Expand TrustLab certificate failure scenarios

trustlab/test/ui.test.js

@@ -2,8 +2,14 @@ import assert from "node:assert/strict";
 import { readFile } from "node:fs/promises";
 import test from "node:test";
 
-import { unknownLocalAuthority } from "../fixtures/tls.js";
 import {
+  explicitlyDistrustedAuthority,
+  expiredLeafCertificate,
+  hostnameMismatch,
+  unknownLocalAuthority,
+} from "../fixtures/tls.js";
+import {
+  createCommunityAdvicePlugin,
   createFirefoxValidationPlugin,
   createUserDecisionPlugin,
   createVillageCommunityPlugin,
@@ -19,6 +25,21 @@ test("UI model identifies the failed end of an unknown-authority chain", () => {
   assert.match(rows.at(-1).edge, /Not anchored/);
 });
 
+test("UI model locates leaf and root policy failures precisely", () => {
+  const expired = chainRows(expiredLeafCertificate);
+  assert.equal(expired[0].failed, true);
+  assert.match(expired[0].edge, /validity period/);
+  assert.equal(expired.at(-1).failed, false);
+
+  const mismatch = chainRows(hostnameMismatch);
+  assert.equal(mismatch[0].failed, true);
+  assert.match(mismatch[0].edge, /records\.village/);
+
+  const distrusted = chainRows(explicitlyDistrustedAuthority);
+  assert.equal(distrusted.at(-1).failed, true);
+  assert.match(distrusted.at(-1).edge, /Explicitly distrusted/);
+});
+
 test("certificate display names prefer the common name", () => {
   assert.equal(subjectName("O=Village,CN=Library CA,C=GE"), "Library CA");
   assert.equal(subjectName("O=Nameless"), "O=Nameless");
@@ -40,6 +61,31 @@ test("UI plugins produce attributed evidence and a local Boolean verdict", async
   assert.equal(verdictCopy(result, true).title, "You trust this connection");
 });
 
+test("conflicting community advice remains visible without becoming a verdict", async () => {
+  const plugins = [
+    createCommunityAdvicePlugin({
+      id: "community.yes",
+      name: "Community Yes",
+      trusted: true,
+      message: "Known key",
+    }),
+    createCommunityAdvicePlugin({
+      id: "community.no",
+      name: "Community No",
+      trusted: false,
+      message: "Unexpected change",
+    }),
+  ];
+  const result = await new TrustRunner({ plugins }).evaluate(unknownLocalAuthority);
+
+  assert.equal(result.verdict.trusted, false);
+  assert.deepEqual(
+    result.journal.entries.map((entry) => entry.data?.trusted),
+    [true, false],
+  );
+  assert.ok(result.journal.entries.every((entry) => entry.kind === "vote"));
+});
+
 test("security surface contains immutable-frame and simulation labels", async () => {
   const html = await readFile(new URL("../ui/index.html", import.meta.url), "utf8");
   assert.match(html, /Browsec security decision/);
@@ -47,4 +93,3 @@ test("security surface contains immutable-frame and simulation labels", async ()
   assert.match(html, /TRUSTLAB · SYNTHETIC/);
   assert.match(html, /It cannot alter browser trust/);
 });
-