87 lines
4.9 KiB
JavaScript
87 lines
4.9 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import crypto from "node:crypto";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { pathToFileURL } from "node:url";
|
|
import test from "node:test";
|
|
import ts from "typescript";
|
|
|
|
const root = path.resolve(import.meta.dirname, "../../..");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "io-format-receipt-freshness-unit-"));
|
|
const stableValue = (value) => Array.isArray(value) ? value.map(stableValue) : value && typeof value === "object" ? Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])])) : value;
|
|
const stableSha256 = (value) => crypto.createHash("sha256").update(JSON.stringify(stableValue(value))).digest("hex");
|
|
|
|
function transpile(sourcePath, outputName, replacements = []) {
|
|
const result = ts.transpileModule(fs.readFileSync(sourcePath, "utf8"), {
|
|
compilerOptions: { module: ts.ModuleKind.ES2022, target: ts.ScriptTarget.ES2022 },
|
|
fileName: sourcePath,
|
|
reportDiagnostics: true,
|
|
});
|
|
assert.deepEqual(result.diagnostics, []);
|
|
let output = result.outputText;
|
|
for (const [from, to] of replacements) output = output.replaceAll(from, to);
|
|
const outputPath = path.join(temporary, outputName);
|
|
fs.writeFileSync(outputPath, output);
|
|
return outputPath;
|
|
}
|
|
|
|
const parentPath = path.join(root, "tests/golden/M12-05E/bound-runtime-receipts.json");
|
|
const freshnessPath = path.join(root, "tests/golden/M12-05F/fresh-runtime-receipts.json");
|
|
const parentBytes = fs.readFileSync(parentPath);
|
|
const bound = JSON.parse(parentBytes);
|
|
const freshness = JSON.parse(fs.readFileSync(freshnessPath, "utf8"));
|
|
const protocolPath = path.join(root, "web/protocol/io-format-receipt-freshness.ts");
|
|
transpile(path.join(root, "web/protocol/io-format-runtime-receipt.ts"), "io-format-runtime-receipt.mjs");
|
|
transpile(path.join(root, "web/protocol/io-format-receipt-binding.ts"), "io-format-receipt-binding.mjs");
|
|
const protocol = await import(pathToFileURL(transpile(protocolPath, "io-format-receipt-freshness.mjs", [["./io-format-receipt-binding\"", "./io-format-receipt-binding.mjs\""], ["./io-format-runtime-receipt\"", "./io-format-runtime-receipt.mjs\""]])));
|
|
const expected = {
|
|
parentBindingSha256: crypto.createHash("sha256").update(parentBytes).digest("hex"),
|
|
parentReceiptSetSha256: bound.parentReceiptSetSha256,
|
|
inventorySha256: bound.inventorySha256,
|
|
boundReceiptSetSha256: stableSha256(bound),
|
|
runtimeSha256: stableSha256(bound.runtime),
|
|
runtime: bound.runtime,
|
|
receiptIdentities: bound.receipts,
|
|
};
|
|
|
|
test("M12-05F artifact is deterministic and bound to M12-05E", () => {
|
|
const manifest = JSON.parse(fs.readFileSync(path.join(root, "tests/golden/M12-05F/manifest.json"), "utf8"));
|
|
assert.equal(manifest.task, "M12-05F");
|
|
assert.equal(manifest.parentTask, "M12-05E");
|
|
assert.equal(manifest.nextTask, "M12-06A");
|
|
for (const artifact of Object.values(manifest.artifacts)) {
|
|
assert.equal(crypto.createHash("sha256").update(fs.readFileSync(path.join(root, artifact.path))).digest("hex"), artifact.sha256, artifact.path);
|
|
}
|
|
assert.equal(freshness.parentBindingSha256, expected.parentBindingSha256);
|
|
assert.equal(freshness.boundReceiptSetSha256, expected.boundReceiptSetSha256);
|
|
assert.equal(freshness.runtimeSha256, expected.runtimeSha256);
|
|
});
|
|
|
|
test("M12-05F accepts only the exact trusted runtime receipt", async () => {
|
|
const parsed = await protocol.verifyIOFormatReceiptFreshness(freshness, expected);
|
|
assert.equal(parsed.bound.receipts.length, 14);
|
|
assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(freshness, expected, { format: "GLB", operation: "EXPORT" }).status, "READY");
|
|
assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(freshness, expected, { format: "USD", operation: "EXPORT" }).status, "BLOCKED");
|
|
});
|
|
|
|
test("M12-05F rejects forged content before route execution", async () => {
|
|
const forged = structuredClone(freshness);
|
|
forged.bound.receipts[0].operator = "forged.operator";
|
|
await assert.rejects(() => protocol.verifyIOFormatReceiptFreshness(forged, expected), (error) => error.reason === "RECEIPT_FORGED");
|
|
const malformed = structuredClone(freshness);
|
|
delete malformed.boundReceiptSetSha256;
|
|
assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(malformed, expected, { format: "GLB", operation: "EXPORT" }).reason, "RECEIPT_FORGED");
|
|
});
|
|
|
|
test("M12-05F rejects stale parent identity and cross-version runtime", () => {
|
|
const stale = structuredClone(freshness);
|
|
stale.bound.inventorySha256 = "a".repeat(64);
|
|
assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(stale, expected, { format: "GLB", operation: "EXPORT" }).reason, "RECEIPT_STALE");
|
|
const crossVersion = structuredClone(freshness);
|
|
crossVersion.bound.runtime.versionTuple = [5, 3, 0];
|
|
assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(crossVersion, expected, { format: "GLB", operation: "EXPORT" }).reason, "RECEIPT_CROSS_VERSION");
|
|
});
|
|
|
|
test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));
|