test(invocation): add command.Covers and subject consistency tests

Also improve the maintainability of the tests by a) providing a set of fixed Personas
and then generating a slew of valid delegation tokens, invalid delegation tokens
and proof-chains thereof.

token/delegation/delegationtest/README.md

@@ -0,0 +1,5 @@
+# delegationtest
+
+See the package documentation for instructions on how to use the generated
+tokens as well as information on how to regenerate the code if changes have
+been made.

token/delegation/delegationtest/doc.go

@@ -0,0 +1,33 @@
+// Package delegationtest provides a set of pre-built delegation tokens
+// for a variety of test cases.
+//
+// For all delegation tokens, the name of the delegation token is the
+// Issuer appended with the Audience.  The tokens are generated so that
+// an invocation can be created for any didtest.Persona.
+//
+// Delegation proof-chain names contain each didtest.Persona name in
+// order starting with the root delegation (which will always be generated
+// by Alice.)  This is opposite of the list of cic.Cids that represent the
+// proof chain.
+//
+// For both the generated delegation tokens granted to Carol's Persona and
+// the proof chains containing Carol's delegations to Dan, if there is no
+// suffix, the proof chain will be deemed valid.  If there is a suffix, it
+// will consist of either the word "Valid" or "Invalid" and the name of the
+// field that has been altered.  Only optional fields will generate proof
+// chains with Valid suffixes.
+//
+// If changes are made to the list of Personas included in the chain, or
+// in the variants that are specified, the generated Go file and delegation
+// tokens stored in the data/ directory should be regenerated by running
+// the following command in this directory:
+//
+//	go test . -update
+//
+// Generated delegation Tokens are stored in the data/ directory and loaded
+// into the DelegationLoader on the first call to GetDelegationLoader.
+// Generated references to these tokens and the tokens themselves are
+// created in the token_gen.go file.  See /token/invocation/invocation_test.go
+// for an example of how these delegation tokens and proof-chains can
+// be used during testing.
+package delegationtest

token/delegation/delegationtest/generator_test.go

@@ -0,0 +1,224 @@
+package delegationtest
+
+import (
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/dave/jennifer/jen"
+	"github.com/ipfs/go-cid"
+	"github.com/libp2p/go-libp2p/core/crypto"
+	"github.com/stretchr/testify/require"
+	"github.com/ucan-wg/go-ucan/did"
+	"github.com/ucan-wg/go-ucan/did/didtest"
+	"github.com/ucan-wg/go-ucan/pkg/command"
+	"github.com/ucan-wg/go-ucan/pkg/policy"
+	"github.com/ucan-wg/go-ucan/pkg/policy/policytest"
+	"github.com/ucan-wg/go-ucan/token/delegation"
+	"gotest.tools/v3/golden"
+)
+
+const (
+	tokenNamePrefix      = "Token"
+	proorChainNamePrefix = "Proof"
+)
+
+var constantNonce = []byte{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b}
+
+// TestUpdate doesn't actually run a test but uses the Go testing library
+// to trigger generation of the delegation tokens and associated Go file.
+func TestUpdate(t *testing.T) {
+	if golden.FlagUpdate() {
+		update(t)
+	}
+}
+
+type newDelegationParams struct {
+	privKey crypto.PrivKey
+	aud     did.DID
+	sub     did.DID
+	cmd     command.Command
+	pol     policy.Policy
+	opts    []delegation.Option
+}
+
+type newDelegationParamsVariant func(*newDelegationParams)
+
+type token struct {
+	name string
+	id   cid.Cid
+}
+
+type proof struct {
+	name string
+	prf  []cid.Cid
+}
+
+type generator struct {
+	dlgs   []token
+	chains []proof
+}
+
+type acc struct {
+	name  string
+	chain []cid.Cid
+}
+
+type variant struct {
+	name    string
+	variant func(*newDelegationParams)
+}
+
+func noopVariant() variant {
+	return variant{
+		name:    "",
+		variant: func(_ *newDelegationParams) {},
+	}
+}
+
+func update(t *testing.T) {
+	t.Helper()
+
+	gen := &generator{}
+	gen.chainPersonas(t, didtest.Personas(t), acc{}, noopVariant())
+	gen.writeGoFile(t)
+}
+
+func (g *generator) chainPersonas(t *testing.T, personas []didtest.Persona, acc acc, vari variant) {
+	t.Helper()
+
+	acc.name += personas[0].Name(t)
+	g.createProofChain(t, acc.name+vari.name, acc.chain)
+
+	if len(personas) < 2 {
+		return
+	}
+
+	name := personas[0].Name(t) + personas[1].Name(t)
+
+	params := newDelegationParams{
+		privKey: personas[0].PrivKey(t),
+		aud:     personas[1].DID(t),
+		cmd:     NominalCommand,
+		pol:     policytest.EmptyPolicy(t),
+		opts: []delegation.Option{
+			delegation.WithSubject(didtest.PersonaAlice.DID(t)),
+			delegation.WithNonce(constantNonce),
+		},
+	}
+
+	// Create each nominal token and continue the chain
+	id := g.createDelegation(t, params, name, vari)
+	acc.chain = append(acc.chain, id)
+	g.chainPersonas(t, personas[1:], acc, vari)
+
+	// If the user is Carol, create variants for each invalid and/or optional
+	// parameter and also continue the chain
+	if personas[0] == didtest.PersonaCarol {
+		variants := []variant{
+			{name: "InvalidExpandedCommand", variant: func(p *newDelegationParams) {
+				p.cmd = ExpandedCommand
+			}},
+			{name: "ValidAttenuatedCommand", variant: func(p *newDelegationParams) {
+				p.cmd = AttenuatedCommand
+			}},
+			{name: "InvalidSubject", variant: func(p *newDelegationParams) {
+				p.opts = append(p.opts, delegation.WithSubject(didtest.PersonaBob.DID(t)))
+			}},
+			{name: "InvalidExpired", variant: func(p *newDelegationParams) {
+				p.opts = append(p.opts, delegation.WithExpiration(time.Now().Add(time.Second)))
+			}},
+			{name: "InvalidInactive", variant: func(p *newDelegationParams) {
+				nbf, err := time.Parse(time.RFC3339, "2070-01-01T00:00:00Z")
+				require.NoError(t, err)
+
+				p.opts = append(p.opts, delegation.WithNotBefore(nbf))
+			}},
+		}
+
+		// Start a branch in the recursion for each of the variants
+		for _, v := range variants {
+			id := g.createDelegation(t, params, name, v)
+
+			// replace the previous Carol token id with the one from the variant
+			acc.chain[len(acc.chain)-1] = id
+			g.chainPersonas(t, personas[1:], acc, v)
+		}
+	}
+}
+
+func (g *generator) createDelegation(t *testing.T, params newDelegationParams, name string, vari variant) cid.Cid {
+	t.Helper()
+
+	vari.variant(&params)
+
+	tkn, err := delegation.New(params.privKey, params.aud, params.cmd, params.pol, params.opts...)
+	require.NoError(t, err)
+
+	data, id, err := tkn.ToSealed(params.privKey)
+	require.NoError(t, err)
+
+	require.NoError(t, os.WriteFile(filepath.Join(tokenDir, tokenNamePrefix+name+vari.name+tokenExt), data, 0o644))
+
+	g.dlgs = append(g.dlgs, token{
+		name: tokenNamePrefix + name + vari.name,
+		id:   id,
+	})
+
+	return id
+}
+
+func (g *generator) createProofChain(t *testing.T, name string, prf []cid.Cid) {
+	t.Helper()
+
+	if len(prf) < 1 {
+		return
+	}
+
+	clone := make([]cid.Cid, len(prf))
+	copy(clone, prf)
+
+	g.chains = append(g.chains, proof{
+		name: proorChainNamePrefix + name,
+		prf:  clone,
+	})
+}
+
+func (g *generator) writeGoFile(t *testing.T) {
+	t.Helper()
+
+	file := jen.NewFile("delegationtest")
+	file.HeaderComment("Code generated by delegationtest - DO NOT EDIT.")
+
+	refs := map[cid.Cid]string{}
+
+	for _, d := range g.dlgs {
+		refs[d.id] = d.name + "CID"
+
+		file.Var().Defs(
+			jen.Id(d.name+"CID").Op("=").Qual("github.com/ipfs/go-cid", "MustParse").Call(jen.Lit(d.id.String())),
+			jen.Id(d.name).Op("=").Id("mustGetDelegation").Call(jen.Id(d.name+"CID")),
+		)
+		file.Line()
+	}
+
+	for _, c := range g.chains {
+		g := jen.CustomFunc(jen.Options{
+			Multi:     true,
+			Separator: ",",
+			Close:     "\n",
+		}, func(g *jen.Group) {
+			slices.Reverse(c.prf)
+			for _, p := range c.prf {
+				g.Id(refs[p])
+			}
+		})
+
+		file.Var().Id(c.name).Op("=").Index().Qual("github.com/ipfs/go-cid", "Cid").Values(g)
+		file.Line()
+	}
+
+	require.NoError(t, file.Save("token_gen.go"))
+}

token/delegation/delegationtest/token.go

@@ -0,0 +1,120 @@
+package delegationtest
+
+import (
+	"embed"
+	"fmt"
+	"path/filepath"
+	"sync"
+
+	"github.com/ipfs/go-cid"
+	"github.com/ucan-wg/go-ucan/pkg/command"
+	"github.com/ucan-wg/go-ucan/token/delegation"
+	"github.com/ucan-wg/go-ucan/token/invocation"
+)
+
+const (
+	tokenDir = "data"
+	tokenExt = ".dagcbor"
+)
+
+var (
+	// ExpandedCommand is the parent of the NominalCommand and represents
+	// the cases where the delegation proof-chain or invocation token tries
+	// to increase the privileges granted by the root delegation token.
+	// Execution of this command is generally prohibited in tests.
+	ExpandedCommand = command.MustParse("/expanded")
+
+	// NominalCommand is the command used for most test tokens and proof-
+	// chains.  Execution of this command is generally allowed in tests.
+	NominalCommand = ExpandedCommand.Join("nominal")
+
+	// AttenuatedCommand is a sub-command of the NominalCommand.  Execution
+	// of this command is generally allowed in tests.
+	AttenuatedCommand = NominalCommand.Join("attenuated")
+)
+
+// ProofEmpty provides an empty proof chain for testing purposes.
+var ProofEmpty = []cid.Cid{}
+
+//go:embed data
+var fs embed.FS
+
+var (
+	once sync.Once
+	ldr  invocation.DelegationLoader
+	err  error
+)
+
+var _ invocation.DelegationLoader = (*delegationLoader)(nil)
+
+type delegationLoader struct {
+	tokens map[cid.Cid]*delegation.Token
+}
+
+// GetDelegationLoader returns a singleton instance of a test
+// DelegationLoader containing all the tokens present in the data/
+// directory.
+func GetDelegationLoader() (invocation.DelegationLoader, error) {
+	once.Do(func() {
+		ldr, err = loadDelegations()
+	})
+
+	return ldr, err
+}
+
+// GetDelegation implements invocation.DelegationLoader.
+func (l *delegationLoader) GetDelegation(id cid.Cid) (*delegation.Token, error) {
+	tkn, ok := l.tokens[id]
+	if !ok {
+		return nil, fmt.Errorf("%w: CID %s", invocation.ErrMissingDelegation, id.String())
+	}
+
+	return tkn, nil
+}
+
+func loadDelegations() (invocation.DelegationLoader, error) {
+	dirEntries, err := fs.ReadDir("data")
+	if err != nil {
+		return nil, err
+	}
+
+	tkns := make(map[cid.Cid]*delegation.Token, len(dirEntries))
+
+	for _, dirEntry := range dirEntries {
+		data, err := fs.ReadFile(filepath.Join(tokenDir, dirEntry.Name()))
+		if err != nil {
+			return nil, err
+		}
+
+		tkn, id, err := delegation.FromSealed(data)
+		if err != nil {
+			return nil, err
+		}
+
+		tkns[id] = tkn
+	}
+
+	return &delegationLoader{
+		tokens: tkns,
+	}, nil
+}
+
+// GetDelegation is a shortcut that gets (or creates) the DelegationLoader
+// and attempts to return the token referenced by the provided CID.
+func GetDelegation(id cid.Cid) (*delegation.Token, error) {
+	ldr, err := GetDelegationLoader()
+	if err != nil {
+		return nil, err
+	}
+
+	return ldr.GetDelegation(id)
+}
+
+func mustGetDelegation(id cid.Cid) *delegation.Token {
+	tkn, err := GetDelegation(id)
+	if err != nil {
+		panic(err)
+	}
+
+	return tkn
+}

token/delegation/delegationtest/token_gen.go

@@ -0,0 +1,240 @@
+// Code generated by delegationtest - DO NOT EDIT.
+
+package delegationtest
+
+import gocid "github.com/ipfs/go-cid"
+
+var (
+	TokenAliceBobCID = gocid.MustParse("bafyreicidrwvmac5lvjypucgityrtjsknojraio7ujjli4r5eyby66wjzm")
+	TokenAliceBob    = mustGetDelegation(TokenAliceBobCID)
+)
+
+var (
+	TokenBobCarolCID = gocid.MustParse("bafyreihxv2uhq43oxllzs2xfvxst7wtvvvl7pohb2chcz6hjvfv2ntea5u")
+	TokenBobCarol    = mustGetDelegation(TokenBobCarolCID)
+)
+
+var (
+	TokenCarolDanCID = gocid.MustParse("bafyreihclsgiroazq3heqdswvj2cafwqbpboicq7immo65scl7ahktpsdq")
+	TokenCarolDan    = mustGetDelegation(TokenCarolDanCID)
+)
+
+var (
+	TokenDanErinCID = gocid.MustParse("bafyreicja6ihewy64p3ake56xukotafjlkh4uqep2qhj52en46zzfwby3e")
+	TokenDanErin    = mustGetDelegation(TokenDanErinCID)
+)
+
+var (
+	TokenErinFrankCID = gocid.MustParse("bafyreicjlx3lobxm6hl5s4htd4ydwkkqeiou6rft4rnvulfdyoew565vka")
+	TokenErinFrank    = mustGetDelegation(TokenErinFrankCID)
+)
+
+var (
+	TokenCarolDanInvalidExpandedCommandCID = gocid.MustParse("bafyreid3m3pk53gqgp5rlzqhvpedbwsqbidqlp4yz64vknwbzj7bxrmsr4")
+	TokenCarolDanInvalidExpandedCommand    = mustGetDelegation(TokenCarolDanInvalidExpandedCommandCID)
+)
+
+var (
+	TokenDanErinInvalidExpandedCommandCID = gocid.MustParse("bafyreifn4sy5onwajx3kqvot5mib6m6xarzrqjozqbzgmzpmc5ox3g2uzm")
+	TokenDanErinInvalidExpandedCommand    = mustGetDelegation(TokenDanErinInvalidExpandedCommandCID)
+)
+
+var (
+	TokenErinFrankInvalidExpandedCommandCID = gocid.MustParse("bafyreidmpgd36jznmq42bs34o4qi3fcbrsh4idkg6ejahudejzwb76fwxe")
+	TokenErinFrankInvalidExpandedCommand    = mustGetDelegation(TokenErinFrankInvalidExpandedCommandCID)
+)
+
+var (
+	TokenCarolDanValidAttenuatedCommandCID = gocid.MustParse("bafyreiekhtm237vyapk3c6voeb5lnz54crebqdqi3x4wn4u4cbrrhzsqfe")
+	TokenCarolDanValidAttenuatedCommand    = mustGetDelegation(TokenCarolDanValidAttenuatedCommandCID)
+)
+
+var (
+	TokenDanErinValidAttenuatedCommandCID = gocid.MustParse("bafyreicrvzqferyy7rgo75l5rn6r2nl7zyeexxjmu3dm4ff7rn2coblj4y")
+	TokenDanErinValidAttenuatedCommand    = mustGetDelegation(TokenDanErinValidAttenuatedCommandCID)
+)
+
+var (
+	TokenErinFrankValidAttenuatedCommandCID = gocid.MustParse("bafyreie6fhspk53kplcc2phla3e7z7fzldlbmmpuwk6nbow5q6s2zjmw2q")
+	TokenErinFrankValidAttenuatedCommand    = mustGetDelegation(TokenErinFrankValidAttenuatedCommandCID)
+)
+
+var (
+	TokenCarolDanInvalidSubjectCID = gocid.MustParse("bafyreifgksz6756if42tnc6rqsnbaa2u3fdrveo7ek44lnj2d64d5sw26u")
+	TokenCarolDanInvalidSubject    = mustGetDelegation(TokenCarolDanInvalidSubjectCID)
+)
+
+var (
+	TokenDanErinInvalidSubjectCID = gocid.MustParse("bafyreibdwew5nypsxrm4fq73wu6hw3lgwwiolj3bi33xdrbgcf3ogm6fty")
+	TokenDanErinInvalidSubject    = mustGetDelegation(TokenDanErinInvalidSubjectCID)
+)
+
+var (
+	TokenErinFrankInvalidSubjectCID = gocid.MustParse("bafyreicr364mj3n7x4iyhcksxypelktcqkkw3ptg7ggxtqegw3p3mr6zc4")
+	TokenErinFrankInvalidSubject    = mustGetDelegation(TokenErinFrankInvalidSubjectCID)
+)
+
+var (
+	TokenCarolDanInvalidExpiredCID = gocid.MustParse("bafyreibgtlioorouqpwr6olk6boc3pprl5tx5xs6zpfnv3pvxtggueofii")
+	TokenCarolDanInvalidExpired    = mustGetDelegation(TokenCarolDanInvalidExpiredCID)
+)
+
+var (
+	TokenDanErinInvalidExpiredCID = gocid.MustParse("bafyreidhq3hjsfrucbecgcjf2nkcgmq3sh3m5gjxz23vzcaynozs5p3uh4")
+	TokenDanErinInvalidExpired    = mustGetDelegation(TokenDanErinInvalidExpiredCID)
+)
+
+var (
+	TokenErinFrankInvalidExpiredCID = gocid.MustParse("bafyreido4om3y3ttkmp4c4gxm6pqug76vu3aekb666vdp6zewpvir5zs7u")
+	TokenErinFrankInvalidExpired    = mustGetDelegation(TokenErinFrankInvalidExpiredCID)
+)
+
+var (
+	TokenCarolDanInvalidInactiveCID = gocid.MustParse("bafyreicea5y2nvlitvxijkupeavtg23i7ktjk3uejnaquguurzptiabk4u")
+	TokenCarolDanInvalidInactive    = mustGetDelegation(TokenCarolDanInvalidInactiveCID)
+)
+
+var (
+	TokenDanErinInvalidInactiveCID = gocid.MustParse("bafyreifsgqzkmxj2vexuts3z766mwcjreiisjg2jykyzf7tbj5sclutpvq")
+	TokenDanErinInvalidInactive    = mustGetDelegation(TokenDanErinInvalidInactiveCID)
+)
+
+var (
+	TokenErinFrankInvalidInactiveCID = gocid.MustParse("bafyreifbfegon24c6dndiqyktahzs65vhyasrygbw7nhsvojn6distsdre")
+	TokenErinFrankInvalidInactive    = mustGetDelegation(TokenErinFrankInvalidInactiveCID)
+)
+
+var ProofAliceBob = []gocid.Cid{
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarol = []gocid.Cid{
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDan = []gocid.Cid{
+	TokenCarolDanCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErin = []gocid.Cid{
+	TokenDanErinCID,
+	TokenCarolDanCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinFrank = []gocid.Cid{
+	TokenErinFrankCID,
+	TokenDanErinCID,
+	TokenCarolDanCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanInvalidExpandedCommand = []gocid.Cid{
+	TokenCarolDanInvalidExpandedCommandCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinInvalidExpandedCommand = []gocid.Cid{
+	TokenDanErinInvalidExpandedCommandCID,
+	TokenCarolDanInvalidExpandedCommandCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinFrankInvalidExpandedCommand = []gocid.Cid{
+	TokenErinFrankInvalidExpandedCommandCID,
+	TokenDanErinInvalidExpandedCommandCID,
+	TokenCarolDanInvalidExpandedCommandCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanValidAttenuatedCommand = []gocid.Cid{
+	TokenCarolDanValidAttenuatedCommandCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinValidAttenuatedCommand = []gocid.Cid{
+	TokenDanErinValidAttenuatedCommandCID,
+	TokenCarolDanValidAttenuatedCommandCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinFrankValidAttenuatedCommand = []gocid.Cid{
+	TokenErinFrankValidAttenuatedCommandCID,
+	TokenDanErinValidAttenuatedCommandCID,
+	TokenCarolDanValidAttenuatedCommandCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanInvalidSubject = []gocid.Cid{
+	TokenCarolDanInvalidSubjectCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinInvalidSubject = []gocid.Cid{
+	TokenDanErinInvalidSubjectCID,
+	TokenCarolDanInvalidSubjectCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinFrankInvalidSubject = []gocid.Cid{
+	TokenErinFrankInvalidSubjectCID,
+	TokenDanErinInvalidSubjectCID,
+	TokenCarolDanInvalidSubjectCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanInvalidExpired = []gocid.Cid{
+	TokenCarolDanInvalidExpiredCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinInvalidExpired = []gocid.Cid{
+	TokenDanErinInvalidExpiredCID,
+	TokenCarolDanInvalidExpiredCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinFrankInvalidExpired = []gocid.Cid{
+	TokenErinFrankInvalidExpiredCID,
+	TokenDanErinInvalidExpiredCID,
+	TokenCarolDanInvalidExpiredCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanInvalidInactive = []gocid.Cid{
+	TokenCarolDanInvalidInactiveCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinInvalidInactive = []gocid.Cid{
+	TokenDanErinInvalidInactiveCID,
+	TokenCarolDanInvalidInactiveCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}
+
+var ProofAliceBobCarolDanErinFrankInvalidInactive = []gocid.Cid{
+	TokenErinFrankInvalidInactiveCID,
+	TokenDanErinInvalidInactiveCID,
+	TokenCarolDanInvalidInactiveCID,
+	TokenBobCarolCID,
+	TokenAliceBobCID,
+}

token/delegation/delegationtest/token_test.go

@@ -0,0 +1,32 @@
+package delegationtest_test
+
+import (
+	"testing"
+
+	"github.com/ipfs/go-cid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/ucan-wg/go-ucan/token/delegation/delegationtest"
+	"github.com/ucan-wg/go-ucan/token/invocation"
+)
+
+func TestGetDelegation(t *testing.T) {
+	t.Parallel()
+
+	t.Run("passes with valid CID", func(t *testing.T) {
+		t.Parallel()
+
+		tkn, err := delegationtest.GetDelegation(delegationtest.TokenAliceBobCID)
+		require.NoError(t, err)
+		assert.NotZero(t, tkn)
+	})
+
+	t.Run("fails with unknown CID", func(t *testing.T) {
+		t.Parallel()
+
+		tkn, err := delegationtest.GetDelegation(cid.Undef)
+		require.ErrorIs(t, err, invocation.ErrMissingDelegation)
+		require.ErrorContains(t, err, "CID b")
+		assert.Nil(t, tkn)
+	})
+}