test signatures in IdentityKeyCreatorTest

Author: vaf-hub

test/tests/api/worker/facades/IdentityKeyCreatorTest.ts

@@ -2,7 +2,7 @@ import o from "../../../../../packages/otest/dist/otest.js"
 import { UserFacade } from "../../../../../src/common/api/worker/facades/UserFacade.js"
 import { EntityClient } from "../../../../../src/common/api/common/EntityClient.js"
 import { IServiceExecutor } from "../../../../../src/common/api/common/ServiceRequest.js"
-import { KeyLoaderFacade } from "../../../../../src/common/api/worker/facades/KeyLoaderFacade.js"
+import { checkKeyVersionConstraints, KeyLoaderFacade } from "../../../../../src/common/api/worker/facades/KeyLoaderFacade.js"
 import { CacheManagementFacade } from "../../../../../src/common/api/worker/facades/lazy/CacheManagementFacade.js"
 import { AsymmetricCryptoFacade } from "../../../../../src/common/api/worker/crypto/AsymmetricCryptoFacade.js"
 import { matchers, object, verify, when } from "testdouble"
@@ -75,13 +75,15 @@ o.spec("IdentityKeyCreatorTest", function () {
 
 	o.spec("Create identity key pair", function () {
 		const userGroupId = "userGroupId"
-		const userGroupKey: VersionedKey = { version: 1, object: object() }
+		const currentUserGroupKeyVersion = 1
+		const userGroupKey: VersionedKey = { version: currentUserGroupKeyVersion, object: object() }
 		const identityKeyPair: Ed25519KeyPair = { public_key: object(), private_key: object() }
 		const encodedPubIdentityKey: Uint8Array = object()
 		const encryptedPrivateIdentityKey: VersionedEncryptedKey = {
 			encryptingKeyVersion: userGroupKey.version,
 			key: object(),
 		}
+		const userGroupKeyPair: Versioned<AsymmetricKeyPair> = object()
 		const identityKeyVersion = 0
 		const tag: MacTag = object()
 
@@ -97,6 +99,7 @@ o.spec("IdentityKeyCreatorTest", function () {
 		const userGroup: Group = object()
 		userGroup.currentKeys = object()
 		userGroup.groupKeyVersion = "1"
+		const publicKeySignature: PublicKeySignature = object()
 
 		o.beforeEach(function () {
 			when(cryptoWrapper.ed25519PublicKeyToBytes(identityKeyPair.public_key)).thenReturn(encodedPubIdentityKey)
@@ -120,17 +123,24 @@ o.spec("IdentityKeyCreatorTest", function () {
 			).thenReturn(tag)
 
 			when(entityClient.load(GroupTypeRef, userGroupId)).thenResolve(userGroup)
+			when(
+				publicKeySignatureFacade.signPublicKey(userGroupKeyPair, {
+					object: identityKeyPair.private_key,
+					version: identityKeyVersion,
+				}),
+			).thenResolve(publicKeySignature)
 		})
 
 		o("success internal user", async function () {
-			await identityKeyCreator.createIdentityKeyPair(userGroupId, object(), [])
+			await identityKeyCreator.createIdentityKeyPair(userGroupId, userGroupKeyPair, [])
 
 			verify(
 				serviceExecutor.post(
 					IdentityKeyService,
 					argThat((data: IdentityKeyPostIn) => {
 						const identityKeyPairFromRequest = data.identityKeyPair
 						const keyMacFromRequest = identityKeyPairFromRequest.publicKeyMac
+						const signaturesFromRequest = data.signatures
 						o(identityKeyPairFromRequest.identityKeyVersion).equals(identityKeyVersion.toString())
 						o(identityKeyPairFromRequest.encryptingKeyVersion).equals(encryptedPrivateIdentityKey.encryptingKeyVersion.toString())
 						o(identityKeyPairFromRequest.privateEd25519Key).equals(encryptedPrivateIdentityKey.key)
@@ -139,6 +149,8 @@ o.spec("IdentityKeyCreatorTest", function () {
 						o(keyMacFromRequest.taggedKeyVersion).equals(identityKeyVersion.toString())
 						o(keyMacFromRequest.taggingKeyVersion).equals(userGroupKey.version.toString())
 						o(keyMacFromRequest.taggingGroup).equals(userGroupId)
+						o(signaturesFromRequest.length).equals(1)
+						o(signaturesFromRequest[0]).equals(publicKeySignature)
 
 						return true
 					}),
@@ -157,14 +169,15 @@ o.spec("IdentityKeyCreatorTest", function () {
 					admin: adminGroupId,
 				}),
 			)
-			await identityKeyCreator.createIdentityKeyPair(userGroupId, object(), [])
+			await identityKeyCreator.createIdentityKeyPair(userGroupId, userGroupKeyPair, [])
 
 			verify(
 				serviceExecutor.post(
 					IdentityKeyService,
 					argThat((data: IdentityKeyPostIn) => {
 						const identityKeyPairFromRequest = data.identityKeyPair
 						const keyMacFromRequest = identityKeyPairFromRequest.publicKeyMac
+						const signaturesFromRequest = data.signatures
 						o(identityKeyPairFromRequest.identityKeyVersion).equals(identityKeyVersion.toString())
 						o(identityKeyPairFromRequest.encryptingKeyVersion).equals(encryptedPrivateIdentityKey.encryptingKeyVersion.toString())
 						o(identityKeyPairFromRequest.privateEd25519Key).equals(encryptedPrivateIdentityKey.key)
@@ -173,6 +186,8 @@ o.spec("IdentityKeyCreatorTest", function () {
 						o(keyMacFromRequest.taggedKeyVersion).equals(identityKeyVersion.toString())
 						o(keyMacFromRequest.taggingKeyVersion).equals(userGroupKey.version.toString())
 						o(keyMacFromRequest.taggingGroup).equals(userGroupId)
+						o(signaturesFromRequest.length).equals(1)
+						o(signaturesFromRequest[0]).equals(publicKeySignature)
 
 						return true
 					}),
@@ -193,14 +208,15 @@ o.spec("IdentityKeyCreatorTest", function () {
 					admin: adminGroupId,
 				}),
 			)
-			await identityKeyCreator.createIdentityKeyPair(userGroupId, object(), [], adminGroupKey)
+			await identityKeyCreator.createIdentityKeyPair(userGroupId, userGroupKeyPair, [], adminGroupKey)
 
 			verify(
 				serviceExecutor.post(
 					IdentityKeyService,
 					argThat((data: IdentityKeyPostIn) => {
 						const identityKeyPairFromRequest = data.identityKeyPair
 						const keyMacFromRequest = identityKeyPairFromRequest.publicKeyMac
+						const signaturesFromRequest = data.signatures
 						o(identityKeyPairFromRequest.identityKeyVersion).equals(identityKeyVersion.toString())
 						o(identityKeyPairFromRequest.encryptingKeyVersion).equals(adminEncPrivateKey.encryptingKeyVersion.toString())
 						o(identityKeyPairFromRequest.privateEd25519Key).equals(adminEncPrivateKey.key)
@@ -209,12 +225,58 @@ o.spec("IdentityKeyCreatorTest", function () {
 						o(keyMacFromRequest.taggedKeyVersion).equals(identityKeyVersion.toString())
 						o(keyMacFromRequest.taggingKeyVersion).equals(userGroupKey.version.toString())
 						o(keyMacFromRequest.taggingGroup).equals(userGroupId)
+						o(signaturesFromRequest.length).equals(1)
+						o(signaturesFromRequest[0]).equals(publicKeySignature)
 						return true
 					}),
 				),
 			)
 		})
 
+		o.spec("createIdentityKeyPairForExistingUser", function () {
+			const currentUserGroupKeyPair: Versioned<AsymmetricKeyPair> = {
+				object: object(),
+				version: currentUserGroupKeyVersion,
+			}
+			o.beforeEach(function () {
+				when(userFacade.getUserGroupId()).thenReturn(userGroupId)
+				when(keyLoaderFacade.loadCurrentKeyPair(userGroupId)).thenResolve(currentUserGroupKeyPair)
+				when(cacheManagementFacade.reloadGroup(userGroupId)).thenResolve(userGroup)
+			})
+
+			o("success no former group keys", async function () {
+				when(keyLoaderFacade.loadAllFormerKeyPairs(userGroup)).thenResolve([])
+				await identityKeyCreator.createIdentityKeyPairForExistingUsers()
+				verify(asymmetricCryptoFacade.getOrMakeSenderX25519KeyPair(currentUserGroupKeyPair.object, userGroupId))
+			})
+			o("success former group keys", async function () {
+				const formerGroupKeyPair: Versioned<AsymmetricKeyPair> = {
+					object: object(),
+					version: checkKeyVersionConstraints(currentUserGroupKeyVersion - 1),
+				}
+				const formerGroupKeyPairSignature: PublicKeySignature = object()
+				when(
+					publicKeySignatureFacade.signPublicKey(formerGroupKeyPair, {
+						object: identityKeyPair.private_key,
+						version: identityKeyVersion,
+					}),
+				).thenResolve(formerGroupKeyPairSignature)
+				when(keyLoaderFacade.loadAllFormerKeyPairs(userGroup)).thenResolve([formerGroupKeyPair])
+				await identityKeyCreator.createIdentityKeyPairForExistingUsers()
+				verify(asymmetricCryptoFacade.getOrMakeSenderX25519KeyPair(currentUserGroupKeyPair.object, userGroupId))
+				verify(
+					serviceExecutor.post(
+						IdentityKeyService,
+						argThat((data: IdentityKeyPostIn) => {
+							o(data.signatures.length).equals(2)
+							o(data.signatures[1]).equals(formerGroupKeyPairSignature)
+							return true
+						}),
+					),
+				)
+			})
+		})
+
 		o.spec("createIdentityKeyPairForExistingTeamGroups", function () {
 			const teamGroupId1 = "teamGroupId1"
 			const teamGroupId2 = "teamGroupId2"