qa360 2.1.7 → 2.2.0

package/core/src/proof/__tests__/verifier-advanced.test.ts

@@ -0,0 +1,588 @@
+/**
+ * Advanced Proof Verifier Tests
+ *
+ * Tests for artifact verification, file loading, and Phase3 format
+ */
+
+import { promises as fs } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { createHash } from 'crypto';
+import {
+  verifyArtifact,
+  verifyArtifacts,
+  verifyComplete,
+  verifyProofFile,
+  verifyPhase3Proof,
+  VerificationCode,
+  createProofBundle,
+  generateKeys,
+  type ProofBundle,
+  type ProofBundleParams,
+} from '../index.js';
+
+describe('verifyArtifact', () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `qa360-test-${Date.now()}`);
+    await fs.mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await fs.rm(testDir, { recursive: true, force: true });
+  });
+
+  it('should verify artifact with matching hash', async () => {
+    const content = 'test artifact content';
+    const filePath = join(testDir, 'test.txt');
+    await fs.writeFile(filePath, content);
+
+    const hash = createHash('sha256').update(content).digest('hex');
+    const artifact = {
+      name: 'test.txt',
+      path: 'test.txt',
+      sha256: `sha256-${hash}`,
+      size: content.length,
+    };
+
+    const result = await verifyArtifact(artifact, filePath);
+    expect(result).toBe(true);
+  });
+
+  it('should reject artifact with mismatched hash', async () => {
+    const content = 'test content';
+    const filePath = join(testDir, 'test.txt');
+    await fs.writeFile(filePath, content);
+
+    const artifact = {
+      name: 'test.txt',
+      path: 'test.txt',
+      sha256: 'sha256-' + 'a'.repeat(64),
+      size: content.length,
+    };
+
+    const result = await verifyArtifact(artifact, filePath);
+    expect(result).toBe(false);
+  });
+
+  it('should return false for missing file', async () => {
+    const artifact = {
+      name: 'missing.txt',
+      path: 'missing.txt',
+      sha256: 'sha256-' + 'b'.repeat(64),
+      size: 100,
+    };
+
+    const result = await verifyArtifact(artifact, join(testDir, 'missing.txt'));
+    expect(result).toBe(false);
+  });
+
+  it('should handle hash without sha256- prefix', async () => {
+    const content = 'test';
+    const filePath = join(testDir, 'test.txt');
+    await fs.writeFile(filePath, content);
+
+    const hash = createHash('sha256').update(content).digest('hex');
+    const artifact = {
+      name: 'test.txt',
+      path: 'test.txt',
+      sha256: hash, // No prefix
+      size: content.length,
+    };
+
+    const result = await verifyArtifact(artifact, filePath);
+    expect(result).toBe(true);
+  });
+});
+
+describe('verifyArtifacts', () => {
+  let testDir: string;
+  let keyPair: any;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `qa360-test-${Date.now()}`);
+    await fs.mkdir(testDir, { recursive: true });
+    keyPair = generateKeys();
+  });
+
+  afterEach(async () => {
+    await fs.rm(testDir, { recursive: true, force: true });
+  });
+
+  it('should verify all artifacts successfully', async () => {
+    // Create test files
+    await fs.writeFile(join(testDir, 'file1.txt'), 'content1');
+    await fs.writeFile(join(testDir, 'file2.txt'), 'content2');
+
+    const hash1 = createHash('sha256').update('content1').digest('hex');
+    const hash2 = createHash('sha256').update('content2').digest('hex');
+
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [
+        { name: 'file1.txt', path: 'file1.txt', sha256: `sha256-${hash1}`, size: 8 },
+        { name: 'file2.txt', path: 'file2.txt', sha256: `sha256-${hash2}`, size: 8 },
+      ],
+      trustScore: 100,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyArtifacts(bundle, { basePath: testDir });
+
+    expect(result.valid).toBe(true);
+    expect(result.code).toBe(VerificationCode.PROOF_OK);
+    expect(result.details?.artifactsVerified).toBe(2);
+    expect(result.details?.artifactsTotal).toBe(2);
+  });
+
+  it('should detect artifact hash mismatch', async () => {
+    await fs.writeFile(join(testDir, 'file.txt'), 'actual content');
+
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [
+        { name: 'file.txt', path: 'file.txt', sha256: 'sha256-' + 'f'.repeat(64), size: 100 },
+      ],
+      trustScore: 100,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyArtifacts(bundle, { basePath: testDir });
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_ARTIFACT_MISMATCH);
+    expect(result.message).toContain('hash mismatch');
+  });
+
+  it('should detect missing artifact file', async () => {
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [
+        { name: 'missing.txt', path: 'missing.txt', sha256: 'sha256-' + 'a'.repeat(64), size: 100 },
+      ],
+      trustScore: 100,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyArtifacts(bundle, { basePath: testDir });
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_ARTIFACT_MISMATCH);
+    expect(result.message).toContain('mismatch');
+  });
+
+  it('should skip missing artifacts when skipMissing is true', async () => {
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [
+        { name: 'missing.txt', path: 'missing.txt', sha256: 'sha256-' + 'a'.repeat(64), size: 100 },
+      ],
+      trustScore: 100,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyArtifacts(bundle, { basePath: testDir, skipMissing: true });
+
+    expect(result.valid).toBe(true);
+    expect(result.details?.artifactsVerified).toBe(0);
+    expect(result.details?.artifactsTotal).toBe(1);
+  });
+
+  it('should handle bundle with no artifacts', async () => {
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [],
+      trustScore: 100,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyArtifacts(bundle, { basePath: testDir });
+
+    expect(result.valid).toBe(true);
+    expect(result.details?.artifactsVerified).toBe(0);
+    expect(result.details?.artifactsTotal).toBe(0);
+  });
+
+  it('should use artifact name when path is missing', async () => {
+    await fs.writeFile(join(testDir, 'test.txt'), 'content');
+    const hash = createHash('sha256').update('content').digest('hex');
+
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [
+        { name: 'test.txt', sha256: `sha256-${hash}`, size: 7 },
+      ],
+      trustScore: 100,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyArtifacts(bundle, { basePath: testDir });
+
+    expect(result.valid).toBe(true);
+  });
+});
+
+describe('verifyComplete', () => {
+  let testDir: string;
+  let keyPair: any;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `qa360-test-${Date.now()}`);
+    await fs.mkdir(testDir, { recursive: true });
+    keyPair = generateKeys();
+  });
+
+  afterEach(async () => {
+    await fs.rm(testDir, { recursive: true, force: true });
+  });
+
+  it('should verify proof and artifacts together', async () => {
+    await fs.writeFile(join(testDir, 'artifact.txt'), 'data');
+    const hash = createHash('sha256').update('data').digest('hex');
+
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [
+        { name: 'artifact.txt', path: 'artifact.txt', sha256: `sha256-${hash}`, size: 4 },
+      ],
+      trustScore: 95,
+      gates: [{ name: 'test', status: 'pass', metrics: {} }],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyComplete(bundle, { basePath: testDir }, keyPair.publicKey);
+
+    expect(result.valid).toBe(true);
+    expect(result.details?.artifactsVerified).toBe(1);
+    expect(result.details?.trustScore).toBe(95);
+  });
+
+  it('should fail if signature is invalid', async () => {
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [],
+      trustScore: 100,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    // Corrupt the signature while keeping valid base64 format (86 chars + ==)
+    // Change some middle characters to flip the signature bytes
+    const originalSig = bundle.signature;
+    const corruptedSig = originalSig.slice(0, 40) + 'X'.repeat(46) + '==';
+    bundle.signature = corruptedSig;
+
+    const result = await verifyComplete(bundle, {}, keyPair.publicKey);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_INVALID_SIG);
+  });
+
+  it('should fail if artifacts do not match', async () => {
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [
+        { name: 'missing.txt', path: 'missing.txt', sha256: 'sha256-' + 'a'.repeat(64), size: 100 },
+      ],
+      trustScore: 100,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyComplete(bundle, { basePath: testDir }, keyPair.publicKey);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_ARTIFACT_MISMATCH);
+  });
+
+  it('should verify proof without artifacts', async () => {
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [],
+      trustScore: 88,
+      gates: [{ name: 'gate1', status: 'pass', metrics: {} }],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const result = await verifyComplete(bundle, {}, keyPair.publicKey);
+
+    expect(result.valid).toBe(true);
+    expect(result.details?.trustScore).toBe(88);
+  });
+
+  it('should verify without providing public key (loads from system)', async () => {
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [],
+      trustScore: 95,
+      gates: [],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+
+    // Call verifyProofBundle without publicKey to trigger key loading
+    const { verifyProofBundle } = await import('../verifier.js');
+    const result = await verifyProofBundle(bundle);
+
+    // Should either succeed (if keys exist) or fail with PROOF_MISSING_KEY or PROOF_INVALID_SIG
+    // (PROOF_INVALID_SIG happens when keys exist but don't match the bundle's signature)
+    expect(result.code).toBeGreaterThanOrEqual(0);
+    expect([
+      VerificationCode.PROOF_OK,
+      VerificationCode.PROOF_INVALID_SIG,
+      VerificationCode.PROOF_MISSING_KEY
+    ]).toContain(result.code);
+  });
+});
+
+describe('verifyProofFile', () => {
+  let testDir: string;
+  let keyPair: any;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `qa360-test-${Date.now()}`);
+    await fs.mkdir(testDir, { recursive: true });
+    keyPair = generateKeys();
+  });
+
+  afterEach(async () => {
+    await fs.rm(testDir, { recursive: true, force: true });
+  });
+
+  it('should load and verify proof from file', async () => {
+    const params: ProofBundleParams = {
+      startedAt: new Date(),
+      finishedAt: new Date(),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [],
+      trustScore: 92,
+      gates: [{ name: 'test', status: 'pass', metrics: {} }],
+      keyPair,
+    };
+
+    const bundle = await createProofBundle(params);
+    const filePath = join(testDir, 'proof.json');
+    await fs.writeFile(filePath, JSON.stringify(bundle));
+
+    const result = await verifyProofFile(filePath, {}, keyPair.publicKey);
+
+    expect(result.valid).toBe(true);
+    expect(result.details?.trustScore).toBe(92);
+  });
+
+  it('should handle missing file', async () => {
+    const result = await verifyProofFile(join(testDir, 'missing.json'), {}, keyPair.publicKey);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_MALFORMED);
+    expect(result.message).toContain('Failed to load proof');
+  });
+
+  it('should handle invalid JSON', async () => {
+    const filePath = join(testDir, 'invalid.json');
+    await fs.writeFile(filePath, 'not valid json {');
+
+    const result = await verifyProofFile(filePath, {}, keyPair.publicKey);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_MALFORMED);
+  });
+
+  it('should handle corrupted proof data', async () => {
+    const filePath = join(testDir, 'corrupted.json');
+    await fs.writeFile(filePath, JSON.stringify({ invalid: 'data' }));
+
+    const result = await verifyProofFile(filePath, {}, keyPair.publicKey);
+
+    expect(result.valid).toBe(false);
+  });
+});
+
+describe('verifyPhase3Proof', () => {
+  let testDir: string;
+  let keyPair: any;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `qa360-test-${Date.now()}`);
+    await fs.mkdir(testDir, { recursive: true });
+    keyPair = generateKeys();
+  });
+
+  afterEach(async () => {
+    await fs.rm(testDir, { recursive: true, force: true });
+  });
+
+  it('should verify valid Phase3 proof', async () => {
+    const { canonicalize } = await import('../canonicalize.js');
+    const { sign } = await import('../signer.js');
+
+    const payload = {
+      version: '1.0',
+      runId: 'test-123',
+      timestamp: new Date().toISOString(),
+      execution: { trustScore: 95 },
+      gates: [],
+    };
+
+    const canonical = canonicalize(payload) + '\n';
+    const signatureValue = sign(canonical, keyPair.secretKey);
+
+    const proof = {
+      ...payload,
+      signature: {
+        algorithm: 'ed25519',
+        value: signatureValue,
+        publicKey: Buffer.from(keyPair.publicKey).toString('base64'),
+        timestamp: new Date().toISOString(),
+      },
+    };
+
+    const filePath = join(testDir, 'phase3-proof.json');
+    await fs.writeFile(filePath, JSON.stringify(proof));
+
+    const result = await verifyPhase3Proof(filePath);
+
+    expect(result.valid).toBe(true);
+    expect(result.code).toBe(VerificationCode.PROOF_OK);
+    expect(result.details?.trustScore).toBe(95);
+    expect(result.details?.runId).toBe('test-123');
+  });
+
+  it('should reject unsigned Phase3 proof', async () => {
+    const proof = {
+      version: '1.0',
+      runId: 'test-123',
+      timestamp: new Date().toISOString(),
+      signature: {
+        algorithm: 'none',
+      },
+    };
+
+    const filePath = join(testDir, 'unsigned.json');
+    await fs.writeFile(filePath, JSON.stringify(proof));
+
+    const result = await verifyPhase3Proof(filePath);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_INVALID_SIG);
+    expect(result.message).toContain('unsigned');
+  });
+
+  it('should reject Phase3 proof with invalid signature', async () => {
+    const proof = {
+      version: '1.0',
+      runId: 'test-456',
+      timestamp: new Date().toISOString(),
+      execution: { trustScore: 80 },
+      signature: {
+        algorithm: 'ed25519',
+        value: 'invalid-signature',
+        publicKey: Buffer.from(keyPair.publicKey).toString('base64'),
+        timestamp: new Date().toISOString(),
+      },
+    };
+
+    const filePath = join(testDir, 'invalid-sig.json');
+    await fs.writeFile(filePath, JSON.stringify(proof));
+
+    const result = await verifyPhase3Proof(filePath);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_INVALID_SIG);
+    expect(result.message).toContain('tampered');
+  });
+
+  it('should reject non-Phase3 format', async () => {
+    const proof = {
+      notPhase3: true,
+      someOtherData: 'test',
+    };
+
+    const filePath = join(testDir, 'not-phase3.json');
+    await fs.writeFile(filePath, JSON.stringify(proof));
+
+    const result = await verifyPhase3Proof(filePath);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_MALFORMED);
+    expect(result.message).toContain('Not a valid Phase3 proof format');
+  });
+
+  it('should handle missing file', async () => {
+    const result = await verifyPhase3Proof(join(testDir, 'missing.json'));
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_MALFORMED);
+  });
+
+  it('should handle malformed JSON', async () => {
+    const filePath = join(testDir, 'malformed.json');
+    await fs.writeFile(filePath, '{invalid json');
+
+    const result = await verifyPhase3Proof(filePath);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_MALFORMED);
+  });
+
+  it('should reject proof without publicKey', async () => {
+    const proof = {
+      version: '1.0',
+      runId: 'test-789',
+      timestamp: new Date().toISOString(),
+      signature: {
+        algorithm: 'ed25519',
+        value: 'some-signature',
+        // Missing publicKey
+      },
+    };
+
+    const filePath = join(testDir, 'no-pubkey.json');
+    await fs.writeFile(filePath, JSON.stringify(proof));
+
+    const result = await verifyPhase3Proof(filePath);
+
+    expect(result.valid).toBe(false);
+    expect(result.code).toBe(VerificationCode.PROOF_INVALID_SIG);
+  });
+});