1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
use std::time::Duration;
use atproto_identity::key::{KeyData, KeyType, to_public};
use atproto_identity::model::Document;
use atproto_identity::traits::IdentityResolver;
use atproto_xrpcs::{ServiceAuthPolicy, mint_service_auth, verify_service_auth};
use axum::body::Body;
use axum::http::{Request, StatusCode};
use http_body_util::BodyExt;
use tower::ServiceExt;
use zkwid_h::{Host, run_stage, seed, stage_bytes};
const DID: &str = "did:web:h.zkwid.test";
#[test]
fn stages_build_deterministically() {
for name in ["shim", "stage2"] {
let a = stage_bytes(name).unwrap();
let b = stage_bytes(name).unwrap();
assert!(a.starts_with(b"\0asm"));
assert_eq!(a, b);
}
}
#[test]
fn shim_derives_public_key() {
let shim = stage_bytes("shim").unwrap();
let seed = seed();
let key = run_stage(&shim, &seed).unwrap();
let expected = to_public(&KeyData::new(KeyType::K256Private, seed.to_vec())).unwrap();
assert_eq!(key.len(), 33);
assert_eq!(key, expected.bytes());
}
#[test]
fn shim_traps_on_bad_input() {
let shim = stage_bytes("shim").unwrap();
assert!(run_stage(&shim, &[1; 31]).is_err());
assert!(run_stage(&shim, &[0; 32]).is_err());
}
#[test]
fn stage2_emits_demo_log() {
let stage2 = stage_bytes("stage2").unwrap();
let out = run_stage(
&stage2,
br#"{"instance":"run-1","createdAt":"2026-11-05T00:00:00.000Z"}"#,
)
.unwrap();
assert_eq!(
String::from_utf8(out).unwrap(),
r#"{"$type":"at.zkwid.demo.log","text":"hello from run-1","createdAt":"2026-11-05T00:00:00.000Z"}"#
);
let out = run_stage(&stage2, br#"{ "createdAt" : "t", "instance" : "i" }"#).unwrap();
assert_eq!(
out,
br#"{"$type":"at.zkwid.demo.log","text":"hello from i","createdAt":"t"}"#
);
assert!(run_stage(&stage2, br#"{"instance":"i"}"#).is_err());
assert!(run_stage(&stage2, &vec![b' '; 4097]).is_err());
}
struct Fixed(Document);
#[async_trait::async_trait]
impl IdentityResolver for Fixed {
async fn resolve(&self, subject: &str) -> anyhow::Result<Document> {
anyhow::ensure!(subject == self.0.id, "unknown {subject}");
Ok(self.0.clone())
}
}
#[tokio::test]
async fn did_document_serves_host_key() {
let host = Host::new(
DID,
"https://h.zkwid.test",
"https://zkwid.test",
"did:web:zkwid.test",
reqwest::Client::new(),
)
.unwrap();
let response = host
.router()
.oneshot(
Request::get("/.well-known/did.json")
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();
assert_eq!(response.status(), StatusCode::OK);
let body = response.into_body().collect().await.unwrap().to_bytes();
let doc: Document = serde_json::from_slice(&body).unwrap();
assert_eq!(doc.id, DID);
let public = to_public(&host.signing_key).unwrap().to_string();
assert_eq!(
doc.verification_method_multibase("atproto"),
public.strip_prefix("did:key:")
);
let aud = "did:web:zkwid.test#zkwid";
let token = mint_service_auth(
&host.signing_key,
DID,
aud,
"at.zkwid.createKey",
Duration::from_secs(60),
)
.unwrap();
let claims = verify_service_auth(
&token,
&Fixed(doc),
&ServiceAuthPolicy::new("at.zkwid.createKey", aud),
None,
)
.await
.unwrap();
assert_eq!(claims.iss, DID);
}
