/// <reference types="node" /> import * as NodeCrypto from "node:crypto"; import { vi } from "vite-plus/test";import { describe, expect, it } from "@effect/vitest";import * as Crypto from "effect/Crypto";import * as Effect from "effect/Effect";import { verifyDpopProof } from "@t3tools/shared/dpop"; import {  CloudDpopProofError,  CloudDpopStorageError,  createDpopProof,  generateDpopProofKeyPair,  isCloudDpopError,  loadOrCreateDpopProofKeyPair,  cryptoLayer,} from "./dpop"; vi.mock("expo-crypto", () => ({  CryptoDigestAlgorithm: {    SHA1: "SHA-1",    SHA256: "SHA-256",    SHA384: "SHA-384",    SHA512: "SHA-512",  },  getRandomBytes: (byteCount: number) => new Uint8Array(NodeCrypto.randomBytes(byteCount)),  getRandomBytesAsync: (byteCount: number) =>    Promise.resolve(new Uint8Array(NodeCrypto.randomBytes(byteCount))),  digest: (algorithm: string, data: unknown) => {    if (!(data instanceof Uint8Array)) {      return Promise.reject(new TypeError("expo-crypto digest data must be a typed array."));    }    return Promise.resolve(      new Uint8Array(NodeCrypto.createHash(algorithm).update(data).digest()).buffer,    );  },})); const secureStore = new Map<string, string>();vi.mock("expo-secure-store", () => ({  getItemAsync: (key: string) => Promise.resolve(secureStore.get(key) ?? null),  setItemAsync: (key: string, value: string) => {    secureStore.set(key, value);    return Promise.resolve();  },})); function proofIat(proof: string): number {  const payload = proof.split(".")[1];  if (!payload) {    throw new Error("Missing DPoP payload.");  }  const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as {    readonly iat: number;  };  return decoded.iat;} function proofHtu(proof: string): string {  const payload = proof.split(".")[1];  if (!payload) {    throw new Error("Missing DPoP payload.");  }  const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as {    readonly htu: string;  };  return decoded.htu;} describe("mobile DPoP", () => {  it.effect("passes typed-array digest input through the Expo Crypto adapter", () =>    Effect.gen(function* () {      const crypto = yield* Crypto.Crypto;      const digest = yield* crypto.digest("SHA-256", new TextEncoder().encode("typed-array"));       expect(Buffer.from(digest).toString("hex")).toBe(        NodeCrypto.createHash("sha256").update("typed-array").digest("hex"),      );    }).pipe(Effect.provide(cryptoLayer)),  );   it.effect("persists and reuses the installation proof key", () =>    Effect.gen(function* () {      secureStore.clear();      const first = yield* loadOrCreateDpopProofKeyPair();      const second = yield* loadOrCreateDpopProofKeyPair();       expect(second.thumbprint).toBe(first.thumbprint);      expect(second.privateJwk).toEqual(first.privateJwk);    }).pipe(Effect.provide(cryptoLayer)),  );   it.effect("rejects malformed persisted proof keys", () =>    Effect.gen(function* () {      secureStore.set("t3code.cloud.dpop-proof-key", `{"kty":"EC","crv":"P-256","d":42}`);       const error = yield* loadOrCreateDpopProofKeyPair().pipe(Effect.flip);       expect(error).toBeInstanceOf(CloudDpopStorageError);      expect(error).toMatchObject({        operation: "decode",        storageKey: "t3code.cloud.dpop-proof-key",      });      expect(isCloudDpopError(error)).toBe(true);    }).pipe(Effect.provide(cryptoLayer)),  );   it.effect("rejects stored key material whose public coordinates do not match", () =>    Effect.gen(function* () {      secureStore.clear();      const generated = yield* generateDpopProofKeyPair();      secureStore.set(        "t3code.cloud.dpop-proof-key",        JSON.stringify({ ...generated.privateJwk, x: generated.privateJwk.y }),      );       const error = yield* loadOrCreateDpopProofKeyPair().pipe(Effect.flip);       expect(error).toBeInstanceOf(CloudDpopStorageError);      expect(error).toMatchObject({        operation: "restore",        storageKey: "t3code.cloud.dpop-proof-key",      });    }).pipe(Effect.provide(cryptoLayer)),  );   it.effect("preserves request context for an invalid proof URL", () =>    Effect.gen(function* () {      const proofKey = yield* generateDpopProofKeyPair();      const error = yield* createDpopProof({        method: "POST",        url: "http://",        proofKey,      }).pipe(Effect.flip);       expect(error).toBeInstanceOf(CloudDpopProofError);      expect(error).toMatchObject({        operation: "normalize-url",        method: "POST",        requestTarget: "<invalid-url>",        urlLength: "http://".length,        thumbprint: proofKey.thumbprint,      });      expect(isCloudDpopError(error)).toBe(true);    }).pipe(Effect.provide(cryptoLayer)),  );   it.effect("redacts credentials and non-HTU URL components from proof failures", () =>    Effect.gen(function* () {      const proofKey = yield* generateDpopProofKeyPair();      const url = "https://user:password@example.com/oauth/token?access_token=secret#fragment";      const error = yield* createDpopProof({        method: "POST",        url,        proofKey: {          ...proofKey,          privateJwk: { ...proofKey.privateJwk, d: "%" },        },      }).pipe(Effect.flip);       expect(error).toBeInstanceOf(CloudDpopProofError);      expect(error).toMatchObject({        operation: "import-private-key",        method: "POST",        requestTarget: "https://example.com/oauth/token",        urlLength: url.length,        thumbprint: proofKey.thumbprint,      });      expect(error).not.toHaveProperty("url");      expect(error.message).not.toContain("user");      expect(error.message).not.toContain("password");      expect(error.message).not.toContain("access_token");      expect(error.message).not.toContain("secret");      expect(error.message).not.toContain("fragment");    }).pipe(Effect.provide(cryptoLayer)),  );   it.effect("signs connect and bootstrap proofs with the same ephemeral proof key", () =>    Effect.gen(function* () {      const proofKey = yield* generateDpopProofKeyPair();      const connect = yield* createDpopProof({        method: "POST",        url: "https://relay.example.test/v1/environments/env-1/connect",        accessToken: "clerk-token",        proofKey,      });      const bootstrap = yield* createDpopProof({        method: "POST",        url: "https://desktop.example.test/oauth/token",        proofKey,      });       expect(connect.thumbprint).toBe(proofKey.thumbprint);      expect(bootstrap.thumbprint).toBe(proofKey.thumbprint);      expect(        verifyDpopProof({          proof: connect.proof,          method: "POST",          url: "https://relay.example.test/v1/environments/env-1/connect",          expectedThumbprint: proofKey.thumbprint,          expectedAccessToken: "clerk-token",          nowEpochSeconds: proofIat(connect.proof),        }),      ).toMatchObject({ ok: true, thumbprint: proofKey.thumbprint });      expect(        verifyDpopProof({          proof: bootstrap.proof,          method: "POST",          url: "https://desktop.example.test/oauth/token",          expectedThumbprint: proofKey.thumbprint,          nowEpochSeconds: proofIat(bootstrap.proof),        }),      ).toMatchObject({ ok: true, thumbprint: proofKey.thumbprint });    }).pipe(Effect.provide(cryptoLayer)),  );   it.effect("signs DPoP proofs with RFC 9449 htu normalization", () =>    Effect.gen(function* () {      const proofKey = yield* generateDpopProofKeyPair();      const proof = yield* createDpopProof({        method: "POST",        url: "https://relay.example.test/v1/environments/env-1/connect?debug=1#ignored",        accessToken: "clerk-token",        proofKey,      });       expect(proofHtu(proof.proof)).toBe(        "https://relay.example.test/v1/environments/env-1/connect",      );      expect(        verifyDpopProof({          proof: proof.proof,          method: "POST",          url: "https://relay.example.test/v1/environments/env-1/connect?debug=1#ignored",          expectedThumbprint: proofKey.thumbprint,          expectedAccessToken: "clerk-token",          nowEpochSeconds: proofIat(proof.proof),        }),      ).toMatchObject({ ok: true });    }).pipe(Effect.provide(cryptoLayer)),  );});