feat: add Resend release gate evidence validation (TASK-WP7-03)

2026-08-04 13:51:02 +08:00
parent 623cad25b2
commit cca0a38ada
4 changed files with 399 additions and 1 deletions
@@ -0,0 +1,76 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  validateAuthResult,
+  validateDeliverySummary,
+  validateDomainCheck,
+  validateRedaction,
+} from "../../scripts/lib/resend-release-gate.mjs";
+
+const realEvidence = {
+  source: "human_controlled_real",
+  service: "resend",
+  status: "verified",
+  schema_version: "1.0",
+};
+
+test("requires SPF, DKIM, exact free limits, and no paid fallback", () => {
+  assert.deepEqual(validateDomainCheck({
+    ...realEvidence,
+    dkim: { status: "pass" },
+    domain_controlled: true,
+    free_rules: { daily_limit: 80, monthly_limit: 2400, paid_fallback_enabled: false, status: "verified" },
+    spf: { status: "pass" },
+  }), []);
+  assert.ok(validateDomainCheck({ ...realEvidence, domain_controlled: true, spf: { status: "pass" }, dkim: { status: "fail" }, free_rules: { status: "unknown" } }).includes("dkim"));
+});
+
+test("requires exactly three 20-message delivery cohorts with 19 within 120 seconds", () => {
+  const summary = {
+    ...realEvidence,
+    categories: ["qq", "163", "enterprise"].map((category) => ({
+      category,
+      delivered_within_120_seconds: 19,
+      max_latency_seconds: 120,
+      mock_used: false,
+      preseeded_account_used: false,
+      sent_count: 20,
+    })),
+  };
+  assert.deepEqual(validateDeliverySummary(summary), []);
+  assert.ok(validateDeliverySummary({ ...summary, categories: summary.categories.map((item) => item.category === "163" ? { ...item, delivered_within_120_seconds: 18 } : item) }).some((error) => error.includes("163")));
+  assert.ok(validateDeliverySummary({ ...summary, categories: summary.categories.map((item) => item.category === "enterprise" ? { ...item, max_latency_seconds: undefined } : item) }).some((error) => error.includes("enterprise")));
+});
+
+test("requires formal ordinary and admin authentication chains", () => {
+  assert.deepEqual(validateAuthResult({
+    ...realEvidence,
+    admin: { chain: "formal", status: "passed", verification_code_source: "real_delivery" },
+    mock_used: false,
+    ordinary: { chain: "formal", status: "passed", verification_code_source: "real_delivery" },
+    preseeded_account_used: false,
+  }), []);
+  assert.ok(validateAuthResult({ ...realEvidence, admin: { chain: "mock", status: "passed", verification_code_source: "fixture" }, ordinary: { status: "failed" } }).length > 0);
+});
+
+test("rejects credentials, mailboxes, private values, and paths from evidence", () => {
+  assert.deepEqual(validateRedaction({
+    absolute_paths_in_evidence: false,
+    credentials_in_evidence: false,
+    forbidden_matches: 0,
+    mailboxes_in_evidence: false,
+    private_content_in_evidence: false,
+    schema_version: "1.0",
+    status: "passed",
+  }, JSON.stringify({ category: "qq", delivered_within_120_seconds: 20 })), []);
+  assert.ok(validateRedaction({
+    absolute_paths_in_evidence: false,
+    credentials_in_evidence: false,
+    forbidden_matches: 0,
+    mailboxes_in_evidence: false,
+    private_content_in_evidence: false,
+    schema_version: "1.0",
+    status: "passed",
+  }, JSON.stringify({ mailbox: "recipient@example.invalid" })).includes("email_value"));
+});