106 lines
7.6 KiB
TypeScript
106 lines
7.6 KiB
TypeScript
import { createHash } from 'node:crypto';
|
|
import { readFile } from 'node:fs/promises';
|
|
|
|
export type ReferenceProfile = 'desktop-high' | 'mobile-low';
|
|
|
|
export interface AuthenticatedReferenceRun {
|
|
profile: ReferenceProfile;
|
|
runId: string;
|
|
runIndex: number;
|
|
attestationDigest: string;
|
|
browserVersion: string;
|
|
viewport: { width: number; height: number };
|
|
}
|
|
|
|
interface AuthenticationInput {
|
|
referenceMode: boolean;
|
|
expectedProfile: ReferenceProfile;
|
|
attestationBytes: Uint8Array;
|
|
expectedDigest: string;
|
|
}
|
|
|
|
interface ObservedEnvironment {
|
|
viewport: { width: number; height: number };
|
|
visible: boolean;
|
|
reducedMotion: 'no-preference' | 'reduce';
|
|
saveData: boolean;
|
|
pageZoom: number;
|
|
devicePixelRatio: number;
|
|
browserName: string;
|
|
browserVersion: string;
|
|
startedFromAboutBlank: boolean;
|
|
}
|
|
|
|
const exactKeys = (value: unknown, keys: readonly string[], label: string): Record<string, unknown> => {
|
|
if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${label} is invalid.`);
|
|
const actual = Object.keys(value).sort();
|
|
const expected = [...keys].sort();
|
|
if (JSON.stringify(actual) !== JSON.stringify(expected)) throw new Error(`${label} fields are invalid.`);
|
|
return value as Record<string, unknown>;
|
|
};
|
|
|
|
const pinned = {
|
|
'desktop-high': { viewport: { width: 1_440, height: 900 }, cpu: 'Apple M1', gpu: 'Apple M1 integrated GPU', ramGb: 8, downstreamKbps: 10_000, upstreamKbps: 10_000, roundTripLatencyMs: 40 },
|
|
'mobile-low': { viewport: { width: 390, height: 844 }, cpu: 'Google Tensor', gpu: 'Mali-G78 MP20', ramGb: 8, downstreamKbps: 1_600, upstreamKbps: 750, roundTripLatencyMs: 150 },
|
|
} as const;
|
|
|
|
export const authenticateReferenceRun = (input: AuthenticationInput): AuthenticatedReferenceRun => {
|
|
if (!input.referenceMode) throw new Error('Authenticated reference mode is required.');
|
|
if (!/^[a-f0-9]{64}$/u.test(input.expectedDigest)) throw new Error('Reference attestation digest is invalid.');
|
|
const actualDigest = createHash('sha256').update(input.attestationBytes).digest('hex');
|
|
if (actualDigest !== input.expectedDigest) throw new Error('Reference attestation digest mismatch.');
|
|
let decoded: unknown;
|
|
try { decoded = JSON.parse(Buffer.from(input.attestationBytes).toString('utf8')); } catch { throw new Error('Reference attestation JSON is invalid.'); }
|
|
const root = exactKeys(decoded, ['schema', 'profile', 'runId', 'runIndex', 'capturedAt', 'device', 'browser', 'osVersion', 'display', 'viewport', 'network', 'assertions'], 'Reference attestation');
|
|
if (root.schema !== 'portfolio-reference-run-attestation/v1' || root.profile !== input.expectedProfile
|
|
|| typeof root.runId !== 'string' || !/^[a-z0-9][a-z0-9-]{2,79}$/u.test(root.runId)
|
|
|| !Number.isInteger(root.runIndex) || Number(root.runIndex) < 1 || Number(root.runIndex) > 5
|
|
|| typeof root.capturedAt !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(root.capturedAt)
|
|
|| !Number.isFinite(Date.parse(root.capturedAt))
|
|
|| typeof root.osVersion !== 'string' || root.osVersion.length < 2) throw new Error('Reference run metadata is invalid.');
|
|
const profile = pinned[input.expectedProfile];
|
|
const device = exactKeys(root.device, ['model', 'cpu', 'gpu', 'ramGb'], 'Reference device');
|
|
if (typeof device.model !== 'string' || device.model.length < 2 || device.cpu !== profile.cpu || device.gpu !== profile.gpu || device.ramGb !== profile.ramGb) throw new Error('Reference device does not match the pinned class.');
|
|
const browser = exactKeys(root.browser, ['name', 'version', 'driverVersion'], 'Reference browser');
|
|
if (browser.name !== 'Chromium' || typeof browser.version !== 'string' || !/^\d+(?:\.\d+){1,3}$/u.test(browser.version)
|
|
|| typeof browser.driverVersion !== 'string' || browser.driverVersion.length < 2) throw new Error('Reference browser metadata is invalid.');
|
|
const display = exactKeys(root.display, ['refreshHz'], 'Reference display');
|
|
if (display.refreshHz !== 60) throw new Error('Reference display must be fixed at 60 Hz.');
|
|
const viewport = exactKeys(root.viewport, ['width', 'height'], 'Reference viewport');
|
|
if (viewport.width !== profile.viewport.width || viewport.height !== profile.viewport.height) throw new Error('Reference viewport does not match the pinned profile.');
|
|
const network = exactKeys(root.network, ['downstreamKbps', 'upstreamKbps', 'roundTripLatencyMs'], 'Reference network');
|
|
if (network.downstreamKbps !== profile.downstreamKbps || network.upstreamKbps !== profile.upstreamKbps || network.roundTripLatencyMs !== profile.roundTripLatencyMs) throw new Error('Reference network does not match the pinned profile.');
|
|
const assertions = exactKeys(root.assertions, ['batteryPercent', 'powerSaving', 'coolStart', 'noOtherForegroundApplications', 'cpuEmulation', 'pageZoom', 'reducedMotion', 'saveData', 'audioState', 'freshBrowserProfile', 'startedFromAboutBlank', 'storageCleared', 'physicalReferenceDevice'], 'Reference assertions');
|
|
const storage = exactKeys(assertions.storageCleared, ['serviceWorkers', 'cacheStorage', 'httpCache', 'cookies', 'localStorage', 'sessionStorage', 'indexedDb', 'preferences'], 'Reference storage assertions');
|
|
if (typeof assertions.batteryPercent !== 'number' || assertions.batteryPercent <= 50 || assertions.batteryPercent > 100
|
|
|| assertions.powerSaving !== false || assertions.coolStart !== true || assertions.noOtherForegroundApplications !== true
|
|
|| assertions.cpuEmulation !== false || assertions.pageZoom !== 1 || assertions.reducedMotion !== 'no-preference'
|
|
|| assertions.saveData !== false || assertions.audioState !== 'idle' || assertions.freshBrowserProfile !== true
|
|
|| assertions.startedFromAboutBlank !== true || assertions.physicalReferenceDevice !== true
|
|
|| Object.values(storage).some((value) => value !== true)) throw new Error('Reference environment assertions are not all satisfied.');
|
|
return {
|
|
profile: input.expectedProfile,
|
|
runId: root.runId,
|
|
runIndex: Number(root.runIndex),
|
|
attestationDigest: actualDigest,
|
|
browserVersion: browser.version,
|
|
viewport: profile.viewport,
|
|
};
|
|
};
|
|
|
|
export const loadAuthenticatedReferenceRun = async (profile: ReferenceProfile): Promise<AuthenticatedReferenceRun | null> => {
|
|
if (process.env.PORTFOLIO_REFERENCE_LAB !== '1') return null;
|
|
const path = process.env.PORTFOLIO_REFERENCE_ATTESTATION_PATH;
|
|
const digest = process.env.PORTFOLIO_REFERENCE_ATTESTATION_SHA256;
|
|
if (path === undefined || digest === undefined) throw new Error('Reference mode requires an attestation path and SHA-256 digest.');
|
|
return authenticateReferenceRun({ referenceMode: true, expectedProfile: profile, attestationBytes: await readFile(path), expectedDigest: digest });
|
|
};
|
|
|
|
export const validateObservedReferenceEnvironment = (reference: AuthenticatedReferenceRun, observed: ObservedEnvironment): void => {
|
|
if (observed.viewport.width !== reference.viewport.width || observed.viewport.height !== reference.viewport.height) throw new Error('Observed viewport does not match the attestation.');
|
|
if (!observed.visible || observed.reducedMotion !== 'no-preference' || observed.saveData || observed.pageZoom !== 1 || !observed.startedFromAboutBlank) throw new Error('Observed reference environment assertions failed.');
|
|
const minimumDpr = reference.profile === 'desktop-high' ? 1.5 : 1.25;
|
|
if (!Number.isFinite(observed.devicePixelRatio) || observed.devicePixelRatio < minimumDpr) throw new Error('Observed device pixel ratio cannot exercise the maximum tier cap.');
|
|
if (observed.browserName !== 'Chromium' || observed.browserVersion !== reference.browserVersion) throw new Error('Observed browser does not match the attestation.');
|
|
};
|