qa360 2.2.1 → 2.2.13

package/core/src/proof/__tests__/signer.test.ts

@@ -1,486 +0,0 @@
-/**
- * Proof Signer Tests
- * 
- * Comprehensive tests for Ed25519 signing operations
- */
-
-import {
-  generateKeys,
-  saveKeys,
-  loadKeys,
-  keysExist,
-  sign,
-  verify,
-  sha256,
-  testRoundtrip,
-  initializeKeys,
-  ensureProofKeys,
-  type KeyPair,
-} from '../signer.js';
-import { mkdirSync, rmSync, existsSync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
-
-describe('Proof Signer - Key Generation', () => {
-  it('should generate valid Ed25519 key pair', () => {
-    const keyPair = generateKeys();
-    
-    expect(keyPair.publicKey).toBeInstanceOf(Uint8Array);
-    expect(keyPair.secretKey).toBeInstanceOf(Uint8Array);
-    expect(keyPair.publicKey.length).toBe(32); // Ed25519 public key
-    expect(keyPair.secretKey.length).toBe(64); // Ed25519 secret key
-  });
-
-  it('should generate unique key pairs', () => {
-    const keyPair1 = generateKeys();
-    const keyPair2 = generateKeys();
-    
-    expect(keyPair1.publicKey).not.toEqual(keyPair2.publicKey);
-    expect(keyPair1.secretKey).not.toEqual(keyPair2.secretKey);
-  });
-});
-
-describe('Proof Signer - Key Storage', () => {
-  let testDir: string;
-
-  beforeEach(() => {
-    testDir = join(tmpdir(), `qa360-signer-test-${Date.now()}`);
-    mkdirSync(testDir, { recursive: true });
-  });
-
-  afterEach(() => {
-    if (existsSync(testDir)) {
-      rmSync(testDir, { recursive: true, force: true });
-    }
-  });
-
-  it('should save and load key pair', async () => {
-    const keyPair = generateKeys();
-    const paths = {
-      privateKey: join(testDir, 'test.key'),
-      publicKey: join(testDir, 'test.pub'),
-    };
-
-    await saveKeys(keyPair, paths);
-    const loaded = await loadKeys(paths);
-
-    expect(loaded.publicKey).toEqual(keyPair.publicKey);
-    expect(loaded.secretKey).toEqual(keyPair.secretKey);
-  });
-
-  it('should detect existing keys', async () => {
-    const keyPair = generateKeys();
-    const paths = {
-      privateKey: join(testDir, 'test.key'),
-      publicKey: join(testDir, 'test.pub'),
-    };
-
-    expect(await keysExist(paths)).toBe(false);
-    
-    await saveKeys(keyPair, paths);
-    
-    expect(await keysExist(paths)).toBe(true);
-  });
-
-  it('should handle missing keys gracefully', async () => {
-    const paths = {
-      privateKey: join(testDir, 'missing.key'),
-      publicKey: join(testDir, 'missing.pub'),
-    };
-
-    await expect(loadKeys(paths)).rejects.toThrow();
-  });
-});
-
-describe('Proof Signer - Signing Operations', () => {
-  let keyPair: KeyPair;
-
-  beforeEach(() => {
-    keyPair = generateKeys();
-  });
-
-  it('should sign message with valid keypair', () => {
-    const message = 'test message';
-    
-    const signature = sign(message, keyPair.secretKey);
-    
-    expect(typeof signature).toBe('string');
-    expect(signature.length).toBe(88); // Base64 encoded signature
-  });
-
-  it('should produce consistent signatures for same message', () => {
-    const message = 'test message';
-    
-    const sig1 = sign(message, keyPair.secretKey);
-    const sig2 = sign(message, keyPair.secretKey);
-    
-    expect(sig1).toEqual(sig2);
-  });
-
-  it('should produce different signatures for different messages', () => {
-    const message1 = 'message 1';
-    const message2 = 'message 2';
-    
-    const sig1 = sign(message1, keyPair.secretKey);
-    const sig2 = sign(message2, keyPair.secretKey);
-    
-    expect(sig1).not.toEqual(sig2);
-  });
-
-  it('should sign empty message', () => {
-    const emptyMessage = '';
-    
-    const signature = sign(emptyMessage, keyPair.secretKey);
-    
-    expect(typeof signature).toBe('string');
-    expect(signature.length).toBe(88);
-  });
-
-  it('should sign large message', () => {
-    const largeMessage = 'x'.repeat(1024 * 1024); // 1MB string
-    
-    const signature = sign(largeMessage, keyPair.secretKey);
-    
-    expect(typeof signature).toBe('string');
-    expect(signature.length).toBe(88);
-  });
-
-  it('should sign JSON data', () => {
-    const jsonData = JSON.stringify({ key: 'value', timestamp: Date.now() });
-    
-    const signature = sign(jsonData, keyPair.secretKey);
-    
-    expect(typeof signature).toBe('string');
-    expect(signature.length).toBe(88);
-  });
-});
-
-describe('Proof Signer - Verification Operations', () => {
-  let keyPair: KeyPair;
-
-  beforeEach(() => {
-    keyPair = generateKeys();
-  });
-
-  it('should verify valid signature', () => {
-    const message = 'test message';
-    const signature = sign(message, keyPair.secretKey);
-    
-    const valid = verify(message, signature, keyPair.publicKey);
-    
-    expect(valid).toBe(true);
-  });
-
-  it('should reject tampered message', () => {
-    const message = 'test message';
-    const signature = sign(message, keyPair.secretKey);
-    
-    const tamperedMessage = 'tampered message';
-    const valid = verify(tamperedMessage, signature, keyPair.publicKey);
-    
-    expect(valid).toBe(false);
-  });
-
-  it('should reject invalid signature', () => {
-    const message = 'test message';
-    const invalidSignature = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
-    
-    const valid = verify(message, invalidSignature, keyPair.publicKey);
-    
-    expect(valid).toBe(false);
-  });
-
-  it('should reject signature with wrong public key', () => {
-    const message = 'test message';
-    const signature = sign(message, keyPair.secretKey);
-    
-    const wrongKeyPair = generateKeys();
-    const valid = verify(message, signature, wrongKeyPair.publicKey);
-    
-    expect(valid).toBe(false);
-  });
-
-  it('should handle corrupted signature gracefully', () => {
-    const message = 'test message';
-    const signature = sign(message, keyPair.secretKey);
-    
-    // Decode, corrupt multiple bytes at binary level, re-encode
-    const sigBytes = Buffer.from(signature, 'base64');
-    sigBytes[0] ^= 0xFF;  // Flip all bits of first byte
-    sigBytes[1] ^= 0xFF;  // Flip all bits of second byte
-    sigBytes[31] ^= 0xFF; // Flip middle byte for extra corruption
-    const corruptedSignature = sigBytes.toString('base64');
-    
-    const valid = verify(message, corruptedSignature, keyPair.publicKey);
-    
-    expect(valid).toBe(false);
-  });
-
-  it('should handle malformed signature', () => {
-    const message = 'test message';
-    const malformedSignature = 'not-a-valid-base64-signature';
-    
-    const valid = verify(message, malformedSignature, keyPair.publicKey);
-    
-    expect(valid).toBe(false);
-  });
-
-  it('should handle empty signature', () => {
-    const message = 'test message';
-    const emptySignature = '';
-    
-    const valid = verify(message, emptySignature, keyPair.publicKey);
-    
-    expect(valid).toBe(false);
-  });
-});
-
-describe('Proof Signer - SHA256 Hashing', () => {
-  it('should compute SHA256 hash', () => {
-    const data = 'test data';
-    
-    const hash = sha256(data);
-    
-    expect(Buffer.isBuffer(hash)).toBe(true);
-    expect(hash.length).toBe(32); // SHA256 output
-  });
-
-  it('should produce consistent hashes', () => {
-    const data = 'test data';
-    
-    const hash1 = sha256(data);
-    const hash2 = sha256(data);
-    
-    expect(hash1.toString('hex')).toEqual(hash2.toString('hex'));
-  });
-
-  it('should produce different hashes for different data', () => {
-    const data1 = 'data 1';
-    const data2 = 'data 2';
-    
-    const hash1 = sha256(data1);
-    const hash2 = sha256(data2);
-    
-    expect(hash1.toString('hex')).not.toEqual(hash2.toString('hex'));
-  });
-
-  it('should hash empty data', () => {
-    const emptyData = '';
-    
-    const hash = sha256(emptyData);
-    
-    expect(Buffer.isBuffer(hash)).toBe(true);
-    expect(hash.length).toBe(32);
-  });
-});
-
-describe('Proof Signer - Round Trip', () => {
-  it('should complete successful round trip', () => {
-    const keyPair = generateKeys();
-    const testData = 'test data for round trip';
-    
-    const result = testRoundtrip(testData, keyPair);
-    
-    expect(result).toBe(true);
-  });
-
-  it('should detect round trip failure with corrupted key', () => {
-    const keyPair = generateKeys();
-    const testData = 'test data';
-    
-    keyPair.publicKey[0] ^= 0xFF;
-    const result = testRoundtrip(testData, keyPair);
-    
-    expect(result).toBe(false);
-  });
-
-  it('should handle round trip with complex JSON', () => {
-    const keyPair = generateKeys();
-    const complexData = JSON.stringify({
-      gates: ['api', 'ui', 'perf'],
-      trustScore: 95,
-      timestamp: '2024-01-01T00:00:00Z',
-    });
-    
-    const result = testRoundtrip(complexData, keyPair);
-    
-    expect(result).toBe(true);
-  });
-});
-
-describe('Proof Signer - Sign/Verify Integration', () => {
-  it('should sign and verify multiple messages in sequence', () => {
-    const keyPair = generateKeys();
-    const messages = [
-      'message 1',
-      'message 2',
-      'message 3',
-    ];
-
-    for (const msg of messages) {
-      const signature = sign(msg, keyPair.secretKey);
-      const valid = verify(msg, signature, keyPair.publicKey);
-      
-      expect(valid).toBe(true);
-    }
-  });
-
-  it('should verify signature format is Ed25519 compatible', () => {
-    const keyPair = generateKeys();
-    const message = 'test';
-    
-    const signature = sign(message, keyPair.secretKey);
-    
-    expect(signature.length).toBe(88); // Base64 encoded signature
-    expect(keyPair.publicKey.length).toBe(32); // Ed25519 public key
-    expect(keyPair.secretKey.length).toBe(64); // Ed25519 secret key
-  });
-
-  it('should handle sign/verify with metadata', () => {
-    const keyPair = generateKeys();
-    const metadata = JSON.stringify({
-      timestamp: new Date().toISOString(),
-      version: '1.0',
-      packHash: 'sha256-abc123',
-    });
-    
-    const signature = sign(metadata, keyPair.secretKey);
-    const valid = verify(metadata, signature, keyPair.publicKey);
-    
-    expect(valid).toBe(true);
-  });
-
-  it('should handle sign/verify with canonical JSON', () => {
-    const keyPair = generateKeys();
-    const canonicalJson = '{"gates":["api","ui"],"trustScore":95}';
-    
-    const signature = sign(canonicalJson, keyPair.secretKey);
-    const valid = verify(canonicalJson, signature, keyPair.publicKey);
-    
-    expect(valid).toBe(true);
-  });
-
-  it('should detect modification in signed data', () => {
-    const keyPair = generateKeys();
-    const originalData = JSON.stringify({ value: 100 });
-    const modifiedData = JSON.stringify({ value: 101 });
-
-    const signature = sign(originalData, keyPair.secretKey);
-    const valid = verify(modifiedData, signature, keyPair.publicKey);
-
-    expect(valid).toBe(false);
-  });
-});
-
-describe('Proof Signer - Key Initialization', () => {
-  let testDir: string;
-
-  beforeEach(() => {
-    testDir = join(tmpdir(), `qa360-init-test-${Date.now()}`);
-    mkdirSync(testDir, { recursive: true });
-  });
-
-  afterEach(() => {
-    if (existsSync(testDir)) {
-      rmSync(testDir, { recursive: true, force: true });
-    }
-  });
-
-  it('should initialize keys when they do not exist', async () => {
-    const paths = {
-      privateKey: join(testDir, 'init.key'),
-      publicKey: join(testDir, 'init.pub'),
-    };
-
-    const keyPair = await initializeKeys(paths);
-
-    expect(keyPair.publicKey).toBeInstanceOf(Uint8Array);
-    expect(keyPair.secretKey).toBeInstanceOf(Uint8Array);
-    expect(await keysExist(paths)).toBe(true);
-  });
-
-  it('should load existing keys instead of generating new ones', async () => {
-    const paths = {
-      privateKey: join(testDir, 'existing.key'),
-      publicKey: join(testDir, 'existing.pub'),
-    };
-
-    // Generate and save keys first
-    const originalKeyPair = generateKeys();
-    await saveKeys(originalKeyPair, paths);
-
-    // Initialize should load existing keys
-    const loadedKeyPair = await initializeKeys(paths);
-
-    expect(loadedKeyPair.publicKey).toEqual(originalKeyPair.publicKey);
-    expect(loadedKeyPair.secretKey).toEqual(originalKeyPair.secretKey);
-  });
-});
-
-describe('Proof Signer - Ensure Proof Keys', () => {
-  let testDir: string;
-
-  beforeEach(() => {
-    testDir = join(tmpdir(), `qa360-ensure-test-${Date.now()}`);
-    mkdirSync(testDir, { recursive: true });
-  });
-
-  afterEach(() => {
-    if (existsSync(testDir)) {
-      rmSync(testDir, { recursive: true, force: true });
-    }
-  });
-
-  it('should create keys when they do not exist', async () => {
-    const result = await ensureProofKeys(testDir);
-
-    expect(result.created).toBe(true);
-    expect(result.keys).toBeDefined();
-    expect(result.keys?.publicKey.length).toBe(32);
-    expect(result.keys?.secretKey.length).toBe(64);
-    expect(existsSync(result.paths.pub)).toBe(true);
-    expect(existsSync(result.paths.priv)).toBe(true);
-  });
-
-  it('should load existing keys and not overwrite them', async () => {
-    // First call creates keys
-    const result1 = await ensureProofKeys(testDir);
-    const originalPublicKey = result1.keys!.publicKey;
-
-    // Second call should load existing keys
-    const result2 = await ensureProofKeys(testDir);
-
-    expect(result2.created).toBe(false);
-    expect(result2.keys).toBeDefined();
-    expect(result2.keys?.publicKey).toEqual(originalPublicKey);
-  });
-
-  it('should validate existing key sizes', async () => {
-    // First create valid keys
-    const result1 = await ensureProofKeys(testDir);
-    expect(result1.created).toBe(true);
-
-    // Load them again to verify validation passes
-    const result2 = await ensureProofKeys(testDir);
-    expect(result2.created).toBe(false);
-    expect(result2.keys?.publicKey.length).toBe(32);
-    expect(result2.keys?.secretKey.length).toBe(64);
-  });
-
-  it('should regenerate keys if existing keys are invalid', async () => {
-    const keyDir = join(testDir, 'keys');
-    mkdirSync(keyDir, { recursive: true });
-
-    // Write invalid keys (wrong size)
-    const fs = await import('fs/promises');
-    await fs.writeFile(join(keyDir, 'ed25519.key'), 'invalid_key_data', { mode: 0o600 });
-    await fs.writeFile(join(keyDir, 'ed25519.pub'), 'invalid_key_data', { mode: 0o644 });
-
-    // ensureProofKeys should detect invalid keys and regenerate
-    const result = await ensureProofKeys(testDir);
-
-    expect(result.created).toBe(true);
-    expect(result.keys?.publicKey.length).toBe(32);
-    expect(result.keys?.secretKey.length).toBe(64);
-  });
-});