Shade/packages/shade-crypto-web/tests/hardening.test.ts

import { describe, test, expect } from 'bun:test';
import { SubtleCryptoProvider } from '../src/provider.js';
import { constantTimeEqual } from '@shade/core';

const crypto = new SubtleCryptoProvider();

describe('Cryptographic Hardening', () => {
  // ─── constantTimeEqual ───────────────────────────────────

  describe('constantTimeEqual', () => {
    test('equal arrays return true', () => {
      const a = new Uint8Array([1, 2, 3, 4, 5]);
      const b = new Uint8Array([1, 2, 3, 4, 5]);
      expect(crypto.constantTimeEqual(a, b)).toBe(true);
    });

    test('unequal arrays return false', () => {
      const a = new Uint8Array([1, 2, 3, 4, 5]);
      const b = new Uint8Array([1, 2, 3, 4, 6]);
      expect(crypto.constantTimeEqual(a, b)).toBe(false);
    });

    test('different lengths return false', () => {
      const a = new Uint8Array([1, 2, 3]);
      const b = new Uint8Array([1, 2, 3, 4]);
      expect(crypto.constantTimeEqual(a, b)).toBe(false);
    });

    test('empty arrays are equal', () => {
      expect(crypto.constantTimeEqual(new Uint8Array(0), new Uint8Array(0))).toBe(true);
    });

    test('works on full 32-byte keys', () => {
      const k1 = crypto.randomBytes(32);
      const k2 = new Uint8Array(k1);
      expect(crypto.constantTimeEqual(k1, k2)).toBe(true);

      k2[31] ^= 0x01;
      expect(crypto.constantTimeEqual(k1, k2)).toBe(false);
    });

    test('standalone function gives same result', () => {
      const a = crypto.randomBytes(32);
      const b = new Uint8Array(a);
      expect(constantTimeEqual(a, b)).toBe(true);
      b[0] ^= 0x01;
      expect(constantTimeEqual(a, b)).toBe(false);
    });

    // Statistical timing test — measure variance between mismatch-at-start vs mismatch-at-end
    // This is noisy on CI but catches obvious early-exit regressions.
    test('timing variance stays bounded across mismatch positions', () => {
      const len = 256;
      const target = crypto.randomBytes(len);

      const mismatchAtStart = new Uint8Array(target);
      mismatchAtStart[0] ^= 0xff;

      const mismatchAtEnd = new Uint8Array(target);
      mismatchAtEnd[len - 1] ^= 0xff;

      const iterations = 20000;
      const measure = (other: Uint8Array): number => {
        const t0 = performance.now();
        for (let i = 0; i < iterations; i++) crypto.constantTimeEqual(target, other);
        return performance.now() - t0;
      };

      // Warm up before measuring anything. The first loop through this code
      // pays for JIT compilation that the second one does not, which biased
      // whichever side ran first and is why the old version had to "allow 2x
      // for JIT/noise" — a tolerance covering a measurement artefact rather
      // than the property under test.
      measure(mismatchAtStart);
      measure(mismatchAtEnd);

      // Paired, interleaved samples, compared by median. A single pair is one
      // GC pause away from a false alarm: this test failed roughly one run in
      // fourteen on a loaded machine on 08.09.2026, and a security test that
      // cries wolf under load is a security test people learn to re-run until
      // it passes. The median throws out the pause instead of the property.
      const ratios: number[] = [];
      for (let round = 0; round < 5; round++) {
        const a = measure(mismatchAtStart);
        const b = measure(mismatchAtEnd);
        ratios.push(Math.max(a, b) / Math.min(a, b));
      }
      ratios.sort((x, y) => x - y);
      const median = ratios[Math.floor(ratios.length / 2)]!;

      // The threshold is unchanged and deliberately so: an early-exit compare
      // would take ~256x longer to reach a mismatch in the last byte than the
      // first, on every single round. Nothing about sampling weakens what this
      // catches — it only stops the scheduler from answering for the code.
      expect(median).toBeLessThan(3);
    });
  });

  // ─── zeroize ──────────────────────────────────────────────

  describe('zeroize', () => {
    test('fills buffer with zeros', () => {
      const buf = crypto.randomBytes(32);
      // Make sure it's not already zero
      const anyNonZero = buf.some((b) => b !== 0);
      expect(anyNonZero).toBe(true);

      crypto.zeroize(buf);
      expect(buf.every((b) => b === 0)).toBe(true);
    });

    test('handles empty buffer', () => {
      crypto.zeroize(new Uint8Array(0));
      // Should not throw
    });

    test('handles large buffer', () => {
      const buf = crypto.randomBytes(4096);
      crypto.zeroize(buf);
      expect(buf.every((b) => b === 0)).toBe(true);
    });
  });

  // ─── randomUint32 ─────────────────────────────────────────

  describe('randomUint32', () => {
    test('returns number in 32-bit unsigned range', () => {
      for (let i = 0; i < 100; i++) {
        const n = crypto.randomUint32();
        expect(n).toBeGreaterThanOrEqual(0);
        expect(n).toBeLessThanOrEqual(0xffffffff);
        expect(Number.isInteger(n)).toBe(true);
      }
    });

    test('produces different values each call', () => {
      const values = new Set<number>();
      for (let i = 0; i < 100; i++) {
        values.add(crypto.randomUint32());
      }
      // With 32 bits, 100 samples should all be unique
      expect(values.size).toBe(100);
    });

    test('distribution is not biased toward low values', () => {
      // Generate many and check that at least some are above 2^31
      // (would fail if using Math.random() with weird multiplier bugs)
      let highCount = 0;
      for (let i = 0; i < 1000; i++) {
        if (crypto.randomUint32() >= 0x80000000) highCount++;
      }
      // Should be around 500, accept 400-600 as "not obviously broken"
      expect(highCount).toBeGreaterThan(400);
      expect(highCount).toBeLessThan(600);
    });
  });
});