first commit

agent/internal/protocol/signing_test.go

@@ -0,0 +1,49 @@
+package protocol
+
+import "testing"
+
+func TestCanonicalJSONIsStableForMapOrder(t *testing.T) {
+	bodyA := map[string]any{
+		"version": "0.1.0",
+		"resources": map[string]any{
+			"memory": 1024,
+			"cpu":    8,
+		},
+		"capabilities": []any{"heartbeat", "report"},
+	}
+	bodyB := map[string]any{
+		"capabilities": []any{"heartbeat", "report"},
+		"resources": map[string]any{
+			"cpu":    8,
+			"memory": 1024,
+		},
+		"version": "0.1.0",
+	}
+
+	jsonA, err := CanonicalJSON(bodyA)
+	if err != nil {
+		t.Fatalf("canonical json A: %v", err)
+	}
+	jsonB, err := CanonicalJSON(bodyB)
+	if err != nil {
+		t.Fatalf("canonical json B: %v", err)
+	}
+
+	if string(jsonA) != string(jsonB) {
+		t.Fatalf("canonical json mismatch:\nA=%s\nB=%s", jsonA, jsonB)
+	}
+	if BodySHA256(jsonA) != BodySHA256(jsonB) {
+		t.Fatalf("body hash mismatch")
+	}
+}
+
+func TestSignatureChangesWithPath(t *testing.T) {
+	secret := "ias_test_secret"
+	bodyHash := BodySHA256([]byte(`{"ok":true}`))
+	payloadA := SigningPayload("POST", "/api/agent/heartbeat", "1777380000000", "nonce-123456", bodyHash)
+	payloadB := SigningPayload("POST", "/api/agent/report", "1777380000000", "nonce-123456", bodyHash)
+
+	if Signature(secret, payloadA) == Signature(secret, payloadB) {
+		t.Fatalf("signature should change when request path changes")
+	}
+}