Niko Marmeladkov
9d66003689
- server: relay storing signed objects (PUT/GET), per-IP rate limiting, per-subject quota (1000), one-response-per-request, pagination, /v1/healthz /v1/readyz /v1/metrics - verify: signature-verifying trust evaluator; every object is checked via env.Verify(), approvals via VerifyApprovalResponse, revocations via VerifyRevocationOf; k-of-n approval quorum - docs: TRUST-MODEL.md and API.md describing issuer-anchored signatures and the endpoint/status-code contract - tests: server, verify, and ratelimit packages
64 lines
1.5 KiB
Go
64 lines
1.5 KiB
Go
package transport_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"git.n1ko.dev/Niko/niko_trust/internal/identity/signer"
|
|
"git.n1ko.dev/Niko/niko_trust/internal/protocol"
|
|
"git.n1ko.dev/Niko/niko_trust/internal/tce"
|
|
"git.n1ko.dev/Niko/niko_trust/internal/transport"
|
|
)
|
|
|
|
func TestEnvelopeViewAndVerify(t *testing.T) {
|
|
issuer, _ := signer.Generate()
|
|
subject, _ := signer.Generate()
|
|
|
|
c := &protocol.Claim{
|
|
Issuer: issuer.Public(),
|
|
Subject: subject.Public(),
|
|
Claims: map[string]tce.Value{"example.flag": tce.Bool(true), "level": tce.Number("7")},
|
|
CreatedAt: 1_700_000_000,
|
|
ExpiresAt: 1_700_086_400,
|
|
Serial: 1,
|
|
Nonce: make([]byte, tce.NonceSize),
|
|
}
|
|
tceBytes, err := protocol.EncodeClaim(c)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
sig := issuer.Sign(tceBytes)
|
|
|
|
env := &transport.Envelope{TCE: tceBytes, Signature: sig}
|
|
|
|
// The authoritative object_id is SHA-256(tce).
|
|
if env.ContentID() != tce.ComputeID(tceBytes).String() {
|
|
t.Fatal("ContentID mismatch")
|
|
}
|
|
|
|
// The object view decodes to valid JSON naming the subject address.
|
|
_, view, err := env.BuildView()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(view) == 0 {
|
|
t.Fatal("empty view")
|
|
}
|
|
|
|
// A verifier checks the signature over the exact TCE bytes.
|
|
if typ, err := env.Verify(); err != nil {
|
|
t.Fatalf("verify %s: %v", typ, err)
|
|
}
|
|
|
|
// Round-trips through JSON.
|
|
raw, err := env.Marshal()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
back, err := transport.ParseEnvelope(raw)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if back.ContentID() != env.ContentID() {
|
|
t.Fatal("round-trip id mismatch")
|
|
}
|
|
}
|