test: add auth-eth tests for IAppTcbPolicy and policy API endpoints

Author: kvinwang

kms/auth-eth/test/DstackApp.test.ts

@@ -127,6 +127,51 @@ describe("DstackApp", function () {
     });
   });
 
+  describe("TCB policy (IAppTcbPolicy)", function () {
+    const testPolicy = '{"version":1,"intel_qal":["policy1"]}';
+
+    it("Should return empty string by default", async function () {
+      expect(await appAuth.tcbPolicy()).to.equal("");
+    });
+
+    it("Should allow owner to set TCB policy", async function () {
+      await appAuth.setTcbPolicy(testPolicy);
+      expect(await appAuth.tcbPolicy()).to.equal(testPolicy);
+    });
+
+    it("Should emit TcbPolicySet event", async function () {
+      await expect(appAuth.setTcbPolicy(testPolicy))
+        .to.emit(appAuth, "TcbPolicySet")
+        .withArgs(testPolicy);
+    });
+
+    it("Should allow clearing TCB policy with empty string", async function () {
+      await appAuth.setTcbPolicy(testPolicy);
+      await appAuth.setTcbPolicy("");
+      expect(await appAuth.tcbPolicy()).to.equal("");
+    });
+
+    it("Should prevent non-owners from setting TCB policy", async function () {
+      await expect(
+        appAuth.connect(user).setTcbPolicy(testPolicy)
+      ).to.be.revertedWithCustomError(appAuth, "OwnableUnauthorizedAccount");
+    });
+
+    it("Should support IAppTcbPolicy interface (ERC-165)", async function () {
+      // IAppTcbPolicy interfaceId = tcbPolicy() ^ setTcbPolicy(string)
+      // We verify via supportsInterface
+      const iface = new ethers.Interface([
+        "function tcbPolicy() view returns (string)",
+        "function setTcbPolicy(string)",
+      ]);
+      const interfaceId =
+        BigInt(iface.getFunction("tcbPolicy")!.selector) ^
+        BigInt(iface.getFunction("setTcbPolicy")!.selector);
+      const id = "0x" + (interfaceId & BigInt("0xffffffff")).toString(16).padStart(8, "0");
+      expect(await appAuth.supportsInterface(id)).to.be.true;
+    });
+  });
+
   describe("Initialize with device and hash", function () {
     let appAuthWithData: DstackApp;
     const testDevice = ethers.randomBytes(32);
@@ -251,3 +296,52 @@ describe("DstackApp", function () {
     });
   });
 });
+
+describe("DstackKms TCB policy", function () {
+  let kmsContract: any;
+  let owner: SignerWithAddress;
+  let user: SignerWithAddress;
+
+  beforeEach(async function () {
+    [owner, user] = await ethers.getSigners();
+    kmsContract = await deployContract(hre, "DstackKms", [
+      owner.address,
+      ethers.ZeroAddress,
+    ], true);
+  });
+
+  it("Should return empty string by default", async function () {
+    expect(await kmsContract.tcbPolicy()).to.equal("");
+  });
+
+  it("Should allow owner to set TCB policy", async function () {
+    const policy = '{"version":1,"intel_qal":[]}';
+    await kmsContract.setTcbPolicy(policy);
+    expect(await kmsContract.tcbPolicy()).to.equal(policy);
+  });
+
+  it("Should emit TcbPolicySet event", async function () {
+    const policy = '{"version":1}';
+    await expect(kmsContract.setTcbPolicy(policy))
+      .to.emit(kmsContract, "TcbPolicySet")
+      .withArgs(policy);
+  });
+
+  it("Should prevent non-owners from setting TCB policy", async function () {
+    await expect(
+      kmsContract.connect(user).setTcbPolicy("test")
+    ).to.be.revertedWithCustomError(kmsContract, "OwnableUnauthorizedAccount");
+  });
+
+  it("Should support IAppTcbPolicy interface (ERC-165)", async function () {
+    const iface = new ethers.Interface([
+      "function tcbPolicy() view returns (string)",
+      "function setTcbPolicy(string)",
+    ]);
+    const interfaceId =
+      BigInt(iface.getFunction("tcbPolicy")!.selector) ^
+      BigInt(iface.getFunction("setTcbPolicy")!.selector);
+    const id = "0x" + (interfaceId & BigInt("0xffffffff")).toString(16).padStart(8, "0");
+    expect(await kmsContract.supportsInterface(id)).to.be.true;
+  });
+});

kms/auth-eth/test/ethereum.test.ts

@@ -81,4 +81,38 @@ describe('EthereumBackend', () => {
       expect(result.isAllowed).toBe(false);
     });
   });
+
+  describe('getAppPolicy', () => {
+    it('should return empty tcbPolicy by default', async () => {
+      const result = await backend.getAppPolicy(appId);
+      expect(result.tcbPolicy).toBe('');
+    });
+
+    it('should return set tcbPolicy', async () => {
+      const policy = '{"version":1,"intel_qal":["test-policy"]}';
+      await appAuth.setTcbPolicy(policy);
+      const result = await backend.getAppPolicy(appId);
+      expect(result.tcbPolicy).toBe(policy);
+    });
+
+    it('should return empty string for address without IAppTcbPolicy', async () => {
+      const randomAddr = ethers.Wallet.createRandom().address;
+      const result = await backend.getAppPolicy(randomAddr);
+      expect(result.tcbPolicy).toBe('');
+    });
+  });
+
+  describe('getKmsPolicy', () => {
+    it('should return empty tcbPolicy by default', async () => {
+      const result = await backend.getKmsPolicy();
+      expect(result.tcbPolicy).toBe('');
+    });
+
+    it('should return set tcbPolicy', async () => {
+      const policy = '{"version":1,"intel_qal":[]}';
+      await kmsContract.setTcbPolicy(policy);
+      const result = await backend.getKmsPolicy();
+      expect(result.tcbPolicy).toBe(policy);
+    });
+  });
 });

kms/auth-eth/test/main.test.ts

@@ -10,7 +10,12 @@ import { BootInfo } from '../src/types';
 jest.mock('../src/ethereum', () => {
   return {
     EthereumBackend: jest.fn().mockImplementation(() => ({
-      checkBoot: jest.fn()
+      checkBoot: jest.fn(),
+      getAppPolicy: jest.fn(),
+      getKmsPolicy: jest.fn(),
+      getGatewayAppId: jest.fn().mockResolvedValue('0x1234'),
+      getChainId: jest.fn().mockResolvedValue(1),
+      getAppImplementation: jest.fn().mockResolvedValue('0x0000000000000000000000000000000000000000'),
     }))
   };
 });
@@ -114,4 +119,79 @@ describe('Server', () => {
       expect(result.reason).toMatch(/Test backend error/);
     });
   });
+
+  describe('GET /policy/app/:appId', () => {
+    it('should return tcbPolicy from backend', async () => {
+      const policy = '{"version":1,"intel_qal":["test"]}';
+      app.ethereum.getAppPolicy = jest.fn().mockResolvedValue({ tcbPolicy: policy });
+
+      const response = await app.inject({
+        method: 'GET',
+        url: '/policy/app/0x9012345678901234567890123456789012345678',
+      });
+
+      expect(response.statusCode).toBe(200);
+      const result = JSON.parse(response.payload);
+      expect(result.tcbPolicy).toBe(policy);
+    });
+
+    it('should return empty tcbPolicy when none set', async () => {
+      app.ethereum.getAppPolicy = jest.fn().mockResolvedValue({ tcbPolicy: '' });
+
+      const response = await app.inject({
+        method: 'GET',
+        url: '/policy/app/0x9012345678901234567890123456789012345678',
+      });
+
+      expect(response.statusCode).toBe(200);
+      const result = JSON.parse(response.payload);
+      expect(result.tcbPolicy).toBe('');
+    });
+  });
+
+  describe('GET /policy/kms', () => {
+    it('should return tcbPolicy from backend', async () => {
+      const policy = '{"version":1,"intel_qal":[]}';
+      app.ethereum.getKmsPolicy = jest.fn().mockResolvedValue({ tcbPolicy: policy });
+
+      const response = await app.inject({
+        method: 'GET',
+        url: '/policy/kms',
+      });
+
+      expect(response.statusCode).toBe(200);
+      const result = JSON.parse(response.payload);
+      expect(result.tcbPolicy).toBe(policy);
+    });
+
+    it('should return empty tcbPolicy when none set', async () => {
+      app.ethereum.getKmsPolicy = jest.fn().mockResolvedValue({ tcbPolicy: '' });
+
+      const response = await app.inject({
+        method: 'GET',
+        url: '/policy/kms',
+      });
+
+      expect(response.statusCode).toBe(200);
+      const result = JSON.parse(response.payload);
+      expect(result.tcbPolicy).toBe('');
+    });
+  });
+
+  describe('GET /', () => {
+    it('should return server info', async () => {
+      const response = await app.inject({
+        method: 'GET',
+        url: '/',
+      });
+
+      expect(response.statusCode).toBe(200);
+      const result = JSON.parse(response.payload);
+      expect(result.status).toBe('ok');
+      expect(result).toHaveProperty('kmsContractAddr');
+      expect(result).toHaveProperty('gatewayAppId');
+      expect(result).toHaveProperty('chainId');
+      expect(result).toHaveProperty('appImplementation');
+    });
+  });
 });