Raven Scott
0d732bd41b
- Bump BARE_OS_CTX_API_VERSION to 1.41.0; align syscalls.example, compat matrix, POSIX dashboard, and doc-contract verifier - Stock hrpc: BARE_OS_HRPC_AUDIT chain rows; BARE_OS_HRPC_EMIT_UNLISTED for bare-os:hrpc-request; document seed/hrpc boundaries in KERNEL_CONTRACT + protocol CHANGELOG - VFS: bareOsEvictWarmReadPrefixes; BARE_OS_VFS_WARM_CACHE_PREFIX_INVALIDATE + replicationLive schema 2; warm cache stats schema 2; hyperblobs gate metrics + failed-write counter - maybeMergeBareFromDrive: BARE_OS_BARE_STDLIB_RESOLVE_CONCURRENCY (parallel reads, manifest order preserved) - Word-7 proc: pear_runtime_channel.json + vfs maps/tests; host env passthrough - Coreutils: export bareAwkRun for tests; build strips export in shipped awk; nextfile smoke test; getconf _SC_PAGESIZE test; man/hawk handbook tweaks - Security/docs: vault AEAD tamper test in test.identity.js; vault threat model + users-manual; scripts/verify-doc-contracts.mjs in pretest - Fix /proc readdir golden list order for new proc node; sync seeder kernel
54 lines
1.3 KiB
JavaScript
54 lines
1.3 KiB
JavaScript
/**
|
|
* bare-crypto loads only under Bare — run via brittle-bare (see package.json "test").
|
|
*/
|
|
import test from 'brittle'
|
|
import b4a from 'b4a'
|
|
import {
|
|
encodeAccount,
|
|
decodeAccount,
|
|
encodeNewAccount,
|
|
ACCOUNT_MAGIC,
|
|
ACCOUNT_VERSION,
|
|
sealBytes,
|
|
openBytes,
|
|
vaultKeyFromSecret
|
|
} from './lib/identity-account.js'
|
|
|
|
test('identity account encode/decode roundtrip', async (t) => {
|
|
const pass = 'unit-test-passphrase'
|
|
const blob = encodeNewAccount(pass)
|
|
t.ok(blob.length > 80)
|
|
t.is(blob[0], ACCOUNT_MAGIC[0])
|
|
t.is(blob[ACCOUNT_MAGIC.length], ACCOUNT_VERSION)
|
|
const { publicKey, secretKey } = decodeAccount(pass, blob)
|
|
t.is(publicKey.length, 32)
|
|
t.is(secretKey.length, 64)
|
|
const blob2 = encodeAccount(pass, publicKey, secretKey)
|
|
const again = decodeAccount(pass, blob2)
|
|
t.alike(publicKey, again.publicKey)
|
|
t.alike(secretKey, again.secretKey)
|
|
let bad = false
|
|
try {
|
|
decodeAccount('wrong-pass', blob)
|
|
} catch {
|
|
bad = true
|
|
}
|
|
t.ok(bad)
|
|
})
|
|
|
|
test('vault sealBytes/openBytes rejects tampered ciphertext', async (t) => {
|
|
const sk = new Uint8Array(64)
|
|
sk.fill(9)
|
|
const key = vaultKeyFromSecret(sk)
|
|
const sealed = sealBytes(key, b4a.from('vault-test'))
|
|
const bad = Uint8Array.from(sealed)
|
|
bad[bad.length - 1] ^= 0xff
|
|
let threw = false
|
|
try {
|
|
openBytes(key, bad)
|
|
} catch {
|
|
threw = true
|
|
}
|
|
t.ok(threw)
|
|
})
|