tests/test_anchor.py

Read-only source from the unchanged 0.3.4 kit. Existing license terms apply.

import unittest
from unittest.mock import patch

import test_conformance as fixture
from ail_ref.anchor import compare_public_anchor, verify_with_trusted_https_anchor, validate_trusted_url


class AnchorTests(unittest.TestCase):
    def setUp(self):
        self.packet = fixture.ConformanceTests()._signed_identity_packet()
        s = self.packet['subject']
        self.url = s['identity_anchor']
        self.anchor = {
            'format': 'AIL-PUBLIC-KEY/0.3',
            'principal': s['principal'], 'display_name': s['display_name'],
            'role': s['role'], 'language': s['language'],
            'identity_anchor': self.url,
            'public_key': dict(self.packet['public_key']),
            'statement': 'This public key is designated to sign AIL identity packets for the named principal.',
        }

    def test_supplied_file_match_does_not_upgrade_assurance(self):
        result = compare_public_anchor(self.packet, self.anchor, self.url)
        self.assertTrue(result['valid'])
        self.assertEqual(result['identity_assurance'], 'ail:self_asserted_key')
        self.assertEqual(result['anchor_status'], 'ail:key_matches_supplied_anchor')

    def test_mismatch_and_extra_fields_rejected(self):
        for section, key, value in [
            ('public_key', 'fingerprint', 'sha256:wrong'),
            (None, 'principal', 'urn:ail:principal:impostor'),
            (None, 'extra', 'instruction'),
        ]:
            with self.subTest(section=section, key=key):
                anchor = {**self.anchor, 'public_key': dict(self.anchor['public_key'])}
                (anchor[section] if section else anchor)[key] = value
                self.assertFalse(compare_public_anchor(self.packet, anchor, self.url)['valid'])

    def test_packet_selected_url_cannot_redefine_trusted_origin(self):
        self.assertFalse(compare_public_anchor(self.packet, self.anchor, 'https://other.example/.well-known/ail-owner.json')['valid'])
        for url in ('http://ail.example/.well-known/ail-owner.json',
                    'https://ail.example/other.json',
                    'https://ail.example/.well-known/ail-owner.json?next=x'):
            with self.subTest(url=url), self.assertRaises(ValueError):
                validate_trusted_url(url)

    def test_verified_https_fetch_upgrades_only_domain_key_assurance(self):
        with patch('ail_ref.anchor.fetch_trusted_anchor', return_value=self.anchor) as fetch:
            result = verify_with_trusted_https_anchor(self.packet, self.url)
        fetch.assert_called_once_with(self.url)
        self.assertTrue(result['valid'])
        self.assertEqual(result['anchor_status'], 'ail:https_domain_key_matched')
        self.assertEqual(result['identity_assurance'], 'ail:domain_anchored_key')

    def test_failed_fetch_keeps_self_asserted(self):
        with patch('ail_ref.anchor.fetch_trusted_anchor', side_effect=OSError('offline')):
            result = verify_with_trusted_https_anchor(self.packet, self.url)
        self.assertFalse(result['valid'])
        self.assertEqual(result['identity_assurance'], 'ail:self_asserted_key')