@certrev/cert-block 0.3.0 → 0.5.1

package/src/modal/verify-client.test.ts

@@ -0,0 +1,164 @@
+/**
+ * End-to-end test of the Web Component's Delivery-API verifier with REAL crypto: mint a signed
+ * artifact (local Ed25519), stub `fetch` to serve it, and assert createDeliveryVerifier runs the
+ * canonical `verifyArtifact` kernel correctly — render on a good envelope, suppress on a subject
+ * mismatch, `suppress:'revoked'` on the SLIM `CertTombstone` (POR-10684 / POR-10481), throw on a
+ * 404 (→ the DOM layer keeps the SSR badge). Proves the fetch + URL + verify wiring the
+ * unit-mocked revalidate.test.ts stubs out.
+ */
+
+import { generateKeyPairSync } from "node:crypto";
+import type {
+	CertSubject,
+	ResolvePublicKeyByKid,
+} from "@certrev/cert-contract";
+import {
+	localEd25519Signer,
+	signTombstone,
+} from "@certrev/cert-contract/signer";
+import { describe, expect, it, vi } from "vitest";
+// Relocated from portal (POR-10721 W2): mint a valid signed envelope with the package's
+// own fixture (cert-contract-native) instead of portal's `mintCertEnvelope` — the modal
+// package must not depend on portal for its tests.
+import { makeSignedEnvelope } from "../contract/fixtures.js";
+import { createDeliveryVerifier } from "./verify-client.js";
+
+const KID = "test-issuer";
+const ARTICLE_GID = "gid://shopify/Article/12345";
+
+function signerFor() {
+	const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+	const pem = publicKey.export({ type: "spki", format: "pem" }) as string;
+	const resolveKid: ResolvePublicKeyByKid = (k) =>
+		k === KID ? { format: "pem", pem } : null;
+	return { resolveKid, sign: localEd25519Signer(privateKey) };
+}
+
+function subjectFor(externalId = ARTICLE_GID): CertSubject {
+	return {
+		platform: "shopify",
+		externalId,
+		logicalArticleId: "art_wc_test",
+		canonicalUrls: ["https://brand.example.com/blogs/news/post"],
+		installationId: null,
+		contentDigest: "a".repeat(64),
+	};
+}
+
+function stubFetch(envelopeJson: unknown, ok = true, status = 200) {
+	return vi.fn(
+		async () =>
+			({ ok, status, json: async () => envelopeJson }) as unknown as Response,
+	);
+}
+
+describe("createDeliveryVerifier", () => {
+	it("fetches the Delivery API URL and returns `render` for a valid served envelope", async () => {
+		// Envelope bound to ARTICLE_GID — the article we ask to verify → render.
+		const { envelope, resolveKid } = makeSignedEnvelope({
+			subject: subjectFor(),
+		});
+		const fetchImpl = stubFetch(envelope);
+		const verify = createDeliveryVerifier(
+			resolveKid,
+			fetchImpl as unknown as typeof fetch,
+		);
+
+		const verdict = await verify({
+			baseUrl: "https://portal.certrev.com/",
+			platform: "shopify",
+			externalId: ARTICLE_GID,
+		});
+
+		expect(verdict.decision).toBe("render");
+		expect(fetchImpl).toHaveBeenCalledWith(
+			`https://portal.certrev.com/api/cert/v1/delivery/shopify/${encodeURIComponent(ARTICLE_GID)}`,
+			expect.objectContaining({ headers: { accept: "application/json" } }),
+		);
+	});
+
+	it("returns a `suppress` verdict when the served envelope is bound to a different article", async () => {
+		// Envelope minted for a DIFFERENT article than the one we ask to verify.
+		const { envelope, resolveKid } = makeSignedEnvelope({
+			subject: subjectFor("gid://shopify/Article/99999"),
+		});
+		const verify = createDeliveryVerifier(
+			resolveKid,
+			stubFetch(envelope) as unknown as typeof fetch,
+		);
+
+		const verdict = await verify({
+			baseUrl: "https://portal.certrev.com",
+			platform: "shopify",
+			externalId: ARTICLE_GID,
+		});
+
+		expect(verdict.decision).toBe("suppress");
+	});
+
+	it('resolves the SLIM tombstone the control plane serves to `suppress:"revoked"` (POR-10684)', async () => {
+		const { resolveKid, sign } = signerFor();
+		// The revoked-placement Delivery response: a slim `CertTombstone` (kind: 'tombstone', NO
+		// payload) — what verifyEnvelope used to mis-suppress as 'unsupported_contract_version'.
+		const artifact = await signTombstone(
+			{
+				subject: subjectFor(),
+				revokedAt: "2026-06-20T00:00:00.000Z",
+				revocationReason: "cert_revoked",
+			},
+			{ kid: KID, sign },
+		);
+		const verify = createDeliveryVerifier(
+			resolveKid,
+			stubFetch(artifact) as unknown as typeof fetch,
+		);
+
+		const verdict = await verify({
+			baseUrl: "https://portal.certrev.com",
+			platform: "shopify",
+			externalId: ARTICLE_GID,
+		});
+
+		expect(verdict.decision).toBe("suppress");
+		expect(verdict.decision === "suppress" && verdict.reason).toBe("revoked");
+	});
+
+	it("suppresses a tombstone minted for a DIFFERENT article (subject binding enforced)", async () => {
+		const { resolveKid, sign } = signerFor();
+		const artifact = await signTombstone(
+			{
+				subject: subjectFor("gid://shopify/Article/99999"),
+				revokedAt: "2026-06-20T00:00:00.000Z",
+				revocationReason: "cert_revoked",
+			},
+			{ kid: KID, sign },
+		);
+		const verify = createDeliveryVerifier(
+			resolveKid,
+			stubFetch(artifact) as unknown as typeof fetch,
+		);
+
+		const verdict = await verify({
+			baseUrl: "https://portal.certrev.com",
+			platform: "shopify",
+			externalId: ARTICLE_GID,
+		});
+
+		expect(verdict.decision).toBe("suppress");
+	});
+
+	it("throws on a non-2xx Delivery API response (404 → caller keeps the SSR badge)", async () => {
+		const { resolveKid } = signerFor();
+		const verify = createDeliveryVerifier(
+			resolveKid,
+			stubFetch(null, false, 404) as unknown as typeof fetch,
+		);
+		await expect(
+			verify({
+				baseUrl: "https://portal.certrev.com",
+				platform: "shopify",
+				externalId: ARTICLE_GID,
+			}),
+		).rejects.toThrow();
+	});
+});

package/src/modal/verify-client.ts

@@ -0,0 +1,42 @@
+/**
+ * The browser-side Delivery-API fetch + verify the Shopify Web Component uses. Thin glue around
+ * the CANONICAL kernel: it GETs the public, CDN-cacheable Delivery API
+ * (`{baseUrl}/api/cert/v1/delivery/{platform}/{externalId}`) and runs `verifyArtifact` from
+ * `@certrev/cert-contract` (WebCrypto Ed25519 over RFC-8785 JCS — the same kernel the server +
+ * every other edge run). No crypto is reimplemented here.
+ *
+ * `verifyArtifact` (POR-10684, cert-contract 0.3.0) dispatches on the `kind: 'tombstone'`
+ * discriminator: a full `CertDeliveryEnvelope` runs the whole crypto + lifecycle pipeline, while
+ * the SLIM `CertTombstone` the control plane now serves for a revoked placement (POR-10481) —
+ * which carries NO payload — verifies its own signature + subject and resolves to
+ * `suppress:'revoked'`. The old `verifyEnvelope` fails a tombstone's shape-check and returns
+ * `suppress:'unsupported_contract_version'` (still a blank badge, but the wrong suppressed-reason
+ * telemetry), so the suppression path routes through `verifyArtifact`.
+ *
+ * Drift is core-compensated (the browser can't recompute the canonical body hash), so
+ * `liveContentHash` is null → the kernel verifies signature + subject + lifecycle and skips
+ * drift. A non-2xx response (the API 404s on an untracked placement) THROWS, so the caller keeps
+ * the lifecycle-gated SSR badge rather than false-hiding it.
+ */
+
+import { type CertDeliveryArtifact, type ResolvePublicKeyByKid, verifyArtifact } from '@certrev/cert-contract'
+import type { BadgeSource, VerifyBadgeFn } from './revalidate.js'
+
+export function createDeliveryVerifier(
+	resolveKid: ResolvePublicKeyByKid,
+	fetchImpl: typeof fetch = fetch,
+): VerifyBadgeFn {
+	return async (source: BadgeSource) => {
+		const base = source.baseUrl.replace(/\/+$/, '')
+		const url = `${base}/api/cert/v1/delivery/${encodeURIComponent(source.platform)}/${encodeURIComponent(source.externalId)}`
+		const res = await fetchImpl(url, { headers: { accept: 'application/json' } })
+		if (!res.ok) throw new Error(`cert delivery ${res.status}`)
+		const artifact = (await res.json()) as CertDeliveryArtifact
+		return verifyArtifact(artifact, resolveKid, {
+			platform: source.platform,
+			externalId: source.externalId,
+			liveContentHash: null,
+			now: new Date(),
+		})
+	}
+}