PaperClipAI/server/src/services/native-runtime/native-workspace-platform-proof.test.ts

import { generateKeyPairSync, sign } from "node:crypto";
import { describe, expect, it, vi } from "vitest";
import { verifyWorkspaceWorkerStopReceipt, requestWorkspaceWorkerStopProof, currentWorkspaceWorker, isRetainedWorkspaceWorkerStopProof } from "./native-workspace-platform-proof.js";
const { privateKey, publicKey } = generateKeyPairSync("ed25519");
const env = { PAPERCLIP_CLOUD_STACK_ID: "stack", PAPERCLIP_CLOUD_API_ORIGIN: "https://cloud.example", PAPERCLIP_CLOUD_TENANT_SERVER_TOKEN: "fixture-token", PAPERCLIP_CLOUD_RUNTIME_IDENTITY_JWKS: JSON.stringify({ keys: [{ ...publicKey.export({ format: "jwk" }), kid: "test", alg: "EdDSA", use: "sig" }] }) };
const worker = { provider: "railway" as const, projectId: "project", environmentId: "environment", serviceId: "service", deploymentId: "old-deployment" };
const binding = { runId: "run", ownerToken: "owner", worker };
const now = new Date("2099-01-01T00:00:00Z");
function receipt(overrides = {}) {
  const header = Buffer.from(JSON.stringify({ alg: "EdDSA", kid: "test", typ: "paperclip-workspace-worker-stop+jwt" })).toString("base64url");
  const payload = Buffer.from(JSON.stringify({ v: 1, iss: "paperclip-cloud", aud: "paperclip-workspace-worker-stop/v1", sub: "stack", ...binding, stopped: true, iat: now.getTime()/1000, exp: now.getTime()/1000+60, ...overrides })).toString("base64url");
  return `${header}.${payload}.${sign(null, Buffer.from(`${header}.${payload}`), privateKey).toString("base64url")}`;
}
describe("workspace platform stop proof", () => {
  it("accepts only signed proof for the exact stack, owner, run and full stopped deployment", () => {
    expect(verifyWorkspaceWorkerStopReceipt(receipt(), binding, env, now)).toMatchObject({ stopped: true, worker });
    for (const invalid of [{ sub: "other-stack" }, { runId: "other-run" }, { ownerToken: "other-owner" }, { stopped: false }, { exp: now.getTime()/1000-1 }, { worker: { ...worker, deploymentId: "other" } }, { aud: "paperclip-cloud-control/v1" }]) {
      expect(verifyWorkspaceWorkerStopReceipt(receipt(invalid), binding, env, now)).toBeNull();
    }
    expect(verifyWorkspaceWorkerStopReceipt(receipt().slice(0,-5)+"wrong", binding, env, now)).toBeNull();
  });
  it("retains verified same-run audit evidence after acquisition expiry without granting new stop authority", () => {
    const proof = verifyWorkspaceWorkerStopReceipt(receipt(), binding, env, now)!;
    const later = new Date(now.getTime() + 120_000);
    expect(verifyWorkspaceWorkerStopReceipt(receipt(), binding, env, later)).toBeNull();
    expect(isRetainedWorkspaceWorkerStopProof(proof, binding.runId)).toBe(true);
    for (const invalid of [null, [], { stopped: true }, { ...proof, runId: "other-run" },
      { ...proof, stopped: false }, { ...proof, exp: proof.iat }, { ...proof, exp: proof.iat + 61 },
      { ...proof, iat: "100" }, { ...proof, ownerToken: "" }, { ...proof, sub: "" },
      { ...proof, worker: { ...worker, deploymentId: "" } }, { ...proof, worker: { ...worker, provider: "other" } },
      { ...proof, worker: { ...worker, providerStarted: true } }, { ...proof, providerStarted: true }]) {
      expect(isRetainedWorkspaceWorkerStopProof(invalid, binding.runId)).toBe(false);
    }
  });
  it("fails closed on live, unknown, unreachable and unsigned platform responses", async () => {
    for (const response of [{ stopped: false }, { stopped: true }, { receipt: "forged" }]) {
      const fetchImpl = vi.fn().mockResolvedValue(Response.json(response));
      expect(await requestWorkspaceWorkerStopProof(binding, { env, now, fetchImpl })).toEqual({ status: "pending" });
    }
    expect(await requestWorkspaceWorkerStopProof(binding, { env, now, fetchImpl: vi.fn().mockRejectedValue(new Error("offline")) })).toEqual({ status: "pending" });
    expect(await requestWorkspaceWorkerStopProof(binding, { env, now, fetchImpl: vi.fn().mockResolvedValue(Response.json({ receipt: receipt() })) })).toMatchObject({ status: "verified", proof: { stopped: true } });
  });
  it("does not schedule platform verification without a supported authenticated endpoint", async () => {
    for (const unavailable of [
      {},
      { ...env, PAPERCLIP_CLOUD_TENANT_SERVER_TOKEN: "" },
      { ...env, PAPERCLIP_CLOUD_API_ORIGIN: "http://cloud.example" },
      { ...env, PAPERCLIP_CLOUD_API_ORIGIN: "https://user:password@cloud.example" },
      { ...env, PAPERCLIP_CLOUD_API_ORIGIN: "not a URL" },
    ]) {
      const fetchImpl = vi.fn();
      expect(await requestWorkspaceWorkerStopProof(binding, { env: unavailable, now, fetchImpl }))
        .toEqual({ status: "unsupported" });
      expect(fetchImpl).not.toHaveBeenCalled();
    }
  });
  it("keeps an authenticated but temporarily unavailable verification pending", async () => {
    const fetchImpl = vi.fn().mockResolvedValue(new Response(null, { status: 503 }));
    expect(await requestWorkspaceWorkerStopProof(binding, { env, now, fetchImpl }))
      .toEqual({ status: "pending" });
    expect(fetchImpl).toHaveBeenCalledOnce();
  });
  it("records a complete platform identity, and does not guess legacy ownership", () => {
    expect(currentWorkspaceWorker({ RAILWAY_PROJECT_ID: "project", RAILWAY_ENVIRONMENT_ID: "environment", RAILWAY_SERVICE_ID: "service", RAILWAY_DEPLOYMENT_ID: "old-deployment" })).toEqual(worker);
    expect(currentWorkspaceWorker({ RAILWAY_DEPLOYMENT_ID: "old-deployment" })).toBeUndefined();
  });
});