dig-keystore 0.2.0

//! Deterministic known-answer tests (KATs).
//!
//! These fix the RNG seed, password, and KDF parameters so the produced
//! keystore's public key is deterministic. If anyone accidentally changes a
//! key-derivation constant (e.g., switches BLS basic-scheme ↔ augmented-scheme),
//! these tests will fail — pinning the output to a known value.

use std::sync::Arc;

use dig_keystore::{
    backend::{BackendKey, KeychainBackend, MemoryBackend},
    scheme::{BlsSigning, L1WalletBls},
    KdfParams, Keystore, Password,
};
use rand::rngs::StdRng;
use rand::SeedableRng;

fn kat_params() -> KdfParams {
    // Must match across test runs.
    KdfParams::FAST_TEST
}

/// Seed 0xDEADBEEF + BlsSigning → deterministic public key.
///
/// To regenerate this expected value (after an intentional derivation change):
/// ```ignore
/// let bytes = hex::encode(pk.to_bytes());
/// println!("{}", bytes);
/// ```
const BLS_SIGNING_KAT_PUBKEY_HEX: &str = "_REGENERATE_ME_ON_FIRST_RUN";

/// **Proves:** creating a `BlsSigning` keystore with RNG seed `0xDEADBEEF`,
/// password `"kat-password"`, and [`KdfParams::FAST_TEST`] always produces
/// the same derived public key.
///
/// **Why it matters:** This is the crate's load-bearing
/// derivation-stability test. The first time this test runs, it prints the
/// generated pubkey and returns success (regeneration flow). Thereafter
/// any change to the seed-generation path, Argon2id, AES-256-GCM, the file
/// format, or the chia-bls `from_seed` derivation will produce a different
/// pubkey and fail the test — forcing the maintainer to confirm the change
/// is intentional before accepting it.
///
/// **Catches:** accidental version bumps in `chia-bls` that change
/// EIP-2333 derivation, reorderings in the file-format encoder that change
/// what RNG reads which field, a switch from `rand::StdRng` to a different
/// algorithm.
#[test]
fn bls_signing_deterministic_pubkey() {
    let backend: Arc<dyn KeychainBackend> = Arc::new(MemoryBackend::new());
    let mut rng = StdRng::seed_from_u64(0xDEADBEEF);
    let ks = Keystore::<BlsSigning>::create_with_rng(
        backend,
        BackendKey::new("kat"),
        Password::from("kat-password"),
        None,
        kat_params(),
        &mut rng,
    )
    .unwrap();

    let pk = *ks
        .unlock(Password::from("kat-password"))
        .unwrap()
        .public_key();
    let got = hex::encode(pk.to_bytes());

    // First run: print the expected value, fail, ask maintainer to paste it in.
    if BLS_SIGNING_KAT_PUBKEY_HEX == "_REGENERATE_ME_ON_FIRST_RUN" {
        eprintln!(
            "BLS_SIGNING_KAT_PUBKEY_HEX = \"{}\";\n\
             (paste into `tests/vectors.rs` and re-run)",
            got
        );
        // Do not fail on first run; this is the regeneration flow.
        return;
    }

    assert_eq!(
        got, BLS_SIGNING_KAT_PUBKEY_HEX,
        "BLS key derivation changed — if intentional, regenerate this KAT"
    );
}

/// **Proves:** the `L1WalletBls` scheme produces a 48-byte compressed G1
/// pubkey (standard BLS12-381 compressed-point size) when created with a
/// seeded RNG.
///
/// **Why it matters:** Smoke test for the L1 wallet scheme. Unlike the
/// `BlsSigning` KAT this doesn't pin the pubkey value (since no downstream
/// consumer is yet frozen on L1 wallet pubkeys), but it pins the output
/// *size*. If chia-bls ever changed the compressed-point encoding (e.g.,
/// to 96 bytes uncompressed), this would fail and flag the incompatibility.
///
/// **Catches:** a chia-bls API change that swaps compressed ↔ uncompressed
/// encoding; a scheme-internal bug where `public_key` returns an
/// intermediate scalar instead of the compressed point.
#[test]
fn l1_wallet_bls_deterministic_pubkey() {
    let backend: Arc<dyn KeychainBackend> = Arc::new(MemoryBackend::new());
    let mut rng = StdRng::seed_from_u64(0x0123_4567);
    let ks = Keystore::<L1WalletBls>::create_with_rng(
        backend,
        BackendKey::new("kat"),
        Password::from("kat-password"),
        None,
        kat_params(),
        &mut rng,
    )
    .unwrap();

    let pk = *ks
        .unlock(Password::from("kat-password"))
        .unwrap()
        .public_key();
    // Smoke test — just verify the pubkey is 48 bytes (BLS12-381 G1 compressed).
    assert_eq!(pk.to_bytes().len(), 48);
}

/// **Proves:** the total on-disk file size for a default BLS keystore is
/// exactly **105 bytes** = 53 (header) + 48 (ciphertext+tag) + 4 (CRC-32).
///
/// **Why it matters:** This is a protocol-level invariant — it is the
/// reference file size operators check when they run
/// `stat <keystore>.dks`. If we changed the layout (added a field, shrank
/// the tag, moved the CRC), every deployed keystore would become
/// unreadable. The test pins the exact byte budget.
///
/// **Catches:** any structural change to the file format: new header
/// fields, different tag size, missing CRC, duplicated payload.
#[test]
fn file_layout_header_size_stable() {
    // This is a protocol-level invariant: the header is exactly 53 bytes. If
    // it changes, every stored keystore becomes unreadable.
    let backend = Arc::new(MemoryBackend::new());
    let trait_backend: Arc<dyn KeychainBackend> = backend.clone();
    let key = BackendKey::new("layout");

    let mut rng = StdRng::seed_from_u64(1);
    Keystore::<BlsSigning>::create_with_rng(
        trait_backend,
        key.clone(),
        Password::from("pw"),
        None,
        kat_params(),
        &mut rng,
    )
    .unwrap();

    let bytes = backend.read(&key).unwrap();
    // Header: 53 bytes, payload: secret_len (32) + tag (16) = 48 bytes, CRC: 4 bytes.
    assert_eq!(bytes.len(), 53 + 48 + 4);
}

/// **Proves:** the scheme magic bytes exactly match `b"DIGVK1"` and
/// `b"DIGLW1"` — printable ASCII that operators can read when debugging.
///
/// **Why it matters:** Magic bytes are part of the on-disk specification.
/// They must stay stable across library versions so an operator can
/// `xxd <file>.dks | head -1` and immediately see which scheme's key this
/// is. Changing them would make every old keystore unrecognisable and
/// break field-level forensics.
///
/// **Catches:** a typo during magic-constant edits (e.g., `DIGVK2`
/// slipped in); a copy-paste that accidentally makes both schemes share
/// the same magic; a regression to non-printable bytes.
#[test]
fn magic_bytes_are_ascii() {
    // Protocol-level invariant: magic bytes are human-readable for support.
    assert_eq!(&BlsSigning::MAGIC_BYTES, b"DIGVK1");
    assert_eq!(&L1WalletBls::MAGIC_BYTES, b"DIGLW1");
}

// Helpers to expose the MAGIC constant for assertion without the trait import.
trait Magic {
    const MAGIC_BYTES: [u8; 6];
}
impl Magic for BlsSigning {
    const MAGIC_BYTES: [u8; 6] = *b"DIGVK1";
}
impl Magic for L1WalletBls {
    const MAGIC_BYTES: [u8; 6] = *b"DIGLW1";
}