Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/chimera-beacon-client.test.js

@@ -0,0 +1,84 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+const {
+  createChimeraBeaconClient, parseBeaconResponse, parseSentinelResponse, buildSentinelRequest,
+  parsePairResponse, hmacHex, REQUEST_PREFIX, SENTINEL_REQUEST_PREFIX, BEACON_PORT, MAX_PACKET_BYTES,
+} = require('../../src/services/chimera-beacon-client');
+
+test('Chimera Beacon protocol validates identity, nonce and bounded read-only telemetry', () => {
+  const nonce = '0123456789abcdef';
+  const response = Buffer.from(JSON.stringify({ schema: 1, service: 'chimera-beacon', version: '0.1.0', nonce, uptimeSeconds: 42, model: 'CFI-1016A', cpuTemperatureC: 61, socTemperatureC: 58, capabilities: ['identity', 'temperature', 'uptime', 'not-allowed'] }));
+  const parsed = parseBeaconResponse(response, nonce);
+  assert.equal(parsed.version, '0.1.0');
+  assert.equal(parsed.model, 'CFI-1016A');
+  assert.equal(parsed.cpuTemperatureC, 61);
+  assert.deepEqual(parsed.capabilities, ['identity', 'temperature', 'uptime']);
+  assert.equal(parsed.security.authenticated, false);
+  assert.equal(BEACON_PORT, 9234);
+  assert.equal(REQUEST_PREFIX, 'CHIMERA_DISCOVER/1 ');
+  assert.throws(() => parseBeaconResponse(response, 'ffffffffffffffff'), /nonce/);
+});
+
+test('Sentinel 0.2 authenticates bounded telemetry and rejects spoofing, replay and oversized packets', () => {
+  const key = Buffer.alloc(32, 7);
+  const nonce = '0123456789abcdef0123456789abcdef';
+  const timestamp = 2_000_000_000;
+  const payload = Buffer.from(JSON.stringify({
+    version: '0.2.0', capabilities: ['identity', 'temperature', 'uptime', 'memory', 'volumes', 'errors', 'shell'],
+    model: 'CFI-1216A', uptimeSeconds: 123, cpuTemperatureC: 60, socTemperatureC: 58,
+    memory: { totalBytes: 1_000, availableBytes: 400 },
+    volumes: [{ id: 'internal-data', kind: 'internal', mountpoint: '/data', filesystem: 'unknown', totalBytes: 5_000, freeBytes: 2_000, readOnly: false }],
+    errors: [],
+  })).toString('base64');
+  const signature = hmacHex(key, `response|${nonce}|${timestamp}|${payload}`);
+  const response = Buffer.from(JSON.stringify({ schema: 2, service: 'chimera-sentinel', nonce, timestamp, payload, hmac: signature }));
+  const replay = new Set();
+  const parsed = parseSentinelResponse(response, { expectedNonce: nonce, pairingKey: key, nowSeconds: timestamp, replayCache: replay });
+  assert.equal(parsed.security.authenticated, true);
+  assert.equal(parsed.memory.availableBytes, 400);
+  assert.equal(parsed.volumes[0].kind, 'internal');
+  assert.equal(parsed.capabilities.includes('shell'), false);
+  assert.throws(() => parseSentinelResponse(response, { expectedNonce: nonce, pairingKey: key, nowSeconds: timestamp, replayCache: replay }), /replay/i);
+  assert.throws(() => parseSentinelResponse(response, { expectedNonce: nonce, pairingKey: Buffer.alloc(32, 8), nowSeconds: timestamp }), /HMAC/i);
+  assert.throws(() => parseSentinelResponse(Buffer.alloc(MAX_PACKET_BYTES + 1), { expectedNonce: nonce, pairingKey: key, nowSeconds: timestamp }), /grootte/i);
+});
+
+test('Sentinel requests and pair acknowledgements use the documented HMAC transcript', () => {
+  const key = Buffer.alloc(32, 9);
+  const nonce = 'abcdefabcdefabcdefabcdefabcdefab';
+  const timestamp = 2_000_000_001;
+  const request = buildSentinelRequest(nonce, timestamp, key).toString('ascii');
+  assert.equal(request, `${SENTINEL_REQUEST_PREFIX}${nonce} ${timestamp} ${hmacHex(key, `discover|${nonce}|${timestamp}`)}`);
+  const hmac = hmacHex(key, `paired|${nonce}|${timestamp}`);
+  const result = parsePairResponse(Buffer.from(JSON.stringify({ schema: 2, service: 'chimera-sentinel', paired: true, nonce, timestamp, hmac })), { expectedNonce: nonce, pairingKey: key, nowSeconds: timestamp });
+  assert.equal(result.authenticated, true);
+});
+
+test('a configured Sentinel key blocks silent downgrade when secure telemetry times out', async () => {
+  const client = createChimeraBeaconClient({
+    settings: { get: key => key === 'ftp.host' ? '127.0.0.1' : '' }, timeoutMs: 25,
+    pairingKeyProvider: () => '11'.repeat(32),
+  });
+  const result = await client.probe();
+  assert.equal(result.online, false);
+  assert.equal(result.downgradeBlocked, true);
+});
+
+test('Beacon source and Docker build keep deployment and dangerous capabilities out', () => {
+  const root = path.resolve(__dirname, '../..');
+  const source = fs.readFileSync(path.join(root, 'payloads', 'chimera-beacon', 'main.c'), 'utf8');
+  const dockerfile = fs.readFileSync(path.join(root, 'Dockerfile'), 'utf8');
+  assert.match(source, /CHIMERA_DISCOVER\/1/);
+  assert.match(source, /CHIMERA_DISCOVER\/2/);
+  assert.match(source, /PAIR_WINDOW_SECONDS 120/);
+  assert.match(source, /chimera_hmac_sha256/);
+  assert.match(source, /SOCK_DGRAM/);
+  assert.doesNotMatch(source, /sceKernelGetHwSerialNumber|system\s*\(|execv|fopen|open\s*\(/);
+  assert.match(dockerfile, /sdk\/releases\/download\/v0\.41/);
+  assert.match(dockerfile, /ebfb0acb5260511951a80e17db41650c62d20a8caf8659a230b928dc85005984/);
+  assert.match(dockerfile, /chimera-beacon\.elf/);
+});