mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-19 00:34:16 +00:00
296 lines
8.4 KiB
Go
296 lines
8.4 KiB
Go
package pds
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/bluesky-social/indigo/atproto/atcrypto"
|
|
)
|
|
|
|
// TestNewHoldKeyManager tests creating a key manager
|
|
func TestNewHoldKeyManager(t *testing.T) {
|
|
// Generate a test key
|
|
privateKey, err := atcrypto.GeneratePrivateKeyK256()
|
|
if err != nil {
|
|
t.Fatalf("Failed to generate private key: %v", err)
|
|
}
|
|
|
|
// Create key manager
|
|
kmgr := NewHoldKeyManager(privateKey)
|
|
|
|
if kmgr == nil {
|
|
t.Fatal("Expected non-nil key manager")
|
|
}
|
|
|
|
if kmgr.signingKey == nil {
|
|
t.Error("Expected signing key to be set")
|
|
}
|
|
|
|
// Verify we got the same key
|
|
if kmgr.signingKey != privateKey {
|
|
t.Error("Expected key manager to store the provided key")
|
|
}
|
|
}
|
|
|
|
// TestSignAndVerify tests signing data and verifying the signature
|
|
func TestSignAndVerify(t *testing.T) {
|
|
ctx := context.Background()
|
|
|
|
// Generate a test key
|
|
privateKey, err := atcrypto.GeneratePrivateKeyK256()
|
|
if err != nil {
|
|
t.Fatalf("Failed to generate private key: %v", err)
|
|
}
|
|
|
|
// Create key manager
|
|
kmgr := NewHoldKeyManager(privateKey)
|
|
|
|
// Test data
|
|
testData := []byte("Hello, ATCR!")
|
|
|
|
// Sign data (DID is ignored for holds)
|
|
signature, err := kmgr.SignForUser(ctx, "did:plc:ignored", testData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed: %v", err)
|
|
}
|
|
|
|
if len(signature) == 0 {
|
|
t.Fatal("Expected non-empty signature")
|
|
}
|
|
|
|
// Verify signature (DID is ignored for holds)
|
|
err = kmgr.VerifyUserSignature(ctx, "did:plc:also-ignored", testData, signature)
|
|
if err != nil {
|
|
t.Fatalf("VerifyUserSignature failed: %v", err)
|
|
}
|
|
}
|
|
|
|
// TestVerifyInvalidSignature tests rejecting bad signatures
|
|
func TestVerifyInvalidSignature(t *testing.T) {
|
|
ctx := context.Background()
|
|
|
|
// Generate a test key
|
|
privateKey, err := atcrypto.GeneratePrivateKeyK256()
|
|
if err != nil {
|
|
t.Fatalf("Failed to generate private key: %v", err)
|
|
}
|
|
|
|
kmgr := NewHoldKeyManager(privateKey)
|
|
|
|
testData := []byte("Original data")
|
|
|
|
// Sign original data
|
|
signature, err := kmgr.SignForUser(ctx, "did:plc:test", testData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed: %v", err)
|
|
}
|
|
|
|
// Test 1: Verify with different data (should fail)
|
|
differentData := []byte("Different data")
|
|
err = kmgr.VerifyUserSignature(ctx, "did:plc:test", differentData, signature)
|
|
if err == nil {
|
|
t.Error("Expected verification to fail with different data")
|
|
}
|
|
|
|
// Test 2: Verify with corrupted signature (should fail)
|
|
corruptedSignature := make([]byte, len(signature))
|
|
copy(corruptedSignature, signature)
|
|
if len(corruptedSignature) > 0 {
|
|
corruptedSignature[0] ^= 0xFF // Flip bits in first byte
|
|
}
|
|
|
|
err = kmgr.VerifyUserSignature(ctx, "did:plc:test", testData, corruptedSignature)
|
|
if err == nil {
|
|
t.Error("Expected verification to fail with corrupted signature")
|
|
}
|
|
|
|
// Test 3: Verify with empty signature (should fail)
|
|
err = kmgr.VerifyUserSignature(ctx, "did:plc:test", testData, []byte{})
|
|
if err == nil {
|
|
t.Error("Expected verification to fail with empty signature")
|
|
}
|
|
}
|
|
|
|
// TestIgnoresDIDParameter tests that DID parameter doesn't affect signing
|
|
func TestIgnoresDIDParameter(t *testing.T) {
|
|
ctx := context.Background()
|
|
|
|
// Generate a test key
|
|
privateKey, err := atcrypto.GeneratePrivateKeyK256()
|
|
if err != nil {
|
|
t.Fatalf("Failed to generate private key: %v", err)
|
|
}
|
|
|
|
kmgr := NewHoldKeyManager(privateKey)
|
|
|
|
testData := []byte("Test data for DID independence")
|
|
|
|
// Sign with different DIDs
|
|
signature1, err := kmgr.SignForUser(ctx, "did:plc:alice123", testData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed with DID alice: %v", err)
|
|
}
|
|
|
|
signature2, err := kmgr.SignForUser(ctx, "did:plc:bob456", testData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed with DID bob: %v", err)
|
|
}
|
|
|
|
signature3, err := kmgr.SignForUser(ctx, "", testData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed with empty DID: %v", err)
|
|
}
|
|
|
|
// All signatures should be identical (same key, same data)
|
|
// Note: K256 signatures may have randomness (nonce), so they might not be byte-identical
|
|
// Instead, verify that all signatures are valid
|
|
|
|
// Verify signature1 works with any DID
|
|
if err := kmgr.VerifyUserSignature(ctx, "did:plc:alice123", testData, signature1); err != nil {
|
|
t.Errorf("Signature1 should verify with alice DID: %v", err)
|
|
}
|
|
if err := kmgr.VerifyUserSignature(ctx, "did:plc:bob456", testData, signature1); err != nil {
|
|
t.Errorf("Signature1 should verify with bob DID: %v", err)
|
|
}
|
|
if err := kmgr.VerifyUserSignature(ctx, "", testData, signature1); err != nil {
|
|
t.Errorf("Signature1 should verify with empty DID: %v", err)
|
|
}
|
|
|
|
// Verify signature2 works with any DID
|
|
if err := kmgr.VerifyUserSignature(ctx, "did:plc:alice123", testData, signature2); err != nil {
|
|
t.Errorf("Signature2 should verify with alice DID: %v", err)
|
|
}
|
|
if err := kmgr.VerifyUserSignature(ctx, "did:plc:bob456", testData, signature2); err != nil {
|
|
t.Errorf("Signature2 should verify with bob DID: %v", err)
|
|
}
|
|
|
|
// Verify signature3 works with any DID
|
|
if err := kmgr.VerifyUserSignature(ctx, "did:plc:alice123", testData, signature3); err != nil {
|
|
t.Errorf("Signature3 should verify with alice DID: %v", err)
|
|
}
|
|
if err := kmgr.VerifyUserSignature(ctx, "did:plc:bob456", testData, signature3); err != nil {
|
|
t.Errorf("Signature3 should verify with bob DID: %v", err)
|
|
}
|
|
}
|
|
|
|
// TestSignForUser_EmptyData tests signing empty data
|
|
func TestSignForUser_EmptyData(t *testing.T) {
|
|
ctx := context.Background()
|
|
|
|
privateKey, err := atcrypto.GeneratePrivateKeyK256()
|
|
if err != nil {
|
|
t.Fatalf("Failed to generate private key: %v", err)
|
|
}
|
|
|
|
kmgr := NewHoldKeyManager(privateKey)
|
|
|
|
// Sign empty data
|
|
emptyData := []byte{}
|
|
signature, err := kmgr.SignForUser(ctx, "did:plc:test", emptyData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed with empty data: %v", err)
|
|
}
|
|
|
|
if len(signature) == 0 {
|
|
t.Fatal("Expected non-empty signature even for empty data")
|
|
}
|
|
|
|
// Verify signature
|
|
err = kmgr.VerifyUserSignature(ctx, "did:plc:test", emptyData, signature)
|
|
if err != nil {
|
|
t.Fatalf("VerifyUserSignature failed for empty data: %v", err)
|
|
}
|
|
}
|
|
|
|
// TestSignForUser_LargeData tests signing large data
|
|
func TestSignForUser_LargeData(t *testing.T) {
|
|
ctx := context.Background()
|
|
|
|
privateKey, err := atcrypto.GeneratePrivateKeyK256()
|
|
if err != nil {
|
|
t.Fatalf("Failed to generate private key: %v", err)
|
|
}
|
|
|
|
kmgr := NewHoldKeyManager(privateKey)
|
|
|
|
// Create large data (1MB)
|
|
largeData := make([]byte, 1024*1024)
|
|
for i := range largeData {
|
|
largeData[i] = byte(i % 256)
|
|
}
|
|
|
|
// Sign large data
|
|
signature, err := kmgr.SignForUser(ctx, "did:plc:test", largeData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed with large data: %v", err)
|
|
}
|
|
|
|
if len(signature) == 0 {
|
|
t.Fatal("Expected non-empty signature for large data")
|
|
}
|
|
|
|
// Verify signature
|
|
err = kmgr.VerifyUserSignature(ctx, "did:plc:test", largeData, signature)
|
|
if err != nil {
|
|
t.Fatalf("VerifyUserSignature failed for large data: %v", err)
|
|
}
|
|
}
|
|
|
|
// TestKeyManager_DifferentKeys tests that different keys produce different signatures
|
|
func TestKeyManager_DifferentKeys(t *testing.T) {
|
|
ctx := context.Background()
|
|
|
|
// Generate two different keys
|
|
key1, err := atcrypto.GeneratePrivateKeyK256()
|
|
if err != nil {
|
|
t.Fatalf("Failed to generate key1: %v", err)
|
|
}
|
|
|
|
key2, err := atcrypto.GeneratePrivateKeyK256()
|
|
if err != nil {
|
|
t.Fatalf("Failed to generate key2: %v", err)
|
|
}
|
|
|
|
kmgr1 := NewHoldKeyManager(key1)
|
|
kmgr2 := NewHoldKeyManager(key2)
|
|
|
|
testData := []byte("Test data")
|
|
|
|
// Sign with key1
|
|
sig1, err := kmgr1.SignForUser(ctx, "did:plc:test", testData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed with key1: %v", err)
|
|
}
|
|
|
|
// Sign with key2
|
|
sig2, err := kmgr2.SignForUser(ctx, "did:plc:test", testData)
|
|
if err != nil {
|
|
t.Fatalf("SignForUser failed with key2: %v", err)
|
|
}
|
|
|
|
// Signatures should be different (different keys)
|
|
// Note: Due to randomness in ECDSA, this isn't guaranteed byte-for-byte,
|
|
// but they should not verify with each other's keys
|
|
|
|
// Verify sig1 fails with key2
|
|
err = kmgr2.VerifyUserSignature(ctx, "did:plc:test", testData, sig1)
|
|
if err == nil {
|
|
t.Error("Expected sig1 to fail verification with key2")
|
|
}
|
|
|
|
// Verify sig2 fails with key1
|
|
err = kmgr1.VerifyUserSignature(ctx, "did:plc:test", testData, sig2)
|
|
if err == nil {
|
|
t.Error("Expected sig2 to fail verification with key1")
|
|
}
|
|
|
|
// But each should verify with their own key
|
|
if err := kmgr1.VerifyUserSignature(ctx, "did:plc:test", testData, sig1); err != nil {
|
|
t.Errorf("sig1 should verify with key1: %v", err)
|
|
}
|
|
|
|
if err := kmgr2.VerifyUserSignature(ctx, "did:plc:test", testData, sig2); err != nil {
|
|
t.Errorf("sig2 should verify with key2: %v", err)
|
|
}
|
|
}
|