coreci-chat/packages/secrets/tests/relay-token.test.ts

/**
 * Relay registration token contract tests (G-005).
 *
 * Verifies: sign/verify round-trip, expired rejection, tampered signature
 * rejection, tampered payload rejection, malformed token rejection.
 */

import { describe, it, expect } from "vitest";
import {
  signRelayToken,
  verifyRelayToken,
  issueRelayToken,
  RelayTokenError,
  type RelayTokenPayload,
} from "../src/index.js";

const TENANT = "00000000-0000-0000-0000-000000000001";
const SIGNING_KEY = "relay-signing-key-dev-only-not-a-tenant-secret";

describe("relay token (G-005)", () => {
  it("sign then verify round-trips the claims", () => {
    const token = issueRelayToken(TENANT, SIGNING_KEY);
    const claims = verifyRelayToken(token, SIGNING_KEY);
    expect(claims.tenantId).toBe(TENANT);
    expect(claims.scope).toBe("relay.register");
    expect(typeof claims.iat).toBe("number");
    expect(typeof claims.exp).toBe("number");
    expect(claims.exp).toBeGreaterThan(claims.iat);
    expect(claims.exp - claims.iat).toBe(24 * 60 * 60);
  });

  it("respects a custom lifetime", () => {
    const token = issueRelayToken(TENANT, SIGNING_KEY, 1);
    const claims = verifyRelayToken(token, SIGNING_KEY);
    expect(claims.exp - claims.iat).toBe(60 * 60);
  });

  it("signRelayToken builds the standard 3-segment shape", () => {
    const now = Math.floor(Date.now() / 1000);
    const payload: RelayTokenPayload = {
      tenantId: TENANT,
      scope: "relay.register",
      iat: now,
      exp: now + 60,
    };
    const token = signRelayToken(payload, SIGNING_KEY);
    expect(token.split(".")).toHaveLength(3);
  });

  it("rejects an expired token", () => {
    const now = Math.floor(Date.now() / 1000);
    const payload: RelayTokenPayload = {
      tenantId: TENANT,
      scope: "relay.register",
      iat: now - 120,
      exp: now - 60,
    };
    const token = signRelayToken(payload, SIGNING_KEY);
    expect(() => verifyRelayToken(token, SIGNING_KEY)).toThrow(RelayTokenError);
    expect(() => verifyRelayToken(token, SIGNING_KEY)).toThrow(/expired/);
  });

  it("rejects a tampered signature", () => {
    const token = issueRelayToken(TENANT, SIGNING_KEY);
    const parts = token.split(".");
    const tamperedSig = Buffer.from(parts[2]!, "base64url");
    tamperedSig[0] = tamperedSig[0]! ^ 0xff;
    const tampered = `${parts[0]}.${parts[1]}.${tamperedSig.toString("base64url")}`;
    expect(() => verifyRelayToken(tampered, SIGNING_KEY)).toThrow(RelayTokenError);
    expect(() => verifyRelayToken(tampered, SIGNING_KEY)).toThrow(/invalid signature/);
  });

  it("rejects a signature verified with the wrong key", () => {
    const token = issueRelayToken(TENANT, SIGNING_KEY);
    expect(() => verifyRelayToken(token, "wrong-key")).toThrow(RelayTokenError);
    expect(() => verifyRelayToken(token, "wrong-key")).toThrow(/invalid signature/);
  });

  it("rejects a tampered payload (signature no longer matches)", () => {
    const token = issueRelayToken(TENANT, SIGNING_KEY);
    const parts = token.split(".");
    const payload = JSON.parse(Buffer.from(parts[1]!, "base64url").toString("utf8")) as RelayTokenPayload;
    payload.tenantId = "00000000-0000-0000-0000-000000000002";
    const tamperedPayload = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
    const tampered = `${parts[0]}.${tamperedPayload}.${parts[2]}`;
    expect(() => verifyRelayToken(tampered, SIGNING_KEY)).toThrow(RelayTokenError);
    expect(() => verifyRelayToken(tampered, SIGNING_KEY)).toThrow(/invalid signature/);
  });

  it("rejects a token with an unexpected scope", () => {
    const now = Math.floor(Date.now() / 1000);
    const payload = {
      tenantId: TENANT,
      scope: "wrong.scope",
      iat: now,
      exp: now + 60,
    } as unknown as RelayTokenPayload;
    const token = signRelayToken(payload, SIGNING_KEY);
    expect(() => verifyRelayToken(token, SIGNING_KEY)).toThrow(RelayTokenError);
    expect(() => verifyRelayToken(token, SIGNING_KEY)).toThrow(/unexpected scope/);
  });

  it("rejects a malformed token (not 3 segments)", () => {
    expect(() => verifyRelayToken("not.a.valid-shape-extra.part", SIGNING_KEY)).toThrow(RelayTokenError);
    expect(() => verifyRelayToken("onlyone", SIGNING_KEY)).toThrow(RelayTokenError);
    expect(() => verifyRelayToken("", SIGNING_KEY)).toThrow(RelayTokenError);
  });

  it("rejects a token with a non-HS256 alg", () => {
    const headerB64 = Buffer.from(JSON.stringify({ alg: "none", typ: "JWT" }), "utf8").toString("base64url");
    const now = Math.floor(Date.now() / 1000);
    const payloadB64 = Buffer.from(
      JSON.stringify({ tenantId: TENANT, scope: "relay.register", iat: now, exp: now + 60 }),
      "utf8",
    ).toString("base64url");
    const fakeSig = Buffer.from("fake").toString("base64url");
    const token = `${headerB64}.${payloadB64}.${fakeSig}`;
    expect(() => verifyRelayToken(token, SIGNING_KEY)).toThrow(RelayTokenError);
    expect(() => verifyRelayToken(token, SIGNING_KEY)).toThrow(/unexpected alg/);
  });
});