {
+  // keyResolver receives the protected + unprotected header maps and
+  // returns the verification key (kid resolution). The resolved key still
+  // goes through the alg/key binding.
+  var s = await b.cose.sign(Buffer.from("resolve-me"), { alg: "ES256", privateKey: EC.privateKey, kid: "kr-1" });
+  var seenKid = null, sawProt = false;
+  var out = await b.cose.verify(s, {
+    algorithms: ["ES256"],
+    keyResolver: function (prot, unprot) {
+      sawProt = (prot instanceof Map) && prot.get(1) === -7;
+      var kid = unprot.get(4);
+      seenKid = Buffer.isBuffer(kid) ? kid.toString("utf8") : null;
+      return EC.publicKey;
+    },
+  });
+  check("keyResolver: resolves the key and verifies", out.payload.toString() === "resolve-me");
+  check("keyResolver: called with protected + unprotected maps (kid read)", sawProt && seenKid === "kr-1");
+
+  // Resolver returning the WRONG key → signature refused (not fail-open).
+  var wrongEc = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var bad = null;
+  try { await b.cose.verify(s, { algorithms: ["ES256"], keyResolver: function () { return wrongEc.publicKey; } }); } catch (e) { bad = e; }
+  check("keyResolver: wrong resolved key refused", bad && bad.code === "cose/bad-signature");
+
+  // Resolver returning a wrong-curve key for the declared ES256 → refused
+  // by the alg/curve binding, not verified.
+  var p384 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "secp384r1" });
+  var mismatch = null;
+  try { await b.cose.verify(s, { algorithms: ["ES256"], keyResolver: function () { return p384.publicKey; } }); } catch (e) { mismatch = e; }
+  check("keyResolver: wrong-curve resolved key refused (alg/curve binding)", mismatch && mismatch.code === "cose/alg-curve-mismatch");
+}
+
+async function testMalformedVerifyBranches() {
+  var protBstr = b.cbor.encode(new Map([[1, -7]]));
+  var sig = Buffer.from([0, 0]);
+  var payload = Buffer.from("p");
+  async function code(bytes) {
+    try { await b.cose.verify(bytes, { algorithms: ["ES256"], publicKey: EC.publicKey }); return null; }
+    catch (e) { return e.code; }
+  }
+  check("verify: wrong array length refused",
+    (await code(b.cbor.encode(new b.cbor.Tag(18, [protBstr, new Map(), payload])))) === "cose/malformed");
+  check("verify: non-bstr protected header refused",
+    (await code(b.cbor.encode(new b.cbor.Tag(18, [new Map(), new Map(), payload, sig])))) === "cose/malformed");
+  check("verify: non-bstr signature refused",
+    (await code(b.cbor.encode(new b.cbor.Tag(18, [protBstr, new Map(), payload, "not-bytes"])))) === "cose/malformed");
+  check("verify: protected header that is not a CBOR map refused",
+    (await code(b.cbor.encode(new b.cbor.Tag(18, [b.cbor.encode([1, 2, 3]), new Map(), payload, sig])))) === "cose/malformed");
+  check("verify: crit (label 2) not an array refused",
+    (await code(b.cbor.encode(new b.cbor.Tag(18, [b.cbor.encode(new Map([[1, -7], [2, 99]])), new Map(), payload, sig])))) === "cose/bad-crit");
+  // crit names an understood label (3 = content-type) that is ABSENT from
+  // the protected header — a crit that references nothing must be refused.
+  check("verify: crit lists an absent (understood) label refused",
+    (await code(b.cbor.encode(new b.cbor.Tag(18, [b.cbor.encode(new Map([[1, -7], [2, [3]]])), new Map(), payload, sig])))) === "cose/crit-absent");
+}
+
+async function testEsAlgVariants() {
+  // ES384 (P-384) and ES512 (P-521) through the real b.cose.sign/verify
+  // consumer path — the sha384 / sha512 digest params and the
+  // secp384r1 / secp521r1 alg→curve bindings, alongside the P-256/ES256
+  // the rest of the suite exercises.
+  var s384 = await b.cose.sign(Buffer.from("es384"), { alg: "ES384", privateKey: EC384.privateKey });
+  var v384 = await b.cose.verify(s384, { algorithms: ["ES384"], publicKey: EC384.publicKey });
+  check("ES384: round-trips over P-384", v384.payload.toString() === "es384" && v384.alg === "ES384" && v384.protectedHeaders.get(1) === -35);
+
+  var s512 = await b.cose.sign(Buffer.from("es512"), { alg: "ES512", privateKey: EC521.privateKey });
+  var v512 = await b.cose.verify(s512, { algorithms: ["ES512"], publicKey: EC521.publicKey });
+  check("ES512: round-trips over P-521", v512.payload.toString() === "es512" && v512.alg === "ES512" && v512.protectedHeaders.get(1) === -36);
+
+  // The alg→curve binding refuses a P-384 key under ES512 even though
+  // both are EC keys (wrong-curve confusion).
+  var s512b = await b.cose.sign(Buffer.from("x"), { alg: "ES512", privateKey: EC521.privateKey });
+  var mism = null;
+  try { await b.cose.verify(s512b, { algorithms: ["ES512"], publicKey: EC384.publicKey }); } catch (e) { mism = e; }
+  check("ES512 declared, P-384 key refused (alg/curve binding)", mism && mism.code === "cose/alg-curve-mismatch");
+}
+
+async function testKeyLoadFailures() {
+  // A well-formed COSE_Sign1 verified with a publicKey that is not a
+  // loadable key → the _toKeyObject load failure surfaces as cose/bad-key
+  // (fail-closed), never a raw node error.
+  var s = await b.cose.sign(Buffer.from("x"), { alg: "ES256", privateKey: EC.privateKey });
+  var badPub = null;
+  try { await b.cose.verify(s, { algorithms: ["ES256"], publicKey: Buffer.from("not-a-pem-key") }); } catch (e) { badPub = e; }
+  check("verify: unloadable publicKey refused (cose/bad-key)", badPub && badPub.code === "cose/bad-key");
+
+  // A keyResolver returning null is fail-closed — the null goes through
+  // the same load path and is refused, never treated as a verified key.
+  var nullResolver = null;
+  try { await b.cose.verify(s, { algorithms: ["ES256"], keyResolver: function () { return null; } }); } catch (e) { nullResolver = e; }
+  check("verify: keyResolver returning null refused (cose/bad-key)", nullResolver && nullResolver.code === "cose/bad-key");
+
+  // Sign with an unloadable private key → cose/bad-key.
+  var badPriv = null;
+  try { await b.cose.sign(Buffer.from("x"), { alg: "ES256", privateKey: Buffer.from("garbage") }); } catch (e) { badPriv = e; }
+  check("sign: unloadable privateKey refused (cose/bad-key)", badPriv && badPriv.code === "cose/bad-key");
+
+  // A valid ES256 token verified against an Ed25519 key: the alg→curve
+  // binding message path where the key is not EC (got=null, key type
+  // reported as ed25519), not verified.
+  var edMismatch = null;
+  try { await b.cose.verify(s, { algorithms: ["ES256"], publicKey: ED.publicKey }); } catch (e) { edMismatch = e; }
+  check("verify: ES256 token with an Ed25519 key refused (alg/curve binding)",
+    edMismatch && edMismatch.code === "cose/alg-curve-mismatch" && /ed25519/.test(edMismatch.message));
+
+  // A non-byte payload to sign is refused by the byte coercer.
+  var badBytes = null;
+  try { await b.cose.sign(12345, { alg: "ES256", privateKey: EC.privateKey }); } catch (e) { badBytes = e; }
+  check("sign: non-byte payload refused (cose/bad-bytes)", badBytes && badBytes.code === "cose/bad-bytes");
+}
+
+async function testSignAndVerifyHeaderBranches() {
+  // Extra unprotected headers on sign ride through and surface on verify.
+  var s = await b.cose.sign(Buffer.from("hdr"), {
+    alg: "ES256", privateKey: EC.privateKey, unprotectedHeaders: { 4: Buffer.from("kid-uh") },
+  });
+  var v = await b.cose.verify(s, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("sign: extra unprotectedHeaders surface on verify", v.unprotectedHeaders.get(4).toString() === "kid-uh");
+
+  // An algorithms allowlist naming an unknown alg name is refused at the
+  // allowlist-validation loop (before any decode).
+  var unknownAlg = null;
+  try { await b.cose.verify(s, { algorithms: ["NOPE"], publicKey: EC.publicKey }); } catch (e) { unknownAlg = e; }
+  check("verify: unknown alg name in allowlist refused", unknownAlg && unknownAlg.code === "cose/unknown-alg");
+}
+
+function testEncrypt0Branches() {
+  var key = b.crypto.generateBytes(32);
+
+  // Unknown AEAD alg name refused.
+  var unknown = null;
+  try { b.cose.encrypt0(Buffer.from("x"), { alg: "BOGUS", key: key }); } catch (e) { unknown = e; }
+  check("encrypt0: unknown alg refused", unknown && unknown.code === "cose/unknown-alg");
+
+  // An explicit (correct-length) IV is honored and round-trips.
+  var iv = b.crypto.generateBytes(12);
+  var encIv = b.cose.encrypt0(Buffer.from("with-iv"), { key: key, iv: iv });
+  var dIv = b.cose.decrypt0(encIv, { key: key, algorithms: ["ChaCha20-Poly1305"] });
+  check("encrypt0: explicit IV round-trips + is stored in unprotected label 5",
+    dIv.plaintext.toString() === "with-iv" && dIv.unprotectedHeaders.get(5).equals(iv));
+
+  // A wrong-length explicit IV is refused.
+  var badIv = null;
+  try { b.cose.encrypt0(Buffer.from("x"), { key: key, iv: Buffer.alloc(8) }); } catch (e) { badIv = e; }
+  check("encrypt0: wrong-length IV refused", badIv && badIv.code === "cose/bad-iv");
+
+  // A128GCM (16-byte key) full round-trip — the third AEAD alg's params.
+  var k16 = b.crypto.generateBytes(16);
+  var encA = b.cose.encrypt0(Buffer.from("aes128"), { alg: "A128GCM", key: k16 });
+  check("encrypt0: A128GCM round-trip (16-byte key)",
+    b.cose.decrypt0(encA, { key: k16, algorithms: ["A128GCM"] }).plaintext.toString() === "aes128");
+}
+
+function testDecrypt0Malformed() {
+  var key = b.crypto.generateBytes(32);
+  function code(bytes, o) {
+    try { b.cose.decrypt0(bytes, o || { key: key, algorithms: ["ChaCha20-Poly1305"] }); return null; }
+    catch (e) { return e.code; }
+  }
+  var protBstr = b.cbor.encode(new Map([[1, 24]]));
+  var iv12 = new Map([[5, Buffer.alloc(12)]]);
+
+  // Bare (untagged) COSE_Encrypt0 array verifies like the tagged form.
+  var enc = b.cose.encrypt0(Buffer.from("bare-enc"), { key: key });
+  var bare = b.cbor.encode(b.cbor.decode(enc, { allowedTags: [16] }).value);
+  check("decrypt0: bare (untagged) COSE_Encrypt0 decrypts",
+    b.cose.decrypt0(bare, { key: key, algorithms: ["ChaCha20-Poly1305"] }).plaintext.toString() === "bare-enc");
+
+  check("decrypt0: wrong array length refused",
+    code(b.cbor.encode(new b.cbor.Tag(16, [protBstr, new Map()]))) === "cose/malformed");
+  check("decrypt0: non-bstr protected header refused",
+    code(b.cbor.encode(new b.cbor.Tag(16, [new Map(), iv12, Buffer.alloc(20)]))) === "cose/malformed");
+  check("decrypt0: non-bstr ciphertext refused",
+    code(b.cbor.encode(new b.cbor.Tag(16, [protBstr, iv12, "not-bytes"]))) === "cose/malformed");
+  check("decrypt0: non-map unprotected header refused",
+    code(b.cbor.encode(new b.cbor.Tag(16, [protBstr, ["array-not-map"], Buffer.alloc(20)]))) === "cose/malformed");
+  check("decrypt0: protected header that is not a CBOR map refused",
+    code(b.cbor.encode(new b.cbor.Tag(16, [b.cbor.encode([1, 2, 3]), iv12, Buffer.alloc(20)]))) === "cose/malformed");
+  // Empty protected header → no alg → unrecognized AEAD id.
+  check("decrypt0: empty protected header (no alg) refused as unknown-alg",
+    code(b.cbor.encode(new b.cbor.Tag(16, [Buffer.alloc(0), iv12, Buffer.alloc(20)]))) === "cose/unknown-alg");
+  check("decrypt0: unrecognized AEAD alg id refused",
+    code(b.cbor.encode(new b.cbor.Tag(16, [b.cbor.encode(new Map([[1, 99]])), iv12, Buffer.alloc(20)]))) === "cose/unknown-alg");
+  // Wrong key length for the declared alg (16-byte key for ChaCha's 32).
+  check("decrypt0: wrong key length for declared alg refused",
+    code(enc, { key: b.crypto.generateBytes(16), algorithms: ["ChaCha20-Poly1305"] }) === "cose/bad-key");
+  // Missing IV in the unprotected header.
+  check("decrypt0: missing IV refused",
+    code(b.cbor.encode(new b.cbor.Tag(16, [protBstr, new Map(), Buffer.alloc(20)]))) === "cose/bad-iv");
+  // Ciphertext shorter than the AEAD tag (valid key + IV, short ct).
+  check("decrypt0: ciphertext shorter than the AEAD tag refused",
+    code(b.cbor.encode(new b.cbor.Tag(16, [protBstr, iv12, Buffer.alloc(10)]))) === "cose/malformed");
+
+  // Cross-algorithm AEAD confusion: a real ChaCha20-Poly1305 token whose
+  // protected header is rewritten to A256GCM (both 32-byte-key / 12-byte-IV)
+  // must NOT decrypt — the protected header is bound as AEAD associated
+  // data via the Enc_structure, so the tag fails.
+  var real = b.cose.encrypt0(Buffer.from("secret"), { alg: "ChaCha20-Poly1305", key: key });
+  var rarr = b.cbor.decode(real, { allowedTags: [16] }).value;
+  var forged = b.cbor.encode(new b.cbor.Tag(16, [b.cbor.encode(new Map([[1, 3]])), rarr[1], rarr[2]]));
+  check("decrypt0: cross-alg header rewrite (ChaCha→A256GCM) refused (AAD binds alg)",
+    code(forged, { key: key, algorithms: ["A256GCM"] }) === "cose/decrypt-failed");
+}
+
+function testMac0Branches() {
+  var key = nodeCrypto.randomBytes(32);
+  var protBstr = b.cbor.encode(new Map([[1, 5]]));
+  var payload = Buffer.from("p");
+  var tag32 = Buffer.alloc(32);
+  function code(bytes, o) {
+    try { b.cose.macVerify0(bytes, o || { algorithms: ["HMAC-256/256"], key: key }); return null; }
+    catch (e) { return e.code; }
+  }
+
+  // Unknown MAC alg name on mac0 refused.
+  var unk = null;
+  try { b.cose.mac0(payload, { alg: "BOGUS", key: key }); } catch (e) { unk = e; }
+  check("mac0: unknown alg refused", unk && unk.code === "cose/unsignable-alg");
+
+  // Extra unprotected headers surface on macVerify0.
+  var mu = b.cose.mac0(payload, { alg: "HMAC-256/256", key: key, unprotectedHeaders: { 4: Buffer.from("kid-m") } });
+  check("mac0: extra unprotectedHeaders surface on verify",
+    b.cose.macVerify0(mu, { algorithms: ["HMAC-256/256"], key: key }).unprotectedHeaders.get(4).toString() === "kid-m");
+
+  // Bare (untagged) COSE_Mac0 verifies like the tagged form.
+  var m = b.cose.mac0(payload, { alg: "HMAC-256/256", key: key });
+  var bare = b.cbor.encode(b.cbor.decode(m, { allowedTags: [17] }).value);
+  check("macVerify0: bare (untagged) COSE_Mac0 verifies",
+    b.cose.macVerify0(bare, { algorithms: ["HMAC-256/256"], key: key }).payload.equals(payload));
+
+  // opts.algorithms required + unknown alg name + missing key.
+  check("macVerify0: missing algorithms refused", code(m, { key: key }) === "cose/algorithms-required");
+  check("macVerify0: unknown alg name in allowlist refused", code(m, { algorithms: ["NOPE"], key: key }) === "cose/unknown-alg");
+  check("macVerify0: missing key refused", code(m, { algorithms: ["HMAC-256/256"] }) === "cose/no-key");
+
+  // Structural malformations.
+  check("macVerify0: wrong array length refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [protBstr, new Map(), payload]))) === "cose/malformed");
+  check("macVerify0: non-bstr protected header refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [new Map(), new Map(), payload, tag32]))) === "cose/malformed");
+  check("macVerify0: non-bstr tag refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [protBstr, new Map(), payload, "not-bytes"]))) === "cose/malformed");
+  check("macVerify0: non-map unprotected header refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [protBstr, ["array"], payload, tag32]))) === "cose/malformed");
+  check("macVerify0: externalPayload on an attached token refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [protBstr, new Map(), payload, tag32])),
+      { algorithms: ["HMAC-256/256"], key: key, externalPayload: payload }) === "cose/payload-ambiguous");
+  check("macVerify0: non-byte payload refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [protBstr, new Map(), "text", tag32]))) === "cose/malformed");
+  check("macVerify0: empty protected header (no alg) refused as unknown-alg",
+    code(b.cbor.encode(new b.cbor.Tag(17, [Buffer.alloc(0), new Map(), payload, tag32]))) === "cose/unknown-alg");
+  check("macVerify0: protected header that is not a CBOR map refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [b.cbor.encode([1, 2, 3]), new Map(), payload, tag32]))) === "cose/malformed");
+  check("macVerify0: crit (label 2) not an array refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [b.cbor.encode(new Map([[1, 5], [2, 99]])), new Map(), payload, tag32]))) === "cose/bad-crit");
+  check("macVerify0: crit lists an absent (understood) label refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [b.cbor.encode(new Map([[1, 5], [2, [3]]])), new Map(), payload, tag32]))) === "cose/crit-absent");
+  check("macVerify0: unrecognized MAC alg id refused",
+    code(b.cbor.encode(new b.cbor.Tag(17, [b.cbor.encode(new Map([[1, 99]])), new Map(), payload, tag32]))) === "cose/unknown-alg");
+
+  // A truncated tag (length mismatch) is refused as cose/bad-tag, never a
+  // raw length-mismatch throw from the constant-time compare.
+  var marr = b.cbor.decode(m, { allowedTags: [17] }).value;
+  var truncated = b.cbor.encode(new b.cbor.Tag(17, [marr[0], marr[1], marr[2], Buffer.alloc(5)]));
+  check("macVerify0: truncated tag refused (cose/bad-tag)", code(truncated) === "cose/bad-tag");
 }
 
 async function run() {
   testSurface();
   testEncrypt0();
   await testClassicalUseableToday();
+  await testEsAlgVariants();
   await testProtectedHeaders();
   await testPqcForward();
   await testTamperAndAllowlist();
   await testCritBypassDefense();
+  await testAlgKeyTypeConfusion();
+  await testEcAlgCurveVerify();
+  await testUnprotectedAlgNotHonored();
+  await testBareUntagged();
+  await testKeyResolver();
+  await testKeyLoadFailures();
+  await testSignAndVerifyHeaderBranches();
+  await testMalformedVerifyBranches();
   await testValidation();
   await testDetachedPayload();
   await testImportKey();
   await testExportKey();
+  testEncrypt0Branches();
+  testDecrypt0Malformed();
   testMac0();
+  testMac0Branches();
 }
 
 function testMac0() {