[Init] Initial commit - NetMesh terminal manager

domain/pluginConnection.test.ts

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  isPluginCredentialCatalogEntryAvailable,
+  isSafePluginAuthenticationUrl,
+  pluginProtocolForProvider,
+  sanitizePluginConnection,
+} from './pluginConnection.ts';
+
+test('plugin connection profiles preserve opaque configuration when their provider is absent', () => {
+  const providerId = 'com.example.transport.connection';
+  const configuration = { endpoint: 'example', nested: { mode: 'safe' }, ports: [22, 443] };
+  const result = sanitizePluginConnection({
+    providerId,
+    configuration,
+    authenticationProviderId: 'com.example.transport.authentication',
+    credentialId: 'credential-reference-1234',
+  }, pluginProtocolForProvider(providerId));
+  assert.deepEqual(result, {
+    providerId,
+    configuration,
+    authenticationProviderId: 'com.example.transport.authentication',
+    credentialId: 'credential-reference-1234',
+  });
+  assert.notEqual(result?.configuration, configuration);
+});
+
+test('plugin connection profiles fail closed on protocol ownership mismatches and unsafe JSON', () => {
+  const providerId = 'com.example.transport.connection';
+  assert.equal(sanitizePluginConnection({ providerId, configuration: {} }, 'plugin:other.plugin.connection'), undefined);
+  assert.equal(sanitizePluginConnection({ providerId, configuration: { value: Number.NaN } }, pluginProtocolForProvider(providerId)), undefined);
+  assert.equal(sanitizePluginConnection({ providerId, configuration: { constructor: 'spoof' } }, pluginProtocolForProvider(providerId)), undefined);
+});
+
+test('plugin connection profiles preserve explicit null configuration', () => {
+  const providerId = 'com.example.transport.connection';
+  assert.deepEqual(
+    sanitizePluginConnection(
+      { providerId, configuration: null },
+      pluginProtocolForProvider(providerId),
+    ),
+    { providerId, configuration: null },
+  );
+});
+
+test('plugin credentials are selectable only after secure catalog publication', () => {
+  const credentialId = 'credential-reference-0001';
+  const published = new Set([credentialId]);
+  assert.equal(isPluginCredentialCatalogEntryAvailable(credentialId, 'secret', published), true);
+  assert.equal(isPluginCredentialCatalogEntryAvailable(credentialId, 'secret', new Set()), false);
+  assert.equal(
+    isPluginCredentialCatalogEntryAvailable(credentialId, 'enc:v1:djEwdGVzdAAAAAAAAAAAAAAAAA==', published),
+    false,
+  );
+  assert.equal(
+    isPluginCredentialCatalogEntryAvailable(credentialId, 'x'.repeat((64 * 1024) + 1), published),
+    false,
+  );
+});
+
+test('plugin authentication URLs require HTTPS except for loopback HTTP callbacks', () => {
+  assert.equal(isSafePluginAuthenticationUrl('https://login.example.com/authorize'), true);
+  assert.equal(isSafePluginAuthenticationUrl('http://localhost:44123/callback'), true);
+  assert.equal(isSafePluginAuthenticationUrl('http://127.0.0.1:44123/callback'), true);
+  assert.equal(isSafePluginAuthenticationUrl('http://[::1]:44123/callback'), true);
+  assert.equal(isSafePluginAuthenticationUrl('http://login.example.com/authorize'), false);
+  assert.equal(isSafePluginAuthenticationUrl('https://user:password@login.example.com/authorize'), false);
+  assert.equal(isSafePluginAuthenticationUrl('javascript:alert(1)'), false);
+});