tdf.spec.ts

import { expect } from 'chai';

import * as TDF from '../../../tdf3/src/tdf.js';
import { KeyAccessObject } from '../../../tdf3/src/models/key-access.js';
import { PolicyBody, type Policy } from '../../../tdf3/src/models/policy.js';
import { OriginAllowList } from '../../../src/access.js';
import { ConfigurationError, InvalidFileError, UnsafeUrlError } from '../../../src/errors.js';
import { getMocks } from '../../mocks/index.js';
import * as DefaultCryptoService from '../../../tdf3/src/crypto/index.js';
import type { CryptoService } from '../../../tdf3/src/crypto/declarations.js';

const sampleCert = `
-----BEGIN CERTIFICATE-----
MIIFnjCCA4YCCQCnKw0cfbMLJTANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UEBhMC
VUExCzAJBgNVBAgMAk9EMQ4wDAYDVQQHDAVPREVTQTEPMA0GA1UECgwGVklSVFJV
MREwDwYDVQQLDAhQTEFURk9STTEZMBcGA1UEAwwQbG9jYWwudmlydHJ1LmNvbTEl
MCMGCSqGSIb3DQEJARYWc2l2YW5vdi5jdHJAdmlydHJ1LmNvbTAeFw0yMzA3MDYx
MTUxMzFaFw0yNDA3MDUxMTUxMzFaMIGQMQswCQYDVQQGEwJVQTELMAkGA1UECAwC
T0QxDjAMBgNVBAcMBU9ERVNBMQ8wDQYDVQQKDAZWSVJUUlUxETAPBgNVBAsMCFBM
QVRGT1JNMRkwFwYDVQQDDBBsb2NhbC52aXJ0cnUuY29tMSUwIwYJKoZIhvcNAQkB
FhZzaXZhbm92LmN0ckB2aXJ0cnUuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
MIICCgKCAgEAn+CvhpQZ6lPZG8j07l8JWWQnmPATKB2GDbcyC/Yg1rJAcFLZmBvH
VR3SamYQrSKxFRsoBGVruIFQBpoYMSolRWVVRnRBmpB5O8vCdP8J78mRaXGoJAez
xexuZBEoUIJJAn0Uoxg462201RgzLrZq+b+gOHZzcOfMlh/HPWhTeLdW2i0oMddL
yeykUa8ARHeCbA1Ux/IZju9n+lY3Pv7pI7z0mYuU14p33lvQbTZ1psY4frwFeyqC
rqHR1NqKjX+CnitFDrVKV48ZNlBQ6y348NpCaNH0wmy4FRAuGS6dJb9KFK6C+KIj
EQlWaucPTgvf6/dgZ6IZdLPvHUQNwC9yidRpnyLTUZlxwCXVO3P1sP7ifq75RwFk
OhvGqnoWNxUwd+23YUOFhE5b7WSO8NwRiMPBeEhNiWaiCmu1v88h52mgRr74MjCQ
mftuJlPwhsqWMpdYuv42851Y95x5s7BFWtntBNcU/+TTSKcygPNGkuR/tNw79JrM
bMl/Wj+cJoCW/3+1KzmPX13Nf2Cq2KZ8Kx6JCy+zFj/Hu8O/iqZ1vxA7gUyESPrd
NFB988QD7H8AQLCeDh6mOTdK08ZG74FlRBSk788A4oyslx8DslOkWbqHLdA7frv6
rEtl3mJ9UchFVpJOXw5nT3plE0ZRx4NWRLAG2+8GIUsL6eylpFUfVH8CAwEAATAN
BgkqhkiG9w0BAQsFAAOCAgEAlS3ph3ZcPf90uo0Y0l6Pca5I7ztuq6wu6reKAqnz
kh6N1rpLSe6EdRIOOCkMWMYTlZYFnSG/USGRfiCV0TOoo2C+jFvARRn6oir1v3B4
XBQORRNrOP8xV6kXAmNxs9Zl8CpAxfejV0vBHzN709q2HDfwmMmmp/yhlsAa1/iL
ARYV3TIJBmAOpec2CemuSVwGvYF7Ojl4sTYl0qMzrmm85wMBHJWR9EJbbFZBDDi4
GKVx26SfxaeauZXRgbO7Tav0q7mbJXI6u95aWO6iwkABRfnEQbimfVCjRI4TKlNs
WX5PS3QXXJg/9ocEglNGDwTouDwD/yMevR2tJ4clb9SJkJjJ3I0t7aUoFHXBl0B2
merKiN1ZE4OlbG/BsJypwAqV7Xk6tK3LM8fCMxhP1K0XX5Ifi1+hbN4Wr7a/zpEq
RWFMXtPKqTne0Ut6M7Xv5BBjY3uBmp0AX9hXt00olAiZsrOfj4gjAVULxdsbaEpr
nTqI65s26fls4y9bCZSfY//YNMAAtSRfmGbCZfrnzyvMtZfSMHqxhzMX7jXonV9c
TuHue7faEGaGlWGQVdNeudZaQ/eimDWeWnbhoUz6hSX7NICUFE64W6+GVFsAte3s
jtfbjUcLqvZzZt+u7YDapWbEbdgYjn/lUt0sTNyY65IagXJel9iacjCIVdzoKPzn
HJg=
-----END CERTIFICATE-----
`.trim();

const { kasECCert } = getMocks();

describe('TDF', () => {
  const cryptoService: CryptoService = DefaultCryptoService;

  it('should return key', async () => {
    const pem = await TDF.extractPemFromKeyString(sampleCert, 'rsa:2048', cryptoService);
    expect(pem).to.include('-----BEGIN PUBLIC KEY-----');
    expect(pem).to.include('-----END PUBLIC KEY-----');
  });

  it('should return pem', async () => {
    const sampleKey = sampleCert
      .replace('BEGIN CERTIFICATE', 'BEGIN PUBLIC KEY')
      .replace('END CERTIFICATE', 'END PUBLIC KEY');
    const pem = await TDF.extractPemFromKeyString(sampleKey, 'rsa:2048', cryptoService);
    expect(pem).to.equal(sampleKey);
  });

  it('should return ec pem', async () => {
    const pem = await TDF.extractPemFromKeyString(kasECCert, 'ec:secp256r1', cryptoService);
    expect(pem).to.include('-----BEGIN PUBLIC KEY-----');
    expect(pem).to.include('-----END PUBLIC KEY-----');
  });
});

describe('fetchKasPublicKey', async () => {
  it('missing kas names throw', async () => {
    try {
      await TDF.fetchKasPublicKey('');
      expect.fail('did not throw');
    } catch (e) {
      expect(() => {
        throw e;
      }).to.throw(ConfigurationError);
    }
  });

  it('invalid kas names throw', async () => {
    try {
      await TDF.fetchKasPublicKey('~~~');
      expect.fail('did not throw');
    } catch (e) {
      expect(e).to.exist;
    }
  });

  it('localhost kas is valid', async () => {
    const pk2 = await TDF.fetchKasPublicKey('http://localhost:3000');
    expect(pk2.publicKey).to.include('BEGIN CERTIFICATE');
    expect(pk2.kid).to.equal('e1');
  });

  it('invalid algorithms', async () => {
    try {
      const res = await TDF.fetchKasPublicKey('http://localhost:3000', 'rsa:512' as never); //ts-ignore
      console.log(res);
      expect.fail('did not throw');
    } catch (e) {
      expect(!!e).to.equal(true);
    }
  });

  it('localhost BaseKey', async () => {
    const pk2 = await TDF.fetchKasPublicKey('http://localhost:3000');
    expect(pk2.publicKey).to.include('BEGIN CERTIFICATE');
    expect(pk2.kid).to.equal('e1');
  });
});

describe('validatePolicyObject', () => {
  const testCases: { title: string; policy: Partial<Policy>; error?: string }[] = [
    {
      title: 'missing uuid',
      policy: { body: { dataAttributes: [], dissem: ['someDissem'] } },
      error: 'uuid',
    },
    {
      title: 'missing body',
      policy: { uuid: 'someUuid' },
      error: 'body',
    },
    {
      title: 'missing body.dissem',
      policy: { uuid: 'someUuid', body: {} as PolicyBody },
      error: 'dissem',
    },
    {
      title: 'valid policy',
      policy: { uuid: 'someUuid', body: { dataAttributes: [], dissem: ['someDissem'] } },
    },
  ];

  testCases.forEach(({ title, policy, error }) => {
    it(`should handle ${title}`, () => {
      if (error) {
        expect(() => TDF.validatePolicyObject(policy as Policy)).to.throw(
          ConfigurationError,
          error
        );
      } else {
        expect(() => TDF.validatePolicyObject(policy as Policy)).to.not.throw();
      }
    });
  });
});

function createDeferred<T>() {
  let reject!: (error: unknown) => void;
  let resolve!: (value: T | PromiseLike<T>) => void;
  const promise = new Promise<T>((innerResolve, innerReject) => {
    resolve = innerResolve;
    reject = innerReject;
  });
  return { promise, reject, resolve };
}

async function flushScheduler() {
  await Promise.resolve();
  await Promise.resolve();
}

describe('bounded segment scheduler', () => {
  it('honors the configured batch size', async () => {
    const started: Array<[number, number]> = [];
    const deferred = createDeferred<void>();
    const scheduler = TDF.createBoundedSegmentScheduler({
      totalSegments: 6,
      segmentBatchSize: 2,
      maxConcurrentSegmentBatches: 1,
      scheduleBatch: (startIndex, endIndex) => {
        started.push([startIndex, endIndex]);
        return deferred.promise;
      },
    });

    scheduler.fillWindow();
    await flushScheduler();
    expect(started).to.deep.equal([[0, 2]]);

    deferred.resolve();
    await flushScheduler();

    scheduler.markConsumed();
    await flushScheduler();
    expect(started).to.deep.equal([[0, 2]]);

    scheduler.markConsumed();
    await flushScheduler();
    expect(started).to.deep.equal([
      [0, 2],
      [2, 4],
    ]);
  });

  it('bounds scheduled work to the configured prefetch window', async () => {
    const started: Array<[number, number]> = [];
    const deferredBatches = [
      createDeferred<void>(),
      createDeferred<void>(),
      createDeferred<void>(),
    ];
    let nextDeferred = 0;
    const scheduler = TDF.createBoundedSegmentScheduler({
      totalSegments: 10,
      segmentBatchSize: 2,
      maxConcurrentSegmentBatches: 2,
      scheduleBatch: (startIndex, endIndex) => {
        started.push([startIndex, endIndex]);
        return deferredBatches[nextDeferred++].promise;
      },
    });

    scheduler.fillWindow();
    await flushScheduler();

    expect(started).to.deep.equal([
      [0, 2],
      [2, 4],
    ]);
    expect(scheduler.snapshot()).to.deep.equal({
      consumedSegments: 0,
      inFlightBatches: 2,
      maxPrefetchedSegments: 4,
      scheduledSegments: 4,
    });

    deferredBatches[0].resolve();
    await flushScheduler();
    expect(started).to.deep.equal([
      [0, 2],
      [2, 4],
    ]);

    scheduler.markConsumed(2);
    await flushScheduler();
    expect(started).to.deep.equal([
      [0, 2],
      [2, 4],
      [4, 6],
    ]);
  });
});

describe('splitLookupTableFactory', () => {
  it('should return a correct split table for valid input', () => {
    const keyAccess: KeyAccessObject[] = [
      { sid: 'split1', type: 'remote', url: 'https://kas1', protocol: 'kas' },
      { sid: 'split2', type: 'remote', url: 'https://kas2', protocol: 'kas' },
    ];
    const allowedKases = new OriginAllowList(['https://kas1', 'https://kas2']);

    const result = TDF.splitLookupTableFactory(keyAccess, allowedKases);

    expect(result).to.deep.equal({
      split1: { 'https://kas1': [keyAccess[0]] },
      split2: { 'https://kas2': [keyAccess[1]] },
    });
  });

  it('should return a correct split table for valid input with ignoreAllowList', () => {
    const keyAccess: KeyAccessObject[] = [
      { sid: 'split1', type: 'remote', url: 'https://kas1', protocol: 'kas' },
      { sid: 'split2', type: 'remote', url: 'https://kas2', protocol: 'kas' },
    ];
    const allowedKases = new OriginAllowList([], true);

    const result = TDF.splitLookupTableFactory(keyAccess, allowedKases);

    expect(result).to.deep.equal({
      split1: { 'https://kas1': [keyAccess[0]] },
      split2: { 'https://kas2': [keyAccess[1]] },
    });
  });

  it('should throw UnsafeUrlError for disallowed KASes', () => {
    const keyAccess: KeyAccessObject[] = [
      { sid: 'split1', type: 'remote', url: 'https://kas1', protocol: 'kas' },
      { sid: 'split2', type: 'remote', url: 'https://kas3', protocol: 'kas' }, // kas3 is not allowed
    ];
    const allowedKases = new OriginAllowList(['https://kas1']);

    expect(() => TDF.splitLookupTableFactory(keyAccess, allowedKases)).to.throw(
      UnsafeUrlError,
      'Unreconstructable key - disallowed KASes include: ["https://kas3"] from splitIds ["split1","split2"]'
    );
  });

  it('preserves duplicate URLs in the same splitId as a list', () => {
    const keyAccess: KeyAccessObject[] = [
      { sid: 'split1', type: 'remote', url: 'https://kas1', protocol: 'kas' },
      { sid: 'split1', type: 'remote', url: 'https://kas1', protocol: 'kas' },
    ];
    const allowedKases = new OriginAllowList(['https://kas1']);

    const result = TDF.splitLookupTableFactory(keyAccess, allowedKases);

    expect(result).to.deep.equal({
      split1: { 'https://kas1': [keyAccess[0], keyAccess[1]] },
    });
  });

  it('preserves multiple keys with distinct kids on the same KAS and split', () => {
    const keyAccess: KeyAccessObject[] = [
      { sid: 'split1', type: 'wrapped', url: 'https://kas1', kid: 'k1', protocol: 'kas' },
      { sid: 'split1', type: 'wrapped', url: 'https://kas1', kid: 'k2', protocol: 'kas' },
    ];
    const allowedKases = new OriginAllowList(['https://kas1']);

    const result = TDF.splitLookupTableFactory(keyAccess, allowedKases);

    expect(result['split1']['https://kas1']).to.have.length(2);
    expect(result['split1']['https://kas1'].map((k) => k.kid)).to.deep.equal(['k1', 'k2']);
  });

  it('should handle empty keyAccess array', () => {
    const keyAccess: KeyAccessObject[] = [];
    const allowedKases = new OriginAllowList([]);

    const result = TDF.splitLookupTableFactory(keyAccess, allowedKases);

    expect(result).to.deep.equal({});
  });

  it('should handle empty allowedKases array', () => {
    const keyAccess: KeyAccessObject[] = [
      { sid: 'split1', type: 'remote', url: 'https://kas1', protocol: 'kas' },
    ];
    const allowedKases = new OriginAllowList([]);

    expect(() => TDF.splitLookupTableFactory(keyAccess, allowedKases)).to.throw(
      InvalidFileError,
      'Unreconstructable key - disallowed KASes include: ["https://kas1"]'
    );
  });

  it('should handle cases where sid is undefined', () => {
    const keyAccess: KeyAccessObject[] = [
      { sid: undefined, type: 'remote', url: 'https://kas1', protocol: 'kas' },
    ];
    const allowedKases = ['https://kas1'];

    const result = TDF.splitLookupTableFactory(keyAccess, new OriginAllowList(allowedKases));

    expect(result).to.deep.equal({
      '': { 'https://kas1': [keyAccess[0]] },
    });
  });
});