@mh-gg/host-runtime 0.1.1-alpha.20260613T085325975Z

package/test/grant-authority-security.test.cjs

@@ -0,0 +1,305 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+
+const { manifestHash } = require("@mh-gg/base");
+const {
+  createOperationGrantAuthority,
+  createOperationRoleKeyGrant,
+  createRoleKeyAuthenticator,
+  createSignedOperationRoleKeyGrant,
+  generateOperationGrantAuthorityKeyPair,
+  generateOperationRoleKeyPair,
+  publicOperationGrantAuthority,
+  signOperationRoleKeyGrant,
+  signOperationWithRoleKey,
+  verifyOperationRoleKey,
+  verifyOperationRoleKeyGrant
+} = require("../src/index.cjs");
+const { kanbanAppPack, KANBAN_PLUGIN_ID } = require("../../../examples/kanban/src/sdk-app.mjs");
+
+const ROOM_ID = "room_grant_authority";
+const APP_HASH = manifestHash(kanbanAppPack);
+
+function actor(role = "member", memberId = "bob") {
+  return { memberId, deviceId: `dev_${memberId}`, role };
+}
+
+function operation(overrides = {}) {
+  return {
+    id: overrides.id || "op_1",
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    pluginId: KANBAN_PLUGIN_ID,
+    type: "card.create",
+    actor: actor("member", "bob"),
+    seq: 1,
+    createdAt: 1000,
+    payload: { listId: "list_1", title: "Secure write" },
+    auth: { credentialId: "cred_user" },
+    ...overrides
+  };
+}
+
+test("role-key grants must chain to a trusted grant authority when required", () => {
+  const authorityKeys = generateOperationGrantAuthorityKeyPair({ issuer: "room-owner" });
+  const authority = createOperationGrantAuthority({
+    issuer: authorityKeys.issuer,
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    publicKeyPem: authorityKeys.publicKeyPem,
+    issuedAt: 10
+  });
+  const userKey = generateOperationRoleKeyPair({ role: "user" });
+  const unsignedGrant = createOperationRoleKeyGrant({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    credentialId: "cred_user",
+    memberId: "bob",
+    deviceId: "dev_bob",
+    role: "user",
+    publicKeyPem: userKey.publicKeyPem,
+    issuedAt: 100
+  });
+
+  assert.equal(verifyOperationRoleKeyGrant(unsignedGrant, [authority], { requireSignedGrants: true }).ok, false);
+
+  const signedGrant = signOperationRoleKeyGrant(unsignedGrant, {
+    authority,
+    privateKeyPem: authorityKeys.privateKeyPem,
+    signedAt: 150
+  });
+  assert.equal(verifyOperationRoleKeyGrant(signedGrant, [authority], { roomId: ROOM_ID, appPackId: kanbanAppPack.id, appPackHash: APP_HASH, now: 5000, requireSignedGrants: true }).ok, true);
+
+  const signedOperation = signOperationWithRoleKey(operation(), { grant: signedGrant, privateKeyPem: userKey.privateKeyPem, issuedAt: 1000 });
+  assert.equal(verifyOperationRoleKey(signedOperation, [signedGrant], {
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    grantAuthorities: [authority],
+    requireSignedGrants: true,
+    now: 5000
+  }).ok, true);
+
+  const forgedAuthorityKeys = generateOperationGrantAuthorityKeyPair({ issuer: "evil" });
+  const forgedAuthority = createOperationGrantAuthority({
+    issuer: forgedAuthorityKeys.issuer,
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    publicKeyPem: forgedAuthorityKeys.publicKeyPem,
+    issuedAt: 10
+  });
+  const forgedGrant = signOperationRoleKeyGrant(unsignedGrant, { authority: forgedAuthority, privateKeyPem: forgedAuthorityKeys.privateKeyPem, signedAt: 150 });
+  const forgedOp = signOperationWithRoleKey(operation({ id: "op_forged" }), { grant: forgedGrant, privateKeyPem: userKey.privateKeyPem, issuedAt: 1000 });
+  assert.match(verifyOperationRoleKey(forgedOp, [forgedGrant], {
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    grantAuthorities: [authority],
+    requireSignedGrants: true,
+    now: 5000
+  }).error, /authority|signature|signed/i);
+
+  const publicAuthority = publicOperationGrantAuthority({ ...authority, privateKeyPem: authorityKeys.privateKeyPem });
+  assert.equal(publicAuthority.privateKeyPem, undefined);
+  assert.equal(publicAuthority.publicKeyPem.includes("PUBLIC KEY"), true);
+});
+
+test("role-key authenticator rejects unsigned relay grants by default when grant authorities are configured", async () => {
+  const authorityKeys = generateOperationGrantAuthorityKeyPair({ issuer: "room-owner" });
+  const authority = createOperationGrantAuthority({
+    issuer: authorityKeys.issuer,
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    publicKeyPem: authorityKeys.publicKeyPem
+  });
+  const userKey = generateOperationRoleKeyPair({ role: "user" });
+  const unsignedGrant = createOperationRoleKeyGrant({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    credentialId: "cred_user",
+    memberId: "bob",
+    deviceId: "dev_bob",
+    role: "user",
+    publicKeyPem: userKey.publicKeyPem,
+    issuedAt: 100
+  });
+  const auth = createRoleKeyAuthenticator({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    grants: [unsignedGrant],
+    grantAuthorities: [authority],
+    requireSignedGrants: true,
+    now: () => 5000
+  });
+  const signedOperation = signOperationWithRoleKey(operation(), { grant: unsignedGrant, privateKeyPem: userKey.privateKeyPem, issuedAt: 1000 });
+  await assert.rejects(() => auth(signedOperation.auth, signedOperation.actor, signedOperation), /grant/i);
+});
+
+test("role-key authenticator requires signed grants in production without authorities", async () => {
+  const userKey = generateOperationRoleKeyPair({ role: "user" });
+  const unsignedGrant = createOperationRoleKeyGrant({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    credentialId: "cred_user_prod",
+    memberId: "bob",
+    deviceId: "dev_bob",
+    role: "user",
+    publicKeyPem: userKey.publicKeyPem,
+    issuedAt: 100
+  });
+  const signedOperation = signOperationWithRoleKey(operation({ id: "op_unsigned_prod" }), {
+    grant: unsignedGrant,
+    privateKeyPem: userKey.privateKeyPem,
+    issuedAt: 1000
+  });
+
+  const productionAuth = createRoleKeyAuthenticator({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    grants: [unsignedGrant],
+    productionRuntime: true,
+    now: () => 5000
+  });
+  await assert.rejects(() => productionAuth(signedOperation.auth, signedOperation.actor, signedOperation), /signed|authority/i);
+
+  const devAuth = createRoleKeyAuthenticator({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    grants: [unsignedGrant],
+    productionRuntime: true,
+    devUnsafeUnsignedOperationRoleKeyGrants: true,
+    now: () => 5000
+  });
+  assert.equal((await devAuth(signedOperation.auth, signedOperation.actor, signedOperation)).memberId, "bob");
+});
+
+
+test("createSignedOperationRoleKeyGrant creates a verifiable public grant in one step", () => {
+  const authorityKeys = generateOperationGrantAuthorityKeyPair({ issuer: "room-owner" });
+  const roleKey = generateOperationRoleKeyPair({ role: "admin" });
+  const authority = createOperationGrantAuthority({
+    issuer: authorityKeys.issuer,
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    publicKeyPem: authorityKeys.publicKeyPem,
+    issuedAt: 10
+  });
+  const grant = createSignedOperationRoleKeyGrant({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    credentialId: "cred_admin",
+    memberId: "alice",
+    deviceId: "dev_alice",
+    role: "admin",
+    publicKeyPem: roleKey.publicKeyPem,
+    issuedAt: 100
+  }, {
+    authority,
+    privateKeyPem: authorityKeys.privateKeyPem,
+    signedAt: 150
+  });
+
+  assert.equal(grant.grantSignature.issuer, "room-owner");
+  assert.equal(verifyOperationRoleKeyGrant(grant, [authority], { requireSignedGrants: true, now: 5000 }).ok, true);
+});
+
+test("grant authority helpers validate scope, arrays, expiry, and public collection forms", () => {
+  const {
+    authorityArray,
+    authorityFingerprint,
+    isOperationGrantAuthority,
+    publicOperationGrantAuthorities
+  } = require("../src/index.cjs");
+  assert.throws(() => authorityFingerprint(""), /public key/);
+  const authorityKeys = generateOperationGrantAuthorityKeyPair();
+  assert.equal(authorityKeys.issuer, "matterhorn-grant-authority");
+  assert.throws(() => createOperationGrantAuthority({ issuer: "bad", publicKeyPem: authorityKeys.publicKeyPem, allowedGrantRoles: [""] }), /allowedGrantRoles/);
+  const authority = createOperationGrantAuthority({
+    issuer: "room-owner",
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    publicKeyPem: authorityKeys.publicKeyPem,
+    allowedGrantRoles: ["member", "admin", "member"],
+    issuedAt: 100,
+    expiresAt: 10000
+  });
+  assert.deepEqual(authority.allowedGrantRoles, ["user", "admin"]);
+  assert.equal(isOperationGrantAuthority(authority, { roomId: ROOM_ID, appPackId: kanbanAppPack.id, appPackHash: APP_HASH }), true);
+  assert.equal(isOperationGrantAuthority(authority, { roomId: "other" }), false);
+  assert.equal(isOperationGrantAuthority({ ...authority, publicKeyFingerprint: "sha256-nope" }), false);
+  assert.equal(isOperationGrantAuthority({ ...authority, expiresAt: "later" }), false);
+  assert.equal(isOperationGrantAuthority({ ...authority, roomId: "" }), false);
+  assert.equal(isOperationGrantAuthority({ ...authority, appPackId: "" }), false);
+  assert.equal(isOperationGrantAuthority({ ...authority, appPackHash: "" }), false);
+  assert.equal(isOperationGrantAuthority({ ...authority, allowedGrantRoles: ["guest"] }), false);
+  assert.deepEqual(authorityArray(authority), [authority]);
+  assert.deepEqual(authorityArray(new Map([["owner", authority]])), [authority]);
+  assert.deepEqual(authorityArray({ owner: authority }), [authority]);
+  assert.deepEqual(publicOperationGrantAuthorities({ owner: { ...authority, privateKeyPem: authorityKeys.privateKeyPem } })[0].privateKeyPem, undefined);
+});
+
+test("signed role-key grants reject untrusted, expired, mismatched, and tampered authorities", () => {
+  const authorityKeys = generateOperationGrantAuthorityKeyPair({ issuer: "room-owner" });
+  const authority = createOperationGrantAuthority({
+    issuer: authorityKeys.issuer,
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    publicKeyPem: authorityKeys.publicKeyPem,
+    allowedGrantRoles: ["admin"],
+    issuedAt: 100,
+    expiresAt: 10000
+  });
+  const key = generateOperationRoleKeyPair({ role: "admin" });
+  const grant = createOperationRoleKeyGrant({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    credentialId: "cred_admin_scope",
+    memberId: "alice",
+    deviceId: "dev_alice",
+    role: "admin",
+    publicKeyPem: key.publicKeyPem,
+    issuedAt: 200
+  });
+
+  assert.throws(() => signOperationRoleKeyGrant(grant, { authority: { bad: true }, privateKeyPem: authorityKeys.privateKeyPem }), /grant authority/);
+  assert.throws(() => signOperationRoleKeyGrant(grant, { authority, privateKeyPem: "" }), /privateKeyPem/);
+  assert.throws(() => signOperationRoleKeyGrant({ bad: true }, { authority, privateKeyPem: authorityKeys.privateKeyPem }), /valid operation role-key grant/);
+  assert.throws(() => signOperationRoleKeyGrant({ ...grant, roomId: "other" }, { authority, privateKeyPem: authorityKeys.privateKeyPem }), /different room/);
+  assert.throws(() => signOperationRoleKeyGrant({ ...grant, appPackId: "other" }, { authority, privateKeyPem: authorityKeys.privateKeyPem }), /different app pack/);
+  assert.throws(() => signOperationRoleKeyGrant({ ...grant, appPackHash: "sha256-other" }, { authority, privateKeyPem: authorityKeys.privateKeyPem }), /different app pack hash/);
+  const userGrant = createOperationRoleKeyGrant({ ...grant, credentialId: "cred_user_scope", role: "user" });
+  assert.throws(() => signOperationRoleKeyGrant(userGrant, { authority, privateKeyPem: authorityKeys.privateKeyPem }), /not allowed/);
+
+  const signed = signOperationRoleKeyGrant(grant, { authority, privateKeyPem: authorityKeys.privateKeyPem, signedAt: 250, expiresAt: 8000 });
+  assert.equal(verifyOperationRoleKeyGrant(signed, [authority], { requireSignedGrants: true, now: 5000 }).ok, true);
+  assert.match(verifyOperationRoleKeyGrant(signed, [authority], { requireSignedGrants: true, now: 11000 }).error, /authority has expired/);
+  assert.match(verifyOperationRoleKeyGrant(signed, [{ ...authority, expiresAt: 20000 }], { requireSignedGrants: true, now: 9000 }).error, /signature has expired/);
+  assert.match(verifyOperationRoleKeyGrant(signOperationRoleKeyGrant(grant, { authority, privateKeyPem: authorityKeys.privateKeyPem, signedAt: 50 }), [authority], { requireSignedGrants: true, now: 5000 }).error, /predates authority/);
+  const laterGrant = { ...grant, issuedAt: 400 };
+  assert.match(verifyOperationRoleKeyGrant(signOperationRoleKeyGrant(laterGrant, { authority, privateKeyPem: authorityKeys.privateKeyPem, signedAt: 300 }), [authority], { requireSignedGrants: true, now: 5000 }).error, /predates grant/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, kind: "bad" } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /kind/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, version: 2 } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /version/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, alg: "rsa" } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /algorithm/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, issuer: "" } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /issuer/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, authorityFingerprint: "" } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /fingerprint/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, signedAt: "later" } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /time/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, expiresAt: "later" } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /expiry/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, signature: "" } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /signature is invalid/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, publicKeyPem: generateOperationRoleKeyPair({ role: "admin" }).publicKeyPem }, [authority], { requireSignedGrants: true, now: 5000 }).error, /invalid|fingerprint/);
+  assert.match(verifyOperationRoleKeyGrant({ ...signed, grantSignature: { ...signed.grantSignature, signature: "not-base64" } }, [authority], { requireSignedGrants: true, now: 5000 }).error, /invalid|failed|DECODER/);
+});