@originals/sdk 1.4.2 → 1.4.3

package/tests/security/bitcoin-penetration-tests.test.ts

@@ -1,622 +0,0 @@
-/**
- * Bitcoin Transaction Logic Penetration Tests
- *
- * This test suite simulates various attack vectors and edge cases
- * to validate the security of Bitcoin transaction handling.
- */
-
-import { describe, it, expect, beforeEach } from 'bun:test';
-import { OriginalsSDK } from '../../src/core/OriginalsSDK';
-import { OrdMockProvider } from '../../src/adapters/providers/OrdMockProvider';
-import { BitcoinManager } from '../../src/bitcoin/BitcoinManager';
-import { PSBTBuilder } from '../../src/bitcoin/PSBTBuilder';
-import { selectUtxos, selectResourceUtxos } from '../../src/bitcoin/utxo-selection';
-import { validateBitcoinAddress } from '../../src/utils/bitcoin-address';
-import { validateSatoshiNumber, parseSatoshiIdentifier } from '../../src/utils/satoshi-validation';
-import type { Utxo, ResourceUtxo, OriginalsConfig } from '../../src/types';
-
-describe('Bitcoin Penetration Tests - Security Audit', () => {
-  let sdk: OriginalsSDK;
-  let bitcoinManager: BitcoinManager;
-  let config: OriginalsConfig;
-
-  beforeEach(() => {
-    config = {
-      network: 'regtest',
-      defaultKeyType: 'ES256K',
-      ordinalsProvider: new OrdMockProvider(),
-      enableLogging: false
-    };
-    sdk = OriginalsSDK.create(config);
-    bitcoinManager = new BitcoinManager(config);
-  });
-
-  describe('1. Double-Spend Attack Simulation', () => {
-    it('should reject duplicate UTXO usage in concurrent transactions', async () => {
-      const utxo: Utxo = {
-        txid: 'abc123',
-        vout: 0,
-        value: 100000,
-        scriptPubKey: 'script',
-        address: 'tb1qtest',
-        inscriptions: []
-      };
-
-      const builder = new PSBTBuilder();
-
-      // Attempt to use same UTXO in two transactions
-      const tx1Promise = builder.build({
-        utxos: [utxo],
-        outputs: [{ address: 'tb1qreceiver1', value: 50000 }],
-        changeAddress: 'tb1qchange',
-        feeRate: 10,
-        network: 'testnet'
-      });
-
-      const tx2Promise = builder.build({
-        utxos: [utxo],
-        outputs: [{ address: 'tb1qreceiver2', value: 50000 }],
-        changeAddress: 'tb1qchange',
-        feeRate: 10,
-        network: 'testnet'
-      });
-
-      // Both should succeed in building (race condition)
-      // but only one can be broadcast successfully
-      const [tx1, tx2] = await Promise.all([tx1Promise, tx2Promise]);
-
-      expect(tx1).toBeDefined();
-      expect(tx2).toBeDefined();
-      expect(tx1.selectedUtxos[0].txid).toBe(tx2.selectedUtxos[0].txid);
-
-      // In production, broadcasting would fail for one of these
-      console.log('[SECURITY] Double-spend attempt detected - both transactions built but only one can broadcast');
-    });
-
-    it('should filter out locked UTXOs from selection', () => {
-      const lockedUtxo: ResourceUtxo = {
-        txid: 'locked123',
-        vout: 0,
-        value: 100000,
-        scriptPubKey: 'script',
-        address: 'tb1qtest',
-        inscriptions: [],
-        hasResource: false,
-        locked: true
-      };
-
-      const unlockedUtxo: ResourceUtxo = {
-        txid: 'unlocked456',
-        vout: 0,
-        value: 100000,
-        scriptPubKey: 'script',
-        address: 'tb1qtest',
-        inscriptions: [],
-        hasResource: false
-      };
-
-      // Using avoidUtxoIds to simulate lock checking
-      const result = selectResourceUtxos(
-        [lockedUtxo, unlockedUtxo],
-        {
-          requiredAmount: 50000,
-          feeRate: 10,
-          avoidUtxoIds: ['locked123:0']
-        }
-      );
-
-      expect(result.selectedUtxos).toHaveLength(1);
-      expect(result.selectedUtxos[0].txid).toBe('unlocked456');
-      console.log('[SECURITY] Locked UTXO correctly excluded from selection');
-    });
-  });
-
-  describe('2. Fee Rate Manipulation', () => {
-    it('should reject extremely high fee rates', async () => {
-      const extremelyHighFeeRate = 1_000_000_000; // 1 billion sat/vB
-
-      await expect(
-        bitcoinManager.inscribeData(
-          { test: 'data' },
-          'application/json',
-          extremelyHighFeeRate
-        )
-      ).rejects.toThrow();
-
-      console.log('[SECURITY] Extremely high fee rate rejected (or should be with fix)');
-    });
-
-    it('should reject negative fee rates', async () => {
-      const negativeFeeRate = -10;
-
-      await expect(
-        bitcoinManager.inscribeData(
-          { test: 'data' },
-          'application/json',
-          negativeFeeRate
-        )
-      ).rejects.toThrow(/must be a positive number/);
-
-      console.log('[SECURITY] Negative fee rate correctly rejected');
-    });
-
-    it('should reject NaN fee rates', async () => {
-      const nanFeeRate = NaN;
-
-      await expect(
-        bitcoinManager.inscribeData(
-          { test: 'data' },
-          'application/json',
-          nanFeeRate
-        )
-      ).rejects.toThrow(/must be a positive number/);
-
-      console.log('[SECURITY] NaN fee rate correctly rejected');
-    });
-
-    it('should reject Infinity fee rates', async () => {
-      const infinityFeeRate = Infinity;
-
-      await expect(
-        bitcoinManager.inscribeData(
-          { test: 'data' },
-          'application/json',
-          infinityFeeRate
-        )
-      ).rejects.toThrow(/must be a positive number/);
-
-      console.log('[SECURITY] Infinity fee rate correctly rejected');
-    });
-
-    it('should handle zero fee rate gracefully', async () => {
-      const zeroFeeRate = 0;
-
-      await expect(
-        bitcoinManager.inscribeData(
-          { test: 'data' },
-          'application/json',
-          zeroFeeRate
-        )
-      ).rejects.toThrow(/must be a positive number/);
-
-      console.log('[SECURITY] Zero fee rate correctly rejected');
-    });
-  });
-
-  describe('3. Input Fuzzing - Bitcoin Addresses', () => {
-    const maliciousAddresses = [
-      '',
-      ' ',
-      'not-a-bitcoin-address',
-      'bc1qinvalid',
-      '1' + 'A'.repeat(100), // Too long
-      'bc1q' + 'x'.repeat(100), // Too long bech32
-      '../../etc/passwd', // Path traversal attempt
-      '<script>alert(1)</script>', // XSS attempt
-      "'; DROP TABLE assets; --", // SQL injection attempt
-      '\x00\x01\x02\x03', // Null bytes
-      '🚀💎🔥', // Emoji
-      'bc1Q' + 'a'.repeat(58), // Mixed case (invalid bech32)
-    ];
-
-    maliciousAddresses.forEach((address) => {
-      it(`should reject malicious address: ${address.substring(0, 20)}...`, () => {
-        expect(() => {
-          validateBitcoinAddress(address, 'mainnet');
-        }).toThrow();
-
-        console.log(`[SECURITY] Malicious address rejected: ${address.substring(0, 30)}`);
-      });
-    });
-
-    it('should reject checksum-invalid addresses', () => {
-      // Valid bech32 format but invalid checksum
-      const invalidChecksum = 'bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdd';
-
-      expect(() => {
-        validateBitcoinAddress(invalidChecksum, 'mainnet');
-      }).toThrow();
-
-      console.log('[SECURITY] Invalid checksum correctly rejected');
-    });
-
-    it('should reject wrong network addresses', () => {
-      const mainnetAddress = 'bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq';
-
-      expect(() => {
-        validateBitcoinAddress(mainnetAddress, 'testnet');
-      }).toThrow();
-
-      console.log('[SECURITY] Wrong network address correctly rejected');
-    });
-  });
-
-  describe('4. Input Fuzzing - Satoshi Numbers', () => {
-    const maliciousSatoshis = [
-      '',
-      ' ',
-      'not-a-number',
-      '123.456', // Decimals
-      '1e10', // Scientific notation
-      '-123456', // Negative
-      '9999999999999999999999999', // Beyond max supply
-      '0xDEADBEEF', // Hex
-      '0o777', // Octal
-      '0b1010', // Binary
-      '\x00123456', // Null byte prefix
-      '123456\x00', // Null byte suffix
-      '../../etc/passwd',
-      '<script>alert(1)</script>',
-      "'; DROP TABLE assets; --",
-    ];
-
-    maliciousSatoshis.forEach((satoshi) => {
-      it(`should reject malicious satoshi: ${satoshi.substring(0, 20)}...`, () => {
-        const result = validateSatoshiNumber(satoshi);
-        expect(result.valid).toBe(false);
-        expect(result.error).toBeDefined();
-
-        console.log(`[SECURITY] Malicious satoshi rejected: ${satoshi.substring(0, 30)}`);
-      });
-    });
-
-    it('should reject satoshi beyond Bitcoin max supply', () => {
-      const beyondMaxSupply = '2100000000000001'; // > 21M BTC
-
-      const result = validateSatoshiNumber(beyondMaxSupply);
-      expect(result.valid).toBe(false);
-      expect(result.error).toContain('total supply');
-
-      console.log('[SECURITY] Satoshi beyond max supply correctly rejected');
-    });
-
-    it('should handle maximum valid satoshi', () => {
-      const maxValidSatoshi = '2100000000000000'; // Exactly 21M BTC
-
-      const result = validateSatoshiNumber(maxValidSatoshi);
-      expect(result.valid).toBe(true);
-
-      console.log('[SECURITY] Maximum valid satoshi correctly accepted');
-    });
-  });
-
-  describe('5. Input Fuzzing - MIME Types', () => {
-    const maliciousMimeTypes = [
-      '',
-      ' ',
-      'not-a-mime-type',
-      'application', // Missing subtype
-      '/json', // Missing type
-      'application//json', // Double slash
-      'application/json; charset=utf-8; exec=malicious', // Injection attempt
-      '../../../etc/passwd',
-      '<script>alert(1)</script>',
-      'a'.repeat(300) + '/json', // Too long type
-      'application/' + 'b'.repeat(300), // Too long subtype
-      'text/html\x00', // Null byte
-    ];
-
-    maliciousMimeTypes.forEach((mimeType) => {
-      it(`should reject malicious MIME type: ${mimeType.substring(0, 30)}...`, async () => {
-        await expect(
-          bitcoinManager.inscribeData(
-            { test: 'data' },
-            mimeType,
-            10
-          )
-        ).rejects.toThrow();
-
-        console.log(`[SECURITY] Malicious MIME type rejected: ${mimeType.substring(0, 40)}`);
-      });
-    });
-
-    it('should accept valid MIME types', async () => {
-      const validMimeTypes = [
-        'application/json',
-        'text/plain',
-        'image/png',
-        'application/octet-stream',
-        'text/html',
-        'application/vnd.custom+json',
-      ];
-
-      for (const mimeType of validMimeTypes) {
-        // Should not throw
-        await bitcoinManager.inscribeData({ test: 'data' }, mimeType, 10);
-        console.log(`[SECURITY] Valid MIME type accepted: ${mimeType}`);
-      }
-    });
-  });
-
-  describe('6. UTXO Selection Edge Cases', () => {
-    it('should handle insufficient funds gracefully', () => {
-      const utxos: Utxo[] = [
-        { txid: 'tx1', vout: 0, value: 1000, scriptPubKey: 'script', address: 'tb1q', inscriptions: [] },
-        { txid: 'tx2', vout: 0, value: 2000, scriptPubKey: 'script', address: 'tb1q', inscriptions: [] },
-      ];
-
-      expect(() => {
-        selectUtxos(utxos, 10000); // Require more than available
-      }).toThrow(/Insufficient funds/);
-
-      console.log('[SECURITY] Insufficient funds correctly detected');
-    });
-
-    it('should handle empty UTXO list', () => {
-      const utxos: Utxo[] = [];
-
-      expect(() => {
-        selectUtxos(utxos, 1000);
-      }).toThrow(/No UTXOs/);
-
-      console.log('[SECURITY] Empty UTXO list correctly rejected');
-    });
-
-    it('should handle dust limit correctly', () => {
-      const utxos: ResourceUtxo[] = [
-        { txid: 'tx1', vout: 0, value: 101000, scriptPubKey: 'script', address: 'tb1q', inscriptions: [], hasResource: false },
-      ];
-
-      // Request amount that would leave dust change (< 546 dust limit)
-      // With 1 input, 2 outputs: ~140 vbytes, fee ~1400 sats
-      // Change = 101000 - 99500 - 1400 = 100 (< 546 dust limit)
-      const result = selectResourceUtxos(utxos, {
-        requiredAmount: 99500, // Would leave ~100 sat change (< 546 dust limit)
-        feeRate: 10
-      });
-
-      // Change should be added to fee to avoid dust, so changeAmount should be 0
-      expect(result.changeAmount).toBeLessThan(546);
-      expect(result.changeAmount).toBe(0);
-
-      console.log('[SECURITY] Dust limit handling verified');
-    });
-
-    it('should reject transactions with UTXOs containing inscriptions', () => {
-      const utxoWithInscription: ResourceUtxo = {
-        txid: 'tx1',
-        vout: 0,
-        value: 100000,
-        scriptPubKey: 'script',
-        address: 'tb1q',
-        inscriptions: ['inscription-id-123'],
-        hasResource: true
-      };
-
-      const regularUtxo: ResourceUtxo = {
-        txid: 'tx2',
-        vout: 0,
-        value: 100000,
-        scriptPubKey: 'script',
-        address: 'tb1q',
-        inscriptions: [],
-        hasResource: false
-      };
-
-      // Should select only non-inscription UTXO
-      const result = selectResourceUtxos([utxoWithInscription, regularUtxo], {
-        requiredAmount: 50000,
-        feeRate: 10,
-        allowResourceUtxos: false
-      });
-
-      expect(result.selectedUtxos).toHaveLength(1);
-      expect(result.selectedUtxos[0].txid).toBe('tx2');
-      expect(result.selectedUtxos[0].hasResource).toBe(false);
-
-      console.log('[SECURITY] Inscription-bearing UTXOs correctly excluded from payment selection');
-    });
-  });
-
-  describe('7. Integer Overflow and Precision', () => {
-    it('should handle large UTXO values without overflow', () => {
-      const largeUtxo: Utxo = {
-        txid: 'large-tx',
-        vout: 0,
-        value: Number.MAX_SAFE_INTEGER - 1000,
-        scriptPubKey: 'script',
-        address: 'tb1q',
-        inscriptions: []
-      };
-
-      const result = selectUtxos([largeUtxo], 1000);
-      expect(result.totalInputValue).toBe(Number.MAX_SAFE_INTEGER - 1000);
-      expect(result.totalInputValue).toBeLessThan(Number.MAX_SAFE_INTEGER);
-
-      console.log('[SECURITY] Large UTXO values handled without overflow');
-    });
-
-    it('should detect overflow in fee calculations', () => {
-      // Create a scenario that would actually overflow
-      // Use values that exceed Number.MAX_SAFE_INTEGER when multiplied
-      const veryLargeTxSize = Number.MAX_SAFE_INTEGER;
-      const highFeeRate = 2; // Multiplying by 2 will exceed MAX_SAFE_INTEGER
-
-      // This would overflow if not properly handled
-      const potentialOverflow = veryLargeTxSize * highFeeRate;
-      expect(Number.isSafeInteger(potentialOverflow)).toBe(false);
-
-      console.log('[SECURITY] Integer overflow potential detected in fee calculations');
-    });
-  });
-
-  describe('8. Concurrency and Race Conditions', () => {
-    it('should handle concurrent UTXO selections', async () => {
-      const sharedUtxo: Utxo = {
-        txid: 'shared-tx',
-        vout: 0,
-        value: 100000,
-        scriptPubKey: 'script',
-        address: 'tb1q',
-        inscriptions: []
-      };
-
-      // Simulate concurrent selections
-      const selections = await Promise.all([
-        Promise.resolve(selectUtxos([sharedUtxo], 50000)),
-        Promise.resolve(selectUtxos([sharedUtxo], 50000)),
-        Promise.resolve(selectUtxos([sharedUtxo], 50000)),
-      ]);
-
-      // All succeed in selection (race condition)
-      expect(selections).toHaveLength(3);
-      selections.forEach(s => {
-        expect(s.selectedUtxos[0].txid).toBe('shared-tx');
-      });
-
-      console.log('[SECURITY] Race condition in concurrent UTXO selection detected');
-    });
-  });
-
-  describe('9. DID and Satoshi Identifier Parsing', () => {
-    it('should reject malformed did:btco DIDs', () => {
-      const malformedDids = [
-        'did:btco',
-        'did:btco:',
-        'did:btco::123456',
-        'did:btco:invalid:123456',
-        'did:btco:test:',
-        'did:btco:test:abc',
-        'did:btco:test:-123',
-      ];
-
-      malformedDids.forEach(did => {
-        expect(() => {
-          parseSatoshiIdentifier(did);
-        }).toThrow();
-
-        console.log(`[SECURITY] Malformed DID rejected: ${did}`);
-      });
-    });
-
-    it('should accept valid did:btco DIDs', () => {
-      const validDids = [
-        { did: 'did:btco:123456', expected: 123456 },
-        { did: 'did:btco:test:789012', expected: 789012 },
-        { did: 'did:btco:sig:345678', expected: 345678 },
-      ];
-
-      validDids.forEach(({ did, expected }) => {
-        const result = parseSatoshiIdentifier(did);
-        expect(result).toBe(expected);
-
-        console.log(`[SECURITY] Valid DID accepted: ${did} -> ${expected}`);
-      });
-    });
-  });
-
-  describe('10. Boundary Value Testing', () => {
-    it('should handle minimum valid values', () => {
-      const minUtxo: Utxo = {
-        txid: 'min-tx',
-        vout: 0,
-        value: 546, // Minimum dust limit
-        scriptPubKey: 'script',
-        address: 'tb1q',
-        inscriptions: []
-      };
-
-      const result = selectUtxos([minUtxo], 500);
-      expect(result.selectedUtxos).toHaveLength(1);
-
-      console.log('[SECURITY] Minimum UTXO value (dust limit) handled correctly');
-    });
-
-    it('should handle maximum valid satoshi number', () => {
-      const maxSatoshi = '2100000000000000';
-      const result = validateSatoshiNumber(maxSatoshi);
-      expect(result.valid).toBe(true);
-
-      console.log('[SECURITY] Maximum valid satoshi (21M BTC) accepted');
-    });
-
-    it('should reject values just beyond boundaries', () => {
-      const justBeyondMax = '2100000000000001';
-      const result = validateSatoshiNumber(justBeyondMax);
-      expect(result.valid).toBe(false);
-
-      console.log('[SECURITY] Value just beyond max correctly rejected');
-    });
-  });
-
-  describe('11. Error Information Leakage', () => {
-    it('should not leak sensitive information in error messages', async () => {
-      try {
-        await bitcoinManager.inscribeData(
-          { secret: 'sensitive-data-12345' },
-          'invalid-mime-type',
-          10
-        );
-      } catch (error: any) {
-        // Error message should not contain the sensitive data
-        expect(error.message).not.toContain('sensitive-data-12345');
-        expect(error.message).not.toContain('secret');
-
-        console.log('[SECURITY] Sensitive data not leaked in error messages');
-      }
-    });
-
-    it('should use generic error messages for validation failures', () => {
-      try {
-        validateBitcoinAddress('secret-address-key-123', 'mainnet');
-      } catch (error: any) {
-        // Should not echo back the invalid address in full
-        expect(error.message).toBeDefined();
-        // Generic error is acceptable
-
-        console.log('[SECURITY] Generic error message for invalid address');
-      }
-    });
-  });
-});
-
-describe('Performance and Resource Exhaustion Tests', () => {
-  describe('12. Resource Exhaustion Attempts', () => {
-    it('should handle very large UTXO lists efficiently', () => {
-      const largeUtxoList: Utxo[] = Array.from({ length: 10000 }, (_, i) => ({
-        txid: `tx-${i}`,
-        vout: 0,
-        value: 10000,
-        scriptPubKey: 'script',
-        address: 'tb1q',
-        inscriptions: []
-      }));
-
-      const startTime = Date.now();
-      const result = selectUtxos(largeUtxoList, 50000);
-      const duration = Date.now() - startTime;
-
-      expect(result.selectedUtxos.length).toBeGreaterThan(0);
-      expect(duration).toBeLessThan(1000); // Should complete within 1 second
-
-      console.log(`[PERFORMANCE] 10,000 UTXO selection completed in ${duration}ms`);
-    });
-
-    it('should reject excessively large data inscriptions', async () => {
-      const largeData = 'x'.repeat(10 * 1024 * 1024); // 10MB
-
-      // This might succeed or fail depending on limits
-      // The test is to ensure it doesn't crash
-      try {
-        await bitcoinManager.inscribeData(largeData, 'text/plain', 10);
-        console.log('[PERFORMANCE] Large data inscription handled');
-      } catch (error) {
-        console.log('[PERFORMANCE] Large data inscription rejected (expected)');
-      }
-    });
-  });
-});
-
-console.log('\n=== Bitcoin Penetration Test Suite Complete ===\n');
-console.log('This test suite validates security controls for:');
-console.log('- Double-spend prevention');
-console.log('- Fee rate manipulation');
-console.log('- Input fuzzing and validation');
-console.log('- UTXO selection security');
-console.log('- Integer overflow protection');
-console.log('- Concurrency and race conditions');
-console.log('- DID/Satoshi identifier parsing');
-console.log('- Boundary value handling');
-console.log('- Error information leakage');
-console.log('- Resource exhaustion resistance');
-console.log('\n===========================================\n');

package/tests/setup.bun.ts

@@ -1,69 +0,0 @@
-// Setup file for Bun test environment
-import { webcrypto } from 'node:crypto';
-import { afterEach, beforeEach, spyOn, setDefaultTimeout } from 'bun:test';
-import { verificationMethodRegistry } from '../src/vc/documentLoader';
-
-// Set default test timeout to 30 seconds
-// Individual tests can override this with their own timeout parameter
-// E.g., test('slow test', async () => { ... }, 60000);
-setDefaultTimeout(30000);
-
-// Suppress console logs during tests to reduce noise
-// Only show errors unless explicitly configured otherwise
-const originalConsole = {
-  log: console.log,
-  info: console.info,
-  debug: console.debug,
-  warn: console.warn,
-};
-
-// Track fetch mock for cleanup
-let fetchMock: any = null;
-
-beforeEach(() => {
-  // Mock fetch to prevent real network calls during tests
-  // Individual tests can override this with their own mocks if needed
-  fetchMock = spyOn(global as any, 'fetch').mockImplementation(async (url: string) => {
-    // Log unmocked fetch calls to help identify tests that need explicit mocking
-    if (process.env.DEBUG_FETCH === 'true') {
-      console.error(`[TEST WARNING] Unmocked fetch call to: ${url}`);
-    }
-    // Return 404 by default to fail tests that forget to mock
-    return new Response('Not Found - Mock fetch not configured for this URL', { status: 404 });
-  });
-
-  // Suppress non-error console output during tests
-  console.log = () => {};
-  console.info = () => {};
-  console.debug = () => {};
-  console.warn = () => {};
-});
-
-// Ensure globalThis.crypto is available for noble libraries
-if (typeof globalThis.crypto === 'undefined') {
-  // @ts-ignore
-  globalThis.crypto = webcrypto as unknown as Crypto;
-}
-
-// Initialize noble crypto libraries (uses shared initialization module)
-// This ensures libraries are configured before any tests run
-import '../src/crypto/noble-init.js';
-
-// Global cleanup after each test
-afterEach(() => {
-  // Restore fetch mock
-  if (fetchMock) {
-    fetchMock.mockRestore();
-    fetchMock = null;
-  }
-
-  // Restore console methods
-  console.log = originalConsole.log;
-  console.info = originalConsole.info;
-  console.debug = originalConsole.debug;
-  console.warn = originalConsole.warn;
-
-  // Clear verification method registry to prevent pollution
-  verificationMethodRegistry.clear();
-});
-