draft: Priority 2 test files T-011 through T-024 in src/drafts/TEST-EXPANSION/

@@ -0,0 +1,140 @@1+// T-019: Argon2id known-answer test (KAT) + parameter assertion2+//3+// Why this test exists: the Argon2id KDF in vault.ts uses m=65536 (64 MiB),4+// t=3 (iterations), p=4 (parallelism), hashLength=32. These parameters5+// determine the real-world cost for an attacker brute-forcing a stolen vault.6+// There is no existing test that:7+//   1. Pins a known (password, salt) to an expected 32-byte output, and8+//   2. Asserts that the parameters match the documented values.9+//10+// A regression that silently reduces e.g. m=65536 → m=1024 would be11+// invisible to users, significantly weaken offline attack resistance, and12+// pass all existing tests because the vault still unlocks (the key changes but13+// re-encrypts everything on save).14+//15+// The KAT approach:16+//   - Pick a deterministic (password, salt) pair and compute the expected17+//     Argon2id output offline (reference value below).18+//   - Assert the actual output matches byte-for-byte.19+//   - If any parameter silently changes (m, t, p, or hashLength), the output20+//     hash changes and this test fails.21+//22+// Reference KAT vector:23+//   password = "testpassword"   (NFC-normalized — same as ASCII, no change)24+//   salt     = 16 × 0xAB25+//   m=65536, t=3, p=4, hashLength=3226+//   Expected output: computed via hash-wasm argon2id (see script below)27+//28+//   To re-derive (run once in Node to get the canonical value):29+//     import { argon2id } from "hash-wasm";30+//     const h = await argon2id({31+//       password: "testpassword", salt: new Uint8Array(16).fill(0xAB),32+//       parallelism: 4, iterations: 3, memorySize: 65536,33+//       hashLength: 32, outputType: "binary",34+//     });35+//     console.log(Buffer.from(h).toString("hex"));36+37+import { describe, expect, it } from "vitest";38+import { deriveKey, deriveKeyRaw } from "../../crypto/argon2";39+40+// ---------------------------------------------------------------------------41+// KAT vector42+// ---------------------------------------------------------------------------43+44+// This hex string is the authoritative expected Argon2id output for the test45+// vector below. It must be re-derived if the hash-wasm library version changes46+// (major version bump) or if a KAT discrepancy is found.47+//48+// Instructions to regenerate:49+//   1. Run `npx tsx scripts/gen-argon2id-kat.ts` (or the Node snippet above).50+//   2. Paste the output here.51+//   3. Commit with message "update Argon2id KAT vector for hash-wasm vX.Y.Z".52+//53+// DO NOT change this value without the regeneration process above. A change54+// here means the KDF output has changed, which would break existing vaults.55+const KAT_EXPECTED_HEX = "REPLACE_ME_WITH_ACTUAL_HASH_FROM_GEN_SCRIPT";56+57+// If you have not yet run the generation script, mark this test as skipped58+// and uncomment the KAT vector once generated.59+const KAT_AVAILABLE = KAT_EXPECTED_HEX !== "REPLACE_ME_WITH_ACTUAL_HASH_FROM_GEN_SCRIPT";60+61+describe("T-019: Argon2id known-answer test + parameter assertion", () => {62+  // T-019a: deriveKey output matches the KAT vector exactly.63+  // If any of m, t, p, hashLength, or the NFC normalization step changes, this64+  // test fails — alerting the developer before a parameter regression ships.65+  it(66+    "T-019a: deriveKey('testpassword', salt=0xAB×16) matches KAT vector (m=65536, t=3, p=4)",67+    KAT_AVAILABLE ? undefined : { skip: "KAT vector not yet generated (run gen-argon2id-kat.ts)" },68+    async () => {69+      if (!KAT_AVAILABLE) return;70+      const salt = new Uint8Array(16).fill(0xab);71+      const key = await deriveKey("testpassword", salt);72+      expect(Array.from(key).map(b => b.toString(16).padStart(2, "0")).join("")).toBe(KAT_EXPECTED_HEX);73+    },74+  );75+76+  // T-019b: parameter assertion — output length is exactly 32 bytes.77+  // hashLength: 32 is the documented value. A change to 16 or 64 would change78+  // the output but might not cause test failures in the vault suite since79+  // AES-256-GCM needs exactly 32 bytes and a wrong length would produce80+  // only a key import error (caught at unlock, not at derive time).81+  it("T-019b: deriveKey output is exactly 32 bytes", async () => {82+    const salt = new Uint8Array(16).fill(0x01);83+    const key = await deriveKey("any-password", salt);84+    expect(key).toBeInstanceOf(Uint8Array);85+    expect(key.length).toBe(32);86+  });87+88+  // T-019c: same (password, salt) → same output (determinism).89+  // Argon2id is deterministic; two calls with the same inputs must produce90+  // identical bytes. This guards against accidental CSPRNG injection into91+  // the KDF path.92+  it("T-019c: deriveKey is deterministic for the same (password, salt)", async () => {93+    const salt = new Uint8Array(16).fill(0x33);94+    const key1 = await deriveKey("determinism-check", salt);95+    const key2 = await deriveKey("determinism-check", salt);96+    expect(key1).toEqual(key2);97+  });98+99+  // T-019d: different salt → different output.100+  // Guards against the salt being ignored (a common KDF implementation bug).101+  // If the salt is ignored, two vaults with the same master password would102+  // use the same derived key — precomputation attacks become feasible.103+  it("T-019d: different salts produce different keys", async () => {104+    const salt1 = new Uint8Array(16).fill(0x11);105+    const salt2 = new Uint8Array(16).fill(0x22);106+    const key1 = await deriveKey("same-password", salt1);107+    const key2 = await deriveKey("same-password", salt2);108+    expect(key1).not.toEqual(key2);109+  });110+111+  // T-019e: NFC normalization — NFC("café") and NFC("café") produce the112+  // same key. The LV-1 fix normalized passwords before the KDF; without it,113+  // a macOS dead-key typed "café" would produce a different key than a Windows114+  // precomposed "café" (U+00E9).115+  it("T-019e: NFC-equivalent passwords derive the same key (LV-1 normalization)", async () => {116+    const salt = new Uint8Array(16).fill(0x55);117+    const composed = "café";      // U+00E9 (precomposed)118+    const decomposed = "café";   // e + combining acute accent (NFD)119+    // deriveKey applies .normalize("NFC") before the KDF120+    const keyComposed = await deriveKey(composed, salt);121+    const keyDecomposed = await deriveKey(decomposed, salt);122+    expect(keyComposed).toEqual(keyDecomposed);123+  });124+125+  // T-019f: deriveKeyRaw (legacy LV-1 fallback) does NOT apply NFC normalization.126+  // The raw path is used only to unlock pre-LV-1 vaults. It must produce a127+  // different key from deriveKey for NFD inputs.128+  it("T-019f: deriveKeyRaw and deriveKey differ for NFD passwords (raw skips NFC)", async () => {129+    const salt = new Uint8Array(16).fill(0x66);130+    const nfdPassword = "café"; // NFD form — NFC would normalize to U+00E9131+    if (nfdPassword === nfdPassword.normalize("NFC")) {132+      // If the runtime auto-normalizes string literals, this test can't133+      // distinguish the two paths. Skip rather than silently pass.134+      return;135+    }136+    const keyNormalized = await deriveKey(nfdPassword, salt);137+    const keyRaw = await deriveKeyRaw(nfdPassword, salt);138+    expect(keyNormalized).not.toEqual(keyRaw);139+  });140+});

@@ -0,0 +1,183 @@1+// T-017: Codex multi-stripe round-trip2+//3+// Why this test exists: the Codex erasure layer splits large vaults across4+// multiple RS stripes (each capped at MAX_DATA_SHARDS_PER_STRIPE = 200 shards5+// × 350 bytes = 70,000 bytes per stripe). Single-stripe round-trips are covered6+// by codex.suite.test.ts and codex.adversarial.test.ts. The multi-stripe path7+// — encodeIntoStripes() → reconstructPayloadFromStripes() — has no test that8+// verifies the concatenation boundary is correct. A one-off-by-CHUNK_SIZE bug9+// in the stripe-cursor arithmetic would corrupt the payload silently when the10+// compressed vault crosses the 70 kB boundary.11+//12+// Tests:13+//   T-017a: payload > MAX_SHARDS_PER_STRIPE * CHUNK_SIZE → encodeIntoStripes14+//           returns 2+ stripes.15+//   T-017b: reconstruct a 2-stripe encoding → JSON payload matches original.16+//   T-017c: reconstruct with parity shards removed from each stripe → RS fills17+//           in (up to parityShards erased chunks per stripe).18+19+import { deflate } from "pako";20+import { describe, expect, it } from "vitest";21+import {22+  CHUNK_SIZE,23+  MAX_DATA_SHARDS_PER_STRIPE,24+  computeParityShards,25+  type CodexPayload,26+} from "../../shared/codex-types";27+import {28+  encodeIntoStripes,29+  type EncodeResult,30+} from "../../popup/codex/erasure";31+import {32+  reconstructPayloadFromStripes,33+  type StripeChunks,34+} from "../../popup/codex/generate";35+36+// ---------------------------------------------------------------------------37+// Helpers38+// ---------------------------------------------------------------------------39+40+function makeCodexPayload(paddingKb: number): { payload: CodexPayload; json: string } {41+  const payload: CodexPayload = {42+    vaultBlob: "A".repeat(paddingKb * 1024),43+    verifyCode: "TEST-CODE",44+    issuedAt: 0,45+    fingerprint: "test-fingerprint",46+    entries: [],47+    identities: [],48+    settings: {},49+  } as unknown as CodexPayload;50+  return { payload, json: JSON.stringify(payload) };51+}52+53+function encodeResultToStripeChunks(r: EncodeResult): StripeChunks {54+  const chunks = new Map<number, Uint8Array>();55+  for (let i = 0; i < r.dataChunks.length; i++) {56+    chunks.set(i, r.dataChunks[i]!);57+  }58+  for (let i = 0; i < r.parityChunks.length; i++) {59+    chunks.set(r.dataShards + i, r.parityChunks[i]!);60+  }61+  return { chunks, dataShards: r.dataShards, totalChunks: r.totalChunks };62+}63+64+function encodeResultToStripeChunksWithoutParity(r: EncodeResult): StripeChunks {65+  const chunks = new Map<number, Uint8Array>();66+  for (let i = 0; i < r.dataChunks.length; i++) {67+    chunks.set(i, r.dataChunks[i]!);68+  }69+  // Parity shards omitted: RS decoder must reconstruct them (erasure mode)70+  return { chunks, dataShards: r.dataShards, totalChunks: r.totalChunks };71+}72+73+function buildStripeChunksWithErasures(74+  r: EncodeResult,75+  eraseParityCount: number,76+): StripeChunks {77+  const chunks = new Map<number, Uint8Array>();78+  for (let i = 0; i < r.dataChunks.length; i++) {79+    chunks.set(i, r.dataChunks[i]!);80+  }81+  // Keep only `parityShards - eraseParityCount` parity shards82+  const keep = r.parityChunks.length - eraseParityCount;83+  for (let i = 0; i < keep; i++) {84+    chunks.set(r.dataShards + i, r.parityChunks[i]!);85+  }86+  return { chunks, dataShards: r.dataShards, totalChunks: r.totalChunks };87+}88+89+// ---------------------------------------------------------------------------90+// Tests91+// ---------------------------------------------------------------------------92+93+describe("T-017: Codex multi-stripe encode/reconstruct", () => {94+  // T-017a: a payload larger than one stripe forces multiple stripes.95+  // MAX_DATA_SHARDS_PER_STRIPE = 200, CHUNK_SIZE = 350 bytes → one stripe96+  // can hold 70,000 bytes. We need > 70,000 bytes compressed to force 2 stripes.97+  // Using 200 kB of incompressible-ish data (base64 of random-ish bytes) ensures98+  // the compressed output still exceeds the single-stripe capacity.99+  it("T-017a: payload > one-stripe capacity → encodeIntoStripes returns 2+ stripes", async () => {100+    // 250 kB of text that deflate can't reduce below 70 kB (mostly random chars)101+    const hugeText = Array.from({ length: 250 * 1024 }, (_, i) => String.fromCharCode(33 + (i % 90))).join("");102+    const compressed = deflate(hugeText);103+104+    const result = await encodeIntoStripes(compressed);105+106+    expect(result.stripes.length).toBeGreaterThanOrEqual(2);107+    expect(result.totalDataChunks).toBeGreaterThan(MAX_DATA_SHARDS_PER_STRIPE);108+    for (const stripe of result.stripes) {109+      // GF(2⁸) cap: every stripe must fit within 256 total shards110+      expect(stripe.dataShards + stripe.parityShards).toBeLessThanOrEqual(255);111+      // No single stripe exceeds the per-stripe cap112+      expect(stripe.dataShards).toBeLessThanOrEqual(MAX_DATA_SHARDS_PER_STRIPE);113+    }114+  });115+116+  // T-017b: encode a 2-stripe payload, reconstruct it, verify JSON matches.117+  // This is the primary multi-stripe correctness check. The concatenation of118+  // stripe data must reproduce the original deflated bytes byte-for-byte.119+  //120+  // Bug this catches: an off-by-CHUNK_SIZE error in the `byteCursor` arithmetic121+  // inside `encodeIntoStripes` would corrupt the stripe boundaries, causing122+  // `inflateBounded` in `reconstructPayloadFromStripes` to fail or produce123+  // wrong JSON.124+  it("T-017b: 2-stripe round-trip → reconstructed payload matches original", async () => {125+    // 150 kB of ASCII text. deflate typically achieves ~50% for structured text,126+    // so compressed ≈ 75 kB > 70 kB single-stripe cap → 2 stripes.127+    const { json } = makeCodexPayload(110);128+    const compressed = deflate(json);129+130+    const encoded = await encodeIntoStripes(compressed);131+    expect(encoded.stripes.length).toBeGreaterThanOrEqual(2);132+133+    const stripeChunks: StripeChunks[] = encoded.stripes.map(encodeResultToStripeChunks);134+135+    const restored = await reconstructPayloadFromStripes(stripeChunks);136+    expect(JSON.stringify(restored)).toBe(json);137+  });138+139+  // T-017c: reconstruct with some parity shards missing from each stripe.140+  // The Reed-Solomon codec fills in erased shards from the surviving data + parity141+  // shards. Dropping up to `parityShards` chunks (here: 1 parity shard per stripe)142+  // must still produce a correct reconstruction.143+  //144+  // Bug this catches: an erasure position bug in `decodeWithErasure` that145+  // mis-identifies which shard is erased would corrupt the data even with146+  // enough redundancy present.147+  it("T-017c: 2-stripe payload with 1 parity shard erased per stripe → reconstruction succeeds", async () => {148+    const { json } = makeCodexPayload(110);149+    const compressed = deflate(json);150+    const encoded = await encodeIntoStripes(compressed);151+    expect(encoded.stripes.length).toBeGreaterThanOrEqual(2);152+153+    // Drop 1 parity shard per stripe — within the RS recovery budget154+    const stripeChunks: StripeChunks[] = encoded.stripes.map((r) => {155+      const parityBudget = computeParityShards(r.dataShards);156+      // Drop exactly 1 parity shard — must be within budget157+      if (parityBudget < 1) return encodeResultToStripeChunks(r); // shouldn't happen for real stripes158+      return buildStripeChunksWithErasures(r, 1);159+    });160+161+    const restored = await reconstructPayloadFromStripes(stripeChunks);162+    expect(JSON.stringify(restored)).toBe(json);163+  });164+165+  // T-017d: empty stripes array → CodexError("INSUFFICIENT_CHUNKS").166+  // reconstructPayloadFromStripes must fail fast with a typed error on no input.167+  it("T-017d: empty stripes array → throws INSUFFICIENT_CHUNKS", async () => {168+    await expect(reconstructPayloadFromStripes([])).rejects.toThrow(/INSUFFICIENT_CHUNKS/i);169+  });170+171+  // T-017e: single-stripe payload still works through reconstructPayloadFromStripes.172+  // The multi-stripe path handles single-stripe as a degenerate case.173+  it("T-017e: single-stripe small payload round-trips through reconstructPayloadFromStripes", async () => {174+    const { json } = makeCodexPayload(1); // 1 kB — fits in a few shards175+    const compressed = deflate(json);176+    const encoded = await encodeIntoStripes(compressed);177+    expect(encoded.stripes.length).toBe(1);178+179+    const stripeChunks: StripeChunks[] = encoded.stripes.map(encodeResultToStripeChunks);180+    const restored = await reconstructPayloadFromStripes(stripeChunks);181+    expect(JSON.stringify(restored)).toBe(json);182+  });183+});

@@ -0,0 +1,175 @@1+// T-011 through T-014: index.ts autofill orchestration2+//3+// Why these tests exist: src/content/index.ts (1,263 lines) is the central4+// autofill decision layer. It implements:5+//   - A 3-layer dismissal model that prevents the selector reopening after6+//     dismiss or fill (lastDismissedField, DISMISS_LOCK_MS, wasAlreadyFilled)7+//   - handleFieldInteraction: ML predict → locked-vault branch → signup/fill8+//   - initialScan: aggression levels 0/1/2 for different page contexts9+//   - Message routing: SUMMON_AUTOFILL, VAULT_UNLOCKED, passkey branches10+//11+// The analysis (§5) flags this as "the most regression-prone code in the12+// project" (v1.4.14 had multiple regressions in this layer) with zero unit13+// test coverage. The e2e suite uses synthetic HTML and doesn't drive the14+// orchestration state machine.15+//16+// ---------------------------------------------------------------------------17+// Integration Contract — REFACTORING REQUIRED18+// ---------------------------------------------------------------------------19+//20+// index.ts exports NOTHING. All functions (handleFieldInteraction, initialScan,21+// wasAlreadyFilled, startDismissLock) and state (lastDismissedField, dismissLock,22+// passkeySummonActive, pageFilledAt) are module-private. To make the tests below23+// runnable, the following exports are needed:24+//25+//   export { handleFieldInteraction }       // for T-01226+//   export { initialScan }                  // for T-01327+//   export { wasAlreadyFilled }             // for T-011 (wasAlreadyFilled check)28+//   export const _testSeam: {              // for T-011 (per-field lock state)29+//     getLastDismissedField(): HTMLInputElement | null;30+//     setLastDismissedField(f: HTMLInputElement | null): void;31+//     isDismissLocked(): boolean;32+//     DISMISS_LOCK_MS: number;33+//   }34+//35+// Additionally, the test environment must be switched to jsdom:36+//   // in vitest.config.ts:37+//   environmentMatchGlobs: [['src/drafts/TEST-EXPANSION/content.orchestration.test.ts', 'jsdom']]38+//39+// And the content script's chrome API calls must be mocked:40+//   - chrome.runtime.sendMessage (for vault queries)41+//   - chrome.runtime.onMessage.addListener (for VAULT_UNLOCKED/SUMMON_AUTOFILL)42+//43+// ---------------------------------------------------------------------------44+45+import { describe, it } from "vitest";46+47+// All tests below are stubs pending the refactoring described above.48+// They document the intended behavior and the specific bug each test catches.49+50+describe("T-011: Dismissal model — 3-layer prevention of selector reopen", () => {51+  // T-011a: per-field lock (lastDismissedField)52+  // After dismissing the selector on field A, focusing field A again must NOT53+  // reopen the selector. Focusing a different field B must reopen normally.54+  //55+  // Bug this catches: removing the `field === lastDismissedField` guard in56+  // handleFieldInteraction causes the selector to reopen immediately after57+  // any Escape-dismiss (regression from v1.4.14).58+  it.todo(59+    "T-011a: focus field A → Escape dismiss → re-focus field A → selector does NOT reopen (requires _testSeam export)",60+  );61+62+  // T-011b: DISMISS_LOCK_MS global cooldown63+  // After any dismiss, a 800ms global lock prevents the selector reopening64+  // on any field (cross-field rapid tabbing).65+  //66+  // Bug this catches: removing startDismissLock() from the onDismiss callback67+  // allows the selector to reopen immediately when the user tabs to the next68+  // field after dismissing.69+  it.todo(70+    "T-011b: dismiss → immediately focus another field → selector does NOT open within 800ms lock (requires _testSeam export)",71+  );72+73+  // T-011c: wasAlreadyFilled form-level grace (PAGE_FILL_GRACE_MS = 3000ms)74+  // After a successful fill, the form and page enter a 3-second grace period.75+  // Re-focusing the same field during the grace period must not reopen the selector.76+  //77+  // Bug this catches: clearing pageFilledAt or removing the PAGE_FILL_GRACE_MS78+  // check causes the selector to immediately reappear after autofill, annoying79+  // users and breaking the "fill once" guarantee.80+  it.todo(81+    "T-011c: fill field → immediate re-focus → selector does NOT reopen (wasAlreadyFilled grace, requires jsdom + real fills)",82+  );83+});84+85+describe("T-012: handleFieldInteraction core paths", () => {86+  // T-012a: ML timeout race (150ms)87+  // If contentMLDetector.predictBatch takes > 150ms, handleFieldInteraction88+  // should use the fallback (no ML prediction) rather than waiting indefinitely.89+  //90+  // Bug this catches: removing the Promise.race timeout causes autofill to91+  // hang on slow pages where ML prediction is delayed.92+  it.todo(93+    "T-012a: ML-predict timeout — mock predictBatch to take 200ms → timeout path taken (requires handleFieldInteraction export)",94+  );95+96+  // T-012b: locked vault path97+  // When the vault is locked, handleFieldInteraction must show the lock prompt98+  // (not the entry selector) and NOT call showAutofillSelector.99+  it.todo(100+    "T-012b: locked vault → lock prompt shown, showAutofillSelector NOT called (requires chrome.runtime mock)",101+  );102+103+  // T-012c: signup mode (no domain entries)104+  // When vault has no entries for the current domain, the identity surface is105+  // shown (for username pre-fill) rather than the entry selector.106+  it.todo(107+    "T-012c: vault has no domain entries → identity surface shown (requires chrome.runtime.sendMessage mock)",108+  );109+110+  // T-012d: email-first form (no password field on step 1)111+  // Google/Microsoft login pages show email, then password on the next page.112+  // handleFieldInteraction must detect this and show only the email-fill surface.113+  it.todo(114+    "T-012d: email-first form (no password field) → email-only path taken (requires jsdom form)",115+  );116+});117+118+describe("T-013: initialScan aggression levels", () => {119+  // T-013a: level 0 — page with no credential form fields → no icon injected.120+  // Bug this catches: a false-positive in isAnyCredentialForm causes the icon121+  // to appear on forms that have no username/password fields.122+  it.todo(123+    "T-013a: form with no matching fields + level 0 → initialScan skips injection (requires jsdom)",124+  );125+126+  // T-013b: level 1 — standard login form → icon injected on password field.127+  it.todo(128+    "T-013b: standard login form + level 1 → icon injected (requires jsdom + injectFieldIcon spy)",129+  );130+131+  // T-013c: level 2 final-pass — bare password field (no username) → icon injected.132+  // This covers the scenario where a SPA reveals the password field after the133+  // username step. The final-pass injection catches fields missed by level 0/1.134+  it.todo(135+    "T-013c: bare password field + level 2 finalPass → icon injected (requires jsdom + injectFieldIcon spy)",136+  );137+});138+139+describe("T-014: Message routing — SUMMON_AUTOFILL and VAULT_UNLOCKED", () => {140+  // T-014a: SUMMON_AUTOFILL from keyboard shortcut opens selector on focused field.141+  // Bug this catches: removing the SUMMON_AUTOFILL branch in the message listener142+  // breaks the Ctrl+Shift+F shortcut for manual autofill.143+  it.todo(144+    "T-014a: SUMMON_AUTOFILL message → selector opens on active field (requires chrome.runtime.onMessage mock)",145+  );146+147+  // T-014b: VAULT_UNLOCKED re-triggers autofill on pending field.148+  // When the user unlocks the vault in response to a lock-prompt, the content149+  // script should automatically retry the fill for the field that triggered it.150+  it.todo(151+    "T-014b: VAULT_UNLOCKED → re-trigger handleFieldInteraction on pending field (requires chrome.runtime.onMessage mock)",152+  );153+154+  // T-014c: VAULT_UNLOCKED does not double-trigger when passkeySummonActive.155+  // If a passkey toast is already showing (passkeySummonActive = true), the156+  // VAULT_UNLOCKED handler must skip autofill to prevent a race condition.157+  it.todo(158+    "T-014c: VAULT_UNLOCKED with passkeySummonActive=true → no double-trigger (requires _testSeam export)",159+  );160+});161+162+// ---------------------------------------------------------------------------163+// What CAN be tested without refactoring164+// ---------------------------------------------------------------------------165+// The pure helper functions in src/content/detect.ts, fill.ts, interaction.ts,166+// policy.ts, and identity-helper.ts are already well covered. The autofill167+// gap is specifically in index.ts's stateful orchestration layer.168+//169+// The only testable behavior from index.ts without exports is importing the170+// module and verifying it doesn't crash on load (smoke test):171+describe("T-011/smoke: index.ts module loads without throwing", () => {172+  it.todo(173+    "importing index.ts in a jsdom environment with chrome mock does not throw (requires jsdom environment switch)",174+  );175+});

@@ -0,0 +1,138 @@1+// T-021: CSV formula-injection on import (round-trip)2+//3+// Why this test exists: the export side has `csvSafe()` in Export.tsx which4+// prefixes formula-trigger characters (=, +, -, @, \t, \r) with a quote.5+// Export.csv.test.ts verifies `csvSafe()` in isolation. However, there is no6+// test that covers the import → vault → re-export round-trip:7+//8+//   1. Import a CSV with formula-injection strings in title/username/password.9+//   2. The entries land in the vault with the raw (unescaped) values.10+//   3. When the vault is re-exported to CSV, `csvSafe()` must neutralize the11+//      formula characters so the resulting CSV is safe to open in a spreadsheet.12+//13+// The gap: if someone imports a Bitwarden/1Password CSV that was generated by14+// an attacker with malicious formulas in the title or notes fields, and the15+// user later exports those entries to CSV to migrate to a different manager,16+// the export must not produce spreadsheet-formula-executable content.17+//18+// Integration note: this test uses `parseImportSource` from import.ts (to19+// simulate the import path) and `csvSafe` from Export.tsx (to verify the20+// export-side sanitization is applied to the imported values).21+22+import { describe, expect, it } from "vitest";23+import { parseImportSource } from "../../shared/import";24+import { csvSafe } from "../../popup/views/Export";25+26+// ---------------------------------------------------------------------------27+// CSV helpers28+// ---------------------------------------------------------------------------29+30+function buildCsv(rows: Array<Record<string, string>>): string {31+  const headers = Object.keys(rows[0]!);32+  const lines = [33+    headers.join(","),34+    ...rows.map((row) =>35+      headers.map((h) => `"${(row[h] ?? "").replace(/"/g, '""')}"`).join(","),36+    ),37+  ];38+  return lines.join("\n");39+}40+41+// ---------------------------------------------------------------------------42+// Tests43+// ---------------------------------------------------------------------------44+45+describe("T-021: CSV formula-injection import round-trip", () => {46+  // T-021a: a CSV title starting with "=" is imported without modification.47+  // The vault stores the raw value (=cmd|…); it is NOT sanitized on import48+  // because the vault is a structured data store, not a CSV writer.49+  it("T-021a: CSV entry with '=cmd...' title is imported with raw value preserved", async () => {50+    const csv = buildCsv([51+      {52+        name: "=cmd|'/c calc'!A1",53+        username: "user",54+        password: "secret",55+        url: "https://example.com",56+      },57+    ]);58+59+    const result = await parseImportSource(csv);60+    expect(result.entries).toHaveLength(1);61+    // Raw value preserved in the vault entry (no mangling on import)62+    expect(result.entries[0]!.title).toBe("=cmd|'/c calc'!A1");63+  });64+65+  // T-021b: when the imported title is passed through csvSafe (as Export.tsx66+  // does at re-export time), the formula character is neutralized.67+  //68+  // Bug this catches: if csvSafe is NOT applied at export time to re-imported69+  // entries, the exported CSV would contain a live spreadsheet formula.70+  it("T-021b: csvSafe neutralizes the formula character when re-exporting the imported title", () => {71+    const rawTitle = "=cmd|'/c calc'!A1";72+    const safe = csvSafe(rawTitle);73+    // csvSafe prefixes formula-trigger characters with a single quote74+    expect(safe).toMatch(/^'/);75+    expect(safe).not.toMatch(/^=/);76+  });77+78+  // T-021c: formula-injection characters in all four dangerous leading positions.79+  // The OWASP list of formula-trigger chars: =, +, -, @, \t, \r.80+  // Each must be sanitized by csvSafe when re-exported.81+  it("T-021c: all formula-trigger leading characters are neutralized by csvSafe on re-export", () => {82+    const triggers = ["=", "+", "-", "@", "\t", "\r"];83+    for (const char of triggers) {84+      const raw = char + "HYPERLINK(\"http://evil.example.com\")";85+      const safe = csvSafe(raw);86+      expect(safe.startsWith(char), `'${char}' should be escaped but csvSafe returned: ${safe}`).toBe(false);87+    }88+  });89+90+  // T-021d: ordinary email addresses starting with "@" inside the string91+  // (not as the FIRST character) must NOT be escaped.92+  // This tests that csvSafe doesn't over-sanitize values like "[email protected]".93+  it("T-021d: email with '@' not at position 0 passes through csvSafe unchanged", () => {94+    const email = "[email protected]";95+    expect(csvSafe(email)).toBe("[email protected]");96+  });97+98+  // T-021e: an imported CSV with formula-injection in the username field is99+  // also sanitized by csvSafe when re-exported.100+  it("T-021e: formula-injection in username field sanitized on re-export", async () => {101+    const csv = buildCsv([102+      {103+        name: "My Site",104+        username: "+1 800 EVIL",105+        password: "mypassword",106+        url: "https://example.com",107+      },108+    ]);109+110+    const result = await parseImportSource(csv);111+    expect(result.entries).toHaveLength(1);112+    const rawUsername = result.entries[0]!.username ?? "";113+    // Raw value preserved in vault entry114+    expect(rawUsername).toBe("+1 800 EVIL");115+    // csvSafe escapes it at re-export time116+    expect(csvSafe(rawUsername)).toMatch(/^'/);117+  });118+119+  // T-021f: a formula-injection string in the password field.120+  // Passwords are exported to CSV in plaintext (that's the point of CSV export).121+  // A password that starts with "=" could execute as a formula in a spreadsheet.122+  it("T-021f: formula-injection password sanitized by csvSafe at re-export", async () => {123+    const csv = buildCsv([124+      {125+        name: "Site",126+        username: "user",127+        password: "=SUM(A1:A9)",128+        url: "https://example.com",129+      },130+    ]);131+132+    const result = await parseImportSource(csv);133+    expect(result.entries).toHaveLength(1);134+    const rawPassword = result.entries[0]!.password ?? "";135+    expect(rawPassword).toBe("=SUM(A1:A9)");136+    expect(csvSafe(rawPassword)).toMatch(/^'/);137+  });138+});

@@ -0,0 +1,230 @@1+// T-022: GET_ENTRY_FOR_EDIT via sender.url + locked-vault AUTOFILL_QUERY2+//3+// Why these tests exist:4+//5+//   GET_ENTRY_FOR_EDIT origin check (PCH-01-006):6+//     The edit channel returns the full TOTP seed and password history — as7+//     sensitive as a fill response. PCH-01-006 added a sender.url domain check8+//     to refuse cross-domain requests. Today the only caller is the popup9+//     (no sender.url), so the check is a structural defense-in-depth guard10+//     that the existing suite doesn't trigger (it never passes a tab-context11+//     sender). An untested guard can silently be removed or inverted.12+//13+//   AUTOFILL_QUERY includeAll vault-locked path:14+//     `includeAll` ships the entire vault inventory (all titles/usernames).15+//     Two guards protect it: (a) userGesture check that strips includeAll16+//     when the flag isn't set, and (b) vault_locked check that fires before17+//     any data access. The vault_locked path for AUTOFILL_QUERY is tested18+//     only incidentally; the includeAll guard against non-gesture callers is19+//     not tested at all.20+21+import { beforeEach, describe, expect, it, vi } from "vitest";22+23+type StorageShape = Record<string, unknown>;24+25+function makeChromeStorageMock() {26+  const storage: StorageShape = {};27+  const chrome = {28+    storage: {29+      local: {30+        get: vi.fn(async (key?: string | string[]) => {31+          if (!key) return { ...storage };32+          if (typeof key === "string") return { [key]: storage[key] };33+          return (Array.isArray(key) ? key : [key]).reduce<StorageShape>(34+            (acc, k) => { acc[k] = storage[k]; return acc; },35+            {},36+          );37+        }),38+        set: vi.fn(async (next: StorageShape) => { Object.assign(storage, next); }),39+        remove: vi.fn(async (keys: string | string[]) => {40+          const ks = Array.isArray(keys) ? keys : [keys];41+          for (const k of ks) delete storage[k];42+        }),43+      },44+      session: {45+        get: vi.fn(async () => ({})),46+        set: vi.fn(async () => {}),47+        remove: vi.fn(async () => {}),48+      },49+    },50+    alarms: { clear: vi.fn(), create: vi.fn(), onAlarm: { addListener: vi.fn() } },51+    idle: { setDetectionInterval: vi.fn(), onStateChanged: { addListener: vi.fn() } },52+    runtime: {53+      id: "test-extension-id",54+      getURL: vi.fn((path: string) => `chrome-extension://test-extension-id/${path}`),55+    },56+  } as unknown as typeof chrome;57+  return { storage, chrome };58+}59+60+describe("T-022: Message router origin and lock guards", () => {61+  let vault: typeof import("../../background/vault");62+  let messages: typeof import("../../background/messages");63+64+  beforeEach(async () => {65+    vi.resetModules();66+    const mock = makeChromeStorageMock();67+    (globalThis as Record<string, unknown>).chrome = mock.chrome;68+    vi.stubGlobal("fetch", vi.fn(async () => { throw new Error("no network"); }));69+70+    vault = await import("../../background/vault");71+    messages = await import("../../background/messages");72+73+    await vault.createVault("test-messages-pass");74+  });75+76+  // T-022a: AUTOFILL_QUERY returns vault_locked before accessing entries77+  // when the vault is not unlocked.78+  //79+  // Bug this catches: removing the `!vault.isUnlocked()` guard at the top of80+  // the AUTOFILL_QUERY case would expose domain-matched entries to a locked-81+  // vault state — entries are readable from the in-memory array even when82+  // the vault is "locked" at the API layer in some edge cases.83+  it("T-022a: AUTOFILL_QUERY returns vault_locked when vault is not unlocked", async () => {84+    // The vault was created and unlocked by createVault; lock it.85+    vault.lock();86+    expect(vault.isUnlocked()).toBe(false);87+88+    const result = await messages.handleMessage(89+      { type: "AUTOFILL_QUERY", payload: { domain: "example.com", kind: "login" } },90+      {} as chrome.runtime.MessageSender,91+    );92+93+    expect((result as { ok: boolean; error: string }).ok).toBe(false);94+    expect((result as { ok: boolean; error: string }).error).toBe("vault_locked");95+  });96+97+  // T-022b: AUTOFILL_QUERY with includeAll=true but userGesture=false → includeAll98+  // is silently stripped. The response returns only domain-matched entries, not99+  // the full vault inventory.100+  //101+  // Bug this catches: removing the `if (includeAll && userGesture !== true)`102+  // guard allows a passive content-script focus event to harvest the entire103+  // vault title/username inventory.104+  it("T-022b: AUTOFILL_QUERY includeAll=true without userGesture → treated as includeAll=false", async () => {105+    // Add an entry for a different domain to confirm it's excluded from non-includeAll results106+    await vault.addEntry({107+      type: "login",108+      title: "Other Site",109+      username: "u",110+      password: "p",111+      url: "https://other.example.com",112+    });113+114+    const result = await messages.handleMessage(115+      {116+        type: "AUTOFILL_QUERY",117+        payload: {118+          domain: "example.com",119+          kind: "login",120+          includeAll: true,      // requested121+          userGesture: false,    // NOT a gesture → includeAll must be stripped122+        },123+      },124+      {} as chrome.runtime.MessageSender,125+    );126+127+    const { ok, data } = result as { ok: boolean; data: unknown[] };128+    expect(ok).toBe(true);129+    // includeAll was stripped; only domain-matched entries are returned130+    // "Other Site" (other.example.com) must not appear131+    const titles = (data as Array<{ title: string }>).map((e) => e.title);132+    expect(titles).not.toContain("Other Site");133+  });134+135+  // T-022c: GET_ENTRY_FOR_EDIT with sender.url from a different domain →136+  // entry_not_found (origin check fails, no id oracle).137+  //138+  // The entry belongs to "example.com". A sender from "attacker.example.net"139+  // must not receive the entry's full data (TOTP seed, password history).140+  //141+  // Bug this catches: removing the senderDomain check in GET_ENTRY_FOR_EDIT142+  // allows any tab-context sender to enumerate entry details by guessing IDs.143+  it("T-022c: GET_ENTRY_FOR_EDIT from wrong-domain sender.url → entry_not_found", async () => {144+    const entry = await vault.addEntry({145+      type: "login",146+      title: "Target Entry",147+      username: "victim",148+      password: "hunter2",149+      url: "https://example.com",150+    });151+152+    // Sender pretends to be a tab from a different domain153+    const crossDomainSender = {154+      tab: { url: "https://attacker.example.net/steal" },155+      url: "https://attacker.example.net/steal",156+    } as unknown as chrome.runtime.MessageSender;157+158+    const result = await messages.handleMessage(159+      {160+        type: "GET_ENTRY_FOR_EDIT",161+        payload: { id: entry.id, explicitSummon: false },162+      },163+      crossDomainSender,164+    );165+166+    expect((result as { ok: boolean; error: string }).ok).toBe(false);167+    expect((result as { ok: boolean; error: string }).error).toBe("entry_not_found");168+  });169+170+  // T-022d: GET_ENTRY_FOR_EDIT with matching sender domain → succeeds.171+  // The control case for T-022c: a sender from the same domain as the entry172+  // must be allowed through.173+  it("T-022d: GET_ENTRY_FOR_EDIT from matching sender.url → returns entry", async () => {174+    const entry = await vault.addEntry({175+      type: "login",176+      title: "Same Domain Entry",177+      username: "legit",178+      password: "pass123",179+      url: "https://example.com",180+    });181+182+    const matchingSender = {183+      tab: { url: "https://example.com/path" },184+      url: "https://example.com/path",185+    } as unknown as chrome.runtime.MessageSender;186+187+    const result = await messages.handleMessage(188+      {189+        type: "GET_ENTRY_FOR_EDIT",190+        payload: { id: entry.id, explicitSummon: false },191+      },192+      matchingSender,193+    );194+195+    const { ok, data } = result as { ok: boolean; data: { title: string } };196+    expect(ok).toBe(true);197+    expect(data.title).toBe("Same Domain Entry");198+  });199+200+  // T-022e: GET_ENTRY_FOR_EDIT with explicitSummon=true bypasses the domain check.201+  // The explicit summon flag is set only by user-initiated keyboard shortcuts,202+  // never by passive autofill. It allows the edit form to open for entries on203+  // a subdomain (e.g., accounts.google.com for a google.com entry).204+  it("T-022e: GET_ENTRY_FOR_EDIT with explicitSummon=true from cross-domain sender → returns entry", async () => {205+    const entry = await vault.addEntry({206+      type: "login",207+      title: "Explicit Summon Entry",208+      username: "user",209+      password: "pw",210+      url: "https://example.com",211+    });212+213+    const crossDomainSender = {214+      tab: { url: "https://completely-different.example.net/" },215+      url: "https://completely-different.example.net/",216+    } as unknown as chrome.runtime.MessageSender;217+218+    const result = await messages.handleMessage(219+      {220+        type: "GET_ENTRY_FOR_EDIT",221+        payload: { id: entry.id, explicitSummon: true },222+      },223+      crossDomainSender,224+    );225+226+    const { ok, data } = result as { ok: boolean; data: { title: string } };227+    expect(ok).toBe(true);228+    expect(data.title).toBe("Explicit Summon Entry");229+  });230+});

@@ -0,0 +1,230 @@1+// T-015: Ed25519 passkey round-trip2+//3+// Why this test exists: passkey-crypto.ts supports two COSE algorithms:4+//   -7 (ECDSA P-256) and -8 (Ed25519/EdDSA).5+// The Ed25519 path (algorithm -8) is tested separately because:6+//   (a) its COSE structure differs from P-256 (kty=1/OKP vs kty=2/EC2),7+//   (b) its signature output is a flat 64 bytes with no DER conversion, and8+//   (c) crypto.subtle.generateKey("Ed25519") is a newer API that may not be9+//       available in all environments — the test exercises that availability.10+//11+// Tests cover:12+//   1. generatePasskeyKeypair(-8) returns the expected COSE structure.13+//   2. The COSE encoding matches what a relying party would receive.14+//   3. signPasskeyAssertion produces a 64-byte signature.15+//   4. The signature is verifiable against the generated public key.16+//   5. publicKeyJwkToCose and ed25519RawToCose produce the same COSE bytes.17+18+import { beforeAll, describe, expect, it } from "vitest";19+import {20+  base64urlDecode,21+  ed25519RawToCose,22+  generatePasskeyKeypair,23+  publicKeyJwkToCose,24+  signPasskeyAssertion,25+} from "../../background/passkey-crypto";26+27+// ---------------------------------------------------------------------------28+// CBOR decode helpers (minimal — only what we need for assertion)29+// ---------------------------------------------------------------------------30+31+// Decode a CBOR map with integer keys into a Map<number, Uint8Array | number>.32+// Covers only the subset of CBOR used by the passkey COSE key encoding.33+function decodeCoseKeyMap(bytes: Uint8Array): Map<number, Uint8Array | number> {34+  const map = new Map<number, Uint8Array | number>();35+  let pos = 0;36+37+  function readByte(): number {38+    return bytes[pos++]!;39+  }40+41+  function readUint(info: number): number {42+    if (info < 24) return info;43+    if (info === 24) return readByte();44+    if (info === 25) { const v = (readByte() << 8) | readByte(); return v; }45+    throw new Error("CBOR uint too wide for test");46+  }47+48+  function readNegint(info: number): number {49+    return -1 - readUint(info);50+  }51+52+  function readItem(): Uint8Array | number {53+    const initial = readByte();54+    const majorType = initial >> 5;55+    const info = initial & 0x1f;56+    switch (majorType) {57+      case 0: return readUint(info);58+      case 1: return readNegint(info);59+      case 2: {60+        const len = readUint(info);61+        const slice = bytes.slice(pos, pos + len);62+        pos += len;63+        return slice;64+      }65+      default:66+        throw new Error(`Unsupported CBOR major type ${majorType} in test decoder`);67+    }68+  }69+70+  const initial = readByte();71+  const majorType = initial >> 5;72+  const count = initial & 0x1f; // works for maps <= 23 entries73+  if (majorType !== 5) throw new Error("Expected CBOR map");74+75+  for (let i = 0; i < count; i++) {76+    const key = readItem() as number;77+    const value = readItem();78+    map.set(key, value);79+  }80+  return map;81+}82+83+// ---------------------------------------------------------------------------84+// Test state85+// ---------------------------------------------------------------------------86+87+let keypair: {88+  publicKeyCose: Uint8Array;89+  publicKeySpki: Uint8Array;90+  privateKeyJwk: JsonWebKey;91+};92+93+describe("T-015: Ed25519 passkey key generation and COSE encoding", () => {94+  beforeAll(async () => {95+    keypair = await generatePasskeyKeypair(-8);96+  });97+98+  // T-015a: Ed25519 keypair generates without error and returns all three99+  // required fields. This checks that crypto.subtle.generateKey("Ed25519")100+  // works in the test environment.101+  it("T-015a: generatePasskeyKeypair(-8) returns publicKeyCose, publicKeySpki, privateKeyJwk", () => {102+    expect(keypair.publicKeyCose).toBeInstanceOf(Uint8Array);103+    expect(keypair.publicKeySpki).toBeInstanceOf(Uint8Array);104+    expect(typeof keypair.privateKeyJwk).toBe("object");105+    expect(keypair.publicKeyCose.length).toBeGreaterThan(0);106+    expect(keypair.publicKeySpki.length).toBeGreaterThan(0);107+  });108+109+  // T-015b: COSE key has the correct Ed25519 structure.110+  // Per COSE Key Structure (RFC 8152 §13.2) for Ed25519:111+  //   kty (1) = 1  (OKP)112+  //   alg (3) = -8 (EdDSA)113+  //   crv (-1) = 6 (Ed25519)114+  //   x (-2) = 32-byte raw public key115+  //116+  // Bug this catches: using the P-256 COSE template (kty=2, crv=1) for Ed25519117+  // would produce a COSE key that a relying party rejects outright.118+  it("T-015b: COSE key structure matches Ed25519 COSE map (kty=1, alg=-8, crv=6, x=32 bytes)", () => {119+    const map = decodeCoseKeyMap(keypair.publicKeyCose);120+    expect(map.get(1)).toBe(1);   // kty = OKP121+    expect(map.get(3)).toBe(-8);  // alg = EdDSA122+    expect(map.get(-1)).toBe(6);  // crv = Ed25519123+    const x = map.get(-2);124+    expect(x).toBeInstanceOf(Uint8Array);125+    expect((x as Uint8Array).length).toBe(32);126+  });127+128+  // T-015c: publicKeyJwkToCose and ed25519RawToCose produce the same COSE bytes129+  // for the same public key. They take different inputs (JWK vs raw bytes) but130+  // must produce identical output — they are two paths to the same encoding.131+  //132+  // Bug this catches: divergent encoding in one of the two functions causes a133+  // mismatch between a key generated at create-time (JWK path) and a key134+  // re-encoded for assertion verification (raw SPKI path).135+  it("T-015c: publicKeyJwkToCose and ed25519RawToCose produce identical COSE bytes", () => {136+    const fromJwk = publicKeyJwkToCose(keypair.privateKeyJwk, -8);137+    // The JWK 'x' field is the base64url-encoded raw public key.138+    const rawPub = base64urlDecode(keypair.privateKeyJwk.x!);139+    const fromRaw = ed25519RawToCose(rawPub);140+141+    expect(fromJwk).toEqual(fromRaw);142+  });143+144+  // T-015d: ed25519RawToCose rejects keys that are not exactly 32 bytes.145+  // The check guards against passing a SPKI-wrapped key (which is longer)146+  // or a truncated raw key.147+  it("T-015d: ed25519RawToCose throws on non-32-byte input", () => {148+    expect(() => ed25519RawToCose(new Uint8Array(31))).toThrow(/invalid/i);149+    expect(() => ed25519RawToCose(new Uint8Array(33))).toThrow(/invalid/i);150+    expect(() => ed25519RawToCose(new Uint8Array(64))).toThrow(/invalid/i);151+  });152+});153+154+describe("T-015: Ed25519 passkey signature round-trip", () => {155+  beforeAll(async () => {156+    keypair = await generatePasskeyKeypair(-8);157+  });158+159+  // T-015e: signPasskeyAssertion(-8) returns a 64-byte signature.160+  // Ed25519 signatures are always exactly 64 bytes — no DER wrapping.161+  // Bug this catches: using the ECDSA path (which applies p1363ToDer and162+  // returns a variable-length DER signature) for Ed25519 produces a signature163+  // the relying party can't verify.164+  it("T-015e: signPasskeyAssertion with Ed25519 returns a 64-byte signature", async () => {165+    const authData = new Uint8Array(37).fill(0xaa);166+    const clientDataHash = new Uint8Array(32).fill(0xbb);167+    const sig = await signPasskeyAssertion(keypair.privateKeyJwk, -8, authData, clientDataHash);168+    expect(sig).toBeInstanceOf(Uint8Array);169+    expect(sig.length).toBe(64);170+  });171+172+  // T-015f: The produced signature verifies against the generated public key.173+  // This end-to-end check ensures generatePasskeyKeypair and signPasskeyAssertion174+  // use the SAME underlying key material — a mis-keyed sign/verify pair would175+  // produce a signature that always fails verification.176+  it("T-015f: Ed25519 signature verifies against the generated public key", async () => {177+    const authData = new Uint8Array(37).fill(0xcc);178+    const clientDataHash = new Uint8Array(32).fill(0xdd);179+    const sig = await signPasskeyAssertion(keypair.privateKeyJwk, -8, authData, clientDataHash);180+181+    // Reconstruct the public key for verification from the JWK 'x' coordinate.182+    const rawPub = base64urlDecode(keypair.privateKeyJwk.x!);183+    const pubKey = await crypto.subtle.importKey(184+      "raw",185+      rawPub,186+      { name: "Ed25519" },187+      false,188+      ["verify"],189+    );190+191+    // The signInput in signPasskeyAssertion is concat(authData, clientDataHash).192+    const signInput = new Uint8Array(authData.length + clientDataHash.length);193+    signInput.set(authData, 0);194+    signInput.set(clientDataHash, authData.length);195+196+    const valid = await crypto.subtle.verify("Ed25519", pubKey, sig, signInput);197+    expect(valid).toBe(true);198+  });199+200+  // T-015g: A signature produced for one payload does not verify against a201+  // different payload. This checks that signPasskeyAssertion actually commits202+  // to the clientDataHash (the nonce the RP chose for this assertion).203+  //204+  // Bug this catches: signing a fixed/constant value instead of the actual205+  // signInput (concat(authData, clientDataHash)) would cause signatures to206+  // be replay-attackable across different RP challenges.207+  it("T-015g: signature does not verify against a different clientDataHash (replay check)", async () => {208+    const authData = new Uint8Array(37).fill(0xee);209+    const clientDataHash = new Uint8Array(32).fill(0xff);210+    const sig = await signPasskeyAssertion(keypair.privateKeyJwk, -8, authData, clientDataHash);211+212+    const rawPub = base64urlDecode(keypair.privateKeyJwk.x!);213+    const pubKey = await crypto.subtle.importKey(214+      "raw",215+      rawPub,216+      { name: "Ed25519" },217+      false,218+      ["verify"],219+    );220+221+    // Same authData, different clientDataHash (different RP challenge)222+    const differentClientDataHash = new Uint8Array(32).fill(0x01);223+    const wrongSignInput = new Uint8Array(authData.length + differentClientDataHash.length);224+    wrongSignInput.set(authData, 0);225+    wrongSignInput.set(differentClientDataHash, authData.length);226+227+    const valid = await crypto.subtle.verify("Ed25519", pubKey, sig, wrongSignInput);228+    expect(valid).toBe(false);229+  });230+});