2789 lines
88 KiB
JavaScript
2789 lines
88 KiB
JavaScript
import { initSync } from "../dist/raw/index.js";
|
|
import fs from "fs";
|
|
import path from "path";
|
|
import { fileURLToPath } from "url";
|
|
import assert from "node:assert/strict";
|
|
import { describe, it } from "node:test";
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
const wasmPath = path.resolve(__dirname, "../wasm/pkg/mtp_wasm_bg.wasm");
|
|
const wasmBytes = fs.readFileSync(wasmPath);
|
|
const wasmModule = new WebAssembly.Module(wasmBytes);
|
|
initSync({ module: wasmModule });
|
|
|
|
const relayCreatedAtMillis = 1720000000123n;
|
|
|
|
const sdk = await import("../dist/sdk/index.js");
|
|
const { MTPRatchet } = await import("../dist/sdk/ratchet.js");
|
|
const {
|
|
serializeEncryptedMessage,
|
|
parseEncryptedMessage,
|
|
encryptPayload,
|
|
decryptPayload,
|
|
FLAG_INIT,
|
|
MTP_E2EE_VERSION,
|
|
} = await import("../dist/sdk/encrypted-message.js");
|
|
const {
|
|
MTPSessionManager,
|
|
InMemorySessionStorage,
|
|
deriveSessionKeys,
|
|
derivePeerSessionId,
|
|
buildSessionTranscript,
|
|
} = await import("../dist/sdk/session.js");
|
|
|
|
const bindings = sdk.raw;
|
|
|
|
class MemoryEndpoint {
|
|
constructor(pipeId) {
|
|
this.pipeId = pipeId;
|
|
this.queue = [];
|
|
this.waiters = [];
|
|
this.peer = null;
|
|
this.closed = false;
|
|
}
|
|
|
|
write(data) {
|
|
if (this.closed || !this.peer || this.peer.closed) {
|
|
return Promise.reject(new Error("memory pipe is closed"));
|
|
}
|
|
const chunk = data.slice();
|
|
const waiter = this.peer.waiters.shift();
|
|
if (waiter) waiter(chunk);
|
|
else this.peer.queue.push(chunk);
|
|
return Promise.resolve();
|
|
}
|
|
|
|
read() {
|
|
if (this.queue.length > 0) return Promise.resolve(this.queue.shift());
|
|
if (this.closed) return Promise.resolve(null);
|
|
return new Promise((resolve) => this.waiters.push(resolve));
|
|
}
|
|
|
|
close() {
|
|
this.closed = true;
|
|
for (const resolve of this.waiters.splice(0)) resolve(null);
|
|
if (this.peer) {
|
|
this.peer.closed = true;
|
|
for (const resolve of this.peer.waiters.splice(0)) resolve(null);
|
|
}
|
|
return Promise.resolve();
|
|
}
|
|
|
|
abort() {
|
|
this.closed = true;
|
|
for (const resolve of this.waiters.splice(0)) resolve(null);
|
|
if (this.peer) {
|
|
this.peer.closed = true;
|
|
for (const resolve of this.peer.waiters.splice(0)) resolve(null);
|
|
}
|
|
}
|
|
}
|
|
|
|
function memoryDuplexPair(pipeId = 77) {
|
|
const left = new MemoryEndpoint(pipeId);
|
|
const right = new MemoryEndpoint(pipeId);
|
|
left.peer = right;
|
|
right.peer = left;
|
|
return [left, right];
|
|
}
|
|
|
|
function publicBundle(keyring) {
|
|
const keys = sdk.crypto.keyringToKeys(keyring);
|
|
return concat(
|
|
new Uint8Array([keys.kemPublicKey.length >> 8, keys.kemPublicKey.length & 0xff]),
|
|
keys.kemPublicKey,
|
|
new Uint8Array([keys.sigPqPublicKey.length >> 8, keys.sigPqPublicKey.length & 0xff]),
|
|
keys.sigPqPublicKey,
|
|
new Uint8Array([keys.sigClPublicKey.length >> 8, keys.sigClPublicKey.length & 0xff]),
|
|
keys.sigClPublicKey,
|
|
);
|
|
}
|
|
|
|
function ed25519OnlyEncryptionKeyring(keyring) {
|
|
const keys = sdk.crypto.keyringToKeys(keyring);
|
|
const fields = [
|
|
keys.kemPublicKey,
|
|
keys.kemSecretKey,
|
|
new Uint8Array(0),
|
|
new Uint8Array(0),
|
|
keys.sigClPublicKey,
|
|
keys.sigClSecretKey,
|
|
];
|
|
return concat(
|
|
...fields.flatMap((field) => [
|
|
new Uint8Array([field.length >> 8, field.length & 0xff]),
|
|
field,
|
|
]),
|
|
);
|
|
}
|
|
|
|
function concat(...arrays) {
|
|
const totalLen = arrays.reduce((sum, a) => sum + a.length, 0);
|
|
const result = new Uint8Array(totalLen);
|
|
let offset = 0;
|
|
for (const a of arrays) {
|
|
result.set(a, offset);
|
|
offset += a.length;
|
|
}
|
|
return result;
|
|
}
|
|
|
|
function setupSessions(sharedSecret, aliceId = 1n, bobId = 2n) {
|
|
const aliceStorage = new InMemorySessionStorage();
|
|
const aliceManager = new MTPSessionManager(aliceStorage);
|
|
const bobStorage = new InMemorySessionStorage();
|
|
const bobManager = new MTPSessionManager(bobStorage);
|
|
const sessionId = derivePeerSessionId(aliceId, bobId);
|
|
|
|
return {
|
|
aliceManager,
|
|
aliceStorage,
|
|
bobManager,
|
|
bobStorage,
|
|
async initSessions() {
|
|
const transcript = new Uint8Array([0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e]);
|
|
const { initiatorSend, initiatorRecv } = await deriveSessionKeys(
|
|
sharedSecret,
|
|
transcript,
|
|
);
|
|
const aliceSession = await aliceManager.createSession({
|
|
sessionId,
|
|
localId: aliceId,
|
|
remoteId: bobId,
|
|
remotePublicKey: new Uint8Array(32),
|
|
sharedSecret,
|
|
role: "initiator",
|
|
transcript,
|
|
});
|
|
const bobSession = await bobManager.createSession({
|
|
sessionId,
|
|
localId: bobId,
|
|
remoteId: aliceId,
|
|
remotePublicKey: new Uint8Array(32),
|
|
sharedSecret,
|
|
role: "receiver",
|
|
transcript,
|
|
});
|
|
return { aliceSession, bobSession, initiatorSend, initiatorRecv };
|
|
},
|
|
};
|
|
}
|
|
|
|
await describe("E2EE Session Derivation", async () => {
|
|
await it("Both sides derive same shared secret", async () => {
|
|
const sharedSecret = sdk.crypto.sha256(new Uint8Array([1, 2, 3, 4, 5]));
|
|
const transcript = new Uint8Array(0);
|
|
|
|
const aliceKeys = await deriveSessionKeys(sharedSecret, transcript);
|
|
const bobKeys = await deriveSessionKeys(sharedSecret, transcript);
|
|
|
|
// Deterministic: same inputs → same outputs
|
|
assert.deepEqual(aliceKeys.initiatorSend, bobKeys.initiatorSend);
|
|
assert.deepEqual(aliceKeys.initiatorRecv, bobKeys.initiatorRecv);
|
|
|
|
// Init and recv keys are different
|
|
assert.notDeepEqual(aliceKeys.initiatorSend, aliceKeys.initiatorRecv);
|
|
});
|
|
|
|
await it("Session manager assigns correct chain keys per role", async () => {
|
|
const ss = sdk.crypto.sha256(new Uint8Array([1]));
|
|
const { initSessions } = setupSessions(ss);
|
|
const { aliceSession, bobSession, initiatorSend, initiatorRecv } =
|
|
await initSessions();
|
|
|
|
// Alice (initiator): send = initiatorSend, recv = initiatorRecv
|
|
assert.deepEqual(aliceSession.sendChainKey, initiatorSend);
|
|
assert.deepEqual(aliceSession.recvChainKey, initiatorRecv);
|
|
|
|
// Bob (receiver): send = initiatorRecv, recv = initiatorSend
|
|
assert.deepEqual(bobSession.sendChainKey, initiatorRecv);
|
|
assert.deepEqual(bobSession.recvChainKey, initiatorSend);
|
|
|
|
// Alice's send chain = Bob's recv chain
|
|
assert.deepEqual(aliceSession.sendChainKey, bobSession.recvChainKey);
|
|
// Alice's recv chain = Bob's send chain
|
|
assert.deepEqual(aliceSession.recvChainKey, bobSession.sendChainKey);
|
|
});
|
|
|
|
await it("Different transcripts produce different keys", async () => {
|
|
const ss = sdk.crypto.sha256(new Uint8Array([99]));
|
|
const aliceKeys1 = await deriveSessionKeys(ss, new Uint8Array(0));
|
|
const aliceKeys2 = await deriveSessionKeys(
|
|
ss,
|
|
sdk.crypto.sha256(new Uint8Array([42])),
|
|
);
|
|
assert.notDeepEqual(aliceKeys1.initiatorSend, aliceKeys2.initiatorSend);
|
|
});
|
|
});
|
|
|
|
await describe("MTP Session Transcript", async () => {
|
|
const base = {
|
|
sessionId: "session-a",
|
|
initiatorId: 1n,
|
|
recipientId: 2n,
|
|
recipientPublicKey: new Uint8Array([1, 2, 3]),
|
|
kemCiphertext: new Uint8Array([4, 5, 6]),
|
|
};
|
|
|
|
await it("binds generic session identity and MTP key-establishment values", () => {
|
|
const transcript = buildSessionTranscript(base);
|
|
assert.notDeepEqual(
|
|
transcript,
|
|
buildSessionTranscript({ ...base, sessionId: "session-b" }),
|
|
);
|
|
assert.notDeepEqual(
|
|
transcript,
|
|
buildSessionTranscript({ ...base, initiatorId: 3n }),
|
|
);
|
|
assert.notDeepEqual(
|
|
transcript,
|
|
buildSessionTranscript({
|
|
...base,
|
|
recipientPublicKey: new Uint8Array([1, 2, 4]),
|
|
}),
|
|
);
|
|
});
|
|
|
|
await it("hashes opaque application context into the transcript", () => {
|
|
const withoutContext = buildSessionTranscript(base);
|
|
const withContext = buildSessionTranscript({
|
|
...base,
|
|
applicationContext: new Uint8Array([0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74]),
|
|
});
|
|
assert.notDeepEqual(withoutContext, withContext);
|
|
});
|
|
});
|
|
|
|
await describe("E2EE Ratchet", async () => {
|
|
await it("Repeated sends produce different message keys", async () => {
|
|
const chainKey = sdk.crypto.sha256(new Uint8Array([42]));
|
|
const step1 = await MTPRatchet.step(chainKey);
|
|
const step2 = await MTPRatchet.step(step1.chainKey);
|
|
const step3 = await MTPRatchet.step(step2.chainKey);
|
|
|
|
assert.notDeepEqual(step1.key, step2.key);
|
|
assert.notDeepEqual(step2.key, step3.key);
|
|
assert.notDeepEqual(step1.key, step3.key);
|
|
assert.notDeepEqual(chainKey, step1.chainKey);
|
|
});
|
|
|
|
await it("Receiver can decrypt messages sent by sender in order", async () => {
|
|
const chainKey = sdk.crypto.sha256(new Uint8Array([7]));
|
|
|
|
const send1 = await MTPRatchet.step(chainKey);
|
|
const send2 = await MTPRatchet.step(send1.chainKey);
|
|
const send3 = await MTPRatchet.step(send2.chainKey);
|
|
|
|
const recv1 = await MTPRatchet.step(chainKey);
|
|
const recv2 = await MTPRatchet.step(recv1.chainKey);
|
|
const recv3 = await MTPRatchet.step(recv2.chainKey);
|
|
|
|
assert.deepEqual(send1.key, recv1.key);
|
|
assert.deepEqual(send2.key, recv2.key);
|
|
assert.deepEqual(send3.key, recv3.key);
|
|
});
|
|
});
|
|
|
|
await describe("E2EE Serialization", async () => {
|
|
await it("Roundtrips a basic message", () => {
|
|
const msg = {
|
|
header: {
|
|
version: 1,
|
|
flags: 0,
|
|
senderId: 0x1234567890abcdefn,
|
|
recipientId: 0xfedcba0987654321n,
|
|
messageNumber: 42,
|
|
},
|
|
aeadPayload: new Uint8Array([1, 2, 3, 4, 5]),
|
|
};
|
|
const bytes = serializeEncryptedMessage(msg);
|
|
const parsed = parseEncryptedMessage(bytes);
|
|
assert.equal(parsed.header.version, 1);
|
|
assert.equal(parsed.header.flags, 0);
|
|
assert.equal(parsed.header.senderId, msg.header.senderId);
|
|
assert.equal(parsed.header.recipientId, msg.header.recipientId);
|
|
assert.equal(parsed.header.messageNumber, 42);
|
|
assert.equal(parsed.header.kemCiphertext, undefined);
|
|
assert.deepEqual(parsed.aeadPayload, msg.aeadPayload);
|
|
});
|
|
|
|
await it("Roundtrips an init message with KEM ciphertext", () => {
|
|
const msg = {
|
|
header: {
|
|
version: 1,
|
|
flags: FLAG_INIT,
|
|
senderId: 1n,
|
|
recipientId: 2n,
|
|
messageNumber: 0,
|
|
kemCiphertext: new Uint8Array([0xde, 0xad, 0xbe, 0xef]),
|
|
},
|
|
aeadPayload: new Uint8Array([10, 20, 30]),
|
|
};
|
|
const bytes = serializeEncryptedMessage(msg);
|
|
const parsed = parseEncryptedMessage(bytes);
|
|
assert.equal(parsed.header.flags & FLAG_INIT, FLAG_INIT);
|
|
assert.deepEqual(parsed.header.kemCiphertext, msg.header.kemCiphertext);
|
|
});
|
|
|
|
await it("Roundtrip: serialize(parse(x)) === x", () => {
|
|
const msg = {
|
|
header: {
|
|
version: 1,
|
|
flags: 0,
|
|
senderId: 0xaaaabbbbccccddddn,
|
|
recipientId: 0xffff000011112222n,
|
|
messageNumber: 65535,
|
|
},
|
|
aeadPayload: new Uint8Array(100).fill(0x42),
|
|
};
|
|
const bytes = serializeEncryptedMessage(msg);
|
|
const parsed = parseEncryptedMessage(bytes);
|
|
const bytes2 = serializeEncryptedMessage(parsed);
|
|
assert.deepEqual(bytes, bytes2);
|
|
});
|
|
|
|
await it("Rejects malformed payloads", () => {
|
|
assert.throws(() => parseEncryptedMessage(new Uint8Array(0)));
|
|
assert.throws(() => parseEncryptedMessage(new Uint8Array([0x01])));
|
|
assert.throws(() =>
|
|
parseEncryptedMessage(
|
|
new Uint8Array([0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
|
|
),
|
|
);
|
|
});
|
|
|
|
await it("Rejects unsupported version", () => {
|
|
const msg = {
|
|
header: {
|
|
version: 1,
|
|
flags: 0,
|
|
senderId: 0n,
|
|
recipientId: 0n,
|
|
messageNumber: 0,
|
|
},
|
|
aeadPayload: new Uint8Array([1]),
|
|
};
|
|
const bytes = serializeEncryptedMessage(msg);
|
|
bytes[0] = 99;
|
|
assert.throws(() => parseEncryptedMessage(bytes));
|
|
});
|
|
|
|
await it("Rejects trailing data", () => {
|
|
const msg = {
|
|
header: {
|
|
version: 1,
|
|
flags: 0,
|
|
senderId: 0n,
|
|
recipientId: 0n,
|
|
messageNumber: 0,
|
|
},
|
|
aeadPayload: new Uint8Array([1]),
|
|
};
|
|
const bytes = concat(
|
|
serializeEncryptedMessage(msg),
|
|
new Uint8Array([0xff]),
|
|
);
|
|
assert.throws(() => parseEncryptedMessage(bytes));
|
|
});
|
|
});
|
|
|
|
await describe("E2EE Encrypt/Decrypt", async () => {
|
|
await it("Alice encrypts and Bob decrypts successfully", async () => {
|
|
const keyring = sdk.crypto.generateKeyring();
|
|
const bobKeys = sdk.crypto.keyringToKeys(keyring);
|
|
|
|
// Alice encapsulates to Bob's KEM public key
|
|
const enc = sdk.crypto.encapsulate(bobKeys.kemPublicKey);
|
|
// Bob decapsulates the ciphertext
|
|
const bobSS = sdk.crypto.decapsulate(bobKeys.kemSecretKey, enc.ciphertext);
|
|
assert.deepEqual(bobSS, enc.shared_secret);
|
|
|
|
const ss = enc.shared_secret;
|
|
const { initSessions } = setupSessions(ss);
|
|
const { aliceSession, bobSession } = await initSessions();
|
|
|
|
// Alice encrypts a message to Bob
|
|
const plaintext = sdk.codec.encode(
|
|
"Ping",
|
|
{ Version: "hello from Alice" },
|
|
{ sender: 1n, receiver: 2n },
|
|
);
|
|
|
|
const { payload, session: aliceNewSession } = await encryptPayload({
|
|
plaintext,
|
|
session: aliceSession,
|
|
kemCiphertext: enc.ciphertext,
|
|
});
|
|
|
|
// Bob decrypts the message
|
|
const { plaintext: decrypted, session: bobNewSession } =
|
|
await decryptPayload({
|
|
payload,
|
|
session: bobSession,
|
|
});
|
|
|
|
const frame = sdk.codec.decode(decrypted);
|
|
assert.equal(frame.type, "Ping");
|
|
assert.equal(frame.data["Version"], "hello from Alice");
|
|
|
|
// Chain keys advanced correctly
|
|
assert.deepEqual(aliceNewSession.sendChainKey, bobNewSession.recvChainKey);
|
|
assert.equal(aliceNewSession.sendCount, 1);
|
|
assert.equal(bobNewSession.recvCount, 1);
|
|
assert.notDeepEqual(
|
|
aliceNewSession.sendChainKey,
|
|
aliceSession.sendChainKey,
|
|
);
|
|
});
|
|
|
|
await it("Encrypt-decrypt multiple messages with chain advance", async () => {
|
|
const ss = sdk.crypto.sha256(new Uint8Array([1, 2, 3]));
|
|
const { initSessions } = setupSessions(ss);
|
|
let { aliceSession, bobSession } = await initSessions();
|
|
|
|
// Message 1
|
|
const { payload: p1, session: aliceAfter1 } = await encryptPayload({
|
|
plaintext: sdk.codec.encode("Ping", { Version: "msg1" }),
|
|
session: aliceSession,
|
|
});
|
|
const { plaintext: d1, session: bobAfter1 } = await decryptPayload({
|
|
payload: p1,
|
|
session: bobSession,
|
|
});
|
|
assert.equal(sdk.codec.decode(d1).data["Version"], "msg1");
|
|
assert.equal(bobAfter1.recvCount, 1);
|
|
|
|
// Message 2
|
|
const { payload: p2, session: aliceAfter2 } = await encryptPayload({
|
|
plaintext: sdk.codec.encode("Ping", { Version: "msg2" }),
|
|
session: aliceAfter1,
|
|
});
|
|
const { plaintext: d2, session: bobAfter2 } = await decryptPayload({
|
|
payload: p2,
|
|
session: bobAfter1,
|
|
});
|
|
assert.equal(sdk.codec.decode(d2).data["Version"], "msg2");
|
|
assert.equal(bobAfter2.recvCount, 2);
|
|
|
|
// Chain keys match after two messages
|
|
assert.deepEqual(aliceAfter2.sendChainKey, bobAfter2.recvChainKey);
|
|
assert.equal(aliceAfter2.sendCount, 2);
|
|
});
|
|
|
|
await it("decrypts messages delivered out of order exactly once", async () => {
|
|
const ss = sdk.crypto.sha256(new Uint8Array([4, 5, 6]));
|
|
const { initSessions } = setupSessions(ss);
|
|
let { aliceSession, bobSession } = await initSessions();
|
|
|
|
const sent = [];
|
|
for (const label of ["first", "second", "third"]) {
|
|
const encrypted = await encryptPayload({
|
|
plaintext: sdk.codec.encode("Ping", { Version: label }),
|
|
session: aliceSession,
|
|
});
|
|
sent.push(encrypted.payload);
|
|
aliceSession = encrypted.session;
|
|
}
|
|
|
|
const third = await decryptPayload({ payload: sent[2], session: bobSession });
|
|
bobSession = third.session;
|
|
assert.equal(sdk.codec.decode(third.plaintext).data["Version"], "third");
|
|
assert.equal(bobSession.recvCount, 3);
|
|
assert.deepEqual(
|
|
bobSession.skippedMessageKeys.map(({ messageNumber }) => messageNumber),
|
|
[0, 1],
|
|
);
|
|
|
|
const first = await decryptPayload({ payload: sent[0], session: bobSession });
|
|
bobSession = first.session;
|
|
assert.equal(sdk.codec.decode(first.plaintext).data["Version"], "first");
|
|
assert.deepEqual(
|
|
bobSession.skippedMessageKeys.map(({ messageNumber }) => messageNumber),
|
|
[1],
|
|
);
|
|
|
|
const second = await decryptPayload({ payload: sent[1], session: bobSession });
|
|
bobSession = second.session;
|
|
assert.equal(sdk.codec.decode(second.plaintext).data["Version"], "second");
|
|
assert.equal(bobSession.skippedMessageKeys.length, 0);
|
|
await assert.rejects(
|
|
decryptPayload({ payload: sent[0], session: bobSession }),
|
|
/replay/,
|
|
);
|
|
});
|
|
});
|
|
|
|
await describe("E2EE Public Key Bundle", async () => {
|
|
await it("parses public key bundles from GetUserData.PublicKey", () => {
|
|
const keyring = sdk.crypto.generateKeyring();
|
|
const keys = sdk.crypto.keyringToKeys(keyring);
|
|
const bundle = concat(
|
|
new Uint8Array([keys.kemPublicKey.length >> 8, keys.kemPublicKey.length & 0xff]),
|
|
keys.kemPublicKey,
|
|
new Uint8Array([keys.sigPqPublicKey.length >> 8, keys.sigPqPublicKey.length & 0xff]),
|
|
keys.sigPqPublicKey,
|
|
new Uint8Array([keys.sigClPublicKey.length >> 8, keys.sigClPublicKey.length & 0xff]),
|
|
keys.sigClPublicKey,
|
|
);
|
|
|
|
const parsed = sdk.crypto.publicKeyBundleToKeys(bundle);
|
|
assert.deepEqual(parsed.kemPublicKey, keys.kemPublicKey);
|
|
assert.deepEqual(parsed.sigPqPublicKey, keys.sigPqPublicKey);
|
|
assert.deepEqual(parsed.sigClPublicKey, keys.sigClPublicKey);
|
|
});
|
|
});
|
|
|
|
await describe("Protected-value policy", async () => {
|
|
await it("enforces the receiver-selected signature suite", () => {
|
|
const keyring = sdk.crypto.generateKeyring();
|
|
const bundle = publicBundle(keyring);
|
|
const value = bindings.encode_data_value("policy-check");
|
|
const edSigned = bindings.sign_data_value_with_keyring(
|
|
value,
|
|
7n,
|
|
0x40,
|
|
keyring,
|
|
bindings.mtp_protection_signature_suite_ed25519(),
|
|
);
|
|
assert.doesNotThrow(() =>
|
|
bindings.verify_data_value_with_policy(
|
|
edSigned,
|
|
bundle,
|
|
7n,
|
|
0x40,
|
|
bindings.mtp_protection_signature_suite_ed25519(),
|
|
),
|
|
);
|
|
assert.throws(() =>
|
|
bindings.verify_data_value_with_policy(
|
|
edSigned,
|
|
bundle,
|
|
7n,
|
|
0x40,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
),
|
|
);
|
|
|
|
const dualSigned = bindings.sign_data_value_with_keyring(
|
|
value,
|
|
7n,
|
|
0x40,
|
|
keyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
);
|
|
assert.doesNotThrow(() =>
|
|
bindings.verify_data_value_with_policy(
|
|
dualSigned,
|
|
bundle,
|
|
7n,
|
|
0x40,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
),
|
|
);
|
|
});
|
|
});
|
|
|
|
await describe("Relay recipient separation", async () => {
|
|
await it("lets a metadata recipient open metadata but not content", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const metadataKeyring = sdk.crypto.generateKeyring();
|
|
const finalKeyring = sdk.crypto.generateKeyring();
|
|
const metadataRecipients = [
|
|
publicBundle(metadataKeyring),
|
|
publicBundle(finalKeyring),
|
|
];
|
|
const contentRecipients = [publicBundle(finalKeyring)];
|
|
|
|
const frameBytes = bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "hello" },
|
|
11n,
|
|
42n,
|
|
7n,
|
|
"message-1",
|
|
123n,
|
|
bindings.encode_data_value({ ExampleType: "metadata" }),
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
metadataRecipients,
|
|
contentRecipients,
|
|
);
|
|
const frame = bindings.parse_frame(frameBytes);
|
|
assert.equal(frame.type, "Relay");
|
|
assert.equal(frame.sender, undefined);
|
|
assert.equal(frame.receiver, 7n);
|
|
|
|
const metadataBytes = frame.data.encoded;
|
|
const openedMetadata = bindings.decrypt_data_value(
|
|
metadataBytes,
|
|
metadataKeyring,
|
|
bindings.mtp_relay_metadata_encryption_purpose(),
|
|
);
|
|
const metadata = bindings.parse_data_value(openedMetadata);
|
|
assert.equal(metadata.kind, "signed");
|
|
assert.equal(BigInt(metadata.value.RelayVersion), 1n);
|
|
assert.equal(BigInt(metadata.value.FinalRecipientId), 42n);
|
|
assert.equal(metadata.value.Metadata.ExampleType, "metadata");
|
|
|
|
const metadataClient = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
credentials: { clientId: 7n, keyring: metadataKeyring },
|
|
pings: false,
|
|
});
|
|
const verifiedMetadata = await metadataClient.openRelayMetadata(frame, {
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
});
|
|
assert.equal(verifiedMetadata.relayVersion, 1);
|
|
assert.equal(verifiedMetadata.finalRecipientId, 42n);
|
|
assert.deepEqual(verifiedMetadata.metadata, {
|
|
ExampleType: "metadata",
|
|
});
|
|
await assert.rejects(
|
|
() => metadataClient.openRelayContent(verifiedMetadata),
|
|
/different final recipient/,
|
|
);
|
|
|
|
const encryptedContent = metadata.value.Content.encoded;
|
|
assert.throws(() =>
|
|
bindings.decrypt_data_value(
|
|
encryptedContent,
|
|
metadataKeyring,
|
|
bindings.mtp_relay_content_encryption_purpose(),
|
|
),
|
|
);
|
|
|
|
const forwardedBytes = bindings.forward_encrypted_relay_frame(frameBytes, 42n);
|
|
const forwarded = bindings.parse_frame(forwardedBytes);
|
|
assert.deepEqual(forwarded.data.encoded, frame.data.encoded);
|
|
const finalMetadata = bindings.parse_data_value(
|
|
bindings.decrypt_data_value(
|
|
forwarded.data.encoded,
|
|
finalKeyring,
|
|
bindings.mtp_relay_metadata_encryption_purpose(),
|
|
),
|
|
);
|
|
assert.equal(BigInt(finalMetadata.value.RelayVersion), 1n);
|
|
const content = bindings.parse_data_value(
|
|
bindings.decrypt_data_value(
|
|
finalMetadata.value.Content.encoded,
|
|
finalKeyring,
|
|
bindings.mtp_relay_content_encryption_purpose(),
|
|
),
|
|
);
|
|
assert.equal(content.kind, "signed");
|
|
assert.equal(content.value.MessageType, "ProtectedMessage");
|
|
assert.equal(content.value.Content.ExampleType, "hello");
|
|
});
|
|
|
|
await it("opens forwarded relay data with explicit identities", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const metadataKeyring = sdk.crypto.generateKeyring();
|
|
const finalKeyring = sdk.crypto.generateKeyring();
|
|
const frameBytes = bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "explicit-identity" },
|
|
11n,
|
|
42n,
|
|
7n,
|
|
"message-explicit-identity",
|
|
456n,
|
|
bindings.encode_data_value({ ExampleType: "forwarded" }),
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(metadataKeyring), publicBundle(finalKeyring)],
|
|
[publicBundle(finalKeyring)],
|
|
);
|
|
const forwarded = bindings.parse_frame(
|
|
bindings.forward_encrypted_relay_frame(frameBytes, 99n),
|
|
);
|
|
const verification = {
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
};
|
|
|
|
const metadataClient = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const metadata = await metadataClient.openRelayMetadata(forwarded, {
|
|
...verification,
|
|
recipient: { keyring: metadataKeyring },
|
|
});
|
|
assert.equal(metadata.finalRecipientId, 42n);
|
|
assert.deepEqual(metadata.metadata, { ExampleType: "forwarded" });
|
|
|
|
const wrongKeyring = sdk.crypto.generateKeyring();
|
|
await assert.rejects(
|
|
() =>
|
|
metadataClient.openRelayMetadata(forwarded, {
|
|
...verification,
|
|
recipient: { keyring: wrongKeyring },
|
|
}),
|
|
);
|
|
|
|
const registeredClient = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
credentials: { clientId: 7n, keyring: metadataKeyring },
|
|
pings: false,
|
|
});
|
|
const finalIdentity = { id: 42n, keyring: finalKeyring };
|
|
const finalMetadata = await registeredClient.openRelayMetadata(
|
|
forwarded,
|
|
{
|
|
...verification,
|
|
recipient: finalIdentity,
|
|
},
|
|
);
|
|
const content = await registeredClient.openRelayContent(finalMetadata, {
|
|
...verification,
|
|
recipient: finalIdentity,
|
|
});
|
|
assert.equal(content.signerId, 11n);
|
|
assert.equal(content.finalRecipientId, 42n);
|
|
assert.equal(content.data.ExampleType, "explicit-identity");
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
registeredClient.openRelayContent(finalMetadata, {
|
|
...verification,
|
|
recipient: finalIdentity,
|
|
expectedFinalRecipientId: 99n,
|
|
}),
|
|
/different final recipient/,
|
|
);
|
|
});
|
|
});
|
|
|
|
await describe("Relay recipient key history", async () => {
|
|
function verificationOptions(recipient) {
|
|
return {
|
|
recipient,
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
};
|
|
}
|
|
|
|
let senderKeyring;
|
|
|
|
await it("uses the current keyring and accepts an empty history", async () => {
|
|
senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = bindings.parse_frame(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "current-key" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-current-key",
|
|
1n,
|
|
null,
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const options = verificationOptions({
|
|
id: 42n,
|
|
keyring: recipientKeyring,
|
|
keyringHistory: [],
|
|
});
|
|
|
|
const metadata = await client.openRelayMetadata(frame, options);
|
|
const content = await client.openRelayContent(metadata, options);
|
|
assert.equal(content.data.ExampleType, "current-key");
|
|
});
|
|
|
|
await it(
|
|
"tries rotated metadata and content recipients newest to oldest without duplicates",
|
|
async () => {
|
|
senderKeyring = sdk.crypto.generateKeyring();
|
|
const currentKeyring = sdk.crypto.generateKeyring();
|
|
const newerPreviousKeyring = sdk.crypto.generateKeyring();
|
|
const previousKeyring = sdk.crypto.generateKeyring();
|
|
const history = [
|
|
newerPreviousKeyring,
|
|
previousKeyring,
|
|
previousKeyring,
|
|
];
|
|
const historySnapshot = history.map((keyring) => keyring.slice());
|
|
const frame = bindings.parse_frame(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "rotated-key" },
|
|
11n,
|
|
42n,
|
|
7n,
|
|
"message-rotated-key",
|
|
2n,
|
|
bindings.encode_data_value({ ExampleType: "rotated-metadata" }),
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(previousKeyring)],
|
|
[publicBundle(previousKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const options = verificationOptions({
|
|
id: 42n,
|
|
keyring: currentKeyring,
|
|
keyringHistory: history,
|
|
});
|
|
|
|
const metadata = await client.openRelayMetadata(frame, options);
|
|
const content = await client.openRelayContent(metadata, options);
|
|
assert.equal(content.data.ExampleType, "rotated-key");
|
|
assert.equal(metadata.matchedSignerKeyIndex, 0);
|
|
assert.equal(metadata.signerPublicKeys.length, 1);
|
|
assert.deepEqual(
|
|
metadata.matchedSignerPublicKey,
|
|
publicBundle(senderKeyring),
|
|
);
|
|
assert.deepEqual(history, historySnapshot);
|
|
},
|
|
);
|
|
|
|
await it("does not expose individual key failures when all keyrings fail", async () => {
|
|
senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const wrongCurrentKeyring = sdk.crypto.generateKeyring();
|
|
const wrongPreviousKeyring = sdk.crypto.generateKeyring();
|
|
const frame = bindings.parse_frame(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "wrong-key" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-wrong-key",
|
|
3n,
|
|
null,
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.openRelayMetadata(frame, {
|
|
...verificationOptions({
|
|
keyring: wrongCurrentKeyring,
|
|
keyringHistory: [wrongPreviousKeyring],
|
|
}),
|
|
}),
|
|
(error) =>
|
|
error.message ===
|
|
"Unable to decrypt protected value with supplied recipient keyrings",
|
|
);
|
|
});
|
|
});
|
|
|
|
await describe("Protected send APIs", async () => {
|
|
function captureSend(client) {
|
|
const frames = [];
|
|
client.raw.client.send = async (frame) => {
|
|
frames.push(frame.slice());
|
|
};
|
|
return frames;
|
|
}
|
|
|
|
await it("round trips with interoperable Ed25519 defaults", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const frames = captureSend(client);
|
|
const signerPublicKey = publicBundle(signerKeyring);
|
|
const recipientPublicKey = publicBundle(recipientKeyring);
|
|
|
|
await client.sendProtected(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "default-direct" },
|
|
{
|
|
receiverId: 22n,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
recipients: [recipientPublicKey],
|
|
signaturePurpose: 0x40,
|
|
encryptionPurpose: 0x41,
|
|
},
|
|
);
|
|
const directFrame = sdk.codec.decode(frames.shift());
|
|
const direct = await client.openProtected(directFrame, {
|
|
recipient: { id: 22n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
expectedReceiverId: 22n,
|
|
resolveSignerPublicKeys: () => [signerPublicKey],
|
|
signaturePurpose: 0x40,
|
|
encryptionPurpose: 0x41,
|
|
});
|
|
assert.equal(direct.data.ExampleType, "default-direct");
|
|
|
|
await client.sendSealedRelay(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "default-relay" },
|
|
{
|
|
finalRecipientId: 22n,
|
|
nextHopId: 7n,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
metadataRecipients: [recipientPublicKey],
|
|
contentRecipients: [recipientPublicKey],
|
|
metadata: { ExampleType: "default-metadata" },
|
|
},
|
|
);
|
|
const relayFrame = sdk.codec.decode(frames.shift());
|
|
const relayOptions = {
|
|
recipient: { id: 22n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [signerPublicKey],
|
|
};
|
|
const metadata = await client.openRelayMetadata(relayFrame, relayOptions);
|
|
const content = await client.openRelayContent(metadata, relayOptions);
|
|
assert.equal(metadata.metadata.ExampleType, "default-metadata");
|
|
assert.equal(content.data.ExampleType, "default-relay");
|
|
metadata.dispose();
|
|
});
|
|
|
|
await it("builds direct protected frames without a Relay hop", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const frames = captureSend(client);
|
|
|
|
await client.sendProtected(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "direct" },
|
|
{
|
|
receiverId: 22n,
|
|
id: 123,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
recipients: [publicBundle(recipientKeyring)],
|
|
signaturePurpose: 0x40,
|
|
encryptionPurpose: 0x41,
|
|
signatureSuite: "dual",
|
|
exposeSender: true,
|
|
},
|
|
);
|
|
|
|
assert.equal(frames.length, 1);
|
|
const frame = bindings.parse_frame(frames[0]);
|
|
assert.equal(frame.type, "ProtectedMessage");
|
|
assert.equal(frame.id, 123);
|
|
assert.equal(frame.sender, 11n);
|
|
assert.equal(frame.receiver, 22n);
|
|
assert.equal(frame.data.kind, "encrypted");
|
|
|
|
const signedBytes = bindings.decrypt_data_value(
|
|
frame.data.encoded,
|
|
recipientKeyring,
|
|
0x41,
|
|
);
|
|
const signed = bindings.parse_data_value(signedBytes);
|
|
assert.equal(signed.kind, "signed");
|
|
assert.equal(signed.signerId, 11n);
|
|
assert.equal(signed.value.Content.ExampleType, "direct");
|
|
assert.equal(signed.value.MessageType, "ProtectedMessage");
|
|
assert.equal(BigInt(signed.value.FinalRecipientId), 22n);
|
|
assert.equal(typeof signed.value.MessageId, "string");
|
|
assert.equal(BigInt(signed.value.CreatedAt) > 0n, true);
|
|
bindings.verify_data_value_with_policy(
|
|
signedBytes,
|
|
publicBundle(signerKeyring),
|
|
11n,
|
|
0x40,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
);
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.sendProtected("Ping", { ExampleType: "reserved" }, {
|
|
receiverId: 22n,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
recipients: [publicBundle(recipientKeyring)],
|
|
signaturePurpose: 0x40,
|
|
encryptionPurpose: 0x41,
|
|
}),
|
|
/control communication type/,
|
|
);
|
|
});
|
|
|
|
await it("builds sealed relay frames from exact generic recipient sets", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const metadataKeyring = sdk.crypto.generateKeyring();
|
|
const contentKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const frames = captureSend(client);
|
|
|
|
await client.sendSealedRelay(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "content" },
|
|
{
|
|
finalRecipientId: 42n,
|
|
nextHopId: 7n,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
metadataRecipients: [publicBundle(metadataKeyring)],
|
|
contentRecipients: [publicBundle(contentKeyring)],
|
|
metadata: { ExampleType: "metadata" },
|
|
signatureSuite: "dual",
|
|
},
|
|
);
|
|
|
|
assert.equal(frames.length, 1);
|
|
const frame = bindings.parse_frame(frames[0]);
|
|
assert.equal(frame.type, "Relay");
|
|
assert.equal(frame.sender, undefined);
|
|
assert.equal(frame.receiver, 7n);
|
|
|
|
const metadataBytes = bindings.decrypt_data_value(
|
|
frame.data.encoded,
|
|
metadataKeyring,
|
|
bindings.mtp_relay_metadata_encryption_purpose(),
|
|
);
|
|
const metadata = bindings.parse_data_value(metadataBytes);
|
|
assert.equal(metadata.kind, "signed");
|
|
assert.equal(metadata.signerId, 11n);
|
|
assert.equal(BigInt(metadata.value.FinalRecipientId), 42n);
|
|
assert.equal(metadata.value.Metadata.ExampleType, "metadata");
|
|
assert.equal(metadata.value.Content.kind, "encrypted");
|
|
|
|
assert.throws(() =>
|
|
bindings.decrypt_data_value(
|
|
metadata.value.Content.encoded,
|
|
metadataKeyring,
|
|
bindings.mtp_relay_content_encryption_purpose(),
|
|
),
|
|
);
|
|
const contentBytes = bindings.decrypt_data_value(
|
|
metadata.value.Content.encoded,
|
|
contentKeyring,
|
|
bindings.mtp_relay_content_encryption_purpose(),
|
|
);
|
|
const content = bindings.parse_data_value(contentBytes);
|
|
assert.equal(content.kind, "signed");
|
|
assert.equal(content.value.Content.ExampleType, "content");
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.sendSealedRelay("Relay", { ExampleType: "reserved" }, {
|
|
finalRecipientId: 42n,
|
|
nextHopId: 7n,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
metadataRecipients: [publicBundle(metadataKeyring)],
|
|
contentRecipients: [publicBundle(contentKeyring)],
|
|
}),
|
|
/control communication type/,
|
|
);
|
|
});
|
|
|
|
await it("round trips generic relay content and metadata presence", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const frames = captureSend(client);
|
|
const openOptions = {
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(signerKeyring)],
|
|
signaturePolicy: "dual",
|
|
};
|
|
|
|
const sendAndOpen = async (data, metadata, includeMetadata) => {
|
|
const options = {
|
|
finalRecipientId: 42n,
|
|
nextHopId: 42n,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
metadataRecipients: [publicBundle(recipientKeyring)],
|
|
contentRecipients: [publicBundle(recipientKeyring)],
|
|
signatureSuite: "dual",
|
|
...(includeMetadata ? { metadata } : {}),
|
|
};
|
|
await client.sendSealedRelay("ProtectedMessage", data, options);
|
|
const frame = sdk.codec.decode(frames.pop());
|
|
const verifiedMetadata = await client.openRelayMetadata(
|
|
frame,
|
|
openOptions,
|
|
);
|
|
const content = await client.openRelayContent(
|
|
verifiedMetadata,
|
|
openOptions,
|
|
);
|
|
return { verifiedMetadata, content };
|
|
};
|
|
|
|
const explicitNull = await sendAndOpen(
|
|
new Uint8Array([1, 2, 3]),
|
|
null,
|
|
true,
|
|
);
|
|
assert.equal(explicitNull.verifiedMetadata.metadata, null);
|
|
assert.deepEqual(explicitNull.content.data, new Uint8Array([1, 2, 3]));
|
|
|
|
const absent = await sendAndOpen(
|
|
["array", 7, false],
|
|
undefined,
|
|
false,
|
|
);
|
|
assert.equal(absent.verifiedMetadata.metadata, undefined);
|
|
assert.deepEqual(absent.content.data, ["array", 7, false]);
|
|
|
|
const scalar = await sendAndOpen("scalar content", "scalar metadata", true);
|
|
assert.equal(scalar.verifiedMetadata.metadata, "scalar metadata");
|
|
assert.equal(scalar.content.data, "scalar content");
|
|
});
|
|
|
|
await it("opens an unauthenticated connection without discarding credentials", async () => {
|
|
const keyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
hostPublicKey: new Uint8Array([1]),
|
|
credentials: { clientId: 99n, keyring },
|
|
pings: false,
|
|
});
|
|
let connectCalls = 0;
|
|
let authCalls = 0;
|
|
client.raw.client.connect = async () => {
|
|
connectCalls += 1;
|
|
};
|
|
client.raw.client.auth_connect = async () => {
|
|
authCalls += 1;
|
|
return 99n;
|
|
};
|
|
|
|
await client.connectUnauthenticated();
|
|
|
|
assert.equal(connectCalls, 1);
|
|
assert.equal(authCalls, 0);
|
|
assert.equal(client.credentials.clientId, 99n);
|
|
});
|
|
|
|
await it("opens an authenticated connection when transport credentials are available", async () => {
|
|
const transportKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
hostPublicKey: new Uint8Array([1]),
|
|
credentials: { clientId: 99n, keyring: transportKeyring },
|
|
pings: false,
|
|
});
|
|
let connectCalls = 0;
|
|
let authCalls = 0;
|
|
client.raw.client.connect = async () => {
|
|
connectCalls += 1;
|
|
};
|
|
client.raw.client.auth_connect = async (
|
|
_config,
|
|
hostPublicKey,
|
|
keyring,
|
|
clientId,
|
|
) => {
|
|
authCalls += 1;
|
|
assert.deepEqual(hostPublicKey, new Uint8Array([1]));
|
|
assert.deepEqual(keyring, transportKeyring);
|
|
assert.equal(clientId, 99n);
|
|
return 99n;
|
|
};
|
|
|
|
await client.connect();
|
|
|
|
assert.equal(connectCalls, 0);
|
|
assert.equal(authCalls, 1);
|
|
assert.equal(client.credentials.clientId, 99n);
|
|
});
|
|
|
|
await it("keeps a protected signer independent from transport authentication", async () => {
|
|
const transportKeyring = sdk.crypto.generateKeyring();
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
hostPublicKey: new Uint8Array([1]),
|
|
credentials: { clientId: 99n, keyring: transportKeyring },
|
|
pings: false,
|
|
});
|
|
client.raw.client.auth_connect = async () => 99n;
|
|
await client.connect();
|
|
const frames = captureSend(client);
|
|
|
|
await client.sendProtected(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "transport-independent" },
|
|
{
|
|
receiverId: 22n,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
recipients: [publicBundle(recipientKeyring)],
|
|
signaturePurpose: 0x40,
|
|
encryptionPurpose: 0x41,
|
|
signatureSuite: "dual",
|
|
},
|
|
);
|
|
|
|
const frame = bindings.parse_frame(frames[0]);
|
|
assert.equal(client.credentials.clientId, 99n);
|
|
assert.equal(frame.sender, undefined);
|
|
const signedBytes = bindings.decrypt_data_value(
|
|
frame.data.encoded,
|
|
recipientKeyring,
|
|
0x41,
|
|
);
|
|
const signed = bindings.parse_data_value(signedBytes);
|
|
assert.equal(signed.kind, "signed");
|
|
assert.equal(signed.signerId, 11n);
|
|
assert.equal(signed.value.Content.ExampleType, "transport-independent");
|
|
});
|
|
});
|
|
|
|
await describe("Protected receive APIs", async () => {
|
|
async function buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
data = { ExampleType: "direct-receive" },
|
|
exposeSender = true,
|
|
receiverId = 22n,
|
|
signaturePurpose = 0x40,
|
|
encryptionPurpose = 0x41,
|
|
signatureSuite = "dual",
|
|
}) {
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const frames = [];
|
|
client.raw.client.send = async (frame) => frames.push(frame.slice());
|
|
await client.sendProtected(
|
|
"ProtectedMessage",
|
|
data,
|
|
{
|
|
receiverId,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
recipients: [publicBundle(recipientKeyring)],
|
|
signaturePurpose,
|
|
encryptionPurpose,
|
|
signatureSuite,
|
|
exposeSender,
|
|
},
|
|
);
|
|
return frames[0];
|
|
}
|
|
|
|
function openOptions(signerKeyring, recipientKeyring, overrides = {}) {
|
|
return {
|
|
recipient: { id: 22n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
expectedReceiverId: 22n,
|
|
resolveSignerPublicKeys: (signerId) => {
|
|
assert.equal(signerId, 11n);
|
|
return [publicBundle(signerKeyring)];
|
|
},
|
|
signaturePolicy: "dual",
|
|
signaturePurpose: 0x40,
|
|
encryptionPurpose: 0x41,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
await it("opens exposed and hidden outer senders", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
|
|
const exposed = await client.openProtected(
|
|
await buildDirectFrame({ signerKeyring, recipientKeyring }),
|
|
openOptions(signerKeyring, recipientKeyring),
|
|
);
|
|
assert.equal(exposed.type, "ProtectedMessage");
|
|
assert.equal(exposed.protectedVersion, 1);
|
|
assert.equal(exposed.signerId, 11n);
|
|
assert.equal(exposed.finalRecipientId, 22n);
|
|
assert.equal(exposed.receiver, 22n);
|
|
assert.equal(exposed.outerSender, 11n);
|
|
assert.equal(typeof exposed.messageId, "string");
|
|
assert.equal(typeof exposed.createdAt, "bigint");
|
|
assert.deepEqual(exposed.data, {
|
|
ExampleType: "direct-receive",
|
|
});
|
|
|
|
const hidden = await client.openProtected(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
exposeSender: false,
|
|
}),
|
|
openOptions(signerKeyring, recipientKeyring),
|
|
);
|
|
assert.equal(hidden.outerSender, undefined);
|
|
assert.equal(hidden.signerId, 11n);
|
|
});
|
|
|
|
await it("authenticates direct routing fields and rejects direct replays", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const frame = await buildDirectFrame({ signerKeyring, recipientKeyring });
|
|
|
|
const changedType = frame.slice();
|
|
changedType[4] = 0;
|
|
changedType[5] = 33;
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
changedType,
|
|
openOptions(signerKeyring, recipientKeyring),
|
|
),
|
|
/protected message type does not match outer routing/,
|
|
);
|
|
|
|
const parsed = bindings.parse_frame(frame);
|
|
const changedSender = bindings.build_frame_with_payload(
|
|
"ProtectedMessage",
|
|
parsed.data.encoded,
|
|
{ receiver: 22n, sender: 12n },
|
|
);
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
changedSender,
|
|
openOptions(signerKeyring, recipientKeyring),
|
|
),
|
|
/protected frame sender does not match authenticated signer/,
|
|
);
|
|
|
|
const changedReceiver = await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
exposeSender: false,
|
|
});
|
|
// The frame has an ID and receiver but no sender, so the receiver's final
|
|
// byte is at offset 18 in the MTP wire header.
|
|
changedReceiver[18] ^= 1;
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
changedReceiver,
|
|
openOptions(signerKeyring, recipientKeyring, {
|
|
recipient: { keyring: recipientKeyring },
|
|
expectedReceiverId: undefined,
|
|
}),
|
|
),
|
|
/protected final recipient does not match outer routing receiver/,
|
|
);
|
|
|
|
const replayOptions = openOptions(signerKeyring, recipientKeyring);
|
|
await client.openProtected(frame, replayOptions);
|
|
await assert.rejects(
|
|
() => client.openProtected(frame, replayOptions),
|
|
(error) => error instanceof sdk.MTPReplayError,
|
|
);
|
|
});
|
|
|
|
await it("snapshots parsed direct frames before async signer resolution", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const serialized = await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
});
|
|
const parsed = bindings.parse_frame(serialized);
|
|
delete parsed.raw;
|
|
|
|
let releaseKeys;
|
|
const keysReady = new Promise((resolve) => {
|
|
releaseKeys = resolve;
|
|
});
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const opening = client.openProtected(parsed, {
|
|
recipient: { id: 22n, keyring: recipientKeyring },
|
|
resolveSignerPublicKeys: async () => {
|
|
await keysReady;
|
|
return [publicBundle(signerKeyring)];
|
|
},
|
|
signaturePolicy: "dual",
|
|
signaturePurpose: 0x40,
|
|
encryptionPurpose: 0x41,
|
|
});
|
|
|
|
parsed.receiver = 23n;
|
|
releaseKeys();
|
|
const message = await opening;
|
|
assert.equal(message.receiver, 22n);
|
|
});
|
|
|
|
await it("validates the expected signer and outer receiver", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = await buildDirectFrame({ signerKeyring, recipientKeyring });
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
|
|
let resolverCalls = 0;
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
frame,
|
|
openOptions(signerKeyring, recipientKeyring, {
|
|
expectedSignerId: 99n,
|
|
resolveSignerPublicKeys: () => {
|
|
resolverCalls += 1;
|
|
return [publicBundle(signerKeyring)];
|
|
},
|
|
}),
|
|
),
|
|
/protected signer ID mismatch/,
|
|
);
|
|
assert.equal(
|
|
resolverCalls,
|
|
0,
|
|
"expected signer mismatch must precede signer-key resolution",
|
|
);
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
frame,
|
|
openOptions(signerKeyring, recipientKeyring, {
|
|
expectedReceiverId: 23n,
|
|
}),
|
|
),
|
|
/protected frame receiver ID mismatch/,
|
|
);
|
|
});
|
|
|
|
await it("uses current and historical recipient keyrings", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const currentRecipientKeyring = sdk.crypto.generateKeyring();
|
|
const historicalRecipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
|
|
const currentFrame = await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring: currentRecipientKeyring,
|
|
});
|
|
const current = await client.openProtected(
|
|
currentFrame,
|
|
openOptions(signerKeyring, currentRecipientKeyring),
|
|
);
|
|
assert.equal(current.data.ExampleType, "direct-receive");
|
|
|
|
const historicalFrame = await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring: historicalRecipientKeyring,
|
|
});
|
|
const historical = await client.openProtected(
|
|
historicalFrame,
|
|
openOptions(signerKeyring, currentRecipientKeyring, {
|
|
recipient: {
|
|
id: 22n,
|
|
keyring: currentRecipientKeyring,
|
|
keyringHistory: [historicalRecipientKeyring],
|
|
},
|
|
}),
|
|
);
|
|
assert.equal(historical.data.ExampleType, "direct-receive");
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
historicalFrame,
|
|
openOptions(signerKeyring, sdk.crypto.generateKeyring()),
|
|
),
|
|
/Unable to decrypt protected value with supplied recipient keyrings/,
|
|
);
|
|
});
|
|
|
|
await it("round trips non-container application DataValues", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const options = openOptions(signerKeyring, recipientKeyring);
|
|
|
|
const stringMessage = await client.openProtected(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
data: "direct string",
|
|
}),
|
|
options,
|
|
);
|
|
assert.equal(stringMessage.data, "direct string");
|
|
|
|
const arrayMessage = await client.openProtected(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
data: ["direct array", 7, false],
|
|
}),
|
|
options,
|
|
);
|
|
assert.deepEqual(arrayMessage.data, ["direct array", 7, false]);
|
|
|
|
const bytesMessage = await client.openProtected(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
data: new Uint8Array([3, 1, 4]),
|
|
}),
|
|
options,
|
|
);
|
|
assert.deepEqual(bytesMessage.data, new Uint8Array([3, 1, 4]));
|
|
|
|
const largeIntegerMessage = await client.openProtected(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
data: 9_007_199_254_740_992n,
|
|
}),
|
|
options,
|
|
);
|
|
assert.equal(largeIntegerMessage.data, 9_007_199_254_740_992n);
|
|
|
|
const safeIntegerMessage = await client.openProtected(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
data: 9_007_199_254_740_991,
|
|
}),
|
|
options,
|
|
);
|
|
assert.equal(safeIntegerMessage.data, 9_007_199_254_740_991);
|
|
|
|
const largeSignedMessage = await client.openProtected(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
data: -9_007_199_254_740_992n,
|
|
}),
|
|
options,
|
|
);
|
|
assert.equal(largeSignedMessage.data, -9_007_199_254_740_992n);
|
|
|
|
const largeUnsignedMessage = await client.openProtected(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
data: 18_446_744_073_709_551_615n,
|
|
}),
|
|
options,
|
|
);
|
|
assert.equal(largeUnsignedMessage.data, 18_446_744_073_709_551_615n);
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.sendProtected(
|
|
"ProtectedMessage",
|
|
9_007_199_254_740_992,
|
|
{
|
|
receiverId: 22n,
|
|
identity: { signerId: 11n, keyring: signerKeyring },
|
|
recipients: [publicBundle(recipientKeyring)],
|
|
signaturePurpose: 0x40,
|
|
encryptionPurpose: 0x41,
|
|
signatureSuite: "dual",
|
|
},
|
|
),
|
|
/unsafe integral MTP DataValue inputs must use bigint/,
|
|
);
|
|
});
|
|
|
|
await it("requires the configured purposes and verifies the protected signature", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const frame = await buildDirectFrame({ signerKeyring, recipientKeyring });
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
frame,
|
|
openOptions(signerKeyring, recipientKeyring, {
|
|
signaturePurpose: 0x42,
|
|
}),
|
|
),
|
|
);
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
frame,
|
|
openOptions(signerKeyring, recipientKeyring, {
|
|
encryptionPurpose: 0x42,
|
|
}),
|
|
),
|
|
);
|
|
|
|
const parsed = bindings.parse_frame(frame);
|
|
const signedBytes = bindings.decrypt_data_value(
|
|
parsed.data.encoded,
|
|
recipientKeyring,
|
|
0x41,
|
|
);
|
|
const tamperedSigned = signedBytes.slice();
|
|
tamperedSigned[1 + 4 + 1 + 1 + 8] ^= 0xff;
|
|
const tamperedPayload = bindings.encrypt_data_value_for_recipients(
|
|
tamperedSigned,
|
|
[publicBundle(recipientKeyring)],
|
|
0x41,
|
|
);
|
|
const tamperedFrame = bindings.build_frame_with_payload(
|
|
"ProtectedMessage",
|
|
tamperedPayload,
|
|
{ receiver: 22n, sender: 11n },
|
|
);
|
|
await assert.rejects(() =>
|
|
client.openProtected(
|
|
tamperedFrame,
|
|
openOptions(signerKeyring, recipientKeyring),
|
|
),
|
|
);
|
|
});
|
|
|
|
await it("resolves policy independently from recipient signing capabilities", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const edOnlyRecipientKeyring = ed25519OnlyEncryptionKeyring(recipientKeyring);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
defaultSignatureVerificationPolicy: "dual",
|
|
pings: false,
|
|
});
|
|
const dualFrame = await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
signatureSuite: "dual",
|
|
});
|
|
const defaultOpened = await client.openProtected(
|
|
dualFrame,
|
|
openOptions(signerKeyring, edOnlyRecipientKeyring, {
|
|
signaturePolicy: undefined,
|
|
}),
|
|
);
|
|
assert.equal(defaultOpened.data.ExampleType, "direct-receive");
|
|
|
|
const edFrame = await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
signatureSuite: "ed25519",
|
|
});
|
|
const overridden = await client.openProtected(
|
|
edFrame,
|
|
openOptions(signerKeyring, edOnlyRecipientKeyring, {
|
|
signaturePolicy: "ed25519",
|
|
}),
|
|
);
|
|
assert.equal(overridden.data.ExampleType, "direct-receive");
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
edFrame,
|
|
openOptions(signerKeyring, edOnlyRecipientKeyring, {
|
|
signaturePolicy: undefined,
|
|
}),
|
|
),
|
|
(error) =>
|
|
error instanceof sdk.MTPSignatureVerificationError &&
|
|
error.code === "policy-rejected",
|
|
);
|
|
|
|
const libraryDefaultClient = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const libraryDefault = await libraryDefaultClient.openProtected(
|
|
edFrame,
|
|
openOptions(signerKeyring, edOnlyRecipientKeyring, {
|
|
signaturePolicy: undefined,
|
|
}),
|
|
);
|
|
assert.equal(libraryDefaultClient.defaultSignatureVerificationPolicy, "ed25519");
|
|
assert.equal(libraryDefault.data.ExampleType, "direct-receive");
|
|
});
|
|
|
|
await it("reports unavailable signer keys and invalid signatures separately", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const frame = await buildDirectFrame({ signerKeyring, recipientKeyring });
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
frame,
|
|
openOptions(signerKeyring, recipientKeyring, {
|
|
resolveSignerPublicKeys: () => [],
|
|
}),
|
|
),
|
|
(error) =>
|
|
error instanceof sdk.MTPSignatureVerificationError &&
|
|
error.code === "signer-keys-unavailable",
|
|
);
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
frame,
|
|
openOptions(signerKeyring, recipientKeyring, {
|
|
resolveSignerPublicKeys: async () => {
|
|
throw new Error("signer key store unavailable");
|
|
},
|
|
}),
|
|
),
|
|
(error) =>
|
|
error instanceof sdk.MTPSignatureVerificationError &&
|
|
error.code === "signer-keys-unavailable",
|
|
);
|
|
|
|
const parsed = bindings.parse_frame(frame);
|
|
const signedBytes = bindings.decrypt_data_value(
|
|
parsed.data.encoded,
|
|
recipientKeyring,
|
|
0x41,
|
|
);
|
|
const tamperedSigned = signedBytes.slice();
|
|
tamperedSigned[1 + 4 + 1 + 1 + 8] ^= 0xff;
|
|
const tamperedPayload = bindings.encrypt_data_value_for_recipients(
|
|
tamperedSigned,
|
|
[publicBundle(recipientKeyring)],
|
|
0x41,
|
|
);
|
|
const tamperedFrame = bindings.build_frame_with_payload(
|
|
"ProtectedMessage",
|
|
tamperedPayload,
|
|
{ receiver: 22n, sender: 11n },
|
|
);
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
tamperedFrame,
|
|
openOptions(signerKeyring, recipientKeyring),
|
|
),
|
|
(error) =>
|
|
error instanceof sdk.MTPSignatureVerificationError &&
|
|
error.code === "invalid-signature",
|
|
);
|
|
});
|
|
|
|
await it("rejects an unresolved communication type", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = await buildDirectFrame({ signerKeyring, recipientKeyring });
|
|
const unknownTypeFrame = frame.slice();
|
|
unknownTypeFrame[4] = 0;
|
|
unknownTypeFrame[5] = 0xff;
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
client.openProtected(
|
|
unknownTypeFrame,
|
|
openOptions(signerKeyring, recipientKeyring),
|
|
),
|
|
/Unknown communication type/,
|
|
);
|
|
});
|
|
|
|
await it("uses the shared opening path for subscriptions", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = bindings.parse_frame(
|
|
await buildDirectFrame({ signerKeyring, recipientKeyring }),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const originalSubscribe = client.raw.client.subscribe;
|
|
const originalUnsubscribe = client.raw.client.unsubscribe;
|
|
let subscribedType;
|
|
let subscribedHandler;
|
|
let unsubscribedId;
|
|
client.raw.client.subscribe = (type, handler) => {
|
|
subscribedType = type;
|
|
subscribedHandler = handler;
|
|
return 23;
|
|
};
|
|
client.raw.client.unsubscribe = (id) => {
|
|
unsubscribedId = id;
|
|
return true;
|
|
};
|
|
|
|
try {
|
|
const received = [];
|
|
const unsubscribe = client.subscribeProtected(
|
|
"ProtectedMessage",
|
|
(message, receivedFrame) => received.push({ message, receivedFrame }),
|
|
openOptions(signerKeyring, recipientKeyring),
|
|
);
|
|
assert.equal(subscribedType, "ProtectedMessage");
|
|
await subscribedHandler(frame);
|
|
assert.equal(received.length, 1);
|
|
assert.equal(received[0].message.signerId, 11n);
|
|
assert.equal(received[0].receivedFrame.type, "ProtectedMessage");
|
|
unsubscribe();
|
|
assert.equal(unsubscribedId, 23);
|
|
} finally {
|
|
client.raw.client.subscribe = originalSubscribe;
|
|
client.raw.client.unsubscribe = originalUnsubscribe;
|
|
}
|
|
});
|
|
|
|
await it("keeps protected subscription replay guards independent", async () => {
|
|
const signerKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = bindings.parse_frame(
|
|
await buildDirectFrame({
|
|
signerKeyring,
|
|
recipientKeyring,
|
|
signatureSuite: "dual",
|
|
}),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const originalSubscribe = client.raw.client.subscribe;
|
|
const originalUnsubscribe = client.raw.client.unsubscribe;
|
|
const subscriptions = [];
|
|
client.raw.client.subscribe = (type, handler) => {
|
|
const id = subscriptions.length + 1;
|
|
subscriptions.push({ type, handler, id });
|
|
return id;
|
|
};
|
|
client.raw.client.unsubscribe = () => true;
|
|
|
|
try {
|
|
const received = [0, 0];
|
|
const options = openOptions(signerKeyring, recipientKeyring);
|
|
client.subscribeProtected(
|
|
"ProtectedMessage",
|
|
() => {
|
|
received[0] += 1;
|
|
},
|
|
options,
|
|
);
|
|
client.subscribeProtected(
|
|
"ProtectedMessage",
|
|
() => {
|
|
received[1] += 1;
|
|
},
|
|
options,
|
|
);
|
|
|
|
assert.equal(subscriptions.length, 2);
|
|
await subscriptions[0].handler(frame);
|
|
await subscriptions[1].handler(frame);
|
|
assert.deepEqual(received, [1, 1]);
|
|
} finally {
|
|
client.raw.client.subscribe = originalSubscribe;
|
|
client.raw.client.unsubscribe = originalUnsubscribe;
|
|
}
|
|
});
|
|
});
|
|
|
|
await describe("E2EE Session Manager", async () => {
|
|
await it("derivePeerSessionId is consistent regardless of order", () => {
|
|
const id1 = derivePeerSessionId(5n, 10n);
|
|
const id2 = derivePeerSessionId(10n, 5n);
|
|
assert.equal(id1, id2);
|
|
});
|
|
|
|
await it("stores independent sessions by explicit session ID", async () => {
|
|
const ss = sdk.crypto.sha256(new Uint8Array([1, 2, 3]));
|
|
const storage = new InMemorySessionStorage();
|
|
const manager = new MTPSessionManager(storage);
|
|
const sessionId = "independent-session";
|
|
|
|
assert.equal(await manager.getSession(sessionId), null);
|
|
|
|
const session = await manager.createSession({
|
|
sessionId,
|
|
localId: 1n,
|
|
remoteId: 2n,
|
|
remotePublicKey: new Uint8Array(32),
|
|
sharedSecret: ss,
|
|
role: "initiator",
|
|
transcriptContext: {
|
|
sessionId,
|
|
initiatorId: 1n,
|
|
recipientId: 2n,
|
|
recipientPublicKey: new Uint8Array(32),
|
|
kemCiphertext: new Uint8Array([1]),
|
|
applicationContext: new Uint8Array([2]),
|
|
},
|
|
});
|
|
assert.equal(session.version, 1);
|
|
assert.equal(session.sendCount, 0);
|
|
assert.equal(session.recvCount, 0);
|
|
|
|
await manager.saveSession(session);
|
|
const retrieved = await manager.getSession(sessionId);
|
|
assert.notEqual(retrieved, null);
|
|
assert.equal(retrieved.sessionId, session.sessionId);
|
|
|
|
const otherSession = await manager.createSession({
|
|
sessionId: "another-session",
|
|
localId: 1n,
|
|
remoteId: 2n,
|
|
remotePublicKey: new Uint8Array(32),
|
|
sharedSecret: ss,
|
|
role: "initiator",
|
|
transcript: new Uint8Array([2]),
|
|
});
|
|
await manager.saveSession(otherSession);
|
|
assert.notEqual(await manager.getSession(sessionId), null);
|
|
assert.notEqual(await manager.getSession(otherSession.sessionId), null);
|
|
|
|
await manager.deleteSession(sessionId);
|
|
assert.equal(await manager.getSession(sessionId), null);
|
|
assert.notEqual(await manager.getSession(otherSession.sessionId), null);
|
|
});
|
|
});
|
|
|
|
await describe("E2EE Full Flow: KEM + Session + Ratchet + AEAD", async () => {
|
|
await it("Alice encapsulates to Bob, both derive matching sessions, encrypt-decrypt works", async () => {
|
|
// Bob generates keyring
|
|
const bobKeyring = sdk.crypto.generateKeyring();
|
|
const bobKeys = sdk.crypto.keyringToKeys(bobKeyring);
|
|
|
|
// Alice encapsulates to Bob's KEM public key
|
|
const enc = sdk.crypto.encapsulate(bobKeys.kemPublicKey);
|
|
|
|
// Bob decapsulates
|
|
const bobSharedSecret = sdk.crypto.decapsulate(
|
|
bobKeys.kemSecretKey,
|
|
enc.ciphertext,
|
|
);
|
|
assert.deepEqual(bobSharedSecret, enc.shared_secret);
|
|
|
|
const ss = enc.shared_secret;
|
|
const { initSessions } = setupSessions(ss);
|
|
const { aliceSession, bobSession } = await initSessions();
|
|
|
|
// Alice sends encrypted init message with KEM ciphertext
|
|
const msg1 = new Uint8Array([0x48, 0x65, 0x6c, 0x6c, 0x6f]); // "Hello"
|
|
const { payload: p1, session: aliceAfter1 } = await encryptPayload({
|
|
plaintext: msg1,
|
|
session: aliceSession,
|
|
kemCiphertext: enc.ciphertext,
|
|
});
|
|
|
|
// Bob receives and decrypts
|
|
const { plaintext: d1, session: bobAfter1 } = await decryptPayload({
|
|
payload: p1,
|
|
session: bobSession,
|
|
});
|
|
assert.deepEqual(d1, msg1);
|
|
assert.deepEqual(aliceAfter1.sendChainKey, bobAfter1.recvChainKey);
|
|
assert.equal(aliceAfter1.sendCount, 1);
|
|
assert.equal(bobAfter1.recvCount, 1);
|
|
|
|
// Second message (no KEM ciphertext)
|
|
const msg2 = new Uint8Array([0x57, 0x6f, 0x72, 0x6c, 0x64]); // "World"
|
|
const { payload: p2, session: aliceAfter2 } = await encryptPayload({
|
|
plaintext: msg2,
|
|
session: aliceAfter1,
|
|
});
|
|
|
|
const { plaintext: d2, session: bobAfter2 } = await decryptPayload({
|
|
payload: p2,
|
|
session: bobAfter1,
|
|
});
|
|
assert.deepEqual(d2, msg2);
|
|
assert.deepEqual(aliceAfter2.sendChainKey, bobAfter2.recvChainKey);
|
|
assert.equal(aliceAfter2.sendCount, 2);
|
|
assert.equal(bobAfter2.recvCount, 2);
|
|
});
|
|
});
|
|
|
|
await describe("E2EE Tamper Detection", async () => {
|
|
await it("Rejects modified ciphertext", async () => {
|
|
const ss = sdk.crypto.sha256(new Uint8Array([42]));
|
|
const { initSessions } = setupSessions(ss);
|
|
const { aliceSession, bobSession } = await initSessions();
|
|
|
|
const plaintext = new Uint8Array([0x01, 0x02, 0x03]);
|
|
const { payload } = await encryptPayload({
|
|
plaintext,
|
|
session: aliceSession,
|
|
});
|
|
|
|
// Tamper with AEAD payload
|
|
const tampered = new Uint8Array(payload);
|
|
tampered[tampered.length - 1] ^= 0xff;
|
|
|
|
await assert.rejects(
|
|
() => decryptPayload({ payload: tampered, session: bobSession }),
|
|
/decrypt failed/,
|
|
);
|
|
});
|
|
|
|
await it("Rejects out-of-order message numbers", async () => {
|
|
const ss = sdk.crypto.sha256(new Uint8Array([7]));
|
|
const { initSessions } = setupSessions(ss);
|
|
const { aliceSession, bobSession } = await initSessions();
|
|
|
|
// Send two messages
|
|
const { payload: p1, session: aliceAfter1 } = await encryptPayload({
|
|
plaintext: sdk.codec.encode("Ping", { Version: "a" }),
|
|
session: aliceSession,
|
|
});
|
|
await encryptPayload({
|
|
plaintext: sdk.codec.encode("Ping", { Version: "b" }),
|
|
session: aliceAfter1,
|
|
});
|
|
|
|
// Bob decrypts p1
|
|
const { session: bobAfter1 } = await decryptPayload({
|
|
payload: p1,
|
|
session: bobSession,
|
|
});
|
|
|
|
// Now bob expects msgNumber 1, but we try to replay msgNumber 0
|
|
await assert.rejects(
|
|
() => decryptPayload({ payload: p1, session: bobAfter1 }),
|
|
/replay|out of order/,
|
|
);
|
|
});
|
|
});
|
|
|
|
await describe("Encrypted Pipe", async () => {
|
|
await it("rejects MTP-reserved application purposes", () => {
|
|
assert.throws(
|
|
() => new sdk.MTPPipeProtectionContext(new Uint8Array([1]), 0x30, 0),
|
|
/reserved/,
|
|
);
|
|
});
|
|
|
|
await it("authenticates records and requires a final record", async () => {
|
|
const [writerPipe, readerPipe] = memoryDuplexPair();
|
|
const context = new sdk.MTPPipeProtectionContext(
|
|
new Uint8Array([1, 2, 3]),
|
|
0x40,
|
|
0,
|
|
);
|
|
const writer = new sdk.MTPEncryptedPipeWriter(
|
|
writerPipe,
|
|
new Uint8Array(32).fill(7),
|
|
context,
|
|
);
|
|
const reader = new sdk.MTPEncryptedPipeReader(
|
|
readerPipe,
|
|
new Uint8Array(32).fill(7),
|
|
context,
|
|
);
|
|
|
|
await writer.writeRecord(new Uint8Array([1, 2, 3]));
|
|
assert.deepEqual(await reader.readRecord(), new Uint8Array([1, 2, 3]));
|
|
await writer.close();
|
|
assert.equal(await reader.readRecord(), null);
|
|
assert.equal(await reader.readRecord(), null);
|
|
});
|
|
|
|
await it("poisons the reader after a truncated stream", async () => {
|
|
const [writerPipe, readerPipe] = memoryDuplexPair();
|
|
const context = new sdk.MTPPipeProtectionContext(
|
|
new Uint8Array([4, 5, 6]),
|
|
0x40,
|
|
0,
|
|
);
|
|
const writer = new sdk.MTPEncryptedPipeWriter(
|
|
writerPipe,
|
|
new Uint8Array(32).fill(8),
|
|
context,
|
|
);
|
|
const reader = new sdk.MTPEncryptedPipeReader(
|
|
readerPipe,
|
|
new Uint8Array(32).fill(8),
|
|
context,
|
|
);
|
|
await writer.writeRecord(new Uint8Array([9]));
|
|
writerPipe.abort();
|
|
assert.deepEqual(await reader.readRecord(), new Uint8Array([9]));
|
|
await assert.rejects(() => reader.readRecord(), /final|truncated/i);
|
|
await assert.rejects(() => reader.readRecord(), /state|readable/i);
|
|
});
|
|
|
|
await it("poisons the writer after a transport write failure", async () => {
|
|
const [writerPipe] = memoryDuplexPair();
|
|
const context = new sdk.MTPPipeProtectionContext(
|
|
new Uint8Array([7, 8, 9]),
|
|
0x40,
|
|
0,
|
|
);
|
|
const writer = new sdk.MTPEncryptedPipeWriter(
|
|
writerPipe,
|
|
new Uint8Array(32).fill(6),
|
|
context,
|
|
);
|
|
writerPipe.abort();
|
|
await assert.rejects(() => writer.writeRecord(new Uint8Array([1])), /write|closed/i);
|
|
await assert.rejects(() => writer.writeRecord(new Uint8Array([2])), /state|writable/i);
|
|
});
|
|
|
|
await it("establishes a forward-secure authenticated duplex session", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const currentSenderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const senderBundle = publicBundle(senderKeyring);
|
|
const currentSenderBundle = publicBundle(currentSenderKeyring);
|
|
const recipientBundle = publicBundle(recipientKeyring);
|
|
const [initiatorPipe, responderPipe] = memoryDuplexPair(91);
|
|
const sessionId = new Uint8Array(32).fill(0x42);
|
|
const params = {
|
|
sessionId,
|
|
pipeId: 91,
|
|
senderId: 11n,
|
|
recipientId: 22n,
|
|
purpose: 0x40,
|
|
direction: 0,
|
|
};
|
|
|
|
const responder = sdk.acceptMTPForwardSecurePipeSession(
|
|
responderPipe,
|
|
{
|
|
pipeId: params.pipeId,
|
|
senderId: params.senderId,
|
|
recipientId: params.recipientId,
|
|
purpose: params.purpose,
|
|
direction: params.direction,
|
|
},
|
|
recipientKeyring,
|
|
[currentSenderBundle, senderBundle],
|
|
"dual",
|
|
"dual",
|
|
);
|
|
const initiator = await sdk.initiateMTPForwardSecurePipeSession(
|
|
initiatorPipe,
|
|
params,
|
|
senderKeyring,
|
|
recipientBundle,
|
|
"dual",
|
|
"dual",
|
|
);
|
|
const receiver = await responder;
|
|
await initiator.writeRecord(new Uint8Array([0xaa, 0xbb]));
|
|
assert.deepEqual(await receiver.readRecord(), new Uint8Array([0xaa, 0xbb]));
|
|
await initiator.close();
|
|
assert.equal(await receiver.readRecord(), null);
|
|
});
|
|
|
|
await it("uses interoperable Ed25519 defaults for pipe handshakes", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const [initiatorPipe, responderPipe] = memoryDuplexPair(93);
|
|
const params = {
|
|
sessionId: new Uint8Array([9, 3]),
|
|
pipeId: 93,
|
|
senderId: 11n,
|
|
recipientId: 22n,
|
|
purpose: 0x40,
|
|
direction: 0,
|
|
};
|
|
|
|
const responder = sdk.acceptMTPForwardSecurePipeSession(
|
|
responderPipe,
|
|
params,
|
|
recipientKeyring,
|
|
publicBundle(senderKeyring),
|
|
);
|
|
const initiator = await sdk.initiateMTPForwardSecurePipeSession(
|
|
initiatorPipe,
|
|
params,
|
|
senderKeyring,
|
|
publicBundle(recipientKeyring),
|
|
);
|
|
const receiver = await responder;
|
|
await initiator.writeRecord(new Uint8Array([0x55]));
|
|
assert.deepEqual(await receiver.readRecord(), new Uint8Array([0x55]));
|
|
await initiator.close();
|
|
assert.equal(await receiver.readRecord(), null);
|
|
});
|
|
|
|
await it("accepts a dual sender with an Ed25519-only recipient keyring", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const recipientEncryptionKeyring = ed25519OnlyEncryptionKeyring(
|
|
recipientKeyring,
|
|
);
|
|
const [writerPipe, readerPipe] = memoryDuplexPair(92);
|
|
const params = {
|
|
sessionId: new Uint8Array([9, 2]),
|
|
pipeId: 92,
|
|
senderId: 11n,
|
|
recipientId: 22n,
|
|
purpose: 0x40,
|
|
direction: 0,
|
|
};
|
|
const readerPromise = sdk.acceptMTPPipeSession(
|
|
readerPipe,
|
|
params,
|
|
recipientEncryptionKeyring,
|
|
publicBundle(senderKeyring),
|
|
"dual",
|
|
);
|
|
const writer = await sdk.initiateMTPPipeSession(
|
|
writerPipe,
|
|
params,
|
|
senderKeyring,
|
|
publicBundle(recipientKeyring),
|
|
"dual",
|
|
);
|
|
const reader = await readerPromise;
|
|
await writer.writeRecord(new Uint8Array([0x11]));
|
|
assert.deepEqual(await reader.readRecord(), new Uint8Array([0x11]));
|
|
});
|
|
});
|
|
|
|
await describe("Relay API invariants", async () => {
|
|
await it("exposes stable codes for raw relay operation errors", () => {
|
|
const ping = bindings.build_ping_frame(
|
|
7n,
|
|
"not-a-relay",
|
|
1n,
|
|
new Uint8Array(),
|
|
);
|
|
assert.throws(
|
|
() => bindings.forward_encrypted_relay_frame(ping, 9n),
|
|
(error) => error?.code === "not-relay",
|
|
);
|
|
|
|
assert.throws(
|
|
() => bindings.forward_encrypted_relay_frame(new Uint8Array([0xff]), 9n),
|
|
(error) => error?.code === "invalid-frame",
|
|
);
|
|
});
|
|
|
|
await it("uses the client default for metadata and content independently of recipient PQ keys", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "default-policy" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-default-policy",
|
|
456n,
|
|
null,
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_ed25519(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
defaultSignatureVerificationPolicy: "ed25519",
|
|
pings: false,
|
|
});
|
|
const options = {
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
};
|
|
const metadata = await client.openRelayMetadata(frame, options);
|
|
assert.equal(metadata.signaturePolicy, "ed25519");
|
|
const content = await client.openRelayContent(metadata, options);
|
|
assert.equal(content.data.ExampleType, "default-policy");
|
|
});
|
|
|
|
await it("inherits the authenticated metadata policy for relay content", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "inherited-policy" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-inherited-policy",
|
|
456n,
|
|
null,
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
defaultSignatureVerificationPolicy: "ed25519",
|
|
pings: false,
|
|
});
|
|
const metadataOptions = {
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
};
|
|
const metadata = await client.openRelayMetadata(frame, metadataOptions);
|
|
const content = await client.openRelayContent(metadata, {
|
|
recipient: metadataOptions.recipient,
|
|
expectedSignerId: metadataOptions.expectedSignerId,
|
|
resolveSignerPublicKeys: metadataOptions.resolveSignerPublicKeys,
|
|
});
|
|
assert.equal(content.data.ExampleType, "inherited-policy");
|
|
});
|
|
|
|
await it("preserves relay CreatedAt milliseconds as bigint", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "generic" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-generic",
|
|
relayCreatedAtMillis,
|
|
bindings.encode_data_value({ ExampleType: "opaque-to-content-only-relays" }),
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const options = {
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
};
|
|
|
|
const metadata = await client.openRelayMetadata(frame, options);
|
|
assert.ok(metadata);
|
|
assert.equal(metadata.signerId, 11n);
|
|
assert.equal(metadata.finalRecipientId, 42n);
|
|
assert.equal(metadata.messageId, "message-generic");
|
|
assert.equal(metadata.createdAt, relayCreatedAtMillis);
|
|
assert.deepEqual(metadata.metadata, {
|
|
ExampleType: "opaque-to-content-only-relays",
|
|
});
|
|
|
|
const content = await client.openRelayContent(metadata, options);
|
|
assert.deepEqual(content, {
|
|
type: "ProtectedMessage",
|
|
data: { ExampleType: "generic" },
|
|
signerId: 11n,
|
|
finalRecipientId: 42n,
|
|
messageId: "message-generic",
|
|
createdAt: relayCreatedAtMillis,
|
|
metadata: { ExampleType: "opaque-to-content-only-relays" },
|
|
});
|
|
});
|
|
|
|
await it("preserves scalar metadata and byte content values", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
new Uint8Array([0xde, 0xad, 0xbe, 0xef]),
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-scalar-values",
|
|
456n,
|
|
bindings.encode_data_value("opaque metadata"),
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const options = {
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
};
|
|
|
|
const metadata = await client.openRelayMetadata(frame, options);
|
|
assert.equal(metadata.metadata, "opaque metadata");
|
|
const content = await client.openRelayContent(metadata, options);
|
|
assert.deepEqual(content.data, new Uint8Array([0xde, 0xad, 0xbe, 0xef]));
|
|
});
|
|
|
|
await it("subscribes through the explicit sealed-relay API", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "subscription" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-subscription",
|
|
789n,
|
|
bindings.encode_data_value({ ExampleType: "subscription" }),
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const originalSubscribe = client.raw.client.subscribe;
|
|
const originalUnsubscribe = client.raw.client.unsubscribe;
|
|
let subscribedType;
|
|
let subscribedHandler;
|
|
let unsubscribedId;
|
|
client.raw.client.subscribe = (type, handler) => {
|
|
subscribedType = type;
|
|
subscribedHandler = handler;
|
|
return 17;
|
|
};
|
|
client.raw.client.unsubscribe = (id) => {
|
|
unsubscribedId = id;
|
|
};
|
|
|
|
try {
|
|
const received = [];
|
|
const unsubscribe = client.subscribeSealedRelay(
|
|
"ProtectedMessage",
|
|
(content, parsedFrame) => {
|
|
received.push({ content, parsedFrame });
|
|
},
|
|
{
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
},
|
|
);
|
|
|
|
assert.equal(subscribedType, "Relay");
|
|
assert.equal(typeof subscribedHandler, "function");
|
|
await subscribedHandler(frame);
|
|
assert.equal(received.length, 1);
|
|
assert.equal(received[0].content.messageId, "message-subscription");
|
|
assert.deepEqual(received[0].content.metadata, {
|
|
ExampleType: "subscription",
|
|
});
|
|
assert.equal(received[0].parsedFrame.type, "ProtectedMessage");
|
|
assert.deepEqual(received[0].parsedFrame.data, {
|
|
ExampleType: "subscription",
|
|
});
|
|
await subscribedHandler(frame);
|
|
assert.equal(received.length, 1);
|
|
|
|
unsubscribe();
|
|
assert.equal(unsubscribedId, 17);
|
|
} finally {
|
|
client.raw.client.subscribe = originalSubscribe;
|
|
client.raw.client.unsubscribe = originalUnsubscribe;
|
|
}
|
|
});
|
|
|
|
await it("keeps relay subscription replay guards independent", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "fanout" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-relay-fanout",
|
|
789n,
|
|
bindings.encode_data_value({ ExampleType: "fanout-metadata" }),
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const originalSubscribe = client.raw.client.subscribe;
|
|
const originalUnsubscribe = client.raw.client.unsubscribe;
|
|
const subscriptions = [];
|
|
client.raw.client.subscribe = (type, handler) => {
|
|
const id = subscriptions.length + 1;
|
|
subscriptions.push({ type, handler, id });
|
|
return id;
|
|
};
|
|
client.raw.client.unsubscribe = () => true;
|
|
|
|
try {
|
|
const options = {
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
};
|
|
let mismatched = 0;
|
|
let matched = 0;
|
|
let metadataOnly = 0;
|
|
client.subscribeSealedRelay(
|
|
"AlternateMessage",
|
|
() => {
|
|
mismatched += 1;
|
|
},
|
|
options,
|
|
);
|
|
client.subscribeSealedRelay(
|
|
"ProtectedMessage",
|
|
() => {
|
|
matched += 1;
|
|
},
|
|
options,
|
|
);
|
|
client.subscribeRelayMetadata(
|
|
() => {
|
|
metadataOnly += 1;
|
|
},
|
|
options,
|
|
);
|
|
|
|
const relaySubscriptions = subscriptions.filter(
|
|
({ type }) => type === "Relay",
|
|
);
|
|
assert.equal(relaySubscriptions.length, 3);
|
|
for (const subscription of relaySubscriptions) {
|
|
await subscription.handler(frame);
|
|
}
|
|
assert.equal(mismatched, 0);
|
|
assert.equal(matched, 1);
|
|
assert.equal(metadataOnly, 1);
|
|
} finally {
|
|
client.raw.client.subscribe = originalSubscribe;
|
|
client.raw.client.unsubscribe = originalUnsubscribe;
|
|
}
|
|
});
|
|
|
|
await it("consumes authenticated relay IDs through the caller's replay guard", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "replay" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-replay",
|
|
123n,
|
|
null,
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
credentials: { clientId: 42n, keyring: recipientKeyring },
|
|
pings: false,
|
|
});
|
|
const accepted = new Set();
|
|
const replayGuard = {
|
|
accept(signerId, messageId) {
|
|
const key = `${signerId}:${messageId}`;
|
|
if (accepted.has(key)) return false;
|
|
accepted.add(key);
|
|
return true;
|
|
},
|
|
};
|
|
const options = {
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
replayGuard,
|
|
};
|
|
const metadata = await client.openRelayMetadata(frame, options);
|
|
assert.equal(metadata.messageId, "message-replay");
|
|
await assert.rejects(
|
|
() => client.openRelayMetadata(frame, options),
|
|
(error) => error instanceof sdk.MTPReplayError,
|
|
);
|
|
metadata.dispose();
|
|
metadata.free();
|
|
await assert.rejects(
|
|
() => client.openRelayContent(metadata, options),
|
|
/disposed/,
|
|
);
|
|
});
|
|
|
|
await it("disposes metadata after relay metadata subscription handlers complete", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "metadata-subscription" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-metadata-subscription",
|
|
123n,
|
|
null,
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const originalSubscribe = client.raw.client.subscribe;
|
|
let subscribedHandler;
|
|
client.raw.client.subscribe = (_type, handler) => {
|
|
subscribedHandler = handler;
|
|
return 19;
|
|
};
|
|
|
|
try {
|
|
let receivedMetadata;
|
|
client.subscribeRelayMetadata(
|
|
(metadata) => {
|
|
receivedMetadata = metadata;
|
|
assert.equal(metadata.messageId, "message-metadata-subscription");
|
|
},
|
|
{
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [publicBundle(senderKeyring)],
|
|
signaturePolicy: "dual",
|
|
},
|
|
);
|
|
|
|
await subscribedHandler(frame);
|
|
assert.throws(() => receivedMetadata.messageId, /disposed/);
|
|
} finally {
|
|
client.raw.client.subscribe = originalSubscribe;
|
|
}
|
|
});
|
|
|
|
await it("rejects relay content opening when metadata is disposed during resolution", async () => {
|
|
const senderKeyring = sdk.crypto.generateKeyring();
|
|
const recipientKeyring = sdk.crypto.generateKeyring();
|
|
const frame = sdk.codec.decode(
|
|
bindings.build_encrypted_relay_frame_with_keyring(
|
|
"ProtectedMessage",
|
|
{ ExampleType: "dispose-race" },
|
|
11n,
|
|
42n,
|
|
42n,
|
|
"message-dispose-race",
|
|
123n,
|
|
null,
|
|
senderKeyring,
|
|
bindings.mtp_protection_signature_suite_dual(),
|
|
[publicBundle(recipientKeyring)],
|
|
[publicBundle(recipientKeyring)],
|
|
),
|
|
);
|
|
const client = await sdk.MTPClient.create({
|
|
url: "https://example.invalid",
|
|
pings: false,
|
|
});
|
|
const signerPublicKey = publicBundle(senderKeyring);
|
|
const metadata = await client.openRelayMetadata(frame, {
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: () => [signerPublicKey],
|
|
signaturePolicy: "dual",
|
|
});
|
|
|
|
let signalResolverStarted;
|
|
let releaseResolver;
|
|
const resolverStarted = new Promise((resolve) => {
|
|
signalResolverStarted = resolve;
|
|
});
|
|
const resolverRelease = new Promise((resolve) => {
|
|
releaseResolver = resolve;
|
|
});
|
|
const opening = client.openRelayContent(metadata, {
|
|
recipient: { id: 42n, keyring: recipientKeyring },
|
|
expectedSignerId: 11n,
|
|
resolveSignerPublicKeys: async () => {
|
|
signalResolverStarted();
|
|
await resolverRelease;
|
|
return [signerPublicKey];
|
|
},
|
|
signaturePolicy: "dual",
|
|
});
|
|
|
|
await resolverStarted;
|
|
metadata.dispose();
|
|
releaseResolver();
|
|
await assert.rejects(opening, /relay metadata has been disposed/);
|
|
});
|
|
|
|
await it("does not permit callers to construct verified metadata", () => {
|
|
assert.throws(
|
|
() => new sdk.MTPVerifiedRelayMetadata(Symbol(), {}),
|
|
/authenticated opening/,
|
|
);
|
|
});
|
|
});
|