Protocol: freeze device proof and browser CSRF contracts

tools/native_conformance.rs

@@ -129,6 +129,20 @@ fn evaluate(version: &str, kind: &str, input: &str) -> &'static str {
     }
 }
 
+fn evaluate_device_proof(input: &str) -> String {
+    let values = values(input);
+    let server_id = decode_hex(values.get("server_id").map(String::as_str).unwrap_or_default()).expect("server fixture hex");
+    let principal_id = decode_hex(values.get("principal_id").map(String::as_str).unwrap_or_default()).expect("principal fixture hex");
+    let device_id = decode_hex(values.get("device_id").map(String::as_str).unwrap_or_default()).expect("device fixture hex");
+    let challenge = decode_hex(values.get("challenge").map(String::as_str).unwrap_or_default()).expect("challenge fixture hex");
+    let expiry = values.get("expiry_unix_ms").expect("expiry fixture").parse::<i64>().expect("expiry integer");
+    device_registration_proof_transcript(&server_id, &principal_id, &device_id, &challenge, expiry)
+        .expect("valid device proof fixture")
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+
 fn classify_gateway_input(encoded: &str) -> &'static str {
     let raw = match decode_hex(encoded) {
         Some(raw) => raw,
@@ -333,7 +347,11 @@ fn main() {
         for line in lines {
             let fields: Vec<&str> = line.split('\t').collect();
             assert_eq!(fields.len(), 5);
-            let actual = evaluate(fields[1], fields[2], fields[3]);
+            let actual = if fields[2] == "device_proof_transcript" {
+                evaluate_device_proof(fields[3])
+            } else {
+                evaluate(fields[1], fields[2], fields[3]).to_owned()
+            };
             assert_eq!(actual, fields[4], "{}", fields[0]);
             results.push(format!("{}\t{}", fields[0], actual));
         }