@onekeyfe/hd-core 1.2.0-alpha.41 → 1.2.0-alpha.43

package/__tests__/pro2Nft.test.ts

@@ -0,0 +1,108 @@
+import { blake2s } from '@noble/hashes/blake2s';
+import { bytesToHex } from '@noble/hashes/utils';
+
+import {
+  PRO2_NFT_IMAGE_HEIGHT,
+  PRO2_NFT_IMAGE_WIDTH,
+  PRO2_NFT_THUMBNAIL_HEIGHT,
+  PRO2_NFT_THUMBNAIL_WIDTH,
+  buildPro2NftBundle,
+} from '../src/utils/pro2Nft';
+
+const rgba = (width: number, height: number, alpha = 0xff) => {
+  const data = new Uint8Array(width * height * 4);
+  for (let index = 3; index < data.length; index += 4) data[index] = alpha;
+  return data;
+};
+
+describe('buildPro2NftBundle', () => {
+  test('builds the exact Pro2 RGB565 triplet and basename', () => {
+    const bundle = buildPro2NftBundle({
+      image: {
+        width: PRO2_NFT_IMAGE_WIDTH,
+        height: PRO2_NFT_IMAGE_HEIGHT,
+        rgba: rgba(PRO2_NFT_IMAGE_WIDTH, PRO2_NFT_IMAGE_HEIGHT),
+      },
+      thumbnail: {
+        width: PRO2_NFT_THUMBNAIL_WIDTH,
+        height: PRO2_NFT_THUMBNAIL_HEIGHT,
+        rgba: rgba(PRO2_NFT_THUMBNAIL_WIDTH, PRO2_NFT_THUMBNAIL_HEIGHT),
+      },
+      title: 'CryptoPunk #3100',
+      subtitle: 'CryptoPunks',
+      timestampMs: 1_760_000_000_000,
+    });
+
+    expect(bundle.image.byteLength).toBe(583_212);
+    expect(bundle.thumbnail.byteLength).toBe(138_876);
+    expect(Array.from(bundle.image.slice(0, 12))).toEqual([
+      0x19, 0x12, 0, 0, 28, 2, 28, 2, 56, 4, 0, 0,
+    ]);
+    expect(Array.from(bundle.thumbnail.slice(0, 12))).toEqual([
+      0x19, 0x12, 0, 0, 7, 1, 7, 1, 16, 2, 0, 0,
+    ]);
+    expect(new TextDecoder().decode(bundle.metadata)).toBe(
+      '{"title":"CryptoPunk #3100","subtitle":"CryptoPunks"}'
+    );
+    expect(bytesToHex(blake2s(bundle.image))).toBe(
+      'af4b5f8fe216cfd0ef4a9162a42b5c66a73466f2491066f66f756c4e28cc869e'
+    );
+    expect(bytesToHex(blake2s(bundle.thumbnail))).toBe(
+      '44591afae1163cc14651d77644501c6a110f96506889b825cab0351ff4de857d'
+    );
+    expect(bytesToHex(blake2s(bundle.metadata))).toBe(
+      'e30d4dc2cddd441c9f1438c783e05a623ccf76f2f6219d4281769dda1b3635b5'
+    );
+    expect(bundle.basename).toBe('nft-af4b5f8f-1760000000000');
+  });
+
+  test('composites transparent pixels onto black without an alpha plane', () => {
+    const image = rgba(PRO2_NFT_IMAGE_WIDTH, PRO2_NFT_IMAGE_HEIGHT);
+    image.set([255, 255, 255, 0], 0);
+    const bundle = buildPro2NftBundle({
+      image: { width: PRO2_NFT_IMAGE_WIDTH, height: PRO2_NFT_IMAGE_HEIGHT, rgba: image },
+      thumbnail: {
+        width: PRO2_NFT_THUMBNAIL_WIDTH,
+        height: PRO2_NFT_THUMBNAIL_HEIGHT,
+        rgba: rgba(PRO2_NFT_THUMBNAIL_WIDTH, PRO2_NFT_THUMBNAIL_HEIGHT, 0),
+      },
+      title: 'NFT',
+      subtitle: '',
+      timestampMs: 1,
+    });
+
+    expect(bundle.image[1]).toBe(0x12);
+    expect(Array.from(bundle.image.slice(12, 14))).toEqual([0, 0]);
+    expect(bundle.thumbnail.byteLength).toBe(138_876);
+  });
+
+  test('rejects invalid dimensions and metadata byte lengths', () => {
+    const validThumbnail = {
+      width: PRO2_NFT_THUMBNAIL_WIDTH,
+      height: PRO2_NFT_THUMBNAIL_HEIGHT,
+      rgba: rgba(PRO2_NFT_THUMBNAIL_WIDTH, PRO2_NFT_THUMBNAIL_HEIGHT),
+    };
+    expect(() =>
+      buildPro2NftBundle({
+        image: { width: 1, height: 1, rgba: new Uint8Array(4) },
+        thumbnail: validThumbnail,
+        title: 'NFT',
+        subtitle: '',
+        timestampMs: 1,
+      })
+    ).toThrow('540x540');
+    expect(() =>
+      buildPro2NftBundle({
+        image: {
+          width: PRO2_NFT_IMAGE_WIDTH,
+          height: PRO2_NFT_IMAGE_HEIGHT,
+          rgba: rgba(PRO2_NFT_IMAGE_WIDTH, PRO2_NFT_IMAGE_HEIGHT),
+        },
+        thumbnail: validThumbnail,
+        title: 'a'.repeat(64),
+        subtitle: '',
+        timestampMs: 1,
+      })
+    ).toThrow('1 to 63');
+  });
+});

package/__tests__/protocol-v2-resources.test.ts

@@ -0,0 +1,204 @@
+import axios from 'axios';
+import { sha256 } from '@noble/hashes/sha256';
+
+import { DataManager } from '../src/data-manager';
+import {
+  PROTOCOL_V2_RESOURCE_DEVICE_PATHS,
+  PROTOCOL_V2_RESOURCE_TYPES,
+  buildProtocolV2ResourceUpdatePlan,
+  isProtocolV2ResourceFileValid,
+  parseProtocolV2ResourceInventory,
+  parseProtocolV2Resources,
+  requestProtocolV2ResourceInventory,
+} from '../src/protocols/protocol-v2/resources';
+
+import type { ConnectSettings, IProtocolV2Resource, RemoteConfigResponse } from '../src/types';
+
+jest.mock('axios');
+jest.mock('../src/data/config', () => ({
+  getSDKVersion: jest.fn(() => '1.0.0-test'),
+  DEFAULT_DOMAIN: 'https://jssdk.onekey.so/1.0.0-test/',
+}));
+
+const bytesToHex = (bytes: Uint8Array) =>
+  Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('');
+
+const resources: IProtocolV2Resource[] = PROTOCOL_V2_RESOURCE_TYPES.map((type, index) => ({
+  type,
+  url: `https://example.com/${type}.okpkg`,
+  size: index + 100,
+  fileHash: index.toString(16).padStart(64, '0'),
+  headerHash: index.toString(16).padStart(128, '0'),
+}));
+
+const createSettings = (configFetcher: ConnectSettings['configFetcher']): ConnectSettings =>
+  ({
+    env: 'node',
+    fetchConfig: true,
+    preRelease: true,
+    configFetcher,
+  } as ConnectSettings);
+
+const createRemoteConfig = (): RemoteConfigResponse =>
+  ({
+    classic: { firmware: [], ble: [] },
+    classic1s: { firmware: [], ble: [] },
+    classicpure: { firmware: [], ble: [] },
+    mini: { firmware: [], ble: [] },
+    touch: { firmware: [], ble: [] },
+    pro: { firmware: [], ble: [] },
+    pro2: { firmware: [], ble: [], resources: { stable: resources } },
+    bridge: {},
+  } as unknown as RemoteConfigResponse);
+
+describe('Pro2 resource configuration', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    DataManager.lastCheckTimestamp = 0;
+  });
+
+  test('accepts exactly six resources and normalizes their deterministic order', () => {
+    const parsed = parseProtocolV2Resources({ stable: [...resources].reverse() });
+
+    expect(parsed?.stable.map(item => item.type)).toEqual(PROTOCOL_V2_RESOURCE_TYPES);
+    expect(PROTOCOL_V2_RESOURCE_DEVICE_PATHS.translations).toBe(
+      'vol0:/bundles/translations/translations.okpkg'
+    );
+  });
+
+  test('rejects incomplete, duplicate, or malformed stable sets', () => {
+    expect(() => parseProtocolV2Resources({ stable: resources.slice(1) })).toThrow(
+      'six unique resource types'
+    );
+    expect(() =>
+      parseProtocolV2Resources({ stable: [...resources.slice(0, 5), resources[0]] })
+    ).toThrow('six unique resource types');
+    expect(() =>
+      parseProtocolV2Resources({
+        stable: resources.map((resource, index) =>
+          index === 0 ? { ...resource, headerHash: 'bad' } : resource
+        ),
+      })
+    ).toThrow('headerHash');
+  });
+
+  test('downloads nothing when all resource identities match', () => {
+    const inventory = resources.map(({ type, size, headerHash }) => ({ type, size, headerHash }));
+
+    expect(
+      buildProtocolV2ResourceUpdatePlan({ resources, inventory, mode: 'application' })
+    ).toEqual({ status: 'valid', resources: [] });
+  });
+
+  test('normalizes the success-only ResourceInventory RPC response', async () => {
+    const items = resources.slice(0, 2).map((resource, index) => ({
+      type: index === 0 ? 'IMAGES' : 1,
+      size: resource.size,
+      header_hash: resource.headerHash,
+    }));
+    const typedCall = jest.fn().mockResolvedValue({ message: { items } });
+
+    await expect(
+      requestProtocolV2ResourceInventory({ commands: { typedCall } as any })
+    ).resolves.toEqual([
+      {
+        type: 'images',
+        size: resources[0].size,
+        headerHash: resources[0].headerHash,
+      },
+      {
+        type: 'animation',
+        size: resources[1].size,
+        headerHash: resources[1].headerHash,
+      },
+    ]);
+    expect(typedCall).toHaveBeenCalledWith(
+      'ResourceInventoryGet',
+      'ResourceInventory',
+      {},
+      { timeoutMs: 5000 }
+    );
+  });
+
+  test('rejects malformed or duplicate inventory identities', () => {
+    expect(() =>
+      parseProtocolV2ResourceInventory({
+        items: [
+          { type: 'IMAGES', size: 1, header_hash: 'a'.repeat(128) },
+          { type: 'IMAGES', size: 1, header_hash: 'b'.repeat(128) },
+        ],
+      })
+    ).toThrow('duplicate resource type');
+    expect(() =>
+      parseProtocolV2ResourceInventory({
+        items: [{ type: 'IMAGES', size: 1, header_hash: 'bad' }],
+      })
+    ).toThrow('inventory headerHash');
+  });
+
+  test('selects only the changed or missing resource in application mode', () => {
+    const inventory = resources
+      .filter(resource => resource.type !== 'noto')
+      .map(({ type, size, headerHash }) => ({
+        type,
+        size: type === 'images' ? size + 1 : size,
+        headerHash,
+      }));
+
+    const result = buildProtocolV2ResourceUpdatePlan({
+      resources,
+      inventory,
+      mode: 'application',
+    });
+
+    expect(result.status).toBe('outdated');
+    expect(result.resources.map(resource => resource.type)).toEqual(['images', 'noto']);
+  });
+
+  test('reports unknown without an application inventory and selects all in recovery mode', () => {
+    expect(buildProtocolV2ResourceUpdatePlan({ resources, mode: 'application' })).toEqual({
+      status: 'unknown',
+      resources: [],
+    });
+    expect(
+      buildProtocolV2ResourceUpdatePlan({ resources, mode: 'bootloader-recovery' }).resources
+    ).toHaveLength(6);
+  });
+
+  test('verifies both full file size and SHA-256 before transfer', () => {
+    const bytes = new Uint8Array([1, 2, 3]);
+    const binary = bytes.buffer;
+    const identity = { size: bytes.byteLength, fileHash: bytesToHex(sha256(bytes)) };
+
+    expect(isProtocolV2ResourceFileValid(binary, identity)).toBe(true);
+    expect(isProtocolV2ResourceFileValid(binary, { ...identity, size: 4 })).toBe(false);
+    expect(isProtocolV2ResourceFileValid(binary, { ...identity, fileHash: '0'.repeat(64) })).toBe(
+      false
+    );
+  });
+
+  test('applies a validated pre-release config and exposes the stable resource set', async () => {
+    const configFetcher = jest.fn().mockResolvedValue(createRemoteConfig());
+
+    await expect(DataManager.load(createSettings(configFetcher))).resolves.toBe(true);
+
+    expect(configFetcher).toHaveBeenCalledWith(
+      expect.stringMatching(/^https:\/\/data\.onekey\.so\/pre-config\.json\?noCache=/)
+    );
+    expect(DataManager.getProtocolV2Resources()).toEqual(resources);
+  });
+
+  test('does not advance the cache timestamp when refresh fails', async () => {
+    jest.spyOn(axios, 'get').mockRejectedValue(new Error('offline'));
+    const settings = createSettings(jest.fn().mockResolvedValue(null));
+    DataManager.settings = settings;
+
+    await DataManager.checkAndReloadData();
+
+    expect(DataManager.lastCheckTimestamp).toBe(0);
+    await expect(DataManager.forceReloadData()).rejects.toThrow(
+      'Unable to refresh the latest remote config'
+    );
+    expect(DataManager.lastCheckTimestamp).toBe(0);
+  });
+});

package/__tests__/protocol-v2-ui-lifecycle.test.ts

@@ -0,0 +1,91 @@
+import { DeviceSessionPinType } from '@onekeyfe/hd-transport';
+
+import { DEVICE } from '../src/events';
+import { Device } from '../src/device/Device';
+
+jest.mock('../src/data/config', () => ({
+  getSDKVersion: jest.fn(() => '1.0.0-test'),
+  DEFAULT_DOMAIN: 'https://example.com/',
+}));
+
+describe('Protocol V2 UI interaction lifecycle', () => {
+  test('synthesizes finish metadata for a progress-only operation', () => {
+    const device = new Device({ id: 'connect-progress' } as any);
+    device.isProtocolV2 = jest.fn(() => true);
+    device.beginProtocolV2UiInteraction();
+
+    const metadata = device.finishProtocolV2UiInteraction('succeeded', {
+      ensureMetadata: true,
+    });
+
+    expect(metadata).toMatchObject({
+      phase: 'processing',
+      transition: 'finish',
+      outcome: 'succeeded',
+      protocol: 'V2',
+    });
+  });
+
+  test('keeps finish metadata after the Protocol V2 transport is released', () => {
+    const device = new Device({ id: 'connect-released' } as any);
+    const isProtocolV2 = jest.fn().mockReturnValueOnce(true).mockReturnValue(false);
+    device.isProtocolV2 = isProtocolV2;
+    device.beginProtocolV2UiInteraction();
+
+    const metadata = device.finishProtocolV2UiInteraction('succeeded', {
+      ensureMetadata: true,
+    });
+
+    expect(metadata).toMatchObject({
+      phase: 'processing',
+      transition: 'finish',
+      outcome: 'succeeded',
+      protocol: 'V2',
+    });
+  });
+
+  test('emits a matching PIN phase completion after DeviceSessionAskPin succeeds', async () => {
+    const device = new Device({ id: 'connect-1' } as any);
+    device.isProtocolV2 = jest.fn(() => true);
+    device.updateProtocolV2Status = jest.fn(() => undefined as any);
+    device.commands = {
+      typedCall: jest.fn().mockResolvedValue({
+        message: { unlocked: true },
+      }),
+    } as any;
+    device.beginProtocolV2UiInteraction();
+
+    const starts: unknown[] = [];
+    const completions: unknown[] = [];
+    device.on(DEVICE.PIN_ON_DEVICE, (...args) => starts.push(args));
+    device.on(DEVICE.PIN_ON_DEVICE_COMPLETE, (...args) => completions.push(args));
+
+    await device.unlockDevice(DeviceSessionPinType.Main, {
+      source: 'unlock-coordinator',
+      reason: 'device-locked',
+      deviceOnly: true,
+    });
+
+    const startMetadata = (starts[0] as unknown[])[2] as Record<string, unknown>;
+    const completionMetadata = (completions[0] as unknown[])[1] as Record<string, unknown>;
+    expect(startMetadata.interaction).toMatchObject({
+      phase: 'pin',
+      transition: 'start',
+      protocol: 'V2',
+    });
+    expect(completionMetadata).toMatchObject({
+      interactionId: (startMetadata.interaction as { interactionId: string }).interactionId,
+      phaseId: (startMetadata.interaction as { phaseId: string }).phaseId,
+      phase: 'pin',
+      transition: 'complete',
+      outcome: 'succeeded',
+      protocol: 'V2',
+    });
+    expect(completionMetadata.sequence).toBeGreaterThan(
+      (startMetadata.interaction as { sequence: number }).sequence
+    );
+    expect(completionMetadata.phaseId).toBe(
+      (startMetadata.interaction as { phaseId: string }).phaseId
+    );
+  });
+});

package/__tests__/protocol-v2-unlock-policy.test.ts

@@ -1,45 +1,206 @@
-import * as publicMethods from '../src/api';
-import {
-  PROTOCOL_V2_RETRY_ON_LOCKED_METHODS,
-  getProtocolV2UnlockPolicy,
-} from '../src/protocols/protocol-v2/unlockPolicy';
+import ConfluxSignMessageCIP23 from '../src/api/conflux/ConfluxSignMessageCIP23';
+import DeviceLock from '../src/api/device/DeviceLock';
+import { runMethodWithUnlockPolicy } from '../src/protocols/protocol-v2/unlockPolicyRunner';
 
 jest.mock('../src/data/config', () => ({
   DEFAULT_DOMAIN: 'https://example.com/',
   getSDKVersion: () => '0.0.0-test',
 }));
 
-describe('Protocol V2 public method unlock policy', () => {
-  test('classifies the complete public method table with an explicit replay allowlist', () => {
-    const publicMethodNames = Object.keys(publicMethods);
-    const retryMethodNames = new Set<string>(PROTOCOL_V2_RETRY_ON_LOCKED_METHODS);
-
-    expect(publicMethodNames.length).toBeGreaterThan(100);
-    expect(new Set(PROTOCOL_V2_RETRY_ON_LOCKED_METHODS).size).toBe(
-      PROTOCOL_V2_RETRY_ON_LOCKED_METHODS.length
-    );
-
-    for (const methodName of PROTOCOL_V2_RETRY_ON_LOCKED_METHODS) {
-      expect(publicMethods).toHaveProperty(methodName);
-    }
-
-    for (const methodName of publicMethodNames) {
-      expect(getProtocolV2UnlockPolicy(methodName)).toBe(
-        retryMethodNames.has(methodName) ? 'retry-on-locked' : 'none'
-      );
-    }
+describe('Protocol V2 unlock semantics', () => {
+  test('wallet business methods inherit the wallet-session unlock requirement', () => {
+    const method = new ConfluxSignMessageCIP23({
+      id: 1,
+      payload: { method: 'confluxSignMessageCIP23' },
+    });
+
+    expect(method.useDevicePassphraseState).toBe(true);
+    expect(method.unlockPolicy).toBe('none');
+    expect(method.getSupportedProtocols()).toContain('V2');
+  });
+
+  test('lock-free Protocol V2 controls explicitly opt out of wallet-session handling', () => {
+    const method = new DeviceLock({
+      id: 1,
+      payload: { method: 'deviceLock' },
+    });
+
+    method.init();
+
+    expect(method.useDevicePassphraseState).toBe(false);
+    expect(method.unlockPolicy).toBe('none');
+  });
+
+  test('pre-unlocks an unregistered wallet business method', async () => {
+    const features = { unlocked: false };
+    const method = {
+      name: 'newWalletBusinessMethod',
+      unlockPolicy: 'none',
+      useDevicePassphraseState: true,
+      run: jest.fn().mockResolvedValue({ message: 'ok' }),
+    };
+    const device = {
+      features,
+      commands: {
+        typedCall: jest.fn().mockResolvedValue({ message: { unlocked: false } }),
+      },
+      isProtocolV2: () => true,
+      isBootloader: () => false,
+      isRomloader: () => false,
+      updateProtocolV2Status: jest.fn(() => features),
+      unlockDevice: jest.fn().mockImplementation(() => {
+        features.unlocked = true;
+        return Promise.resolve(features);
+      }),
+    };
+
+    await expect(runMethodWithUnlockPolicy(method as any, device as any)).resolves.toEqual({
+      message: 'ok',
+    });
+    expect(device.unlockDevice).toHaveBeenCalledTimes(1);
+    expect(method.run).toHaveBeenCalledTimes(1);
+  });
+
+  test('lets the standard wallet session own the Main PIN unlock', async () => {
+    const calls: string[] = [];
+    const features = {
+      unlocked: false,
+      passphraseProtection: true,
+    };
+    const method = {
+      name: 'btcGetPublicKey',
+      unlockPolicy: 'none',
+      useDevicePassphraseState: true,
+      payload: { useEmptyPassphrase: true },
+      run: jest.fn().mockImplementation(() => {
+        calls.push('run');
+        return Promise.resolve({ message: 'ok' });
+      }),
+    };
+    const device = {
+      features,
+      commands: {
+        typedCall: jest.fn().mockImplementation(() => {
+          calls.push('status');
+          return Promise.resolve({
+            message: {
+              unlocked: false,
+              passphraseProtection: true,
+            },
+          });
+        }),
+      },
+      isProtocolV2: () => true,
+      isBootloader: () => false,
+      isRomloader: () => false,
+      updateProtocolV2Status: jest.fn(() => features),
+      unlockDevice: jest.fn().mockImplementation(() => {
+        calls.push('wallet-session-unlock');
+        features.unlocked = true;
+        return Promise.resolve(features);
+      }),
+    };
+
+    await expect(
+      runMethodWithUnlockPolicy(method as any, device as any, {
+        prepare: async () => {
+          await device.unlockDevice();
+        },
+      })
+    ).resolves.toEqual({ message: 'ok' });
+
+    expect(calls).toEqual(['status', 'wallet-session-unlock', 'run']);
+    expect(device.unlockDevice).toHaveBeenCalledTimes(1);
   });
 
-  test.each([
-    'deviceUnlock',
-    'deviceLock',
-    'deviceWipe',
-    'deviceChangePin',
-    'deviceSettings',
-    'firmwareUpdateV4',
-    'deviceUploadWallpaper',
-    'uploadPortfolio',
-  ])('does not make the state-changing method %s replayable by default', methodName => {
-    expect(getProtocolV2UnlockPolicy(methodName)).toBe('none');
+  test('reuses a Main PIN selected by pre-unlock when locked status hides passphrase state', async () => {
+    const calls: string[] = [];
+    const features: {
+      unlocked: boolean;
+      passphraseProtection?: boolean;
+      unlockedAttachPin?: boolean;
+    } = {
+      unlocked: false,
+    };
+    const method: any = {
+      name: 'btcGetPublicKey',
+      unlockPolicy: 'none',
+      useDevicePassphraseState: true,
+      payload: { useEmptyPassphrase: true },
+      run: jest.fn().mockImplementation(() => {
+        calls.push('run');
+        return Promise.resolve({ message: 'ok' });
+      }),
+    };
+    const device = {
+      features,
+      commands: {
+        typedCall: jest.fn().mockImplementation(() => {
+          calls.push('status');
+          return Promise.resolve({
+            message: {
+              unlocked: false,
+            },
+          });
+        }),
+      },
+      isProtocolV2: () => true,
+      isBootloader: () => false,
+      isRomloader: () => false,
+      updateProtocolV2Status: jest.fn(() => features),
+      unlockDevice: jest.fn().mockImplementation(() => {
+        calls.push('main-pin');
+        features.unlocked = true;
+        features.passphraseProtection = true;
+        features.unlockedAttachPin = false;
+        return Promise.resolve(features);
+      }),
+    };
+
+    await expect(
+      runMethodWithUnlockPolicy(method, device as any, {
+        prepare: async () => {
+          if (!(features.unlocked && features.unlockedAttachPin === false)) {
+            await device.unlockDevice();
+          }
+        },
+      })
+    ).resolves.toEqual({ message: 'ok' });
+
+    expect(calls).toEqual(['status', 'main-pin', 'run']);
+    expect(device.unlockDevice).toHaveBeenCalledTimes(1);
+  });
+
+  test('runs fresh-status validation before starting unlock', async () => {
+    const identityError = new Error('Unexpected device');
+    const method = {
+      name: 'walletBusinessMethod',
+      unlockPolicy: 'none',
+      useDevicePassphraseState: true,
+      run: jest.fn(),
+    };
+    const features = { unlocked: false };
+    const device = {
+      features,
+      commands: {
+        typedCall: jest.fn().mockResolvedValue({ message: { unlocked: false } }),
+      },
+      isProtocolV2: () => true,
+      isBootloader: () => false,
+      isRomloader: () => false,
+      updateProtocolV2Status: jest.fn(() => features),
+      unlockDevice: jest.fn(),
+    };
+
+    await expect(
+      runMethodWithUnlockPolicy(method as any, device as any, {
+        afterStatusBeforeUnlock: () => {
+          throw identityError;
+        },
+      })
+    ).rejects.toBe(identityError);
+
+    expect(device.unlockDevice).not.toHaveBeenCalled();
+    expect(method.run).not.toHaveBeenCalled();
   });
 });