28 lines
2.3 KiB
JavaScript
28 lines
2.3 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {createRequire} from 'node:module';
|
|
import {randomUUID} from 'node:crypto';
|
|
import {spawnSync} from 'node:child_process';
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
const require=createRequire(import.meta.url);
|
|
const {createBrokerAuditPersistence}=require('../apps/browser/broker-audit-persistence.cjs');
|
|
const enabled=process.platform==='win32'&&process.env.SAFETYNET_NATIVE_BROKER_AUDIT==='1';
|
|
test('actual Windows DPAPI encrypted commit preserves broker identity before receipt',{skip:!enabled},()=>{
|
|
const root=path.resolve('artifacts/broker-parent-audit');fs.mkdirSync(root,{recursive:true});
|
|
const directory=fs.mkdtempSync(path.join(root,'proof-'));
|
|
const python=path.resolve('.runtime/windows/python/python.exe'),helper=path.resolve('apps/inspector/dpapi.py');
|
|
const convert=(action,input)=>{const result=spawnSync(python,[helper,action],{input,windowsHide:true,timeout:10000,maxBuffer:65536});assert.equal(result.status,0,'Private Windows DPAPI operation failed');return result.stdout;};
|
|
const queue=[],file=path.join(directory,'queue.bin'),temporary=path.join(directory,'queue.tmp');let committed=false;
|
|
const sink=createBrokerAuditPersistence({policyVersion:4,current:()=>true,getQueue:()=>queue,onFailure:()=>assert.fail('Parent audit was quarantined'),persistQueue:()=>{
|
|
const protectedBytes=convert('protect',Buffer.from(JSON.stringify(queue)));
|
|
const fd=fs.openSync(temporary,'wx',0o600);try{fs.writeFileSync(fd,protectedBytes);fs.fsyncSync(fd);}finally{fs.closeSync(fd);}
|
|
fs.renameSync(temporary,file);committed=true;
|
|
}});
|
|
const input={eventId:randomUUID(),kind:'upload.authorized',ruleId:'broker-approved',policyVersion:4,request:{bytes:6,detectedType:'text'}};
|
|
const receipt=sink.persist(input);assert.equal(committed,true);assert.equal(receipt.eventId,input.eventId);
|
|
const encrypted=fs.readFileSync(file);assert.equal(encrypted.includes(Buffer.from(input.eventId)),false);
|
|
const decrypted=convert('unprotect',encrypted);try{assert.deepEqual(JSON.parse(decrypted.toString()),[input]);}finally{decrypted.fill(0);}
|
|
fs.writeFileSync(path.join(directory,'proof.json'),JSON.stringify({outcome:'passed',nativeProtection:'Windows current-user DPAPI',fsyncBeforeReceipt:true,identityPreserved:true,plaintextIdentityAbsent:true,productionMainWired:false},null,2)+'\n');
|
|
});
|