crossmate

EngagementMessageAuthenticatorTests.swift (12834B)

---

 import Foundation
 import Testing
 
 @testable import Crossmate
 
 // Serialised: every `withAliceBobKey` test mutates the same global
 // `UserDefaults` key (`push.friendEncryptionKey.<pairKey(alice,bob)>`) and
 // removes it on the way out. Run in parallel, one test's cleanup can delete the
 // key while another is mid-flight, so `authTags` finds no local send key and
 // `roundTripVerifies` sees empty tags. The fixed pair is unique to this suite
 // (AccountPushCoordinatorTests uses a per-test UUID pair), so serialising here
 // is enough to isolate them.
 @Suite("EngagementMessageAuthenticator", .serialized)
 struct EngagementMessageAuthenticatorTests {
     private static let alice = "_alice"
     private static let bob = "_bob"
     private static let carol = "_carol"
 
     /// The game the receiving channel is bound to; `otherGameID` is a second
     /// game the sender also knows, used for cross-game injection attempts.
     private static let gameID = UUID(uuidString: "22222222-2222-2222-2222-222222222222")!
     private static let otherGameID = UUID(uuidString: "99999999-9999-9999-9999-999999999999")!
     private static let roster = [alice, bob]
 
     private static let localKeyPrefix = "push.friendEncryptionKey."
 
     /// Installs `payload` as Alice's own send key for the Alice↔Bob pair (in
     /// `UserDefaults`, where the sender reads it) and as the key Bob mirrors for
     /// Alice (in the directory, where the receiver reads it) — the same value in
     /// both places, exactly as the friend channel converges it.
     private static func withAliceBobKey(
         _ body: (FriendEncryptionKeyPayload) async throws -> Void
     ) async throws {
         let url = FileManager.default.temporaryDirectory
             .appendingPathComponent("engagement-auth-\(UUID().uuidString).json")
         let pairKey = FriendZone.pairKey(alice, bob)
         let defaultsKey = localKeyPrefix + pairKey
         defer {
             try? FileManager.default.removeItem(at: url)
             UserDefaults.standard.removeObject(forKey: defaultsKey)
         }
         try await FriendEncryptionKeyDirectory.$testingFileURL.withValue(url) {
             let payload = try #require(FriendEncryptionKeyPayload.fresh())
             UserDefaults.standard.set(payload.encodedString(), forKey: defaultsKey)
             FriendEncryptionKeyDirectory.upsert(payload, for: alice)
             try await body(payload)
         }
     }
 
     private static func cellEdit(
         authorID: String,
         letter: String = "A",
         gameID: UUID = gameID
     ) -> RealtimeCellEdit {
         RealtimeCellEdit(
             gameID: gameID,
             authorID: authorID,
             deviceID: "device-alice",
             row: 1,
             col: 2,
             letter: letter,
             mark: .pen(checked: nil),
             updatedAt: Date(timeIntervalSince1970: 1000),
             cellAuthorID: authorID
         )
     }
 
     private static func selection(
         authorID: String,
         gameID: UUID = gameID
     ) -> EngagementSelectionUpdate {
         EngagementSelectionUpdate(
             gameID: gameID,
             authorID: authorID,
             deviceID: "device-alice",
             selection: PlayerSelection(row: 1, col: 2, direction: .across),
             updatedAt: Date(timeIntervalSince1970: 1000)
         )
     }
 
     /// `verify` with this suite's fixed channel binding: the channel is bound
     /// to `gameID` and the game's known roster is Alice and Bob.
     private static func verify(
         _ message: EngagementMessage,
         localAuthorID: String,
         channelGameID: UUID = gameID,
         participantAuthorIDs: [String] = roster
     ) -> Bool {
         EngagementMessageAuthenticator.verify(
             message,
             localAuthorID: localAuthorID,
             channelGameID: channelGameID,
             participantAuthorIDs: participantAuthorIDs
         )
     }
 
     @Test("a tag Alice signs for Bob verifies on Bob's device")
     func roundTripVerifies() async throws {
         try await Self.withAliceBobKey { _ in
             let edit = Self.cellEdit(authorID: Self.alice)
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(cellEdit: edit),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             #expect(tags[Self.bob] != nil)
 
             let received = EngagementMessage(cellEdit: edit, senderAuthorID: Self.alice, auth: tags)
             #expect(Self.verify(received, localAuthorID: Self.bob))
         }
     }
 
     @Test("a forged sender with no matching key is dropped")
     func forgedSenderDropped() async throws {
         try await Self.withAliceBobKey { _ in
             // Carol asserts Alice's identity but can't produce Alice's tag: she
             // signs with her own (absent) key, so Bob holds no key for the tag.
             let edit = Self.cellEdit(authorID: Self.alice)
             let received = EngagementMessage(
                 cellEdit: edit,
                 senderAuthorID: Self.alice,
                 auth: [Self.bob: Data("forged".utf8).base64EncodedString()]
             )
             #expect(!Self.verify(received, localAuthorID: Self.bob))
         }
     }
 
     @Test("an edit whose authorID differs from the verified sender is dropped")
     func authorMismatchDropped() async throws {
         try await Self.withAliceBobKey { _ in
             // Alice authenticates as herself but carries an edit attributed to
             // Carol — she may only write her own record.
             let foreign = Self.cellEdit(authorID: Self.carol)
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(cellEdit: foreign),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             let received = EngagementMessage(cellEdit: foreign, senderAuthorID: Self.alice, auth: tags)
             #expect(!Self.verify(received, localAuthorID: Self.bob))
         }
     }
 
     @Test("a tampered payload no longer verifies")
     func tamperedPayloadDropped() async throws {
         try await Self.withAliceBobKey { _ in
             let signed = Self.cellEdit(authorID: Self.alice, letter: "A")
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(cellEdit: signed),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             // Same tag, different letter.
             let tampered = Self.cellEdit(authorID: Self.alice, letter: "Z")
             let received = EngagementMessage(cellEdit: tampered, senderAuthorID: Self.alice, auth: tags)
             #expect(!Self.verify(received, localAuthorID: Self.bob))
         }
     }
 
     @Test("a tampered logical tick no longer verifies")
     func tamperedTickDropped() async throws {
         try await Self.withAliceBobKey { _ in
             var signed = Self.cellEdit(authorID: Self.alice)
             signed.tick = 41
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(cellEdit: signed),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             let authentic = EngagementMessage(
                 cellEdit: signed,
                 senderAuthorID: Self.alice,
                 auth: tags
             )
             #expect(Self.verify(authentic, localAuthorID: Self.bob))
             var tampered = signed
             tampered.tick = 42
             let received = EngagementMessage(
                 cellEdit: tampered,
                 senderAuthorID: Self.alice,
                 auth: tags
             )
             #expect(!Self.verify(received, localAuthorID: Self.bob))
         }
     }
 
     @Test("with no key for the sender, an otherwise valid tag is dropped")
     func missingKeyDropped() async throws {
         // No directory entry and no local key are installed for the pair.
         let url = FileManager.default.temporaryDirectory
             .appendingPathComponent("engagement-auth-\(UUID().uuidString).json")
         defer { try? FileManager.default.removeItem(at: url) }
         try await FriendEncryptionKeyDirectory.$testingFileURL.withValue(url) {
             let edit = Self.cellEdit(authorID: Self.alice)
             let received = EngagementMessage(
                 cellEdit: edit,
                 senderAuthorID: Self.alice,
                 auth: [Self.bob: Data("anything".utf8).base64EncodedString()]
             )
             #expect(!Self.verify(received, localAuthorID: Self.bob))
         }
     }
 
     @Test("a correctly MACed edit for a different game is dropped")
     func crossGameEditDropped() async throws {
         try await Self.withAliceBobKey { _ in
             // Alice shares a live room with Bob for one game and signs a valid
             // frame targeting another game she knows the UUID of. The tag
             // verifies, but the payload game is not the channel's game.
             let edit = Self.cellEdit(authorID: Self.alice, gameID: Self.otherGameID)
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(cellEdit: edit),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             let received = EngagementMessage(cellEdit: edit, senderAuthorID: Self.alice, auth: tags)
             #expect(!Self.verify(received, localAuthorID: Self.bob))
             // The same frame is accepted on a channel bound to its own game.
             #expect(Self.verify(received, localAuthorID: Self.bob, channelGameID: Self.otherGameID))
         }
     }
 
     @Test("a batch containing any cross-game edit is dropped whole")
     func mixedGameBatchDropped() async throws {
         try await Self.withAliceBobKey { _ in
             let edits = [
                 Self.cellEdit(authorID: Self.alice),
                 Self.cellEdit(authorID: Self.alice, gameID: Self.otherGameID),
             ]
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(cellEdits: edits),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             let received = EngagementMessage(cellEdits: edits, senderAuthorID: Self.alice, auth: tags)
             #expect(!Self.verify(received, localAuthorID: Self.bob))
         }
     }
 
     @Test("a correctly MACed selection for a different game is dropped")
     func crossGameSelectionDropped() async throws {
         try await Self.withAliceBobKey { _ in
             let selection = Self.selection(authorID: Self.alice, gameID: Self.otherGameID)
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(selection: selection),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             let received = EngagementMessage(selection: selection, senderAuthorID: Self.alice, auth: tags)
             #expect(!Self.verify(received, localAuthorID: Self.bob))
             #expect(Self.verify(received, localAuthorID: Self.bob, channelGameID: Self.otherGameID))
         }
     }
 
     @Test("a sender outside the game's roster is dropped")
     func nonParticipantSenderDropped() async throws {
         try await Self.withAliceBobKey { _ in
             // Alice still holds Bob's friend key (they remain friends) but is
             // no longer a participant of the channel's game.
             let edit = Self.cellEdit(authorID: Self.alice)
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(cellEdit: edit),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             let received = EngagementMessage(cellEdit: edit, senderAuthorID: Self.alice, auth: tags)
             #expect(!Self.verify(
                 received,
                 localAuthorID: Self.bob,
                 participantAuthorIDs: [Self.bob, Self.carol]
             ))
         }
     }
 
     @Test("a sender that can key nobody produces no tags")
     func noRecipientsNoTags() async throws {
         let url = FileManager.default.temporaryDirectory
             .appendingPathComponent("engagement-auth-\(UUID().uuidString).json")
         defer { try? FileManager.default.removeItem(at: url) }
         try await FriendEncryptionKeyDirectory.$testingFileURL.withValue(url) {
             let edit = Self.cellEdit(authorID: Self.alice)
             let tags = EngagementMessageAuthenticator.authTags(
                 for: EngagementMessage(cellEdit: edit),
                 senderAuthorID: Self.alice,
                 recipientAuthorIDs: [Self.bob]
             )
             #expect(tags.isEmpty)
         }
     }
 }