qa360 2.1.7 → 2.2.1

package/core/src/proof/__tests__/signer.test.ts

@@ -0,0 +1,486 @@
+/**
+ * Proof Signer Tests
+ * 
+ * Comprehensive tests for Ed25519 signing operations
+ */
+
+import {
+  generateKeys,
+  saveKeys,
+  loadKeys,
+  keysExist,
+  sign,
+  verify,
+  sha256,
+  testRoundtrip,
+  initializeKeys,
+  ensureProofKeys,
+  type KeyPair,
+} from '../signer.js';
+import { mkdirSync, rmSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+
+describe('Proof Signer - Key Generation', () => {
+  it('should generate valid Ed25519 key pair', () => {
+    const keyPair = generateKeys();
+    
+    expect(keyPair.publicKey).toBeInstanceOf(Uint8Array);
+    expect(keyPair.secretKey).toBeInstanceOf(Uint8Array);
+    expect(keyPair.publicKey.length).toBe(32); // Ed25519 public key
+    expect(keyPair.secretKey.length).toBe(64); // Ed25519 secret key
+  });
+
+  it('should generate unique key pairs', () => {
+    const keyPair1 = generateKeys();
+    const keyPair2 = generateKeys();
+    
+    expect(keyPair1.publicKey).not.toEqual(keyPair2.publicKey);
+    expect(keyPair1.secretKey).not.toEqual(keyPair2.secretKey);
+  });
+});
+
+describe('Proof Signer - Key Storage', () => {
+  let testDir: string;
+
+  beforeEach(() => {
+    testDir = join(tmpdir(), `qa360-signer-test-${Date.now()}`);
+    mkdirSync(testDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true });
+    }
+  });
+
+  it('should save and load key pair', async () => {
+    const keyPair = generateKeys();
+    const paths = {
+      privateKey: join(testDir, 'test.key'),
+      publicKey: join(testDir, 'test.pub'),
+    };
+
+    await saveKeys(keyPair, paths);
+    const loaded = await loadKeys(paths);
+
+    expect(loaded.publicKey).toEqual(keyPair.publicKey);
+    expect(loaded.secretKey).toEqual(keyPair.secretKey);
+  });
+
+  it('should detect existing keys', async () => {
+    const keyPair = generateKeys();
+    const paths = {
+      privateKey: join(testDir, 'test.key'),
+      publicKey: join(testDir, 'test.pub'),
+    };
+
+    expect(await keysExist(paths)).toBe(false);
+    
+    await saveKeys(keyPair, paths);
+    
+    expect(await keysExist(paths)).toBe(true);
+  });
+
+  it('should handle missing keys gracefully', async () => {
+    const paths = {
+      privateKey: join(testDir, 'missing.key'),
+      publicKey: join(testDir, 'missing.pub'),
+    };
+
+    await expect(loadKeys(paths)).rejects.toThrow();
+  });
+});
+
+describe('Proof Signer - Signing Operations', () => {
+  let keyPair: KeyPair;
+
+  beforeEach(() => {
+    keyPair = generateKeys();
+  });
+
+  it('should sign message with valid keypair', () => {
+    const message = 'test message';
+    
+    const signature = sign(message, keyPair.secretKey);
+    
+    expect(typeof signature).toBe('string');
+    expect(signature.length).toBe(88); // Base64 encoded signature
+  });
+
+  it('should produce consistent signatures for same message', () => {
+    const message = 'test message';
+    
+    const sig1 = sign(message, keyPair.secretKey);
+    const sig2 = sign(message, keyPair.secretKey);
+    
+    expect(sig1).toEqual(sig2);
+  });
+
+  it('should produce different signatures for different messages', () => {
+    const message1 = 'message 1';
+    const message2 = 'message 2';
+    
+    const sig1 = sign(message1, keyPair.secretKey);
+    const sig2 = sign(message2, keyPair.secretKey);
+    
+    expect(sig1).not.toEqual(sig2);
+  });
+
+  it('should sign empty message', () => {
+    const emptyMessage = '';
+    
+    const signature = sign(emptyMessage, keyPair.secretKey);
+    
+    expect(typeof signature).toBe('string');
+    expect(signature.length).toBe(88);
+  });
+
+  it('should sign large message', () => {
+    const largeMessage = 'x'.repeat(1024 * 1024); // 1MB string
+    
+    const signature = sign(largeMessage, keyPair.secretKey);
+    
+    expect(typeof signature).toBe('string');
+    expect(signature.length).toBe(88);
+  });
+
+  it('should sign JSON data', () => {
+    const jsonData = JSON.stringify({ key: 'value', timestamp: Date.now() });
+    
+    const signature = sign(jsonData, keyPair.secretKey);
+    
+    expect(typeof signature).toBe('string');
+    expect(signature.length).toBe(88);
+  });
+});
+
+describe('Proof Signer - Verification Operations', () => {
+  let keyPair: KeyPair;
+
+  beforeEach(() => {
+    keyPair = generateKeys();
+  });
+
+  it('should verify valid signature', () => {
+    const message = 'test message';
+    const signature = sign(message, keyPair.secretKey);
+    
+    const valid = verify(message, signature, keyPair.publicKey);
+    
+    expect(valid).toBe(true);
+  });
+
+  it('should reject tampered message', () => {
+    const message = 'test message';
+    const signature = sign(message, keyPair.secretKey);
+    
+    const tamperedMessage = 'tampered message';
+    const valid = verify(tamperedMessage, signature, keyPair.publicKey);
+    
+    expect(valid).toBe(false);
+  });
+
+  it('should reject invalid signature', () => {
+    const message = 'test message';
+    const invalidSignature = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+    
+    const valid = verify(message, invalidSignature, keyPair.publicKey);
+    
+    expect(valid).toBe(false);
+  });
+
+  it('should reject signature with wrong public key', () => {
+    const message = 'test message';
+    const signature = sign(message, keyPair.secretKey);
+    
+    const wrongKeyPair = generateKeys();
+    const valid = verify(message, signature, wrongKeyPair.publicKey);
+    
+    expect(valid).toBe(false);
+  });
+
+  it('should handle corrupted signature gracefully', () => {
+    const message = 'test message';
+    const signature = sign(message, keyPair.secretKey);
+    
+    // Decode, corrupt multiple bytes at binary level, re-encode
+    const sigBytes = Buffer.from(signature, 'base64');
+    sigBytes[0] ^= 0xFF;  // Flip all bits of first byte
+    sigBytes[1] ^= 0xFF;  // Flip all bits of second byte
+    sigBytes[31] ^= 0xFF; // Flip middle byte for extra corruption
+    const corruptedSignature = sigBytes.toString('base64');
+    
+    const valid = verify(message, corruptedSignature, keyPair.publicKey);
+    
+    expect(valid).toBe(false);
+  });
+
+  it('should handle malformed signature', () => {
+    const message = 'test message';
+    const malformedSignature = 'not-a-valid-base64-signature';
+    
+    const valid = verify(message, malformedSignature, keyPair.publicKey);
+    
+    expect(valid).toBe(false);
+  });
+
+  it('should handle empty signature', () => {
+    const message = 'test message';
+    const emptySignature = '';
+    
+    const valid = verify(message, emptySignature, keyPair.publicKey);
+    
+    expect(valid).toBe(false);
+  });
+});
+
+describe('Proof Signer - SHA256 Hashing', () => {
+  it('should compute SHA256 hash', () => {
+    const data = 'test data';
+    
+    const hash = sha256(data);
+    
+    expect(Buffer.isBuffer(hash)).toBe(true);
+    expect(hash.length).toBe(32); // SHA256 output
+  });
+
+  it('should produce consistent hashes', () => {
+    const data = 'test data';
+    
+    const hash1 = sha256(data);
+    const hash2 = sha256(data);
+    
+    expect(hash1.toString('hex')).toEqual(hash2.toString('hex'));
+  });
+
+  it('should produce different hashes for different data', () => {
+    const data1 = 'data 1';
+    const data2 = 'data 2';
+    
+    const hash1 = sha256(data1);
+    const hash2 = sha256(data2);
+    
+    expect(hash1.toString('hex')).not.toEqual(hash2.toString('hex'));
+  });
+
+  it('should hash empty data', () => {
+    const emptyData = '';
+    
+    const hash = sha256(emptyData);
+    
+    expect(Buffer.isBuffer(hash)).toBe(true);
+    expect(hash.length).toBe(32);
+  });
+});
+
+describe('Proof Signer - Round Trip', () => {
+  it('should complete successful round trip', () => {
+    const keyPair = generateKeys();
+    const testData = 'test data for round trip';
+    
+    const result = testRoundtrip(testData, keyPair);
+    
+    expect(result).toBe(true);
+  });
+
+  it('should detect round trip failure with corrupted key', () => {
+    const keyPair = generateKeys();
+    const testData = 'test data';
+    
+    keyPair.publicKey[0] ^= 0xFF;
+    const result = testRoundtrip(testData, keyPair);
+    
+    expect(result).toBe(false);
+  });
+
+  it('should handle round trip with complex JSON', () => {
+    const keyPair = generateKeys();
+    const complexData = JSON.stringify({
+      gates: ['api', 'ui', 'perf'],
+      trustScore: 95,
+      timestamp: '2024-01-01T00:00:00Z',
+    });
+    
+    const result = testRoundtrip(complexData, keyPair);
+    
+    expect(result).toBe(true);
+  });
+});
+
+describe('Proof Signer - Sign/Verify Integration', () => {
+  it('should sign and verify multiple messages in sequence', () => {
+    const keyPair = generateKeys();
+    const messages = [
+      'message 1',
+      'message 2',
+      'message 3',
+    ];
+
+    for (const msg of messages) {
+      const signature = sign(msg, keyPair.secretKey);
+      const valid = verify(msg, signature, keyPair.publicKey);
+      
+      expect(valid).toBe(true);
+    }
+  });
+
+  it('should verify signature format is Ed25519 compatible', () => {
+    const keyPair = generateKeys();
+    const message = 'test';
+    
+    const signature = sign(message, keyPair.secretKey);
+    
+    expect(signature.length).toBe(88); // Base64 encoded signature
+    expect(keyPair.publicKey.length).toBe(32); // Ed25519 public key
+    expect(keyPair.secretKey.length).toBe(64); // Ed25519 secret key
+  });
+
+  it('should handle sign/verify with metadata', () => {
+    const keyPair = generateKeys();
+    const metadata = JSON.stringify({
+      timestamp: new Date().toISOString(),
+      version: '1.0',
+      packHash: 'sha256-abc123',
+    });
+    
+    const signature = sign(metadata, keyPair.secretKey);
+    const valid = verify(metadata, signature, keyPair.publicKey);
+    
+    expect(valid).toBe(true);
+  });
+
+  it('should handle sign/verify with canonical JSON', () => {
+    const keyPair = generateKeys();
+    const canonicalJson = '{"gates":["api","ui"],"trustScore":95}';
+    
+    const signature = sign(canonicalJson, keyPair.secretKey);
+    const valid = verify(canonicalJson, signature, keyPair.publicKey);
+    
+    expect(valid).toBe(true);
+  });
+
+  it('should detect modification in signed data', () => {
+    const keyPair = generateKeys();
+    const originalData = JSON.stringify({ value: 100 });
+    const modifiedData = JSON.stringify({ value: 101 });
+
+    const signature = sign(originalData, keyPair.secretKey);
+    const valid = verify(modifiedData, signature, keyPair.publicKey);
+
+    expect(valid).toBe(false);
+  });
+});
+
+describe('Proof Signer - Key Initialization', () => {
+  let testDir: string;
+
+  beforeEach(() => {
+    testDir = join(tmpdir(), `qa360-init-test-${Date.now()}`);
+    mkdirSync(testDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true });
+    }
+  });
+
+  it('should initialize keys when they do not exist', async () => {
+    const paths = {
+      privateKey: join(testDir, 'init.key'),
+      publicKey: join(testDir, 'init.pub'),
+    };
+
+    const keyPair = await initializeKeys(paths);
+
+    expect(keyPair.publicKey).toBeInstanceOf(Uint8Array);
+    expect(keyPair.secretKey).toBeInstanceOf(Uint8Array);
+    expect(await keysExist(paths)).toBe(true);
+  });
+
+  it('should load existing keys instead of generating new ones', async () => {
+    const paths = {
+      privateKey: join(testDir, 'existing.key'),
+      publicKey: join(testDir, 'existing.pub'),
+    };
+
+    // Generate and save keys first
+    const originalKeyPair = generateKeys();
+    await saveKeys(originalKeyPair, paths);
+
+    // Initialize should load existing keys
+    const loadedKeyPair = await initializeKeys(paths);
+
+    expect(loadedKeyPair.publicKey).toEqual(originalKeyPair.publicKey);
+    expect(loadedKeyPair.secretKey).toEqual(originalKeyPair.secretKey);
+  });
+});
+
+describe('Proof Signer - Ensure Proof Keys', () => {
+  let testDir: string;
+
+  beforeEach(() => {
+    testDir = join(tmpdir(), `qa360-ensure-test-${Date.now()}`);
+    mkdirSync(testDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true });
+    }
+  });
+
+  it('should create keys when they do not exist', async () => {
+    const result = await ensureProofKeys(testDir);
+
+    expect(result.created).toBe(true);
+    expect(result.keys).toBeDefined();
+    expect(result.keys?.publicKey.length).toBe(32);
+    expect(result.keys?.secretKey.length).toBe(64);
+    expect(existsSync(result.paths.pub)).toBe(true);
+    expect(existsSync(result.paths.priv)).toBe(true);
+  });
+
+  it('should load existing keys and not overwrite them', async () => {
+    // First call creates keys
+    const result1 = await ensureProofKeys(testDir);
+    const originalPublicKey = result1.keys!.publicKey;
+
+    // Second call should load existing keys
+    const result2 = await ensureProofKeys(testDir);
+
+    expect(result2.created).toBe(false);
+    expect(result2.keys).toBeDefined();
+    expect(result2.keys?.publicKey).toEqual(originalPublicKey);
+  });
+
+  it('should validate existing key sizes', async () => {
+    // First create valid keys
+    const result1 = await ensureProofKeys(testDir);
+    expect(result1.created).toBe(true);
+
+    // Load them again to verify validation passes
+    const result2 = await ensureProofKeys(testDir);
+    expect(result2.created).toBe(false);
+    expect(result2.keys?.publicKey.length).toBe(32);
+    expect(result2.keys?.secretKey.length).toBe(64);
+  });
+
+  it('should regenerate keys if existing keys are invalid', async () => {
+    const keyDir = join(testDir, 'keys');
+    mkdirSync(keyDir, { recursive: true });
+
+    // Write invalid keys (wrong size)
+    const fs = await import('fs/promises');
+    await fs.writeFile(join(keyDir, 'ed25519.key'), 'invalid_key_data', { mode: 0o600 });
+    await fs.writeFile(join(keyDir, 'ed25519.pub'), 'invalid_key_data', { mode: 0o644 });
+
+    // ensureProofKeys should detect invalid keys and regenerate
+    const result = await ensureProofKeys(testDir);
+
+    expect(result.created).toBe(true);
+    expect(result.keys?.publicKey.length).toBe(32);
+    expect(result.keys?.secretKey.length).toBe(64);
+  });
+});