feat(round-11): 弱网离线队列/跨国会议一键预约/团队多语言名片批量向导/NFC硬件出厂封印 (83套件984测试全绿)

backend/test/modules/nfc/anti-tamper-replay.test.ts

@@ -0,0 +1,106 @@
+import {
+  NfcAntiTamperService,
+  generateCardOfflineSeal,
+  verifyCardOfflineSeal,
+  OfflineCardPayload,
+  verifyOfflineCardPayload,
+} from '../../../src/modules/nfc/service/anti-tamper';
+
+describe('Point 44: NFC 实体卡离线数字防伪防篡改签章与硬件出厂封印', () => {
+  let service: NfcAntiTamperService;
+  const mockUid = '04A1B2C3D4E5F6';
+  const mockCardId = 2002;
+  const mockSecret = 'nfc-secret-key-gitex-2026-dubai-omnicard';
+  const mockFactoryKey = 'factory-master-key-secure-hardware-seal';
+  const mockBatchNo = 'BATCH-202609-UAE-001';
+
+  beforeEach(() => {
+    service = new NfcAntiTamperService();
+  });
+
+  describe('1. 硬件物理出厂封印 (generateCardOfflineSeal & verifyCardOfflineSeal)', () => {
+    it('应基于 UID、批次号与工厂母密钥生成不可逆 SHA-256 硬件封印哈希', () => {
+      const seal = generateCardOfflineSeal(mockUid, mockBatchNo, mockFactoryKey);
+      expect(typeof seal).toBe('string');
+      expect(seal).toHaveLength(64);
+      expect(/^[0-9a-f]{64}$/i.test(seal)).toBe(true);
+
+      // 验证封印通过
+      const isSealValid = verifyCardOfflineSeal(mockUid, mockBatchNo, seal, mockFactoryKey);
+      expect(isSealValid).toBe(true);
+    });
+
+    it('篡改 UID、批次号或封印哈希时应严密拒绝', () => {
+      const seal = generateCardOfflineSeal(mockUid, mockBatchNo, mockFactoryKey);
+
+      // 篡改 UID
+      expect(verifyCardOfflineSeal('04FFFFFFFFFFFF', mockBatchNo, seal, mockFactoryKey)).toBe(false);
+      // 篡改批次号
+      expect(verifyCardOfflineSeal(mockUid, 'BATCH-FAKED', seal, mockFactoryKey)).toBe(false);
+      // 篡改签名封印
+      expect(verifyCardOfflineSeal(mockUid, mockBatchNo, seal.replace('a', 'b'), mockFactoryKey)).toBe(false);
+    });
+
+    it('参数缺失时抛出明确保护异常', () => {
+      expect(() => generateCardOfflineSeal('', mockBatchNo, mockFactoryKey)).toThrow();
+      expect(() => generateCardOfflineSeal(mockUid, '', mockFactoryKey)).toThrow();
+      expect(() => generateCardOfflineSeal(mockUid, mockBatchNo, '')).toThrow();
+    });
+  });
+
+  describe('2. 离线碰一碰数据包快速验签 (verifyOfflineCardPayload)', () => {
+    it('合法离线数据包在无网络状态下应成功通过验签', () => {
+      const ts = Date.now();
+      const token = service.generateDeviceToken(mockUid, mockCardId, mockSecret, ts);
+      const seal = generateCardOfflineSeal(mockUid, mockBatchNo, mockFactoryKey);
+
+      const payload: OfflineCardPayload = {
+        uid: mockUid,
+        cardId: mockCardId,
+        batchNo: mockBatchNo,
+        seal,
+        token,
+      };
+
+      const result = verifyOfflineCardPayload(payload, mockSecret, mockFactoryKey);
+      expect(result.valid).toBe(true);
+      expect(result.isAuthenticNfc).toBe(true);
+      expect(result.reason).toBeUndefined();
+    });
+
+    it('离线防伪 Token 伪造时应准确识破', () => {
+      const seal = generateCardOfflineSeal(mockUid, mockBatchNo, mockFactoryKey);
+      const fakePayload: OfflineCardPayload = {
+        uid: mockUid,
+        cardId: mockCardId,
+        batchNo: mockBatchNo,
+        seal,
+        token: `${Date.now()}.0000000000000000000000000000000000000000000000000000000000000000`,
+      };
+
+      const result = verifyOfflineCardPayload(fakePayload, mockSecret, mockFactoryKey);
+      expect(result.valid).toBe(false);
+      expect(result.reason).toMatch(/签名|篡改|invalid/i);
+    });
+  });
+
+  describe('3. 时钟漂移与时序攻击防护 (Clock Drift Tolerance)', () => {
+    it('在合理漂移容差内 (30秒) 允许通过', () => {
+      const futureTs = Date.now() + 15 * 1000; // 稍超前 15 秒 (网络或卡内时钟微偏)
+      const token = service.generateDeviceToken(mockUid, mockCardId, mockSecret, futureTs);
+
+      // 设置 30 秒容差
+      const res = service.verifyDeviceToken(mockUid, mockCardId, token, mockSecret, 300000, 30000);
+      expect(res.valid).toBe(true);
+    });
+
+    it('严重超前于未来时间戳的令牌应被坚决拦截', () => {
+      const futureTs = Date.now() + 120 * 1000; // 超前 2 分钟
+      const token = service.generateDeviceToken(mockUid, mockCardId, mockSecret, futureTs);
+
+      const res = service.verifyDeviceToken(mockUid, mockCardId, token, mockSecret, 300000, 30000);
+      expect(res.valid).toBe(false);
+      expect(res.reason).toMatch(/未来|clock drift/i);
+    });
+  });
+});