web-terminal/relay-auth/test/spiffe.test.ts

/**
 * A2a · SPIFFE-ID device-arm contract edit (FIX H-cp-2 / H-native-6).
 * The host arm MUST keep working; a new /device/ arm is added in lockstep with the
 * control-plane device issuer. The cross-track test pins issuer↔verifier so the two
 * cannot drift (a device SAN the CP stamps must parse under relay-auth's parser).
 */
import { describe, it, expect } from 'vitest'
import { spiffeIdFor, parseSpiffeId, SpiffeError } from '../src/agent/spiffe.js'
import { SpiffeIdSchema } from '../src/types.js'

const DOMAIN = 'example.com'

describe('spiffeIdFor / parseSpiffeId — host arm (backward compatible)', () => {
  it('default kind produces the exact existing host URI and round-trips', () => {
    const id = spiffeIdFor('acct-A', 'host-1', DOMAIN)
    expect(id).toBe('spiffe://relay.example.com/account/acct-A/host/host-1')
    expect(parseSpiffeId(id)).toEqual({ accountId: 'acct-A', id: 'host-1', kind: 'host' })
  })

  it('3-arg call (accountId, id, domain) still works and defaults kind=host', () => {
    const id = spiffeIdFor('acct-A', 'host-9', DOMAIN)
    expect(parseSpiffeId(id).kind).toBe('host')
  })

  it('explicit kind=host matches the 3-arg default form', () => {
    expect(spiffeIdFor('acct-A', 'host-1', DOMAIN, 'host')).toBe(
      spiffeIdFor('acct-A', 'host-1', DOMAIN),
    )
  })
})

describe('spiffeIdFor / parseSpiffeId — device arm (new)', () => {
  it('device kind produces a /device/ URI that passes the schema and round-trips', () => {
    const id = spiffeIdFor('acct-A', 'dev-1', DOMAIN, 'device')
    expect(id).toBe('spiffe://relay.example.com/account/acct-A/device/dev-1')
    expect(SpiffeIdSchema.safeParse(id).success).toBe(true)
    expect(parseSpiffeId(id)).toEqual({ accountId: 'acct-A', id: 'dev-1', kind: 'device' })
  })

  it('CROSS-TRACK: a raw device SAN as the CP issuer stamps it parses under relay-auth', () => {
    // This is the exact string form control-plane/src/ca/device-issue.ts will place in the
    // URI SAN. Assert relay-auth's schema + parser accept it and that it equals the shared
    // builder's output — proving issuer and verifier cannot drift.
    const account = 'acct-XYZ'
    const deviceId = 'did-abc_123'
    const stampedSan = `spiffe://relay.${DOMAIN}/account/${account}/device/${deviceId}`
    expect(SpiffeIdSchema.safeParse(stampedSan).success).toBe(true)
    expect(parseSpiffeId(stampedSan)).toEqual({
      accountId: account,
      id: deviceId,
      kind: 'device',
    })
    expect(spiffeIdFor(account, deviceId, DOMAIN, 'device')).toBe(stampedSan)
  })
})

describe('spiffeIdFor / parseSpiffeId — malformed / traversal / wildcard rejected', () => {
  it('rejects path-traversal in either arm', () => {
    expect(() => parseSpiffeId('spiffe://relay.example.com/account/../host/x')).toThrow(SpiffeError)
    expect(() => parseSpiffeId('spiffe://relay.example.com/account/../device/x')).toThrow(
      SpiffeError,
    )
  })

  it('rejects wildcard in either arm', () => {
    expect(() => parseSpiffeId('spiffe://relay.example.com/account/*/host/x')).toThrow(SpiffeError)
    expect(() => parseSpiffeId('spiffe://relay.example.com/account/a/device/*')).toThrow(SpiffeError)
  })

  it('rejects an unknown kind segment (only host|device allowed)', () => {
    expect(SpiffeIdSchema.safeParse('spiffe://relay.example.com/account/a/user/x').success).toBe(
      false,
    )
    expect(() => parseSpiffeId('spiffe://relay.example.com/account/a/user/x')).toThrow(SpiffeError)
  })

  it('rejects empty accountId / id', () => {
    expect(() => spiffeIdFor('', 'dev-1', DOMAIN, 'device')).toThrow(SpiffeError)
    expect(() => spiffeIdFor('acct-A', '', DOMAIN, 'device')).toThrow(SpiffeError)
  })
})