mirror of
https://github.com/BigBodyCobain/Shadowbroker.git
synced 2026-08-12 05:30:27 +02:00
519 lines
16 KiB
TypeScript
519 lines
16 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
|
|
import {
|
|
buildDmTrustHint,
|
|
buildPrivateLaneHint,
|
|
dmTrustPrimaryActionLabel,
|
|
hasKnownFirstContactAnchor,
|
|
hasVerifiedFirstContactAnchor,
|
|
isInvitePinnedFirstContact,
|
|
isFirstContactTrustOnly,
|
|
requiresVerifiedFirstContact,
|
|
shortTrustFingerprint,
|
|
shouldAutoRevealSasForTrust,
|
|
} from '@/mesh/meshPrivacyHints';
|
|
|
|
describe('meshPrivacyHints', () => {
|
|
it('flags recent private-lane fallback as a danger hint', () => {
|
|
const hint = buildPrivateLaneHint({
|
|
activeTab: 'dms',
|
|
recentPrivateFallback: true,
|
|
recentPrivateFallbackReason: 'Tor transport failed and clearnet relay was used.',
|
|
dmTransportMode: 'relay',
|
|
});
|
|
|
|
expect(hint).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'danger',
|
|
title: 'RECENT PRIVACY DOWNGRADE',
|
|
}),
|
|
);
|
|
expect(hint?.detail).toContain('clearnet relay');
|
|
});
|
|
|
|
it('flags remote prekey mismatch as a danger trust hint', () => {
|
|
const hint = buildDmTrustHint({
|
|
remotePrekeyMismatch: true,
|
|
});
|
|
|
|
expect(hint).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'danger',
|
|
title: 'REMOTE PREKEY CHANGED',
|
|
}),
|
|
);
|
|
});
|
|
|
|
it('flags first-seen pinned contacts as TOFU until verified', () => {
|
|
const contact = {
|
|
remotePrekeyFingerprint: 'abc123',
|
|
remotePrekeyPinnedAt: 123,
|
|
verify_registry: false,
|
|
verify_inband: false,
|
|
verified: false,
|
|
};
|
|
|
|
expect(isFirstContactTrustOnly(contact)).toBe(true);
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'warn',
|
|
title: 'FIRST CONTACT (TOFU ONLY)',
|
|
}),
|
|
);
|
|
expect(buildDmTrustHint(contact)?.detail).toContain('not proof of sender identity');
|
|
expect(dmTrustPrimaryActionLabel(contact)).toBe('VERIFY SAS NOW');
|
|
expect(shouldAutoRevealSasForTrust(contact)).toBe(true);
|
|
});
|
|
|
|
it('treats invite-pinned first contact as stronger than TOFU', () => {
|
|
const contact = {
|
|
trustSummary: {
|
|
state: 'invite_pinned',
|
|
label: 'INVITE PINNED',
|
|
severity: 'warn',
|
|
detail: 'anchored by signed invite',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'show_sas',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootAttested: true,
|
|
rootWitnessed: true,
|
|
rootDistributionState: 'quorum_witnessed',
|
|
rootWitnessThreshold: 2,
|
|
rootWitnessCount: 2,
|
|
rootWitnessDomainCount: 1,
|
|
rootWitnessProvenanceState: 'local_quorum',
|
|
rootWitnessIndependentQuorumMet: false,
|
|
rootMismatch: false,
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
};
|
|
|
|
expect(isInvitePinnedFirstContact(contact)).toBe(true);
|
|
expect(isFirstContactTrustOnly(contact)).toBe(false);
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'warn',
|
|
title: 'ROOT LOCAL QUORUM',
|
|
}),
|
|
);
|
|
expect(buildDmTrustHint(contact)?.detail).toContain('co-resident in one trust domain');
|
|
expect(dmTrustPrimaryActionLabel(contact)).toBe('SHOW SAS');
|
|
expect(shouldAutoRevealSasForTrust(contact)).toBe(false);
|
|
});
|
|
|
|
it('distinguishes independent quorum provenance from local quorum', () => {
|
|
const contact = {
|
|
trustSummary: {
|
|
state: 'invite_pinned',
|
|
label: 'INVITE PINNED',
|
|
severity: 'warn',
|
|
detail: 'anchored by signed invite on independent quorum root',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'show_sas',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootAttested: true,
|
|
rootWitnessed: true,
|
|
rootDistributionState: 'quorum_witnessed',
|
|
rootWitnessThreshold: 2,
|
|
rootWitnessCount: 2,
|
|
rootWitnessDomainCount: 2,
|
|
rootWitnessProvenanceState: 'independent_quorum',
|
|
rootWitnessIndependentQuorumMet: true,
|
|
rootMismatch: false,
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
};
|
|
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'warn',
|
|
title: 'ROOT INDEPENDENT QUORUM',
|
|
}),
|
|
);
|
|
expect(buildDmTrustHint(contact)?.detail).toContain('independently quorum-witnessed');
|
|
});
|
|
|
|
it('requires verified first-contact anchors before secure bootstrap', () => {
|
|
expect(requiresVerifiedFirstContact(undefined)).toBe(true);
|
|
expect(hasKnownFirstContactAnchor(undefined)).toBe(false);
|
|
expect(hasVerifiedFirstContactAnchor(undefined)).toBe(false);
|
|
|
|
expect(
|
|
requiresVerifiedFirstContact({
|
|
trustSummary: {
|
|
state: 'invite_pinned',
|
|
label: 'INVITE PINNED',
|
|
severity: 'warn',
|
|
detail: 'anchored by signed invite',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'show_sas',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootWitnessed: true,
|
|
rootDistributionState: 'quorum_witnessed',
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
}),
|
|
).toBe(false);
|
|
expect(
|
|
hasVerifiedFirstContactAnchor({
|
|
trustSummary: {
|
|
state: 'invite_pinned',
|
|
label: 'INVITE PINNED',
|
|
severity: 'warn',
|
|
detail: 'anchored by signed invite',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'show_sas',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootWitnessed: true,
|
|
rootDistributionState: 'quorum_witnessed',
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
}),
|
|
).toBe(true);
|
|
|
|
expect(
|
|
requiresVerifiedFirstContact({
|
|
remotePrekeyFingerprint: 'abc123',
|
|
remotePrekeyPinnedAt: 123,
|
|
}),
|
|
).toBe(true);
|
|
expect(
|
|
hasVerifiedFirstContactAnchor({
|
|
remotePrekeyFingerprint: 'abc123',
|
|
remotePrekeyPinnedAt: 123,
|
|
}),
|
|
).toBe(false);
|
|
|
|
expect(
|
|
requiresVerifiedFirstContact({
|
|
verified: true,
|
|
verify_inband: true,
|
|
verify_registry: true,
|
|
}),
|
|
).toBe(true);
|
|
expect(
|
|
hasVerifiedFirstContactAnchor({
|
|
verified: true,
|
|
verify_inband: true,
|
|
verify_registry: true,
|
|
}),
|
|
).toBe(false);
|
|
});
|
|
|
|
it('auto-reveals SAS for trust hazards but keeps ordinary verified contacts quiet', () => {
|
|
expect(
|
|
shouldAutoRevealSasForTrust({
|
|
remotePrekeyMismatch: true,
|
|
}),
|
|
).toBe(true);
|
|
expect(
|
|
shouldAutoRevealSasForTrust({
|
|
verify_mismatch: true,
|
|
}),
|
|
).toBe(true);
|
|
expect(
|
|
shouldAutoRevealSasForTrust({
|
|
trustSummary: {
|
|
state: 'sas_verified',
|
|
label: 'SAS VERIFIED',
|
|
severity: 'good',
|
|
detail: 'sas verified',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'show_sas',
|
|
legacyLookup: false,
|
|
inviteAttested: false,
|
|
rootDistributionState: 'none',
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
}),
|
|
).toBe(false);
|
|
expect(
|
|
dmTrustPrimaryActionLabel({
|
|
trustSummary: {
|
|
state: 'sas_verified',
|
|
label: 'SAS VERIFIED',
|
|
severity: 'good',
|
|
detail: 'sas verified',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'show_sas',
|
|
legacyLookup: false,
|
|
inviteAttested: false,
|
|
rootDistributionState: 'none',
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
}),
|
|
).toBe('SHOW SAS');
|
|
});
|
|
|
|
it('maps import-invite and reverify actions to distinct labels', () => {
|
|
expect(
|
|
dmTrustPrimaryActionLabel({
|
|
trustSummary: {
|
|
state: 'unpinned',
|
|
label: 'UNVERIFIED',
|
|
severity: 'warn',
|
|
detail: 'invite required',
|
|
verifiedFirstContact: false,
|
|
recommendedAction: 'import_invite',
|
|
legacyLookup: false,
|
|
inviteAttested: false,
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
}),
|
|
).toBe('IMPORT INVITE');
|
|
expect(
|
|
dmTrustPrimaryActionLabel({
|
|
trustSummary: {
|
|
state: 'continuity_broken',
|
|
label: 'CONTINUITY BROKEN',
|
|
severity: 'danger',
|
|
detail: 'reverify',
|
|
verifiedFirstContact: false,
|
|
recommendedAction: 'reverify',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
registryMismatch: true,
|
|
transparencyConflict: false,
|
|
},
|
|
}),
|
|
).toBe('REVERIFY NOW');
|
|
});
|
|
|
|
it('surfaces stable root mismatch as a continuity hazard', () => {
|
|
const contact = {
|
|
trustSummary: {
|
|
state: 'continuity_broken',
|
|
label: 'CONTINUITY BROKEN',
|
|
severity: 'danger',
|
|
detail: 'root changed',
|
|
verifiedFirstContact: false,
|
|
recommendedAction: 'reverify',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootAttested: true,
|
|
rootWitnessed: true,
|
|
rootDistributionState: 'quorum_witnessed',
|
|
rootMismatch: true,
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
};
|
|
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'danger',
|
|
title: 'CONTINUITY BROKEN',
|
|
}),
|
|
);
|
|
expect(buildDmTrustHint(contact)?.detail).toContain('stable root identity');
|
|
});
|
|
|
|
it('treats legacy lookup on an otherwise verified contact as an invite-import migration state', () => {
|
|
const contact = {
|
|
trustSummary: {
|
|
state: 'sas_verified',
|
|
label: 'SAS VERIFIED',
|
|
severity: 'good',
|
|
detail: 'sas verified but still legacy lookup',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'import_invite',
|
|
legacyLookup: true,
|
|
inviteAttested: false,
|
|
rootDistributionState: 'none',
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
};
|
|
|
|
expect(dmTrustPrimaryActionLabel(contact)).toBe('IMPORT INVITE');
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'warn',
|
|
title: 'LEGACY LOOKUP',
|
|
}),
|
|
);
|
|
});
|
|
|
|
it('surfaces internal-only root continuity as an invite refresh state', () => {
|
|
const contact = {
|
|
trustSummary: {
|
|
state: 'invite_pinned',
|
|
label: 'INVITE PINNED',
|
|
severity: 'warn',
|
|
detail: 'invite pinned on internal root only',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'import_invite',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootAttested: true,
|
|
rootWitnessed: false,
|
|
rootDistributionState: 'internal_only',
|
|
rootMismatch: false,
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
};
|
|
|
|
expect(dmTrustPrimaryActionLabel(contact)).toBe('IMPORT INVITE');
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'warn',
|
|
title: 'ROOT INTERNAL ONLY',
|
|
}),
|
|
);
|
|
expect(buildDmTrustHint(contact)?.detail).toContain('witnessed root');
|
|
});
|
|
|
|
it('surfaces single-witness root continuity as a weaker witnessed state', () => {
|
|
const contact = {
|
|
trustSummary: {
|
|
state: 'invite_pinned',
|
|
label: 'INVITE PINNED',
|
|
severity: 'warn',
|
|
detail: 'invite pinned on single witness root',
|
|
verifiedFirstContact: true,
|
|
recommendedAction: 'import_invite',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootAttested: true,
|
|
rootWitnessed: true,
|
|
rootDistributionState: 'single_witness',
|
|
rootWitnessCount: 1,
|
|
rootWitnessThreshold: 1,
|
|
rootWitnessQuorumMet: true,
|
|
rootMismatch: false,
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
};
|
|
|
|
expect(dmTrustPrimaryActionLabel(contact)).toBe('IMPORT INVITE');
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'warn',
|
|
title: 'ROOT SINGLE WITNESS',
|
|
}),
|
|
);
|
|
expect(buildDmTrustHint(contact)?.detail).toContain('quorum witness provenance');
|
|
});
|
|
|
|
it('surfaces unproven witnessed root rotation as a hard invite refresh state', () => {
|
|
const contact = {
|
|
trustSummary: {
|
|
state: 'invite_pinned',
|
|
label: 'INVITE PINNED',
|
|
severity: 'warn',
|
|
detail: 'invite pinned on witnessed root without rotation proof',
|
|
verifiedFirstContact: false,
|
|
recommendedAction: 'import_invite',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootAttested: true,
|
|
rootWitnessed: true,
|
|
rootDistributionState: 'quorum_witnessed',
|
|
rootManifestGeneration: 2,
|
|
rootRotationProven: false,
|
|
rootMismatch: false,
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
};
|
|
|
|
expect(dmTrustPrimaryActionLabel(contact)).toBe('IMPORT INVITE');
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'danger',
|
|
title: 'ROOT ROTATION UNPROVEN',
|
|
}),
|
|
);
|
|
expect(buildDmTrustHint(contact)?.detail).toContain('previous-root proof');
|
|
});
|
|
|
|
it('surfaces unsatisfied witness policy as a hard invite refresh state', () => {
|
|
const contact = {
|
|
trustSummary: {
|
|
state: 'invite_pinned',
|
|
label: 'INVITE PINNED',
|
|
severity: 'warn',
|
|
detail: 'invite pinned on root missing witness quorum',
|
|
verifiedFirstContact: false,
|
|
recommendedAction: 'import_invite',
|
|
legacyLookup: false,
|
|
inviteAttested: true,
|
|
rootAttested: true,
|
|
rootWitnessed: true,
|
|
rootDistributionState: 'witness_policy_not_met',
|
|
rootWitnessCount: 1,
|
|
rootWitnessThreshold: 2,
|
|
rootWitnessQuorumMet: false,
|
|
rootMismatch: false,
|
|
registryMismatch: false,
|
|
transparencyConflict: false,
|
|
},
|
|
};
|
|
|
|
expect(dmTrustPrimaryActionLabel(contact)).toBe('IMPORT INVITE');
|
|
expect(buildDmTrustHint(contact)).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'danger',
|
|
title: 'ROOT WITNESS POLICY NOT MET',
|
|
}),
|
|
);
|
|
expect(buildDmTrustHint(contact)?.detail).toContain('witness policy');
|
|
});
|
|
|
|
it('transitional lane hint separates gate posture from DM posture', () => {
|
|
const hint = buildPrivateLaneHint({
|
|
activeTab: 'infonet',
|
|
privateInfonetReady: true,
|
|
privateInfonetTransportReady: false,
|
|
});
|
|
|
|
expect(hint).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'warn',
|
|
title: 'CONTROL-ONLY PRIVATE LANE',
|
|
}),
|
|
);
|
|
// Must explicitly mention gate is on a control-only private lane
|
|
expect(hint?.detail).toContain('PRIVATE / CONTROL_ONLY');
|
|
// Must explicitly mention DM requires a stronger tier
|
|
expect(hint?.detail).toContain('Dead Drop');
|
|
expect(hint?.detail).toContain('stronger lane');
|
|
// Must not imply gate and DM share the same posture
|
|
expect(hint?.detail).toContain('metadata resistance is reduced');
|
|
});
|
|
|
|
it('relay delivery hint is specific to Dead Drop, not gate', () => {
|
|
const hint = buildPrivateLaneHint({
|
|
activeTab: 'dms',
|
|
dmTransportMode: 'relay',
|
|
});
|
|
|
|
expect(hint).toEqual(
|
|
expect.objectContaining({
|
|
severity: 'warn',
|
|
title: 'RELAY DELIVERY ACTIVE',
|
|
}),
|
|
);
|
|
expect(hint?.detail).toContain('Dead Drop');
|
|
});
|
|
|
|
it('shortens long trust fingerprints for display', () => {
|
|
expect(shortTrustFingerprint('abcdef0123456789fedcba9876543210')).toBe('abcdef01..543210');
|
|
expect(shortTrustFingerprint('abcd1234')).toBe('abcd1234');
|
|
expect(shortTrustFingerprint('')).toBe('unknown');
|
|
});
|
|
});
|