Something went wrong. Try again.
A downstream fork of Tranquil PDS for use in margin.cafe
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585import { beforeEach, describe, expect, it, vi } from "vitest";import { PlcOps, plcOps } from "../../lib/migration/plc-ops.ts";import { P256PrivateKeyExportable, Secp256k1PrivateKeyExportable,} from "@atcute/crypto";import { fromBase58Btc, toBase58Btc } from "@atcute/multibase";
describe("migration/plc-ops", () => { beforeEach(() => { vi.restoreAllMocks(); });
describe("PlcOps class", () => { it("uses default PLC directory URL", () => { const ops = new PlcOps(); expect(ops).toBeDefined(); });
it("accepts custom PLC directory URL", () => { const ops = new PlcOps("https://custom-plc.example.com"); expect(ops).toBeDefined(); }); });
describe("plcOps singleton", () => { it("exports a singleton instance", () => { expect(plcOps).toBeInstanceOf(PlcOps); }); });
describe("getPlcAuditLogs", () => { it("throws on HTTP error", async () => { globalThis.fetch = vi.fn().mockResolvedValue({ ok: false, status: 404, });
await expect(plcOps.getPlcAuditLogs("did:plc:notfound")).rejects.toThrow( "Failed to fetch PLC audit logs: 404", ); }); });
describe("getLastPlcOpFromPlc", () => { it("throws when empty array returned", async () => { globalThis.fetch = vi.fn().mockResolvedValue({ ok: true, json: () => Promise.resolve([]), });
await expect( plcOps.getLastPlcOpFromPlc("did:plc:empty"), ).rejects.toThrow(); }); });
describe("createNewSecp256k1Keypair", () => { it("generates a keypair with private and public keys", async () => { const result = await plcOps.createNewSecp256k1Keypair();
expect(result.privateKey).toBeDefined(); expect(result.publicKey).toBeDefined(); expect(result.publicKey.startsWith("did:key:")).toBe(true); });
it("generates different keypairs each time", async () => { const result1 = await plcOps.createNewSecp256k1Keypair(); const result2 = await plcOps.createNewSecp256k1Keypair();
expect(result1.privateKey).not.toBe(result2.privateKey); expect(result1.publicKey).not.toBe(result2.publicKey); }); });
describe("getKeyPair", () => { it("parses 64-character hex private key", async () => { const hexKey = "a".repeat(64);
const result = await plcOps.getKeyPair(hexKey);
expect(result.type).toBe("private_key"); expect(result.didPublicKey.startsWith("did:key:")).toBe(true); expect(result.keypair).toBeDefined(); });
it("handles whitespace in key input", async () => { const hexKey = " " + "b".repeat(64) + " ";
const result = await plcOps.getKeyPair(hexKey);
expect(result.type).toBe("private_key"); });
it("throws for invalid key format", async () => { await expect(plcOps.getKeyPair("not-a-valid-key")).rejects.toThrow( "Unrecognized key format", ); });
it("throws for hex key with wrong length", async () => { await expect(plcOps.getKeyPair("abc123")).rejects.toThrow(); }); });
describe("getKeyPair - multikey round-trip", () => { it("round-trips from createNewSecp256k1Keypair", async () => { const { privateKey, publicKey } = await plcOps .createNewSecp256k1Keypair();
const result = await plcOps.getKeyPair(privateKey);
expect(result.didPublicKey).toBe(publicKey); });
it("produces correct multikey structure (z prefix, codec bytes)", async () => { const { privateKey } = await plcOps.createNewSecp256k1Keypair();
expect(privateKey.startsWith("z")).toBe(true); const decoded = fromBase58Btc(privateKey.slice(1)); expect(decoded[0]).toBe(0x81); expect(decoded[1]).toBe(0x26); expect(decoded.length).toBe(34); });
it("multikey import matches hex import of same raw bytes", async () => { const keypair = await Secp256k1PrivateKeyExportable.createKeypair(); const multikey = await keypair.exportPrivateKey("multikey"); const rawHex = await keypair.exportPrivateKey("rawHex");
const fromMultikey = await plcOps.getKeyPair(multikey); const fromHex = await plcOps.getKeyPair(rawHex);
expect(fromMultikey.didPublicKey).toBe(fromHex.didPublicKey); }); });
describe("getKeyPair - hex format", () => { it("accepts uppercase hex", async () => { const result = await plcOps.getKeyPair("A".repeat(64));
expect(result.type).toBe("private_key"); expect(result.didPublicKey.startsWith("did:key:")).toBe(true); }); });
describe("getMatchingKeyPair", () => { it("resolves a P-256 key supplied as hex against its did:key", async () => { const keypair = await P256PrivateKeyExportable.createKeypair(); const rawHex = await keypair.exportPrivateKey("rawHex"); const did = await keypair.exportPublicKey("did");
const result = await plcOps.getMatchingKeyPair(rawHex, [did]);
expect(result?.didPublicKey).toBe(did); });
it("resolves a secp256k1 key supplied as hex against its did:key", async () => { const keypair = await Secp256k1PrivateKeyExportable.createKeypair(); const rawHex = await keypair.exportPrivateKey("rawHex"); const did = await keypair.exportPublicKey("did");
const result = await plcOps.getMatchingKeyPair(rawHex, [did]);
expect(result?.didPublicKey).toBe(did); });
it("returns null when no curve matches the accepted keys", async () => { const keypair = await P256PrivateKeyExportable.createKeypair(); const rawHex = await keypair.exportPrivateKey("rawHex");
const result = await plcOps.getMatchingKeyPair(rawHex, [ "did:key:zQ3shqPwo8CSE8zNXEyEpN4ASEBCCNeUFQq8Lrw3zkAJYB7SB", ]);
expect(result).toBeNull(); });
it("throws on unparseable input", async () => { await expect( plcOps.getMatchingKeyPair("not-a-valid-key", []), ).rejects.toThrow(); }); });
describe("getKeyPair - JWK format", () => { it("imports secp256k1 JWK with d parameter", async () => { const keypair = await Secp256k1PrivateKeyExportable.createKeypair(); const jwk = await keypair.exportPrivateKey("jwk"); const expectedDid = await keypair.exportPublicKey("did");
const result = await plcOps.getKeyPair(JSON.stringify(jwk));
expect(result.didPublicKey).toBe(expectedDid); });
it("imports P-256 JWK with d parameter", async () => { const keypair = await P256PrivateKeyExportable.createKeypair(); const jwk = await keypair.exportPrivateKey("jwk"); const expectedDid = await keypair.exportPublicKey("did");
const result = await plcOps.getKeyPair(JSON.stringify(jwk));
expect(result.didPublicKey).toBe(expectedDid); });
it("rejects JWK without d (public key)", async () => { const keypair = await Secp256k1PrivateKeyExportable.createKeypair(); const jwk = await keypair.exportPublicKey("jwk");
await expect( plcOps.getKeyPair(JSON.stringify(jwk)), ).rejects.toThrow("public key"); });
it("rejects unsupported kty", async () => { const jwk = { kty: "RSA", n: "abc", e: "AQAB" };
await expect(plcOps.getKeyPair(JSON.stringify(jwk))).rejects.toThrow( "Unsupported JWK key type", ); });
it("rejects unsupported crv", async () => { const jwk = { kty: "EC", crv: "P-384", d: "AAAA", x: "BBBB", y: "CCCC" };
await expect(plcOps.getKeyPair(JSON.stringify(jwk))).rejects.toThrow( "Unsupported JWK curve", ); });
it("rejects malformed JSON", async () => { await expect(plcOps.getKeyPair("{not valid json")).rejects.toThrow(); });
it("produces same public key as hex import of same raw bytes", async () => { const keypair = await Secp256k1PrivateKeyExportable.createKeypair(); const jwk = await keypair.exportPrivateKey("jwk"); const rawHex = await keypair.exportPrivateKey("rawHex");
const fromJwk = await plcOps.getKeyPair(JSON.stringify(jwk)); const fromHex = await plcOps.getKeyPair(rawHex);
expect(fromJwk.didPublicKey).toBe(fromHex.didPublicKey); }); });
describe("getKeyPair - plain base58 format", () => { it("imports base58-encoded 32-byte raw key", async () => { const keypair = await Secp256k1PrivateKeyExportable.createKeypair(); const rawBytes = await keypair.exportPrivateKey("raw"); const base58 = toBase58Btc(rawBytes); const expectedDid = await keypair.exportPublicKey("did");
const result = await plcOps.getKeyPair(base58);
expect(result.didPublicKey).toBe(expectedDid); });
it("produces same public key as hex import of same raw bytes", async () => { const keypair = await Secp256k1PrivateKeyExportable.createKeypair(); const rawBytes = await keypair.exportPrivateKey("raw"); const rawHex = await keypair.exportPrivateKey("rawHex"); const base58 = toBase58Btc(rawBytes);
const fromBase58 = await plcOps.getKeyPair(base58); const fromHex = await plcOps.getKeyPair(rawHex);
expect(fromBase58.didPublicKey).toBe(fromHex.didPublicKey); });
it("rejects wrong decoded length", async () => { const shortBytes = new Uint8Array(16); crypto.getRandomValues(shortBytes); const base58Short = toBase58Btc(shortBytes);
await expect(plcOps.getKeyPair(base58Short)).rejects.toThrow( "expected 32", ); }); });
describe("getKeyPair - cross-format consistency", () => { it("hex, multikey, and JWK all produce identical did:key", async () => { const keypair = await Secp256k1PrivateKeyExportable.createKeypair(); const rawHex = await keypair.exportPrivateKey("rawHex"); const multikey = await keypair.exportPrivateKey("multikey"); const jwk = await keypair.exportPrivateKey("jwk");
const [fromHex, fromMultikey, fromJwk] = await Promise.all([ plcOps.getKeyPair(rawHex), plcOps.getKeyPair(multikey), plcOps.getKeyPair(JSON.stringify(jwk)), ]);
expect(fromHex.didPublicKey).toBe(fromMultikey.didPublicKey); expect(fromHex.didPublicKey).toBe(fromJwk.didPublicKey); });
it("hex, multikey, JWK, and base58 all match for P-256", async () => { const keypair = await P256PrivateKeyExportable.createKeypair(); const rawHex = await keypair.exportPrivateKey("rawHex"); const multikey = await keypair.exportPrivateKey("multikey"); const jwk = await keypair.exportPrivateKey("jwk"); const rawBytes = await keypair.exportPrivateKey("raw"); const base58 = toBase58Btc(rawBytes);
const [fromHex, fromMultikey, fromJwk, fromBase58] = await Promise.all([ plcOps.getKeyPair(rawHex, "p256"), plcOps.getKeyPair(multikey), plcOps.getKeyPair(JSON.stringify(jwk)), plcOps.getKeyPair(base58, "p256"), ]);
expect(fromHex.didPublicKey).toBe(fromMultikey.didPublicKey); expect(fromHex.didPublicKey).toBe(fromJwk.didPublicKey); expect(fromHex.didPublicKey).toBe(fromBase58.didPublicKey); }); });
describe("getKeyPair - error cases", () => { it("rejects empty string", async () => { await expect(plcOps.getKeyPair("")).rejects.toThrow( "Private key is required", ); });
it("rejects whitespace-only", async () => { await expect(plcOps.getKeyPair(" ")).rejects.toThrow( "Private key is required", ); });
it("rejects did:key: prefix with helpful error", async () => { await expect( plcOps.getKeyPair( "did:key:zQ3shunBKoL5VRgSEX7RQGQEG3TTo6MPVWvT7tcVjjwZCWMEE", ), ).rejects.toThrow("public key"); });
it("rejects unrecognized garbage", async () => { await expect(plcOps.getKeyPair("!!!invalid!!!")).rejects.toThrow( "Unrecognized key format", ); });
it("rejects hex with non-hex chars in 64-char string", async () => { const almostHex = "g".repeat(64); await expect(plcOps.getKeyPair(almostHex)).rejects.toThrow(); }); });
describe("pushPlcOperation", () => { it("posts operation to PLC directory", async () => { globalThis.fetch = vi.fn().mockResolvedValue({ ok: true, });
const operation = { type: "plc_operation" as const, prev: "bafyreiabc", alsoKnownAs: ["at://alice.example.com"], rotationKeys: ["did:key:z123"], services: { atproto_pds: { type: "AtprotoPersonalDataServer", endpoint: "https://pds.example.com", }, }, verificationMethods: { atproto: "did:key:z456", }, sig: "test-signature", };
await plcOps.pushPlcOperation("did:plc:abc123", operation);
expect(fetch).toHaveBeenCalledWith( "https://plc.directory/did:plc:abc123", expect.objectContaining({ method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(operation), }), ); });
it("throws with error message from PLC directory", async () => { globalThis.fetch = vi.fn().mockResolvedValue({ ok: false, status: 400, headers: new Map([["content-type", "application/json"]]), json: () => Promise.resolve({ message: "Invalid signature" }), });
const operation = { type: "plc_operation" as const, prev: "bafyreiabc", alsoKnownAs: [], rotationKeys: ["did:key:z123"], services: {}, verificationMethods: {}, sig: "bad-sig", };
await expect( plcOps.pushPlcOperation("did:plc:abc123", operation), ).rejects.toThrow("Invalid signature"); });
it("throws generic error when no message in response", async () => { globalThis.fetch = vi.fn().mockResolvedValue({ ok: false, status: 500, headers: new Map([["content-type", "text/plain"]]), });
const operation = { type: "plc_operation" as const, prev: null, alsoKnownAs: [], rotationKeys: [], services: {}, verificationMethods: {}, };
await expect( plcOps.pushPlcOperation("did:plc:abc123", operation), ).rejects.toThrow("PLC directory returned HTTP 500"); }); });
describe("createServiceAuthToken", () => { it("creates a valid JWT", async () => { const { privateKey } = await plcOps.createNewSecp256k1Keypair(); const keypair = await plcOps.getKeyPair(privateKey);
const token = await plcOps.createServiceAuthToken( "did:plc:issuer", "did:web:audience.example.com", keypair.keypair, "com.atproto.server.createAccount", );
expect(token).toBeDefined(); const parts = token.split("."); expect(parts).toHaveLength(3); });
it("includes correct header", async () => { const { privateKey } = await plcOps.createNewSecp256k1Keypair(); const keypair = await plcOps.getKeyPair(privateKey);
const token = await plcOps.createServiceAuthToken( "did:plc:issuer", "did:web:audience", keypair.keypair, "com.atproto.server.createAccount", );
const headerB64 = token.split(".")[0]; const header = JSON.parse( atob(headerB64.replace(/-/g, "+").replace(/_/g, "/")), ); expect(header.typ).toBe("JWT"); expect(header.alg).toBe("ES256K"); });
it("includes correct payload claims", async () => { const { privateKey } = await plcOps.createNewSecp256k1Keypair(); const keypair = await plcOps.getKeyPair(privateKey);
const before = Math.floor(Date.now() / 1000); const token = await plcOps.createServiceAuthToken( "did:plc:myissuer", "did:web:myaudience.com", keypair.keypair, "com.atproto.sync.getRepo", ); const after = Math.floor(Date.now() / 1000);
const payloadB64 = token.split(".")[1]; const payload = JSON.parse( atob(payloadB64.replace(/-/g, "+").replace(/_/g, "/")), );
expect(payload.iss).toBe("did:plc:myissuer"); expect(payload.aud).toBe("did:web:myaudience.com"); expect(payload.lxm).toBe("com.atproto.sync.getRepo"); expect(payload.iat).toBeGreaterThanOrEqual(before); expect(payload.iat).toBeLessThanOrEqual(after); expect(payload.exp).toBe(payload.iat + 60); expect(payload.jti).toBeDefined(); }); });
describe("signAndPublishNewOp", () => { it("throws when no rotation keys provided", async () => { const { privateKey } = await plcOps.createNewSecp256k1Keypair(); const keypair = await plcOps.getKeyPair(privateKey);
await expect( plcOps.signAndPublishNewOp( "did:plc:test", keypair.keypair, ["at://alice.example.com"], [], "https://pds.example.com", "did:key:zVerify", "bafyreiprev", ), ).rejects.toThrow("No rotation keys provided"); });
it("throws when more than 5 unique rotation keys provided", async () => { const { privateKey } = await plcOps.createNewSecp256k1Keypair(); const keypair = await plcOps.getKeyPair(privateKey);
const tooManyKeys = [ "did:key:z1", "did:key:z2", "did:key:z3", "did:key:z4", "did:key:z5", "did:key:z6", ];
await expect( plcOps.signAndPublishNewOp( "did:plc:test", keypair.keypair, [], tooManyKeys, "https://pds.example.com", "did:key:zVerify", "bafyreiprev", ), ).rejects.toThrow("Maximum 5 rotation keys allowed"); }); });
describe("signPlcOperationWithCredentials", () => { it("throws when no rotation keys provided", async () => { const { privateKey } = await plcOps.createNewSecp256k1Keypair(); const keypair = await plcOps.getKeyPair(privateKey);
await expect( plcOps.signPlcOperationWithCredentials( "did:plc:test", keypair.keypair, { rotationKeys: [], alsoKnownAs: [], verificationMethods: {}, services: {}, }, [], "bafyreiprev", ), ).rejects.toThrow("No rotation keys provided"); });
it("throws when more than 5 rotation keys provided", async () => { const { privateKey } = await plcOps.createNewSecp256k1Keypair(); const keypair = await plcOps.getKeyPair(privateKey);
await expect( plcOps.signPlcOperationWithCredentials( "did:plc:test", keypair.keypair, { rotationKeys: ["did:key:z1", "did:key:z2", "did:key:z3"], alsoKnownAs: [], verificationMethods: {}, services: {}, }, ["did:key:z4", "did:key:z5", "did:key:z6"], "bafyreiprev", ), ).rejects.toThrow("Maximum 5 rotation keys allowed"); }); });});