tests/test_dsse_real_signing.py

# SPDX-License-Identifier: Apache-2.0
# © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173
# Authored by Yachay (CTO). Co-Authored-By: Perplexity Computer Agent.
# Doctrine v11 LOCKED 749/14/163 · Λ Conjecture 1 · SLSA L1+L2
"""
tests/test_dsse_real_signing.py — proves the DSSE signer flips from
`signatures: []` (honest UNSIGNED) to a REAL ECDSA-P256-SHA256 signature
the moment the SZL_COSIGN_PRIVATE_KEY_PEM secret is present, and that the
resulting signature verifies against the matching public key.

HONESTY / SAFETY
  - No real org private key is ever required, embedded, or baked into CI.
  - The "present-secret" test GENERATES its own ephemeral P-256 key at runtime,
    sets the env var to it, signs, and verifies against THAT key's public half.
  - The real-org-secret round-trip is `skipif`-guarded: it runs ONLY if a real
    SZL_COSIGN_PRIVATE_KEY_PEM / SZL_COSIGN_PRIVATE_PEM is already in the env
    (e.g. a developer's local shell). It is never satisfied by CI defaults.
"""
from __future__ import annotations

import base64
import importlib
import os
import sys

import pytest

REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
if REPO_ROOT not in sys.path:
    sys.path.insert(0, REPO_ROOT)

cryptography = pytest.importorskip("cryptography")
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes
from cryptography.exceptions import InvalidSignature

import szl_dsse

_PRIV_ENV = "SZL_COSIGN_PRIVATE_KEY_PEM"
_LEGACY_ENV = "SZL_COSIGN_PRIVATE_PEM"


def _gen_ephemeral_keypair():
    """Generate a fresh, test-only ECDSA P-256 keypair (plain PKCS#8 PEM)."""
    priv = ec.generate_private_key(ec.SECP256R1())
    priv_pem = priv.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption(),
    ).decode("utf-8")
    pub_pem = priv.public_key().public_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PublicFormat.SubjectPublicKeyInfo,
    ).decode("utf-8")
    return priv_pem, pub_pem


@pytest.fixture(autouse=True)
def _clean_env(monkeypatch):
    """Ensure no ambient secret leaks between tests unless a test sets one."""
    yield


def test_unsigned_fallback_when_secret_absent(monkeypatch):
    """No secret -> signatures:[] + honesty:UNSIGNED, never fabricated."""
    monkeypatch.delenv(_PRIV_ENV, raising=False)
    monkeypatch.delenv(_LEGACY_ENV, raising=False)
    importlib.reload(szl_dsse)
    env = szl_dsse.sign_payload({"hello": "world"})
    assert env["signatures"] == []
    assert env["signed"] is False
    assert "UNSIGNED" in env["honesty"]
    assert szl_dsse.signing_available() is False


def test_real_signature_with_ephemeral_key_verifies(monkeypatch):
    """Secret present (ephemeral test key) -> REAL signature that verifies
    against the matching public key via raw cryptography AND via the module's
    own verify path when the embedded public key is swapped to the test key."""
    priv_pem, pub_pem = _gen_ephemeral_keypair()
    monkeypatch.delenv(_LEGACY_ENV, raising=False)
    monkeypatch.setenv(_PRIV_ENV, priv_pem)
    importlib.reload(szl_dsse)

    assert szl_dsse.signing_available() is True
    env = szl_dsse.sign_payload({"hello": "world", "n": 42})

    # Flipped from [] to a real signature
    assert env["signed"] is True
    assert len(env["signatures"]) == 1
    sig_entry = env["signatures"][0]
    assert sig_entry["keyid"] == szl_dsse.KEYID
    assert "REAL" in env["honesty"]

    # 1) Verify the signature against the test public key with raw cryptography,
    #    reconstructing the exact DSSE PAE bytes the signer used.
    body = base64.b64decode(env["payload"])
    msg = szl_dsse.pae(env["payloadType"], body)
    pub = serialization.load_pem_public_key(pub_pem.encode("utf-8"))
    sig = base64.b64decode(sig_entry["sig"])
    pub.verify(sig, msg, ec.ECDSA(hashes.SHA256()))  # raises InvalidSignature on failure

    # 2) Module verify path: point the embedded public key at the test public
    #    key and confirm verify_envelope() validates the just-made signature.
    monkeypatch.setattr(szl_dsse, "COSIGN_PUBLIC_PEM", pub_pem, raising=True)
    verdict = szl_dsse.verify_envelope(env)
    assert verdict["verified"] is True


def test_tampered_payload_fails_verification(monkeypatch):
    """A tampered payload must NOT verify (signature binds the payload)."""
    priv_pem, pub_pem = _gen_ephemeral_keypair()
    monkeypatch.delenv(_LEGACY_ENV, raising=False)
    monkeypatch.setenv(_PRIV_ENV, priv_pem)
    importlib.reload(szl_dsse)

    env = szl_dsse.sign_payload({"amount": 1})
    body = szl_dsse.canonical_json({"amount": 1000000})  # tamper
    msg = szl_dsse.pae(env["payloadType"], body)
    pub = serialization.load_pem_public_key(pub_pem.encode("utf-8"))
    sig = base64.b64decode(env["signatures"][0]["sig"])
    with pytest.raises(InvalidSignature):
        pub.verify(sig, msg, ec.ECDSA(hashes.SHA256()))


def test_legacy_env_var_still_works(monkeypatch):
    """Backward-compat: the legacy SZL_COSIGN_PRIVATE_PEM name still signs."""
    priv_pem, _pub_pem = _gen_ephemeral_keypair()
    monkeypatch.delenv(_PRIV_ENV, raising=False)
    monkeypatch.setenv(_LEGACY_ENV, priv_pem)
    importlib.reload(szl_dsse)
    env = szl_dsse.sign_payload({"compat": True})
    assert env["signed"] is True
    assert len(env["signatures"]) == 1


@pytest.mark.skipif(
    not (os.environ.get(_PRIV_ENV) or os.environ.get(_LEGACY_ENV)),
    reason="real cosign private key not present in env; skip real-key round-trip "
           "(the private key is never baked into CI)",
)
def test_real_org_key_roundtrip_if_present():
    """OPT-IN: if a real org private key is in the env, the produced signature
    must verify against the module's embedded (published) public key."""
    importlib.reload(szl_dsse)
    assert szl_dsse.signing_available() is True
    env = szl_dsse.sign_payload({"real": "org-key-roundtrip"})
    assert env["signed"] is True
    verdict = szl_dsse.verify_envelope(env)
    assert verdict["verified"] is True, verdict


@pytest.fixture(autouse=True)
def _restore_module():
    yield
    # Restore a clean module state for any downstream tests
    for _n in (_PRIV_ENV, _LEGACY_ENV):
        os.environ.pop(_n, None)
    importlib.reload(szl_dsse)