83 lines
2.3 KiB
TypeScript
83 lines
2.3 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import type { FidoMetadataSnapshot } from "../../src/webauthn/metadata";
|
|
import {
|
|
DEFAULT_ATTESTATION_TRUST_POLICY,
|
|
evaluateMetadataPolicy,
|
|
} from "../../src/webauthn/trust-policy";
|
|
|
|
const AAGUID = "00000000-0000-0000-0000-000000000001";
|
|
|
|
function snapshot(): FidoMetadataSnapshot {
|
|
return {
|
|
sequenceNumber: 42,
|
|
nextUpdate: "2027-01-01",
|
|
entries: [
|
|
{
|
|
aaguid: AAGUID,
|
|
statusReports: [
|
|
{ status: "FIDO_CERTIFIED", effectiveDate: "2025-01-01" },
|
|
{
|
|
status: "USER_VERIFICATION_BYPASS",
|
|
effectiveDate: "2026-04-01",
|
|
authenticatorVersion: 7,
|
|
},
|
|
],
|
|
},
|
|
],
|
|
jwtAlgorithm: "RS256",
|
|
signerCertificates: 1,
|
|
signerCertificateChain: ["AA"],
|
|
signatureVerified: true,
|
|
trustEstablished: false,
|
|
warnings: [],
|
|
};
|
|
}
|
|
|
|
describe("attestation metadata policy", () => {
|
|
it("evaluates historical effective dates", () => {
|
|
const result = evaluateMetadataPolicy({
|
|
snapshot: snapshot(),
|
|
aaguid: AAGUID,
|
|
asOf: "2026-03-01",
|
|
trustEstablished: true,
|
|
});
|
|
expect(result.accepted).toBe(true);
|
|
expect(result.activeStatusReports.map(({ status }) => status)).toEqual([
|
|
"FIDO_CERTIFIED",
|
|
]);
|
|
});
|
|
|
|
it("blocks severe statuses for the selected firmware", () => {
|
|
const result = evaluateMetadataPolicy({
|
|
snapshot: snapshot(),
|
|
aaguid: AAGUID,
|
|
asOf: "2026-08-19",
|
|
authenticatorVersion: 7,
|
|
trustEstablished: true,
|
|
});
|
|
expect(result.accepted).toBe(false);
|
|
expect(result.checks).toContainEqual(
|
|
expect.objectContaining({
|
|
name: "Metadata status: USER_VERIFICATION_BYPASS",
|
|
status: "fail",
|
|
}),
|
|
);
|
|
});
|
|
|
|
it("allows transparent policy overrides", () => {
|
|
const result = evaluateMetadataPolicy({
|
|
snapshot: { ...snapshot(), signatureVerified: false },
|
|
aaguid: "ffffffff-ffff-ffff-ffff-ffffffffffff",
|
|
asOf: "2028-01-01",
|
|
policy: {
|
|
...DEFAULT_ATTESTATION_TRUST_POLICY,
|
|
requireValidBlobSignature: false,
|
|
requirePinnedTrustRoot: false,
|
|
requireCurrentSnapshot: false,
|
|
requireMetadataEntry: false,
|
|
},
|
|
});
|
|
expect(result.accepted).toBe(true);
|
|
});
|
|
});
|