teleport/mpc/__tests__/profile_negative.test.ts

/**
 * Profile-gate negative tests.
 *
 * Exhaustively exercises the 4 × 6 (profile × scheme) matrix from
 * SPEC §4.2 to assert that:
 *
 *  - Every (profile, scheme) cell in the admissible set returns the
 *    expected scheme.
 *  - Every (profile, scheme) cell outside the admissible set throws
 *    with a clear error message.
 *
 * This is the latch for Red HIGH #4 closure plus its symmetric leg
 * (PQ schemes under classical-compat throw). The 24-cell matrix
 * makes drift impossible to slip through.
 */

import { resolveSchemeFromEnv } from '../src/signers';

type Profile = 'quasar-strict-pq' | 'classical-compat' | 'hybrid';
type Scheme =
  | 'ecdsa'
  | 'cggmp21'
  | 'frost'
  | 'pulsar'
  | 'corona'
  | 'double-lattice';

const PROFILES: Profile[] = ['quasar-strict-pq', 'classical-compat', 'hybrid'];
const SCHEMES: Scheme[] = ['ecdsa', 'cggmp21', 'frost', 'pulsar', 'corona', 'double-lattice'];
const CLASSICAL: Set<Scheme> = new Set(['ecdsa', 'cggmp21', 'frost']);
const PQ: Set<Scheme> = new Set(['pulsar', 'corona', 'double-lattice']);

/**
 * Authoritative admissibility table (matches SPEC §4.2).
 *
 * `null` means the resolver throws; otherwise it returns the cell value.
 *
 * Note: under `hybrid` the resolver emits a WARN (tested elsewhere)
 * but still resolves to the requested scheme — hybrid is permissive
 * by design.
 */
function admissible(profile: Profile, scheme: Scheme | undefined): Scheme | null {
  if (profile === 'quasar-strict-pq') {
    if (scheme === undefined) return 'double-lattice';
    return PQ.has(scheme) ? scheme : null;
  }
  if (profile === 'classical-compat') {
    if (scheme === undefined) return 'ecdsa';
    return CLASSICAL.has(scheme) ? scheme : null;
  }
  // hybrid
  if (scheme === undefined) return 'ecdsa';
  return scheme;
}

describe('profile-gate negative matrix — full 4 × (6+1)', () => {
  // 4 profiles × (6 schemes + 1 "scheme unset") = 28 cells. We assert
  // the full matrix against the SPEC table.
  for (const profile of PROFILES) {
    for (const scheme of [undefined, ...SCHEMES] as const) {
      const expected = admissible(profile, scheme);
      const cell = scheme === undefined ? '<unset>' : scheme;

      if (expected === null) {
        it(`(profile=${profile}, scheme=${cell}) MUST throw "incompatible"`, () => {
          expect(() =>
            resolveSchemeFromEnv({
              LUX_PROFILE: profile,
              ...(scheme ? { MPC_SCHEME: scheme } : {}),
            } as never),
          ).toThrow(/incompatible/);
        });
      } else {
        it(`(profile=${profile}, scheme=${cell}) MUST resolve to ${expected}`, () => {
          // Suppress hybrid WARN noise.
          const spy = jest.spyOn(console, 'warn').mockImplementation(() => undefined);
          try {
            const got = resolveSchemeFromEnv({
              LUX_PROFILE: profile,
              ...(scheme ? { MPC_SCHEME: scheme } : {}),
            } as never);
            expect(got).toBe(expected);
          } finally {
            spy.mockRestore();
          }
        });
      }
    }
  }
});

describe('profile-gate: fail-closed on unset LUX_PROFILE', () => {
  // No matter what MPC_SCHEME is set to, an unset LUX_PROFILE throws.
  // This is the Red HIGH #4 closure: the previous behaviour of
  // "silent ECDSA when env is unset" cannot recur.

  it.each([
    {},
    { MPC_SCHEME: 'ecdsa' },
    { MPC_SCHEME: 'pulsar' },
    { MPC_SCHEME: 'double-lattice' },
    { MPC_SCHEME: 'frost' },
    { MPC_SCHEME: 'cggmp21' },
    { MPC_SCHEME: 'corona' },
  ])('env=%j throws with explicit LUX_PROFILE remediation', (env) => {
    expect(() => resolveSchemeFromEnv(env as never)).toThrow(/LUX_PROFILE must be set/);
  });
});

describe('profile-gate: unknown values rejected explicitly', () => {
  it('unknown profile throws with allow-list', () => {
    expect(() => resolveSchemeFromEnv({ LUX_PROFILE: 'rubbish' } as never)).toThrow(
      /is not one of/,
    );
  });

  it('unknown scheme throws BEFORE profile coherence check', () => {
    // LUX_PROFILE is valid but MPC_SCHEME is bogus — must throw the
    // scheme-validation error first, not the coherence error.
    expect(() =>
      resolveSchemeFromEnv({
        LUX_PROFILE: 'classical-compat',
        MPC_SCHEME: 'bogus',
      } as never),
    ).toThrow(/MPC_SCHEME='bogus' is not one of/);
  });

  it('case-insensitive after trim', () => {
    // Demonstrate that 'FROST' / ' FROST  ' resolve identically to 'frost'
    // — defence against accidental capitalisation in env vars.
    expect(
      resolveSchemeFromEnv({
        LUX_PROFILE: 'classical-compat',
        MPC_SCHEME: '  FROST  ',
      } as never),
    ).toBe('frost');
  });
});