@virtru/dsp-sdk 0.5.0 → 0.6.0

package/src/lib/fips-crypto/symmetric.ts

@@ -1,213 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { Binary, type SymmetricKey } from '@opentdf/sdk/singlecontainer';
-import { ConfigurationError } from '@opentdf/sdk';
-import { getVirtruCrypto } from './primitives';
-import { isSymmetricKey, wrapSymmetricKey, unwrapSymmetricKey } from './keys';
-
-type AlgorithmUrn = string;
-type EncryptResult = { payload: Binary; authTag?: Binary };
-type DecryptResult = { payload: Binary };
-
-const AES_CBC_URN = 'http://www.w3.org/2001/04/xmlenc#aes256-cbc';
-
-const SYM_KEY_METHODS = ['encrypt', 'decrypt', 'sign', 'verify'] as const;
-
-/**
- * Generate a random AES-256 symmetric key.
- * The VirtruCryptoKey handle is kept alive inside the opaque SymmetricKey —
- * key material never leaves the FIPS WASM keystore.
- */
-export async function generateKey(length?: number): Promise<SymmetricKey> {
-  const crypto = await getVirtruCrypto();
-  const bitLen = (length || 32) * 8;
-  // extractable=true and internal=true: keystore-based AES key that can be exported
-  // for RSA key-wrapping (encryptWithPublicKey calls exportKey on the DEK).
-  const vKey = await crypto.generateKey(
-    { name: 'AES-GCM', length: bitLen as 256 },
-    true,
-    SYM_KEY_METHODS,
-    true
-  );
-  return wrapSymmetricKey(vKey, bitLen);
-}
-
-/**
- * Encrypt a payload with a symmetric AES key.
- * When payload is a SymmetricKey the key bytes are exported internally to
- * perform key-wrapping — they are never surfaced to the caller.
- */
-export async function encrypt(
-  payload: Binary | SymmetricKey,
-  key: SymmetricKey,
-  iv: Binary,
-  algorithm?: AlgorithmUrn
-): Promise<EncryptResult> {
-  const crypto = await getVirtruCrypto();
-  const algName = algorithm === AES_CBC_URN ? 'AES-CBC' : 'AES-GCM';
-
-  let payloadBytes: Uint8Array;
-  if (isSymmetricKey(payload)) {
-    // Key-wrapping path: export symmetric key bytes from keystore.
-    // Only works if the key was created with extractable:true (e.g. via importSymmetricKey).
-    payloadBytes = await crypto.exportKey('raw', unwrapSymmetricKey(payload));
-  } else {
-    payloadBytes = new Uint8Array(payload.asArrayBuffer());
-  }
-
-  const vKey = unwrapSymmetricKey(key);
-  const ivBytes = new Uint8Array(iv.asArrayBuffer());
-
-  const cipherBytes = await crypto.encrypt(
-    { name: algName, length: 256, iv: ivBytes } as any,
-    vKey,
-    payloadBytes
-  );
-
-  if (algName === 'AES-GCM') {
-    return {
-      payload: Binary.fromArrayBuffer(cipherBytes.slice(0, -16).buffer as ArrayBuffer),
-      authTag: Binary.fromArrayBuffer(cipherBytes.slice(-16).buffer as ArrayBuffer),
-    };
-  }
-  return { payload: Binary.fromArrayBuffer(cipherBytes.buffer as ArrayBuffer) };
-}
-
-/**
- * Decrypt a payload with a symmetric AES key.
- */
-export async function decrypt(
-  payload: Binary,
-  key: SymmetricKey,
-  iv: Binary,
-  algorithm?: AlgorithmUrn,
-  authTag?: Binary
-): Promise<DecryptResult> {
-  const crypto = await getVirtruCrypto();
-  const algName = algorithm === AES_CBC_URN ? 'AES-CBC' : 'AES-GCM';
-
-  let payloadBytes = new Uint8Array(payload.asArrayBuffer());
-  const ivBytes = new Uint8Array(iv.asArrayBuffer());
-
-  if (algName === 'AES-GCM') {
-    if (!authTag) {
-      throw new Error('Missing authTag for AES-GCM decryption');
-    }
-    const tagBytes = new Uint8Array(authTag.asArrayBuffer());
-    const combined = new Uint8Array(payloadBytes.length + tagBytes.length);
-    combined.set(payloadBytes, 0);
-    combined.set(tagBytes, payloadBytes.length);
-    payloadBytes = combined;
-  }
-
-  const vKey = unwrapSymmetricKey(key);
-  const plainBytes = await crypto.decrypt(
-    { name: algName, length: 256, iv: ivBytes } as any,
-    vKey,
-    payloadBytes
-  );
-
-  return { payload: Binary.fromArrayBuffer(plainBytes.buffer as ArrayBuffer) };
-}
-
-// ─── HMAC ─────────────────────────────────────────────────────────────────────
-
-const HMAC_PARAMS = { name: 'HMAC' as const, hash: 'SHA-256' as const };
-
-/**
- * Compute HMAC-SHA256.
- * The SymmetricKey must have been created with extractable:true (e.g. via
- * importSymmetricKey) so its bytes can be re-imported as an HMAC key.
- */
-export async function hmac(data: Uint8Array, key: SymmetricKey): Promise<Uint8Array> {
-  const crypto = await getVirtruCrypto();
-  const vKey = unwrapSymmetricKey(key);
-  // The key was imported with 'sign' usage (see importSymmetricKey).
-  // VirtruCrypto sign() checks usage.includes('sign') then calls the WASM
-  // hmac() with the slot number — the key type string is irrelevant for HMAC.
-  // Do NOT call release() here: the key handle must remain valid for future calls.
-  const sig = await crypto.sign(HMAC_PARAMS, vKey, data);
-  return new Uint8Array(sig);
-}
-
-/**
- * Verify HMAC-SHA256 using constant-time comparison.
- */
-export async function verifyHmac(
-  data: Uint8Array,
-  signature: Uint8Array,
-  key: SymmetricKey
-): Promise<boolean> {
-  const expected = await hmac(data, key);
-  if (signature.length !== expected.length) return false;
-  let mismatch = 0;
-  for (let i = 0; i < signature.length; i++) {
-    mismatch |= signature[i] ^ expected[i];
-  }
-  return mismatch === 0;
-}
-
-// ─── Symmetric Key Import / Split / Merge ─────────────────────────────────────
-
-/**
- * Import raw key bytes as an opaque SymmetricKey.
- * The resulting key is extractable so it can be used for HMAC and key-wrapping.
- */
-export async function importSymmetricKey(keyBytes: Uint8Array): Promise<SymmetricKey> {
-  const crypto = await getVirtruCrypto();
-  const bitLen = keyBytes.length * 8;
-  // Include 'sign'/'verify' so this key can also be used for HMAC-SHA256.
-  // VirtruCrypto's sign() checks key.usage.includes('sign'); the underlying
-  // WASM hmac() takes the slot number and works with any 256-bit key material.
-  const vKey = await crypto.importKey(
-    'raw',
-    keyBytes,
-    { name: 'AES-GCM' },
-    true,
-    SYM_KEY_METHODS
-  );
-  return wrapSymmetricKey(vKey, bitLen);
-}
-
-/**
- * Split a symmetric key into N shares using XOR secret sharing.
- *
- * For numShares === 1 (single-KAS), the key is returned as-is — no key
- * material is exported and no splitting occurs. This is the common DSP case.
- *
- * For numShares > 1 (multi-KAS), XOR secret sharing requires exporting the
- * raw key bytes. This is not yet implemented in FIPS mode.
- */
-export async function splitSymmetricKey(key: SymmetricKey, numShares: number): Promise<SymmetricKey[]> {
-  if (numShares === 1) {
-    return [key];
-  }
-  throw new ConfigurationError(
-    `splitSymmetricKey with ${numShares} shares is not yet supported in FIPS mode. ` +
-    'Multi-KAS key splitting requires raw key export which violates FIPS key boundary constraints.'
-  );
-}
-
-/**
- * Merge symmetric key shares back into the original key using XOR.
- *
- * For a single share (single-KAS), the share is returned as-is — no key
- * material is exported and no XOR occurs. This is the common DSP case.
- *
- * For multiple shares (multi-KAS), XOR merging requires exporting raw key bytes.
- * This is not yet implemented in FIPS mode.
- */
-export async function mergeSymmetricKeys(shares: SymmetricKey[]): Promise<SymmetricKey> {
-  if (shares.length === 0) throw new ConfigurationError('No shares provided to mergeSymmetricKeys');
-  if (shares.length === 1) {
-    return shares[0];
-  }
-  throw new ConfigurationError(
-    `mergeSymmetricKeys with ${shares.length} shares is not yet supported in FIPS mode. ` +
-    'Multi-KAS key merging requires raw key export which violates FIPS key boundary constraints.'
-  );
-}

package/src/lib/fips-crypto-service.ts

@@ -1,58 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { type CryptoService } from '@opentdf/sdk/singlecontainer';
-
-export { initializeFipsCrypto } from './fips-crypto/primitives';
-
-export {
-  wrapPublicKey,
-  wrapPrivateKey,
-  wrapSymmetricKey,
-  wrapKeyPair,
-  unwrapPublicKey,
-  unwrapPrivateKey,
-  unwrapSymmetricKey,
-} from './fips-crypto/keys';
-
-import { randomBytes, digest } from './fips-crypto/primitives';
-import { generateKey, encrypt, decrypt, hmac, verifyHmac, importSymmetricKey, splitSymmetricKey, mergeSymmetricKeys } from './fips-crypto/symmetric';
-import { generateKeyPair, generateSigningKeyPair, encryptWithPublicKey, decryptWithPrivateKey, sign, verify, generateECKeyPair, deriveKeyFromECDH } from './fips-crypto/asymmetric';
-import { importPublicKey, importPrivateKey, exportPublicKeyPem, exportPrivateKeyPem, exportPublicKeyJwk, parsePublicKeyPem, extractPublicKeyPem, jwkToPublicKeyPem } from './fips-crypto/key-format';
-export { importPrivateKey, exportPrivateKeyPem } from './fips-crypto/key-format';
-
-// ─── FipsCryptoService ────────────────────────────────────────────────────────
-
-export const FipsCryptoService: CryptoService = {
-  name: 'FipsCryptoService',
-  method: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
-  decrypt,
-  decryptWithPrivateKey,
-  encrypt,
-  encryptWithPublicKey,
-  generateKey,
-  generateKeyPair,
-  generateSigningKeyPair,
-  randomBytes,
-  sign,
-  verify,
-  hmac,
-  verifyHmac,
-  digest,
-  generateECKeyPair,
-  deriveKeyFromECDH,
-  importPublicKey,
-  importPrivateKey,
-  exportPublicKeyPem,
-  exportPrivateKeyPem,
-  exportPublicKeyJwk,
-  parsePublicKeyPem,
-  extractPublicKeyPem,
-  jwkToPublicKeyPem,
-  importSymmetricKey,
-  splitSymmetricKey,
-  mergeSymmetricKeys,
-};

package/src/lib/utils.test.ts

@@ -1,415 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-
-// Mock all @opentdf imports BEFORE importing utils
-vi.mock('@opentdf/sdk', () => ({
-  AuthProviders: {
-    refreshAuthProvider: vi.fn(),
-  },
-  OpenTDF: vi.fn(),
-  PermissionDeniedError: class PermissionDeniedError extends Error {},
-}));
-
-vi.mock('@opentdf/sdk/singlecontainer', () => ({
-  WebCryptoService: {
-    generateSigningKeyPair: vi.fn().mockResolvedValue({
-      publicKey: {},
-      privateKey: {},
-    }),
-  },
-}));
-
-vi.mock('@opentdf/sdk/platform', () => ({
-  PlatformClient: vi.fn(),
-}));
-
-vi.mock('@opentdf/sdk/platform/policy/objects_pb.js', () => ({
-  Certificate: class Certificate {
-    pem?: string;
-    constructor(data?: any) {
-      if (data) Object.assign(this, data);
-    }
-  },
-}));
-
-vi.mock('@opentdf/sdk/platform/common/common_pb.js', () => ({
-  ActiveStateEnum: {
-    ACTIVE: 1,
-  },
-}));
-
-// Polyfill atob if needed
-if (typeof (globalThis as any).atob === 'undefined') {
-  (globalThis as any).atob = (b64: string) =>
-    Buffer.from(b64, 'base64').toString('binary');
-}
-
-// Mock pkijs/asn1js with a way to control them
-const mockState = {
-  asn1Mode: 'ok' as 'ok' | 'bad-der',
-  verifyResult: { result: true } as { result: boolean; resultMessage?: string },
-};
-
-vi.mock('asn1js', () => ({
-  fromBER: vi.fn((_: ArrayBuffer) => {
-    if (mockState.asn1Mode === 'bad-der') return { offset: -1 };
-    return {
-      offset: 0,
-      result: {
-        subject: { typesAndValues: [] },
-        issuer: { typesAndValues: [] },
-      },
-    };
-  }),
-}));
-
-vi.mock('pkijs', () => {
-  return {
-    Certificate: class Certificate {
-      public subject: any = { typesAndValues: [] };
-      public issuer: any = { typesAndValues: [] };
-      public subjectPublicKeyInfo: any = {};
-      constructor(_: any) {}
-    },
-    CertificateChainValidationEngine: class CertificateChainValidationEngine {
-      constructor(_: any) {}
-      async verify() {
-        return mockState.verifyResult;
-      }
-    },
-  };
-});
-
-// Mock DSPClient
-vi.mock('./client', () => ({
-  DSPClient: vi.fn(),
-}));
-
-// NOW import utils
-import { validateJWSCertificateChain, getTrustedCertificates } from './utils';
-import { DSPClient } from './client';
-import { PlatformClient } from '@opentdf/sdk/platform';
-import { AuthProviders } from '@opentdf/sdk';
-import { WebCryptoService } from '@opentdf/sdk/singlecontainer';
-
-describe('validateJWSCertificateChain', () => {
-  beforeEach(() => {
-    mockState.asn1Mode = 'ok';
-    mockState.verifyResult = { result: true };
-  });
-
-  it('throws error when x5c is empty', async () => {
-    await expect(
-      validateJWSCertificateChain([], [{ pem: '---' }] as any)
-    ).rejects.toThrow(/No certificates provided in x5c array/);
-  });
-
-  it('throws error when too many certificates in x5c', async () => {
-    const tooMany = new Array(11).fill('AQI=');
-    await expect(
-      validateJWSCertificateChain(tooMany, [{ pem: '---' }] as any)
-    ).rejects.toThrow(/Too many certificates in x5c/);
-  });
-
-  it('throws error when no trusted roots provided', async () => {
-    await expect(
-      validateJWSCertificateChain(['AQI='], [] as any)
-    ).rejects.toThrow(/No trusted root certificates provided/);
-  });
-
-  it('fails on invalid base64 in x5c', async () => {
-    await expect(
-      validateJWSCertificateChain(['***not-base64***'], [{ pem: '---' }] as any)
-    ).rejects.toThrow(/Failed to parse certificate at x5c\[0]/);
-  });
-
-  it('fails on ASN.1 parse error', async () => {
-    mockState.asn1Mode = 'bad-der';
-    await expect(
-      validateJWSCertificateChain(['AQI='], [{ pem: '---' }] as any)
-    ).rejects.toThrow(/Invalid DER encoding/);
-  });
-
-  it('returns valid true on successful verification', async () => {
-    const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
-    mockState.verifyResult = { result: true };
-    const res = await validateJWSCertificateChain(['AQI='], [{ pem }] as any);
-    expect(res.valid).toBe(true);
-    expect(res.validationResult.warnings).toEqual([]);
-  });
-
-  it('returns warnings when some trusted roots fail to parse', async () => {
-    const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
-    const res = await validateJWSCertificateChain(['AQI='], [
-      { pem: '' },
-      { pem },
-    ] as any);
-    expect(res.valid).toBe(true);
-    expect(res.validationResult.warnings).toHaveLength(1);
-    expect(res.validationResult.warnings[0]).toMatch(/has no PEM data/);
-  });
-});
-
-describe('getTrustedCertificates', () => {
-  const mockOptions = {
-    oidc: {
-      clientId: 'test-client-id',
-      tokenEndpoint: 'https://auth.test.com/token',
-      userInfoEndpoint: 'https://auth.test.com/userinfo',
-    },
-    platformEndpoint: 'https://platform.test.com',
-    refreshToken: 'test-refresh-token',
-  };
-
-  let mockAuthProvider: any;
-  let mockPlatformClient: any;
-  let mockDSPClient: any;
-  let mockCertificateService: any;
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-
-    // Mock crypto.subtle.generateKey for DPoP signing keys
-    if (!globalThis.crypto) {
-      (globalThis as any).crypto = {};
-    }
-    if (!globalThis.crypto.subtle) {
-      (globalThis.crypto as any).subtle = {};
-    }
-    (globalThis.crypto.subtle as any).generateKey = vi.fn().mockResolvedValue({
-      publicKey: {},
-      privateKey: {},
-    });
-
-    // Mock auth provider
-    mockAuthProvider = {
-      updateClientPublicKey: vi.fn().mockResolvedValue(undefined),
-    };
-
-    (AuthProviders.refreshAuthProvider as any).mockResolvedValue(
-      mockAuthProvider
-    );
-
-    // Mock certificate service
-    mockCertificateService = {
-      listCertificatesByNamespace: vi.fn(),
-    };
-
-    // Mock DSP client
-    mockDSPClient = {
-      v1: {
-        certificateService: mockCertificateService,
-      },
-    };
-
-    (DSPClient as any).mockImplementation(() => mockDSPClient);
-
-    // Mock platform client
-    mockPlatformClient = {
-      v1: {
-        namespace: {
-          listNamespaces: vi.fn(),
-        },
-      },
-    };
-
-    (PlatformClient as any).mockImplementation(() => mockPlatformClient);
-  });
-
-  it('successfully retrieves certificates from a single namespace', async () => {
-    const mockCertificate1 = { pem: 'cert1-pem-data' };
-    const mockCertificate2 = { pem: 'cert2-pem-data' };
-
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
-      certificates: [mockCertificate1, mockCertificate2],
-      pagination: { nextOffset: 0 },
-    });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    expect(result).toHaveLength(2);
-    expect(result).toEqual([mockCertificate1, mockCertificate2]);
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenCalledWith({
-      namespaceId: 'namespace-1',
-      pagination: { limit: 100, offset: 0 },
-    });
-  });
-
-  it('successfully retrieves certificates from multiple namespaces', async () => {
-    const mockCert1 = { pem: 'cert1-pem' };
-    const mockCert2 = { pem: 'cert2-pem' };
-    const mockCert3 = { pem: 'cert3-pem' };
-
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }, { id: 'namespace-2' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace
-      .mockResolvedValueOnce({
-        certificates: [mockCert1, mockCert2],
-        pagination: { nextOffset: 0 },
-      })
-      .mockResolvedValueOnce({
-        certificates: [mockCert3],
-        pagination: { nextOffset: 0 },
-      });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    expect(result).toHaveLength(3);
-    expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenCalledTimes(2);
-  });
-
-  it('handles pagination correctly (multiple pages)', async () => {
-    const mockCert1 = { pem: 'cert1' };
-    const mockCert2 = { pem: 'cert2' };
-    const mockCert3 = { pem: 'cert3' };
-
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    // First page
-    mockCertificateService.listCertificatesByNamespace
-      .mockResolvedValueOnce({
-        certificates: [mockCert1, mockCert2],
-        pagination: { nextOffset: 100 },
-      })
-      // Second page
-      .mockResolvedValueOnce({
-        certificates: [mockCert3],
-        pagination: { nextOffset: 0 },
-      });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    expect(result).toHaveLength(3);
-    expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenCalledTimes(2);
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenNthCalledWith(1, {
-      namespaceId: 'namespace-1',
-      pagination: { limit: 100, offset: 0 },
-    });
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenNthCalledWith(2, {
-      namespaceId: 'namespace-1',
-      pagination: { limit: 100, offset: 100 },
-    });
-  });
-
-  it('handles empty certificate list', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
-      certificates: [],
-      pagination: { nextOffset: 0 },
-    });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    expect(result).toHaveLength(0);
-    expect(result).toEqual([]);
-  });
-
-  it('handles errors from certificate service', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace.mockRejectedValue(
-      new Error('Certificate service error')
-    );
-
-    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow(
-      'Certificate service error'
-    );
-  });
-
-  it('handles errors from namespace listing', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockRejectedValue(
-      new Error('Namespace listing error')
-    );
-
-    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow(
-      'Namespace listing error'
-    );
-  });
-
-  it('initializes auth provider correctly', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [],
-    });
-
-    await getTrustedCertificates(mockOptions);
-
-    expect(AuthProviders.refreshAuthProvider).toHaveBeenCalled();
-    expect(WebCryptoService.generateSigningKeyPair).toHaveBeenCalled();
-    expect(mockAuthProvider.updateClientPublicKey).toHaveBeenCalled();
-  });
-
-  it('creates both PlatformClient and DSPClient with correct config', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [],
-    });
-
-    await getTrustedCertificates(mockOptions);
-
-    expect(PlatformClient).toHaveBeenCalledWith({
-      authProvider: mockAuthProvider,
-      platformUrl: mockOptions.platformEndpoint,
-    });
-
-    expect(DSPClient).toHaveBeenCalledWith({
-      platformUrl: mockOptions.platformEndpoint,
-      authProvider: mockAuthProvider,
-    });
-  });
-
-  it('returns same Certificate type compatible with validateJWSCertificateChain', async () => {
-    const mockCert = {
-      pem: '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----',
-    };
-
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
-      certificates: [mockCert],
-      pagination: { nextOffset: 0 },
-    });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    // Verify the result can be used with validateJWSCertificateChain
-    expect(result[0].pem).toBeDefined();
-
-    // Integration test: verify compatibility with validateJWSCertificateChain
-    const validationResult = await validateJWSCertificateChain(
-      ['AQI='],
-      result
-    );
-    expect(validationResult.valid).toBe(true);
-  });
-});