feat(domain-access): load trusted signer registry

product-source/guanghu-knowledge-base/server/trusted-signer-registry.test.ts

@@ -0,0 +1,104 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { generateKeyPairSync } from 'node:crypto';
+import {
+  assertRegisteredTrustedManifestSigner,
+  parseTrustedManifestSignerRegistry,
+  resolveTrustedManifestSigner,
+} from './trusted-signer-registry.js';
+
+const COMMIT = 'd'.repeat(40);
+const SOURCE = {
+  repositoryId: 'REPO-012',
+  sourceCommit: COMMIT,
+  sourceUrl: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
+} as const;
+const publicKeyPem = generateKeyPairSync('ed25519').publicKey
+  .export({ format: 'pem', type: 'spki' }).toString();
+
+function registry(signers: unknown[] = []) {
+  return {
+    registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
+    schema: 'gh-aios.trusted-domain-manifest-signers/v1',
+    signers,
+    state: 'CURRENT',
+    version: '1.0.0',
+  };
+}
+
+function signer(overrides: Record<string, unknown> = {}) {
+  return {
+    algorithm: 'Ed25519',
+    domainIds: ['DOM-FIFTH-0001'],
+    publicKeyPem,
+    repositoryId: 'REPO-014',
+    signerId: 'GH-LIGHTHOUSE-001',
+    status: 'ACTIVE',
+    ...overrides,
+  };
+}
+
+test('an empty current registry is safe and trusts no signer', () => {
+  const parsed = parseTrustedManifestSignerRegistry(registry(), SOURCE);
+  assert.equal(parsed.signers.length, 0);
+  assert.equal(resolveTrustedManifestSigner(parsed, {
+    domainId: 'DOM-FIFTH-0001',
+    repositoryId: 'REPO-014',
+    signerId: 'GH-LIGHTHOUSE-001',
+  }), null);
+});
+
+test('an active Ed25519 SPKI signer resolves only for its exact domain and repository', () => {
+  const parsed = parseTrustedManifestSignerRegistry(registry([signer()]), SOURCE);
+  const trusted = resolveTrustedManifestSigner(parsed, {
+    domainId: 'DOM-FIFTH-0001',
+    repositoryId: 'REPO-014',
+    signerId: 'GH-LIGHTHOUSE-001',
+  });
+  assert.ok(trusted);
+  assert.equal(assertRegisteredTrustedManifestSigner(trusted), trusted);
+  assert.equal(resolveTrustedManifestSigner(parsed, {
+    domainId: 'DOMAIN-OTHER',
+    repositoryId: 'REPO-014',
+    signerId: 'GH-LIGHTHOUSE-001',
+  }), null);
+});
+
+test('copied signer fields do not cross the parsed-registry trust boundary', () => {
+  const parsed = parseTrustedManifestSignerRegistry(registry([signer()]), SOURCE);
+  const trusted = resolveTrustedManifestSigner(parsed, {
+    domainId: 'DOM-FIFTH-0001',
+    repositoryId: 'REPO-014',
+    signerId: 'GH-LIGHTHOUSE-001',
+  });
+  assert.ok(trusted);
+  assert.throws(() => assertRegisteredTrustedManifestSigner({ ...trusted }), /trusted_manifest_signer_unregistered/);
+});
+
+test('revoked signers stay parseable for history but never resolve', () => {
+  const parsed = parseTrustedManifestSignerRegistry(registry([signer({ status: 'REVOKED' })]), SOURCE);
+  assert.equal(resolveTrustedManifestSigner(parsed, {
+    domainId: 'DOM-FIFTH-0001',
+    repositoryId: 'REPO-014',
+    signerId: 'GH-LIGHTHOUSE-001',
+  }), null);
+});
+
+test('duplicates, unknown fields and unsupported algorithms fail closed', () => {
+  assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer(), signer()]), SOURCE), /trusted_signer_registry_invalid/);
+  assert.throws(() => parseTrustedManifestSignerRegistry({ ...registry(), extra: true }, SOURCE), /trusted_signer_registry_invalid/);
+  assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ algorithm: 'RSA' })]), SOURCE), /trusted_signer_registry_invalid/);
+});
+
+test('private keys and malformed public keys fail closed', () => {
+  const privateKeyPem = generateKeyPairSync('ed25519').privateKey
+    .export({ format: 'pem', type: 'pkcs8' }).toString();
+  assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ publicKeyPem: privateKeyPem })]), SOURCE), /trusted_signer_registry_invalid/);
+  assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ publicKeyPem: 'not-a-key' })]), SOURCE), /trusted_signer_registry_invalid/);
+});
+
+test('registry source provenance requires exact Guanghu HTTPS and a full commit', () => {
+  assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceCommit: 'short' }), /trusted_signer_registry_source_invalid/);
+  assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceUrl: 'https://example.com/registry.json' }), /trusted_signer_registry_source_invalid/);
+  assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceUrl: 'https://user:pass@guanghulab.com/registry.json' }), /trusted_signer_registry_source_invalid/);
+});