feat: release authentication laboratories 0.3.0

tests/webauthn/trust-policy.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, it } from "vitest";
+import type { FidoMetadataSnapshot } from "../../src/webauthn/metadata";
+import {
+  DEFAULT_ATTESTATION_TRUST_POLICY,
+  evaluateMetadataPolicy,
+} from "../../src/webauthn/trust-policy";
+
+const AAGUID = "00000000-0000-0000-0000-000000000001";
+
+function snapshot(): FidoMetadataSnapshot {
+  return {
+    sequenceNumber: 42,
+    nextUpdate: "2027-01-01",
+    entries: [
+      {
+        aaguid: AAGUID,
+        statusReports: [
+          { status: "FIDO_CERTIFIED", effectiveDate: "2025-01-01" },
+          {
+            status: "USER_VERIFICATION_BYPASS",
+            effectiveDate: "2026-04-01",
+            authenticatorVersion: 7,
+          },
+        ],
+      },
+    ],
+    jwtAlgorithm: "RS256",
+    signerCertificates: 1,
+    signerCertificateChain: ["AA"],
+    signatureVerified: true,
+    trustEstablished: false,
+    warnings: [],
+  };
+}
+
+describe("attestation metadata policy", () => {
+  it("evaluates historical effective dates", () => {
+    const result = evaluateMetadataPolicy({
+      snapshot: snapshot(),
+      aaguid: AAGUID,
+      asOf: "2026-03-01",
+      trustEstablished: true,
+    });
+    expect(result.accepted).toBe(true);
+    expect(result.activeStatusReports.map(({ status }) => status)).toEqual([
+      "FIDO_CERTIFIED",
+    ]);
+  });
+
+  it("blocks severe statuses for the selected firmware", () => {
+    const result = evaluateMetadataPolicy({
+      snapshot: snapshot(),
+      aaguid: AAGUID,
+      asOf: "2026-08-19",
+      authenticatorVersion: 7,
+      trustEstablished: true,
+    });
+    expect(result.accepted).toBe(false);
+    expect(result.checks).toContainEqual(
+      expect.objectContaining({
+        name: "Metadata status: USER_VERIFICATION_BYPASS",
+        status: "fail",
+      }),
+    );
+  });
+
+  it("allows transparent policy overrides", () => {
+    const result = evaluateMetadataPolicy({
+      snapshot: { ...snapshot(), signatureVerified: false },
+      aaguid: "ffffffff-ffff-ffff-ffff-ffffffffffff",
+      asOf: "2028-01-01",
+      policy: {
+        ...DEFAULT_ATTESTATION_TRUST_POLICY,
+        requireValidBlobSignature: false,
+        requirePinnedTrustRoot: false,
+        requireCurrentSnapshot: false,
+        requireMetadataEntry: false,
+      },
+    });
+    expect(result.accepted).toBe(true);
+  });
+});