Checkpoint web parity through Chromium input tasks

web/tests/unit/script-manifest-canonical.test.mjs

@@ -0,0 +1,80 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+import test from "node:test";
+import ts from "typescript";
+
+const root = path.resolve(import.meta.dirname, "../../..");
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-manifest-canonical-"));
+const require = createRequire(import.meta.url);
+for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
+  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
+  const output = ts.transpileModule(source, {
+    compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
+    fileName: `${name}.ts`,
+  }).outputText
+    .replace('require("./asset-path")', 'require("./asset-path.cjs")')
+    .replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
+  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
+}
+const protocol = require(path.join(temporary, "scripting-platform.cjs"));
+const digest = "a".repeat(64);
+const signature = "b".repeat(128);
+const script = (id, overrides = {}) => ({
+  id,
+  name: id,
+  entryPath: `scripts/${id}.py`,
+  sourceByteLength: 128,
+  sourceSha256: digest,
+  publisher: "local",
+  signature,
+  keyId: "key:local",
+  permissions: ["READ_MAIN"],
+  dependencies: [],
+  module: false,
+  cpuMs: 1000,
+  memoryBytes: 1024 * 1024,
+  wallMs: 5000,
+  network: false,
+  autorun: false,
+  driverExpressions: false,
+  addonInstall: false,
+  ...overrides,
+});
+
+test("M13-02B canonical serialization is invariant to manifest/script array order", () => {
+  const base = {
+    schemaVersion: 1,
+    scripts: [
+      script("zeta", { permissions: ["WRITE_ASSET", "READ_MAIN"], dependencies: [{ id: "alpha", sourceSha256: digest, sourcePath: "deps/alpha.py" }, { id: "beta", sourceSha256: digest, sourcePath: "deps/beta.py" }] }),
+      script("alpha", { permissions: ["SUBMIT_SERVER_JOB", "READ_ASSET"] }),
+      script("beta"),
+    ],
+  };
+  const reordered = {
+    schemaVersion: 1,
+    scripts: [
+      { ...base.scripts[1], permissions: [...base.scripts[1].permissions].reverse(), ignored: "removed" },
+      { ...base.scripts[0], permissions: [...base.scripts[0].permissions].reverse(), dependencies: [...base.scripts[0].dependencies].reverse() },
+      base.scripts[2],
+    ],
+  };
+  const first = protocol.serializeScriptingManifest(base);
+  const second = protocol.serializeScriptingManifest(reordered);
+  assert.equal(first, second);
+  assert.match(first, /^\{"schemaVersion":1,"scripts":\[/);
+  assert.equal(Object.keys(protocol.canonicalizeScriptingManifest(reordered).scripts[0]).includes("ignored"), false);
+});
+
+test("M13-02B canonical serialization includes security-relevant declaration fields", () => {
+  const base = { schemaVersion: 1, scripts: [script("clean")] };
+  const changedBytes = { schemaVersion: 1, scripts: [script("clean", { sourceByteLength: 129 })] };
+  const changedPermission = { schemaVersion: 1, scripts: [script("clean", { permissions: ["READ_ASSET"] })] };
+  assert.notEqual(protocol.serializeScriptingManifest(base), protocol.serializeScriptingManifest(changedBytes));
+  assert.notEqual(protocol.serializeScriptingManifest(base), protocol.serializeScriptingManifest(changedPermission));
+  assert.throws(() => protocol.serializeScriptingManifest({ ...base, schemaVersion: 2 }), /PROTOCOL_MISMATCH/);
+});
+
+test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));