87 lines
2.9 KiB
Python
87 lines
2.9 KiB
Python
# ============================================================
|
||
# 完整 Merkle 树黄金测试（plan.md §3.6 / 矩阵「全审计」剩余项）
|
||
# 覆盖：确定性、顺序/数量/内容敏感、成员证明校验、篡改检测、导出携带根。
|
||
# ============================================================
|
||
from __future__ import annotations
|
||
|
||
import copy
|
||
import hashlib
|
||
import json
|
||
|
||
from server.agent_core.audit_export import export_events
|
||
from server.agent_core.audit_ledger import GENESIS_ROOT
|
||
from server.agent_core.audit_merkle import (
|
||
_leaf_hash,
|
||
merkle_proof,
|
||
merkle_root,
|
||
verify_proof,
|
||
)
|
||
|
||
|
||
def _events(n: int = 5) -> list[dict]:
|
||
out: list[dict] = []
|
||
prev = "GENESIS"
|
||
for i in range(n):
|
||
ev = {"id": i + 1, "action": f"action-{i}", "prevHash": prev}
|
||
prev = hashlib.sha256((prev + json.dumps(ev, sort_keys=True)).encode()).hexdigest()
|
||
ev["hash"] = prev
|
||
out.append(ev)
|
||
return out
|
||
|
||
|
||
def test_merkle_root_deterministic_and_sensitive():
|
||
"""Merkle 根：同事件同根；空树=创世根；顺序/数量/内容变化均断根。"""
|
||
evs = _events()
|
||
assert merkle_root(evs) == merkle_root(evs)
|
||
assert merkle_root([]) == GENESIS_ROOT
|
||
assert merkle_root(evs) != merkle_root(list(reversed(evs)))
|
||
assert merkle_root(evs) != merkle_root(evs[:-1])
|
||
tampered = copy.deepcopy(evs)
|
||
tampered[2]["hash"] = "0" * 64
|
||
assert merkle_root(evs) != merkle_root(tampered)
|
||
|
||
|
||
def test_merkle_proof_every_index_verifies():
|
||
"""成员证明：每个事件都能给出 O(log n) proof 且 verify_proof 通过。"""
|
||
evs = _events(8)
|
||
root = merkle_root(evs)
|
||
for i in range(len(evs)):
|
||
proof = merkle_proof(evs, i)
|
||
assert proof["root"] == root
|
||
assert verify_proof(root, _leaf_hash(evs[i]), proof) is True
|
||
# sibling 数应等于树高（8 叶 → 3 层）
|
||
assert len(proof["siblings"]) >= 2
|
||
|
||
|
||
def test_merkle_proof_rejects_wrong_leaf():
|
||
"""错误叶子无法通过证明校验（防伪造成员）。"""
|
||
evs = _events(6)
|
||
root = merkle_root(evs)
|
||
proof = merkle_proof(evs, 1)
|
||
other_leaf = _leaf_hash(evs[4])
|
||
assert verify_proof(root, other_leaf, proof) is False
|
||
|
||
|
||
def test_merkle_proof_out_of_range():
|
||
"""越界索引返回错误，不抛异常。"""
|
||
evs = _events(3)
|
||
assert merkle_proof(evs, -1)["error"]
|
||
assert merkle_proof(evs, 99)["error"]
|
||
|
||
|
||
def test_merkle_single_and_empty():
|
||
"""单事件/空事件边界：根互异且可复算。"""
|
||
one = _events(1)
|
||
root1 = merkle_root(one)
|
||
assert root1 != GENESIS_ROOT
|
||
assert merkle_root(_events(1)) == root1
|
||
proof = merkle_proof(one, 0)
|
||
assert verify_proof(root1, _leaf_hash(one[0]), proof) is True
|
||
|
||
|
||
def test_export_json_carries_merkle_root():
|
||
"""合规导出 JSON 携带 merkleRoot，且与本地复算一致。"""
|
||
evs = _events(4)
|
||
payload = json.loads(export_events(evs, fmt="json"))
|
||
assert payload["merkleRoot"] == merkle_root(evs)
|