up

src/Scanner/__Tests/StellaOps.Scanner.Reachability.Tests/RichGraphPublisherTests.cs

@@ -1,3 +1,5 @@
+using System;
+using System.Text.Json;
 using System.Threading.Tasks;
 using StellaOps.Cryptography;
 using StellaOps.Scanner.Reachability;
@@ -24,6 +26,46 @@ public class RichGraphPublisherTests
 
         Assert.Contains(":", result.GraphHash); // hash format: algorithm:digest
         Assert.StartsWith("cas://reachability/graphs/", result.CasUri);
+        Assert.StartsWith("cas://reachability/graphs/", result.DsseCasUri);
+        Assert.EndsWith(".dsse", result.DsseCasUri, StringComparison.Ordinal);
+        Assert.StartsWith("sha256:", result.DsseDigest, StringComparison.Ordinal);
         Assert.Equal(1, result.NodeCount);
+
+        var casKey = result.CasUri[(result.CasUri.LastIndexOf('/') + 1)..];
+        var dsseKey = $"{casKey}.dsse";
+        var dsseBytes = cas.GetBytes(dsseKey);
+        Assert.NotNull(dsseBytes);
+
+        using var dsseDoc = JsonDocument.Parse(dsseBytes!);
+        Assert.Equal(
+            "application/vnd.stellaops.graph.predicate+json",
+            dsseDoc.RootElement.GetProperty("payloadType").GetString());
+
+        var payloadBase64Url = dsseDoc.RootElement.GetProperty("payload").GetString();
+        Assert.False(string.IsNullOrWhiteSpace(payloadBase64Url));
+
+        var payloadBytes = Base64UrlDecode(payloadBase64Url!);
+        using var payloadDoc = JsonDocument.Parse(payloadBytes);
+        Assert.Equal(
+            result.GraphHash,
+            payloadDoc.RootElement.GetProperty("hashes").GetProperty("graphHash").GetString());
+        Assert.Equal(
+            result.CasUri,
+            payloadDoc.RootElement.GetProperty("cas").GetProperty("location").GetString());
+
+        var signature = dsseDoc.RootElement.GetProperty("signatures")[0];
+        Assert.Equal("scanner-deterministic", signature.GetProperty("keyid").GetString());
+    }
+
+    private static byte[] Base64UrlDecode(string value)
+    {
+        var normalized = value.Replace('-', '+').Replace('_', '/');
+        var remainder = normalized.Length % 4;
+        if (remainder != 0)
+        {
+            normalized = normalized.PadRight(normalized.Length + (4 - remainder), '=');
+        }
+
+        return Convert.FromBase64String(normalized);
     }
 }