safetynet/tests/evidence-policy.test.mjs

import test from 'node:test';
import assert from 'node:assert/strict';
import {defaultPolicy,PolicySchema,signPolicy,verifyPolicy} from '../packages/core/policy.mjs';
import {generateKeyPairSync} from 'node:crypto';
import {openStore} from '../apps/server/store.mjs';
import {createApp} from '../apps/server/app.mjs';
import {mkdtempSync,rmSync} from 'node:fs';
import {tmpdir} from 'node:os';
import {join} from 'node:path';
test('evidence controls default off, reject unknown settings and are bound to the policy signature',()=>{
 const p=defaultPolicy();assert.deepEqual(p.evidence,{enabled:false,captureDownloads:false,captureInteractions:false});assert.equal(PolicySchema.safeParse({...p,evidence:{enabled:true,captureDownloads:true,fullFiles:true}}).success,false);
 const keys=generateKeyPairSync('ed25519'),publicKey=keys.publicKey.export({type:'spki',format:'pem'});p.evidence={enabled:true,captureDownloads:true};const envelope=signPolicy(p,keys.privateKey.export({type:'pkcs8',format:'pem'}));assert.equal(verifyPolicy(envelope,publicKey).evidence.captureDownloads,true);p.evidence.enabled=false;envelope.payload=Buffer.from(JSON.stringify(p)).toString('base64url');assert.throws(()=>verifyPolicy(envelope,publicKey));
});
test('central policy publication cannot enable unconfigured evidence storage',async t=>{
 const dir=mkdtempSync(join(tmpdir(),'safetynet-evidence-policy-')),store=openStore(dir),adminToken='synthetic-evidence-policy-admin-123456789';const server=createApp(store,{publicUrl:'http://127.0.0.1',secure:false,adminToken}).listen(0,'127.0.0.1');await new Promise(r=>server.once('listening',r));t.after(async()=>{server.closeAllConnections();await new Promise(r=>server.close(r));store.db.close();assert.ok(dir.startsWith(join(tmpdir(),'safetynet-evidence-policy-')));rmSync(dir,{recursive:true,force:true});});
 const p=store.get('policy');p.version++;p.evidence={enabled:true,captureDownloads:true};const response=await fetch(`http://127.0.0.1:${server.address().port}/api/admin/policy`,{method:'PUT',headers:{authorization:`Bearer ${adminToken}`,'content-type':'application/json'},body:JSON.stringify(p)});assert.equal(response.status,400);assert.equal(store.get('policy').evidence.enabled,false);assert.equal(store.get('policy').version,1);
});