Add packaged DLP broker and protected Windows service foundation

tests/request-audit.test.mjs

@@ -41,3 +41,12 @@ test('central API accepts typed broker causation and rejects invalid lifecycle s
  for(const broker of [{...fault.broker,authorizedEventId:undefined},{...fault.broker,authorizedEventId:fault.eventId},{...allow.broker,phase:'connect.block'},{...allow.broker,reason:'arbitrary secret details'},{...allow.broker,body:'private'}])assert.equal((await send({...fault,eventId:broker.authorizedEventId===fault.eventId?fault.eventId:randomUUID(),broker})).status,400);
  const rows=store.db.prepare('SELECT metadata FROM events ORDER BY id').all();assert.equal(rows.length,2);assert.deepEqual(JSON.parse(rows[1].metadata).broker,fault.broker);assert.equal(store.auditIntegrity.verify().valid,true);
 });
+
+test('central typed download audit retains genuine file hash and requires causal request authorization',async t=>{
+ const dir=mkdtempSync(join(tmpdir(),'safetynet-request-audit-')),store=openStore(dir),credential='synthetic-device-download-broker-token';store.db.prepare('INSERT INTO devices(id,name,token_hash) VALUES(?,?,?)').run('download-broker','Synthetic',digest(credential));
+ const server=createApp(store,{publicUrl:'http://127.0.0.1',adminToken:'synthetic-administrator-token-123456789',secure:false}).listen(0,'127.0.0.1');await new Promise(r=>server.once('listening',r));t.after(async()=>{server.closeAllConnections();await new Promise(r=>server.close(r));store.db.close();rmSync(dir,{recursive:true,force:true});});
+ const send=event=>fetch(`http://127.0.0.1:${server.address().port}/api/device/events`,{method:'POST',headers:{authorization:`Bearer ${credential}`,'content-type':'application/json'},body:JSON.stringify(event)});
+ const event={eventId:randomUUID(),policyVersion:1,kind:'download.block',ruleId:'registered-document',file:{bytes:613,detectedType:'pdf',sha256:digest('synthetic real PDF bytes')},broker:{requestId:randomUUID(),authorizedEventId:randomUUID(),phase:'response.block',reason:'broker-download-inspection-block'}};assert.equal((await send(event)).status,200);
+ for(const value of [{...event,eventId:randomUUID(),request:{bytes:613,detectedType:'pdf'}},{...event,eventId:randomUUID(),file:undefined},{...event,eventId:randomUUID(),broker:{...event.broker,authorizedEventId:undefined}},{...event,eventId:randomUUID(),broker:{...event.broker,phase:'request.block'}}])assert.equal((await send(value)).status,400);
+ const stored=JSON.parse(store.db.prepare('SELECT metadata FROM events').get().metadata);assert.deepEqual(stored.file,event.file);assert.deepEqual(stored.broker,event.broker);assert.equal(store.auditIntegrity.verify().valid,true);
+});