gitspace 0.2.0-rc.20 → 0.2.0-rc.21

package/src/lib/tmux-lite/crypto/__tests__/helpers/test-identities.ts

@@ -1,142 +0,0 @@
-/**
- * Test identity generation helpers
- *
- * Provides utilities for generating test identities and public identity objects
- * for use in integration tests.
- */
-
-import { generateIdentity, getPublicIdentity } from "../../identity.js";
-import type { Identity, PublicIdentity } from "../../../../../types/identity.js";
-
-/**
- * Generate a test identity with optional label
- *
- * @param label - Optional label for the identity
- * @returns Complete test identity
- *
- * @example
- * ```typescript
- * const alice = createTestIdentity("Alice");
- * const bob = createTestIdentity("Bob");
- * ```
- */
-export function createTestIdentity(label?: string): Identity {
-  return generateIdentity(label);
-}
-
-/**
- * Create a pair of test identities (client and machine)
- *
- * @param clientLabel - Label for client identity
- * @param machineLabel - Label for machine identity
- * @returns Object with client and machine identities
- *
- * @example
- * ```typescript
- * const { client, machine } = createTestIdentityPair();
- * ```
- */
-export function createTestIdentityPair(
-  clientLabel = "Test Client",
-  machineLabel = "Test Machine"
-): { client: Identity; machine: Identity } {
-  return {
-    client: createTestIdentity(clientLabel),
-    machine: createTestIdentity(machineLabel),
-  };
-}
-
-/**
- * Create multiple test identities
- *
- * @param count - Number of identities to create
- * @param labelPrefix - Prefix for identity labels
- * @returns Array of identities
- *
- * @example
- * ```typescript
- * const clients = createTestIdentities(5, "Client");
- * // Creates: "Client 1", "Client 2", etc.
- * ```
- */
-export function createTestIdentities(
-  count: number,
-  labelPrefix = "Identity"
-): Identity[] {
-  return Array.from({ length: count }, (_, i) =>
-    createTestIdentity(`${labelPrefix} ${i + 1}`)
-  );
-}
-
-/**
- * Get public identity from a complete identity
- *
- * Wrapper around getPublicIdentity for convenience
- *
- * @param identity - Complete identity
- * @returns Public identity (safe to share)
- */
-export function toPublicIdentity(identity: Identity): PublicIdentity {
-  return getPublicIdentity(identity);
-}
-
-/**
- * Create a fixture set of identities for testing
- *
- * Returns a pre-configured set of identities with meaningful names
- * for common testing scenarios.
- *
- * @example
- * ```typescript
- * const fixtures = createIdentityFixtures();
- * // fixtures.alice - Client identity
- * // fixtures.bob - Another client
- * // fixtures.machine - Machine/server identity
- * // fixtures.untrusted - Identity not in access list
- * ```
- */
-export function createIdentityFixtures(): {
-  alice: Identity;
-  bob: Identity;
-  machine: Identity;
-  untrusted: Identity;
-  alicePublic: PublicIdentity;
-  bobPublic: PublicIdentity;
-  machinePublic: PublicIdentity;
-  untrustedPublic: PublicIdentity;
-} {
-  const alice = createTestIdentity("Alice (Client)");
-  const bob = createTestIdentity("Bob (Client)");
-  const machine = createTestIdentity("Test Machine");
-  const untrusted = createTestIdentity("Untrusted Client");
-
-  return {
-    alice,
-    bob,
-    machine,
-    untrusted,
-    alicePublic: toPublicIdentity(alice),
-    bobPublic: toPublicIdentity(bob),
-    machinePublic: toPublicIdentity(machine),
-    untrustedPublic: toPublicIdentity(untrusted),
-  };
-}
-
-/**
- * Create an access control list pre-populated with test identities
- *
- * @param acl - AccessControlList to populate
- * @param identities - Identities to add to the list
- * @param accessType - Access type to grant (optional, default: 'full')
- * @param sessionId - Session ID for session-invite (optional)
- */
-export function populateAccessList(
-  acl: import("../../access-control.js").AccessControlList,
-  identities: Identity[],
-  accessType?: import("../../../../../types/identity.js").AccessType,
-  sessionId?: string
-): void {
-  for (const identity of identities) {
-    acl.addEntry(toPublicIdentity(identity), accessType, sessionId);
-  }
-}

package/src/lib/tmux-lite/crypto/__tests__/integration/authorization.integration.test.ts

@@ -1,339 +0,0 @@
-/**
- * Integration tests for authorization scenarios
- *
- * Tests access list and invite token authorization during handshake.
- */
-
-import { describe, it, expect, beforeEach } from "bun:test";
-import {
-  HandshakeHandler,
-  type HandshakeMessage,
-} from "../../../handshake-handler.js";
-import { AccessControlList } from "../../access-control.js";
-import { createInviteToken, isInviteExpired } from "../../invites.js";
-import {
-  createTestIdentityPair,
-  createTestIdentity,
-  toPublicIdentity,
-  createIdentityFixtures,
-} from "../helpers/test-identities.js";
-import { runCompleteHandshake } from "../helpers/handshake-runner.js";
-import type { X3DHResponseMessage, X3DHResultMessage } from "../../../../../types/identity.js";
-import {
-  isReplyResult,
-  getReplyData,
-} from "../../../../../__tests__/test-utils.js";
-
-describe("Authorization Integration", () => {
-  describe("access list authorization", () => {
-    it("should accept client in access list", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-      accessList.addEntry(toPublicIdentity(client));
-
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        { type: "access_list" }
-      );
-
-      expect(result.success).toBe(true);
-      expect(result.machineSession?.peerIdentityId).toBe(client.id);
-    });
-
-    it("should reject client not in access list", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-      // Client NOT added to access list
-
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        { type: "access_list" }
-      );
-
-      expect(result.success).toBe(false);
-      expect(result.error).toContain("Not in access list");
-    });
-
-    it("should respect session-invite access type", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-      accessList.addEntry(toPublicIdentity(client), 'session-invite', 'test-session');
-
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        { type: "access_list" }
-      );
-
-      expect(result.success).toBe(true);
-      expect(result.machineSession?.accessType).toBe('session-invite');
-    });
-
-    it("should respect full access type", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-      accessList.addEntry(toPublicIdentity(client), 'full');
-
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        { type: "access_list" }
-      );
-
-      expect(result.success).toBe(true);
-      expect(result.machineSession?.accessType).toBe('full');
-    });
-
-    it("should reject with expired access entry", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-
-      // Add with expiry in the past
-      const entry = accessList.addEntry(toPublicIdentity(client));
-      // Manually set expiry to past
-      const entries = accessList.export();
-      entries[0].expiresAt = Date.now() - 1000;
-      accessList.import(entries);
-
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        { type: "access_list" }
-      );
-
-      expect(result.success).toBe(false);
-      expect(result.error).toContain("Not in access list");
-    });
-  });
-
-  describe("invite token authorization", () => {
-    it("should accept valid invite token", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        {
-          type: "invite",
-          accessType: 'full',
-        }
-      );
-
-      expect(result.success).toBe(true);
-      expect(result.machineSession?.peerIdentityId).toBe(client.id);
-    });
-
-    it("should use access type from invite token", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        {
-          type: "invite",
-          accessType: 'session-invite',
-          sessionId: 'test-session',
-        }
-      );
-
-      expect(result.success).toBe(true);
-      expect(result.machineSession?.accessType).toBe('session-invite');
-    });
-
-    it("should add client to access list after invite acceptance", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-
-      expect(accessList.hasAccess(client.id)).toBe(false);
-
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        {
-          type: "invite",
-          accessType: 'full',
-        }
-      );
-
-      expect(result.success).toBe(true);
-
-      // Client should now be in access list
-      expect(accessList.hasAccess(client.id)).toBe(true);
-    });
-
-    it("should reject expired invite token", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const accessList = new AccessControlList();
-
-      // Create an already-expired token
-      const result = await runCompleteHandshake(
-        client,
-        machine,
-        accessList,
-        {
-          type: "invite",
-          accessType: 'full',
-          validityMs: -1000, // Expired 1 second ago
-        }
-      );
-
-      expect(result.success).toBe(false);
-      expect(result.error).toContain("expired");
-    });
-
-    it("should reject invite token from different machine", async () => {
-      const { client, machine } = createTestIdentityPair();
-      const otherMachine = createTestIdentity("Other Machine");
-      const accessList = new AccessControlList();
-
-      const handler = new HandshakeHandler({
-        identity: machine,
-        accessList,
-      });
-
-      // Create invite from a different machine
-      const wrongToken = createInviteToken(otherMachine, "wss://test.relay", {
-        accessType: 'full',
-      });
-
-      // Start handshake
-      const { createClientHello, processServerHello, createClientAuth } =
-        await import("../../handshake.js");
-
-      const { state: state1, message: clientHello } = createClientHello();
-
-      const result1 = await handler.processMessage("conn-1", {
-        type: "handshake",
-        phase: "client_hello",
-        data: clientHello,
-      });
-
-      expect(result1.type).toBe("reply");
-      if (!isReplyResult(result1)) throw new Error("Expected reply");
-      const serverHello = getReplyData<X3DHResponseMessage>(result1);
-
-      const state2 = processServerHello(state1, serverHello);
-      expect(state2).not.toBeNull();
-
-      const { message: clientAuth } = createClientAuth(state2!, client, {
-        type: "invite",
-        inviteToken: wrongToken,
-      });
-
-      const result2 = await handler.processMessage("conn-1", {
-        type: "handshake",
-        phase: "client_auth",
-        data: clientAuth,
-      });
-
-      // Should return a reply with rejection (not an error)
-      // The ServerAuth message contains the rejection reason
-      expect(result2.type).toBe("reply");
-      if (isReplyResult(result2)) {
-        const serverAuth = getReplyData<X3DHResultMessage>(result2);
-        expect(serverAuth.result.type).toBe("rejected");
-        if (serverAuth.result.type === "rejected") {
-          expect(serverAuth.result.reason).toContain("not issued by this machine");
-        }
-      }
-    });
-  });
-
-  describe("multiple clients", () => {
-    it("should allow multiple clients with different access types", async () => {
-      const fixtures = createIdentityFixtures();
-      const accessList = new AccessControlList();
-
-      // Alice gets full access
-      accessList.addEntry(fixtures.alicePublic, 'full');
-
-      // Bob gets session-invite
-      accessList.addEntry(fixtures.bobPublic, 'session-invite', 'test-session');
-
-      const [aliceResult, bobResult] = await Promise.all([
-        runCompleteHandshake(
-          fixtures.alice,
-          fixtures.machine,
-          accessList,
-          { type: "access_list" }
-        ),
-        runCompleteHandshake(
-          fixtures.bob,
-          fixtures.machine,
-          accessList,
-          { type: "access_list" }
-        ),
-      ]);
-
-      expect(aliceResult.success).toBe(true);
-      expect(aliceResult.machineSession?.accessType).toBe('full');
-
-      expect(bobResult.success).toBe(true);
-      expect(bobResult.machineSession?.accessType).toBe('session-invite');
-    });
-
-    it("should accept authorized and reject unauthorized simultaneously", async () => {
-      const fixtures = createIdentityFixtures();
-      const accessList = new AccessControlList();
-
-      // Only Alice is authorized
-      accessList.addEntry(fixtures.alicePublic);
-
-      const [aliceResult, untrustedResult] = await Promise.all([
-        runCompleteHandshake(
-          fixtures.alice,
-          fixtures.machine,
-          accessList,
-          { type: "access_list" }
-        ),
-        runCompleteHandshake(
-          fixtures.untrusted,
-          fixtures.machine,
-          accessList,
-          { type: "access_list" }
-        ),
-      ]);
-
-      expect(aliceResult.success).toBe(true);
-      expect(untrustedResult.success).toBe(false);
-    });
-  });
-
-  describe("access type combinations", () => {
-    const accessTypeCombinations: Array<{ accessType: 'full' | 'session-invite'; sessionId?: string }> = [
-      { accessType: 'full' },
-      { accessType: 'session-invite', sessionId: 'session-1' },
-      { accessType: 'session-invite', sessionId: 'session-2' },
-    ];
-
-    for (const config of accessTypeCombinations) {
-      it(`should correctly grant access type: ${config.accessType}${config.sessionId ? ` with sessionId=${config.sessionId}` : ''}`, async () => {
-        const { client, machine } = createTestIdentityPair();
-        const accessList = new AccessControlList();
-        accessList.addEntry(toPublicIdentity(client), config.accessType, config.sessionId);
-
-        const result = await runCompleteHandshake(
-          client,
-          machine,
-          accessList,
-          { type: "access_list" }
-        );
-
-        expect(result.success).toBe(true);
-        expect(result.machineSession?.accessType).toBe(config.accessType);
-      });
-    }
-  });
-});