From 06ff6346dc666fd524e59d7325ad16c1a1384808 Mon Sep 17 00:00:00 2001 From: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com> Date: Tue, 4 Aug 2026 14:46:38 -0500 Subject: [PATCH] test(auth): align authorization fixtures Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com> --- crates/buzz-auth/src/finalization.rs | 85 ++++++++++++++++++-------- crates/buzz-auth/src/provider/tests.rs | 12 +++- 2 files changed, 71 insertions(+), 26 deletions(-) diff --git a/crates/buzz-auth/src/finalization.rs b/crates/buzz-auth/src/finalization.rs index d67c013d6e..d3842894ec 100644 --- a/crates/buzz-auth/src/finalization.rs +++ b/crates/buzz-auth/src/finalization.rs @@ -417,9 +417,10 @@ mod tests { use crate::{ context::{ AssertionExpiry, AssertionTransport, AuthContextVersion, AuthMethod, AuthTransport, + AuthoritativeBindingEvidence, AuthoritativeBindingResolution, AuthorizedCommunityAccess, BindingSource, DelegationExpiry, EnrollmentMode, - VerifiedFederatedAssertion, VerifiedKeyAttestation, VerifiedNostrProof, - VerifiedTransportDelegation, + FederatedPolicyStamp, VerifiedFederatedAssertion, VerifiedKeyAttestation, + VerifiedNostrProof, VerifiedTransportDelegation, }, lease::{ ApplicationLeaseLimit, AuthorizationClock, AuthorizationClockSkew, @@ -454,6 +455,12 @@ mod tests { } } + impl crate::provider::AuthorizationClock for FixedClock { + fn now_unix_seconds(&self) -> Option { + Some(self.0.load(Ordering::SeqCst)) + } + } + struct AllowProvider { issued_at: u64, fresh_until: u64, @@ -471,7 +478,7 @@ mod tests { let allow = ProviderAllow::new( request.authorization_domain(), request.principal().clone(), - request.profile_id().clone(), + self.profile_id(), request.requested_capabilities().clone(), PolicyVersion::new("policy.synthetic.example") .expect("synthetic policy version is valid"), @@ -492,6 +499,24 @@ mod tests { .expect("synthetic profile is valid") } + fn required_policy( + correlation_id: Uuid, + enrollment_mode: EnrollmentMode, + ) -> ResolvedFederatedPolicy { + ResolvedFederatedPolicy::from_authoritative_resolution( + FederatedPolicyStamp::from_authoritative_state( + domain(), + Uuid::from_u128(0x40), + 1, + correlation_id, + FederatedIdentityRequirement::Required(enrollment_mode), + 1, + u64::MAX, + ) + .expect("synthetic federated policy lineage is valid"), + ) + } + struct DirectFixture { input: AuthContextInput, policy: ResolvedFederatedPolicy, @@ -532,6 +557,7 @@ mod tests { principal, actor, binding_version, + None, BindingSource::AttestedKey, ) .expect("synthetic binding is valid"); @@ -546,10 +572,7 @@ mod tests { proof, AuthorizedCommunityAccess::new(domain(), vec![Scope::MessagesRead], None), ), - policy: ResolvedFederatedPolicy::server_resolved_required( - domain(), - EnrollmentMode::AttestedKey, - ), + policy: required_policy(Uuid::from_u128(0x300), EnrollmentMode::AttestedKey), authorization: FederatedAuthorization::Direct { binding, assertion }, binding_bound, binding_id, @@ -560,7 +583,7 @@ mod tests { async fn direct_snapshot( fixture: &DirectFixture, - profile: AuthorizationProfileId, + clock: &FixedClock, provider_fresh_until: u64, ) -> Box { let FederatedAuthorization::Direct { assertion, .. } = &fixture.authorization else { @@ -569,7 +592,7 @@ mod tests { let request = AuthorizationRequest::direct( fixture.input.nostr_proof(), assertion, - profile, + required_policy(fixture.input.correlation_id(), EnrollmentMode::AttestedKey), CapabilitySet::single(AuthorizationCapability::CommunityRead), fixture.input.correlation_id(), 1_000, @@ -581,8 +604,9 @@ mod tests { fresh_until: provider_fresh_until, }, &request, - 1_000, + clock, ProviderTimeout::new(Duration::from_secs(1)).expect("synthetic timeout is valid"), + Uuid::from_u128(0x600), ) .await; match outcome { @@ -605,7 +629,7 @@ mod tests { let finalizer = AuthorizationFinalizer::new(clock.clone()); let expected_profile = profile(); let fixture = direct_fixture(1_500, 1_400); - let snapshot = direct_snapshot(&fixture, expected_profile.clone(), 1_300).await; + let snapshot = direct_snapshot(&fixture, clock.as_ref(), 1_300).await; let context = finalizer .finalize_access( fixture.input, @@ -660,7 +684,7 @@ mod tests { let actor = fixture.actor_pubkey; let binding_id = fixture.binding_id; let binding_version = fixture.binding_version; - let snapshot = direct_snapshot(&fixture, expected_profile.clone(), 1_300).await; + let snapshot = direct_snapshot(&fixture, clock.as_ref(), 1_300).await; let context = finalizer .finalize_access( fixture.input, @@ -708,7 +732,7 @@ mod tests { let fixture = direct_fixture(1_500, 1_400); let actor = fixture.actor_pubkey; let binding_version = fixture.binding_version; - let snapshot = direct_snapshot(&fixture, expected_profile.clone(), 1_300).await; + let snapshot = direct_snapshot(&fixture, clock.as_ref(), 1_300).await; let context = finalizer .finalize_access( fixture.input, @@ -750,7 +774,7 @@ mod tests { let actor = fixture.actor_pubkey; let binding_id = fixture.binding_id; let binding_version = fixture.binding_version; - let snapshot = direct_snapshot(&fixture, expected_profile.clone(), 1_300).await; + let snapshot = direct_snapshot(&fixture, clock.as_ref(), 1_300).await; let context = finalizer .finalize_access( fixture.input, @@ -795,7 +819,7 @@ mod tests { let actor = fixture.actor_pubkey; let binding_id = fixture.binding_id; let binding_version = fixture.binding_version; - let snapshot = direct_snapshot(&fixture, expected_profile.clone(), 1_300).await; + let snapshot = direct_snapshot(&fixture, clock.as_ref(), 1_300).await; let context = finalizer .finalize_access( fixture.input, @@ -847,7 +871,7 @@ mod tests { let finalizer = AuthorizationFinalizer::new(clock.clone()); let expected_profile = profile(); let fixture = direct_fixture(1_500, 1_400); - let snapshot = direct_snapshot(&fixture, expected_profile.clone(), 1_300).await; + let snapshot = direct_snapshot(&fixture, clock.as_ref(), 1_300).await; let status = finalizer .finalize_verification_only( fixture.input, @@ -875,7 +899,7 @@ mod tests { let finalizer = AuthorizationFinalizer::new(clock.clone()); let expected_profile = profile(); let fixture = direct_fixture(1_500, 1_400); - let snapshot = direct_snapshot(&fixture, expected_profile.clone(), 1_300).await; + let snapshot = direct_snapshot(&fixture, clock.as_ref(), 1_300).await; let context = finalizer .finalize_access( fixture.input, @@ -920,7 +944,7 @@ mod tests { #[tokio::test] async fn delegated_lease_is_bounded_by_delegation_and_owner_binding() { let clock = Arc::new(FixedClock::new(1_000)); - let finalizer = AuthorizationFinalizer::new(clock); + let finalizer = AuthorizationFinalizer::new(clock.clone()); let expected_profile = profile(); let owner = Keys::generate().public_key(); let delegate = Keys::generate().public_key(); @@ -956,13 +980,26 @@ mod tests { principal.clone(), owner, binding_version, + None, BindingSource::Provisioned, ) .expect("synthetic owner binding is valid"); + let owner_resolution = AuthoritativeBindingResolution::existing_active( + AuthoritativeBindingEvidence::new( + domain(), + binding_id, + principal, + owner, + binding_version, + None, + BindingSource::Provisioned, + ) + .expect("synthetic owner binding resolution is valid"), + ); let request = AuthorizationRequest::delegated( &proof, - &owner_binding, - expected_profile.clone(), + &owner_resolution, + required_policy(Uuid::from_u128(0x500), EnrollmentMode::Provisioned), CapabilitySet::single(AuthorizationCapability::CommunityWrite), Uuid::from_u128(0x500), 1_000, @@ -974,8 +1011,9 @@ mod tests { fresh_until: 1_300, }, &request, - 1_000, + clock.as_ref(), ProviderTimeout::new(Duration::from_secs(1)).expect("synthetic timeout is valid"), + Uuid::from_u128(0x600), ) .await { @@ -1001,10 +1039,7 @@ mod tests { let context = finalizer .finalize_access( input, - ResolvedFederatedPolicy::server_resolved_required( - domain(), - EnrollmentMode::Provisioned, - ), + required_policy(Uuid::from_u128(0x500), EnrollmentMode::Provisioned), authorization, snapshot, &expected_profile, diff --git a/crates/buzz-auth/src/provider/tests.rs b/crates/buzz-auth/src/provider/tests.rs index fd0f799811..f64273d52b 100644 --- a/crates/buzz-auth/src/provider/tests.rs +++ b/crates/buzz-auth/src/provider/tests.rs @@ -1838,8 +1838,18 @@ async fn delegated_owner_admission_does_not_require_owner_assertion() { assert_eq!(snapshot.binding_id(), Some(Uuid::from_u128(10))); assert_eq!(snapshot.binding_version(), Some(BindingVersion::INITIAL)); assert_eq!(snapshot.transport(), AuthTransport::RelayWebSocket); + let owner_binding = VersionedBindingRef::new_existing_active_for_test( + domain(1), + Uuid::from_u128(10), + principal(), + owner.public_key(), + BindingVersion::INITIAL, + None, + BindingSource::Provisioned, + ) + .expect("synthetic owner binding is valid"); let admission = snapshot - .verified_owner_admission(&existing_binding(&owner)) + .verified_owner_admission(&owner_binding) .expect("delegated snapshot matches the exact owner binding"); assert_eq!(admission.authorization_domain(), domain(1)); assert_eq!(admission.principal(), request.principal());