VM 복귀 후 예약턴 잠금 복구와 Windows 부팅 식별자 확인을 추가한다

tools/host-recovery/windows-boot-agent.test.mjs

@@ -0,0 +1,42 @@
+import { after, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { once } from 'node:events';
+import { bootIdentity, createBootIdentityServer } from './windows-boot-agent.mjs';
+
+test('agent restart preserves OS boot identity; a new OS boot changes it', () => {
+    assert.equal(bootIdentity('HOST', '638985120000000000'), bootIdentity('host', '638985120000000000'));
+    assert.notEqual(bootIdentity('HOST', '638985120000000000'), bootIdentity('HOST', '638985120000000001'));
+    assert.throws(() => bootIdentity('HOST', 'invalid'));
+});
+
+test('HTTP transport rejects anonymous requests and signs the current challenge and boot identity', async () => {
+    const key = randomBytes(32);
+    let bootId = 'a'.repeat(64);
+    const server = createBootIdentityServer({ key, getBootId: () => bootId });
+    server.listen(0, '127.0.0.1');
+    await once(server, 'listening');
+    const url = `http://127.0.0.1:${server.address().port}/v1/boot-id`;
+    after(
+        () =>
+            new Promise((resolve) => {
+                server.close(resolve);
+                server.closeAllConnections();
+            })
+    );
+    assert.equal((await fetch(url)).status, 401);
+    assert.equal((await fetch(`${url}?bypass=1`)).status, 404);
+    const challenge = randomBytes(32).toString('hex');
+    const signature = createHmac('sha256', key).update(`sammo-host-boot-request-v1\n${challenge}`).digest('hex');
+    const headers = { 'x-sammo-challenge': challenge, 'x-sammo-signature': signature };
+    const response = await fetch(url, { headers });
+    assert.equal(response.status, 200);
+    assert.equal(response.headers.get('cache-control'), 'no-store');
+    const body = await response.json();
+    assert.equal(body.challenge, challenge);
+    const expected = createHmac('sha256', key).update(`sammo-host-boot-response-v1\n${challenge}\n${bootId}`).digest();
+    assert.ok(timingSafeEqual(expected, Buffer.from(body.signature, 'hex')));
+    bootId = 'b'.repeat(64);
+    assert.equal((await (await fetch(url, { headers })).json()).bootId, bootId);
+    assert.equal((await fetch(url, { headers: { ...headers, 'x-sammo-signature': '0'.repeat(64) } })).status, 401);
+});