@futdevpro/nts-dynamo 1.15.142 → 1.15.145

package/src/_collections/signed-url.util.spec.ts

@@ -1,198 +1,198 @@
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_SignedUrl_Util } from './signed-url.util';
-
-/**
- * ALÁÍRT-URL primitív tesztjei (AAA).
- *
- * ⭐ **Az ARANY-VEKTOR az első teszt, és ez a legfontosabb:** a hex értéket a ma ÉLŐ algoritmusból
- * generáltuk *(az `fdp-ftp-service` `FtpUrlSignature_Util` verify- és a `master-prompter`
- * `FtpUrlSigner_Util` sign-oldala — bit-azonosak)*. Ha ez a teszt elpirosodik, az azt jelenti,
- * hogy a bedrock util **elcsúszott** az élő rendszertől, és a **már kiadott URL-ek elromlanának**.
- *
- * ⚠️ `nowMs` **mindenhol injektálva** — a tesztben nincs `Date.now()`, tehát nincs flake.
- */
-describe('| DyNTS_SignedUrl_Util', () => {
-  const SECRET: string = 'golden-vector-secret';
-  const BACKSLASH: string = String.fromCharCode(92);
-
-  // --- ARANY-VEKTOR (az élő algoritmusból generálva) ---
-  const GOLDEN_PATH: string = '/accounts/acc-1/invoices/INV-2026-001.pdf';
-  const GOLDEN_EXP: number = 1767225600000;
-  const GOLDEN_HEX: string = 'a6c2d1ddf0fe4614e3b6130d4e22a9ef085377f73088d3f79aab548e8056c165';
-
-  it('1 | ARANY-VEKTOR — a mai algoritmus hexét adja (bitre)', () => {
-    const signature: string = DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, GOLDEN_EXP, SECRET);
-
-    expect(signature).toBe(GOLDEN_HEX);
-  });
-
-  it('2 | normalizePath — vezető /-ek le, backslash → slash', () => {
-    expect(DyNTS_SignedUrl_Util.normalizePath('///a' + BACKSLASH + 'b/c')).toBe('a/b/c');
-  });
-
-  it('3 | buildCanonicalString — `<path>\\n<exp>`', () => {
-    expect(DyNTS_SignedUrl_Util.buildCanonicalString('a/b', 123)).toBe('a/b\n123');
-  });
-
-  it('4 | sign determinisztikus — kétszeri hívás azonos', () => {
-    const first: string = DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, GOLDEN_EXP, SECRET);
-    const second: string = DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, GOLDEN_EXP, SECRET);
-
-    expect(first).toBe(second);
-  });
-
-  it('5 | verify — érvényes aláírásra { valid: true }', () => {
-    const result = DyNTS_SignedUrl_Util.verify({
-      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
-      secret: SECRET, nowMs: GOLDEN_EXP - 1000,
-    });
-
-    expect(result.valid).toBeTrue();
-    expect(result.reason).toBeUndefined();
-  });
-
-  it('6 | verify — LEJÁRT aláírásra { valid: false, reason: expired }', () => {
-    const result = DyNTS_SignedUrl_Util.verify({
-      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
-      secret: SECRET, nowMs: GOLDEN_EXP + 1,
-    });
-
-    expect(result.valid).toBeFalse();
-    expect(result.reason).toBe('expired');
-  });
-
-  it('7 | verify — HAMIS aláírásra { valid: false, reason: signature-mismatch }', () => {
-    // ugyanolyan HOSSZÚ, de más tartalmú hex — a timing-safe ág fut le, nem a hossz-guard
-    const forged: string = 'b'.repeat(GOLDEN_HEX.length);
-
-    const result = DyNTS_SignedUrl_Util.verify({
-      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: forged,
-      secret: SECRET, nowMs: GOLDEN_EXP - 1000,
-    });
-
-    expect(result.valid).toBeFalse();
-    expect(result.reason).toBe('signature-mismatch');
-  });
-
-  it('8 | verify — ELTÉRŐ HOSSZÚ aláírásra NEM dob (timingSafeEqual guard)', () => {
-    const shortSignature: string = 'abc';
-
-    // Act + Assert: a lényeg, hogy NEM dob — a `timingSafeEqual` eltérő hosszra dobna.
-    expect((): void => {
-      const result = DyNTS_SignedUrl_Util.verify({
-        filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: shortSignature,
-        secret: SECRET, nowMs: GOLDEN_EXP - 1000,
-      });
-
-      expect(result.valid).toBeFalse();
-    }).not.toThrow();
-  });
-
-  it('9 | verify — hiányzó exp/sig esetén { valid: false, reason: missing-params }', () => {
-    const noSignature = DyNTS_SignedUrl_Util.verify({
-      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: undefined,
-      secret: SECRET, nowMs: GOLDEN_EXP - 1000,
-    });
-    const noExp = DyNTS_SignedUrl_Util.verify({
-      filePath: GOLDEN_PATH, expMs: undefined, signature: GOLDEN_HEX,
-      secret: SECRET, nowMs: GOLDEN_EXP - 1000,
-    });
-
-    expect(noSignature.reason).toBe('missing-params');
-    expect(noExp.reason).toBe('missing-params');
-  });
-
-  it('10 | verify — ÜRES secrettel SOHA nem true', () => {
-    const result = DyNTS_SignedUrl_Util.verify({
-      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
-      secret: '', nowMs: GOLDEN_EXP - 1000,
-    });
-
-    expect(result.valid).toBeFalse();
-    expect(result.reason).toBe('missing-secret');
-  });
-
-  it('11 | sign — ÜRES secretre DOB (DyNTS-SURL-SIGN-NOSEC), nem ad csendben üres aláírást', () => {
-    let caught: DyFM_Error | undefined;
-
-    try {
-      DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, GOLDEN_EXP, '');
-    } catch (error) {
-      caught = error as DyFM_Error;
-    }
-
-    expect(caught).toBeDefined();
-    expect(caught?._errorCode).toBe('DyNTS-SURL-SIGN-NOSEC');
-  });
-
-  it('12 | buildSignedUrl — base végi /-ek levágva, query helyes', () => {
-    const url: string = DyNTS_SignedUrl_Util.buildSignedUrl({
-      baseUrl: 'https://ftp.example.com///',
-      filePath: '/accounts/acc-1/f.pdf',
-      ttlMs: 60_000,
-      secret: SECRET,
-      nowMs: 1_000_000,
-    });
-
-    const expectedSignature: string =
-      DyNTS_SignedUrl_Util.sign('accounts/acc-1/f.pdf', 1_060_000, SECRET);
-    expect(url).toBe(
-      `https://ftp.example.com/accounts/acc-1/f.pdf?exp=1060000&sig=${expectedSignature}`,
-    );
-  });
-
-  it('13 | PATH-MANIPULÁCIÓ — aláírt path ≠ kért path → érvénytelen', () => {
-    const signature: string = DyNTS_SignedUrl_Util.sign('accounts/acc-1/f.pdf', GOLDEN_EXP, SECRET);
-
-    const result = DyNTS_SignedUrl_Util.verify({
-      filePath: 'accounts/acc-2/f.pdf',        // MÁSIK account
-      expMs: GOLDEN_EXP, signature, secret: SECRET, nowMs: GOLDEN_EXP - 1000,
-    });
-
-    expect(result.valid).toBeFalse();
-    expect(result.reason).toBe('signature-mismatch');
-  });
-
-  it('14 | nowMs injektálás — determinisztikus lejárat-határ (nincs Date.now a tesztben)', () => {
-    const atBoundary = DyNTS_SignedUrl_Util.verify({
-      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
-      secret: SECRET, nowMs: GOLDEN_EXP,        // exp === now → MÉG érvényes
-    });
-    const afterBoundary = DyNTS_SignedUrl_Util.verify({
-      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
-      secret: SECRET, nowMs: GOLDEN_EXP + 1,    // egy ms-mal később → lejárt
-    });
-
-    expect(atBoundary.valid).toBeTrue();
-    expect(afterBoundary.reason).toBe('expired');
-  });
-
-  it('15 | buildSignedUrl — ÜRES/hibás baseUrl-re DOB (DyNTS-SURL-URL-BADBASE), nem épít félkész URL-t', () => {
-    let caught: DyFM_Error | undefined;
-
-    try {
-      DyNTS_SignedUrl_Util.buildSignedUrl({
-        baseUrl: '   ', filePath: 'a/b.pdf', ttlMs: 1000, secret: SECRET, nowMs: 1,
-      });
-    } catch (error) {
-      caught = error as DyFM_Error;
-    }
-
-    expect(caught).toBeDefined();
-    expect(caught?._errorCode).toBe('DyNTS-SURL-URL-BADBASE');
-  });
-
-  it('16 | sign — nem-pozitív/nem-szám expMs-re DOB (DyNTS-SURL-SIGN-BADEXP)', () => {
-    let caught: DyFM_Error | undefined;
-
-    try {
-      DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, Number.NaN, SECRET);
-    } catch (error) {
-      caught = error as DyFM_Error;
-    }
-
-    expect(caught).toBeDefined();
-    expect(caught?._errorCode).toBe('DyNTS-SURL-SIGN-BADEXP');
-  });
-});
+import { DyFM_Error } from '@futdevpro/fsm-dynamo';
+
+import { DyNTS_SignedUrl_Util } from './signed-url.util';
+
+/**
+ * ALÁÍRT-URL primitív tesztjei (AAA).
+ *
+ * ⭐ **Az ARANY-VEKTOR az első teszt, és ez a legfontosabb:** a hex értéket a ma ÉLŐ algoritmusból
+ * generáltuk *(az `fdp-ftp-service` `FtpUrlSignature_Util` verify- és a `master-prompter`
+ * `FtpUrlSigner_Util` sign-oldala — bit-azonosak)*. Ha ez a teszt elpirosodik, az azt jelenti,
+ * hogy a bedrock util **elcsúszott** az élő rendszertől, és a **már kiadott URL-ek elromlanának**.
+ *
+ * ⚠️ `nowMs` **mindenhol injektálva** — a tesztben nincs `Date.now()`, tehát nincs flake.
+ */
+describe('| DyNTS_SignedUrl_Util', () => {
+  const SECRET: string = 'golden-vector-secret';
+  const BACKSLASH: string = String.fromCharCode(92);
+
+  // --- ARANY-VEKTOR (az élő algoritmusból generálva) ---
+  const GOLDEN_PATH: string = '/accounts/acc-1/invoices/INV-2026-001.pdf';
+  const GOLDEN_EXP: number = 1767225600000;
+  const GOLDEN_HEX: string = 'a6c2d1ddf0fe4614e3b6130d4e22a9ef085377f73088d3f79aab548e8056c165';
+
+  it('1 | ARANY-VEKTOR — a mai algoritmus hexét adja (bitre)', () => {
+    const signature: string = DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, GOLDEN_EXP, SECRET);
+
+    expect(signature).toBe(GOLDEN_HEX);
+  });
+
+  it('2 | normalizePath — vezető /-ek le, backslash → slash', () => {
+    expect(DyNTS_SignedUrl_Util.normalizePath('///a' + BACKSLASH + 'b/c')).toBe('a/b/c');
+  });
+
+  it('3 | buildCanonicalString — `<path>\\n<exp>`', () => {
+    expect(DyNTS_SignedUrl_Util.buildCanonicalString('a/b', 123)).toBe('a/b\n123');
+  });
+
+  it('4 | sign determinisztikus — kétszeri hívás azonos', () => {
+    const first: string = DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, GOLDEN_EXP, SECRET);
+    const second: string = DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, GOLDEN_EXP, SECRET);
+
+    expect(first).toBe(second);
+  });
+
+  it('5 | verify — érvényes aláírásra { valid: true }', () => {
+    const result = DyNTS_SignedUrl_Util.verify({
+      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
+      secret: SECRET, nowMs: GOLDEN_EXP - 1000,
+    });
+
+    expect(result.valid).toBeTrue();
+    expect(result.reason).toBeUndefined();
+  });
+
+  it('6 | verify — LEJÁRT aláírásra { valid: false, reason: expired }', () => {
+    const result = DyNTS_SignedUrl_Util.verify({
+      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
+      secret: SECRET, nowMs: GOLDEN_EXP + 1,
+    });
+
+    expect(result.valid).toBeFalse();
+    expect(result.reason).toBe('expired');
+  });
+
+  it('7 | verify — HAMIS aláírásra { valid: false, reason: signature-mismatch }', () => {
+    // ugyanolyan HOSSZÚ, de más tartalmú hex — a timing-safe ág fut le, nem a hossz-guard
+    const forged: string = 'b'.repeat(GOLDEN_HEX.length);
+
+    const result = DyNTS_SignedUrl_Util.verify({
+      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: forged,
+      secret: SECRET, nowMs: GOLDEN_EXP - 1000,
+    });
+
+    expect(result.valid).toBeFalse();
+    expect(result.reason).toBe('signature-mismatch');
+  });
+
+  it('8 | verify — ELTÉRŐ HOSSZÚ aláírásra NEM dob (timingSafeEqual guard)', () => {
+    const shortSignature: string = 'abc';
+
+    // Act + Assert: a lényeg, hogy NEM dob — a `timingSafeEqual` eltérő hosszra dobna.
+    expect((): void => {
+      const result = DyNTS_SignedUrl_Util.verify({
+        filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: shortSignature,
+        secret: SECRET, nowMs: GOLDEN_EXP - 1000,
+      });
+
+      expect(result.valid).toBeFalse();
+    }).not.toThrow();
+  });
+
+  it('9 | verify — hiányzó exp/sig esetén { valid: false, reason: missing-params }', () => {
+    const noSignature = DyNTS_SignedUrl_Util.verify({
+      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: undefined,
+      secret: SECRET, nowMs: GOLDEN_EXP - 1000,
+    });
+    const noExp = DyNTS_SignedUrl_Util.verify({
+      filePath: GOLDEN_PATH, expMs: undefined, signature: GOLDEN_HEX,
+      secret: SECRET, nowMs: GOLDEN_EXP - 1000,
+    });
+
+    expect(noSignature.reason).toBe('missing-params');
+    expect(noExp.reason).toBe('missing-params');
+  });
+
+  it('10 | verify — ÜRES secrettel SOHA nem true', () => {
+    const result = DyNTS_SignedUrl_Util.verify({
+      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
+      secret: '', nowMs: GOLDEN_EXP - 1000,
+    });
+
+    expect(result.valid).toBeFalse();
+    expect(result.reason).toBe('missing-secret');
+  });
+
+  it('11 | sign — ÜRES secretre DOB (DyNTS-SURL-SIGN-NOSEC), nem ad csendben üres aláírást', () => {
+    let caught: DyFM_Error | undefined;
+
+    try {
+      DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, GOLDEN_EXP, '');
+    } catch (error) {
+      caught = error as DyFM_Error;
+    }
+
+    expect(caught).toBeDefined();
+    expect(caught?._errorCode).toBe('DyNTS-SURL-SIGN-NOSEC');
+  });
+
+  it('12 | buildSignedUrl — base végi /-ek levágva, query helyes', () => {
+    const url: string = DyNTS_SignedUrl_Util.buildSignedUrl({
+      baseUrl: 'https://ftp.example.com///',
+      filePath: '/accounts/acc-1/f.pdf',
+      ttlMs: 60_000,
+      secret: SECRET,
+      nowMs: 1_000_000,
+    });
+
+    const expectedSignature: string =
+      DyNTS_SignedUrl_Util.sign('accounts/acc-1/f.pdf', 1_060_000, SECRET);
+    expect(url).toBe(
+      `https://ftp.example.com/accounts/acc-1/f.pdf?exp=1060000&sig=${expectedSignature}`,
+    );
+  });
+
+  it('13 | PATH-MANIPULÁCIÓ — aláírt path ≠ kért path → érvénytelen', () => {
+    const signature: string = DyNTS_SignedUrl_Util.sign('accounts/acc-1/f.pdf', GOLDEN_EXP, SECRET);
+
+    const result = DyNTS_SignedUrl_Util.verify({
+      filePath: 'accounts/acc-2/f.pdf',        // MÁSIK account
+      expMs: GOLDEN_EXP, signature, secret: SECRET, nowMs: GOLDEN_EXP - 1000,
+    });
+
+    expect(result.valid).toBeFalse();
+    expect(result.reason).toBe('signature-mismatch');
+  });
+
+  it('14 | nowMs injektálás — determinisztikus lejárat-határ (nincs Date.now a tesztben)', () => {
+    const atBoundary = DyNTS_SignedUrl_Util.verify({
+      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
+      secret: SECRET, nowMs: GOLDEN_EXP,        // exp === now → MÉG érvényes
+    });
+    const afterBoundary = DyNTS_SignedUrl_Util.verify({
+      filePath: GOLDEN_PATH, expMs: GOLDEN_EXP, signature: GOLDEN_HEX,
+      secret: SECRET, nowMs: GOLDEN_EXP + 1,    // egy ms-mal később → lejárt
+    });
+
+    expect(atBoundary.valid).toBeTrue();
+    expect(afterBoundary.reason).toBe('expired');
+  });
+
+  it('15 | buildSignedUrl — ÜRES/hibás baseUrl-re DOB (DyNTS-SURL-URL-BADBASE), nem épít félkész URL-t', () => {
+    let caught: DyFM_Error | undefined;
+
+    try {
+      DyNTS_SignedUrl_Util.buildSignedUrl({
+        baseUrl: '   ', filePath: 'a/b.pdf', ttlMs: 1000, secret: SECRET, nowMs: 1,
+      });
+    } catch (error) {
+      caught = error as DyFM_Error;
+    }
+
+    expect(caught).toBeDefined();
+    expect(caught?._errorCode).toBe('DyNTS-SURL-URL-BADBASE');
+  });
+
+  it('16 | sign — nem-pozitív/nem-szám expMs-re DOB (DyNTS-SURL-SIGN-BADEXP)', () => {
+    let caught: DyFM_Error | undefined;
+
+    try {
+      DyNTS_SignedUrl_Util.sign(GOLDEN_PATH, Number.NaN, SECRET);
+    } catch (error) {
+      caught = error as DyFM_Error;
+    }
+
+    expect(caught).toBeDefined();
+    expect(caught?._errorCode).toBe('DyNTS-SURL-SIGN-BADEXP');
+  });
+});