18 lines
1.1 KiB
JavaScript
18 lines
1.1 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {createRequire} from 'node:module';
|
|
import {generateKeyPairSync} from 'node:crypto';
|
|
import {defaultPolicy,signPolicy,verifyPolicy} from '../packages/core/policy.mjs';
|
|
const {assertPolicyAssignment}=createRequire(import.meta.url)('../apps/browser/policy-assignment.cjs');
|
|
test('signed effective policy cannot be reused for another enrolled device',()=>{
|
|
const a='00000000-0000-4000-8000-000000000001',b='00000000-0000-4000-8000-000000000002';
|
|
const keys=generateKeyPairSync('ed25519');
|
|
const privateKey=keys.privateKey.export({type:'pkcs8',format:'pem'}),publicKey=keys.publicKey.export({type:'spki',format:'pem'});
|
|
const p={...defaultPolicy(),assignment:{deviceId:a,groups:[]}};
|
|
const verified=verifyPolicy(signPolicy(p,privateKey),publicKey);
|
|
assert.equal(assertPolicyAssignment(verified,a),verified);
|
|
assert.throws(()=>assertPolicyAssignment(verified,b),/device assignment rejected/);
|
|
const legacy=verifyPolicy(signPolicy(defaultPolicy(),privateKey),publicKey);
|
|
assert.equal(assertPolicyAssignment(legacy,a),legacy);
|
|
});
|