prep docs and service updates

tests/AirGap/StellaOps.AirGap.Time.Tests/AirGapOptionsValidatorTests.cs

@@ -0,0 +1,35 @@
+using Microsoft.Extensions.Options;
+using StellaOps.AirGap.Time.Config;
+using StellaOps.AirGap.Time.Models;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class AirGapOptionsValidatorTests
+{
+    [Fact]
+    public void FailsWhenTenantMissing()
+    {
+        var opts = new AirGapOptions { TenantId = "" };
+        var validator = new AirGapOptionsValidator();
+        var result = validator.Validate(null, opts);
+        Assert.True(result is ValidateOptionsResultFailure);
+    }
+
+    [Fact]
+    public void FailsWhenWarningExceedsBreach()
+    {
+        var opts = new AirGapOptions { TenantId = "t", Staleness = new StalenessOptions { WarningSeconds = 20, BreachSeconds = 10 } };
+        var validator = new AirGapOptionsValidator();
+        var result = validator.Validate(null, opts);
+        Assert.True(result is ValidateOptionsResultFailure);
+    }
+
+    [Fact]
+    public void SucceedsForValidOptions()
+    {
+        var opts = new AirGapOptions { TenantId = "t", Staleness = new StalenessOptions { WarningSeconds = 10, BreachSeconds = 20 } };
+        var validator = new AirGapOptionsValidator();
+        var result = validator.Validate(null, opts);
+        Assert.True(result.Succeeded);
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/Rfc3161VerifierTests.cs

@@ -0,0 +1,32 @@
+using System.Security.Cryptography;
+using System.Security.Cryptography.Pkcs;
+using System.Security.Cryptography.X509Certificates;
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class Rfc3161VerifierTests
+{
+    [Fact]
+    public void SignedCmsTokenVerifies()
+    {
+        using var rsa = RSA.Create(2048);
+        var req = new CertificateRequest("CN=tsa", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        var cert = req.CreateSelfSigned(DateTimeOffset.UtcNow.AddMinutes(-1), DateTimeOffset.UtcNow.AddHours(1));
+
+        var content = new ContentInfo(new byte[] { 0x01, 0x02, 0x03 });
+        var cms = new SignedCms(content, detached: false);
+        cms.ComputeSignature(new CmsSigner(cert));
+        var tokenBytes = cms.Encode();
+
+        var verifier = new Rfc3161Verifier();
+        var trust = new[] { new TimeTrustRoot("tsa-root", cert.GetPublicKey(), "rsa-pkcs1-sha256") };
+
+        var result = verifier.Verify(tokenBytes, trust, out var anchor);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("rfc3161-verified", result.Reason);
+        Assert.Equal("RFC3161", anchor.Format);
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/RoughtimeVerifierTests.cs

@@ -0,0 +1,40 @@
+using System.Security.Cryptography;
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class RoughtimeVerifierTests
+{
+    [Fact]
+    public void ValidEd25519SignaturePasses()
+    {
+        if (!Ed25519.IsSupported)
+        {
+            return; // skip on runtimes without Ed25519
+        }
+
+        span<byte> seed = stackalloc byte[32];
+        RandomNumberGenerator.Fill(seed);
+        var key = Ed25519.Create();
+        key.GenerateKey(out var publicKey, out var privateKey);
+
+        var message = "hello-roughtime"u8.ToArray();
+        var signature = new byte[64];
+        Ed25519.Sign(message, privateKey, signature);
+
+        var token = new byte[message.Length + signature.Length];
+        Buffer.BlockCopy(message, 0, token, 0, message.Length);
+        Buffer.BlockCopy(signature, 0, token, message.Length, signature.Length);
+
+        var verifier = new RoughtimeVerifier();
+        var trust = new[] { new TimeTrustRoot("root1", publicKey, "ed25519") };
+
+        var result = verifier.Verify(token, trust, out var anchor);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("roughtime-verified", result.Reason);
+        Assert.Equal("Roughtime", anchor.Format);
+        Assert.Equal("root1", anchor.SignatureFingerprint);
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/SealedStartupValidatorTests.cs

@@ -0,0 +1,62 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+using StellaOps.AirGap.Time.Stores;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class SealedStartupValidatorTests
+{
+    [Fact]
+    public async Task FailsWhenAnchorMissing()
+    {
+        var validator = Build(out var statusService);
+        var result = await validator.ValidateAsync("t1", StalenessBudget.Default, default);
+        Assert.False(result.IsValid);
+        Assert.Equal("time-anchor-missing", result.Reason);
+    }
+
+    [Fact]
+    public async Task FailsWhenBreach()
+    {
+        var validator = Build(out var statusService);
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "src", "fmt", "fp", "digest");
+        await statusService.SetAnchorAsync("t1", anchor, new StalenessBudget(10, 20));
+        var now = DateTimeOffset.UnixEpoch.AddSeconds(25);
+        var status = await statusService.GetStatusAsync("t1", now);
+        var result = status.Staleness.IsBreach;
+        Assert.True(result);
+        var validation = await validator.ValidateAsync("t1", new StalenessBudget(10, 20), default);
+        Assert.False(validation.IsValid);
+        Assert.Equal("time-anchor-stale", validation.Reason);
+    }
+
+    [Fact]
+    public async Task SucceedsWhenFresh()
+    {
+        var validator = Build(out var statusService);
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "src", "fmt", "fp", "digest");
+        await statusService.SetAnchorAsync("t1", anchor, new StalenessBudget(10, 20));
+        var validation = await validator.ValidateAsync("t1", new StalenessBudget(10, 20), default);
+        Assert.True(validation.IsValid);
+    }
+
+    [Fact]
+    public async Task FailsOnBudgetMismatch()
+    {
+        var validator = Build(out var statusService);
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "src", "fmt", "fp", "digest");
+        await statusService.SetAnchorAsync("t1", anchor, new StalenessBudget(10, 20));
+
+        var validation = await validator.ValidateAsync("t1", new StalenessBudget(5, 15), default);
+
+        Assert.False(validation.IsValid);
+        Assert.Equal("time-anchor-budget-mismatch", validation.Reason);
+    }
+
+    private static SealedStartupValidator Build(out TimeStatusService statusService)
+    {
+        var store = new InMemoryTimeAnchorStore();
+        statusService = new TimeStatusService(store, new StalenessCalculator());
+        return new SealedStartupValidator(statusService);
+    }
+}

tests/AirGap/StellaOps.AirGap.Time.Tests/TimeAnchorLoaderTests.cs

@@ -25,4 +25,28 @@ public class TimeAnchorLoaderTests
         Assert.True(result.IsValid);
         Assert.Equal("Roughtime", anchor.Format);
     }
+
+    [Fact]
+    public void RejectsIncompatibleTrustRoots()
+    {
+        var loader = new TimeAnchorLoader();
+        var hex = "010203";
+        var rsaKey = new byte[128];
+        var trust = new[] { new TimeTrustRoot("k1", rsaKey, "rsa") };
+
+        var result = loader.TryLoadHex(hex, TimeTokenFormat.Roughtime, trust, out _);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("trust-roots-incompatible-format", result.Reason);
+    }
+
+    [Fact]
+    public void RejectsWhenTrustRootsMissing()
+    {
+        var loader = new TimeAnchorLoader();
+        var result = loader.TryLoadHex("010203", TimeTokenFormat.Roughtime, Array.Empty<TimeTrustRoot>(), out _);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("trust-roots-required", result.Reason);
+    }
 }