@mh-gg/relay-runtime 0.1.1-alpha.20260613T085325975Z

package/test/operation-role-keys.test.cjs

@@ -0,0 +1,346 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+
+const { manifestHash } = require("@mh-gg/base");
+const {
+  createOperationGrantAuthority,
+  createOperationRoleKeyGrant,
+  generateOperationGrantAuthorityKeyPair,
+  generateOperationRoleKeyPair,
+  signOperationRoleKeyGrant,
+  signOperationWithRoleKey
+} = require("@mh-gg/host-runtime");
+const { createRelayPluginRuntimeManager } = require("../src/index.cjs");
+const { kanbanAppPack, kanbanHostPlugins, KANBAN_PLUGIN_ID } = require("../../../examples/kanban/src/sdk-app.mjs");
+
+const ROOM_ID = "room_relay_role_keys";
+const APP_HASH = manifestHash(kanbanAppPack);
+
+function actor(role = "member", memberId = "member") {
+  return { memberId, deviceId: `dev_${memberId}`, role, displayName: memberId };
+}
+
+function operation(overrides = {}) {
+  return {
+    clientOperationId: overrides.id || "op_1",
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash: APP_HASH,
+    pluginId: overrides.pluginId || KANBAN_PLUGIN_ID,
+    type: overrides.type || "list.create",
+    actor: overrides.actor || actor("admin", "alice"),
+    seq: overrides.seq || 1,
+    createdAt: overrides.createdAt || 1000,
+    payload: overrides.payload || { title: "Backlog" },
+    auth: { credentialId: overrides.credentialId || "placeholder", signature: "placeholder" },
+    ...overrides
+  };
+}
+
+function makeKeys(options = {}) {
+  const appPackHash = options.appPackHash || APP_HASH;
+  const authorityKey = generateOperationGrantAuthorityKeyPair({ issuer: "room-owner" });
+  const authority = createOperationGrantAuthority({
+    issuer: authorityKey.issuer,
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash,
+    publicKeyPem: authorityKey.publicKeyPem,
+    issuedAt: 50
+  });
+  const adminKey = generateOperationRoleKeyPair({ role: "admin" });
+  const userKey = generateOperationRoleKeyPair({ role: "user" });
+  const unsignedAdminGrant = createOperationRoleKeyGrant({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash,
+    credentialId: "admin_cred",
+    memberId: "alice",
+    deviceId: "dev_alice",
+    role: "admin",
+    publicKeyPem: adminKey.publicKeyPem,
+    issuedAt: 100
+  });
+  const unsignedUserGrant = createOperationRoleKeyGrant({
+    roomId: ROOM_ID,
+    appPackId: kanbanAppPack.id,
+    appPackHash,
+    credentialId: "user_cred",
+    memberId: "bob",
+    deviceId: "dev_bob",
+    role: "user",
+    publicKeyPem: userKey.publicKeyPem,
+    issuedAt: 100
+  });
+  const adminGrant = options.unsigned ? unsignedAdminGrant : signOperationRoleKeyGrant(unsignedAdminGrant, { authority, privateKeyPem: authorityKey.privateKeyPem, signedAt: 150 });
+  const userGrant = options.unsigned ? unsignedUserGrant : signOperationRoleKeyGrant(unsignedUserGrant, { authority, privateKeyPem: authorityKey.privateKeyPem, signedAt: 150 });
+  return { authorityKey, authority, adminKey, userKey, adminGrant, userGrant, unsignedAdminGrant, unsignedUserGrant, grants: [adminGrant, userGrant], unsignedGrants: [unsignedAdminGrant, unsignedUserGrant], grantAuthorities: [authority] };
+}
+
+function sign(op, key, grant) {
+  return signOperationWithRoleKey({ ...op, auth: { credentialId: grant.credentialId } }, { privateKeyPem: key.privateKeyPem, grant, now: () => op.createdAt || 1000 });
+}
+
+async function enableRelay(keys) {
+  const manager = createRelayPluginRuntimeManager({ relayAddress: "relay-role-key", now: () => 5000 });
+  await manager.enableRoomComposition({
+    roomName: ROOM_ID,
+    appPack: kanbanAppPack,
+    plugins: kanbanHostPlugins,
+    operationRoleKeyGrants: keys.grants,
+    operationGrantAuthorities: keys.grantAuthorities
+  });
+  return manager;
+}
+
+test("relay runtime verifies role-key operation signatures without private/master keys", async () => {
+  const keys = makeKeys();
+  const manager = await enableRelay(keys);
+  const app = manager.roomApp(ROOM_ID);
+  assert.equal(JSON.stringify(app).includes("PRIVATE KEY"), false);
+  assert.equal(app.operationAuth.grants.length, 2);
+  assert.equal(app.operationAuth.authorities.length, 1);
+  assert.equal(JSON.stringify(app.operationAuth).includes("PRIVATE KEY"), false);
+
+  const forged = sign(operation({ id: "op_forged", actor: actor("admin", "bob") }), keys.userKey, keys.userGrant);
+  const rejected = await manager.handleClientOperation({
+    roomName: ROOM_ID,
+    peerId: "bob-peer",
+    message: { type: "client/operation", protocol: 1, roomName: ROOM_ID, clientId: "bob", operation: forged },
+    sendToClient: () => {},
+    broadcastToRoom: () => {}
+  });
+  assert.equal(rejected.ok, false);
+  assert.match(rejected.reason, /Admins only|Forbidden|Operation is not allowed|requires admin/);
+
+  const adminList = sign(operation({ id: "op_admin", actor: actor("admin", "alice") }), keys.adminKey, keys.adminGrant);
+  assert.equal((await manager.handleClientOperation({
+    roomName: ROOM_ID,
+    peerId: "alice-peer",
+    message: { type: "client/operation", protocol: 1, roomName: ROOM_ID, clientId: "alice", operation: adminList },
+    sendToClient: () => {},
+    broadcastToRoom: () => {}
+  })).ok, true);
+
+  const listId = (await manager.snapshot(ROOM_ID)).state.plugins[KANBAN_PLUGIN_ID].lists[0].id;
+  const userCard = sign(operation({
+    id: "op_user_card",
+    seq: 2,
+    type: "card.create",
+    actor: actor("admin", "bob"),
+    payload: { listId, title: "Relay accepted user-key member write" },
+    createdAt: 1001
+  }), keys.userKey, keys.userGrant);
+  assert.equal((await manager.handleClientOperation({
+    roomName: ROOM_ID,
+    peerId: "bob-peer",
+    message: { type: "client/operation", protocol: 1, roomName: ROOM_ID, clientId: "bob", operation: userCard },
+    sendToClient: () => {},
+    broadcastToRoom: () => {}
+  })).ok, true);
+});
+
+test("relay-to-relay portable operations reject tampered role-key signatures", async () => {
+  const keys = makeKeys();
+  const relayA = await enableRelay(keys);
+  const relayB = await enableRelay(keys);
+  const envelopes = [];
+  const adminList = sign(operation({ id: "op_admin", actor: actor("admin", "alice") }), keys.adminKey, keys.adminGrant);
+  await relayA.handleClientOperation({
+    roomName: ROOM_ID,
+    peerId: "alice-peer",
+    message: { type: "client/operation", protocol: 1, roomName: ROOM_ID, clientId: "alice", operation: adminList },
+    sendToClient: () => {},
+    broadcastToRoom: () => {},
+    broadcastToMesh: (message) => envelopes.push(message)
+  });
+
+  const tampered = {
+    ...envelopes[0],
+    operation: {
+      ...envelopes[0].operation,
+      payload: { title: "Tampered by relay" }
+    }
+  };
+  const rejected = await relayB.handleRelayOperation(tampered);
+  assert.equal(rejected.ok, false);
+  assert.match(rejected.reason, /signature|invalid|Forbidden|Admins only|Operation is not allowed|operation\.id|content hash/);
+  assert.equal((await relayB.snapshot(ROOM_ID)).state.version, 0);
+
+  const accepted = await relayB.handleRelayOperation(envelopes[0]);
+  assert.equal(accepted.ok, true);
+  assert.equal((await relayB.snapshot(ROOM_ID)).state.version, 1);
+});
+
+test("relay-owned runtime rejects unsigned operation role-key grants unless explicitly allowed", async () => {
+  const keys = makeKeys({ unsigned: true });
+  const manager = createRelayPluginRuntimeManager();
+  await assert.rejects(() => manager.enableRoomComposition({
+    roomName: ROOM_ID,
+    appPack: kanbanAppPack,
+    plugins: kanbanHostPlugins,
+    operationRoleKeyGrants: keys.unsignedGrants
+  }), /grant authority|signed|unsigned/i);
+
+  const devManager = createRelayPluginRuntimeManager({ allowUnsignedOperationRoleKeyGrants: true });
+  await devManager.enableRoomComposition({
+    roomName: ROOM_ID,
+    appPack: kanbanAppPack,
+    plugins: kanbanHostPlugins,
+    operationRoleKeyGrants: keys.unsignedGrants,
+    operationGrantAuthorities: keys.grantAuthorities
+  });
+  assert.equal(devManager.hasRoom(ROOM_ID), true);
+});
+
+test("relay-owned runtime accepts public role-key grants from common collection shapes", async () => {
+  const keys = makeKeys();
+  const cases = [
+    { name: "map", grants: new Map([["admin", keys.adminGrant], ["user", keys.userGrant]]), authorities: keys.grantAuthorities, expected: 2 },
+    { name: "single", grants: keys.adminGrant, authorities: keys.grantAuthorities, expected: 1 },
+    { name: "object", grants: { admin: keys.adminGrant, user: keys.userGrant }, authorities: { owner: keys.authority }, expected: 2 }
+  ];
+
+  for (const collection of cases) {
+    const manager = createRelayPluginRuntimeManager({ relayAddress: `relay-${collection.name}` });
+    await manager.enableRoomComposition({
+      roomName: ROOM_ID,
+      appPack: kanbanAppPack,
+      plugins: kanbanHostPlugins,
+      operationRoleKeyGrants: collection.grants,
+      operationGrantAuthorities: collection.authorities
+    });
+    assert.equal(manager.roomApp(ROOM_ID).operationAuth.grants.length, collection.expected);
+  }
+});
+
+test("relay-owned runtime accepts same-app historical signed operations during catch-up", async () => {
+  const oldHash = "sha256-old-kanban-schema";
+  const keys = makeKeys({ appPackHash: oldHash });
+  const manager = createRelayPluginRuntimeManager({ relayAddress: "relay-role-key-upgrade", now: () => 5000 });
+  await manager.enableRoomComposition({
+    roomName: ROOM_ID,
+    appPack: kanbanAppPack,
+    plugins: kanbanHostPlugins,
+    operationRoleKeyGrants: keys.grants,
+    operationGrantAuthorities: keys.grantAuthorities
+  });
+  const oldOperation = sign(operation({
+    id: "op_historical_signed",
+    appPackHash: oldHash,
+    actor: actor("admin", "alice")
+  }), keys.adminKey, keys.adminGrant);
+
+  const result = await manager.handleRelayOperation({
+    type: "relay.matterhorn-operation",
+    roomName: ROOM_ID,
+    operation: oldOperation
+  });
+
+  assert.equal(result.ok, true, result.reason);
+  assert.equal((await manager.snapshot(ROOM_ID)).state.plugins[KANBAN_PLUGIN_ID].lists[0].title, "Backlog");
+});
+
+test("relay-owned runtime returns current state with ordinary relay operation rejections", async () => {
+  const keys = makeKeys();
+  const manager = await enableRelay(keys);
+  const forbidden = sign(operation({
+    id: "op_forbidden_relay",
+    actor: actor("member", "bob")
+  }), keys.userKey, keys.userGrant);
+
+  const result = await manager.handleRelayOperation({
+    type: "relay.matterhorn-operation",
+    id: "relay-b:forbidden",
+    roomName: ROOM_ID,
+    operation: forbidden
+  });
+
+  assert.equal(result.ok, false);
+  assert.equal(result.state.version, 0);
+});
+
+test("secure relay snapshot sync requires replayable signed operation proof", async () => {
+  const keys = makeKeys();
+  const relayA = await enableRelay(keys);
+  const relayB = await enableRelay(keys);
+  const envelopes = [];
+  const adminList = sign(operation({ id: "op_snapshot_proof", actor: actor("admin", "alice") }), keys.adminKey, keys.adminGrant);
+  await relayB.handleClientOperation({
+    roomName: ROOM_ID,
+    peerId: "alice-peer",
+    message: { type: "client/operation", protocol: 1, roomName: ROOM_ID, clientId: "alice", operation: adminList },
+    sendToClient: () => {},
+    broadcastToRoom: () => {},
+    broadcastToMesh: (message) => envelopes.push(message)
+  });
+
+  const provenSnapshot = await relayB.snapshot(ROOM_ID);
+  const tamperedState = {
+    ...provenSnapshot.state,
+    version: provenSnapshot.state.version + 100,
+    plugins: {
+      ...provenSnapshot.state.plugins,
+      [KANBAN_PLUGIN_ID]: {
+        ...provenSnapshot.state.plugins[KANBAN_PLUGIN_ID],
+        lists: [{ id: "evil", title: "Forged state", cardIds: [] }]
+      }
+    }
+  };
+
+  const rejectedBare = await relayA.syncSnapshot(ROOM_ID, tamperedState);
+  assert.equal(rejectedBare.updated, false);
+  assert.match(rejectedBare.reason, /proof|operation|verify/i);
+  assert.equal((await relayA.snapshot(ROOM_ID)).state.version, 0);
+
+  const accepted = await relayA.syncSnapshot(ROOM_ID, provenSnapshot);
+  assert.equal(accepted.updated, true);
+  assert.equal((await relayA.snapshot(ROOM_ID)).state.version, provenSnapshot.state.version);
+});
+
+test("secure relay operation envelopes can prove missed history for catch-up", async () => {
+  const keys = makeKeys();
+  const relayA = await enableRelay(keys);
+  const relayB = await enableRelay(keys);
+
+  const listOp = sign(operation({ id: "op_catchup_list", actor: actor("admin", "alice") }), keys.adminKey, keys.adminGrant);
+  assert.equal((await relayB.handleClientOperation({
+    roomName: ROOM_ID,
+    peerId: "alice-peer",
+    message: { type: "client/operation", protocol: 1, roomName: ROOM_ID, clientId: "alice", operation: listOp },
+    sendToClient: () => {},
+    broadcastToRoom: () => {},
+    broadcastToMesh: () => {}
+  })).ok, true);
+  const listId = (await relayB.snapshot(ROOM_ID)).state.plugins[KANBAN_PLUGIN_ID].lists[0].id;
+  const cardOp = sign(operation({
+    id: "op_catchup_card",
+    seq: 2,
+    type: "card.create",
+    actor: actor("member", "bob"),
+    payload: { listId, title: "Catch up through proof" },
+    createdAt: 1001
+  }), keys.userKey, keys.userGrant);
+  assert.equal((await relayB.handleClientOperation({
+    roomName: ROOM_ID,
+    peerId: "bob-peer",
+    message: { type: "client/operation", protocol: 1, roomName: ROOM_ID, clientId: "bob", operation: cardOp },
+    sendToClient: () => {},
+    broadcastToRoom: () => {},
+    broadcastToMesh: () => {}
+  })).ok, true);
+
+  const provenSnapshot = await relayB.snapshot(ROOM_ID);
+  const catchup = await relayA.handleRelayOperation({
+    type: "relay.matterhorn-operation",
+    id: "relay-b:catchup",
+    roomName: ROOM_ID,
+    operation: cardOp,
+    state: provenSnapshot.state,
+    operations: provenSnapshot.operations
+  });
+  assert.equal(catchup.ok, true);
+  const stateA = (await relayA.snapshot(ROOM_ID)).state;
+  assert.equal(stateA.version, 2);
+  assert.equal(stateA.plugins[KANBAN_PLUGIN_ID].lists[0].cardIds.length, 1);
+});