mirror of
https://github.com/sonr-io/sonr.git
synced 2026-08-02 17:31:39 +00:00
* feat: Add Enclave Usage Examples * feat(es/ucan): Add comprehensive integration tests - Create integration.test.ts with full UCAN token lifecycle testing - Cover end-to-end token creation, parsing, and validation - Test capability attenuation and delegation chains - Validate multi-algorithm support and timestamp scenarios - Implement error recovery and performance test scenarios 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com> * No commit suggestions generated * No commit suggestions generated * chore: Remove migrated components and add migration documentation Removed all code and references for components that have been moved to separate repositories: **Moved to sonr-io/hway:** - bridge/ - HTTP service with OAuth2/OIDC/WebAuthn handlers - cmd/hway/ - Highway service binary - internal/migrations/ - PostgreSQL schema migrations **Moved to sonr-io/motr:** - cmd/motr/ - Motor worker service (WASM vault operations) - cmd/vault/ - Vault CLI tool - crypto/ - Comprehensive cryptographic library - packages/ - TypeScript SDK packages (es, sdk, ui, com, pkl) - web/auth/ - Authentication web application - web/dash/ - Dashboard web application **Updated Configuration:** - Makefile: Removed build/test/release targets for moved components - CLAUDE.md: Simplified to focus on core blockchain components - devbox.json: Removed scripts for moved services - docker-compose.yml: Removed hway, postgres, redis, auth, dash services - .github/scopes.yml: Removed CI scopes for migrated components - .goreleaser.yml: Updated release configuration **Added Migration Documentation:** - MIGRATE_HWAY.md: Comprehensive Highway service architecture and migration guide - MIGRATE_MOTR.md: Comprehensive Motor/Worker/Vault architecture and migration guide These migration documents provide complete context for setting up the new repositories including architecture diagrams, component breakdowns, API documentation, and migration checklists. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * No commit suggestions generated * chore: Remove contracts references and documentation Removed all references to the contracts directory that was migrated to a separate repository. **Changes:** - .gitignore: Removed contract-specific ignore patterns for DAO and wSNR contracts - .gitignore: Removed hway and motr binary references (already migrated) - .rgignore: Removed contracts, chains, and crypto directory references - docs/reference/contracts/: Removed DAO.mdx and wSNR.mdx documentation files This completes the cleanup of migrated components from the repository. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: add crypto library migration documentation Added comprehensive migration documentation for the crypto library that was moved to sonr-io/crypto repository. This documentation provides complete context for understanding the cryptographic primitives and protocols used throughout the Sonr ecosystem. ## Key Documentation Added ### MIGRATE_CRYPTO.md Complete documentation of the crypto library covering: **Core Cryptographic Primitives** - Elliptic curve implementations (Ed25519, Secp256k1, P-256, BLS12-381, Pallas/Vesta) - Native curve arithmetic with optimized field operations - Pairing-friendly curves for BLS signatures **Multi-Party Computation (MPC)** - MPC enclave for vault key generation and management - Threshold cryptography (TECDSA, TED25519 with FROST protocol) - Distributed Key Generation (DKG) via Gennaro and FROST protocols - Secret sharing schemes (Shamir, Feldman VSS, Pedersen VSS) **Digital Signature Schemes** - BLS signatures with aggregation support - BBS+ signatures for selective disclosure - Schnorr signatures (standard and Mina/NEM variants) - ECDSA with deterministic nonce generation **Zero-Knowledge Proofs** - Bulletproofs for range proofs - Inner Product Arguments (IPA) - Batch verification support **Advanced Cryptographic Protocols** - Cryptographic accumulators for set membership proofs - Paillier homomorphic encryption - Oblivious Transfer (OT) protocols - Verifiable Random Functions (VRF) **Key Management & Identity** - DID key management with multi-chain support - Multi-algorithm public key handling - Wallet address derivation (Bitcoin, Ethereum, Cosmos, Solana, etc.) **UCAN Integration** - User-Controlled Authorization Networks - Capability delegation and attenuation - JWT-based capability tokens - MPC-enabled UCAN signing **Security Utilities** - AEAD encryption (AES-GCM, AES-SIV) - Argon2 key derivation - ECIES encryption - Secure memory handling ### MIGRATE_MOTR.md Updates Updated Motor migration documentation to clarify that the crypto library is now a separate external dependency at github.com/sonr-io/crypto v1.0.1 ## Repository Context The crypto library has been successfully migrated to its own repository and is published as a Go module. It serves as the foundational cryptographic layer for: - Sonr blockchain (snrd) - DID signatures, vault operations - Highway service (hway) - UCAN token signing, WebAuthn - Motor/Worker (motr) - MPC vault operations, threshold signatures ## Integration Impact All Sonr ecosystem components now depend on the external crypto library: ```go require github.com/sonr-io/crypto v1.0.1 ``` The migration enables independent versioning and maintenance of cryptographic primitives while maintaining security and compatibility across the ecosystem. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * No commit suggestions generated * No commit suggestions generated * No commit suggestions generated --------- Co-authored-by: Claude <noreply@anthropic.com>
296 lines
7.4 KiB
Go
296 lines
7.4 KiB
Go
package plugin
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/sonr-io/crypto/mpc"
|
|
)
|
|
|
|
// createTestEnclaveData creates mock enclave data for testing
|
|
func createTestEnclaveData() *mpc.EnclaveData {
|
|
// Generate a real enclave for testing to ensure IsValid() returns true
|
|
enclave, err := mpc.NewEnclave()
|
|
if err != nil {
|
|
// Fallback to mock data if real enclave generation fails
|
|
// This provides compatibility for environments without proper MPC support
|
|
testPubBytes := make([]byte, 65)
|
|
for i := range testPubBytes {
|
|
testPubBytes[i] = byte(i % 256)
|
|
}
|
|
return &mpc.EnclaveData{
|
|
PubHex: "03a1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12",
|
|
PubBytes: testPubBytes,
|
|
ValShare: nil,
|
|
UserShare: nil,
|
|
Nonce: make([]byte, 32),
|
|
Curve: mpc.K256Name,
|
|
}
|
|
}
|
|
|
|
return enclave.GetData()
|
|
}
|
|
|
|
func TestEnclaveConfigValidation(t *testing.T) {
|
|
t.Run("valid config", func(t *testing.T) {
|
|
config := DefaultEnclaveConfig()
|
|
config.EnclaveData = createTestEnclaveData()
|
|
|
|
if err := config.Validate(); err != nil {
|
|
t.Errorf("Valid config failed validation: %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("missing chain_id", func(t *testing.T) {
|
|
config := DefaultEnclaveConfig()
|
|
config.ChainID = ""
|
|
config.EnclaveData = createTestEnclaveData()
|
|
|
|
if err := config.Validate(); err == nil {
|
|
t.Error("Expected validation error for missing chain_id")
|
|
}
|
|
})
|
|
|
|
t.Run("missing enclave_data", func(t *testing.T) {
|
|
config := DefaultEnclaveConfig()
|
|
config.EnclaveData = nil
|
|
|
|
if err := config.Validate(); err == nil {
|
|
t.Error("Expected validation error for missing enclave_data")
|
|
}
|
|
})
|
|
|
|
t.Run("invalid vault config", func(t *testing.T) {
|
|
config := DefaultEnclaveConfig()
|
|
config.EnclaveData = createTestEnclaveData()
|
|
config.VaultConfig.MaxVaultSize = -1 // Invalid size
|
|
|
|
if err := config.Validate(); err == nil {
|
|
t.Error("Expected validation error for invalid vault config")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestVaultConfigValidation(t *testing.T) {
|
|
t.Run("valid vault config", func(t *testing.T) {
|
|
config := DefaultEnclaveConfig().VaultConfig
|
|
|
|
if err := config.Validate(); err != nil {
|
|
t.Errorf("Valid vault config failed validation: %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("negative max vault size", func(t *testing.T) {
|
|
config := VaultConfig{
|
|
MaxVaultSize: -1,
|
|
}
|
|
|
|
if err := config.Validate(); err == nil {
|
|
t.Error("Expected validation error for negative max vault size")
|
|
}
|
|
})
|
|
|
|
t.Run("excessive max vault size", func(t *testing.T) {
|
|
config := VaultConfig{
|
|
MaxVaultSize: 200 * 1024 * 1024, // 200MB (exceeds 100MB limit)
|
|
}
|
|
|
|
if err := config.Validate(); err == nil {
|
|
t.Error("Expected validation error for excessive max vault size")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestSecurityConfigValidation(t *testing.T) {
|
|
t.Run("valid security config", func(t *testing.T) {
|
|
config := DefaultEnclaveConfig().Security
|
|
|
|
if err := config.Validate(); err != nil {
|
|
t.Errorf("Valid security config failed validation: %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("negative token lifetime", func(t *testing.T) {
|
|
config := SecurityConfig{
|
|
MaxTokenLifetime: -time.Hour,
|
|
}
|
|
|
|
if err := config.Validate(); err == nil {
|
|
t.Error("Expected validation error for negative token lifetime")
|
|
}
|
|
})
|
|
|
|
t.Run("excessive token lifetime", func(t *testing.T) {
|
|
config := SecurityConfig{
|
|
MaxTokenLifetime: 40 * 24 * time.Hour, // 40 days (exceeds 30 day limit)
|
|
}
|
|
|
|
if err := config.Validate(); err == nil {
|
|
t.Error("Expected validation error for excessive token lifetime")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestToManifestConfig(t *testing.T) {
|
|
config := DefaultEnclaveConfig()
|
|
config.EnclaveData = createTestEnclaveData()
|
|
|
|
manifestConfig, err := config.ToManifestConfig()
|
|
if err != nil {
|
|
t.Fatalf("ToManifestConfig failed: %v", err)
|
|
}
|
|
|
|
// Check required keys are present
|
|
requiredKeys := []string{
|
|
"chain_id",
|
|
"enclave",
|
|
"vault_config",
|
|
"security_config",
|
|
"timeout_config",
|
|
}
|
|
for _, key := range requiredKeys {
|
|
if _, exists := manifestConfig[key]; !exists {
|
|
t.Errorf("Missing required key in manifest config: %s", key)
|
|
}
|
|
}
|
|
|
|
// Check chain_id value
|
|
if manifestConfig["chain_id"] != config.ChainID {
|
|
t.Errorf(
|
|
"Chain ID mismatch: expected %s, got %s",
|
|
config.ChainID,
|
|
manifestConfig["chain_id"],
|
|
)
|
|
}
|
|
}
|
|
|
|
func TestDefaultConfigurations(t *testing.T) {
|
|
t.Run("default enclave config", func(t *testing.T) {
|
|
config := DefaultEnclaveConfig()
|
|
|
|
if config.ChainID == "" {
|
|
t.Error("Default enclave config should have non-empty chain_id")
|
|
}
|
|
|
|
if config.VaultConfig.MaxVaultSize <= 0 {
|
|
t.Error("Default vault config should have positive max_vault_size")
|
|
}
|
|
|
|
if config.Security.MaxTokenLifetime <= 0 {
|
|
t.Error("Default security config should have positive max_token_lifetime")
|
|
}
|
|
})
|
|
|
|
t.Run("default loader config", func(t *testing.T) {
|
|
config := DefaultLoaderConfig()
|
|
|
|
if !config.EnableWASI {
|
|
t.Error("Default loader config should enable WASI")
|
|
}
|
|
|
|
if config.MemoryLimit <= 0 {
|
|
t.Error("Default loader config should have positive memory limit")
|
|
}
|
|
|
|
if config.MaxConcurrentPlugins <= 0 {
|
|
t.Error("Default loader config should have positive max concurrent plugins")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestPluginStateManagement(t *testing.T) {
|
|
config := DefaultEnclaveConfig()
|
|
config.EnclaveData = createTestEnclaveData()
|
|
|
|
state := NewPluginState("test-plugin", config, nil)
|
|
|
|
t.Run("initial state", func(t *testing.T) {
|
|
if state.ID != "test-plugin" {
|
|
t.Errorf("Expected plugin ID 'test-plugin', got %s", state.ID)
|
|
}
|
|
|
|
if !state.IsHealthy {
|
|
t.Error("New plugin state should be healthy")
|
|
}
|
|
|
|
if state.ErrorCount != 0 {
|
|
t.Errorf("New plugin state should have zero error count, got %d", state.ErrorCount)
|
|
}
|
|
})
|
|
|
|
t.Run("health updates", func(t *testing.T) {
|
|
// Test successful operation
|
|
state.UpdateHealth(nil)
|
|
if !state.IsHealthy {
|
|
t.Error("Plugin should remain healthy after successful operation")
|
|
}
|
|
if state.ErrorCount != 0 {
|
|
t.Error("Error count should reset after successful operation")
|
|
}
|
|
|
|
// Test error handling
|
|
testError := fmt.Errorf("test error")
|
|
for i := 0; i < state.MaxErrors; i++ {
|
|
state.UpdateHealth(testError)
|
|
}
|
|
|
|
if state.IsHealthy {
|
|
t.Error("Plugin should be unhealthy after max errors")
|
|
}
|
|
if state.ErrorCount != state.MaxErrors {
|
|
t.Errorf("Expected error count %d, got %d", state.MaxErrors, state.ErrorCount)
|
|
}
|
|
})
|
|
|
|
t.Run("expiration check", func(t *testing.T) {
|
|
maxIdleTime := 1 * time.Second
|
|
|
|
// Plugin should not be expired immediately
|
|
if state.IsExpired(maxIdleTime) {
|
|
t.Error("Plugin should not be expired immediately")
|
|
}
|
|
|
|
// Simulate old last used time
|
|
state.LastUsed = time.Now().Add(-2 * time.Second)
|
|
|
|
if !state.IsExpired(maxIdleTime) {
|
|
t.Error("Plugin should be expired after max idle time")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestManagerConfiguration(t *testing.T) {
|
|
loaderConfig := DefaultLoaderConfig()
|
|
manager := NewManager(loaderConfig)
|
|
defer manager.Close()
|
|
|
|
if manager.loaderConfig != loaderConfig {
|
|
t.Error("Manager should use provided loader config")
|
|
}
|
|
|
|
if len(manager.plugins) != 0 {
|
|
t.Error("New manager should have no plugins initially")
|
|
}
|
|
}
|
|
|
|
func TestCreateEnclaveConfig(t *testing.T) {
|
|
chainID := "test-chain"
|
|
enclaveData := createTestEnclaveData()
|
|
|
|
config := CreateEnclaveConfig(chainID, enclaveData)
|
|
|
|
if config.ChainID != chainID {
|
|
t.Errorf("Expected chain ID %s, got %s", chainID, config.ChainID)
|
|
}
|
|
|
|
if config.EnclaveData != enclaveData {
|
|
t.Error("Enclave data should match provided data")
|
|
}
|
|
|
|
// Should have default values for other fields
|
|
if config.VaultConfig.MaxVaultSize <= 0 {
|
|
t.Error("Should have default vault config values")
|
|
}
|
|
}
|