multimodel-dev-os 3.1.0 → 3.5.0

package/tests/unit/registry-trust-store.test.js

@@ -0,0 +1,133 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { loadTrustedKeys } from '../../src/registry/trust-store.js';
+import { verifySignatureBlock } from '../../src/registry/signing.js';
+
+const tempDir = join(process.cwd(), 'temp-trust-store-test');
+
+describe('Registry Trust Store — loadTrustedKeys', () => {
+  beforeAll(() => {
+    mkdirSync(join(tempDir, '.ai', 'registries'), { recursive: true });
+  });
+
+  afterAll(() => {
+    if (existsSync(tempDir)) {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('returns empty array when no trusted-keys.yaml exists', () => {
+    const noKeysDir = join(tempDir, 'no-keys-dir');
+    mkdirSync(noKeysDir, { recursive: true });
+    const result = loadTrustedKeys(noKeysDir);
+    expect(result).toEqual([]);
+  });
+
+  it('returns parsed trusted keys list when trusted-keys.yaml exists', () => {
+    const yamlContent = `
+trusted_publishers:
+  - key_id: official-key
+    name: Official Maintainer
+    algorithm: ed25519
+    public_key: "-----BEGIN PUBLIC KEY-----\\n..."
+    scopes:
+      - registry
+    status: active
+`;
+    writeFileSync(join(tempDir, '.ai', 'registries', 'trusted-keys.yaml'), yamlContent, 'utf8');
+    const result = loadTrustedKeys(tempDir);
+    expect(result).toHaveLength(1);
+    expect(result[0].key_id).toBe('official-key');
+    expect(result[0].name).toBe('Official Maintainer');
+  });
+});
+
+describe('Registry Trust Store — Status & Scope Validation', () => {
+  const trustedKeys = [
+    {
+      key_id: 'active-key',
+      name: 'Active Key',
+      algorithm: 'ed25519',
+      public_key: 'MCowBQYDK2VwAyEA9vWwyE5+fY0dvEzl9S1UcvtoMkOAIDhDCzZAkP+CVNo=',
+      scopes: ['registry'],
+      status: 'active'
+    },
+    {
+      key_id: 'disabled-key',
+      name: 'Disabled Key',
+      algorithm: 'ed25519',
+      public_key: 'MCowBQYDK2VwAyEA9vWwyE5+fY0dvEzl9S1UcvtoMkOAIDhDCzZAkP+CVNo=',
+      scopes: ['registry'],
+      status: 'disabled'
+    },
+    {
+      key_id: 'revoked-key',
+      name: 'Revoked Key',
+      algorithm: 'ed25519',
+      public_key: 'MCowBQYDK2VwAyEA9vWwyE5+fY0dvEzl9S1UcvtoMkOAIDhDCzZAkP+CVNo=',
+      scopes: ['registry'],
+      status: 'revoked'
+    },
+    {
+      key_id: 'wrong-scope-key',
+      name: 'Wrong Scope Key',
+      algorithm: 'ed25519',
+      public_key: 'MCowBQYDK2VwAyEA9vWwyE5+fY0dvEzl9S1UcvtoMkOAIDhDCzZAkP+CVNo=',
+      scopes: ['other'],
+      status: 'active'
+    }
+  ];
+
+  const manifestTemplate = {
+    registry_name: 'test-registry',
+    publisher: 'Test Publisher',
+    version: '1.0.0',
+    catalog_hash: 'sha256:abc',
+    signature: {
+      algorithm: 'ed25519',
+      key_id: 'active-key',
+      signature: 'sig',
+      signed_fields: ['registry_name', 'version', 'catalog_hash']
+    }
+  };
+
+  it('fails verification if key is disabled', () => {
+    const manifest = {
+      ...manifestTemplate,
+      signature: {
+        ...manifestTemplate.signature,
+        key_id: 'disabled-key'
+      }
+    };
+    const res = verifySignatureBlock({ manifest, trustedKeys });
+    expect(res.verified).toBe(false);
+    expect(res.errors[0]).toContain('must be active');
+  });
+
+  it('fails verification if key is revoked', () => {
+    const manifest = {
+      ...manifestTemplate,
+      signature: {
+        ...manifestTemplate.signature,
+        key_id: 'revoked-key'
+      }
+    };
+    const res = verifySignatureBlock({ manifest, trustedKeys });
+    expect(res.verified).toBe(false);
+    expect(res.errors[0]).toContain('must be active');
+  });
+
+  it('fails verification if scope does not include registry or catalog', () => {
+    const manifest = {
+      ...manifestTemplate,
+      signature: {
+        ...manifestTemplate.signature,
+        key_id: 'wrong-scope-key'
+      }
+    };
+    const res = verifySignatureBlock({ manifest, trustedKeys });
+    expect(res.verified).toBe(false);
+    expect(res.errors[0]).toContain('does not have required scope');
+  });
+});

package/tests/unit/registry-url-validation.test.js

@@ -0,0 +1,64 @@
+import { describe, it, expect } from 'vitest';
+import { validateRegistryUrl } from '../../src/registry/validation.js';
+
+describe('Registry URL Validation', () => {
+  it('should accept valid HTTPS URLs', () => {
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml')).not.toThrow();
+    expect(() => validateRegistryUrl('https://raw.githubusercontent.com/user/repo/main/catalog.yaml')).not.toThrow();
+  });
+
+  it('should reject empty or non-string URLs', () => {
+    expect(() => validateRegistryUrl(null)).toThrow('Registry URL must be a non-empty string.');
+    expect(() => validateRegistryUrl('')).toThrow('Registry URL must be a non-empty string.');
+    expect(() => validateRegistryUrl(123)).toThrow('Registry URL must be a non-empty string.');
+  });
+
+  it('should reject URLs with whitespace or control characters', () => {
+    expect(() => validateRegistryUrl('https://example.com/cat alog.yaml')).toThrow('whitespace or control characters');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml\n')).toThrow('whitespace or control characters');
+  });
+
+  it('should reject URLs containing quotes or backticks', () => {
+    expect(() => validateRegistryUrl("https://example.com/catalog.yaml'")).toThrow('quotes or backticks');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml"')).toThrow('quotes or backticks');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml`')).toThrow('quotes or backticks');
+  });
+
+  it('should reject URLs containing shell metacharacters', () => {
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml;echo')).toThrow('shell metacharacters');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml&foo')).toThrow('shell metacharacters');
+    expect(() => validateRegistryUrl('https://example.com/catalog.yaml$foo')).toThrow('shell metacharacters');
+  });
+
+  it('should reject malformed URLs', () => {
+    expect(() => validateRegistryUrl('not-a-url')).toThrow('malformed or invalid');
+  });
+
+  it('should reject URLs containing credentials', () => {
+    expect(() => validateRegistryUrl('https://user:password@example.com/catalog.yaml')).toThrow('credentials');
+    expect(() => validateRegistryUrl('https://user@example.com/catalog.yaml')).toThrow('credentials');
+  });
+
+  it('should reject non-HTTPS remote URLs by default', () => {
+    expect(() => validateRegistryUrl('http://example.com/catalog.yaml')).toThrow('Only HTTPS is permitted');
+    expect(() => validateRegistryUrl('ftp://example.com/catalog.yaml')).toThrow('Only HTTPS is permitted');
+  });
+
+  describe('Localhost HTTP Allowance', () => {
+    it('should reject HTTP localhost by default', () => {
+      expect(() => validateRegistryUrl('http://localhost/catalog.yaml')).toThrow('Only HTTPS is permitted');
+      expect(() => validateRegistryUrl('http://127.0.0.1/catalog.yaml')).toThrow('Only HTTPS is permitted');
+    });
+
+    it('should allow HTTP localhost if policy explicitly allows it', () => {
+      const policy = { allow_http_localhost: true };
+      expect(() => validateRegistryUrl('http://localhost/catalog.yaml', policy)).not.toThrow();
+      expect(() => validateRegistryUrl('http://127.0.0.1/catalog.yaml', policy)).not.toThrow();
+    });
+
+    it('should still reject HTTP non-localhost even if policy allows HTTP localhost', () => {
+      const policy = { allow_http_localhost: true };
+      expect(() => validateRegistryUrl('http://example.com/catalog.yaml', policy)).toThrow('Only HTTPS is permitted');
+    });
+  });
+});

package/tests/unit/yaml.test.js

@@ -0,0 +1,92 @@
+import { describe, it, expect } from 'vitest';
+import { parseYaml, parseFlowArray } from '../../src/core/yaml.js';
+
+describe('YAML Parser', () => {
+  describe('parseFlowArray', () => {
+    it('should parse standard flow arrays', () => {
+      expect(parseFlowArray('[a, b, c]')).toEqual(['a', 'b', 'c']);
+      expect(parseFlowArray('["a", \'b\', c]')).toEqual(['a', 'b', 'c']);
+      expect(parseFlowArray('[true, false, null, 123, -45]')).toEqual([true, false, null, 123, -45]);
+    });
+
+    it('should handle empty flow array', () => {
+      expect(parseFlowArray('[]')).toEqual([]);
+    });
+  });
+
+  describe('parseYaml', () => {
+    it('should parse basic key-value pairs', () => {
+      const yaml = `
+        name: test-plugin
+        version: "1.0.0"
+        enabled: true
+        count: 42
+      `;
+      const result = parseYaml(yaml);
+      expect(result).toEqual({
+        name: 'test-plugin',
+        version: '1.0.0',
+        enabled: true,
+        count: 42
+      });
+    });
+
+    it('should ignore comments', () => {
+      const yaml = `
+        # This is a comment
+        name: test-plugin # trailing comment
+        version: '1.0.0'
+      `;
+      const result = parseYaml(yaml);
+      expect(result).toEqual({
+        name: 'test-plugin',
+        version: '1.0.0'
+      });
+    });
+
+    it('should not treat comments inside quoted strings as comments', () => {
+      const yaml = `
+        name: "test # plugin"
+        description: 'simple # description'
+      `;
+      const result = parseYaml(yaml);
+      expect(result).toEqual({
+        name: 'test # plugin',
+        description: 'simple # description'
+      });
+    });
+
+    it('should parse nested objects', () => {
+      const yaml = `
+        meta:
+          name: test
+          slug: test-slug
+      `;
+      const result = parseYaml(yaml);
+      expect(result).toEqual({
+        meta: {
+          name: 'test',
+          slug: 'test-slug'
+        }
+      });
+    });
+
+    it('should parse list arrays', () => {
+      const yaml = `
+        items:
+          - one
+          - "two"
+          - three
+      `;
+      const result = parseYaml(yaml);
+      expect(result).toEqual({
+        items: ['one', 'two', 'three']
+      });
+    });
+
+    it('should return empty object on malformed YAML', () => {
+      const result = parseYaml(null);
+      expect(result).toEqual({});
+    });
+  });
+});