crossmate

push-worker.test.mjs (22934B)

---

 import test from "node:test";
 import assert from "node:assert/strict";
 import { createHmac } from "node:crypto";
 import { PushRegistry } from "../../Workers/push-worker.js";
 import { StubStorage } from "./helpers.mjs";
 
 function makeRegistry(env = {}) {
   const storage = new StubStorage();
   return { registry: new PushRegistry({ storage }, env), storage };
 }
 
 function attestRequest(ip) {
   return new Request("https://push.example/attest/register", {
     method: "POST",
     headers: { "CF-Connecting-IP": ip }
   });
 }
 
 const appAttestKeyBytes = Buffer.from([
   0xfb, 0xff, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
   0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d,
   0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
   0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d
 ]);
 const standardAppAttestKeyID = appAttestKeyBytes.toString("base64");
 const urlSafeAppAttestKeyID = appAttestKeyBytes.toString("base64url");
 
 function challengeRequest(keyID, deviceID = "device-1") {
   return new Request("https://push.example/attest/challenge", {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
       "CF-Connecting-IP": "203.0.113.9"
     },
     body: JSON.stringify({ deviceID, keyID })
   });
 }
 
 test("challenge accepts standard and URL-safe App Attest key IDs", async () => {
   assert.match(standardAppAttestKeyID, /[+/]/);
   assert.match(standardAppAttestKeyID, /=+$/);
   const standard = makeRegistry();
   const standardResponse = await standard.registry.fetch(challengeRequest(standardAppAttestKeyID));
   assert.equal(standardResponse.status, 200);
 
   const urlSafe = makeRegistry();
   const urlSafeResponse = await urlSafe.registry.fetch(challengeRequest(urlSafeAppAttestKeyID));
   assert.equal(urlSafeResponse.status, 200);
 });
 
 test("registration accepts both App Attest key-ID alphabets before attestation verification", async () => {
   for (const keyID of [standardAppAttestKeyID, urlSafeAppAttestKeyID]) {
     const { registry } = makeRegistry();
     const response = await registry.handleAttestationRegister(
       attestRequest("203.0.113.9"),
       JSON.stringify({
         deviceID: "device-1",
         keyID,
         challenge: "unknown-challenge",
         attestationObject: "AA"
       })
     );
     assert.equal(response.status, 401);
     assert.equal(await response.text(), "Unknown App Attest challenge");
   }
 });
 
 test("App Attest key-ID storage uses one URL-safe canonical component", () => {
   const { registry } = makeRegistry();
   const expected = `appattest-key:device-1:${urlSafeAppAttestKeyID}`;
   assert.equal(registry.appAttestRegistrationKey("device-1", standardAppAttestKeyID), expected);
   assert.equal(registry.appAttestRegistrationKey("device-1", urlSafeAppAttestKeyID), expected);
 });
 
 test("registration retry succeeds after its first response was lost", async () => {
   const { registry, storage } = makeRegistry();
   const registrationKey = registry.appAttestRegistrationKey("device-1", standardAppAttestKeyID);
   await storage.put(registrationKey, { publicKeySPKI: "already-verified" });
 
   const response = await registry.handleAttestationRegister(
     attestRequest("203.0.113.9"),
     JSON.stringify({
       deviceID: "device-1",
       keyID: standardAppAttestKeyID,
       challenge: "already-consumed",
       attestationObject: "AA"
     })
   );
 
   assert.equal(response.status, 204);
 });
 
 test("pre-885 registration storage migrates to the canonical key on lookup", async () => {
   const { registry, storage } = makeRegistry();
   const legacyKey = `appattest-key:device-1:${standardAppAttestKeyID}`;
   const canonicalKey = `appattest-key:device-1:${urlSafeAppAttestKeyID}`;
   const registration = { publicKeySPKI: "legacy-record" };
   await storage.put(legacyKey, registration);
 
   const loaded = await registry.loadAppAttestRegistration(
     "device-1",
     standardAppAttestKeyID,
     urlSafeAppAttestKeyID
   );
 
   assert.deepEqual(loaded, registration);
   assert.equal(storage.map.has(legacyKey), false);
   assert.deepEqual(await storage.get(canonicalKey), registration);
 });
 
 test("challenge rejects empty, oversized, malformed, and storage-smuggling key IDs", async () => {
   const invalidKeyIDs = [
     "",
     "A".repeat(257),
     "not:base64",
     "+_8=",
     "AA=A",
     "A",
     `${standardAppAttestKeyID}:forged`
   ];
   for (const keyID of invalidKeyIDs) {
     const { registry } = makeRegistry();
     const response = await registry.fetch(challengeRequest(keyID));
     assert.equal(response.status, 400, `expected rejection for ${JSON.stringify(keyID.slice(0, 20))}`);
   }
 });
 
 test("rate limit config uses table defaults", () => {
   const { registry } = makeRegistry();
   assert.deepEqual(registry.rateLimitConfig("PUBLISH_CRED"), { limit: 60, windowSeconds: 60 });
   assert.deepEqual(registry.rateLimitConfig("APP_ATTEST_REGISTER_IP"), { limit: 30, windowSeconds: 60 * 60 });
 });
 
 test("rate limit config honours env overrides and rejects junk", () => {
   const { registry } = makeRegistry({
     PUBLISH_CRED_LIMIT: "5",
     PUBLISH_CRED_WINDOW_SECONDS: "120",
     PUBLISH_ADDRESS_LIMIT: "not-a-number"
   });
   assert.deepEqual(registry.rateLimitConfig("PUBLISH_CRED"), { limit: 5, windowSeconds: 120 });
   // A malformed override falls back to the table default rather than NaN.
   assert.equal(registry.rateLimitConfig("PUBLISH_ADDRESS").limit, 30);
 });
 
 test("requests beyond the limit are rejected with a retry hint", async () => {
   const { registry } = makeRegistry();
   const config = registry.rateLimitConfig("PUBLISH_CRED");
   for (let i = 0; i < config.limit; i++) {
     const result = await registry.checkRateLimit("publish:cred", "cred-a", config);
     assert.equal(result.ok, true, `call ${i + 1} should be allowed`);
   }
   const over = await registry.checkRateLimit("publish:cred", "cred-a", config);
   assert.equal(over.ok, false);
   assert.ok(over.retryAfterSeconds >= 1);
 });
 
 test("the window slides: aged entries free quota again", async () => {
   const { registry, storage } = makeRegistry({ PUBLISH_CRED_LIMIT: "2" });
   const config = registry.rateLimitConfig("PUBLISH_CRED");
   await registry.checkRateLimit("publish:cred", "cred-a", config);
   await registry.checkRateLimit("publish:cred", "cred-a", config);
   assert.equal((await registry.checkRateLimit("publish:cred", "cred-a", config)).ok, false);
 
   storage.age(storage.keys("rate:")[0], config.windowSeconds * 1000 + 1000);
   assert.equal((await registry.checkRateLimit("publish:cred", "cred-a", config)).ok, true);
 });
 
 test("identities have independent buckets", async () => {
   const { registry } = makeRegistry({ PUBLISH_CRED_LIMIT: "1" });
   const config = registry.rateLimitConfig("PUBLISH_CRED");
   assert.equal((await registry.checkRateLimit("publish:cred", "cred-a", config)).ok, true);
   assert.equal((await registry.checkRateLimit("publish:cred", "cred-a", config)).ok, false);
   assert.equal((await registry.checkRateLimit("publish:cred", "cred-b", config)).ok, true);
 });
 
 test("attestation gate returns a 429 response once the device limit is hit", async () => {
   const { registry } = makeRegistry({ APP_ATTEST_REGISTER_DEVICE_LIMIT: "2" });
   const request = attestRequest("203.0.113.9");
   assert.equal(await registry.checkAttestationRateLimit(request, "register", "device-1"), null);
   assert.equal(await registry.checkAttestationRateLimit(request, "register", "device-1"), null);
   const limited = await registry.checkAttestationRateLimit(request, "register", "device-1");
   assert.equal(limited.status, 429);
   assert.ok(Number(limited.headers.get("Retry-After")) >= 1);
 });
 
 test("first write arms the sweep alarm at the horizon; later writes leave it", async () => {
   const { registry, storage } = makeRegistry();
   const config = registry.rateLimitConfig("PUBLISH_CRED");
   const before = Date.now();
   await registry.checkRateLimit("publish:cred", "cred-a", config);
   const horizon = registry.rateSweepHorizonMillis();
   // The default horizon is the largest table window: the 1h attest buckets.
   assert.equal(horizon, 60 * 60 * 1000);
   assert.ok(storage.alarmAt >= before + horizon);
 
   const armedAt = storage.alarmAt;
   await registry.checkRateLimit("publish:cred", "cred-b", config);
   assert.equal(storage.alarmAt, armedAt, "arm-if-unarmed must not reschedule");
 });
 
 test("an env window override raises the sweep horizon", () => {
   const { registry } = makeRegistry({ APP_ATTEST_REGISTER_IP_WINDOW_SECONDS: "7200" });
   assert.equal(registry.rateSweepHorizonMillis(), 7200 * 1000);
 });
 
 test("sweep prunes only stale rate keys and re-arms while live ones remain", async () => {
   const { registry, storage } = makeRegistry();
   const config = registry.rateLimitConfig("PUBLISH_CRED");
   await registry.checkRateLimit("publish:cred", "cred-a", config);
   await registry.checkRateLimit("publish:cred", "cred-b", config);
   const [staleKey, freshKey] = storage.keys("rate:");
   storage.age(staleKey, registry.rateSweepHorizonMillis() + 60 * 1000);
   await storage.put("gamecred:keep-me", { secret: "s" });
 
   await registry.alarm();
   assert.equal(storage.map.has(staleKey), false);
   assert.equal(storage.map.has(freshKey), true);
   assert.equal(storage.map.has("gamecred:keep-me"), true, "sweep must stay inside the rate: prefix");
   assert.ok(storage.alarmAt > Date.now(), "alarm re-arms while live keys remain");
 });
 
 test("sweep goes quiet once every rate key has expired", async () => {
   const { registry, storage } = makeRegistry();
   const config = registry.rateLimitConfig("PUBLISH_CRED");
   await registry.checkRateLimit("publish:cred", "cred-a", config);
   storage.age(storage.keys("rate:")[0], registry.rateSweepHorizonMillis() + 60 * 1000);
   storage.alarmAt = null;
 
   await registry.alarm();
   assert.deepEqual(storage.keys("rate:"), []);
   assert.equal(storage.alarmAt, null, "no live keys, no re-arm");
 });
 
 // --- Game-binding registration (H4): a credID-scoped address registration
 // must prove possession of that game's secret, exactly like a publish.
 
 const gameSecret = Buffer.alloc(32, 7).toString("base64url");
 const otherSecret = Buffer.alloc(32, 9).toString("base64url");
 
 function gameSignature(secret, credID, { bodyHash = "hash", timestamp = "1000", nonce = "nonce" } = {}) {
   const payload = ["crossmate-push-game-v1", credID, bodyHash, timestamp, nonce].join("\n");
   return createHmac("sha256", Buffer.from(secret, "base64url")).update(payload).digest("base64url");
 }
 
 function registerRequest(signature) {
   const headers = {
     "X-Crossmate-Body-SHA256": "hash",
     "X-Crossmate-Timestamp": "1000",
     "X-Crossmate-Nonce": "nonce"
   };
   if (signature) headers["X-Crossmate-Game-Signature"] = signature;
   return new Request("https://push.example/register", { method: "POST", headers });
 }
 
 function registerBody(addresses, deviceID = "device1") {
   return JSON.stringify({
     deviceID,
     token: "apns-token",
     environment: "production",
     addresses
   });
 }
 
 async function registerGameCred(registry, credID, secret = gameSecret) {
   const response = await registry.handleGameRegister(credID, JSON.stringify({ secret }));
   assert.ok(response.status === 201 || response.status === 204);
 }
 
 test("a correctly signed game binding registers under its credID", async () => {
   const { registry, storage } = makeRegistry();
   await registerGameCred(registry, "cred-1");
 
   const response = await registry.handleRegister(
     registerRequest(gameSignature(gameSecret, "cred-1")),
     registerBody([{ address: "addr-a", credID: "cred-1" }]),
     { deviceID: "device1" }
   );
 
   assert.equal(response.status, 204);
   assert.deepEqual(storage.keys("addr:"), ["addr:cred-1:addr-a:device1"]);
 });
 
 test("an App-Attest-only game binding (no game signature) is not stored", async () => {
   const { registry, storage } = makeRegistry();
   await registerGameCred(registry, "cred-1");
 
   // A departed participant (or anyone who learned the credID) has a valid
   // App Attest enrollment of their own but not the game secret.
   const response = await registry.handleRegister(
     registerRequest(null),
     registerBody([
       { address: "addr-account" },
       { address: "addr-a", credID: "cred-1" }
     ]),
     { deviceID: "device1" }
   );
 
   // The account-scoped binding still lands (legacy batched clients), but the
   // unproven game binding is dropped.
   assert.equal(response.status, 204);
   assert.deepEqual(storage.keys("addr:"), ["addr:addr-account:device1"]);
 });
 
 test("a game binding signed with the wrong secret is not stored", async () => {
   const { registry, storage } = makeRegistry();
   await registerGameCred(registry, "cred-1");
 
   const response = await registry.handleRegister(
     registerRequest(gameSignature(otherSecret, "cred-1")),
     registerBody([{ address: "addr-a", credID: "cred-1" }]),
     { deviceID: "device1" }
   );
 
   assert.equal(response.status, 204);
   assert.deepEqual(storage.keys("addr:"), []);
 });
 
 test("a game binding naming an unknown credID is not stored", async () => {
   const { registry, storage } = makeRegistry();
 
   const response = await registry.handleRegister(
     registerRequest(gameSignature(gameSecret, "cred-unregistered")),
     registerBody([{ address: "addr-a", credID: "cred-unregistered" }]),
     { deviceID: "device1" }
   );
 
   assert.equal(response.status, 204);
   assert.deepEqual(storage.keys("addr:"), []);
 });
 
 test("mixed credIDs in one request drop every game binding", async () => {
   const { registry, storage } = makeRegistry();
   await registerGameCred(registry, "cred-1");
   await registerGameCred(registry, "cred-2", otherSecret);
 
   // One request carries one signature, so it can prove at most one credID;
   // a batch that names two proves neither.
   const response = await registry.handleRegister(
     registerRequest(gameSignature(gameSecret, "cred-1")),
     registerBody([
       { address: "addr-a", credID: "cred-1" },
       { address: "addr-b", credID: "cred-2" }
     ]),
     { deviceID: "device1" }
   );
 
   assert.equal(response.status, 204);
   assert.deepEqual(storage.keys("addr:"), []);
 });
 
 test("after rotation, the old credential cannot bind under the new credID", async () => {
   const { registry, storage } = makeRegistry();
   // The room before rotation…
   await registerGameCred(registry, "cred-old");
   // …and the replacement a remaining participant registered after someone left.
   await registerGameCred(registry, "cred-new", otherSecret);
 
   // The departed participant holds the complete old credential but signs for
   // the new credID with the old secret — the only credential it has.
   const response = await registry.handleRegister(
     registerRequest(gameSignature(gameSecret, "cred-new")),
     registerBody([{ address: "addr-a", credID: "cred-new" }], "device-departed"),
     { deviceID: "device-departed" }
   );
   assert.equal(response.status, 204);
   assert.deepEqual(storage.keys("addr:"), [], "old secret must not subscribe to the rotated room");
 
   // A current participant holding the new secret registers fine.
   const ok = await registry.handleRegister(
     registerRequest(gameSignature(otherSecret, "cred-new")),
     registerBody([{ address: "addr-a", credID: "cred-new" }], "device-current"),
     { deviceID: "device-current" }
   );
   assert.equal(ok.status, 204);
   assert.deepEqual(storage.keys("addr:"), ["addr:cred-new:addr-a:device-current"]);
 });
 
 // --- Ingress and fanout bounds (M3): request bodies, lists, strings, and
 // APNs payloads are all refused before the work they would otherwise buy.
 
 test("an oversized request body is refused before auth", async () => {
   const { registry } = makeRegistry({ MAX_BODY_BYTES: "1024" });
   const response = await registry.fetch(new Request("https://push.example/publish", {
     method: "POST",
     body: "x".repeat(2048)
   }));
   assert.equal(response.status, 413);
 });
 
 test("a body exactly at the limit passes the size gate", async () => {
   const { registry } = makeRegistry({ MAX_BODY_BYTES: "1024" });
   const response = await registry.fetch(new Request("https://push.example/publish", {
     method: "POST",
     body: "x".repeat(1024)
   }));
   // Past the size gate; refused by auth, not by size.
   assert.equal(response.status, 401);
 });
 
 test("the body cap also covers the pre-auth attestation routes", async () => {
   const { registry } = makeRegistry({ MAX_BODY_BYTES: "1024" });
   const response = await registry.fetch(new Request("https://push.example/attest/challenge", {
     method: "POST",
     body: "x".repeat(2048)
   }));
   assert.equal(response.status, 413);
 });
 
 test("register refuses oversized address and mutedKinds lists", async () => {
   const { registry } = makeRegistry({ MAX_ADDRESS_COUNT: "2" });
   const tooMany = await registry.handleRegister(
     registerRequest(null),
     registerBody([{ address: "a1" }, { address: "a2" }, { address: "a3" }]),
     { deviceID: "device1" }
   );
   assert.equal(tooMany.status, 400);
 
   const mutedOverflow = await registry.handleRegister(
     registerRequest(null),
     JSON.stringify({
       deviceID: "device1",
       token: "apns-token",
       environment: "production",
       addresses: [{ address: "a1" }],
       mutedKinds: Array.from({ length: 33 }, (_, i) => `kind${i}`)
     }),
     { deviceID: "device1" }
   );
   assert.equal(mutedOverflow.status, 400);
 });
 
 test("register refuses a malformed token and skips malformed addresses", async () => {
   const { registry, storage } = makeRegistry();
   const badToken = await registry.handleRegister(
     registerRequest(null),
     JSON.stringify({
       deviceID: "device1",
       token: "x".repeat(200),
       environment: "production",
       addresses: [{ address: "a1" }]
     }),
     { deviceID: "device1" }
   );
   assert.equal(badToken.status, 400);
 
   // An address that could forge a `:`-separated storage-key segment is
   // dropped; the well-formed sibling in the same request still registers.
   const mixed = await registry.handleRegister(
     registerRequest(null),
     registerBody([{ address: "addr:forged" }, { address: "addr-ok" }]),
     { deviceID: "device1" }
   );
   assert.equal(mixed.status, 204);
   assert.deepEqual(storage.keys("addr:"), ["addr:addr-ok:device1"]);
 });
 
 test("a game's registration set is capped at write time", async () => {
   const { registry, storage } = makeRegistry({ MAX_REGISTRATIONS_PER_CRED: "2" });
   await registerGameCred(registry, "cred-1");
   for (const device of ["device1", "device2"]) {
     const response = await registry.handleRegister(
       registerRequest(gameSignature(gameSecret, "cred-1")),
       registerBody([{ address: `addr-${device}`, credID: "cred-1" }], device),
       { deviceID: device }
     );
     assert.equal(response.status, 204);
   }
 
   const over = await registry.handleRegister(
     registerRequest(gameSignature(gameSecret, "cred-1")),
     registerBody([{ address: "addr-device3", credID: "cred-1" }], "device3"),
     { deviceID: "device3" }
   );
   assert.equal(over.status, 400);
   assert.equal(storage.keys("addr:cred-1:").length, 2);
 
   // Re-registering an existing binding is an overwrite, not growth.
   const again = await registry.handleRegister(
     registerRequest(gameSignature(gameSecret, "cred-1")),
     registerBody([{ address: "addr-device1", credID: "cred-1" }], "device1"),
     { deviceID: "device1" }
   );
   assert.equal(again.status, 204);
 });
 
 test("game credential registration bounds credID and secret", async () => {
   const { registry } = makeRegistry();
   const badCredID = await registry.handleGameRegister(
     "cred:forged",
     JSON.stringify({ secret: gameSecret })
   );
   assert.equal(badCredID.status, 400);
 
   const hugeSecret = await registry.handleGameRegister(
     "cred-1",
     JSON.stringify({ secret: "A".repeat(1000) })
   );
   assert.equal(hugeSecret.status, 400);
 });
 
 function publishRequest() {
   return new Request("https://push.example/publish", { method: "POST" });
 }
 
 function publishBody(overrides = {}) {
   return JSON.stringify({
     kind: "win",
     addressees: [{ address: "addr-a" }],
     ...overrides
   });
 }
 
 test("a bounded publish with no registered targets succeeds cheaply", async () => {
   const { registry } = makeRegistry();
   const response = await registry.handlePublish(
     publishRequest(),
     publishBody(),
     { deviceID: "device1" }
   );
   assert.equal(response.status, 200);
   assert.deepEqual(await response.json(), { delivered: 0, removed: 0, muted: 0, failed: 0 });
 });
 
 test("publish refuses oversized addressee lists and fields", async () => {
   const { registry } = makeRegistry({ MAX_ADDRESS_COUNT: "2" });
   const tooMany = await registry.handlePublish(
     publishRequest(),
     publishBody({ addressees: [{ address: "a1" }, { address: "a2" }, { address: "a3" }] }),
     { deviceID: "device1" }
   );
   assert.equal(tooMany.status, 400);
 
   const hugeEnc = await registry.handlePublish(
     publishRequest(),
     publishBody({ addressees: [{ address: "a1", enc: "A".repeat(5000) }] }),
     { deviceID: "device1" }
   );
   assert.equal(hugeEnc.status, 400);
 
   const hugeBody = await registry.handlePublish(
     publishRequest(),
     publishBody({ alertBody: "x".repeat(1000) }),
     { deviceID: "device1" }
   );
   assert.equal(hugeBody.status, 400);
 
   const badCollapse = await registry.handlePublish(
     publishRequest(),
     publishBody({ collapseID: "c".repeat(65) }),
     { deviceID: "device1" }
   );
   assert.equal(badCollapse.status, 400);
 
   const badAddress = await registry.handlePublish(
     publishRequest(),
     publishBody({ addressees: [{ address: "addr:forged" }] }),
     { deviceID: "device1" }
   );
   assert.equal(badAddress.status, 400);
 });
 
 test("a publish whose APNs payload cannot fit is refused before any fanout", async () => {
   const { registry } = makeRegistry();
   // Each field is within its own cap, but the assembled APNs payload
   // (aps + kind + title + enc as JSON) exceeds the 4 KB APNs ceiling.
   const response = await registry.handlePublish(
     publishRequest(),
     publishBody({
       title: "t".repeat(400),
       alertBody: "b".repeat(500),
       addressees: [{ address: "a1", enc: "A".repeat(4000) }]
     }),
     { deviceID: "device1" }
   );
   assert.equal(response.status, 413);
 
   // The same shape with a small enc fits and proceeds.
   const fits = await registry.handlePublish(
     publishRequest(),
     publishBody({
       title: "t".repeat(400),
       alertBody: "b".repeat(500),
       addressees: [{ address: "a1", enc: "A".repeat(500) }]
     }),
     { deviceID: "device1" }
   );
   assert.equal(fits.status, 200);
 });
 
 test("broadcast fanout is capped even for an over-cap room", async () => {
   const { registry, storage } = makeRegistry({ MAX_BROADCAST_TARGETS: "2" });
   for (let index = 0; index < 4; index += 1) {
     await storage.put(`addr:cred-1:addr-${index}:device-${index}`, {
       token: "t",
       environment: "production"
     });
   }
   const targets = await registry.resolveBroadcastTargets(
     "cred-1", null, null, "body", undefined, undefined
   );
   assert.equal(targets.length, 2);
 });