@smartledger/bsv 5.4.2 → 5.5.1

package/test/cli/smoke.js

@@ -0,0 +1,261 @@
+'use strict'
+
+// End-to-end smoke test for `bin/cli.js`.
+//
+// Exercises every subcommand advertised in the README quickstart:
+//   didweb init  → vc issue → vc verify
+//   status create → status set → status check
+//   anchor hash  → anchor build
+//
+// Each test runs the CLI in an isolated temp directory so the files it
+// drops (.well-known/did.json, issuer-key-<kid>.json, etc.) don't pollute
+// the repo. We assert on stdout/stderr/exit-code only — the CLI's primary
+// output is stdout, status messages go to stderr.
+
+var expect = require('chai').expect
+var spawnSync = require('child_process').spawnSync
+var fs = require('fs')
+var os = require('os')
+var path = require('path')
+
+var REPO_ROOT = path.resolve(__dirname, '..', '..')
+var CLI = path.join(REPO_ROOT, 'bin', 'cli.js')
+var PKG_VERSION = require(path.join(REPO_ROOT, 'package.json')).version
+
+function runCli(args, opts) {
+  opts = opts || {}
+  var result = spawnSync(process.execPath, [CLI].concat(args), {
+    cwd: opts.cwd || REPO_ROOT,
+    encoding: 'utf8',
+    timeout: 15000,
+    env: Object.assign({}, process.env, opts.env || {})
+  })
+  return {
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    code: result.status,
+    signal: result.signal
+  }
+}
+
+describe('CLI smoke', function () {
+  this.timeout(20000) // crypto + JWT signing can be slow on cold start
+
+  var tmpDir
+
+  beforeEach(function () {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'bsv-cli-smoke-'))
+  })
+
+  afterEach(function () {
+    try {
+      fs.rmSync(tmpDir, { recursive: true, force: true })
+    } catch (e) { /* best-effort cleanup */ }
+  })
+
+  describe('meta', function () {
+    it('--version prints package.json version', function () {
+      var r = runCli(['--version'])
+      expect(r.code).to.equal(0)
+      expect(r.stdout.trim()).to.equal(PKG_VERSION)
+    })
+
+    it('-v is an alias for --version', function () {
+      var r = runCli(['-v'])
+      expect(r.code).to.equal(0)
+      expect(r.stdout.trim()).to.equal(PKG_VERSION)
+    })
+
+    it('no args prints the help banner with the current version', function () {
+      var r = runCli([])
+      expect(r.code).to.equal(0)
+      expect(r.stdout).to.include('SmartLedger BSV CLI v' + PKG_VERSION)
+      expect(r.stdout).to.include('didweb init')
+      expect(r.stdout).to.include('vc issue')
+      expect(r.stdout).to.include('status create')
+      expect(r.stdout).to.include('anchor hash')
+    })
+
+    it('--help prints the help banner', function () {
+      var r = runCli(['--help'])
+      expect(r.code).to.equal(0)
+      expect(r.stdout).to.include('Usage:')
+    })
+
+    it('unknown top-level command exits non-zero', function () {
+      var r = runCli(['nope'])
+      expect(r.code).to.not.equal(0)
+      expect(r.stderr).to.match(/Unknown command/i)
+    })
+  })
+
+  describe('didweb', function () {
+    it('init --domain creates .well-known files and an issuer key', function () {
+      var r = runCli(['didweb', 'init', '--domain', 'example.com', '--alg', 'ES256'], { cwd: tmpDir })
+      expect(r.code, r.stderr).to.equal(0)
+
+      var didPath = path.join(tmpDir, '.well-known', 'did.json')
+      var jwksPath = path.join(tmpDir, '.well-known', 'jwks.json')
+      expect(fs.existsSync(didPath), 'did.json missing').to.equal(true)
+      expect(fs.existsSync(jwksPath), 'jwks.json missing').to.equal(true)
+
+      var didDoc = JSON.parse(fs.readFileSync(didPath, 'utf8'))
+      expect(didDoc.id).to.equal('did:web:example.com')
+
+      var jwks = JSON.parse(fs.readFileSync(jwksPath, 'utf8'))
+      expect(jwks.keys).to.be.an('array').with.length.greaterThan(0)
+      expect(jwks.keys[0].kty).to.be.a('string')
+
+      // Issuer key file is named issuer-key-<kid>.json
+      var keyFiles = fs.readdirSync(tmpDir).filter(function (f) {
+        return f.startsWith('issuer-key-') && f.endsWith('.json')
+      })
+      expect(keyFiles, 'issuer key not written').to.have.length(1)
+
+      var keyData = JSON.parse(fs.readFileSync(path.join(tmpDir, keyFiles[0]), 'utf8'))
+      expect(keyData.did).to.equal('did:web:example.com')
+      expect(keyData.privateJwk).to.be.an('object')
+      expect(keyData.publicJwk).to.be.an('object')
+      expect(keyData.alg).to.equal('ES256')
+    })
+
+    it('init --alg ES256K produces a secp256k1 key', function () {
+      var r = runCli(['didweb', 'init', '--domain', 'example.org', '--alg', 'ES256K'], { cwd: tmpDir })
+      expect(r.code, r.stderr).to.equal(0)
+
+      var keyFiles = fs.readdirSync(tmpDir).filter(function (f) {
+        return f.startsWith('issuer-key-')
+      })
+      var keyData = JSON.parse(fs.readFileSync(path.join(tmpDir, keyFiles[0]), 'utf8'))
+      expect(keyData.alg).to.equal('ES256K')
+    })
+
+    it('init without --domain exits non-zero', function () {
+      var r = runCli(['didweb', 'init'], { cwd: tmpDir })
+      expect(r.code).to.not.equal(0)
+      expect(r.stderr).to.match(/--domain is required/)
+    })
+  })
+
+  describe('vc → status → anchor end-to-end', function () {
+    // One big sequenced test that uses didweb init's output to issue,
+    // verify, anchor, and revoke a credential — mirrors the README's
+    // quickstart exactly.
+    it('full credential lifecycle', function () {
+      // 1. Init a DID:web issuer
+      var initRes = runCli(['didweb', 'init', '--domain', 'example.com', '--alg', 'ES256'], { cwd: tmpDir })
+      expect(initRes.code, initRes.stderr).to.equal(0)
+
+      // The CLI writes the key file as issuer-key-<kid>.json but `vc issue`
+      // looks for `issuer-key.json` by default. Rename so we can use the
+      // default --key path.
+      var keyFile = fs.readdirSync(tmpDir).filter(function (f) {
+        return f.startsWith('issuer-key-')
+      })[0]
+      fs.renameSync(path.join(tmpDir, keyFile), path.join(tmpDir, 'issuer-key.json'))
+
+      // 2. Issue a credential
+      var issueRes = runCli([
+        'vc', 'issue',
+        '--issuer', 'did:web:example.com',
+        '--subject', 'did:example:alice',
+        '--types', 'VerifiableCredential,AgeCredential',
+        '--claims', JSON.stringify({ ageOver: 18, country: 'US' })
+      ], { cwd: tmpDir })
+      expect(issueRes.code, issueRes.stderr).to.equal(0)
+
+      // JWT format: three base64url segments separated by `.`
+      var jwt = issueRes.stdout.trim()
+      expect(jwt.split('.')).to.have.length(3)
+
+      // 3. Verify the credential
+      fs.writeFileSync(path.join(tmpDir, 'cred.jwt'), jwt)
+      var verifyRes = runCli(['vc', 'verify', 'cred.jwt'], { cwd: tmpDir })
+      expect(verifyRes.code, verifyRes.stderr).to.equal(0)
+      expect(verifyRes.stderr).to.match(/VALID/)
+      // Verified payload echoed on stdout
+      var payload = JSON.parse(verifyRes.stdout)
+      expect(payload.iss).to.equal('did:web:example.com')
+
+      // 4. Anchor the credential hash
+      var anchorRes = runCli(['anchor', 'hash', 'cred.jwt'], { cwd: tmpDir })
+      expect(anchorRes.code, anchorRes.stderr).to.equal(0)
+      var hash = anchorRes.stdout.trim()
+      expect(hash).to.match(/^[0-9a-f]{64}$/)
+
+      // 5. Build an anchor payload around that hash
+      var buildRes = runCli([
+        'anchor', 'build',
+        '--kind', 'VC_ANCHOR_SHA256',
+        '--hash', hash,
+        '--issuer', 'did:web:example.com'
+      ], { cwd: tmpDir })
+      expect(buildRes.code, buildRes.stderr).to.equal(0)
+      var payloadJson = JSON.parse(buildRes.stdout)
+      expect(payloadJson.hash).to.equal(hash)
+
+      // 6. Create a status list
+      var statusCreateRes = runCli([
+        'status', 'create',
+        '--issuer', 'did:web:example.com'
+      ], { cwd: tmpDir })
+      expect(statusCreateRes.code, statusCreateRes.stderr).to.equal(0)
+      var listJwt = statusCreateRes.stdout.trim()
+      expect(listJwt.split('.')).to.have.length(3)
+
+      // 7. Revoke index 42
+      fs.writeFileSync(path.join(tmpDir, 'list.jwt'), listJwt)
+      var statusSetRes = runCli([
+        'status', 'set',
+        '--list', 'list.jwt',
+        '--index', '42',
+        '--status', 'revoked'
+      ], { cwd: tmpDir })
+      expect(statusSetRes.code, statusSetRes.stderr).to.equal(0)
+      var updatedListJwt = statusSetRes.stdout.trim()
+      expect(updatedListJwt.split('.')).to.have.length(3)
+
+      // 8. Check the new status at index 42
+      fs.writeFileSync(path.join(tmpDir, 'list-updated.jwt'), updatedListJwt)
+      var statusCheckRes = runCli([
+        'status', 'check',
+        '--list', 'list-updated.jwt',
+        '--index', '42'
+      ], { cwd: tmpDir })
+      expect(statusCheckRes.code, statusCheckRes.stderr).to.equal(0)
+      expect(statusCheckRes.stdout.trim()).to.equal('revoked')
+
+      // 9. A different index should still report valid
+      var statusCheckValidRes = runCli([
+        'status', 'check',
+        '--list', 'list-updated.jwt',
+        '--index', '0'
+      ], { cwd: tmpDir })
+      expect(statusCheckValidRes.code, statusCheckValidRes.stderr).to.equal(0)
+      expect(statusCheckValidRes.stdout.trim()).to.equal('valid')
+    })
+  })
+
+  describe('error handling', function () {
+    it('vc issue without --issuer exits non-zero', function () {
+      var r = runCli(['vc', 'issue', '--subject', 'x', '--claims', '{}'], { cwd: tmpDir })
+      expect(r.code).to.not.equal(0)
+      expect(r.stderr).to.match(/--issuer/)
+    })
+
+    it('vc verify on a missing file exits non-zero', function () {
+      var r = runCli(['vc', 'verify', 'no-such-file.jwt'], { cwd: tmpDir })
+      expect(r.code).to.not.equal(0)
+    })
+
+    it('status set without --list exits non-zero', function () {
+      var r = runCli(['status', 'set', '--index', '1', '--status', 'revoked'], { cwd: tmpDir })
+      expect(r.code).to.not.equal(0)
+    })
+
+    it('anchor build without --kind exits non-zero', function () {
+      var r = runCli(['anchor', 'build', '--hash', 'x', '--issuer', 'y'], { cwd: tmpDir })
+      expect(r.code).to.not.equal(0)
+    })
+  })
+})

package/test/credentials-test.js

@@ -0,0 +1,329 @@
+/**
+ * Test Vectors for DID:web + VC-JWT + StatusList2021
+ * Comprehensive test suite for v3.4.0
+ */
+
+'use strict'
+
+var didweb = require('../lib/didweb')
+var vcjwt = require('../lib/vcjwt')
+var statuslist = require('../lib/statuslist')
+var anchor = require('../lib/anchor')
+var assert = require('assert')
+
+console.log('🧪 SmartLedger BSV v3.4.0 - Credential Test Suite\n')
+
+// Test 1: DID:web Key Generation (ES256)
+async function testES256KeyGeneration() {
+  console.log('1️⃣  Testing ES256 key generation...')
+  
+  var keys = await didweb.generateIssuerKeys({ alg: 'ES256' })
+  
+  assert(keys.privateJwk, 'Private JWK should exist')
+  assert(keys.publicJwk, 'Public JWK should exist')
+  assert.strictEqual(keys.alg, 'ES256', 'Algorithm should be ES256')
+  assert(keys.kid, 'Key ID should exist')
+  assert.strictEqual(keys.publicJwk.kty, 'EC', 'Key type should be EC')
+  assert.strictEqual(keys.publicJwk.crv, 'P-256', 'Curve should be P-256')
+  
+  console.log('   ✅ ES256 key generation successful')
+  console.log('   ✅ Kid:', keys.kid)
+  return keys
+}
+
+// Test 2: DID:web Key Generation (ES256K)
+async function testES256KKeyGeneration() {
+  console.log('\n2️⃣  Testing ES256K key generation...')
+  
+  var keys = await didweb.generateIssuerKeys({ alg: 'ES256K' })
+  
+  assert(keys.privateJwk, 'Private JWK should exist')
+  assert(keys.publicJwk, 'Public JWK should exist')
+  assert.strictEqual(keys.alg, 'ES256K', 'Algorithm should be ES256K')
+  assert(keys.kid, 'Key ID should exist')
+  assert.strictEqual(keys.publicJwk.kty, 'EC', 'Key type should be EC')
+  assert.strictEqual(keys.publicJwk.crv, 'secp256k1', 'Curve should be secp256k1')
+  
+  console.log('   ✅ ES256K key generation successful')
+  console.log('   ✅ Kid:', keys.kid)
+  return keys
+}
+
+// Test 3: DID:web Document Building
+async function testDIDDocumentBuilding(p256Keys) {
+  console.log('\n3️⃣  Testing DID:web document building...')
+  
+  var docs = didweb.buildDidWebDocuments({
+    domain: 'smartledger.technology',
+    p256: { jwk: p256Keys.publicJwk, kid: p256Keys.kid },
+    controllerName: 'SmartLedger Test Issuer'
+  })
+  
+  assert.strictEqual(docs.did, 'did:web:smartledger.technology', 'DID should be correctly formatted')
+  assert(docs.didDocument, 'DID Document should exist')
+  assert(docs.jwks, 'JWKS should exist')
+  assert(docs.didDocument.verificationMethod.length > 0, 'Should have verification methods')
+  assert(docs.jwks.keys.length > 0, 'JWKS should have keys')
+  
+  console.log('   ✅ DID:', docs.did)
+  console.log('   ✅ Verification methods:', docs.didDocument.verificationMethod.length)
+  console.log('   ✅ JWKS keys:', docs.jwks.keys.length)
+  
+  return docs
+}
+
+// Test 4: VC-JWT Issuance (ES256)
+async function testVCIssuanceES256(issuerDid, keys) {
+  console.log('\n4️⃣  Testing VC-JWT issuance (ES256)...')
+  
+  var result = await vcjwt.issueVcJwt({
+    issuerDid: issuerDid,
+    subjectId: 'did:example:holder123',
+    types: ['VerifiableCredential', 'AgeCredential'],
+    credentialSubject: {
+      ageOver: 18,
+      country: 'US'
+    },
+    privateJwk: keys.privateJwk,
+    alg: 'ES256',
+    kid: keys.kid
+  })
+  
+  assert(result.jwt, 'JWT should be generated')
+  assert(result.jwt.split('.').length === 3, 'JWT should have 3 parts')
+  
+  console.log('   ✅ JWT generated')
+  console.log('   ✅ JWT length:', result.jwt.length)
+  
+  return result.jwt
+}
+
+// Test 5: VC-JWT Verification
+async function testVCVerification(jwt, jwks) {
+  console.log('\n5️⃣  Testing VC-JWT verification...')
+  
+  var didResolver = async function(did) {
+    return { jwks: jwks }
+  }
+  
+  var result = await vcjwt.verifyVcJwt(jwt, {
+    didResolver: didResolver,
+    expectedIssuerDid: 'did:web:smartledger.technology'
+  })
+  
+  assert.strictEqual(result.valid, true, 'JWT should be valid')
+  assert(result.payload, 'Payload should be present')
+  assert(result.header, 'Header should be present')
+  
+  console.log('   ✅ JWT verification successful')
+  console.log('   ✅ Issuer:', result.payload.iss)
+  console.log('   ✅ Subject:', result.payload.sub)
+  
+  return result
+}
+
+// Test 6: StatusList2021 Creation
+async function testStatusListCreation(issuerDid, keys) {
+  console.log('\n6️⃣  Testing StatusList2021 creation...')
+  
+  var result = await statuslist.createStatusList({
+    issuerDid: issuerDid,
+    privateJwk: keys.privateJwk
+  })
+  
+  assert(result.listVcJwt, 'Status list JWT should be created')
+  assert(result.listId, 'List ID should be created')
+  
+  console.log('   ✅ Status list created')
+  console.log('   ✅ List ID:', result.listId)
+  
+  return result.listVcJwt
+}
+
+// Test 7: StatusList2021 Update (Revocation)
+async function testStatusListRevocation(listJwt, keys) {
+  console.log('\n7️⃣  Testing credential revocation...')
+  
+  var index = 42
+  
+  // Check initial status
+  var initialStatus = statuslist.getCredentialStatusEntry({
+    listVcJwt: listJwt,
+    index: index
+  })
+  
+  assert.strictEqual(initialStatus, 'valid', 'Initial status should be valid')
+  console.log('   ✅ Initial status at index', index + ':', initialStatus)
+  
+  // Revoke credential
+  var result = await statuslist.updateStatusList({
+    listVcJwt: listJwt,
+    index: index,
+    status: 'revoked',
+    privateJwk: keys.privateJwk
+  })
+  
+  assert(result.listVcJwt, 'Updated list should be returned')
+  
+  // Check updated status
+  var updatedStatus = statuslist.getCredentialStatusEntry({
+    listVcJwt: result.listVcJwt,
+    index: index
+  })
+  
+  assert.strictEqual(updatedStatus, 'revoked', 'Status should be revoked')
+  console.log('   ✅ Updated status at index', index + ':', updatedStatus)
+  
+  return result.listVcJwt
+}
+
+// Test 8: Anchor Hash Generation
+function testAnchorHashing() {
+  console.log('\n8️⃣  Testing anchor hash generation...')
+  
+  var testData = 'Test Verifiable Credential Data'
+  var hash = anchor.sha256Hex(testData)
+  
+  assert(hash, 'Hash should be generated')
+  assert.strictEqual(hash.length, 64, 'Hash should be 64 hex characters')
+  assert(/^[a-f0-9]{64}$/.test(hash), 'Hash should be valid hex')
+  
+  console.log('   ✅ SHA-256 hash generated')
+  console.log('   ✅ Hash:', hash)
+  
+  // Test hash reproducibility
+  var hash2 = anchor.sha256Hex(testData)
+  assert.strictEqual(hash, hash2, 'Hash should be reproducible')
+  console.log('   ✅ Hash reproducibility confirmed')
+  
+  return hash
+}
+
+// Test 9: Anchor Payload Building
+function testAnchorPayload(hash, issuerDid) {
+  console.log('\n9️⃣  Testing anchor payload building...')
+  
+  var payload = anchor.buildAnchorPayload({
+    kind: 'VC_ANCHOR_SHA256',
+    hash: hash,
+    issuerDid: issuerDid,
+    issuedAt: new Date().toISOString()
+  })
+  
+  assert(payload.json, 'Payload JSON should be generated')
+  
+  var parsed = JSON.parse(payload.json)
+  assert.strictEqual(parsed.protocol, 'SmartLedger', 'Protocol should be SmartLedger')
+  assert.strictEqual(parsed.type, 'VC_ANCHOR_SHA256', 'Type should match')
+  assert.strictEqual(parsed.hash, hash, 'Hash should match')
+  assert.strictEqual(parsed.issuer, issuerDid, 'Issuer should match')
+  
+  console.log('   ✅ Anchor payload created')
+  console.log('   ✅ Size:', payload.json.length, 'bytes')
+  console.log('   ✅ Protocol:', parsed.protocol)
+  
+  return payload
+}
+
+// Test 10: End-to-end Workflow
+async function testEndToEndWorkflow() {
+  console.log('\n🔟 Testing complete end-to-end workflow...')
+  
+  // Generate keys
+  var keys = await didweb.generateIssuerKeys({ alg: 'ES256' })
+  
+  // Build DID documents
+  var docs = didweb.buildDidWebDocuments({
+    domain: 'test.example.com',
+    p256: { jwk: keys.publicJwk, kid: keys.kid }
+  })
+  
+  // Issue credential
+  var result = await vcjwt.issueVcJwt({
+    issuerDid: docs.did,
+    subjectId: 'did:example:alice',
+    types: ['VerifiableCredential', 'DriverLicense'],
+    credentialSubject: {
+      licenseNumber: 'DL123456',
+      class: 'C'
+    },
+    privateJwk: keys.privateJwk,
+    alg: 'ES256',
+    kid: keys.kid
+  })
+  var jwt = result.jwt
+  
+  // Hash credential for anchoring
+  var hash = anchor.sha256Hex(jwt)
+  
+  // Build anchor payload
+  var anchorPayload = anchor.buildAnchorPayload({
+    kind: 'VC_ANCHOR_SHA256',
+    hash: hash,
+    issuerDid: docs.did
+  })
+  
+  // Verify credential
+  var didResolver = async function() { return { jwks: docs.jwks } }
+  var verification = await vcjwt.verifyVcJwt(jwt, { didResolver: didResolver })
+  
+  assert.strictEqual(verification.valid, true, 'Credential should be valid')
+  
+  // Create status list
+  var statusListResult = await statuslist.createStatusList({
+    issuerDid: docs.did,
+    privateJwk: keys.privateJwk
+  })
+  
+  // Revoke credential
+  var updatedList = await statuslist.updateStatusList({
+    listVcJwt: statusListResult.listVcJwt,
+    index: 10,
+    status: 'revoked',
+    privateJwk: keys.privateJwk
+  })
+  
+  // Verify credential is now revoked
+  var verification2 = await vcjwt.verifyVcJwt(jwt, { didResolver: didResolver })
+  var revokedStatus = statuslist.getCredentialStatusEntry({
+    listVcJwt: updatedList.listVcJwt,
+    index: 10
+  })
+  
+  assert.strictEqual(verification2.valid, true, 'JWT signature still valid')
+  assert.strictEqual(revokedStatus, 'revoked', 'But credential is revoked')
+  
+  console.log('   ✅ Complete workflow executed successfully')
+  console.log('   ✅ Issue → Anchor → Verify → Revoke → Verify')
+}
+
+// Run all tests
+async function runTests() {
+  try {
+    var p256Keys = await testES256KeyGeneration()
+    var k1Keys = await testES256KKeyGeneration()
+    var docs = await testDIDDocumentBuilding(p256Keys)
+    var jwt = await testVCIssuanceES256(docs.did, p256Keys)
+    var verification = await testVCVerification(jwt, docs.jwks)
+    var statusListJwt = await testStatusListCreation(docs.did, p256Keys)
+    var revokedListJwt = await testStatusListRevocation(statusListJwt, p256Keys)
+    var hash = testAnchorHashing()
+    var anchorPayload = testAnchorPayload(hash, docs.did)
+    await testEndToEndWorkflow()
+    
+    console.log('\n🎉 All tests passed successfully!')
+    console.log('✅ DID:web generation working')
+    console.log('✅ VC-JWT issuance and verification working')
+    console.log('✅ StatusList2021 revocation working')
+    console.log('✅ BSV anchor hashing working')
+    console.log('✅ ES256 and ES256K support confirmed')
+    
+  } catch (error) {
+    console.error('\n❌ Test failed:', error.message)
+    console.error(error.stack)
+    process.exit(1)
+  }
+}
+
+// Run the test suite
+runTests()