Require current node possession proof

product-source/guanghu-knowledge-base/server/domain-access-orchestrator.test.ts

@@ -4,6 +4,7 @@ import { createHash, generateKeyPairSync, sign } from 'node:crypto';
 import { domainManifestSigningBytes } from './domain-access.js';
 import { DomainAccessOrchestrator } from './domain-access-orchestrator.js';
 import { nodeRegistrationClaimSigningBytes } from './node-registration.js';
+import { nodePossessionChallengeSigningBytes } from './node-possession-proof.js';
 import { NodeRegistrationSnapshotLoader } from './node-registration-snapshot.js';
 import { TrustedSignerSnapshotLoader } from './trusted-signer-snapshot.js';
 
@@ -18,6 +19,11 @@ const SIGNER_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-he
 const NODE_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/node-registration-endpoints.json`;
 const manifestKeys = generateKeyPairSync('ed25519');
 const registrationKeys = generateKeyPairSync('ed25519');
+const nodeKeys = generateKeyPairSync('ed25519');
+const nodePublicKeyPem = nodeKeys.publicKey.export({ format: 'pem', type: 'spki' }).toString();
+const nodeKeyFingerprint = createHash('sha256')
+  .update(nodeKeys.publicKey.export({ format: 'der', type: 'spki' }))
+  .digest('hex');
 
 function anchor() {
   return {
@@ -118,7 +124,7 @@ function validRegistrationClaim() {
     expiresAt: NOW + 60_000,
     issuedAt: NOW - 1_000,
     nodeId: NODE_ID,
-    nodeKeyFingerprint: 'c'.repeat(64),
+    nodeKeyFingerprint,
     nodeType: NODE_TYPE,
     schema: 'gh-aios.node-registration-claim/v1' as const,
     signerId: 'GH-NODE-REG-SIGNER-001',
@@ -168,6 +174,16 @@ function validHandoff() {
 const loggedOutIdentity = { async read() { return { accountId: '', accountVerified: false, nodeId: '' }; } };
 const loggedInIdentity = { async read() { return { accountId: ACCOUNT_ID, accountVerified: true, nodeId: NODE_ID }; } };
 const validRegistrationSource = { async read() { return validRegistrationClaim(); } };
+const validPossessionSource = {
+  async prove(challenge: Parameters<typeof nodePossessionChallengeSigningBytes>[0]) {
+    return {
+      challengeId: challenge.challengeId,
+      publicKeyPem: nodePublicKeyPem,
+      schema: 'gh-aios.node-possession-response/v1',
+      signature: sign(null, nodePossessionChallengeSigningBytes(challenge), nodeKeys.privateKey).toString('base64'),
+    };
+  },
+};
 
 test('projects both trust-source states without asking for claims or handoff before login', async () => {
   let claimReads = 0;
@@ -177,6 +193,7 @@ test('projects both trust-source states without asking for claims or handoff bef
     registrationLoader(),
     loggedOutIdentity,
     { async read() { claimReads += 1; return null; } },
+    validPossessionSource,
     { async read() { handoffReads += 1; return null; } },
   );
 
@@ -200,6 +217,7 @@ test('a signed node registration without a handoff remains identity-only', async
       observedEndpointId = request.endpoint.endpointId;
       return validRegistrationClaim();
     } },
+    validPossessionSource,
     { async read() { return null; } },
   );
 
@@ -212,6 +230,24 @@ test('a signed node registration without a handoff remains identity-only', async
   assert.ok(status.blockers.includes('verified_domain_manifest_missing'));
 });
 
+test('a signed registration without a fresh node-key proof cannot reach the handoff route', async () => {
+  let handoffReads = 0;
+  const orchestrator = new DomainAccessOrchestrator(
+    signerLoader(),
+    registrationLoader(),
+    loggedInIdentity,
+    validRegistrationSource,
+    { async prove() { return null; } },
+    { async read() { handoffReads += 1; return null; } },
+  );
+
+  const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
+
+  assert.equal(status.stage, 'login-required');
+  assert.ok(status.blockers.includes('verified_node_possession_missing'));
+  assert.equal(handoffReads, 0);
+});
+
 test('a code-channel account cannot supply registration and never contacts a handoff route', async () => {
   let handoffReads = 0;
   const orchestrator = new DomainAccessOrchestrator(
@@ -219,6 +255,7 @@ test('a code-channel account cannot supply registration and never contacts a han
     registrationLoader(),
     loggedInIdentity,
     { async read() { return null; } },
+    validPossessionSource,
     { async read() { handoffReads += 1; return validHandoff() as never; } },
   );
 
@@ -235,6 +272,7 @@ test('current registries, signed node claim and verified handoff project runtime
     registrationLoader(),
     loggedInIdentity,
     validRegistrationSource,
+    validPossessionSource,
     { async read() {
       return {
         handoff: validHandoff(),
@@ -259,6 +297,7 @@ test('source failures are reduced to safe status without raw details', async ()
     unavailableRegistration,
     loggedInIdentity,
     { async read() { claimReads += 1; throw new Error('secret claim detail'); } },
+    { async prove() { throw new Error('secret possession detail'); } },
     { async read() { throw new Error('secret handoff detail'); } },
   );
 
@@ -282,6 +321,7 @@ test('a degraded signer may preserve handoff verification while node registratio
     registrationLoader(),
     loggedInIdentity,
     validRegistrationSource,
+    validPossessionSource,
     { async read() {
       return {
         handoff: validHandoff(),
@@ -308,6 +348,7 @@ test('a degraded node-registration registry cannot authorize a claim', async ()
     currentNodeLoader,
     loggedInIdentity,
     { async read() { claimReads += 1; return validRegistrationClaim(); } },
+    validPossessionSource,
     { async read() { handoffReads += 1; return null; } },
   );