atproto-identity / test / device-chain.test.js

// keet device chain (Ed25519, P2P side): root identity attests a device, the device
// vouches for the atproto DID, and a verifier resolves the chain back to the root — the
// attestation OUR P2P world checks, parallel to atproto's PLC authority.

import test from 'brittle'
import b4a from 'b4a'
import {
  deviceKeetKeyPair, rootIdentityPublicKey,
  attestDeviceChain, attestAtprotoBinding, verifyAtprotoBinding
} from '../lib/device-chain.js'

const ROOT = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
const DEVICE = 'legal winner thank year wave sausage worth useful legal winner thank yellow'
const DID = 'did:plc:waj4hyx6pr5zdwaccrcbsfti'

test('device chain binds the atproto DID to the root identity', async (t) => {
  const deviceKp = await deviceKeetKeyPair(DEVICE)
  const chain = await attestDeviceChain({ rootMnemonic: ROOT, devicePublicKey: deviceKp.publicKey })
  const bound = attestAtprotoBinding({ deviceKeyPair: deviceKp, did: DID, proof: chain })

  const res = verifyAtprotoBinding({ proof: bound, did: DID })
  const rootPk = await rootIdentityPublicKey(ROOT)

  t.ok(res, 'binding proof verifies')
  t.ok(res && b4a.equals(res.identityPublicKey, rootPk), 'chain resolves to the ROOT identity')
  t.ok(res && b4a.equals(res.devicePublicKey, deviceKp.publicKey), 'the device is the attested leaf')
})

test('binding is rejected for a different DID or a wrong expected device', async (t) => {
  const deviceKp = await deviceKeetKeyPair(DEVICE)
  const chain = await attestDeviceChain({ rootMnemonic: ROOT, devicePublicKey: deviceKp.publicKey })
  const bound = attestAtprotoBinding({ deviceKeyPair: deviceKp, did: DID, proof: chain })

  t.absent(verifyAtprotoBinding({ proof: bound, did: 'did:plc:someoneelsesdifferentdid' }),
    'a different DID → rejected (device signed the real DID)')
  const otherKp = await deviceKeetKeyPair(ROOT)
  t.absent(verifyAtprotoBinding({ proof: bound, did: DID, expectedDevice: otherKp.publicKey }),
    'a wrong expected device → rejected')
})