packages/slate-cli/test/test-node-pairing.sgl

1(import (sigil test) (sigil core) (sigil string) (sigil fs) (sigil path) (sigil json)

2 (sigil process) (sigil time) (slate-cli node pairing))

4(define (record public key-id generation)

5 #{ bot-id: "bot-2" transport-nick: "peer-transport" label: "Peer"

6 peer-key-id: key-id peer-generation: generation peer-public-key: public

7 endpoints: (list "ws://100.64.0.2:32644/node/direct")

8 created: 100 last-connected: 101 last-enclave-validated: 102 revoked: #f })

10(test-group "durable node pairing primitives"

11 (test "default identity timestamps validate in the native runtime"

12 (assert-true (pairing-identity-valid? (pairing-make-identity 1))))

14 (test "transcript is ordered, length-prefixed, and identity-bound"

15 (let ((a (pairing-transcript "s" "a" "an" "ak" 1 "b" "bn" "bk" 2

16 "ap" "bp" "cn" "an"))

17 (b (pairing-transcript "s" "aa" "n" "ak" 1 "b" "bn" "bk" 2

18 "ap" "bp" "cn" "an")))

19 (assert-false (string=? a b))

20 (let ((prefix "21:slate-node-pairing-v1|1:s"))

21 (assert-true (string=? (substring a 0 (string-length prefix)) prefix)))))

23 (test "P-256 signatures and ephemeral confirmation agree"

24 (let* ((a (pairing-generate-keypair)) (b (pairing-generate-keypair))

25 (msg "bound transcript")

26 (sig (pairing-sign (dict-ref a private-key: "") msg))

27 (za (pairing-shared-secret (dict-ref a private-key: "")

28 (dict-ref b public-key: "")))

29 (zb (pairing-shared-secret (dict-ref b private-key: "")

30 (dict-ref a public-key: ""))))

31 (assert-true (pairing-verify? (dict-ref a public-key: "") msg sig))

32 (assert-false (pairing-verify? (dict-ref b public-key: "") msg sig))

33 (assert-equal (pairing-confirmation-key za msg)

34 (pairing-confirmation-key zb msg))))

36 (test "same-generation key conflict and stale generation fail closed"

37 (let* ((a (pairing-generate-keypair)) (b (pairing-generate-keypair))

38 (old (record (dict-ref a public-key: "") "a" 2))

39 (conflict (record (dict-ref b public-key: "") "b" 2))

40 (stale (record (dict-ref a public-key: "") "a" 1)))

41 (assert-equal 'conflict (pairing-record-relation old conflict))

42 (assert-equal 'stale (pairing-record-relation old stale))

43 (assert-false (pairing-record-merge (list old) conflict))

44 (assert-false (pairing-record-merge (list old) stale))))

46 (test "malformed keys, unsafe endpoints, and corruption are refused"

47 (let* ((kp (pairing-generate-keypair))

48 (good (record (dict-ref kp public-key: "") "key" 1)))

49 (assert-true (pairing-record-valid? good))

50 (assert-false (pairing-record-valid? (dict-set good peer-public-key: "bad")))

51 (assert-false (pairing-record-valid?

52 (dict-set good endpoints: (list "ws://127.0.0.1:1/x"))))))

54 (test "identity and pairing stores are atomic and owner-only"

55 (let* ((dir (string-append "/tmp/slate-node-pairing-"

56 (number->string (current-jiffy))))

57 (identity (pairing-make-identity 1 100))

58 (peer (record (dict-ref identity public-key: "") "peer-key" 1)))

59 (guard (e (#t (raise e)))

60 (pairing-save-identity! dir identity)

61 (pairing-save-records! dir (list peer))

62 (assert-equal "700" (string-trim (process-output->string "stat" "-c" "%a" dir)))

63 (assert-equal "600" (string-trim (process-output->string "stat" "-c" "%a"

64 (pairing-identity-path dir))))

65 (assert-equal identity (pairing-load-identity dir))

66 (assert-equal (list peer) (pairing-load-records dir))

67 (assert-false (file-exists? (string-append (pairing-records-path dir) ".tmp"))))))

69 (test "corrupt stores quarantine instead of returning partial trust"

70 (let ((dir (string-append "/tmp/slate-node-pairing-corrupt-"

71 (number->string (current-jiffy)))))

72 (ensure-directory dir)

73 (write-file-string (pairing-records-path dir) "{not json")

74 (assert-false (pairing-load-records dir))))

76 (test "permission failure is fatal"

77 (assert-error (pairing-require-mode! "/tmp/x" "600"

78 exists?: (lambda (name) #f) run: (lambda args 0))))

80 (test "public output is reconstructed without private material or endpoints"

81 (let* ((identity (pairing-make-identity 1 100))

82 (summary (pairing-public-summary identity))

83 (rendered (json-encode summary)))

84 (assert-false (string-contains? rendered (dict-ref identity private-key: "")))

85 (assert-false (dict-ref summary private-key: #f)))))