sign every write as an MMUR2 claim (POST /api/claims)

test/filename-guard.test.ts

@@ -20,13 +20,17 @@ import * as http from 'http';
 import { promises as fs } from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { verifyClaim } from '../src/meta-core-client.js';
+
+// Fixed test signing key (scalar 0x0101…01) — the plugin signs as this.
+process.env.METAMESH_SIGNING_KEY ??= '01'.repeat(32);
 
 let processFile: typeof import('../src/plugin.js').process;
 let configure: typeof import('../src/plugin.js').configure;
 
 /** Properties the stand-in meta-core currently holds, per cid. */
 let record: Record<string, string>;
-/** Every `PUT /meta/{cid}/{key}` the plugin made, in order. */
+/** Every claim the plugin posted (`POST /api/claims`), in order. */
 let writes: Array<{ key: string; value: string }>;
 
 let server: http.Server;
@@ -69,7 +73,7 @@ beforeAll(async () => {
     // Stand-in meta-core: just enough of the property API for this plugin.
     server = http.createServer((req, res) => {
         const url = new URL(req.url ?? '/', 'http://localhost');
-        const parts = url.pathname.split('/').filter(Boolean); // ['meta', cid, key?]
+        const parts = url.pathname.split('/').filter(Boolean); // ['meta', cid, key?] or ['api', 'claims']
         const key = parts[2];
         if (req.method === 'GET' && key) {
             const value = record[key];
@@ -80,14 +84,18 @@ beforeAll(async () => {
             res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ value }));
             return;
         }
-        if (req.method === 'PUT' && key) {
+        if (req.method === 'POST' && url.pathname === '/api/claims') {
             let body = '';
             req.on('data', (c) => (body += c));
             req.on('end', () => {
-                const value = String(JSON.parse(body || '{}').value ?? '');
-                writes.push({ key, value });
-                record[key] = value;
-                res.writeHead(200, { 'Content-Type': 'application/json' }).end('{}');
+                const claims = JSON.parse(body || '[]') as Array<{ cid: string; uid: string; key: string; value: string; ts: number; sig: string }>;
+                const statuses = claims.map((c) => {
+                    if (!verifyClaim({ ...c, sig: Buffer.from(c.sig, 'base64') })) return { status: 'bad_signature' };
+                    writes.push({ key: c.key, value: String(c.value) });
+                    record[c.key] = String(c.value);
+                    return { status: 'accepted' };
+                });
+                res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify(statuses));
             });
             return;
         }