qa360 2.1.7 → 2.2.0

package/core/src/proof/__tests__/verifier.test.ts

@@ -0,0 +1,413 @@
+/**
+ * Proof Verifier Tests
+ * 
+ * Comprehensive tests for proof bundle verification
+ */
+
+import {
+  verifyProofBundle,
+  createProofBundle,
+  generateKeys,
+  type ProofBundleParams,
+  type VerificationResult,
+} from '../index.js';
+
+describe('Proof Verifier - Valid Proofs', () => {
+  it('should verify a valid signed proof bundle', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '0'.repeat(64),
+      artifacts: [],
+      trustScore: 95,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 150 } },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(true);
+    expect(result.code).toBe(0);
+    expect(result.details?.trustScore).toBe(95);
+  });
+
+  it('should verify proof with multiple gates', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:10:00Z'),
+      packHash: 'sha256-' + 'a'.repeat(64),
+      artifacts: [],
+      trustScore: 87,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 120 } },
+        { name: 'ui', status: 'pass', metrics: { coverage: 85 } },
+        { name: 'perf', status: 'pass', metrics: { p95_ms: 200 } },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(true);
+    expect(result.code).toBe(0);
+  });
+
+  it('should verify proof with artifacts', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + 'b'.repeat(64),
+      artifacts: [
+        { name: 'step1.png', path: 'screenshots/step1.png', sha256: 'sha256-' + 'a'.repeat(64), size: 12345 },
+        { name: 'test.log', path: 'logs/test.log', sha256: 'sha256-' + 'b'.repeat(64), size: 5678 },
+      ],
+      trustScore: 92,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(true);
+    expect(result.details?.artifactsTotal).toBe(2);
+  });
+});
+
+describe('Proof Verifier - Tampered Proofs', () => {
+  it('should detect tampered proof data', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + 'c'.repeat(64),
+      artifacts: [],
+      trustScore: 90,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    
+    // Tamper with proof data
+    bundle.results.trustScore = 100;
+    
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(false);
+    expect(result.code).toBeGreaterThan(0);
+  });
+
+  it('should detect modified gates', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + 'd'.repeat(64),
+      artifacts: [],
+      trustScore: 85,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 150 } },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    
+    // Modify gate status
+    bundle.results.gates[0].status = 'fail';
+    
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(false);
+  });
+
+  it('should detect tampered artifacts', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + 'e'.repeat(64),
+      artifacts: [
+        { name: 'test.png', path: 'test.png', sha256: 'sha256-' + 'f'.repeat(64), size: 1000 },
+      ],
+      trustScore: 88,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    
+    // Modify artifact
+    bundle.artifacts[0].size = 9999;
+    
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(false);
+  });
+});
+
+describe('Proof Verifier - Invalid Signatures', () => {
+  it('should reject proof with invalid signature', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '8'.repeat(64),
+      artifacts: [],
+      trustScore: 90,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    
+    // Corrupt signature
+    bundle.signature = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+    
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(false);
+  });
+
+  it('should reject proof signed with different key', async () => {
+    const keyPair1 = generateKeys();
+    const keyPair2 = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '9'.repeat(64),
+      artifacts: [],
+      trustScore: 85,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair: keyPair1,
+    };
+    
+    const bundle = await createProofBundle(params);
+    
+    // Verify with different key
+    const result = await verifyProofBundle(bundle, keyPair2.publicKey);
+    
+    expect(result.valid).toBe(false);
+  });
+
+  it('should handle malformed signature', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + 'a'.repeat(64),
+      artifacts: [],
+      trustScore: 90,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    
+    // Set malformed signature
+    bundle.signature = 'not-a-valid-signature';
+    
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(false);
+  });
+});
+
+describe('Proof Verifier - Edge Cases', () => {
+  it('should verify proof with empty artifacts', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '1'.repeat(64),
+      artifacts: [],
+      trustScore: 95,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(true);
+    expect(result.details?.artifactsTotal).toBe(0);
+  });
+
+  it('should verify proof with trust score 0', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '2'.repeat(64),
+      artifacts: [],
+      trustScore: 0,
+      gates: [
+        { name: 'api_smoke', status: 'fail', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(true);
+    expect(result.details?.trustScore).toBe(0);
+  });
+
+  it('should verify proof with trust score 100', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '3'.repeat(64),
+      artifacts: [],
+      trustScore: 100,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 100 } },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(true);
+    expect(result.details?.trustScore).toBe(100);
+  });
+
+  it('should handle proof with many gates', async () => {
+    const keyPair = generateKeys();
+    
+    const gates = [
+      { name: 'api_smoke', status: 'pass' as const, metrics: {} },
+      { name: 'ui', status: 'pass' as const, metrics: {} },
+      { name: 'perf', status: 'pass' as const, metrics: {} },
+      { name: 'a11y', status: 'pass' as const, metrics: {} },
+      { name: 'sast', status: 'pass' as const, metrics: {} },
+      { name: 'deps', status: 'pass' as const, metrics: {} },
+      { name: 'secrets', status: 'pass' as const, metrics: {} },
+      { name: 'dast', status: 'pass' as const, metrics: {} },
+    ];
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:10:00Z'),
+      packHash: 'sha256-' + '4'.repeat(64),
+      artifacts: [],
+      trustScore: 98,
+      gates,
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(true);
+    expect(result.details?.artifactsTotal).toBe(0);
+  });
+});
+
+describe('Proof Verifier - Verification Details', () => {
+  it('should include verification code in result', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '5'.repeat(64),
+      artifacts: [],
+      trustScore: 90,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.code).toBeDefined();
+    expect(typeof result.code).toBe('number');
+  });
+
+  it('should include details for valid proof', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '6'.repeat(64),
+      artifacts: [],
+      trustScore: 92,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 145 } },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.details).toBeDefined();
+    expect(result.details?.trustScore).toBe(92);
+    expect(result.details?.trustScore).toBeDefined();
+  });
+
+  it('should provide error details for invalid proof', async () => {
+    const keyPair = generateKeys();
+    
+    const params: ProofBundleParams = {
+      startedAt: new Date('2024-01-01T00:00:00Z'),
+      finishedAt: new Date('2024-01-01T00:05:00Z'),
+      packHash: 'sha256-' + '7'.repeat(64),
+      artifacts: [],
+      trustScore: 85,
+      gates: [
+        { name: 'api_smoke', status: 'pass', metrics: {} },
+      ],
+      keyPair,
+    };
+    
+    const bundle = await createProofBundle(params);
+    bundle.results.trustScore = 99; // Tamper
+    
+    const result = await verifyProofBundle(bundle, keyPair.publicKey);
+    
+    expect(result.valid).toBe(false);
+    expect(result.code).toBeGreaterThan(0);
+  });
+});

package/core/src/proof/bundle.ts

@@ -0,0 +1,290 @@
+/**
+ * Proof Bundle Creation
+ * 
+ * Creates cryptographically signed proof bundles from test run data.
+ * 
+ * @see docs/rfc/proof-bundle-v1.md#3-data-model
+ */
+
+import { randomUUID } from 'crypto';
+import { platform, arch } from 'os';
+import { createHash } from 'crypto';
+import { canonicalizeForSigning } from './canonicalize.js';
+import { sign, initializeKeys, type KeyPair } from './signer.js';
+import { validateProofBundle } from './schema.js';
+
+/**
+ * Proof Bundle structure (matches RFC spec)
+ */
+export interface ProofBundle {
+  spec: 'qa360.proof.v1';
+  run: RunMetadata;
+  artifacts: Artifact[];
+  results: TestResults;
+  signing: SigningMetadata;
+  signature: string;
+}
+
+/**
+ * Run metadata
+ */
+export interface RunMetadata {
+  id: string;
+  startedAt: string;
+  finishedAt: string;
+  environment: Environment;
+  packHash: string;
+  ciContext: CIContext;
+}
+
+/**
+ * Environment information
+ */
+export interface Environment {
+  os: 'windows' | 'linux' | 'darwin';
+  node: string;
+  arch: 'x64' | 'arm64';
+  ci: boolean;
+}
+
+/**
+ * CI context
+ */
+export interface CIContext {
+  provider: string | null;
+}
+
+/**
+ * Artifact metadata
+ */
+export interface Artifact {
+  name: string;
+  sha256: string;
+  size: number;
+  path?: string;
+}
+
+/**
+ * Test results
+ */
+export interface TestResults {
+  trustScore: number;
+  gates: Gate[];
+}
+
+/**
+ * Gate result
+ */
+export interface Gate {
+  name: string;
+  status: 'pass' | 'fail' | 'skip';
+  metrics?: Record<string, any>;
+}
+
+/**
+ * Signing metadata
+ */
+export interface SigningMetadata {
+  algo: 'ed25519';
+  signerId: string;
+  timestamp: TimestampInfo;
+  identity: IdentityInfo;
+}
+
+/**
+ * Timestamp information (Phase 1: none, Phase 2: rfc3161)
+ */
+export interface TimestampInfo {
+  type: 'none' | 'rfc3161';
+  token: string | null;
+}
+
+/**
+ * Identity information (Phase 1: none, Phase 2: did/sigstore)
+ */
+export interface IdentityInfo {
+  type: 'none' | 'did' | 'sigstore';
+  evidence: string | object | null;
+}
+
+/**
+ * Parameters for creating a proof bundle
+ */
+export interface ProofBundleParams {
+  // Run metadata
+  runId?: string; // Auto-generated if not provided
+  startedAt: Date;
+  finishedAt: Date;
+  packHash: string;
+  
+  // Artifacts
+  artifacts: Artifact[];
+  
+  // Results
+  trustScore: number;
+  gates: Gate[];
+  
+  // Signing
+  signerId?: string; // Default: 'local@qa360'
+  keyPair?: KeyPair; // Auto-loaded if not provided
+}
+
+/**
+ * Get current OS in RFC format
+ */
+function getCurrentOS(): 'windows' | 'linux' | 'darwin' {
+  const p = platform();
+  if (p === 'win32') return 'windows';
+  if (p === 'darwin') return 'darwin';
+  return 'linux';
+}
+
+/**
+ * Get current architecture in RFC format
+ */
+function getCurrentArch(): 'x64' | 'arm64' {
+  const a = arch();
+  if (a === 'arm64') return 'arm64';
+  return 'x64';
+}
+
+/**
+ * Get Node.js version (semver format)
+ */
+function getNodeVersion(): string {
+  return process.version.replace(/^v/, '');
+}
+
+/**
+ * Detect if running in CI
+ */
+function isCI(): boolean {
+  return !!(
+    process.env.CI ||
+    process.env.GITHUB_ACTIONS ||
+    process.env.GITLAB_CI ||
+    process.env.CIRCLECI ||
+    process.env.JENKINS_URL
+  );
+}
+
+/**
+ * Detect CI provider
+ */
+function getCIProvider(): string | null {
+  if (process.env.GITHUB_ACTIONS) return 'github-actions';
+  if (process.env.GITLAB_CI) return 'gitlab-ci';
+  if (process.env.CIRCLECI) return 'circleci';
+  if (process.env.JENKINS_URL) return 'jenkins';
+  return null;
+}
+
+/**
+ * Compute SHA-256 hash of string
+ */
+export function computeSHA256(data: string): string {
+  const hash = createHash('sha256').update(data, 'utf-8').digest('hex');
+  return `sha256-${hash}`;
+}
+
+/**
+ * Create unsigned proof bundle (without signature)
+ */
+function createUnsignedBundle(params: ProofBundleParams): Omit<ProofBundle, 'signature'> {
+  return {
+    spec: 'qa360.proof.v1',
+    run: {
+      id: params.runId || randomUUID(),
+      startedAt: params.startedAt.toISOString(),
+      finishedAt: params.finishedAt.toISOString(),
+      environment: {
+        os: getCurrentOS(),
+        node: getNodeVersion(),
+        arch: getCurrentArch(),
+        ci: isCI(),
+      },
+      packHash: params.packHash,
+      ciContext: {
+        provider: getCIProvider(),
+      },
+    },
+    artifacts: params.artifacts,
+    results: {
+      trustScore: params.trustScore,
+      gates: params.gates,
+    },
+    signing: {
+      algo: 'ed25519',
+      signerId: params.signerId || 'local@qa360',
+      timestamp: {
+        type: 'none',
+        token: null,
+      },
+      identity: {
+        type: 'none',
+        evidence: null,
+      },
+    },
+  };
+}
+
+/**
+ * Create and sign a proof bundle
+ * 
+ * @param params - Bundle parameters
+ * @returns Signed proof bundle
+ * 
+ * @example
+ * ```ts
+ * const bundle = await createProofBundle({
+ *   startedAt: new Date('2025-01-01T00:00:00Z'),
+ *   finishedAt: new Date('2025-01-01T00:01:00Z'),
+ *   packHash: 'sha256-abc123...',
+ *   artifacts: [],
+ *   trustScore: 87,
+ *   gates: [{ name: 'api_smoke', status: 'pass' }],
+ * });
+ * ```
+ */
+export async function createProofBundle(params: ProofBundleParams): Promise<ProofBundle> {
+  // Load or initialize keys
+  const keyPair = params.keyPair || await initializeKeys();
+  
+  // Create unsigned bundle
+  const unsigned = createUnsignedBundle(params);
+  
+  // Canonicalize for signing (removes signature field, adds newline)
+  const canonical = canonicalizeForSigning(unsigned);
+  
+  // Sign the canonical form
+  const signature = sign(canonical, keyPair.secretKey);
+  
+  // Create final bundle
+  const bundle: ProofBundle = {
+    ...unsigned,
+    signature,
+  };
+  
+  // Validate against schema
+  const validation = validateProofBundle(bundle);
+  if (!validation.valid) {
+    throw new Error(`Invalid proof bundle: ${validation.errors?.join(', ')}`);
+  }
+  
+  return bundle;
+}
+
+/**
+ * Create proof bundle from pack file content
+ * 
+ * @param packContent - Pack YAML/JSON content
+ * @param params - Other bundle parameters
+ * @returns Signed proof bundle
+ */
+export async function createProofBundleFromPack(
+  packContent: string,
+  params: Omit<ProofBundleParams, 'packHash'>
+): Promise<ProofBundle> {
+  const packHash = computeSHA256(packContent);
+  return createProofBundle({ ...params, packHash });
+}