@mh-gg/host-runtime 0.1.1-alpha.20260613T085325975Z

package/test/cascading-authority.test.cjs

@@ -0,0 +1,390 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+
+const {
+  HostPluginRuntime,
+  allow,
+  createMemoryOperationLog,
+  createMemoryRoomStore,
+  createOperationGrantAuthority,
+  createOperationRoleKeyGrant,
+  createOperationSchemaDescriptor,
+  createRoleKeyAuthenticator,
+  createSignedOperationRoleKeyGrant,
+  defineHostPlugin,
+  generateOperationGrantAuthorityKeyPair,
+  generateOperationRoleKeyPair,
+  signOperationWithRoleKey
+} = require("../src/index.cjs");
+const { ensureOperationIdentity } = require("@mh-gg/protocol");
+
+const ROOM_ID = "room_cascade";
+const APP_PACK = { id: "com.matterhorn.cascade", version: "1.0.0", hash: "sha256-cascade", protocolHash: "sha256-protocol" };
+const PLUGIN_ID = "com.matterhorn.cascade.content";
+
+function schema(parse) { return { parse }; }
+
+function contentPlugin() {
+  return defineHostPlugin({
+    id: PLUGIN_ID,
+    version: "1.0.0",
+    operationSchemaDescriptor: createOperationSchemaDescriptor({ plugin: PLUGIN_ID, version: "1.0.0", operations: {
+      "admin.post": { authorize: { roles: ["admin"] } },
+      "member.note": { authorize: { roles: ["member"] } },
+      "narrow.post": { authorize: { roles: ["admin"] } }
+    } }),
+    schemas: {
+      state: schema((value) => value && typeof value === "object" ? value : { posts: [] }),
+      operations: {
+        "admin.post": schema((payload) => {
+          assert.equal(typeof payload.id, "string");
+          return { id: payload.id, body: payload.body || "" };
+        }),
+        "member.note": schema((payload) => ({ id: payload.id, body: payload.body || "" })),
+        "narrow.post": schema((payload) => ({ id: payload.id, body: payload.body || "" }))
+      }
+    },
+    createInitialState() { return { posts: [] }; },
+    authorize(_ctx, op) {
+      if (op.type === "narrow.post") return { ok: false, reason: "narrow denied" };
+      return allow();
+    },
+    reduce(ctx, state, op) {
+      return { posts: [...state.posts, { id: op.payload.id, type: op.type, by: ctx.actor.memberId, role: ctx.actor.role }] };
+    }
+  });
+}
+
+function makeKeys() {
+  const authorityKey = generateOperationGrantAuthorityKeyPair({ issuer: "room-root" });
+  const authority = createOperationGrantAuthority({
+    issuer: authorityKey.issuer,
+    roomId: ROOM_ID,
+    appPackId: APP_PACK.id,
+    appPackHash: APP_PACK.hash,
+    publicKeyPem: authorityKey.publicKeyPem,
+    issuedAt: 1
+  });
+  function member(memberId, role, credentialId = `${memberId}_cred`) {
+    const key = generateOperationRoleKeyPair({ role });
+    const grant = createSignedOperationRoleKeyGrant(createOperationRoleKeyGrant({
+      roomId: ROOM_ID,
+      appPackId: APP_PACK.id,
+      appPackHash: APP_PACK.hash,
+      credentialId,
+      memberId,
+      deviceId: `dev_${memberId}`,
+      role,
+      publicKeyPem: key.publicKeyPem,
+      issuedAt: 2,
+      expiresAt: 100000
+    }), { authority, privateKeyPem: authorityKey.privateKeyPem, signedAt: 3 });
+    return { key, grant };
+  }
+  const olivia = member("olivia", "owner");
+  const alice = member("alice", "admin");
+  const bob = member("bob", "admin");
+  const carol = member("carol", "admin");
+  const realAdmin = member("realAdmin", "admin");
+  const memberOnly = member("memberOnly", "member");
+  return { authority, olivia, alice, bob, carol, realAdmin, memberOnly, grants: [olivia.grant, alice.grant, bob.grant, carol.grant, realAdmin.grant, memberOnly.grant] };
+}
+
+function initialAuthorityGrants() {
+  return [
+    { id: "grant_root_alice_admin", granter: "olivia", target: "alice", role: "admin", createdAt: 10 },
+    { id: "grant_root_real_admin", granter: "olivia", target: "realAdmin", role: "admin", createdAt: 11 },
+    { id: "grant_root_bob_member", granter: "olivia", target: "bob", role: "member", createdAt: 12 },
+    { id: "grant_root_carol_member", granter: "olivia", target: "carol", role: "member", createdAt: 13 },
+    { id: "grant_root_memberOnly_member", granter: "olivia", target: "memberOnly", role: "member", createdAt: 14 }
+  ];
+}
+
+function createRuntime() {
+  const keys = makeKeys();
+  const operationLog = createMemoryOperationLog();
+  const runtime = new HostPluginRuntime({
+    room: { id: ROOM_ID, appPack: APP_PACK },
+    plugins: [contentPlugin()],
+    store: createMemoryRoomStore(),
+    operationLog,
+    initialOwners: ["olivia"],
+    initialAuthorityGrants: initialAuthorityGrants(),
+    authenticateActor: createRoleKeyAuthenticator({
+      roomId: ROOM_ID,
+      appPackId: APP_PACK.id,
+      appPackHash: APP_PACK.hash,
+      grants: keys.grants,
+      grantAuthorities: [keys.authority],
+      requireSignedGrants: true,
+      now: () => 100
+    }),
+    now: () => 1000
+  });
+  return { runtime, operationLog, keys };
+}
+
+function unsigned(memberId, pluginId, type, payload, overrides = {}) {
+  return {
+    id: overrides.id || `op_${memberId}_${type.replace(/[^a-zA-Z0-9]/g, "_")}`,
+    roomId: ROOM_ID,
+    appPackId: APP_PACK.id,
+    appPackHash: APP_PACK.hash,
+    pluginId,
+    type,
+    actor: { memberId, deviceId: `dev_${memberId}`, role: overrides.claimedRole || "member" },
+    seq: overrides.seq || 1,
+    createdAt: overrides.createdAt || 1000,
+    payload: payload || {},
+    auth: { credentialId: overrides.credentialId || `${memberId}_cred`, signature: "placeholder" }
+  };
+}
+
+function sign(op, memberKeys) {
+  return signOperationWithRoleKey(op, { privateKeyPem: memberKeys.key.privateKeyPem, grant: memberKeys.grant, now: () => op.createdAt });
+}
+
+function grantOp(memberId, target, role, memberKeys, overrides = {}) {
+  return sign(unsigned(memberId, "matterhorn.core", "authority.grant", { target, role, reason: overrides.reason || "test" }, {
+    id: overrides.id,
+    seq: overrides.seq,
+    createdAt: overrides.createdAt,
+    claimedRole: overrides.claimedRole || role
+  }), memberKeys);
+}
+
+function revokeOp(memberId, payload, memberKeys, overrides = {}) {
+  return sign(unsigned(memberId, "matterhorn.core", "authority.revoke", payload, {
+    id: overrides.id,
+    seq: overrides.seq,
+    createdAt: overrides.createdAt,
+    claimedRole: overrides.claimedRole || "owner"
+  }), memberKeys);
+}
+
+function postOp(memberId, id, memberKeys, overrides = {}) {
+  return sign(unsigned(memberId, PLUGIN_ID, "admin.post", { id, body: id }, {
+    id: overrides.id || `op_${id}`,
+    seq: overrides.seq,
+    createdAt: overrides.createdAt,
+    claimedRole: overrides.claimedRole || "admin"
+  }), memberKeys);
+}
+
+async function expectOk(runtime, op) {
+  const result = await runtime.handleOperation(op);
+  assert.equal(result.ok, true, result.reason || result.code);
+  return result;
+}
+
+async function expectDenied(runtime, op, pattern) {
+  const result = await runtime.handleOperation(op);
+  assert.equal(result.ok, false);
+  assert.match(result.reason || result.code || "", pattern);
+  return result;
+}
+
+test("owner-root revocation cascades through malicious admin grants and downstream admin writes", async () => {
+  const { runtime, keys } = createRuntime();
+  await runtime.start();
+
+  const grantBobAdmin = grantOp("alice", "bob", "admin", keys.alice, { id: "op_alice_grants_bob_admin", seq: 1, createdAt: 1001 });
+  await expectOk(runtime, grantBobAdmin);
+  const grantedState = await runtime.getState();
+  const grantRecord = grantedState.authority.grants.find((grant) => grant.id === grantBobAdmin.id);
+  assert.equal(grantRecord.credentialId, "alice_cred");
+  assert.equal(typeof grantRecord.signature, "string");
+  assert.equal(grantRecord.createdAt, 1001);
+  const bobAdminPost = postOp("bob", "bob_admin_post", keys.bob, { id: "op_bob_admin_post", seq: 2, createdAt: 1002 });
+  await expectOk(runtime, bobAdminPost);
+
+  const grantCarolAdmin = grantOp("bob", "carol", "admin", keys.bob, { id: "op_bob_grants_carol_admin", seq: 3, createdAt: 1003 });
+  await expectOk(runtime, grantCarolAdmin);
+  const carolAdminPost = postOp("carol", "carol_admin_post", keys.carol, { id: "op_carol_admin_post", seq: 4, createdAt: 1004 });
+  await expectOk(runtime, carolAdminPost);
+
+  const demoteRealAdmin = grantOp("alice", "realAdmin", "member", keys.alice, { id: "op_alice_demotes_real_admin", seq: 5, createdAt: 1005 });
+  await expectOk(runtime, demoteRealAdmin);
+
+  await expectOk(runtime, revokeOp("olivia", {
+    target: "alice",
+    voidGrantIds: [grantBobAdmin.id, demoteRealAdmin.id],
+    scope: "all-by-target",
+    cascade: true
+  }, keys.olivia, { id: "op_olivia_revokes_alice_spree", seq: 6, createdAt: 1006 }));
+
+  const state = await runtime.getState();
+  assert.equal(state.members.olivia.role, "owner");
+  assert.equal(state.members.alice.role, "admin");
+  assert.equal(state.members.realAdmin.role, "admin");
+  assert.equal(state.members.bob.role, "member");
+  assert.equal(state.members.carol.role, "member");
+  assert.deepEqual(state.plugins[PLUGIN_ID].posts, []);
+  assert.equal(state.authority.tombstones[grantBobAdmin.id].reason, "voided-by-revocation");
+  assert.equal(state.authority.tombstones[demoteRealAdmin.id].reason, "voided-by-revocation");
+  assert.equal(state.authority.tombstones[bobAdminPost.id].reason, "unauthorized-operation");
+  assert.equal(state.authority.tombstones[grantCarolAdmin.id].reason, "unauthorized-authority-grant");
+  assert.equal(state.authority.tombstones[carolAdminPost.id].reason, "unauthorized-operation");
+});
+
+test("admin cannot demote or revoke a genesis owner", async () => {
+  const { runtime, keys } = createRuntime();
+  await runtime.start();
+
+  await expectDenied(runtime, grantOp("alice", "olivia", "member", keys.alice, {
+    id: "op_alice_demotes_owner",
+    createdAt: 2001,
+    claimedRole: "admin"
+  }), /owner|authority|forbidden/i);
+
+  const state = await runtime.getState();
+  assert.equal(state.members.olivia.role, "owner");
+});
+
+test("from-point revocation leaves pre-cut grants and content intact", async () => {
+  const { runtime, keys } = createRuntime();
+  await runtime.start();
+
+  await expectOk(runtime, postOp("alice", "legit_pre_cut", keys.alice, { id: "op_alice_pre_cut", createdAt: 2999 }));
+  const grantBobAdmin = grantOp("alice", "bob", "admin", keys.alice, { id: "op_alice_late_bob_admin", createdAt: 3001 });
+  await expectOk(runtime, grantBobAdmin);
+  await expectOk(runtime, postOp("bob", "late_bob_post", keys.bob, { id: "op_late_bob_post", createdAt: 3002 }));
+
+  await expectOk(runtime, revokeOp("olivia", {
+    target: "alice",
+    voidFrom: grantBobAdmin.hlc,
+    scope: "from-point",
+    cascade: true
+  }, keys.olivia, { id: "op_olivia_from_point", createdAt: 3003 }));
+
+  const state = await runtime.getState();
+  assert.deepEqual(state.plugins[PLUGIN_ID].posts.map((post) => post.id), ["legit_pre_cut"]);
+  assert.equal(state.members.bob.role, "member");
+  assert.equal(state.authority.tombstones[grantBobAdmin.id].reason, "voided-by-revocation");
+});
+
+const { createAuthorityState, resolveAuthorityOperations } = require("../src/index.cjs");
+
+function coreUnsigned(memberId, type, payload, id, createdAt, overrides = {}) {
+  return ensureOperationIdentity({
+    roomId: ROOM_ID,
+    appPackId: APP_PACK.id,
+    appPackHash: APP_PACK.hash,
+    pluginId: overrides.pluginId || "matterhorn.core",
+    type,
+    actor: { memberId, deviceId: `dev_${memberId}`, role: "admin" },
+    seq: 1,
+    createdAt,
+    hlc: overrides.hlc,
+    payload,
+    auth: { credentialId: `${memberId}_cred`, signature: "sig" }
+  }, { now: createdAt, nodeId: `dev_${memberId}` });
+}
+
+test("authority resolution is deterministic across shuffled arrival order", () => {
+  const authority = createAuthorityState({
+    ownerIds: ["olivia"],
+    grants: [
+      { id: "grant_alice_admin", granter: "olivia", target: "alice", role: "admin", createdAt: 10 },
+      { id: "grant_bob_member", granter: "olivia", target: "bob", role: "member", createdAt: 11 }
+    ]
+  });
+  const grantBobAdmin = coreUnsigned("alice", "authority.grant", { target: "bob", role: "admin" }, "op_grant_bob_admin", 100);
+  const revokeAliceGrant = coreUnsigned("olivia", "authority.revoke", { target: "alice", voidGrantIds: [grantBobAdmin.id], scope: "all-by-target", cascade: true }, "op_revoke_alice_grant", 101);
+
+  const left = resolveAuthorityOperations({ authority, operations: [grantBobAdmin, revokeAliceGrant] });
+  const right = resolveAuthorityOperations({ authority, operations: [revokeAliceGrant, grantBobAdmin] });
+
+  assert.deepEqual(left.derivedRoles, right.derivedRoles);
+  assert.deepEqual(left.tombstones, right.tombstones);
+  assert.equal(left.derivedRoles.bob, "member");
+  assert.equal(left.tombstones[grantBobAdmin.id].reason, "voided-by-revocation");
+});
+
+test("concurrent mutual admin revocation converges by deterministic operation order", () => {
+  const authority = createAuthorityState({
+    ownerIds: ["olivia"],
+    grants: [
+      { id: "grant_alice_admin", granter: "olivia", target: "alice", role: "admin", createdAt: 10 },
+      { id: "grant_bob_admin", granter: "olivia", target: "bob", role: "admin", createdAt: 11 }
+    ]
+  });
+  const aliceRevokesBob = coreUnsigned("alice", "authority.revoke", { target: "bob", voidGrantIds: ["grant_bob_admin"], scope: "all-by-target", cascade: true }, "a_revokes_bob", 100);
+  const bobRevokesAlice = coreUnsigned("bob", "authority.revoke", { target: "alice", voidGrantIds: ["grant_alice_admin"], scope: "all-by-target", cascade: true }, "b_revokes_alice", 100);
+
+  const resolved = resolveAuthorityOperations({ authority, operations: [bobRevokesAlice, aliceRevokesBob] });
+
+  assert.equal(resolved.derivedRoles.alice, "admin");
+  assert.equal(resolved.derivedRoles.bob, undefined);
+  assert.equal(resolved.tombstones.grant_bob_admin.reason, "voided-by-revocation");
+  assert.equal(resolved.tombstones[bobRevokesAlice.id].reason, "unauthorized-authority-revocation");
+});
+
+test("authority replay tombstones malformed, unknown, and narrowing-denied log entries", async () => {
+  const { runtime, operationLog, keys } = createRuntime();
+  await runtime.start();
+
+  const missingPlugin = coreUnsigned("alice", "not.core", {}, "op_missing_plugin", 401, { pluginId: "com.matterhorn.missing" });
+  const unknownType = coreUnsigned("alice", "unknown.type", {}, "op_unknown_type", 402, { pluginId: PLUGIN_ID });
+  const invalidPayload = sign(unsigned("alice", PLUGIN_ID, "admin.post", {}, { id: "op_invalid_payload", createdAt: 403, claimedRole: "admin" }), keys.alice);
+  const pluginDenied = sign(unsigned("alice", PLUGIN_ID, "narrow.post", { id: "narrow" }, { id: "op_plugin_denied", createdAt: 404, claimedRole: "admin" }), keys.alice);
+  const invalidCredentialRevoke = sign(unsigned("alice", "matterhorn.core", "credential.revoke", {}, { id: "op_invalid_credential_revoke", createdAt: 405, claimedRole: "admin" }), keys.alice);
+  const unauthorizedCredentialRevoke = sign(unsigned("memberOnly", "matterhorn.core", "credential.revoke", { credentialId: "alice_cred" }, { id: "op_unauthorized_credential_revoke", createdAt: 406, claimedRole: "member" }), keys.memberOnly);
+  operationLog.entries.push(missingPlugin, unknownType, invalidPayload, pluginDenied, invalidCredentialRevoke, unauthorizedCredentialRevoke);
+
+  await expectOk(runtime, revokeOp("olivia", {
+    target: "alice",
+    scope: "future",
+    cascade: true
+  }, keys.olivia, { id: "op_replay_cleanup", createdAt: 407 }));
+
+  const state = await runtime.getState();
+  assert.equal(state.authority.tombstones[missingPlugin.id].reason, "plugin-not-installed");
+  assert.equal(state.authority.tombstones[unknownType.id].reason, "unknown-operation-type");
+  assert.equal(state.authority.tombstones[invalidPayload.id].reason, "invalid-payload");
+  assert.equal(state.authority.tombstones[pluginDenied.id].reason, "plugin-denied");
+  assert.equal(state.authority.tombstones[invalidCredentialRevoke.id].reason, "invalid-credential-revocation");
+  assert.equal(state.authority.tombstones[unauthorizedCredentialRevoke.id].reason, "unauthorized-credential-revocation");
+});
+
+test("authority ordering honors HLC before createdAt and id fallback", () => {
+  const { sortOperations } = require("../src/index.cjs");
+  const ordered = sortOperations([
+    { id: "late", createdAt: 1, hlc: "000000000000002:000000:node" },
+    { id: "early-b", createdAt: 99, hlc: "000000000000001:000000:node" },
+    { id: "early-a", createdAt: 1, hlc: "000000000000001:000000:node" }
+  ]);
+  assert.deepEqual(ordered.map((op) => op.id), ["early-a", "early-b", "late"]);
+});
+
+test("authority resolver and replay record invalid authority entries deterministically", async () => {
+  const authority = createAuthorityState({ ownerIds: ["olivia"] });
+  const badGrant = coreUnsigned("olivia", "authority.grant", { target: "", role: "admin" }, "op_bad_grant", 1);
+  const badRevoke = ensureOperationIdentity({
+    roomId: ROOM_ID,
+    appPackId: APP_PACK.id,
+    appPackHash: APP_PACK.hash,
+    pluginId: "matterhorn.core",
+    type: "authority.revoke",
+    actor: {},
+    seq: 1,
+    createdAt: 2,
+    payload: { scope: "future" },
+    auth: { credentialId: "olivia_cred", signature: "sig" }
+  }, { now: 2, nodeId: "dev_olivia" });
+  const resolved = resolveAuthorityOperations({ authority, operations: [badGrant, badRevoke] });
+  assert.equal(resolved.tombstones[badGrant.id].reason, "invalid-authority-grant");
+  assert.equal(resolved.tombstones[badRevoke.id].reason, "invalid-authority-revocation");
+
+  const { runtime, operationLog, keys } = createRuntime();
+  await runtime.start();
+  const replayBadGrant = coreUnsigned("alice", "authority.grant", { target: "", role: "admin" }, "op_replay_bad_grant", 501);
+  const wrongRoom = { ...coreUnsigned("alice", "authority.grant", { target: "bob", role: "admin" }, "op_wrong_room", 502), roomId: "other_room" };
+  operationLog.entries.push(replayBadGrant);
+  operationLog.entries.push(wrongRoom);
+
+  await expectOk(runtime, revokeOp("olivia", { target: "alice", scope: "future", cascade: true }, keys.olivia, { id: "op_trigger_invalid_replay", createdAt: 503 }));
+  const state = await runtime.getState();
+  assert.equal(state.authority.tombstones[replayBadGrant.id].reason, "invalid-authority-grant");
+  assert.equal(state.authority.tombstones[wrongRoom.id].reason, "invalid-operation");
+});