Release Crypto Tools 0.1.0

tests/browser/app.spec.ts

@@ -0,0 +1,57 @@
+import { expect, test, type Page } from "@playwright/test";
+
+const ORIGIN = "http://127.0.0.1:4173";
+async function localOnly(page: Page) {
+  const external: string[] = [];
+  await page.route("**/*", async (route) => {
+    const url = new URL(route.request().url());
+    if (url.origin !== ORIGIN) {
+      external.push(url.href);
+      await route.abort();
+    } else await route.continue();
+  });
+  return external;
+}
+
+test("runs from a nested path without external requests", async ({ page }) => {
+  const errors: string[] = [];
+  page.on("pageerror", (error) => errors.push(error.message));
+  page.on("console", (message) => {
+    if (message.type() === "error") errors.push(message.text());
+  });
+  const external = await localOnly(page);
+  await page.goto("/deep/nested/crypto/");
+  await expect(
+    page.getByRole("heading", { name: "Crypto Tools" }),
+  ).toBeVisible();
+  expect(external).toEqual([]);
+  expect(errors).toEqual([]);
+});
+
+test("inspects a JWK and computes its local thumbprint", async ({ page }) => {
+  const external = await localOnly(page);
+  await page.goto("/deep/nested/crypto/");
+  await page.getByRole("button", { name: "Inspect locally" }).click();
+  await expect(page.getByRole("heading", { name: "1 object" })).toBeVisible();
+  await expect(page.getByText("RFC 7638 SHA-256 thumbprint")).toBeVisible();
+  await expect(page.getByText(/^[A-Za-z0-9_-]{43}$/u)).toBeVisible();
+  await expect(page.getByText(/does not use or imply trust/u)).toBeVisible();
+  expect(external).toEqual([]);
+});
+
+test("serves the release identity and hardened headers", async ({
+  request,
+}) => {
+  const index = await request.get("/deep/nested/crypto/");
+  expect(index.ok()).toBe(true);
+  expect(index.headers()["content-security-policy"]).toContain(
+    "default-src 'self'",
+  );
+  expect(await index.text()).not.toMatch(/\b(?:src|href)=["']\//u);
+  const manifest = await request.get("/deep/nested/crypto/toolbox-app.json");
+  await expect(manifest.json()).resolves.toMatchObject({
+    id: "de.add-ideas.crypto-tools",
+    version: "0.1.0",
+    entry: "./",
+  });
+});

tests/components/app.test.tsx

@@ -0,0 +1,19 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+import { App } from "../../src/App";
+
+describe("Crypto Tools", () => {
+  it("renders the local workbench and standard shell", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("Not found", { status: 404 })),
+    );
+    render(<App />);
+    expect(
+      await screen.findByRole("heading", { name: "Crypto Tools" }),
+    ).toBeVisible();
+    expect(
+      await screen.findByText("Memory-only", undefined, { timeout: 10_000 }),
+    ).toBeVisible();
+  });
+});

tests/crypto/inspection.test.ts

@@ -0,0 +1,73 @@
+import { describe, expect, it } from "vitest";
+import {
+  checkCertificateHostname,
+  inspectCryptoInput,
+  parsePemBlocks,
+} from "../../src/crypto/inspection";
+
+describe("crypto input inspection", () => {
+  it("parses bounded PEM blocks and detects encrypted key material", () => {
+    const pem =
+      "-----BEGIN ENCRYPTED PRIVATE KEY-----\nAQID\n-----END ENCRYPTED PRIVATE KEY-----";
+    expect(parsePemBlocks(pem)).toMatchObject([
+      { label: "ENCRYPTED PRIVATE KEY", encrypted: true },
+    ]);
+    expect(parsePemBlocks(pem)[0]?.bytes).toEqual(Uint8Array.of(1, 2, 3));
+  });
+
+  it("computes the RFC 7638 thumbprint without serialising private values", async () => {
+    const inspection = await inspectCryptoInput(
+      JSON.stringify({
+        kty: "RSA",
+        n: "AQAB",
+        e: "AQAB",
+        d: "do-not-display",
+        kid: "test",
+      }),
+    );
+    expect(inspection.items[0]?.facts["RFC 7638 SHA-256 thumbprint"]).toMatch(
+      /^[A-Za-z0-9_-]{43}$/u,
+    );
+    expect(JSON.stringify(inspection)).not.toContain("do-not-display");
+    expect(inspection.items[0]?.findings[0]?.severity).toBe("warning");
+  });
+
+  it("does not use a legacy common-name hostname fallback", () => {
+    expect(
+      checkCertificateHostname(
+        {
+          id: "x",
+          type: "X.509 certificate",
+          title: "x",
+          facts: {},
+          findings: [],
+          dnsNames: [],
+        },
+        "example.com",
+      ),
+    ).toEqual({ valid: false, message: "Select a certificate." });
+  });
+
+  it("rejects unrelated JSON", async () => {
+    await expect(inspectCryptoInput('{"hello":"world"}')).rejects.toThrow(
+      /JWK or a JWKS/u,
+    );
+    await expect(inspectCryptoInput("null")).rejects.toThrow(/PEM or JWK/u);
+  });
+
+  it("rejects wildcards and invalid labels as hostname inputs", () => {
+    const item = {
+      id: "x",
+      type: "X.509 certificate",
+      title: "x",
+      facts: {},
+      findings: [],
+      certificate: {} as never,
+      dnsNames: ["*.example.com"],
+    };
+    expect(checkCertificateHostname(item, "*.example.com").valid).toBe(false);
+    expect(checkCertificateHostname(item, "bad_label.example.com").valid).toBe(
+      false,
+    );
+  });
+});