test: add KMS unit tests and cross-language serde contract tests

- Unit tests for validate_onchain_tcb_policy: empty policy, version
  checks, malformed JSON, invalid Rego, TcbPolicyDoc deserialization
- Serde contract tests with shared JSON fixtures (kms/tests/fixtures/)
  validated by both Rust and TypeScript to catch field naming drift
- TDX quote sample fixtures for building QuoteVerificationResult in tests
- url_join utility test

Author: kvinwang

kms/auth-eth/test/serde_contract.test.ts

@@ -0,0 +1,72 @@
+// SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Serde contract tests: verify that TypeScript types correctly
+ * parse/produce the same JSON fixtures used by the Rust KMS tests.
+ *
+ * Direction-aware:
+ * - BootInfo:       KMS→auth-eth  → TS is the consumer  → test deserialization
+ * - BootResponse:   auth-eth→KMS  → TS is the producer  → test serialization
+ * - PolicyResponse: auth-eth→KMS  → TS is the producer  → test serialization
+ */
+
+import { BootInfo, BootResponse, PolicyResponse } from '../src/types';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const FIXTURES_DIR = path.resolve(__dirname, '../../tests/fixtures');
+
+describe('Serde contract tests (shared fixtures)', () => {
+  describe('BootInfo (KMS→auth-eth: TS deserializes)', () => {
+    it('should deserialize the shared fixture produced by Rust', () => {
+      const json = JSON.parse(fs.readFileSync(path.join(FIXTURES_DIR, 'boot_info.json'), 'utf8'));
+      const info: BootInfo = json;
+      // Verify all required fields are accessible after deserialization
+      expect(typeof info.mrAggregated).toBe('string');
+      expect(typeof info.osImageHash).toBe('string');
+      expect(typeof info.mrSystem).toBe('string');
+      expect(typeof info.appId).toBe('string');
+      expect(typeof info.composeHash).toBe('string');
+      expect(typeof info.instanceId).toBe('string');
+      expect(typeof info.deviceId).toBe('string');
+      expect(typeof info.tcbStatus).toBe('string');
+      expect(Array.isArray(info.advisoryIds)).toBe(true);
+      expect(info.tcbStatus).toBe('UpToDate');
+      expect(info.advisoryIds).toEqual(['INTEL-SA-00001']);
+    });
+
+    it('should contain all fields expected by the server schema', () => {
+      const json = JSON.parse(fs.readFileSync(path.join(FIXTURES_DIR, 'boot_info.json'), 'utf8'));
+      const requiredFields = ['mrAggregated', 'osImageHash', 'appId', 'composeHash', 'instanceId', 'deviceId'];
+      for (const field of requiredFields) {
+        expect(json).toHaveProperty(field);
+      }
+    });
+  });
+
+  describe('BootResponse (auth-eth→KMS: TS serializes)', () => {
+    it('should produce JSON matching the shared fixture consumed by Rust', () => {
+      const fixture = JSON.parse(fs.readFileSync(path.join(FIXTURES_DIR, 'boot_response.json'), 'utf8'));
+      // Construct the response as auth-eth would
+      const resp: BootResponse = {
+        isAllowed: true,
+        gatewayAppId: '0x1234567890abcdef1234567890abcdef12345678',
+        reason: '',
+      };
+      expect(JSON.parse(JSON.stringify(resp))).toEqual(fixture);
+    });
+  });
+
+  describe('PolicyResponse (auth-eth→KMS: TS serializes)', () => {
+    it('should produce JSON matching the shared fixture consumed by Rust', () => {
+      const fixture = JSON.parse(fs.readFileSync(path.join(FIXTURES_DIR, 'policy_response.json'), 'utf8'));
+      // Construct the response as auth-eth would
+      const resp: PolicyResponse = {
+        tcbPolicy: '{"version":1,"intel_qal":[]}',
+      };
+      expect(JSON.parse(JSON.stringify(resp))).toEqual(fixture);
+    });
+  });
+});

kms/src/main_service.rs

@@ -491,3 +491,91 @@ impl RpcCall<KmsState> for RpcHandler {
 pub fn rpc_methods() -> &'static [&'static str] {
     <KmsServer<RpcHandler>>::supported_methods()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Build a QuoteVerificationResult from the bundled TDX sample fixtures.
+    fn sample_qvr() -> QuoteVerificationResult {
+        let raw_quote = include_bytes!("../tests/fixtures/tdx_quote");
+        let collateral: dcap_qvl::QuoteCollateralV3 =
+            serde_json::from_slice(include_bytes!("../tests/fixtures/tdx_quote_collateral.json"))
+                .expect("parse collateral");
+        // Timestamp within the collateral validity window
+        let now = 1_750_400_000;
+        dcap_qvl::verify::QuoteVerifier::new_prod_default_crypto()
+            .verify(raw_quote, collateral, now)
+            .expect("verify sample quote")
+    }
+
+    #[test]
+    fn empty_policy_is_noop() {
+        let qvr = sample_qvr();
+        validate_onchain_tcb_policy(&qvr, "").unwrap();
+    }
+
+    #[test]
+    fn version1_empty_intel_qal_is_noop() {
+        let qvr = sample_qvr();
+        validate_onchain_tcb_policy(&qvr, r#"{"version":1,"intel_qal":[]}"#).unwrap();
+    }
+
+    #[test]
+    fn unknown_version_is_rejected() {
+        let qvr = sample_qvr();
+        let err = validate_onchain_tcb_policy(&qvr, r#"{"version":99,"intel_qal":[]}"#)
+            .unwrap_err();
+        assert!(
+            err.to_string().contains("Unsupported TCB policy version 99"),
+            "unexpected error: {err}"
+        );
+    }
+
+    #[test]
+    fn malformed_json_is_rejected() {
+        let qvr = sample_qvr();
+        let err = validate_onchain_tcb_policy(&qvr, "not json").unwrap_err();
+        assert!(
+            err.to_string().contains("Failed to parse"),
+            "unexpected error: {err}"
+        );
+    }
+
+    #[test]
+    fn missing_version_field_is_rejected() {
+        let qvr = sample_qvr();
+        let err = validate_onchain_tcb_policy(&qvr, r#"{"intel_qal":[]}"#).unwrap_err();
+        // version is required — serde fails, wrapped with "Failed to parse" context
+        assert!(
+            err.to_string().contains("Failed to parse"),
+            "unexpected error: {err}"
+        );
+    }
+
+    #[test]
+    fn tcb_policy_doc_deserialization() {
+        let doc: TcbPolicyDoc =
+            serde_json::from_str(r#"{"version":1,"intel_qal":["policy1","policy2"]}"#).unwrap();
+        assert_eq!(doc.version, 1);
+        assert_eq!(doc.intel_qal.len(), 2);
+
+        // intel_qal defaults to empty when omitted
+        let doc: TcbPolicyDoc = serde_json::from_str(r#"{"version":1}"#).unwrap();
+        assert!(doc.intel_qal.is_empty());
+    }
+
+    #[test]
+    fn invalid_rego_policy_is_rejected() {
+        let qvr = sample_qvr();
+        let err = validate_onchain_tcb_policy(
+            &qvr,
+            r#"{"version":1,"intel_qal":["not valid rego json"]}"#,
+        )
+        .unwrap_err();
+        assert!(
+            err.to_string().contains("Failed to build RegoPolicySet"),
+            "unexpected error: {err}"
+        );
+    }
+}

kms/src/main_service/upgrade_authority.rs

@@ -165,3 +165,58 @@ fn url_join(url: &str, path: &str) -> String {
     url.push_str(path);
     url
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// BootInfo: KMS is the producer (serializer).
+    /// Verify that Rust serialization output matches the shared fixture exactly.
+    #[test]
+    fn boot_info_serialization_matches_fixture() {
+        let fixture_json = include_str!("../../tests/fixtures/boot_info.json");
+        // Deserialize to construct the value, then re-serialize and compare.
+        // This proves Rust's serialization produces JSON that TS can consume.
+        let info: BootInfo =
+            serde_json::from_str(fixture_json).expect("deserialize BootInfo from fixture");
+        let serialized = serde_json::to_value(&info).expect("serialize BootInfo");
+        let expected: serde_json::Value =
+            serde_json::from_str(fixture_json).expect("parse fixture");
+        assert_eq!(
+            serialized, expected,
+            "Rust BootInfo serialization must match fixture (consumed by TS auth-eth)"
+        );
+    }
+
+    /// BootResponse: auth-eth is the producer, KMS is the consumer (deserializer).
+    /// Verify that Rust can deserialize the shared fixture correctly.
+    #[test]
+    fn boot_response_deserialization_from_fixture() {
+        let fixture_json = include_str!("../../tests/fixtures/boot_response.json");
+        let resp: BootResponse =
+            serde_json::from_str(fixture_json).expect("deserialize BootResponse from fixture");
+        assert!(resp.is_allowed);
+        assert_eq!(resp.gateway_app_id, "0x1234567890abcdef1234567890abcdef12345678");
+        assert!(resp.reason.is_empty());
+    }
+
+    /// PolicyResponse: auth-eth is the producer, KMS is the consumer (deserializer).
+    /// Verify that Rust can deserialize the shared fixture correctly.
+    #[test]
+    fn policy_response_deserialization_from_fixture() {
+        let fixture_json = include_str!("../../tests/fixtures/policy_response.json");
+        let resp: PolicyResponse =
+            serde_json::from_str(fixture_json).expect("deserialize PolicyResponse from fixture");
+        assert!(!resp.tcb_policy.is_empty());
+        // Verify the embedded JSON is valid
+        let policy: serde_json::Value =
+            serde_json::from_str(&resp.tcb_policy).expect("parse embedded tcbPolicy JSON");
+        assert_eq!(policy["version"], 1);
+    }
+
+    #[test]
+    fn url_join_appends_path_correctly() {
+        assert_eq!(url_join("http://host", "path"), "http://host/path");
+        assert_eq!(url_join("http://host/", "path"), "http://host/path");
+    }
+}

kms/tests/fixtures/boot_info.json

@@ -0,0 +1,13 @@
+{
+  "attestationMode": "dstack-tdx",
+  "mrAggregated": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
+  "osImageHash": "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
+  "mrSystem": "9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba",
+  "appId": "1234567890123456789012345678901234567890",
+  "composeHash": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+  "instanceId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "deviceId": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "keyProviderInfo": "",
+  "tcbStatus": "UpToDate",
+  "advisoryIds": ["INTEL-SA-00001"]
+}

kms/tests/fixtures/boot_response.json

@@ -0,0 +1,5 @@
+{
+  "isAllowed": true,
+  "gatewayAppId": "0x1234567890abcdef1234567890abcdef12345678",
+  "reason": ""
+}

kms/tests/fixtures/policy_response.json

@@ -0,0 +1,3 @@
+{
+  "tcbPolicy": "{\"version\":1,\"intel_qal\":[]}"
+}