import { createMockFacade } from './facade/mockFacade'
import { createSecurityPreflight } from './facade/securityPreflight'
type SecurityReport = { schemaVersion: 1; status: 'pass' | 'failed'; browserId: 'chrome'; crossOriginIsolated: boolean; checks?: { path: number; archiveEntries: number; xmlBytes: number; permissionChecks: number; rejectedCases: number; pass: boolean }; persistence?: { mode: string; byteLength: number; roundTrip: boolean; released: boolean }; opfs?: { markerSuite: string; checks: number; markerRemoved: boolean }; afterRelease?: { shapeCount: number; kernelReferenceCount: number }; error?: string }
const sha256 = async (bytes: Uint8Array) => [...new Uint8Array(await crypto.subtle.digest('SHA-256', Uint8Array.from(bytes).buffer))].map((value) => value.toString(16).padStart(2, '0')).join('')
const run = async (): Promise<SecurityReport> => { const facade = createMockFacade(); const report: SecurityReport = { schemaVersion: 1, status: 'failed', browserId: 'chrome', crossOriginIsolated: globalThis.crossOriginIsolated === true }; try { if (!report.crossOriginIsolated || !navigator.storage?.getDirectory) throw new Error('Chrome security evidence requires isolated OPFS.'); await facade.project.list(); const security = createSecurityPreflight(); security.path('projects/Document.xml'); security.archive([{ path: 'Document.xml', compressedBytes: 100, uncompressedBytes: 500 }, { path: 'GuiDocument.xml', compressedBytes: 100, uncompressedBytes: 700 }]); security.xml('<Document><Object id="box"/></Document>'); security.permissions(['geometry.read', 'project.read']); let rejectedCases = 0; for (const action of [() => security.path('../outside'), () => security.archive([{ path: 'bomb', compressedBytes: 1, uncompressedBytes: 101 }]), () => security.xml('<!DOCTYPE x SYSTEM "file:///etc/passwd">'), () => security.permissions(['network'])]) { try { action() } catch { rejectedCases += 1 } }; const snapshot = security.report(); const payload = new TextEncoder().encode(JSON.stringify(snapshot)); const stored = await facade.project.resource.put(payload, 'application/vnd.bitbybit.security+json'); const loaded = await facade.project.resource.get(stored.hash); const roundTrip = loaded !== null && await sha256(loaded) === await sha256(payload); await facade.project.resource.release(stored.hash); const released = await facade.project.resource.get(stored.hash) === null; const directory = await navigator.storage.getDirectory(); const markerName = 'security-chrome-marker.json'; const marker = await directory.getFileHandle(markerName, { create: true }); const writable = await marker.createWritable(); await writable.write(JSON.stringify({ suite: 'QA-07', checks: rejectedCases })); await writable.close(); const markerPayload = JSON.parse(await (await marker.getFile()).text()) as { suite: string; checks: number }; await directory.removeEntry(markerName); let markerRemoved = false; try { await directory.getFileHandle(markerName) } catch (error) { markerRemoved = error instanceof DOMException && error.name === 'NotFoundError' }; report.checks = { path: snapshot.pathChecks, archiveEntries: snapshot.archiveEntries, xmlBytes: snapshot.xmlBytes, permissionChecks: snapshot.permissionChecks, rejectedCases, pass: snapshot.errors.length === 4 && rejectedCases === 4 }; report.persistence = { mode: facade.project.capabilities().mode, byteLength: stored.byteLength, roundTrip, released }; report.opfs = { markerSuite: markerPayload.suite, checks: markerPayload.checks, markerRemoved }; report.status = report.checks.path === 5 && report.checks.archiveEntries === 3 && report.checks.xmlBytes > 0 && report.checks.permissionChecks === 3 && report.checks.rejectedCases === 4 && report.checks.pass && report.persistence.mode === 'sqlite-opfs' && report.persistence.roundTrip && report.persistence.released && report.opfs.markerSuite === 'QA-07' && report.opfs.checks === 4 && report.opfs.markerRemoved ? 'pass' : 'failed' } catch (error) { report.error = error instanceof Error ? error.stack || error.message : String(error) } finally { facade.geometry.dispose(); await new Promise((resolve) => setTimeout(resolve, 0)); const capabilities = facade.geometry.capabilities(); report.afterRelease = { shapeCount: capabilities.shapeCount, kernelReferenceCount: capabilities.kernelReferenceCount }; if (capabilities.shapeCount !== 0 || capabilities.kernelReferenceCount !== 0) { report.status = 'failed'; report.error = `${report.error ? `${report.error} ` : ''}Shape ownership gate failed.` } } return report }
run().then((report) => { ;(window as Window & { __bitbybitSecurityReport?: SecurityReport }).__bitbybitSecurityReport = report; document.documentElement.dataset.status = report.status; document.querySelector('#result')!.textContent = JSON.stringify(report, null, 2) }).catch((error) => { document.documentElement.dataset.status = 'failed'; document.querySelector('#result')!.textContent = error instanceof Error ? error.stack || error.message : String(error) })
export {}
