archetech / archon / 30766745305

93%

main: 94%

Pull #829

github

test(keymaster): cover validation guards and DIDComm rejection paths

keymaster.ts sat at 83.7% branches — the suites drive it along happy
paths, leaving validation guards and "already in the desired state"
short-circuits untaken. 30 tests take it to 84.9% (148 -> 137 missed).

Guards: normalizeAddressDomain against empty, whitespace, non-string,
null, undefined, `https://` and `://`, plus confirmation that a scheme is
stripped, case lowered and a non-default port retained in the host;
removeAddress rejecting an unknown address and one whose stored name
differs; checkAddress reporting 'unreachable' rather than throwing;
listAliases with and without includeIDs; verifyResponse's rejection paths.

DIDComm, targeting envelope security rather than error strings:

- packDidComm strips a caller-supplied `from` on an anoncrypt envelope.
  The code spreads the caller's message first, then forces typ/to and
  deletes from, so a caller cannot smuggle an impersonated sender into an
  unauthenticated envelope. Asserted by packing {from: 'did:cid:
  impersonated'} and checking it is gone after unpack.
- unpackDidComm rejects an envelope addressed to another identity — pack
  for alice, switch to bob, expect rejection. That check is what stops
  one identity opening another's mail.
- Signing round trip asserting nonRepudiation and a signer kid matching
  the sender; gateway delivery and mailbox failures; a recipient with no
  DIDCommMessaging endpoint; unpublishDidComm being idempotent and
  actually removing both the #key-agreement-1 VM and the #didcomm service.

Three of my own mistakes are worth recording, since each produced a test
that looked fine:

- One assertion iterated `fetchSpy.mock.calls` when fetch had never been
  called (importAddress throws at fetchIdInfo first), so the loop ran zero
  times and proved nothing. Now creates an ID first and asserts the call
  count, so it cannot pass vacuously.
- A test claimed deleting seed.mnemonicEnc would exercise ... (continued)

3536 of 4060 branches covered (87.09%)

Branch coverage included in aggregate %.

8171 of 8511 relevant lines covered (96.01%)

686.47 hits per line