Add comprehensive testing documentation and smoke test script - #6
Merged
Conversation
The claim-signer's README covers running it and the enrolment runbook covers
getting a certificate, but nothing said how to establish that a given
deployment actually works — that this service, on this host, with this
certificate, produces credentials someone else's validator accepts.
services/claim-signer/TESTING.md is that procedure, in two parts: a local run
on the test PKI, and a production one on an SSL.com credential. It records the
answers each check is allowed to give, including the two validator results that
look like failures and are not, and it ends in a symptom-to-cause table.
Three things it documents were found by running the path rather than reading it:
- The service serves no CORS headers and answers 405 to a preflight, so a
page cannot call it cross-origin. This affects local development as much as
deployment, since :5173 calling :8443 is cross-origin too. The dev server
now proxies /signer/* to the service instead.
- Any proxy in front of it must strip its path prefix. The Edge computes its
request MAC over the literal path /v1/sign and the service recomputes it
over the path it receives, so an unstripped prefix refuses every signature
while /v1/identity keeps working.
- SSL.com's C2PA ECC endpoint answers unauthenticated and grants tokens under
the C2PA policy OID, which makes it usable as a test target before any
certificate exists. Its AIA names a staging authority whose intermediate is
not on the official C2PA TSA Trust List, so tokens from it validate as
timestamp.untrusted; the production endpoint has to come from the account.
scripts/smoke-test.sh exercises a running service — the public endpoints, one
authenticated signature, and the refusals: replayed nonce, stale timestamp,
unknown key id. Signing by hand needs an HMAC over the request, so testing
/v1/sign was otherwise not something a person could do with curl. The same
invocation works against localhost and production.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168skCigxtfbBu6Lwx68AjS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds comprehensive testing documentation and a smoke test script for the claim-signer service, along with configuration updates to support local development and testing workflows.
Key Changes
Added
services/claim-signer/TESTING.md: Comprehensive testing guide covering three layers of testing:Added
services/claim-signer/scripts/smoke-test.sh: Black-box test script that exercises a running claim-signer service:/healthz,/v1/identity)Updated
apps/editor/vite.config.ts: Added development proxy configuration:/signer/*requests to the claim-signer service/signerprefix (required for correct HMAC computation)Updated
README.md:claim-signer.jsonshould use/signerURL instead of directhttp://localhost:8443Updated
services/claim-signer/README.md: Added reference to comprehensiveTESTING.mddocumentationUpdated
.gitignore: Addedapps/editor/public/claim-signer.jsonto prevent committing development secretsUpdated
conformance/enrolment-runbook.md: Added cross-reference to full testing proceduresNotable Implementation Details
auth.rsand the editor's signer implementationhttps://claude.ai/code/session_0168skCigxtfbBu6Lwx68AjS