first commit

tests/policy-assignment.test.mjs

@@ -0,0 +1,17 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createRequire} from 'node:module';
+import {generateKeyPairSync} from 'node:crypto';
+import {defaultPolicy,signPolicy,verifyPolicy} from '../packages/core/policy.mjs';
+const {assertPolicyAssignment}=createRequire(import.meta.url)('../apps/browser/policy-assignment.cjs');
+test('signed effective policy cannot be reused for another enrolled device',()=>{
+  const a='00000000-0000-4000-8000-000000000001',b='00000000-0000-4000-8000-000000000002';
+  const keys=generateKeyPairSync('ed25519');
+  const privateKey=keys.privateKey.export({type:'pkcs8',format:'pem'}),publicKey=keys.publicKey.export({type:'spki',format:'pem'});
+  const p={...defaultPolicy(),assignment:{deviceId:a,groups:[]}};
+  const verified=verifyPolicy(signPolicy(p,privateKey),publicKey);
+  assert.equal(assertPolicyAssignment(verified,a),verified);
+  assert.throws(()=>assertPolicyAssignment(verified,b),/device assignment rejected/);
+  const legacy=verifyPolicy(signPolicy(defaultPolicy(),privateKey),publicKey);
+  assert.equal(assertPolicyAssignment(legacy,a),legacy);
+});