Checkpoint web parity through Chromium input tasks

web/tests/unit/script-sandbox-recovery.test.mjs

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+import test from "node:test";
+import ts from "typescript";
+
+const root = path.resolve(import.meta.dirname, "../../..");
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-sandbox-recovery-"));
+const source = fs.readFileSync(path.join(root, "web/app/src/testing/script-sandbox-recovery.ts"), "utf8");
+fs.writeFileSync(path.join(temporary, "script-sandbox-recovery.cjs"), ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: "script-sandbox-recovery.ts" }).outputText);
+const protocol = createRequire(import.meta.url)(path.join(temporary, "script-sandbox-recovery.cjs"));
+const digest = "a".repeat(64);
+const entry = (sequence, requestId, previousEntrySha256, entrySha256) => ({ sequence, requestId, previousEntrySha256, entrySha256, sourceSha256: digest, manifestSha256: "b".repeat(64) });
+
+test("M13-03G accepts one-generation recovery with a continuous audit chain", () => {
+  const receipt = protocol.createScriptSandboxRecoveryReceipt({ previousGeneration: 4, nextGeneration: 5, mainRevisionBefore: 11, mainRevisionAfter: 11, sourceSha256: digest, manifestSha256: "b".repeat(64), audit: { entries: 2, first: entry(1, "sandbox-recovery:g4", null, digest), second: entry(2, "sandbox-recovery:g5", digest, "c".repeat(64)) } });
+  assert.equal(receipt.recovered, true);
+  assert.equal(receipt.execution, "DISABLED");
+  assert.equal(receipt.audit.second.previousEntrySha256, receipt.audit.first.entrySha256);
+});
+
+test("M13-03G rejects generation, revision, request and hash-chain drift", () => {
+  const base = { previousGeneration: 4, nextGeneration: 5, mainRevisionBefore: 11, mainRevisionAfter: 11, sourceSha256: digest, manifestSha256: "b".repeat(64), audit: { entries: 2, first: entry(1, "sandbox-recovery:g4", null, digest), second: entry(2, "sandbox-recovery:g5", digest, "c".repeat(64)) } };
+  assert.throws(() => protocol.createScriptSandboxRecoveryReceipt({ ...base, nextGeneration: 7 }), /generation/);
+  assert.throws(() => protocol.createScriptSandboxRecoveryReceipt({ ...base, mainRevisionAfter: 12 }), /revision/);
+  assert.throws(() => protocol.createScriptSandboxRecoveryReceipt({ ...base, audit: { ...base.audit, second: entry(2, "sandbox-recovery:g5", "d".repeat(64), "c".repeat(64)) } }), /hash chain/);
+  assert.throws(() => protocol.createScriptSandboxRecoveryReceipt({ ...base, audit: { ...base.audit, second: entry(2, "sandbox-recovery:g4", digest, "c".repeat(64)) } }), /replayed/);
+});
+
+test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));