feat(mobile): bind device identities and bound voice usage in 0.1.4 dev

apps/mobile/tests/peer-identity.test.mjs

@@ -0,0 +1,40 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { normalizeFingerprint, assertRemoteIdentity, parsePhoneIdentity } from '../src/peer-identity.mjs'
+import { openPhoneConnection } from '../src/transport.mjs'
+
+const trusted = Array(32).fill('AB').join(':')
+const other = Array(32).fill('CD').join(':')
+const line = pin => `a=fingerprint:sha-256 ${pin}`
+
+test('phone identity document binds the complete fingerprint to this pairing and device', () => {
+  const value = { kind: 'aiturk-phone-identity', version: 1, pairingId: 'pair',
+    deviceId: '33333333-3333-4333-8333-333333333333', fingerprint: trusted }
+  assert.deepEqual(parsePhoneIdentity(JSON.stringify(value), 'pair'), { deviceId: value.deviceId, fingerprint: trusted })
+  for (const bad of [{ ...value, pairingId: 'other' }, { ...value, fingerprint: 'AB' },
+    { ...value, deviceId: '__proto__' }, { ...value, version: 2 }])
+    assert.throws(() => parsePhoneIdentity(JSON.stringify(bad), 'pair'))
+})
+
+test('phone refuses absent or malformed saved trust before signaling or opening WebRTC', async () => {
+  let calls = 0
+  for (const desktopFingerprints of [undefined, {}, { desktop: 'invalid' }, Object.create({ desktop: trusted })]) {
+    const account = { credentials: { desktopFingerprints }, call() { calls++; throw new Error('must not contact gateway') } }
+    await assert.rejects(openPhoneConnection(account, 'desktop', () => {}), /kimliği/)
+  }
+  assert.equal(calls, 0)
+})
+
+test('a peer identity is a complete SHA-256 fingerprint, not a name or partial digest', () => {
+  assert.equal(normalizeFingerprint(trusted.toLowerCase()), trusted)
+  for (const bad of [null, '', 'desktop', 'AB', trusted + ':AB', ' ' + trusted, trusted.replace('AB', 'ZZ')])
+    assert.throws(() => normalizeFingerprint(bad))
+})
+
+test('every advertised DTLS fingerprint must match the independently trusted peer', () => {
+  assert.doesNotThrow(() => assertRemoteIdentity(`v=0\r\n${line(trusted)}\r\nm=application 9 UDP/DTLS/SCTP webrtc-datachannel\r\n${line(trusted.toLowerCase())}\r\n`, trusted))
+  for (const bad of ['', 'v=0', line(other), `${line(trusted)}\n${line(other)}`,
+    line(trusted).replace('sha-256', 'sha-1'), line(trusted) + ' extra', 'x'.repeat(131073)])
+    assert.throws(() => assertRemoteIdentity(bad, trusted))
+  assert.throws(() => assertRemoteIdentity(line(trusted), undefined))
+})