@crawlcheck/sdk 1.0.1 → 1.0.3

package/test/sdk.test.js

@@ -1,6 +1,6 @@
 // Runs against the live API. npm test
 import test from "node:test"; import assert from "node:assert/strict";
-import { CrawlCheck, verifyBundle, verifyReceipt, CrawlCheckError } from "../dist/index.js";
+import { CrawlCheck, verifyBundle, verifyReceipt, CrawlCheckError, verifyDocument } from "../dist/index.js";
 const c = new CrawlCheck();
 
 test("conformance: every published fixture gives its expected output through this package's verifier", async () => {
@@ -43,3 +43,28 @@ test("a tampered live bundle fails offline", async () => {
 test("locked data surfaces as a typed error, not a crash", async () => {
   await assert.rejects(c.impact({ domain: "wikipedia.org" }), (e) => e instanceof CrawlCheckError && e.locked === true && e.status === 403);
 });
+
+test("live preflight: the decision receipt verifies offline, its key is published, a changed decision fails, guard agrees", async () => {
+  const rc = await c.preflight("example.com", "read");
+  assert.equal(rc.kind, "crawlcheck-decision");
+  assert.ok(["allow", "warn", "require_confirmation", "block", "unsupported"].includes(rc.decision));
+  const v = await c.verifyDocument(rc);
+  assert.equal(v.verified, true, JSON.stringify(v.checks));
+  for (const id of ["document_hash", "key_id", "signature", "key_published", "resolve_bound", "decision_known"]) assert.equal(v.checks.find((c) => c.id === id)?.ok, true, id);
+  const forged = JSON.parse(JSON.stringify(rc)); forged.decision = rc.decision === "allow" ? "block" : "allow";
+  const f = await verifyDocument(forged);
+  assert.equal(f.verified, false);
+  assert.equal(f.checks.find((c) => c.id === "document_hash").ok, false);
+  const g = await c.guard("example.com", "read");
+  assert.equal(g.verification.verified, true);
+  assert.equal(g.proceed, g.receipt.decision === "allow");
+  const r = await c.resolve("example.com");
+  const off = await verifyDocument(r);
+  assert.equal(off.verified, true); assert.equal(off.issuer_trusted, null); assert.equal(off.accepted, false, "offline is never accepted");
+  assert.equal((await c.verifyDocument(r)).accepted, true);
+  const ids = await c.publishedKeyIds();
+  const ix = await (await fetch(c.base + "/conformance/index.json")).json();
+  const foreign = await (await fetch(ix.fixtures.find((x) => x.name === "receipt-foreign-key").file)).json();
+  assert.equal((await verifyReceipt(foreign)).verified, true, "self-consistent offline");
+  assert.ok(!ids.includes(foreign.signature.kid), "but not a CrawlCheck key, so never accepted");
+});