@wenathlan/argan 2.0.81 → 2.0.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/argan",
-  "version": "2.0.81",
+  "version": "2.0.89",
   "repository": {
     "type": "git",
     "url": "https://github.com/wenathlan/devthink"

package/tests/dnssec.test.ts

@@ -0,0 +1,124 @@
+// # dnssec.test — honest unit tests for the DNSSEC validation math, runnable
+// with the node built-in runner (no install, no dependencies):
+//   node --test tests/dnssec.test.ts
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+  DNSSECALGORITHMS,
+  DNSSECDIGESTTYPES,
+  keyTag,
+  parseRrSig,
+  validateChainLink,
+  validateDsMatch,
+  validateSignatureLabels,
+  validateSignatureTtl,
+  validateSignatureWindow,
+  DnssecValidationError,
+  type DnsKey,
+} from "../dnssec.ts";
+
+/** A small DNSKEY whose key tag was computed by hand from the RFC 4034 Appendix B loop. */
+const ZONEKEY: DnsKey = { flags: 256, protocol: 3, algorithm: 8, publicKey: "qrs=" };
+
+/** A fresh RRSIG presentation line over www.example.com. (2026 window). */
+const SIGNATURELINE = "A 8 3 300 20261231235959 20260101000000 18928 www.example.com. dGVzdHNpZ25hdHVyZQ==";
+
+describe("dnssec presentation parsing", () => {
+  it("parses an RRSIG line with its zone-file timestamps", () => {
+    const sig = parseRrSig(SIGNATURELINE);
+    assert.equal(sig.typeCovered, "A");
+    assert.equal(sig.algorithm, 8);
+    assert.equal(sig.labels, 3);
+    assert.equal(sig.originalTtl, 300);
+    assert.equal(sig.keyTag, 18928);
+    assert.equal(sig.signerName, "www.example.com.");
+    assert.equal(sig.expiration, Date.UTC(2026, 11, 31, 23, 59, 59));
+    assert.equal(sig.inception, Date.UTC(2026, 0, 1, 0, 0, 0));
+  });
+
+  it("accepts the optional leading RRSIG token and rejects broken rows", () => {
+    assert.equal(parseRrSig(`RRSIG ${SIGNATURELINE}`).typeCovered, "A");
+    assert.throws(() => parseRrSig("A 8 3"), DnssecValidationError);
+    assert.throws(() => parseRrSig("A 8 3 300 2026 20260101000000 1 example.com. aa"), DnssecValidationError);
+    // expiration before inception is structurally impossible
+    assert.throws(
+      () => parseRrSig("A 8 3 300 20260101000000 20261231235959 1 example.com. aa"),
+      DnssecValidationError,
+    );
+  });
+});
+
+describe("dnssec key tag and chain math", () => {
+  it("computes the RFC 4034 Appendix B checksum by hand", () => {
+    // rdata = 01 00 03 08 aa bb → 256 + 0 + 768 + 8 + 43520 + 187 = 44739
+    assert.equal(keyTag(ZONEKEY), 44739);
+  });
+
+  it("answers the IANA registries the validator consults", () => {
+    assert.equal(DNSSECALGORITHMS.get(15), "ED25519");
+    assert.equal(DNSSECDIGESTTYPES.get(2), "SHA-256");
+    assert.ok(!DNSSECALGORITHMS.has(0));
+  });
+
+  it("matches a DS to its DNSKEY and names the failed check", () => {
+    const ds = { keyTag: keyTag(ZONEKEY), algorithm: 8, digestType: 2, digest: "9f86d081884c7d65" };
+    assert.deepEqual(validateDsMatch(ds, ZONEKEY), { ok: true });
+    assert.deepEqual(validateChainLink(ds, ZONEKEY), { ok: true });
+    const wrongTag = validateDsMatch({ ...ds, keyTag: 1 }, ZONEKEY);
+    assert.equal(wrongTag.ok, false);
+    assert.equal(wrongTag.ok ? "" : wrongTag.code, "key-tag-mismatch");
+    const wrongAlgorithm = validateDsMatch({ ...ds, algorithm: 13 }, ZONEKEY);
+    assert.equal(wrongAlgorithm.ok ? "" : wrongAlgorithm.code, "algorithm-mismatch");
+    const unknownDigest = validateDsMatch({ ...ds, digestType: 9 }, ZONEKEY);
+    assert.equal(unknownDigest.ok ? "" : unknownDigest.code, "unknown-digest-type");
+    const unknownAlgorithm = validateDsMatch({ ...ds, algorithm: 0 }, ZONEKEY);
+    assert.equal(unknownAlgorithm.ok ? "" : unknownAlgorithm.code, "unknown-algorithm");
+    // flags and protocol are part of the rdata, so each mutation recomputes its own DS tag
+    const strippedKey = { ...ZONEKEY, flags: 1 };
+    const noZoneKey = validateDsMatch({ keyTag: keyTag(strippedKey), algorithm: 8, digestType: 2, digest: "aa" }, strippedKey);
+    assert.equal(noZoneKey.ok ? "" : noZoneKey.code, "not-a-zone-key");
+    const oldProtocolKey = { ...ZONEKEY, protocol: 2 };
+    const badProtocol = validateDsMatch({ keyTag: keyTag(oldProtocolKey), algorithm: 8, digestType: 2, digest: "aa" }, oldProtocolKey);
+    assert.equal(badProtocol.ok ? "" : badProtocol.code, "protocol-mismatch");
+  });
+});
+
+describe("dnssec clock and ttl windows", () => {
+  const sig = parseRrSig(SIGNATURELINE);
+
+  it("answers ok inside the validity window and names the reason outside", () => {
+    const inside = Date.UTC(2026, 5, 15, 12, 0, 0);
+    assert.deepEqual(validateSignatureWindow(sig, inside), { ok: true });
+    const after = Date.UTC(2027, 0, 2, 0, 0, 0);
+    const expired = validateSignatureWindow(sig, after);
+    assert.equal(expired.ok ? "" : expired.code, "expired-signature");
+    const before = Date.UTC(2025, 0, 1, 0, 0, 0);
+    const early = validateSignatureWindow(sig, before);
+    assert.equal(early.ok ? "" : early.code, "not-yet-valid-signature");
+  });
+
+  it("honors the clock skew on both edges of the window", () => {
+    const justExpired = sig.expiration + 60_000;
+    assert.equal(validateSignatureWindow(sig, justExpired, 120_000).ok, true);
+    assert.equal(validateSignatureWindow(sig, justExpired, 0).ok, false);
+    const justStarted = sig.inception - 60_000;
+    assert.equal(validateSignatureWindow(sig, justStarted, 120_000).ok, true);
+  });
+
+  it("enforces the rrset ttl equality and the original ttl ceiling", () => {
+    assert.deepEqual(validateSignatureTtl(sig, 300, 300), { ok: true });
+    const mismatch = validateSignatureTtl(sig, 600, 300);
+    assert.equal(mismatch.ok ? "" : mismatch.code, "ttl-mismatch");
+    const ceiling = validateSignatureTtl(parseRrSig("A 8 3 60 20261231235959 20260101000000 1 example.com. aa"), 300, 300);
+    assert.equal(ceiling.ok ? "" : ceiling.code, "ttl-exceeds-original");
+  });
+
+  it("checks the label count with the wildcard rule", () => {
+    assert.deepEqual(validateSignatureLabels(sig, "www.example.com."), { ok: true });
+    // the wildcard drops its leftmost label: *.example.com. signs as 2 labels
+    const wildcard = parseRrSig("A 8 2 300 20261231235959 20260101000000 1 example.com. aa");
+    assert.deepEqual(validateSignatureLabels(wildcard, "*.example.com."), { ok: true });
+    const broken = validateSignatureLabels(sig, "a.b.example.com.");
+    assert.equal(broken.ok ? "" : broken.code, "label-count-mismatch");
+  });
+});

package/tests/zonediff.test.ts

@@ -0,0 +1,162 @@
+// # zonediff.test — honest unit tests for the zone diff, runnable with the node
+// built-in runner (no install, no dependencies):
+//   node --test tests/zonediff.test.ts
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { nextSerial } from "../argan.ts";
+import {
+  diffZoneFiles,
+  diffZones,
+  parseZoneRecords,
+  recordsFromRows,
+  serialForPublication,
+  ZoneDiffError,
+  type ZoneRecord,
+} from "../zonediff.ts";
+
+const ORIGIN = "example.com.";
+
+/** A shorthand record builder. */
+function record(name: string, type: string, ttl: number | undefined, data: string): ZoneRecord {
+  return { name, type, ttl, data };
+}
+
+describe("zonediff parser", () => {
+  it("parses absolute and relative owners, @, ttl and class in both orders", () => {
+    const text = [
+      "example.com.      300 IN SOA ns1.example.com. hostmaster.example.com. 1 2 3 4 5",
+      "www         3600 IN A   192.0.2.10",
+      "@                 IN  A   192.0.2.1",
+      "mail      IN 600  A   192.0.2.20",
+    ].join("\n");
+    const records = parseZoneRecords(text, ORIGIN);
+    assert.equal(records.length, 4);
+    assert.equal(records[0].name, "example.com.");
+    assert.equal(records[0].type, "SOA");
+    assert.equal(records[0].ttl, 300);
+    assert.equal(records[1].name, "www.example.com.");
+    assert.equal(records[1].ttl, 3600);
+    assert.equal(records[2].name, "example.com.");
+    assert.equal(records[2].ttl, undefined);
+    assert.equal(records[3].name, "mail.example.com.");
+    assert.equal(records[3].ttl, 600);
+  });
+
+  it("honors $TTL, $ORIGIN, unit ttls and name normalization in rdata", () => {
+    const text = [
+      "$TTL 1h30m",
+      "$ORIGIN example.com.",
+      "www     10m  A    192.0.2.10",
+      "api          CNAME www",
+      "@       300  MX   10 Mail",
+      "_sip._tcp    SRV  10 60 5060 sipserver",
+    ].join("\n");
+    const records = parseZoneRecords(text, "example.org.");
+    assert.equal(records[0].ttl, 600);
+    assert.equal(records[1].data, "www.example.com.");
+    assert.equal(records[2].data, "10 mail.example.com.");
+    assert.equal(records[3].data, "10 60 5060 sipserver.example.com.");
+    // a record without its own ttl inherits the $TTL default (RFC 2308)
+    assert.equal(records[1].ttl, 5400);
+  });
+
+  it("inherits the owner on indented lines and joins parenthesized continuations", () => {
+    const text = [
+      "$ORIGIN example.com.",
+      "@   300 IN SOA ns1.example.com. hostmaster.example.com. (",
+      "        2026010101 ; serial",
+      "        7200       ; refresh",
+      "        )",
+      "www     300 IN A 192.0.2.10",
+    ].join("\n");
+    const records = parseZoneRecords(text, ORIGIN);
+    assert.equal(records.length, 2);
+    assert.equal(records[0].type, "SOA");
+    assert.equal(records[0].name, "example.com.");
+    assert.ok(records[0].data.includes("2026010101"));
+    assert.ok(records[0].data.includes("7200"));
+  });
+
+  it("drops comments and quoted-content keeps spaces", () => {
+    const text = ['chat 300 IN TXT "hello world" ; the greeting'].join("\n");
+    const records = parseZoneRecords(text, ORIGIN);
+    assert.equal(records[0].data, "hello world");
+  });
+
+  it("throws a traceable ZoneDiffError with the line number", () => {
+    const text = ["ok 300 IN A 192.0.2.1", "broken 300 IN"].join("\n");
+    assert.throws(
+      () => parseZoneRecords(text, ORIGIN),
+      (error: unknown) => error instanceof ZoneDiffError && error.line === 2,
+    );
+  });
+});
+
+describe("zonediff planner", () => {
+  it("answers an empty diff for identical records", () => {
+    const zone = [
+      record("example.com.", "A", 300, "192.0.2.1"),
+      record("www.example.com.", "A", 300, "192.0.2.10"),
+      record("www.example.com.", "AAAA", 300, "2001:db8::10"),
+    ];
+    const diff = diffZones(zone, [...zone].reverse());
+    assert.deepEqual(diff, { creates: [], deletes: [], updates: [] });
+  });
+
+  it("detects creates, deletes and target updates", () => {
+    const current = [
+      record("example.com.", "A", 300, "192.0.2.1"),
+      record("old.example.com.", "A", 300, "192.0.2.2"),
+      record("www.example.com.", "CNAME", 300, "web.example.com."),
+    ];
+    const desired = [
+      record("example.com.", "A", 300, "192.0.2.1"),
+      record("new.example.com.", "A", 300, "192.0.2.3"),
+      record("www.example.com.", "CNAME", 300, "edge.example.com."),
+    ];
+    const diff = diffZones(current, desired);
+    assert.equal(diff.creates.length, 1);
+    assert.equal(diff.creates[0].after?.name, "new.example.com.");
+    assert.equal(diff.deletes.length, 1);
+    assert.equal(diff.deletes[0].before?.name, "old.example.com.");
+    assert.equal(diff.updates.length, 1);
+    assert.equal(diff.updates[0].reason, "targets");
+    assert.equal(diff.updates[0].before?.data, "web.example.com.");
+    assert.equal(diff.updates[0].after?.data, "edge.example.com.");
+  });
+
+  it("never changes on round robin order and reports ttl-only updates", () => {
+    const current = [record("api.example.com.", "A", 300, "192.0.2.1"), record("api.example.com.", "A", 300, "192.0.2.2")];
+    const reordered = [record("api.example.com.", "A", 300, "192.0.2.2"), record("api.example.com.", "A", 300, "192.0.2.1")];
+    assert.deepEqual(diffZones(current, reordered), { creates: [], deletes: [], updates: [] });
+    const rettl = current.map((entry) => record(entry.name, entry.type, 600, entry.data));
+    const diff = diffZones(current, rettl);
+    assert.equal(diff.updates.length, 1);
+    assert.equal(diff.updates[0].reason, "ttl");
+    assert.equal(diff.updates[0].before?.ttl, 300);
+    assert.equal(diff.updates[0].after?.ttl, 600);
+  });
+
+  it("keeps the serial when the diff is empty and bumps it through argan.nextSerial", () => {
+    const zone = [record("example.com.", "A", 300, "192.0.2.1")];
+    const serial = "2026093001";
+    assert.equal(serialForPublication(diffZones(zone, zone), serial), serial);
+    assert.equal(serialForPublication(diffZones(zone, []), serial), nextSerial(serial));
+    assert.equal(nextSerial("2026093001"), "2026093002");
+  });
+
+  it("diffs two verbatim zone files and bridges the RecordSetRow tables", () => {
+    const currentText = "www 300 IN A 192.0.2.10";
+    const desiredText = "www 300 IN A 192.0.2.11";
+    const diff = diffZoneFiles(currentText, desiredText, ORIGIN);
+    assert.equal(diff.updates.length, 1);
+    const rows = [
+      { kind: "record" as const, name: "www", type: "A", data: "192.0.2.10", line: "www 300 IN A 192.0.2.10" },
+      { kind: "blank" as const, line: "" },
+    ];
+    const records = recordsFromRows(rows, ORIGIN);
+    assert.equal(records.length, 1);
+    assert.equal(records[0].name, "www.example.com.");
+    assert.deepEqual(diffZones(records, parseZoneRecords(desiredText, ORIGIN)).updates.length, 1);
+  });
+});