@mh-gg/base 0.1.1-alpha.20260613T085325975Z

package/test/pack-security.test.cjs

@@ -0,0 +1,51 @@
+const assert = require("node:assert/strict");
+const fs = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+
+const { APP_PACK_KIND, loadPackArtifact, loadPackReference, manifestHash } = require("../src/index.cjs");
+
+function appPack() {
+  return {
+    kind: APP_PACK_KIND,
+    id: "com.matterhorn.security-pack",
+    name: "Security Pack",
+    version: "1.0.0",
+    publisher: { id: "pub", name: "Publisher", publicKey: "pubkey" },
+    matterhornVersion: ">=0.1 <0.2",
+    hostPack: { url: "workspace:@mh-gg/security#host", integrity: "sha256-host" },
+    playerPacks: [{ id: "player", name: "Player", url: "workspace:@mh-gg/security#player", integrity: "sha256-player" }],
+    compatibility: { appProtocolHash: "sha256-protocol", operationSchemaHash: "sha256-ops", stateSchemaHash: "sha256-state" },
+    capabilities: { required: ["room.state"] },
+    trust: { createdAt: "2026-05-28T00:00:00.000Z", signatures: [{ publicKey: "pubkey", signature: "sig" }] }
+  };
+}
+
+test("remote pack artifacts require https and pinned integrity by default", async () => {
+  await assert.rejects(
+    () => loadPackArtifact({ url: "http://registry.example/app.json", integrity: "sha256-pinned" }, { fetch: async () => ({ ok: true, arrayBuffer: async () => Buffer.from("{}") }) }),
+    /Insecure HTTP pack references are disabled/
+  );
+
+  await assert.rejects(
+    () => loadPackArtifact({ url: "https://registry.example/app.json" }, { fetch: async () => ({ ok: true, arrayBuffer: async () => Buffer.from("{}") }) }),
+    /Remote pack artifact integrity is required/
+  );
+});
+
+test("file pack references cannot escape an explicit base directory by default", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "matterhorn-pack-security-"));
+  const baseDir = path.join(root, "base");
+  const outsideDir = path.join(root, "outside");
+  await fs.mkdir(baseDir, { recursive: true });
+  await fs.mkdir(outsideDir, { recursive: true });
+  const manifest = appPack();
+  const outsideFile = path.join(outsideDir, "app.json");
+  await fs.writeFile(outsideFile, JSON.stringify(manifest));
+
+  await assert.rejects(
+    () => loadPackReference({ url: `file:${path.relative(baseDir, outsideFile)}`, integrity: manifestHash(manifest) }, { baseDir }),
+    /escapes the configured base directory/
+  );
+});