feat: verify canonical portfolio release provenance

2026-09-02 09:41:01 +03:00
parent 1cec658baf
commit 672ba80d9b
12 changed files with 3536 additions and 0 deletions
--- a/tests/unit/approval-envelope.test.ts
+++ b/tests/unit/approval-envelope.test.ts
@@ -0,0 +1,82 @@
+import { generateKeyPairSync, sign } from 'node:crypto';
+import { describe, expect, test } from 'vitest';
+
+import {
+  type ApprovalPayload,
+  parseApprovalEnvelopeJson,
+  verifyApprovalEnvelope,
+} from '../../src/security/approval-envelope.ts';
+import { canonicalValueBytes } from '../../src/security/canonical-digest.ts';
+
+const hash = (character: string) => character.repeat(64);
+const payload = (): ApprovalPayload => ({
+  schema: 'portfolio-approval-payload/v1',
+  keyId: 'approval-2026',
+  issuerEpoch: 3,
+  authorizedRole: 'portfolio-approver',
+  evidenceFingerprints: [hash('a')],
+  recordClass: 'content',
+  recordType: 'profile',
+  publicRecordIdOrAssetId: 'profile-main',
+  approvedPublicRecordHashOrManifestRecordHash: hash('b'),
+  sanitizedOutputHashOrNull: null,
+  decision: 'approve',
+  issuedAt: '2026-09-01T08:00:00Z',
+  expiresAt: '2026-10-01T08:00:00Z',
+  previousLedgerHeadHash: hash('c'),
+  ledgerRevision: 12,
+  policyVersion: 'approval-policy-1',
+});
+
+function signedEnvelope(overrides: Partial<ApprovalPayload> = {}) {
+  const keys = generateKeyPairSync('ed25519');
+  const signedPayload = { ...payload(), ...overrides };
+  const signature = sign(null, canonicalValueBytes(signedPayload), keys.privateKey).toString('base64url');
+  return {
+    envelope: {
+      schema: 'portfolio-approval-envelope/v1' as const,
+      payload: signedPayload,
+      signature: { algorithm: 'Ed25519' as const, encoding: 'base64url-nopad' as const, value: signature },
+    },
+    publicKey: keys.publicKey,
+  };
+}
+
+describe('approval envelopes', () => {
+  test('verifies an exact, current, scoped Ed25519 approval', () => {
+    const { envelope, publicKey } = signedEnvelope();
+    const verified = verifyApprovalEnvelope(envelope, {
+      now: '2026-09-02T00:00:00Z',
+      latestLedgerHeadHash: hash('d'),
+      latestLedgerRevision: 13,
+      trustedKeys: [{
+        keyId: 'approval-2026', issuerEpoch: 3, scope: 'portfolio-approval-decision/v1',
+        authorizedRoles: ['portfolio-approver'], publicKey,
+      }],
+    });
+    expect(verified.publicRecordIdOrAssetId).toBe('profile-main');
+  });
+
+  test.each([
+    ['expired', { expiresAt: '2026-09-01T09:00:00Z' }],
+    ['non-UTC timestamp', { issuedAt: '2026-09-01T10:00:00+02:00' }],
+    ['wrong epoch', { issuerEpoch: 2 }],
+    ['rejection', { decision: 'reject' }],
+  ] as const)('rejects a %s envelope', (_label, override) => {
+    const { envelope, publicKey } = signedEnvelope(override);
+    expect(() => verifyApprovalEnvelope(envelope, {
+      now: '2026-09-02T00:00:00Z', latestLedgerHeadHash: hash('d'), latestLedgerRevision: 13,
+      trustedKeys: [{ keyId: 'approval-2026', issuerEpoch: 3, scope: 'portfolio-approval-decision/v1', authorizedRoles: ['portfolio-approver'], publicKey }],
+    })).toThrow();
+  });
+
+  test('rejects unknown fields, duplicate keys, and alternate signature encodings at ingest', () => {
+    const { envelope } = signedEnvelope();
+    expect(() => parseApprovalEnvelopeJson(JSON.stringify({ ...envelope, extra: true }))).toThrow();
+    expect(() => parseApprovalEnvelopeJson('{"schema":"portfolio-approval-envelope/v1","schema":"portfolio-approval-envelope/v1"}')).toThrow();
+    expect(() => parseApprovalEnvelopeJson(JSON.stringify({
+      ...envelope,
+      signature: { ...envelope.signature, value: `${envelope.signature.value}=` },
+    }))).toThrow();
+  });
+});