41 lines
2.3 KiB
JavaScript
41 lines
2.3 KiB
JavaScript
import test from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { normalizeFingerprint, assertRemoteIdentity, parsePhoneIdentity } from '../src/peer-identity.mjs'
|
|
import { openPhoneConnection } from '../src/transport.mjs'
|
|
|
|
const trusted = Array(32).fill('AB').join(':')
|
|
const other = Array(32).fill('CD').join(':')
|
|
const line = pin => `a=fingerprint:sha-256 ${pin}`
|
|
|
|
test('phone identity document binds the complete fingerprint to this pairing and device', () => {
|
|
const value = { kind: 'aiturk-phone-identity', version: 1, pairingId: 'pair',
|
|
deviceId: '33333333-3333-4333-8333-333333333333', fingerprint: trusted }
|
|
assert.deepEqual(parsePhoneIdentity(JSON.stringify(value), 'pair'), { deviceId: value.deviceId, fingerprint: trusted })
|
|
for (const bad of [{ ...value, pairingId: 'other' }, { ...value, fingerprint: 'AB' },
|
|
{ ...value, deviceId: '__proto__' }, { ...value, version: 2 }])
|
|
assert.throws(() => parsePhoneIdentity(JSON.stringify(bad), 'pair'))
|
|
})
|
|
|
|
test('phone refuses absent or malformed saved trust before signaling or opening WebRTC', async () => {
|
|
let calls = 0
|
|
for (const desktopFingerprints of [undefined, {}, { desktop: 'invalid' }, Object.create({ desktop: trusted })]) {
|
|
const account = { credentials: { desktopFingerprints }, call() { calls++; throw new Error('must not contact gateway') } }
|
|
await assert.rejects(openPhoneConnection(account, 'desktop', () => {}), /kimliği/)
|
|
}
|
|
assert.equal(calls, 0)
|
|
})
|
|
|
|
test('a peer identity is a complete SHA-256 fingerprint, not a name or partial digest', () => {
|
|
assert.equal(normalizeFingerprint(trusted.toLowerCase()), trusted)
|
|
for (const bad of [null, '', 'desktop', 'AB', trusted + ':AB', ' ' + trusted, trusted.replace('AB', 'ZZ')])
|
|
assert.throws(() => normalizeFingerprint(bad))
|
|
})
|
|
|
|
test('every advertised DTLS fingerprint must match the independently trusted peer', () => {
|
|
assert.doesNotThrow(() => assertRemoteIdentity(`v=0\r\n${line(trusted)}\r\nm=application 9 UDP/DTLS/SCTP webrtc-datachannel\r\n${line(trusted.toLowerCase())}\r\n`, trusted))
|
|
for (const bad of ['', 'v=0', line(other), `${line(trusted)}\n${line(other)}`,
|
|
line(trusted).replace('sha-256', 'sha-1'), line(trusted) + ' extra', 'x'.repeat(131073)])
|
|
assert.throws(() => assertRemoteIdentity(bad, trusted))
|
|
assert.throws(() => assertRemoteIdentity(line(trusted), undefined))
|
|
})
|