@learncard/sss-key-manager 0.2.0 → 0.2.2

package/src/sss-session-writes.test.ts

@@ -61,7 +61,7 @@ describe('session-scoped enrollment writes', () => {
         vi.stubGlobal(
             'fetch',
             vi.fn(async (url: string) => {
-                if (url.endsWith('/attestation')) {
+                if (url.includes('/attestation?nonce=')) {
                     started.resolve();
                     return attestation.promise;
                 }
@@ -91,7 +91,7 @@ describe('session-scoped enrollment writes', () => {
                         return authWrite.promise;
                     }
                     if (url.endsWith('/challenge')) return response({ challenge: 'nonce' });
-                    if (url.endsWith('/attestation')) return response({ attestation: {} });
+                    if (url.includes('/attestation?nonce=')) return response({ attestation: {} });
                     return response(keyStatus);
                 })
             );

package/src/sss-strategy.test.ts

@@ -160,6 +160,7 @@ describe('escrow strategy', () => {
     let releasePolicy: 'hold' | 'pin';
     let consumed: boolean;
     let burned: string[];
+    let escrowStale: 'mode-mismatch' | 'key-rotated' | undefined;
     const hold = () => ({
         holdId: holdNumber <= 1 ? 'escrow-hold' : `escrow-hold-${holdNumber}`,
         status: cancelled ? 'cancelled' : 'pending',
@@ -190,6 +191,7 @@ describe('escrow strategy', () => {
         releasePolicy = 'hold';
         consumed = false;
         burned = [];
+        escrowStale = undefined;
         config = {
             serverUrl: 'https://test.example/api',
             storage,
@@ -225,6 +227,7 @@ describe('escrow strategy', () => {
                         attemptsRemaining,
                         ...(pinSalt ? { salt: pinSalt } : {}),
                     },
+                    ...(escrowStale ? { escrowStale } : {}),
                 });
             }
             if (path === '/keys/recovery' || path === '/keys/recovery/confirm')
@@ -266,6 +269,7 @@ describe('escrow strategy', () => {
                 blob = await decryptEscrowBlob(body.envelope, enclaveKeys.privateKey);
                 pinSalt = body.pinSalt;
                 attemptsRemaining = 10;
+                escrowStale = undefined;
                 expect(blob.did).toBe(did);
                 expect(blob.shareVersion).toBe(version);
                 expect(
@@ -480,7 +484,7 @@ describe('escrow strategy', () => {
         });
         methods[0].shareVersion = 1;
         expect(await strategy.getEscrowEnrollmentState!(params)).toMatchObject({
-            state: 'not-enrolled',
+            state: 'stale',
         });
         methods[0].shareVersion = version;
         methods[0].confirmedAt = undefined;
@@ -543,7 +547,7 @@ describe('escrow strategy', () => {
         await strategy.setupRecoveryMethod!({ ...params, input: { method: 'phrase' } });
         expect(config.onEscrowError).toHaveBeenCalledWith(
             expect.objectContaining({
-                message: 'Nitro attestation verification is not implemented yet',
+                message: 'Escrow attestation mode mismatch',
             })
         );
     });
@@ -571,6 +575,77 @@ describe('escrow strategy', () => {
         });
         expect(calls).toHaveLength(0);
     });
+    it('getEscrowEnrollmentState reports stale with a reason when the server flags the blob', async () => {
+        await strategy.ensureEscrowEnrollment!(params);
+        escrowStale = 'mode-mismatch';
+        expect(await strategy.getEscrowEnrollmentState!(params)).toMatchObject({
+            state: 'stale',
+            staleReason: 'mode-mismatch',
+        });
+        escrowStale = 'key-rotated';
+        expect(await strategy.getEscrowEnrollmentState!(params)).toMatchObject({
+            state: 'stale',
+            staleReason: 'key-rotated',
+        });
+    });
+    it('does not trigger the stale-repair path when the server reports no staleness', async () => {
+        await strategy.ensureEscrowEnrollment!(params);
+        calls = [];
+        await expect(strategy.ensureEscrowEnrollment!(params)).resolves.toEqual({
+            enrolled: true,
+            changed: false,
+        });
+        expect(calls.some(call => call.path === '/keys/escrow/attestation')).toBe(false);
+    });
+    it('rotates a stale enrollment through the normal rotation path, at most once per session', async () => {
+        await strategy.ensureEscrowEnrollment!(params);
+        escrowStale = 'mode-mismatch';
+        await expect(strategy.ensureEscrowEnrollment!(params)).resolves.toEqual({
+            enrolled: true,
+            changed: true,
+            shareVersion: 3,
+        });
+        expect(version).toBe(3);
+        expect(blob?.shareVersion).toBe(3);
+        // A real re-enroll clears server-side staleness (the mock's '/keys/escrow'
+        // handler already reset it); force it stale again so this assertion proves
+        // the session-scoped rate limit — not the mock's own healing — stops the retry.
+        escrowStale = 'mode-mismatch';
+        calls = [];
+        await expect(strategy.ensureEscrowEnrollment!(params)).resolves.toEqual({
+            enrolled: true,
+            changed: false,
+        });
+        expect(calls.some(call => call.path === '/keys/escrow/attestation')).toBe(false);
+        expect(version).toBe(3);
+        // A fresh strategy instance (the next app session) attempts the repair again.
+        const nextSession = createSSSStrategy(config);
+        await expect(nextSession.ensureEscrowEnrollment!(params)).resolves.toEqual({
+            enrolled: true,
+            changed: true,
+            shareVersion: 4,
+        });
+        expect(version).toBe(4);
+    });
+    it('swallows a failed automatic stale-blob repair instead of throwing to the caller', async () => {
+        await strategy.ensureEscrowEnrollment!(params);
+        escrowStale = 'key-rotated';
+        attestationFailure = true;
+        await expect(strategy.ensureEscrowEnrollment!(params)).resolves.toEqual({
+            enrolled: true,
+            changed: false,
+        });
+        expect(version).toBe(2);
+        expect(config.onEscrowError).toHaveBeenCalledOnce();
+        vi.mocked(config.onEscrowError!).mockClear();
+        // Still rate-limited to one attempt this session, even though it failed.
+        await expect(strategy.ensureEscrowEnrollment!(params)).resolves.toEqual({
+            enrolled: true,
+            changed: false,
+        });
+        expect(config.onEscrowError).not.toHaveBeenCalled();
+        expect(version).toBe(2);
+    });
     it('requires DID verification before attempting PIN recovery', async () => {
         await expect(
             strategy.executeRecovery({
@@ -585,6 +660,24 @@ describe('escrow strategy', () => {
         expect(storage.clearAllShares).not.toHaveBeenCalled();
         expect(strategy.hasPendingIdentityRecovery!()).toBe(false);
     });
+    it.each(['set', 'clear'] as const)(
+        'rejects explicit %s PIN on a stale account when the enclave is unreachable',
+        async action => {
+            await strategy.ensureEscrowEnrollment!(params);
+            escrowStale = 'key-rotated';
+            attestationFailure = true;
+            await expect(
+                action === 'set'
+                    ? strategy.setEscrowPin!({ ...params, pin: '135790' })
+                    : strategy.clearEscrowPin!(params)
+            ).rejects.toThrow();
+            expect(version).toBe(2);
+            expect(config.onEscrowError).not.toHaveBeenCalled();
+            // Explicit actions must not consume the automatic repair attempt.
+            await strategy.ensureEscrowEnrollment!(params);
+            expect(config.onEscrowError).toHaveBeenCalledOnce();
+        }
+    );
     const recoverPin = (pin = '135790') =>
         strategy.executeRecovery({
             ...params,