102 lines
3.6 KiB
JavaScript
102 lines
3.6 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { readFile } from "node:fs/promises";
|
|
import test from "node:test";
|
|
|
|
import {
|
|
explicitlyDistrustedAuthority,
|
|
expiredLeafCertificate,
|
|
hostnameMismatch,
|
|
unknownLocalAuthority,
|
|
} from "../fixtures/tls.js";
|
|
import {
|
|
createCommunityAdvicePlugin,
|
|
createFirefoxValidationPlugin,
|
|
createUserDecisionPlugin,
|
|
createVillageCommunityPlugin,
|
|
} from "../plugins/demo-plugins.js";
|
|
import { TrustRunner } from "../src/index.js";
|
|
import { chainRows, subjectName, verdictCopy } from "../ui/model.js";
|
|
|
|
test("UI model identifies the failed end of an unknown-authority chain", () => {
|
|
const rows = chainRows(unknownLocalAuthority);
|
|
assert.equal(rows.length, 2);
|
|
assert.equal(rows[0].name, "library.village");
|
|
assert.equal(rows.at(-1).failed, true);
|
|
assert.match(rows.at(-1).edge, /Not anchored/);
|
|
});
|
|
|
|
test("UI model locates leaf and root policy failures precisely", () => {
|
|
const expired = chainRows(expiredLeafCertificate);
|
|
assert.equal(expired[0].failed, true);
|
|
assert.match(expired[0].edge, /validity period/);
|
|
assert.equal(expired.at(-1).failed, false);
|
|
|
|
const mismatch = chainRows(hostnameMismatch);
|
|
assert.equal(mismatch[0].failed, true);
|
|
assert.match(mismatch[0].edge, /records\.village/);
|
|
|
|
const distrusted = chainRows(explicitlyDistrustedAuthority);
|
|
assert.equal(distrusted.at(-1).failed, true);
|
|
assert.match(distrusted.at(-1).edge, /Explicitly distrusted/);
|
|
});
|
|
|
|
test("certificate display names prefer the common name", () => {
|
|
assert.equal(subjectName("O=Village,CN=Library CA,C=GE"), "Library CA");
|
|
assert.equal(subjectName("O=Nameless"), "O=Nameless");
|
|
});
|
|
|
|
test("UI plugins produce attributed evidence and a local Boolean verdict", async () => {
|
|
const plugins = [
|
|
configure(createFirefoxValidationPlugin(), "advisor"),
|
|
configure(createVillageCommunityPlugin(), "advisor"),
|
|
configure(createUserDecisionPlugin(true), "decision-authority"),
|
|
];
|
|
const result = await new TrustRunner({ plugins }).evaluate(unknownLocalAuthority);
|
|
|
|
assert.equal(result.verdict.trusted, true);
|
|
assert.ok(result.journal.entries.some((entry) => entry.code === "unknown-issuer"));
|
|
assert.ok(
|
|
result.journal.entries.some((entry) => entry.code === "community-key-continuity"),
|
|
);
|
|
assert.equal(verdictCopy(result, true).title, "You trust this connection");
|
|
});
|
|
|
|
test("conflicting community advice remains visible without becoming a verdict", async () => {
|
|
const plugins = [
|
|
configure(createCommunityAdvicePlugin({
|
|
id: "community.yes",
|
|
name: "Community Yes",
|
|
trusted: true,
|
|
message: "Known key",
|
|
}), "advisor"),
|
|
configure(createCommunityAdvicePlugin({
|
|
id: "community.no",
|
|
name: "Community No",
|
|
trusted: false,
|
|
message: "Unexpected change",
|
|
}), "advisor"),
|
|
];
|
|
const result = await new TrustRunner({ plugins }).evaluate(unknownLocalAuthority);
|
|
|
|
assert.equal(result.verdict.trusted, false);
|
|
assert.deepEqual(
|
|
result.journal.entries.map((entry) => entry.data?.trusted),
|
|
[true, false],
|
|
);
|
|
assert.ok(result.journal.entries.every((entry) => entry.kind === "vote"));
|
|
});
|
|
|
|
function configure(plugin, mode) {
|
|
return { plugin, mode };
|
|
}
|
|
|
|
test("security surface contains immutable-frame and simulation labels", async () => {
|
|
const html = await readFile(new URL("../ui/index.html", import.meta.url), "utf8");
|
|
assert.match(html, /Browsec security decision/);
|
|
assert.match(html, /Browser-owned test surface/);
|
|
assert.match(html, /TRUSTLAB · SYNTHETIC/);
|
|
assert.match(html, /It cannot alter browser trust/);
|
|
assert.match(html, /Decision target/);
|
|
assert.match(html, /Effective and consumed local rules/);
|
|
});
|