50 lines
2.2 KiB
JavaScript
50 lines
2.2 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { readFile } from "node:fs/promises";
|
|
import test from "node:test";
|
|
|
|
const schemaUrl = new URL(
|
|
"../migrations/008_device_sensitive_references.sql",
|
|
import.meta.url,
|
|
);
|
|
const commandsUrl = new URL(
|
|
"../migrations/009_device_sensitive_reference_commands.sql",
|
|
import.meta.url,
|
|
);
|
|
const repositoryUrl = new URL("../src/postgres-repository.mjs", import.meta.url);
|
|
|
|
test("sensitive reference schema stores only digest, mask and canonical refs", async () => {
|
|
const sql = await readFile(schemaUrl, "utf8");
|
|
|
|
assert.match(sql, /create table if not exists device_restricted_identifiers/);
|
|
assert.match(sql, /identifier_digest text not null/);
|
|
assert.match(sql, /identifier_masked text not null/);
|
|
assert.match(sql, /device_restricted_identifiers_active_identity_idx/);
|
|
assert.match(sql, /device_restricted_identifiers_primary_idx/);
|
|
assert.match(sql, /device_identifier_ownership_mismatch/);
|
|
assert.match(sql, /device_active_identifier_ownership_mismatch/);
|
|
assert.match(sql, /deferrable initially deferred/);
|
|
assert.match(sql, /create table if not exists device_credential_bindings/);
|
|
assert.match(sql, /credential_owner = 'ndc_l2_credentials'/);
|
|
assert.match(sql, /\^ndc-credref:/);
|
|
assert.match(sql, /device_credential_binding_ownership_mismatch/);
|
|
assert.match(sql, /device_transfer_active_credential_binding/);
|
|
assert.match(sql, /owner_scope_id is null or credential_ref is null/);
|
|
assert.doesNotMatch(sql, /imei\s+text|serial\s+text|password\s+text|token\s+text/i);
|
|
assert.doesNotMatch(sql, /insert\s+into/i);
|
|
});
|
|
|
|
test("credential commands extend durable receipts after their schema", async () => {
|
|
const commands = await readFile(commandsUrl, "utf8");
|
|
const repository = await readFile(repositoryUrl, "utf8");
|
|
|
|
assert.match(commands, /'device_credential_binding\.upsert'/);
|
|
assert.match(commands, /'device_credential_binding\.revoke'/);
|
|
const schemaIndex = repository.indexOf("008_device_sensitive_references.sql");
|
|
const commandsIndex = repository.indexOf(
|
|
"009_device_sensitive_reference_commands.sql",
|
|
);
|
|
assert.notEqual(schemaIndex, -1);
|
|
assert.notEqual(commandsIndex, -1);
|
|
assert.ok(schemaIndex < commandsIndex);
|
|
});
|