buzz/crates/buzz-auth/src/nip_fi/startup/tests.rs

use super::*;
use crate::nip_fi::config::{FreshnessClass, IssuerPolicy, IssuerRegistry, TokenClass};
use crate::nip_fi::jwks::{IssuerJwksConfig, JwksSourceContract};
use jsonwebtoken::Algorithm as JwtAlgorithm;

fn test_contract(issuer: &str) -> JwksSourceContract {
    // Build a canonical JWKS URI from the issuer URL. The issuer may already
    // be a full HTTPS URL (e.g. "https://id.example") or a bare hostname.
    let uri = if issuer.starts_with("https://") {
        format!("{}/.well-known/jwks.json", issuer.trim_end_matches('/'))
    } else {
        format!("https://{}/.well-known/jwks.json", issuer)
    };
    JwksSourceContract::new(uri, 300, 3600).expect("valid test contract")
}

fn make_offline_policy(issuer: &str) -> IssuerPolicy {
    IssuerPolicy::new(
        issuer.to_owned(),
        vec![format!("https://relay.example/api")],
        TokenClass::DedicatedNipFi,
        FreshnessClass::OfflineJwt,
        vec![JwtAlgorithm::ES256],
        0,
        3600,
        None,
        test_contract(issuer),
    )
    .unwrap()
}

fn make_status_policy(issuer: &str) -> IssuerPolicy {
    IssuerPolicy::new(
        issuer.to_owned(),
        vec![format!("https://relay.example/api")],
        TokenClass::DedicatedNipFi,
        FreshnessClass::CurrentStatus,
        vec![JwtAlgorithm::ES256],
        0,
        3600,
        Some(60),
        test_contract(issuer),
    )
    .unwrap()
}

fn make_jwks_config(issuer: &str) -> IssuerJwksConfig {
    IssuerJwksConfig {
        issuer: issuer.to_owned(),
        contract: test_contract(issuer),
    }
}

#[test]
fn off_mode_accepts_empty_registry() {
    let registry = IssuerRegistry::new();
    assert!(validate_nip_fi_config(NipFiMode::Off, &registry, &[]).is_ok());
}

#[test]
fn deny_protected_mode_accepts_empty_registry() {
    let registry = IssuerRegistry::new();
    assert!(validate_nip_fi_config(NipFiMode::DenyProtected, &registry, &[]).is_ok());
}

#[test]
fn enforce_valid_config_passes() {
    let issuer = "https://id.example";
    let mut registry = IssuerRegistry::new();
    registry.insert(make_offline_policy(issuer));

    assert!(
        validate_nip_fi_config(NipFiMode::Enforce, &registry, &[make_jwks_config(issuer)]).is_ok()
    );
}

#[test]
fn enforce_multiple_issuers_passes() {
    let issuers = [
        "https://a.example",
        "https://b.example",
        "https://c.example",
    ];
    let mut registry = IssuerRegistry::new();
    for iss in &issuers {
        registry.insert(make_offline_policy(iss));
    }
    let jwks: Vec<_> = issuers.iter().map(|i| make_jwks_config(i)).collect();
    assert!(validate_nip_fi_config(NipFiMode::Enforce, &registry, &jwks).is_ok());
}

#[test]
fn enforce_empty_registry_rejects() {
    let registry = IssuerRegistry::new();
    let err = validate_nip_fi_config(NipFiMode::Enforce, &registry, &[]).unwrap_err();
    assert_eq!(err, NipFiStartupError::EmptyRegistry);
}

#[test]
fn enforce_issuer_without_jwks_rejects() {
    let issuer = "https://id.example";
    let mut registry = IssuerRegistry::new();
    registry.insert(make_offline_policy(issuer));

    let err = validate_nip_fi_config(NipFiMode::Enforce, &registry, &[]).unwrap_err();
    assert_eq!(err, NipFiStartupError::MissingJwksConfig);
}

#[test]
fn enforce_unmatched_jwks_config_rejects() {
    let issuer = "https://id.example";
    let mut registry = IssuerRegistry::new();
    registry.insert(make_offline_policy(issuer));

    let err = validate_nip_fi_config(
        NipFiMode::Enforce,
        &registry,
        &[make_jwks_config("https://other.example")],
    )
    .unwrap_err();
    assert_eq!(err, NipFiStartupError::UnmatchedJwksConfig);
}

/// A JWKS config whose contract differs from the policy contract must be
/// rejected — a mismatch means two independent copies of URI/timing have
/// drifted, violating the single-source-of-truth invariant.
#[test]
fn enforce_jwks_contract_mismatch_rejects() {
    let issuer = "https://id.example";
    let mut registry = IssuerRegistry::new();
    registry.insert(make_offline_policy(issuer));

    // Config carries a different refresh interval than the policy (300 vs 600).
    let mismatched_config = IssuerJwksConfig {
        issuer: issuer.to_owned(),
        contract: JwksSourceContract::new(
            format!("{}/.well-known/jwks.json", issuer.trim_end_matches('/')),
            600, // differs from policy contract (300)
            3600,
        )
        .unwrap(),
    };
    assert_eq!(
        validate_nip_fi_config(NipFiMode::Enforce, &registry, &[mismatched_config]).unwrap_err(),
        NipFiStartupError::JwksContractMismatch
    );
}

#[test]
fn enforce_policy_and_jwks_source_contract_mismatch_rejects() {
    let issuer = "https://id.example";
    let mesh_contract = JwksSourceContract::new_mesh(
        "http://mesh.example.test/.well-known/jwks.json".to_owned(),
        300,
        3600,
    )
    .expect("valid mesh contract");
    let mesh_policy = IssuerPolicy::new(
        issuer.to_owned(),
        vec!["https://relay.example/api".to_owned()],
        TokenClass::DedicatedNipFi,
        FreshnessClass::OfflineJwt,
        vec![JwtAlgorithm::ES256],
        0,
        3600,
        None,
        mesh_contract,
    )
    .expect("valid mesh policy");
    let mut registry = IssuerRegistry::new();
    registry.insert(mesh_policy);

    let error = validate_nip_fi_config(NipFiMode::Enforce, &registry, &[make_jwks_config(issuer)])
        .expect_err("policy and JWKS source contracts must match");
    assert_eq!(error, NipFiStartupError::JwksContractMismatch);
}

/// Rejected regardless of whether a JWKS config is present — the verifier
/// has no status witness to satisfy the freshness guarantee.
#[test]
fn enforce_current_status_policy_always_rejects() {
    let issuer = "https://id.example";
    let mut registry = IssuerRegistry::new();
    registry.insert(make_status_policy(issuer));

    assert_eq!(
        validate_nip_fi_config(NipFiMode::Enforce, &registry, &[]).unwrap_err(),
        NipFiStartupError::UnsupportedPosture
    );
    assert_eq!(
        validate_nip_fi_config(NipFiMode::Enforce, &registry, &[make_jwks_config(issuer)])
            .unwrap_err(),
        NipFiStartupError::UnsupportedPosture
    );
}

/// Duplicate JWKS configs for the same issuer must not silently succeed.
#[test]
fn enforce_duplicate_jwks_issuer_in_configs_rejects() {
    let issuer = "https://id.example";
    let mut registry = IssuerRegistry::new();
    registry.insert(make_offline_policy(issuer));

    let jwks = vec![make_jwks_config(issuer), make_jwks_config(issuer)];
    assert!(
        validate_nip_fi_config(NipFiMode::Enforce, &registry, &jwks).is_err(),
        "duplicate JWKS configs must not pass"
    );
}

#[test]
fn shadow_mode_validates_like_enforce() {
    let issuer = "https://id.example";
    let mut registry = IssuerRegistry::new();
    assert_eq!(
        validate_nip_fi_config(NipFiMode::Shadow, &registry, &[]).unwrap_err(),
        NipFiStartupError::EmptyRegistry
    );
    registry.insert(make_offline_policy(issuer));
    assert_eq!(
        validate_nip_fi_config(NipFiMode::Shadow, &registry, &[]).unwrap_err(),
        NipFiStartupError::MissingJwksConfig
    );
    assert!(
        validate_nip_fi_config(NipFiMode::Shadow, &registry, &[make_jwks_config(issuer)]).is_ok()
    );
}

#[test]
fn mode_predicates_separate_evaluation_from_authority() {
    // (mode, restricts, evaluates): Shadow is the only mode that evaluates
    // evidence without the verdict affecting admission.
    for (mode, restricts, evaluates) in [
        (NipFiMode::Off, false, false),
        (NipFiMode::Enforce, true, true),
        (NipFiMode::DenyProtected, true, false),
        (NipFiMode::Shadow, false, true),
    ] {
        assert_eq!(mode.restricts(), restricts, "{mode:?} restricts");
        assert_eq!(mode.evaluates(), evaluates, "{mode:?} evaluates");
        assert_eq!(mode.enforces(), restricts && evaluates, "{mode:?} enforces");
        assert_eq!(
            mode.denies_unconditionally(),
            restricts && !evaluates,
            "{mode:?}"
        );
        assert_eq!(mode.observes_only(), evaluates && !restricts, "{mode:?}");
    }
}