39 lines
1.5 KiB
JavaScript
39 lines
1.5 KiB
JavaScript
|
"use strict";
|
||
|
|
|
||
|
|
const test = require("node:test");
|
||
|
|
const assert = require("node:assert/strict");
|
||
|
|
const crypto = require("node:crypto");
|
||
|
|
const fs = require("node:fs");
|
||
|
|
const os = require("node:os");
|
||
|
|
const path = require("node:path");
|
||
|
|
const { GhdrAuthorizer } = require("./ghdr-authorizer");
|
||
|
|
|
||
|
|
test("GHDR authorizer persists a private key without exposing it and signs a two-minute capability", () => {
|
||
|
|
const directory = fs.mkdtempSync(path.join(os.tmpdir(), "ghdr-authorizer-"));
|
||
|
|
try {
|
||
|
|
const privateKeyFile = path.join(directory, "authorizer.pem");
|
||
|
|
const authorizer = new GhdrAuthorizer({ privateKeyFile, now: () => 1000 });
|
||
|
|
const issued = authorizer.issue({
|
||
|
|
controllerNodeId: "GH-CTRL-GZ-01",
|
||
|
|
targetNodeId: "GH-CVM-MAIN-PROD-01",
|
||
|
|
layoutPayloadSha256: "a".repeat(64),
|
||
|
|
resource: `GH-CVM-MAIN-PROD-01:${"a".repeat(64)}:1`,
|
||
|
|
workorderId: "00000000-0000-4000-8000-000000000001",
|
||
|
|
});
|
||
|
|
assert.equal(fs.statSync(privateKeyFile).mode & 0o777, 0o600);
|
||
|
|
assert.equal(issued.capability.expires_at_unix, 1120);
|
||
|
|
const publicKey = crypto.createPublicKey(authorizer.publicBinding().public_key_pem);
|
||
|
|
assert.equal(
|
||
|
|
crypto.verify(
|
||
|
|
null,
|
||
|
|
Buffer.from(JSON.stringify(issued.capability)),
|
||
|
|
publicKey,
|
||
|
|
Buffer.from(issued.capability_signature_base64url, "base64url"),
|
||
|
|
),
|
||
|
|
true,
|
||
|
|
);
|
||
|
|
assert.doesNotMatch(JSON.stringify(authorizer.publicBinding()), /PRIVATE KEY/);
|
||
|
|
} finally {
|
||
|
|
fs.rmSync(directory, { recursive: true, force: true });
|
||
|
|
}
|
||
|
|
});
|