@futdevpro/fsm-dynamo 1.16.40 → 1.20.5

package/src/_modules/crypto/_services/artifact-signature.control-service.spec.ts

@@ -13,7 +13,7 @@ interface DyFM_ArtifactSignatureSpecKeyMaterial {
 describe('| DyFM artifact signature', (): void => {
   const signature_CS: DyFM_ArtifactSignature_ControlService =
     new DyFM_ArtifactSignature_ControlService();
-  const subjectBytes: Uint8Array = new TextEncoder().encode(
+  const subjectBytes: Uint8Array<ArrayBuffer> = new TextEncoder().encode(
     '{"contractVersion":"ctm-artifact-canonical/1","bundleSource":"exact"}'
   );
   let keyMaterial: DyFM_ArtifactSignatureSpecKeyMaterial;
@@ -182,7 +182,7 @@ describe('| DyFM artifact signature', (): void => {
   }
 
   /** Calculates lowercase SHA-256 through the same platform boundary as production. */
-  async function checksum(bytes: Uint8Array): Promise<string> {
+  async function checksum(bytes: Uint8Array<ArrayBuffer>): Promise<string> {
     const digest: ArrayBuffer = await globalThis.crypto.subtle.digest('SHA-256', bytes);
 
     return [ ...new Uint8Array(digest) ]

package/src/_modules/crypto/_services/artifact-signature.control-service.ts

@@ -34,14 +34,14 @@ export class DyFM_ArtifactSignature_ControlService {
     this.validateTimestamp(set.signedAt);
 
     const subtle: SubtleCrypto = this.getSubtleCrypto();
-    const subjectBytes: Uint8Array = new Uint8Array(set.subjectBytes);
+    const subjectBytes: Uint8Array<ArrayBuffer> = new Uint8Array(set.subjectBytes);
     const actualChecksum: string = await this.checksum(subjectBytes);
 
     if (actualChecksum !== set.subjectChecksum) {
       throw this.buildError('SUBJECT_CHECKSUM_MISMATCH');
     }
 
-    const privateKeyBytes: Uint8Array = this.decodeBase64UrlStrict(set.privateKeyPkcs8Base64Url);
+    const privateKeyBytes: Uint8Array<ArrayBuffer> = this.decodeBase64UrlStrict(set.privateKeyPkcs8Base64Url);
 
     if (privateKeyBytes.byteLength < 64 || privateKeyBytes.byteLength > 512) {
       throw this.buildError('PRIVATE_KEY_LENGTH_INVALID');
@@ -73,7 +73,7 @@ export class DyFM_ArtifactSignature_ControlService {
       privateKeyBytes.fill(0);
     }
 
-    let signatureBytes: Uint8Array;
+    let signatureBytes: Uint8Array<ArrayBuffer>;
 
     try {
       signatureBytes = new Uint8Array(await subtle.sign(
@@ -128,7 +128,7 @@ export class DyFM_ArtifactSignature_ControlService {
       return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|SUBJECT_INVALID');
     }
 
-    const subjectBytes: Uint8Array = new Uint8Array(set.subjectBytes);
+    const subjectBytes: Uint8Array<ArrayBuffer> = new Uint8Array(set.subjectBytes);
     const actualChecksum: string = await this.checksum(subjectBytes);
 
     if (actualChecksum !== set.evidence.subjectChecksum) {
@@ -136,7 +136,7 @@ export class DyFM_ArtifactSignature_ControlService {
     }
 
     let publicKeyJwk: JsonWebKey;
-    let signatureBytes: Uint8Array;
+    let signatureBytes: Uint8Array<ArrayBuffer>;
 
     try {
       publicKeyJwk = this.validatePublicJwk(set.publicKeyJwk);
@@ -193,7 +193,7 @@ export class DyFM_ArtifactSignature_ControlService {
     return this.checksum(new TextEncoder().encode(canonicalJwk));
   }
 
-  private async checksum(bytes: Uint8Array): Promise<string> {
+  private async checksum(bytes: Uint8Array<ArrayBuffer>): Promise<string> {
     const digest: ArrayBuffer = await this.getSubtleCrypto().digest('SHA-256', bytes);
 
     return [ ...new Uint8Array(digest) ]
@@ -201,7 +201,7 @@ export class DyFM_ArtifactSignature_ControlService {
       .join('');
   }
 
-  private decodeBase64UrlStrict(value: string): Uint8Array {
+  private decodeBase64UrlStrict(value: string): Uint8Array<ArrayBuffer> {
     if (!value || !/^[A-Za-z0-9_-]+$/u.test(value) || value.length % 4 === 1) {
       throw this.buildError('BASE64URL_INVALID');
     }
@@ -230,7 +230,7 @@ export class DyFM_ArtifactSignature_ControlService {
       }
     }
 
-    const decoded: Uint8Array = new Uint8Array(bytes);
+    const decoded: Uint8Array<ArrayBuffer> = new Uint8Array(bytes);
 
     if (this.encodeBase64Url(decoded) !== value) {
       throw this.buildError('BASE64URL_NON_CANONICAL');
@@ -360,8 +360,8 @@ export class DyFM_ArtifactSignature_ControlService {
       throw this.buildError('PUBLIC_KEY_INVALID');
     }
 
-    const xBytes: Uint8Array = this.decodeBase64UrlStrict(value.x);
-    const yBytes: Uint8Array = this.decodeBase64UrlStrict(value.y);
+    const xBytes: Uint8Array<ArrayBuffer> = this.decodeBase64UrlStrict(value.x);
+    const yBytes: Uint8Array<ArrayBuffer> = this.decodeBase64UrlStrict(value.y);
 
     if (xBytes.byteLength !== 32 || yBytes.byteLength !== 32) {
       throw this.buildError('PUBLIC_KEY_COORDINATE_INVALID');

package/src/_modules/deployment/_collections/atomic-rollback-manifest.util.spec.ts

@@ -0,0 +1,221 @@
+import { DyFM_AtomicRollbackManifest_Util } from './atomic-rollback-manifest.util';
+import {
+  DyFM_AtomicRollbackImage_Interface,
+  DyFM_AtomicRollbackLocalValidation_Interface,
+  DyFM_AtomicRollbackManifest_Interface,
+  DyFM_AtomicRollbackPostCheck_Interface
+} from '../_models/atomic-rollback-manifest.interface';
+
+/** Builds one fully valid manifest for contract mutation tests. */
+const dyfm_createManifest: () => DyFM_AtomicRollbackManifest_Interface =
+  (): DyFM_AtomicRollbackManifest_Interface => {
+    const manifest: DyFM_AtomicRollbackManifest_Interface = {
+      contractVersion: 'fdp-atomic-rollback-manifest/1',
+      operationId: `rollback_${'1'.repeat(32)}`,
+      environment: 'test',
+      authority: {
+        principalId: 'fdp-cdp',
+        evidenceId: '2'.repeat(64),
+      },
+      sourceRevision: '3'.repeat(40),
+      configuration: {
+        revision: '4'.repeat(40),
+        sha256: '5'.repeat(64),
+        compatibilityVersion: 'ctm-db/1',
+        policyChecksum: '6'.repeat(64),
+      },
+      images: [
+        {
+          service: 'company-toolmaker-server',
+          version: '0.0.1',
+          immutableReference: 'registry.example/company-toolmaker-server:release-0.0.1',
+          mutableReference: 'registry.example/company-toolmaker-server:release',
+          digest: `sha256:${'7'.repeat(64)}`,
+        },
+        {
+          service: 'company-toolmaker-client',
+          version: '0.0.1',
+          immutableReference: 'registry.example/company-toolmaker-client:release-0.0.1',
+          mutableReference: 'registry.example/company-toolmaker-client:release',
+          digest: `sha256:${'8'.repeat(64)}`,
+        },
+      ],
+      postChecks: [
+        {
+          checkId: 'server-readiness',
+          service: 'company-toolmaker-server',
+          endpoint: 'https://test-company-toolmaker.futdevpro.hu/readiness',
+          expectedProbeContract: 'ctm-service-probe/4',
+        },
+        {
+          checkId: 'client-smoke',
+          service: 'company-toolmaker-client',
+          endpoint: 'https://test-company-toolmaker.futdevpro.hu/',
+          expectedProbeContract: 'ctm-client-smoke/1',
+        },
+      ],
+      targetChecksum: '',
+    };
+
+    manifest.targetChecksum = DyFM_AtomicRollbackManifest_Util.computeTargetChecksum(manifest);
+
+    return manifest;
+  };
+
+describe('| DyFM atomic rollback manifest', (): void => {
+  it('| validates an exact manifest with order-independent service and post-check sets', (): void => {
+    const manifest: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+    const checksum: string = manifest.targetChecksum;
+
+    manifest.images.reverse();
+    manifest.postChecks.reverse();
+
+    expect(DyFM_AtomicRollbackManifest_Util.computeTargetChecksum(manifest)).toBe(checksum);
+    expect(checksum).toBe('2b416434a8d36c5b3305383eb1f2ecebae4057d30d2f46d986d04728225b58df');
+    expect(DyFM_AtomicRollbackManifest_Util.validate(manifest)).toEqual(jasmine.objectContaining({
+      valid: true,
+      environment: 'test',
+      operationId: manifest.operationId,
+      targetChecksum: checksum,
+      serviceCount: 2,
+      postCheckCount: 2,
+      gapCodes: [],
+    }));
+  });
+
+  it('| ignores nested object insertion order when calculating the canonical checksum', (): void => {
+    const manifest: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+    const reordered: DyFM_AtomicRollbackManifest_Interface = {
+      ...manifest,
+      authority: {
+        evidenceId: manifest.authority.evidenceId,
+        principalId: manifest.authority.principalId,
+      },
+      configuration: {
+        policyChecksum: manifest.configuration.policyChecksum,
+        compatibilityVersion: manifest.configuration.compatibilityVersion,
+        sha256: manifest.configuration.sha256,
+        revision: manifest.configuration.revision,
+      },
+      images: manifest.images.map((
+        image: DyFM_AtomicRollbackImage_Interface,
+      ): DyFM_AtomicRollbackImage_Interface => ({
+        digest: image.digest,
+        mutableReference: image.mutableReference,
+        immutableReference: image.immutableReference,
+        version: image.version,
+        service: image.service,
+      })),
+      postChecks: manifest.postChecks.map((
+        check: DyFM_AtomicRollbackPostCheck_Interface,
+      ): DyFM_AtomicRollbackPostCheck_Interface => ({
+        expectedProbeContract: check.expectedProbeContract,
+        endpoint: check.endpoint,
+        service: check.service,
+        checkId: check.checkId,
+      })),
+    };
+
+    expect(DyFM_AtomicRollbackManifest_Util.computeTargetChecksum(reordered)).toBe(manifest.targetChecksum);
+    expect(DyFM_AtomicRollbackManifest_Util.validate(reordered).valid).toBeTrue();
+  });
+
+  it('| rejects missing, duplicated and non-targeted service members', (): void => {
+    const missing: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    missing.images.pop();
+    const duplicated: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    duplicated.images[1] = { ...duplicated.images[0] };
+
+    expect(DyFM_AtomicRollbackManifest_Util.validate(missing).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|POST_CHECK_SERVICE_NOT_TARGETED',
+    );
+    expect(DyFM_AtomicRollbackManifest_Util.validate(duplicated).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|IMAGE_SERVICE_DUPLICATED',
+    );
+  });
+
+  it('| rejects tag, version, digest and repository substitution', (): void => {
+    const mutable: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    mutable.images[0].immutableReference = 'registry.example/company-toolmaker-server:release';
+    const versionMismatch: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    versionMismatch.images[0].version = '0.0.2';
+    const digestInvalid: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    digestInvalid.images[0].digest = 'sha256:not-a-digest';
+    const repositoryMismatch: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    repositoryMismatch.images[0].mutableReference = 'other.example/company-toolmaker-server:release';
+
+    expect(DyFM_AtomicRollbackManifest_Util.validate(mutable).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|IMAGE_IMMUTABLE_REFERENCE_INVALID|company-toolmaker-server',
+    );
+    expect(DyFM_AtomicRollbackManifest_Util.validate(versionMismatch).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|IMAGE_IMMUTABLE_REFERENCE_INVALID|company-toolmaker-server',
+    );
+    expect(DyFM_AtomicRollbackManifest_Util.validate(digestInvalid).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|IMAGE_DIGEST_INVALID|company-toolmaker-server',
+    );
+    expect(DyFM_AtomicRollbackManifest_Util.validate(repositoryMismatch).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|IMAGE_REPOSITORY_MISMATCH|company-toolmaker-server',
+    );
+  });
+
+  it('| rejects configuration, authority and target-checksum substitution', (): void => {
+    const configuration: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    configuration.configuration.sha256 = '9'.repeat(64);
+    const authority: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    authority.authority.evidenceId = 'not-evidence';
+    const checksum: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    checksum.targetChecksum = 'a'.repeat(64);
+
+    expect(DyFM_AtomicRollbackManifest_Util.validate(configuration).gapCodes).toEqual([
+      'FDP|ATOMIC_ROLLBACK|TARGET_CHECKSUM_MISMATCH',
+    ]);
+    expect(DyFM_AtomicRollbackManifest_Util.validate(authority).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|AUTHORITY_EVIDENCE_INVALID',
+    );
+    expect(DyFM_AtomicRollbackManifest_Util.validate(checksum).gapCodes).toEqual([
+      'FDP|ATOMIC_ROLLBACK|TARGET_CHECKSUM_MISMATCH',
+    ]);
+  });
+
+  it('| rejects oversized operational references before they can expand evidence or work', (): void => {
+    const imageReference: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    imageReference.images[0].immutableReference =
+      `registry.example/${'segment/'.repeat(70)}company-toolmaker-server:release-0.0.1`;
+    imageReference.targetChecksum = DyFM_AtomicRollbackManifest_Util.computeTargetChecksum(imageReference);
+    const endpoint: DyFM_AtomicRollbackManifest_Interface = dyfm_createManifest();
+
+    endpoint.postChecks[0].endpoint = `https://${'a'.repeat(2040)}.example/readiness`;
+    endpoint.targetChecksum = DyFM_AtomicRollbackManifest_Util.computeTargetChecksum(endpoint);
+
+    expect(DyFM_AtomicRollbackManifest_Util.validate(imageReference).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|IMAGE_IMMUTABLE_REFERENCE_INVALID|company-toolmaker-server',
+    );
+    expect(DyFM_AtomicRollbackManifest_Util.validate(endpoint).gapCodes).toContain(
+      'FDP|ATOMIC_ROLLBACK|POST_CHECK_ENDPOINT_INVALID|server-readiness',
+    );
+  });
+
+  it('| never reflects unknown content in validation evidence', (): void => {
+    const candidate: Record<string, unknown> = {
+      ...dyfm_createManifest(),
+      workbookName: 'sensitive-customer.xlsx',
+    };
+    const report: DyFM_AtomicRollbackLocalValidation_Interface = DyFM_AtomicRollbackManifest_Util.validate(candidate);
+    const serialized: string = JSON.stringify(report);
+
+    expect(report.gapCodes).toEqual([ 'FDP|ATOMIC_ROLLBACK|MANIFEST_SHAPE_INVALID' ]);
+    expect(serialized).not.toContain('sensitive-customer');
+    expect(serialized).not.toContain('registry.example');
+    expect(serialized).not.toContain('workbookName');
+  });
+});