Add Cloudflare signing key contract

2026-05-07 23:58:36 -04:00
parent 90c5110d6c
commit 1013a22915
12 changed files with 1854 additions and 1 deletions
@@ -0,0 +1,59 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import {
+  SigningKeysSchemaError,
+  parsePublicSigningKeysDocument,
+  publicSigningKeysKvKey,
+} from "../src/signing_keys.js";
+
+const PUBLIC_KEY = "a".repeat(64);
+
+describe("public signing keys", () => {
+  it("builds an environment-prefixed KV key", () => {
+    assert.equal(publicSigningKeysKvKey("production"), "ely:production:public_signing_keys");
+  });
+
+  it("parses a valid key document", () => {
+    const document = parsePublicSigningKeysDocument(
+      JSON.stringify({
+        version: 1,
+        keys: [{ key_id: "elydora-alpha-plugins", public_key: PUBLIC_KEY.toUpperCase() }],
+      }),
+    );
+
+    assert.deepEqual(document, {
+      version: 1,
+      keys: [{ key_id: "elydora-alpha-plugins", public_key: PUBLIC_KEY }],
+    });
+  });
+
+  it("rejects duplicate key ids", () => {
+    assert.throws(
+      () =>
+        parsePublicSigningKeysDocument(
+          JSON.stringify({
+            version: 1,
+            keys: [
+              { key_id: "elydora-alpha-plugins", public_key: PUBLIC_KEY },
+              { key_id: "elydora-alpha-plugins", public_key: "b".repeat(64) },
+            ],
+          }),
+        ),
+      SigningKeysSchemaError,
+    );
+  });
+
+  it("rejects malformed public keys", () => {
+    assert.throws(
+      () =>
+        parsePublicSigningKeysDocument(
+          JSON.stringify({
+            version: 1,
+            keys: [{ key_id: "elydora-alpha-plugins", public_key: "abcd" }],
+          }),
+        ),
+      SigningKeysSchemaError,
+    );
+  });
+});