merge(test): expand suite 56->133 over secured behaviour

Author: jjohare

test/body-hash.test.js

@@ -0,0 +1,152 @@
+/**
+ * Tests for bodyToHashHex — the page-side NIP-98 `payload` body hashing in
+ * nip98-interceptor.js. The raw request body never crosses to the background
+ * service worker; the page computes its SHA-256 here (the only context where
+ * FormData / URLSearchParams / Blob survive intact) and ships only the digest.
+ *
+ * bodyToHashHex is a private function inside the interceptor's page-context
+ * IIFE (no ESM export — classic scripts can't import). To exercise the real
+ * source it is loaded and run inside a vm sandbox with a minimal page (window,
+ * fetch, XHR), and the bodyHash the interceptor emits on the
+ * podkey-nip98-request event is captured. This drives the genuine code path
+ * (window.fetch wrapper -> getNip98AuthHeader -> bodyToHashHex) rather than a
+ * reimplementation.
+ */
+
+import { describe, it, before } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { createHash, webcrypto } from 'node:crypto';
+import vm from 'node:vm';
+
+const sha256hex = (input) => createHash('sha256').update(input).digest('hex');
+
+/** Build a fresh sandboxed page with the interceptor installed. */
+function makeInterceptedPage () {
+  const src = readFileSync(new URL('../src/nip98-interceptor.js', import.meta.url), 'utf8');
+  const bus = new EventTarget();
+  const win = {
+    __podkey_nip98_intercepted: false,
+    addEventListener: (...a) => bus.addEventListener(...a),
+    removeEventListener: (...a) => bus.removeEventListener(...a),
+    dispatchEvent: (e) => bus.dispatchEvent(e),
+    // originalFetch: a stub the wrapper calls after deciding on auth.
+    fetch: async () => ({ status: 200, redirected: false, url: '' })
+  };
+
+  // Echo every nip98 request back immediately so the fetch wrapper resolves,
+  // recording the detail (which carries bodyHash) for assertions.
+  const requests = [];
+  bus.addEventListener('podkey-nip98-request', (e) => {
+    requests.push(e.detail);
+    bus.dispatchEvent(new CustomEvent('podkey-nip98-response', { detail: { id: e.detail.id, result: null } }));
+  });
+
+  // Minimal XHR so the interceptor can patch its prototype without throwing.
+  function XHR () {}
+  XHR.prototype = { open () {}, send () {}, setRequestHeader () {} };
+
+  const sandbox = {
+    window: win,
+    XMLHttpRequest: XHR,
+    crypto: webcrypto,
+    CustomEvent, Headers, Request, TextEncoder,
+    Blob, URLSearchParams, ArrayBuffer, Uint8Array, Uint16Array, Array, Object,
+    console, setTimeout, clearTimeout
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(src, sandbox);
+
+  return {
+    /** Issue a fetch through the wrapped fetch and return the captured bodyHash. */
+    async fetchAndGetHash (init) {
+      requests.length = 0;
+      await win.fetch('https://pod.test/r', init);
+      assert.equal(requests.length, 1, 'interceptor should emit exactly one nip98 request');
+      return requests[0].bodyHash;
+    },
+    /** Issue a fetch and return whether any nip98 request was emitted. */
+    async fetchEmitsRequest (input, init) {
+      requests.length = 0;
+      await win.fetch(input, init);
+      return requests.length > 0;
+    }
+  };
+}
+
+describe('bodyToHashHex (NIP-98 page-side body hashing)', () => {
+  let page;
+  before(() => { page = makeInterceptedPage(); });
+
+  it('hashes a string body to its sha-256 hex', async () => {
+    const body = '{"hello":"world"}';
+    assert.equal(await page.fetchAndGetHash({ method: 'POST', body }), sha256hex(body));
+  });
+
+  it('hashes a URLSearchParams body via its serialized form', async () => {
+    const params = new URLSearchParams({ a: '1', b: 'two' });
+    assert.equal(await page.fetchAndGetHash({ method: 'POST', body: params }), sha256hex(params.toString()));
+  });
+
+  it('hashes a Blob body by its bytes', async () => {
+    const text = 'blob-bytes-😀';
+    const blob = new Blob([text]);
+    const expected = sha256hex(Buffer.from(text, 'utf8'));
+    assert.equal(await page.fetchAndGetHash({ method: 'PUT', body: blob }), expected);
+  });
+
+  it('hashes an ArrayBuffer body', async () => {
+    const bytes = new Uint8Array([1, 2, 3, 4, 250, 255]);
+    const expected = sha256hex(Buffer.from(bytes));
+    assert.equal(await page.fetchAndGetHash({ method: 'POST', body: bytes.buffer }), expected);
+  });
+
+  it('hashes a typed-array (Uint8Array) body', async () => {
+    const bytes = new Uint8Array([10, 20, 30]);
+    const expected = sha256hex(Buffer.from(bytes));
+    assert.equal(await page.fetchAndGetHash({ method: 'POST', body: bytes }), expected);
+  });
+
+  it('respects a typed-array view offset (does not hash the whole buffer)', async () => {
+    const full = new Uint8Array([0, 0, 1, 2, 3, 0]);
+    const view = full.subarray(2, 5); // [1,2,3]
+    const expected = sha256hex(Buffer.from([1, 2, 3]));
+    assert.equal(await page.fetchAndGetHash({ method: 'POST', body: view }), expected);
+  });
+
+  it('returns "" for no body (GET)', async () => {
+    assert.equal(await page.fetchAndGetHash({ method: 'GET' }), '');
+  });
+
+  it('returns "" for an empty-string body', async () => {
+    assert.equal(await page.fetchAndGetHash({ method: 'POST', body: '' }), '');
+  });
+
+  it('returns "" for a FormData body (no canonical NIP-98 multipart hash)', async () => {
+    // Documented decision: NIP-98 defines no canonical hash for multipart bodies,
+    // so FormData is intentionally not hashed (no payload tag is added). A
+    // FormData instance matches none of bodyToHashHex's recognised body types
+    // (string / URLSearchParams / Blob / ArrayBuffer / typed-array) and hits the
+    // `return ''` fallthrough.
+    const fd = new FormData();
+    fd.append('field', 'value');
+    assert.equal(await page.fetchAndGetHash({ method: 'POST', body: fd }), '');
+  });
+});
+
+describe('interceptor honors a page-set Authorization (no NIP-98 injection)', () => {
+  let page;
+  before(() => { page = makeInterceptedPage(); });
+
+  it('does not emit a nip98 request when init.headers already has Authorization', async () => {
+    const emitted = await page.fetchEmitsRequest('https://pod.test/r', {
+      method: 'GET', headers: { Authorization: 'DPoP page-token' }
+    });
+    assert.equal(emitted, false, 'page-set DPoP must not be overwritten by NIP-98');
+  });
+
+  it('emits a nip98 request when no Authorization is present', async () => {
+    const emitted = await page.fetchEmitsRequest('https://pod.test/r', { method: 'GET' });
+    assert.equal(emitted, true);
+  });
+});

test/consent-approval.test.js

@@ -0,0 +1,245 @@
+/**
+ * Tests for the per-origin consent gate / signing-approval flow.
+ *
+ * background.js exports nothing and wires its handlers onto chrome.runtime at
+ * import time, so these tests drive it exactly the way the real extension does:
+ * mock `chrome`, import the module to capture the onMessage listener, then send
+ * the same messages the content script and approve popup would send.
+ *
+ * Covered (consent contract, security/signing-approval-ui #20):
+ *   - approve resolves the pending request with the result
+ *   - deny rejects the request ("User denied ...")
+ *   - the 60s timeout auto-denies
+ *   - APPROVE_SIGNING with approved:false (popup beforeunload = deny) rejects
+ *   - trusted-origin + autoSign auto-path: kind 27235 Solid auth signs with NO
+ *     prompt; any other kind still prompts even when trusted+autoSign
+ */
+
+import { describe, it, beforeEach, afterEach, mock } from 'node:test';
+import assert from 'node:assert/strict';
+
+// --- chrome mock (session + local areas, like storage.test.js) ----------------
+function makeArea (store) {
+  return {
+    get: async (keys) => {
+      const result = {};
+      if (Array.isArray(keys)) {
+        keys.forEach((k) => { result[k] = store[k]; });
+      } else if (keys) {
+        Object.keys(keys).forEach((k) => { result[k] = store[k] ?? keys[k]; });
+      } else {
+        return { ...store };
+      }
+      return result;
+    },
+    set: async (items) => { Object.assign(store, items); },
+    remove: async (keys) => {
+      (Array.isArray(keys) ? keys : [keys]).forEach((k) => delete store[k]);
+    }
+  };
+}
+
+const stores = { local: {}, session: {} };
+const windowsCreated = [];
+const captured = { onMessage: null };
+
+global.chrome = {
+  runtime: {
+    onInstalled: { addListener: () => {} },
+    onMessage: { addListener: (fn) => { captured.onMessage = fn; } },
+    lastError: null
+  },
+  windows: {
+    create: (opts) => { windowsCreated.push(opts); return Promise.resolve({ id: windowsCreated.length }); }
+  },
+  storage: {
+    local: makeArea(stores.local),
+    session: makeArea(stores.session)
+  }
+};
+
+// Import background once (captures the onMessage listener). Storage helpers are
+// imported separately for seeding; they share the same chrome mock instance.
+await import('../src/background.js');
+const { generateKeypair } = await import('../src/crypto.js');
+const { storeKeypair, addTrustedOrigin, setAutoSign } = await import('../src/storage.js');
+
+const onMessage = captured.onMessage;
+
+/**
+ * Drain the microtask queue. handleMessage awaits several storage reads before
+ * it reaches showPermissionPrompt / chrome.windows.create; one setImmediate
+ * turn flushes that chain deterministically (and is not affected by the faked
+ * setTimeout used in the timeout tests).
+ */
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+/** Send a message to the background and return a promise of sendResponse(). */
+function send (message) {
+  return new Promise((resolve) => { onMessage(message, {}, resolve); });
+}
+
+/** Read the requestId out of the most recently opened approval popup URL. */
+function lastRequestId () {
+  const last = windowsCreated[windowsCreated.length - 1];
+  // url is `popup/approve.html?id=...&origin=...` — parse against a dummy base
+  return new URL('https://x/' + last.url).searchParams.get('id');
+}
+
+/** Resolve a pending prompt by sending the popup's APPROVE_SIGNING message. */
+function respond (requestId, approved) {
+  onMessage({ type: 'APPROVE_SIGNING', requestId, approved }, {}, () => {});
+}
+
+const SOLID_EVENT = { kind: 27235, created_at: 1700000000, tags: [['u', 'https://pod.test/']], content: '' };
+const NOTE_EVENT = { kind: 1, created_at: 1700000000, tags: [], content: 'gm' };
+
+describe('consent gate / approval flow', () => {
+  let keypair;
+
+  beforeEach(async () => {
+    // Reset storage and the record of opened windows before every test.
+    for (const k of Object.keys(stores.local)) delete stores.local[k];
+    for (const k of Object.keys(stores.session)) delete stores.session[k];
+    windowsCreated.length = 0;
+    keypair = await generateKeypair();
+    await storeKeypair(keypair.privateKey, keypair.publicKey);
+  });
+
+  afterEach(() => { mock.timers.reset(); });
+
+  it('opens an approval popup for an untrusted origin (does not auto-resolve)', async () => {
+    const pending = send({ type: 'GET_PUBLIC_KEY', origin: 'https://untrusted.test' });
+    // Let the handler reach showPermissionPrompt / chrome.windows.create.
+    await flush();
+    assert.equal(windowsCreated.length, 1, 'exactly one approval popup should open');
+    const url = windowsCreated[0].url;
+    assert.match(url, /^popup\/approve\.html\?/);
+    const params = new URL('https://x/' + url).searchParams;
+    assert.equal(params.get('origin'), 'https://untrusted.test');
+    assert.equal(params.get('action'), 'read your public key');
+    assert.ok(params.get('id'), 'a requestId must be present');
+    // Clean up the dangling promise so the test runner doesn't hang.
+    respond(params.get('id'), true);
+    await pending;
+  });
+
+  it('approve resolves the pending request with the public key', async () => {
+    const pending = send({ type: 'GET_PUBLIC_KEY', origin: 'https://app.test' });
+    await flush();
+    respond(lastRequestId(), true);
+    const result = await pending;
+    assert.equal(result, keypair.publicKey);
+  });
+
+  it('deny rejects the request with "User denied permission"', async () => {
+    const pending = send({ type: 'GET_PUBLIC_KEY', origin: 'https://app.test' });
+    await flush();
+    respond(lastRequestId(), false);
+    const result = await pending;
+    assert.deepEqual(result, { error: 'User denied permission' });
+  });
+
+  it('APPROVE_SIGNING approved:false (popup beforeunload = deny) rejects signing', async () => {
+    const pending = send({ type: 'SIGN_EVENT', event: NOTE_EVENT, origin: 'https://app.test' });
+    await flush();
+    // The approve popup sends {approved:false} on window beforeunload (closing
+    // the window without choosing = deny). Same wire message, approved:false.
+    respond(lastRequestId(), false);
+    const result = await pending;
+    assert.deepEqual(result, { error: 'User denied signing' });
+  });
+
+  it('the 60s timeout auto-denies when the popup never responds', async () => {
+    mock.timers.enable({ apis: ['setTimeout'] });
+    const pending = send({ type: 'GET_PUBLIC_KEY', origin: 'https://slow.test' });
+    await flush();
+    assert.equal(windowsCreated.length, 1, 'popup opened, awaiting a decision');
+    // No APPROVE_SIGNING arrives. Advance just past the 60s auto-deny.
+    mock.timers.tick(60001);
+    const result = await pending;
+    assert.deepEqual(result, { error: 'User denied permission' });
+  });
+
+  it('does NOT auto-deny before 60s elapse', async () => {
+    mock.timers.enable({ apis: ['setTimeout'] });
+    const pending = send({ type: 'GET_PUBLIC_KEY', origin: 'https://app.test' });
+    await flush();
+    mock.timers.tick(59999); // one ms short of the deadline
+    // Still pending — a late approval must win the race.
+    respond(lastRequestId(), true);
+    const result = await pending;
+    assert.equal(result, keypair.publicKey);
+  });
+
+  it('a late APPROVE_SIGNING after timeout is ignored (entry already deleted)', async () => {
+    mock.timers.enable({ apis: ['setTimeout'] });
+    const pending = send({ type: 'GET_PUBLIC_KEY', origin: 'https://app.test' });
+    await flush();
+    const id = lastRequestId();
+    mock.timers.tick(60001);
+    const result = await pending;
+    assert.deepEqual(result, { error: 'User denied permission' });
+    // Late response for the same id must be a harmless no-op (no throw, no
+    // second resolution). pendingApprovals no longer holds the id.
+    assert.doesNotThrow(() => respond(id, true));
+  });
+});
+
+describe('trusted-origin auto-path (autoSign)', () => {
+  let keypair;
+
+  beforeEach(async () => {
+    for (const k of Object.keys(stores.local)) delete stores.local[k];
+    for (const k of Object.keys(stores.session)) delete stores.session[k];
+    windowsCreated.length = 0;
+    keypair = await generateKeypair();
+    await storeKeypair(keypair.privateKey, keypair.publicKey);
+  });
+
+  it('signs a kind-27235 Solid event with NO prompt when trusted + autoSign', async () => {
+    await addTrustedOrigin('https://pod.test');
+    await setAutoSign(true);
+    const result = await send({ type: 'SIGN_EVENT', event: SOLID_EVENT, origin: 'https://pod.test' });
+    assert.equal(windowsCreated.length, 0, 'auto-sign path must not open a popup');
+    assert.equal(result.kind, 27235);
+    assert.equal(result.pubkey, keypair.publicKey);
+    assert.equal(result.sig.length, 128);
+  });
+
+  it('still PROMPTS for a non-Solid kind even when trusted + autoSign', async () => {
+    await addTrustedOrigin('https://pod.test');
+    await setAutoSign(true);
+    const pending = send({ type: 'SIGN_EVENT', event: NOTE_EVENT, origin: 'https://pod.test' });
+    await flush();
+    assert.equal(windowsCreated.length, 1, 'non-Solid kind must still require approval');
+    respond(lastRequestId(), true);
+    const result = await pending;
+    assert.equal(result.kind, 1);
+  });
+
+  it('PROMPTS for a Solid event when autoSign is OFF (even if trusted)', async () => {
+    await addTrustedOrigin('https://pod.test');
+    await setAutoSign(false);
+    const pending = send({ type: 'SIGN_EVENT', event: SOLID_EVENT, origin: 'https://pod.test' });
+    await flush();
+    assert.equal(windowsCreated.length, 1, 'autoSign off must require explicit approval');
+    respond(lastRequestId(), true);
+    const result = await pending;
+    assert.equal(result.kind, 27235);
+  });
+
+  it('approving an untrusted signing request trusts the origin (no re-prompt)', async () => {
+    await setAutoSign(true);
+    // First request: untrusted -> prompt -> approve.
+    const first = send({ type: 'SIGN_EVENT', event: SOLID_EVENT, origin: 'https://new.test' });
+    await flush();
+    assert.equal(windowsCreated.length, 1);
+    respond(lastRequestId(), true);
+    await first;
+    // Second Solid request from the now-trusted origin: auto-signs, no popup.
+    const second = await send({ type: 'SIGN_EVENT', event: SOLID_EVENT, origin: 'https://new.test' });
+    assert.equal(windowsCreated.length, 1, 'origin became trusted; no second popup');
+    assert.equal(second.kind, 27235);
+  });
+});