test: add validation tests for signature lexicons

- validate-signature-inline: inline signature with all JOSE algorithms,
  required fields, open knownValues
- validate-signature-proof: proof record with CID, optional fields,
   requirement, datetime validation
- validate-signatures-on-record: signatures array on activity records
  with inline, remote (strongRef), mixed, and empty signatures

Author: aspiers

tests/validate-signature-inline.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect } from "vitest";
+import { validate, ids } from "../generated/lexicons.js";
+import * as SignatureInline from "../generated/types/app/certified/signature/inline.js";
+
+describe("app.certified.signature.inline", () => {
+  it("should accept a valid inline signature with all fields", () => {
+    const result = SignatureInline.validateMain({
+      $type: "app.certified.signature.inline",
+      signatureType: "ES256K",
+      signature: new Uint8Array([1, 2, 3, 4]),
+      key: "did:plc:abc123#signing",
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.value.key).toBe("did:plc:abc123#signing");
+      expect(result.value.signatureType).toBe("ES256K");
+    }
+  });
+
+  it("should accept a signature without optional signatureType", () => {
+    const result = SignatureInline.validateMain({
+      $type: "app.certified.signature.inline",
+      signature: new Uint8Array([1, 2, 3, 4]),
+      key: "did:plc:abc123#signing",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("should accept all known algorithm identifiers", () => {
+    for (const alg of ["ES256", "ES256K", "Ed25519"]) {
+      const result = SignatureInline.validateMain({
+        $type: "app.certified.signature.inline",
+        signatureType: alg,
+        signature: new Uint8Array([0xde, 0xad]),
+        key: "did:plc:test#key-1",
+      });
+      expect(result.success).toBe(true);
+    }
+  });
+
+  it("should accept unknown algorithm identifiers (knownValues is open)", () => {
+    const result = SignatureInline.validateMain({
+      $type: "app.certified.signature.inline",
+      signatureType: "PS256",
+      signature: new Uint8Array([0xca, 0xfe]),
+      key: "did:web:example.com#key-1",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("should reject when required field 'signature' is missing", () => {
+    const result = validate(
+      {
+        key: "did:plc:abc123#signing",
+      },
+      ids.AppCertifiedSignatureInline,
+      "main",
+      false,
+    );
+    expect(result.success).toBe(false);
+  });
+
+  it("should reject when required field 'key' is missing", () => {
+    const result = validate(
+      {
+        signature: new Uint8Array([1, 2, 3]),
+      },
+      ids.AppCertifiedSignatureInline,
+      "main",
+      false,
+    );
+    expect(result.success).toBe(false);
+  });
+});

tests/validate-signature-proof.test.ts

@@ -0,0 +1,69 @@
+import { describe, it, expect } from "vitest";
+import { validate, ids } from "../generated/lexicons.js";
+import * as SignatureProof from "../generated/types/app/certified/signature/proof.js";
+
+describe("app.certified.signature.proof", () => {
+  it("should accept a valid proof with all fields", () => {
+    const result = SignatureProof.validateMain({
+      $type: "app.certified.signature.proof",
+      cid: "bafyreie5737gdxlw5i64vngml6xvqeatqy3a4erphoqtso54z2eooh4zae",
+      note: "Verified by platform quality assurance process",
+      createdAt: "2024-06-15T12:00:00.000Z",
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.value.cid).toBe(
+        "bafyreie5737gdxlw5i64vngml6xvqeatqy3a4erphoqtso54z2eooh4zae",
+      );
+      expect(result.value.note).toBe(
+        "Verified by platform quality assurance process",
+      );
+    }
+  });
+
+  it("should accept a proof with only the required cid field", () => {
+    const result = SignatureProof.validateMain({
+      $type: "app.certified.signature.proof",
+      cid: "bafyreie5737gdxlw5i64vngml6xvqeatqy3a4erphoqtso54z2eooh4zae",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("should reject when required field 'cid' is missing", () => {
+    const result = validate(
+      {
+        note: "Some note",
+        createdAt: "2024-06-15T12:00:00.000Z",
+      },
+      ids.AppCertifiedSignatureProof,
+      "main",
+      false,
+    );
+    expect(result.success).toBe(false);
+  });
+
+  it("should require $type since proof is a record type", () => {
+    const result = validate(
+      {
+        cid: "bafyreie5737gdxlw5i64vngml6xvqeatqy3a4erphoqtso54z2eooh4zae",
+      },
+      ids.AppCertifiedSignatureProof,
+      "main",
+      true,
+    );
+    expect(result.success).toBe(false);
+  });
+
+  it("should reject an invalid datetime format", () => {
+    const result = validate(
+      {
+        cid: "bafyreie5737gdxlw5i64vngml6xvqeatqy3a4erphoqtso54z2eooh4zae",
+        createdAt: "not-a-date",
+      },
+      ids.AppCertifiedSignatureProof,
+      "main",
+      false,
+    );
+    expect(result.success).toBe(false);
+  });
+});

tests/validate-signatures-on-record.test.ts

@@ -0,0 +1,90 @@
+import { describe, it, expect } from "vitest";
+import { ids } from "../generated/lexicons.js";
+import * as Activity from "../generated/types/org/hypercerts/claim/activity.js";
+
+/**
+ * Tests that the `signatures` property works correctly on record lexicons.
+ * Uses activity as a representative — all 20 record lexicons share the
+ * same signatures property definition.
+ */
+describe("signatures property on records", () => {
+  const baseActivity = {
+    title: "Test Activity",
+    shortDescription: "A test activity for signature validation",
+    createdAt: "2024-06-15T12:00:00.000Z",
+  };
+
+  it("should accept a record without signatures", () => {
+    const result = Activity.validateMain({
+      $type: ids.OrgHypercertsClaimActivity,
+      ...baseActivity,
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("should accept a record with an inline signature", () => {
+    const result = Activity.validateMain({
+      $type: ids.OrgHypercertsClaimActivity,
+      ...baseActivity,
+      signatures: [
+        {
+          $type: "app.certified.signature.inline",
+          signatureType: "ES256K",
+          signature: new Uint8Array([1, 2, 3, 4]),
+          key: "did:plc:platform123#signing",
+        },
+      ],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("should accept a record with a remote attestation (strongRef)", () => {
+    const result = Activity.validateMain({
+      $type: ids.OrgHypercertsClaimActivity,
+      ...baseActivity,
+      signatures: [
+        {
+          $type: "com.atproto.repo.strongRef",
+          uri: "at://did:plc:verifier/app.certified.signature.proof/3k2abc",
+          cid: "bafyreie5737gdxlw5i64vngml6xvqeatqy3a4erphoqtso54z2eooh4zae",
+        },
+      ],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("should accept a record with both inline and remote signatures", () => {
+    const result = Activity.validateMain({
+      $type: ids.OrgHypercertsClaimActivity,
+      ...baseActivity,
+      signatures: [
+        {
+          $type: "app.certified.signature.inline",
+          signature: new Uint8Array([0xde, 0xad]),
+          key: "did:plc:signer1#key-1",
+        },
+        {
+          $type: "com.atproto.repo.strongRef",
+          uri: "at://did:plc:verifier/app.certified.signature.proof/abc123",
+          cid: "bafyreie5737gdxlw5i64vngml6xvqeatqy3a4erphoqtso54z2eooh4zae",
+        },
+        {
+          $type: "app.certified.signature.inline",
+          signatureType: "Ed25519",
+          signature: new Uint8Array([0xca, 0xfe]),
+          key: "did:plc:signer2#key-2",
+        },
+      ],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("should accept an empty signatures array", () => {
+    const result = Activity.validateMain({
+      $type: ids.OrgHypercertsClaimActivity,
+      ...baseActivity,
+      signatures: [],
+    });
+    expect(result.success).toBe(true);
+  });
+});