bindings/boxes_hash_validator_test.cc

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#include "bindings/boxes_hash_validator.h"

#include <string>

#include "absl/log/log.h"
#include "absl/status/status.h"
#include "absl/strings/str_format.h"
#include "absl/strings/string_view.h"
#include "constants/status_codes.h"
#include "gmock/gmock.h"
#include "google/protobuf/util/message_differencer.h"
#include "gtest/gtest.h"
#include "proto/boxes_hash_assertion.pb.h"
#include "proto/validation_status.pb.h"
#include "testing/proto_test_utils.h"
#include "testing/test_status_tracker.h"

namespace credentio {
namespace {

using ::credentio_testing::ParseTextProtoOrDie;

struct ExpectedValues {
  absl::Status status;
  ValidationStatusSet validation;
};

// Matcher for ValidationStatusSet that ignores the `url` field.
MATCHER_P(EqualsValidationStatusSetIgnoringUrl, expected, "") {
  google::protobuf::util::MessageDifferencer differencer;
  differencer.IgnoreField(
      ValidationStatus::descriptor()->FindFieldByName("url"));
  return differencer.Compare(arg, expected);
}

struct BoxesHashValidatorTestParams {
  std::string name;
  BoxesHashAssertion assertion;
  ExpectedValues expected;
};

ExpectedValues CreateStatusSet(bool has_additional_exclusions = false) {
  ExpectedValues expected;

  expected.status = absl::OkStatus();

  if (has_additional_exclusions) {
    expected.validation.add_informationals()->set_code(absl::StrFormat(
        "%v", InformationalStatusCode::
                  kAssertionBoxesHashAdditionalExclusionsPresent));
  }
  return expected;
}

ExpectedValues CreateStatusSet(FailureStatusCode failure_code,
                               absl::string_view explanation,
                               bool has_additional_exclusions = false) {
  ExpectedValues expected;

  ValidationStatus* failure = expected.validation.add_failures();
  failure->set_code(absl::StrFormat("%v", failure_code));
  failure->set_explanation(explanation);

  expected.status = absl::InvalidArgumentError(explanation);

  if (has_additional_exclusions) {
    expected.validation.add_informationals()->set_code(absl::StrFormat(
        "%v", InformationalStatusCode::
                  kAssertionBoxesHashAdditionalExclusionsPresent));
  }
  return expected;
}

using BoxesHashValidatorTest =
    testing::TestWithParam<BoxesHashValidatorTestParams>;

TEST_P(BoxesHashValidatorTest, Validate) {
  TestStatusTracker tracker;
  BoxesHashValidator validator(GetParam().assertion, "test_uri", "", tracker);
  EXPECT_EQ(validator.Validate(), GetParam().expected.status);
  EXPECT_THAT(tracker.GetStatusSet(), EqualsValidationStatusSetIgnoringUrl(
                                          GetParam().expected.validation));
}

INSTANTIATE_TEST_SUITE_P(
    BoxesHashValidatorTest, BoxesHashValidatorTest,
    testing::ValuesIn<BoxesHashValidatorTestParams>({
        {
            .name = "empty_assertion",
            .assertion = BoxesHashAssertion(),
            .expected =
                CreateStatusSet(FailureStatusCode::kAssertionBoxesHashMalformed,
                                "box-map.boxes is empty"),
        },
        {
            .name = "empty_names",
            .assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
              boxes { hash: "hash" }
            )pb"),
            .expected =
                CreateStatusSet(FailureStatusCode::kAssertionBoxesHashMalformed,
                                "box-map.names is empty"),
        },
        {
            .name = "empty_hash",
            .assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
              boxes { names: "box1" }
            )pb"),
            .expected =
                CreateStatusSet(FailureStatusCode::kAssertionBoxesHashMismatch,
                                "box-map.hash is empty"),
        },
        {
            .name = "no_algo",
            .assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
              boxes { names: "box1" hash: "hash" }
            )pb"),
            .expected =
                CreateStatusSet(FailureStatusCode::kAlgorithmUnsupported,
                                "Algorithm not supported: "),
        },
        {
            .name = "bad_algo_box_map",
            .assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
              boxes { names: "box1" hash: "hash" alg: "bad_algo" }
            )pb"),
            .expected =
                CreateStatusSet(FailureStatusCode::kAlgorithmUnsupported,
                                "Algorithm not supported: bad_algo"),
        },
        {
            .name = "bad_algo_assertion",
            .assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
              boxes { names: "box1" hash: "hash" }
              alg: "bad_algo"
            )pb"),
            .expected =
                CreateStatusSet(FailureStatusCode::kAlgorithmUnsupported,
                                "Algorithm not supported: bad_algo"),
        },
        {
            .name = "c2pa_not_only_box",
            .assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
              boxes { names: "box1" names: "C2PA" hash: "hash" }
              alg: "sha256"
            )pb"),
            .expected = CreateStatusSet(
                FailureStatusCode::kAssertionBoxesHashMalformed,
                "C2PA box must be the only name in the names array"),
        },
        {
            .name = "c2pa_not_zero_byte_hash",
            .assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
              boxes { names: "C2PA" hash: "hash" }
              alg: "sha256"
            )pb"),
            .expected =
                CreateStatusSet(FailureStatusCode::kAssertionBoxesHashMismatch,
                                "C2PA box hash is not a single 0 byte"),
        },
        {
            .name = "only_c2pa_excluded",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes { names: "box1" hash: "hash" }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(),
        },
        {
            .name = "box_1_excluded",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes { names: "box1" hash: "hash", excluded: true }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(/*has_additional_exclusions=*/true),
        },
        {
            .name = "single_box_exclusion_ranges_out_of_order",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  hash: "hash",
                  exclusions { start: 100 length: 100 }
                  exclusions { start: 10 length: 50 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(
                FailureStatusCode::kAssertionBoxesHashMalformed,
                "box-map.start is overlapping with the last box-map.start"),
        },
        {
            .name = "single_box_exclusion_ranges_overlapping",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  hash: "hash",
                  exclusions { start: 100 length: 100 }
                  exclusions { start: 150 length: 100 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(
                FailureStatusCode::kAssertionBoxesHashMalformed,
                "box-map.start is overlapping with the last box-map.start"),
        },
        {
            .name = "two_boxes_exclusion_ranges_missing_box_index",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  names: "box2"
                  hash: "hash",
                  exclusions { start: 100 length: 100 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(
                FailureStatusCode::kAssertionBoxesHashMalformed,
                "box-map.boxIndex is required when there is more than one box"),
        },
        {
            .name = "two_boxes_exclusion_ranges_out_of_range",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  names: "box2"
                  hash: "hash",
                  exclusions { start: 100 length: 100 box_index: 2 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected =
                CreateStatusSet(FailureStatusCode::kAssertionBoxesHashMalformed,
                                "box-map.boxIndex is out of range"),
        },
        {
            .name = "two_boxes_exclusion_ranges_negative_box_index",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  names: "box2"
                  hash: "hash",
                  exclusions { start: 100 length: 100 box_index: -1 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected =
                CreateStatusSet(FailureStatusCode::kAssertionBoxesHashMalformed,
                                "box-map.boxIndex is out of range"),
        },
        {
            .name = "two_boxes_exclusion_ranges_box_index_not_in_order",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  names: "box2"
                  hash: "hash",
                  exclusions { start: 100 length: 100 box_index: 1 }
                  exclusions { start: 100 length: 100 box_index: 0 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected =
                CreateStatusSet(FailureStatusCode::kAssertionBoxesHashMalformed,
                                "box-map.boxIndex is not in order"),
        },
        {
            .name = "two_boxes_exclusion_ranges_box_index_in_order",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  names: "box2"
                  hash: "hash"
                  exclusions { start: 100 length: 100 box_index: 0 }
                  exclusions { start: 100 length: 100 box_index: 1 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(/*has_additional_exclusions=*/true),
        },
        {
            .name = "one_box_exclusion_ranges_valid",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  hash: "hash",
                  exclusions { start: 10 length: 10 }
                  exclusions { start: 30 length: 10 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(/*has_additional_exclusions=*/true),
        },
        {
            .name = "negative_exclusion_start",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  hash: "hash",
                  exclusions { start: -10 length: 10 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(
                FailureStatusCode::kAssertionBoxesHashMalformed,
                "box-map.start and box-map.length must be non-negative"),
        },
        {
            .name = "negative_exclusion_length",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  hash: "hash",
                  exclusions { start: 10 length: -10 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected = CreateStatusSet(
                FailureStatusCode::kAssertionBoxesHashMalformed,
                "box-map.start and box-map.length must be non-negative"),
        },
        {
            .name = "exclusion_range_overflow",
            .assertion = []() -> BoxesHashAssertion {
              auto assertion = ParseTextProtoOrDie<BoxesHashAssertion>(R"pb(
                boxes {
                  names: "box1"
                  hash: "hash",
                  exclusions { start: 9223372036854775800 length: 100 }
                }
                boxes { names: "C2PA" hash: "" }
                alg: "sha256"
              )pb");
              assertion.mutable_boxes(1)->set_hash(std::string("\0", 1));
              return assertion;
            }(),
            .expected =
                CreateStatusSet(FailureStatusCode::kAssertionBoxesHashMalformed,
                                "box-map.start + box-map.length overflows"),
        },
    }),
    [](const testing::TestParamInfo<BoxesHashValidatorTestParams>& info) {
      return info.param.name;
    });

}  // namespace
}  // namespace credentio