crossmate

PushRequestAuthenticatorTests.swift (10507B)

---

 import Foundation
 import Testing
 
 @testable import Crossmate
 
 @Suite("Push request authentication", .serialized)
 struct PushRequestAuthenticatorTests {
     @Test("App Attest key IDs canonicalize standard and URL-safe Base64")
     func keyIDCanonicalization() throws {
         let bytes = Data([0xfb, 0xff] + Array(0..<30))
         let standard = bytes.base64EncodedString()
         let urlSafe = bytes.base64URLEncodedString()
 
         #expect(standard.contains("+"))
         #expect(standard.contains("/"))
         #expect(standard.hasSuffix("="))
         #expect(try PushRequestAuthenticator.canonicalKeyID(standard) == urlSafe)
         #expect(try PushRequestAuthenticator.canonicalKeyID(urlSafe) == urlSafe)
     }
 
     @Test("App Attest key IDs reject malformed and storage-smuggling values")
     func keyIDRejection() {
         for keyID in ["", "A", "AA=A", "+_8=", "not:base64", String(repeating: "A", count: 257)] {
             #expect(throws: PushRequestAuthError.self) {
                 try PushRequestAuthenticator.canonicalKeyID(keyID)
             }
         }
     }
 
     @Test("challenge failures retain privacy-safe status and retry information")
     func challengeDiagnostics() throws {
         let url = try #require(URL(string: "https://push.test/attest/challenge"))
         let badRequest = try #require(HTTPURLResponse(
             url: url,
             statusCode: 400,
             httpVersion: nil,
             headerFields: nil
         ))
         let badRequestError = PushRequestAuthenticator.challengeError(
             response: badRequest,
             data: Data("Malformed deviceID or keyID".utf8),
             now: Date(timeIntervalSince1970: 0)
         )
         #expect(badRequestError.localizedDescription.contains("HTTP 400"))
         #expect(badRequestError.localizedDescription.contains("Malformed deviceID or keyID"))
 
         let secretEcho = PushRequestAuthenticator.challengeError(
             response: badRequest,
             data: Data("keyID abcdef0123456789".utf8),
             now: Date(timeIntervalSince1970: 0)
         )
         #expect(secretEcho.localizedDescription.contains("unrecognized response"))
         #expect(!secretEcho.localizedDescription.contains("abcdef0123456789"))
 
         let limited = try #require(HTTPURLResponse(
             url: url,
             statusCode: 429,
             httpVersion: nil,
             headerFields: ["Retry-After": "90"]
         ))
         let limitedError = PushRequestAuthenticator.challengeError(
             response: limited,
             data: Data("Rate limit exceeded".utf8),
             now: Date(timeIntervalSince1970: 0)
         )
         #expect(limitedError.localizedDescription.contains("HTTP 429"))
         #expect(limitedError.localizedDescription.contains("90 seconds"))
     }
 
     @Test("failed challenge reuses the persisted key after backoff")
     func failedChallengeReusesKey() async throws {
         AuthURLProtocol.reset()
         defer { AuthURLProtocol.reset() }
 
         let bytes = Data([0xfb, 0xff] + Array(0..<30))
         let originalKeyID = bytes.base64EncodedString()
         let canonicalKeyID = bytes.base64URLEncodedString()
         let service = FakeAppAttestService(keyID: originalKeyID)
         let storage = MemoryPushAuthKeyStore()
         let sleeps = SleepRecorder()
         AuthURLProtocol.setHandler { request, challengeAttempt in
             switch request.url?.path {
             case "/attest/challenge" where challengeAttempt == 1:
                 return (500, [:], Data("internal details".utf8))
             case "/attest/challenge":
                 return (200, [:], Data(#"{"challenge":"challenge-1"}"#.utf8))
             case "/attest/register":
                 return (204, [:], Data())
             default:
                 return (404, [:], Data("Not found".utf8))
             }
         }
 
         let configuration = URLSessionConfiguration.ephemeral
         configuration.protocolClasses = [AuthURLProtocol.self]
         let authenticator = PushRequestAuthenticator(
             baseURL: URL(string: "https://push.test")!,
             deviceID: "device-1",
             session: URLSession(configuration: configuration),
             service: service,
             keyStore: storage.store,
             now: { Date(timeIntervalSince1970: 1_000) },
             sleep: { await sleeps.record($0) },
             jitter: { 1 }
         )
 
         await #expect(throws: PushRequestAuthError.self) {
             try await authenticator.signedHeaders(method: "POST", path: "/register", body: Data())
         }
         let headers = try await authenticator.signedHeaders(
             method: "POST",
             path: "/register",
             body: Data()
         )
 
         #expect(headers["X-Crossmate-Key-ID"] == canonicalKeyID)
         #expect(service.generateKeyCount == 1)
         #expect(service.attestKeyIDs == [originalKeyID])
         #expect(await sleeps.values == [2])
     }
 
     @Test("lost registration response resends the persisted attestation")
     func lostRegistrationResponseReusesAttestation() async throws {
         AuthURLProtocol.reset()
         defer { AuthURLProtocol.reset() }
 
         let bytes = Data([0xfb, 0xff] + Array(0..<30))
         let originalKeyID = bytes.base64EncodedString()
         let service = FakeAppAttestService(keyID: originalKeyID)
         let storage = MemoryPushAuthKeyStore()
         let sleeps = SleepRecorder()
         let registerAttempts = LockedCounter()
         AuthURLProtocol.setHandler { request, _ in
             switch request.url?.path {
             case "/attest/challenge":
                 return (200, [:], Data(#"{"challenge":"challenge-1"}"#.utf8))
             case "/attest/register":
                 let attempt = registerAttempts.increment()
                 return attempt == 1 ? (500, [:], Data()) : (204, [:], Data())
             default:
                 return (404, [:], Data("Not found".utf8))
             }
         }
 
         let configuration = URLSessionConfiguration.ephemeral
         configuration.protocolClasses = [AuthURLProtocol.self]
         let authenticator = PushRequestAuthenticator(
             baseURL: URL(string: "https://push.test")!,
             deviceID: "device-1",
             session: URLSession(configuration: configuration),
             service: service,
             keyStore: storage.store,
             now: { Date(timeIntervalSince1970: 1_000) },
             sleep: { await sleeps.record($0) },
             jitter: { 1 }
         )
 
         await #expect(throws: PushRequestAuthError.self) {
             try await authenticator.signedHeaders(method: "POST", path: "/register", body: Data())
         }
         _ = try await authenticator.signedHeaders(method: "POST", path: "/register", body: Data())
 
         #expect(service.generateKeyCount == 1)
         #expect(service.attestKeyIDs == [originalKeyID])
         #expect(registerAttempts.value == 2)
         #expect(await sleeps.values == [2])
     }
 }
 
 private final class FakeAppAttestService: AppAttestServicing, @unchecked Sendable {
     private let lock = NSLock()
     private let keyID: String
     private var generated = 0
     private var attested: [String] = []
 
     init(keyID: String) {
         self.keyID = keyID
     }
 
     var isSupported: Bool { true }
 
     var generateKeyCount: Int {
         lock.withLock { generated }
     }
 
     var attestKeyIDs: [String] {
         lock.withLock { attested }
     }
 
     func generateKey() async throws -> String {
         lock.withLock { generated += 1 }
         return keyID
     }
 
     func attestKey(_ keyID: String, clientDataHash: Data) async throws -> Data {
         lock.withLock { attested.append(keyID) }
         return Data([1, 2, 3])
     }
 
     func generateAssertion(_ keyID: String, clientDataHash: Data) async throws -> Data {
         Data([4, 5, 6])
     }
 }
 
 private final class MemoryPushAuthKeyStore: @unchecked Sendable {
     private let lock = NSLock()
     private var values: [String: Data] = [:]
 
     var store: PushAuthKeyStore {
         PushAuthKeyStore(
             load: { [self] key in lock.withLock { values[key] } },
             save: { [self] key, data in lock.withLock { values[key] = data } },
             delete: { [self] key in lock.withLock { _ = values.removeValue(forKey: key) } }
         )
     }
 }
 
 private actor SleepRecorder {
     private(set) var values: [TimeInterval] = []
 
     func record(_ value: TimeInterval) {
         values.append(value)
     }
 }
 
 private final class LockedCounter: @unchecked Sendable {
     private let lock = NSLock()
     private var count = 0
 
     var value: Int { lock.withLock { count } }
 
     func increment() -> Int {
         lock.withLock {
             count += 1
             return count
         }
     }
 }
 
 private final class AuthURLProtocol: URLProtocol {
     typealias Result = (status: Int, headers: [String: String], data: Data)
     private static let state = AuthURLProtocolState()
 
     static func reset() { state.reset() }
     static func setHandler(_ handler: @escaping @Sendable (URLRequest, Int) -> Result) {
         state.setHandler(handler)
     }
 
     override class func canInit(with request: URLRequest) -> Bool { true }
     override class func canonicalRequest(for request: URLRequest) -> URLRequest { request }
 
     override func startLoading() {
         let result = Self.state.result(for: request)
         let response = HTTPURLResponse(
             url: request.url!,
             statusCode: result.status,
             httpVersion: nil,
             headerFields: result.headers
         )!
         client?.urlProtocol(self, didReceive: response, cacheStoragePolicy: .notAllowed)
         client?.urlProtocol(self, didLoad: result.data)
         client?.urlProtocolDidFinishLoading(self)
     }
 
     override func stopLoading() {}
 }
 
 private final class AuthURLProtocolState: @unchecked Sendable {
     private let lock = NSLock()
     private var challengeAttempts = 0
     private var handler: (@Sendable (URLRequest, Int) -> AuthURLProtocol.Result)?
 
     func reset() {
         lock.withLock {
             challengeAttempts = 0
             handler = nil
         }
     }
 
     func setHandler(_ next: @escaping @Sendable (URLRequest, Int) -> AuthURLProtocol.Result) {
         lock.withLock { handler = next }
     }
 
     func result(for request: URLRequest) -> AuthURLProtocol.Result {
         lock.withLock {
             if request.url?.path == "/attest/challenge" { challengeAttempts += 1 }
             return handler?(request, challengeAttempts) ?? (500, [:], Data())
         }
     }
 }