[test] coach claude to write decent tests

Co-authored-by: Claude <[email protected]>

Author: indexzero

packages/client/src/__tests__/sigstore.test.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 import type { SerializedBundle } from '@sigstore/bundle';
 import { mockFulcio, mockRekor, mockTSA } from '@sigstore/mock';
-import { VerificationError } from '@sigstore/verify';
+import { VerificationError, Signer } from '@sigstore/verify';
 import { fromPartial } from '@total-typescript/shoehorn';
 import mocktuf, { Target } from '@tufjs/repo-mock';
 import { attest, createVerifier, sign, verify } from '../sigstore';
@@ -180,8 +180,12 @@ describe('#verify', () => {
       validBundles.v1.dsse.withSigningCert
     );
 
-    it('does not throw an error', async () => {
-      await expect(verify(bundle, tufOptions)).resolves.toBe(undefined);
+    it('returns a Signer object', async () => {
+      const result = await verify(bundle, tufOptions);
+      expect(result).toBeDefined();
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
+      expect(result).toHaveProperty('identity');
     }, 10000);
   });
 
@@ -196,8 +200,11 @@ describe('#verify', () => {
       timeout: 0,
     };
 
-    it('does not throw an error', async () => {
-      await expect(verify(bundle, options)).resolves.toBe(undefined);
+    it('returns a Signer object', async () => {
+      const result = await verify(bundle, options);
+      expect(result).toBeDefined();
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
     });
   });
 
@@ -207,10 +214,12 @@ describe('#verify', () => {
     );
     const artifact = validBundles.artifact;
 
-    it('does not throw an error', async () => {
-      await expect(verify(bundle, artifact, tufOptions)).resolves.toBe(
-        undefined
-      );
+    it('returns a Signer object', async () => {
+      const result = await verify(bundle, artifact, tufOptions);
+      expect(result).toBeDefined();
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
+      expect(result).toHaveProperty('identity');
     });
   });
 
@@ -220,10 +229,12 @@ describe('#verify', () => {
     );
     const artifact = validBundles.artifact;
 
-    it('does not throw an error', async () => {
-      await expect(verify(bundle, artifact, tufOptions)).resolves.toBe(
-        undefined
-      );
+    it('returns a Signer object', async () => {
+      const result = await verify(bundle, artifact, tufOptions);
+      expect(result).toBeDefined();
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
+      expect(result).toHaveProperty('identity');
     });
   });
 
@@ -233,10 +244,12 @@ describe('#verify', () => {
     );
     const artifact = validBundles.artifact;
 
-    it('does not throw an error', async () => {
-      await expect(verify(bundle, artifact, tufOptions)).resolves.toBe(
-        undefined
-      );
+    it('returns a Signer object', async () => {
+      const result = await verify(bundle, artifact, tufOptions);
+      expect(result).toBeDefined();
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
+      expect(result).toHaveProperty('identity');
     });
   });
 
@@ -246,10 +259,12 @@ describe('#verify', () => {
     );
     const artifact = validBundles.artifact;
 
-    it('does not throw an error', async () => {
-      await expect(verify(bundle, artifact, tufOptions)).resolves.toBe(
-        undefined
-      );
+    it('returns a Signer object', async () => {
+      const result = await verify(bundle, artifact, tufOptions);
+      expect(result).toBeDefined();
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
+      expect(result).toHaveProperty('identity');
     });
   });
 
@@ -288,10 +303,107 @@ describe('#verify', () => {
 
     const artifact = validBundles.artifact;
 
-    it('does not throw an error', async () => {
-      await expect(verify(bundle, artifact, tufOptions)).resolves.toBe(
-        undefined
-      );
+    it('returns a Signer object', async () => {
+      const result = await verify(bundle, artifact, tufOptions);
+      expect(result).toBeDefined();
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
+      expect(result).toHaveProperty('identity');
+    });
+  });
+});
+
+describe('#verify - Signer object structure and properties', () => {
+  let tufRepo: ReturnType<typeof mocktuf> | undefined;
+  let tufOptions: VerifyOptions | undefined;
+
+  const trustedRootJSON = JSON.stringify(trustedRoot);
+  const target: Target = {
+    name: 'trusted_root.json',
+    content: Buffer.from(trustedRootJSON),
+  };
+
+  beforeEach(() => {
+    tufRepo = mocktuf(target, { metadataPathPrefix: '' });
+    tufOptions = {
+      tufMirrorURL: tufRepo.baseURL,
+      tufCachePath: tufRepo.cachePath,
+      tufRootPath: path.join(tufRepo.cachePath, 'root.json'),
+      certificateIssuer: 'https://github.com/login/oauth',
+    };
+  });
+
+  afterEach(() => tufRepo?.teardown());
+
+  describe('when verifying a DSSE bundle with certificate', () => {
+    const bundle: SerializedBundle = fromPartial(
+      validBundles.v1.dsse.withSigningCert
+    );
+
+    it('returns a Signer with a valid key object', async () => {
+      const result = await verify(bundle, tufOptions);
+      expect(result).toMatchObject({
+        key: expect.any(Object),
+        identity: expect.any(Object),
+      });
+
+      // Verify the key is a proper crypto.KeyObject
+      expect(result.key).toHaveProperty('asymmetricKeyType');
+      expect(typeof result.key.export).toBe('function');
+    });
+
+    it('returns a Signer with certificate identity information', async () => {
+      const result = await verify(bundle, tufOptions);
+      expect(result.identity).toBeDefined();
+
+      // The identity should have either subjectAlternativeName or extensions
+      expect(
+        result.identity?.subjectAlternativeName ||
+        result.identity?.extensions
+      ).toBeDefined();
+    });
+
+  });
+
+  describe('when verifying a message signature bundle', () => {
+    const bundle: SerializedBundle = fromPartial(
+      validBundles.v1.messageSignature.withSigningCert
+    );
+    const artifact = validBundles.artifact;
+
+    it('returns a Signer object with key and identity', async () => {
+      const result = await verify(bundle, artifact, tufOptions);
+
+      expect(result).toMatchObject({
+        key: expect.any(Object),
+        identity: expect.any(Object),
+      });
+    });
+
+    it('returns a key that can be used for cryptographic operations', async () => {
+      const result = await verify(bundle, artifact, tufOptions);
+
+      // Verify we can export the public key
+      expect(() => {
+        result.key.export({ format: 'pem', type: 'spki' });
+      }).not.toThrow();
+    });
+  });
+
+  describe('when verifying with public key', () => {
+    const bundle: SerializedBundle = fromPartial(
+      validBundles.v1.dsse.withPublicKey
+    );
+    const options: VerifyOptions = {
+      ...tufOptions,
+      keySelector: (hint: string) => validBundles.publicKeys[hint],
+    };
+
+    it('returns a Signer with key', async () => {
+      const result = await verify(bundle, options);
+
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
     });
   });
 });
@@ -327,9 +439,13 @@ describe('#createVerifier', () => {
       validBundles.v1.dsse.withSigningCert
     );
 
-    it('does not throw an error when invoked', async () => {
+    it('returns a Signer object when invoked', async () => {
       const verifier = await createVerifier(tufOptions!);
-      expect(verifier.verify(bundle)).toBeUndefined();
+      const result = verifier.verify(bundle);
+      expect(result).toBeDefined();
+      expect(result).toHaveProperty('key');
+      expect(result.key).toBeDefined();
+      expect(result).toHaveProperty('identity');
     });
   });
 
@@ -345,4 +461,82 @@ describe('#createVerifier', () => {
       }).toThrowWithCode(VerificationError, 'TLOG_BODY_ERROR');
     });
   });
+
+  describe('#createVerifier - BundleVerifier.verify Signer return tests', () => {
+    describe('when verifying valid bundles', () => {
+      const bundle: SerializedBundle = fromPartial(
+        validBundles.v1.dsse.withSigningCert
+      );
+
+      it('BundleVerifier.verify returns Signer with proper structure', async () => {
+        const verifier = await createVerifier(tufOptions!);
+        const result = verifier.verify(bundle);
+
+        expect(result).toMatchObject({
+          key: expect.any(Object),
+          identity: expect.any(Object),
+        });
+
+        // Test the Signer type properties
+        expect(result.key).toHaveProperty('asymmetricKeyType');
+      });
+
+
+      it('BundleVerifier.verify throws error for invalid bundle but still returns Signer type when valid', async () => {
+        const validVerifier = await createVerifier(tufOptions!);
+        const invalidBundle: SerializedBundle = fromPartial(
+          invalidBundles.v1.dsse.invalidBadSignature
+        );
+
+        // Test that invalid bundles still throw errors
+        expect(() => {
+          validVerifier.verify(invalidBundle);
+        }).toThrowWithCode(VerificationError, 'TLOG_BODY_ERROR');
+
+        // But valid bundles should return Signer
+        const result = validVerifier.verify(bundle);
+        expect(result).toMatchObject({
+          key: expect.any(Object),
+          identity: expect.any(Object),
+        });
+      });
+    });
+
+    describe('when verifying with data payload', () => {
+      const bundle: SerializedBundle = fromPartial(
+        validBundles.v1.messageSignature.withSigningCert
+      );
+      const artifact = validBundles.artifact;
+
+      it('BundleVerifier.verify with data returns proper Signer', async () => {
+        const verifier = await createVerifier(tufOptions!);
+        const result = verifier.verify(bundle, artifact);
+
+        expect(result).toMatchObject({
+          key: expect.any(Object),
+          identity: expect.any(Object),
+        });
+
+        // Verify identity contains expected certificate information
+        expect(result.identity).toBeDefined();
+        if (result.identity) {
+          expect(
+            result.identity.subjectAlternativeName || result.identity.extensions
+          ).toBeDefined();
+        }
+      });
+
+      it('BundleVerifier.verify returns Signer with working cryptographic key', async () => {
+        const verifier = await createVerifier(tufOptions!);
+        const result = verifier.verify(bundle, artifact);
+
+        // Ensure the key can be exported and used
+        expect(() => {
+          const exported = result.key.export({ format: 'pem', type: 'spki' });
+          expect(typeof exported).toBe('string');
+          expect(exported).toContain('-----BEGIN PUBLIC KEY-----');
+        }).not.toThrow();
+      });
+    });
+  });
 });