feat: complete device onboarding and mobile binding workflows

internal/onboarding/crypto_test.go

@@ -0,0 +1,35 @@
+package onboarding
+
+import (
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+func TestDEVREQ1IndependentVector(t *testing.T) {
+	raw, err := os.ReadFile("../../test/fixtures/onboarding-devreq1.json")
+	must(t, err)
+	var v struct {
+		KeyHex, Method, Path, DeviceID, Nonce, RequestID, Body, Signature string
+		KeyVersion, Timestamp                                             int64
+	}
+	must(t, json.Unmarshal(raw, &v))
+	key, err := hex.DecodeString(v.KeyHex)
+	must(t, err)
+	got := RequestMAC(key, v.Method, v.Path, v.DeviceID, v.KeyVersion, v.Timestamp, v.Nonce, v.RequestID, []byte(v.Body))
+	if got != v.Signature {
+		t.Fatalf("independent vector mismatch: %s", got)
+	}
+	if RequestMAC([]byte(v.KeyHex), v.Method, v.Path, v.DeviceID, v.KeyVersion, v.Timestamp, v.Nonce, v.RequestID, []byte(v.Body)) == v.Signature {
+		t.Fatal("text key accepted as raw key")
+	}
+}
+func TestStrictJSONRejectsAmbiguousBodies(t *testing.T) {
+	for _, raw := range []string{`{"boot_id":"a","boot_id":"b"}`, `{"boot_id":"a","unknown":true}`, `[]`, `{} {}`, "{\"boot_id\":\"\xff\"}"} {
+		var out RegisterInput
+		if StrictJSON([]byte(raw), &out) == nil {
+			t.Fatalf("accepted invalid body %q", raw)
+		}
+	}
+}