Verify signed node registration claims

product-source/guanghu-knowledge-base/server/node-registration.test.ts

@@ -0,0 +1,136 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { generateKeyPairSync, sign } from 'node:crypto';
+import {
+  nodeRegistrationClaimSigningBytes,
+  parseNodeRegistrationEndpointRegistry,
+  resolveNodeRegistrationEndpoint,
+  verifyNodeRegistrationClaim,
+} from './node-registration.js';
+
+const NOW = 1_786_291_200_000;
+const COMMIT = 'a'.repeat(40);
+const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+const source = {
+  repositoryId: 'REPO-012' as const,
+  sourceCommit: COMMIT,
+  sourceUrl: `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/node-registration-endpoints.json`,
+};
+
+function endpoint(overrides: Record<string, unknown> = {}) {
+  return {
+    algorithm: 'Ed25519',
+    domainIds: ['DOM-FIFTH-0001'],
+    endpointId: 'GH-NODE-REG-001',
+    nodeTypes: ['local-terminal', 'cloud-resident'],
+    publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
+    signerId: 'GH-NODE-REG-SIGNER-001',
+    status: 'ACTIVE',
+    url: 'https://guanghulab.com/api/ai/v1/node-registrations/claims',
+    ...overrides,
+  };
+}
+
+function registry(endpoints: unknown[] = [endpoint()]) {
+  return parseNodeRegistrationEndpointRegistry({
+    endpoints,
+    registryId: 'GH-AIOS-NODE-REGISTRATION-ENDPOINTS-001',
+    schema: 'gh-aios.node-registration-endpoints/v1',
+    state: 'CURRENT',
+    version: '1.0.0',
+  }, source);
+}
+
+function signedClaim(overrides: Record<string, unknown> = {}) {
+  const payload = {
+    accountId: 'bingshuo',
+    claimId: 'NODE-CLAIM-001',
+    domainId: 'DOM-FIFTH-0001',
+    endpointId: 'GH-NODE-REG-001',
+    expiresAt: NOW + 60_000,
+    issuedAt: NOW - 1_000,
+    nodeId: 'JD-FD-PRIMARY',
+    nodeKeyFingerprint: 'b'.repeat(64),
+    nodeType: 'local-terminal' as const,
+    schema: 'gh-aios.node-registration-claim/v1' as const,
+    signerId: 'GH-NODE-REG-SIGNER-001',
+    ...overrides,
+  };
+  return {
+    ...payload,
+    signature: sign(null, nodeRegistrationClaimSigningBytes(payload as never), privateKey).toString('base64'),
+  };
+}
+
+test('resolves one active endpoint for a domain and node type', () => {
+  const resolved = resolveNodeRegistrationEndpoint(registry(), {
+    domainId: 'DOM-FIFTH-0001',
+    nodeType: 'local-terminal',
+  });
+  assert.equal(resolved?.endpointId, 'GH-NODE-REG-001');
+});
+
+test('rejects credentials, arbitrary origins and ambiguous active scopes', () => {
+  assert.throws(() => registry([endpoint({ url: 'https://user:secret@guanghulab.com/api/ai/v1/node-registrations' })]), /registry_invalid/);
+  assert.throws(() => registry([endpoint({ url: 'https://example.com/api/ai/v1/node-registrations' })]), /registry_invalid/);
+  assert.throws(() => registry([
+    endpoint(),
+    endpoint({ endpointId: 'GH-NODE-REG-002', signerId: 'GH-NODE-REG-SIGNER-002' }),
+  ]), /registry_invalid/);
+});
+
+test('a signed registration binds account, domain, node, type, key and endpoint', () => {
+  const resolved = resolveNodeRegistrationEndpoint(registry(), {
+    domainId: 'DOM-FIFTH-0001',
+    nodeType: 'local-terminal',
+  });
+  assert.ok(resolved);
+  const verified = verifyNodeRegistrationClaim(signedClaim(), {
+    accountId: 'bingshuo',
+    domainId: 'DOM-FIFTH-0001',
+    nodeId: 'JD-FD-PRIMARY',
+    nodeType: 'local-terminal',
+  }, resolved, NOW);
+  assert.equal(verified.nodeKeyFingerprint, 'b'.repeat(64));
+  assert.equal(verified.verifiedAt, NOW);
+});
+
+test('copied booleans, unknown fields, mismatches and expired claims fail closed', () => {
+  const resolved = resolveNodeRegistrationEndpoint(registry(), {
+    domainId: 'DOM-FIFTH-0001',
+    nodeType: 'local-terminal',
+  });
+  assert.ok(resolved);
+  const expected = {
+    accountId: 'bingshuo',
+    domainId: 'DOM-FIFTH-0001',
+    nodeId: 'JD-FD-PRIMARY',
+    nodeType: 'local-terminal' as const,
+  };
+  assert.throws(() => verifyNodeRegistrationClaim({ ...signedClaim(), verified: true }, expected, resolved, NOW), /claim_invalid/);
+  assert.throws(() => verifyNodeRegistrationClaim(signedClaim(), { ...expected, accountId: 'other' }, resolved, NOW), /claim_invalid/);
+  assert.throws(() => verifyNodeRegistrationClaim(signedClaim(), { ...expected, nodeType: 'cloud-resident' }, resolved, NOW), /claim_invalid/);
+  assert.throws(() => verifyNodeRegistrationClaim(signedClaim({ expiresAt: NOW }), expected, resolved, NOW), /claim_invalid/);
+});
+
+test('tampering or signing with another key fails closed', () => {
+  const resolved = resolveNodeRegistrationEndpoint(registry(), {
+    domainId: 'DOM-FIFTH-0001',
+    nodeType: 'local-terminal',
+  });
+  assert.ok(resolved);
+  const expected = {
+    accountId: 'bingshuo',
+    domainId: 'DOM-FIFTH-0001',
+    nodeId: 'JD-FD-PRIMARY',
+    nodeType: 'local-terminal' as const,
+  };
+  assert.throws(() => verifyNodeRegistrationClaim({ ...signedClaim(), nodeKeyFingerprint: 'c'.repeat(64) }, expected, resolved, NOW), /claim_invalid/);
+  const other = generateKeyPairSync('ed25519');
+  const claim = signedClaim();
+  const forged = {
+    ...claim,
+    signature: sign(null, nodeRegistrationClaimSigningBytes(claim), other.privateKey).toString('base64'),
+  };
+  assert.throws(() => verifyNodeRegistrationClaim(forged, expected, resolved, NOW), /claim_invalid/);
+});