feat(authz): add email-authorized GHDR dual signing

server-tools/lake-lamp-authz/ghdr-authorizer.test.js

@@ -0,0 +1,39 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { GhdrAuthorizer } = require("./ghdr-authorizer");
+
+test("GHDR authorizer persists a private key without exposing it and signs a two-minute capability", () => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), "ghdr-authorizer-"));
+  try {
+    const privateKeyFile = path.join(directory, "authorizer.pem");
+    const authorizer = new GhdrAuthorizer({ privateKeyFile, now: () => 1000 });
+    const issued = authorizer.issue({
+      controllerNodeId: "GH-CTRL-GZ-01",
+      targetNodeId: "GH-CVM-MAIN-PROD-01",
+      layoutPayloadSha256: "a".repeat(64),
+      resource: `GH-CVM-MAIN-PROD-01:${"a".repeat(64)}:1`,
+      workorderId: "00000000-0000-4000-8000-000000000001",
+    });
+    assert.equal(fs.statSync(privateKeyFile).mode & 0o777, 0o600);
+    assert.equal(issued.capability.expires_at_unix, 1120);
+    const publicKey = crypto.createPublicKey(authorizer.publicBinding().public_key_pem);
+    assert.equal(
+      crypto.verify(
+        null,
+        Buffer.from(JSON.stringify(issued.capability)),
+        publicKey,
+        Buffer.from(issued.capability_signature_base64url, "base64url"),
+      ),
+      true,
+    );
+    assert.doesNotMatch(JSON.stringify(authorizer.publicBinding()), /PRIVATE KEY/);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});