평문 환경 숙의 연습 해시 보정

apps/web/e2e/deliberate-practice.spec.ts

@@ -477,12 +477,18 @@ test.describe("G4 숙의 연습", () => {
     );
     const episodeBody = submitted[0].episode as {
       episode_id: string;
-      attempts: Array<{ attempt_id: string }>;
+      attempts: Array<{
+        attempt_id: string;
+        utterance_template_id?: string | null;
+      }>;
     };
     expect(episodeBody.episode_id).toMatch(/^oas-g4-episode-[a-f0-9-]+$/);
     expect(episodeBody.attempts[0].attempt_id).toMatch(
       /^oas-g4-attempt-[a-f0-9-]+$/,
     );
+    expect(episodeBody.attempts[0].utterance_template_id).toBe(
+      "utterance-sha256:c06db0f06811c540ea7d985c7d4e3b880e978e33524128538d6f0ab7b23362aa",
+    );
 
     await card.getByRole("button", { name: /05:04.*발화로 이동/ }).click();
     await expect(page.getByRole("tab", { name: "축어록" })).toHaveAttribute(

apps/web/e2e/insecure-context-uuid.spec.ts

@@ -11,6 +11,24 @@ import { expect, test } from "@playwright/test";
  * context.
  */
 const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const SHA256_VECTORS = [
+  {
+    value: "",
+    digest: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  },
+  {
+    value: "abc",
+    digest: "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+  },
+  {
+    value: "a".repeat(56),
+    digest: "b35439a4ac6f0948b6d6f9e3c6af0f5f590ce20f1bde7090ef7970686ec6738a",
+  },
+  {
+    value: "지금 이 이야기를 조금 더 다뤄도 괜찮을까요?",
+    digest: "c06db0f06811c540ea7d985c7d4e3b880e978e33524128538d6f0ab7b23362aa",
+  },
+] as const;
 
 test.describe("insecure-context idempotency keys", () => {
   test("randomUuid keeps working when crypto.randomUUID is unavailable", async ({
@@ -83,6 +101,78 @@ test.describe("insecure-context idempotency keys", () => {
     expect(new Set(values).size).toBe(2);
   });
 
+  test("sha256Hex matches known vectors when crypto.subtle is unavailable", async ({
+    page,
+  }) => {
+    await page.addInitScript(() => {
+      Object.defineProperty(globalThis.crypto, "subtle", {
+        value: undefined,
+        configurable: true,
+      });
+    });
+    await page.goto("/");
+
+    const probe = await page.evaluate(async (vectors) => {
+      const module = await import("/src/lib/sha256.ts");
+      return {
+        subtlePresent: typeof globalThis.crypto.subtle,
+        digests: await Promise.all(
+          vectors.map(({ value }) => module.sha256Hex(value)),
+        ),
+      };
+    }, SHA256_VECTORS);
+
+    expect(probe.subtlePresent).toBe("undefined");
+    expect(probe.digests).toEqual(
+      SHA256_VECTORS.map(({ digest }) => digest),
+    );
+  });
+
+  test("sha256Hex falls back when a partial subtle implementation throws", async ({
+    page,
+  }) => {
+    await page.addInitScript(() => {
+      let digestCalls = 0;
+      Object.defineProperty(globalThis, "__sha256DigestCalls", {
+        configurable: true,
+        get: () => digestCalls,
+      });
+      Object.defineProperty(globalThis.crypto, "subtle", {
+        configurable: true,
+        value: {
+          digest: async () => {
+            digestCalls += 1;
+            throw new DOMException(
+              "partial Web Crypto implementation",
+              "NotSupportedError",
+            );
+          },
+        },
+      });
+    });
+    await page.goto("/");
+
+    const probe = await page.evaluate(async (vectors) => {
+      const module = await import("/src/lib/sha256.ts");
+      const digests = await Promise.all(
+        vectors.map(({ value }) => module.sha256Hex(value)),
+      );
+      return {
+        subtlePresent: typeof globalThis.crypto.subtle,
+        digestCalls: (
+          globalThis as typeof globalThis & { __sha256DigestCalls: number }
+        ).__sha256DigestCalls,
+        digests,
+      };
+    }, SHA256_VECTORS);
+
+    expect(probe.subtlePresent).toBe("object");
+    expect(probe.digestCalls).toBe(SHA256_VECTORS.length);
+    expect(probe.digests).toEqual(
+      SHA256_VECTORS.map(({ digest }) => digest),
+    );
+  });
+
   test("no product source calls crypto.randomUUID without the fallback", async () => {
     const { readFileSync, readdirSync, statSync } = await import("node:fs");
     const path = await import("node:path");
@@ -105,4 +195,28 @@ test.describe("insecure-context idempotency keys", () => {
     walk(root);
     expect(offenders).toEqual([]);
   });
+
+  test("no product source calls subtle.digest outside the sha256 fallback", async () => {
+    const { readFileSync, readdirSync, statSync } = await import("node:fs");
+    const path = await import("node:path");
+    const root = path.join(process.cwd(), "src");
+    const fallbackPath = path.join("lib", "sha256.ts");
+    const offenders: string[] = [];
+    const walk = (dir: string) => {
+      for (const entry of readdirSync(dir)) {
+        const full = path.join(dir, entry);
+        if (statSync(full).isDirectory()) {
+          walk(full);
+          continue;
+        }
+        if (!/\.(ts|tsx)$/.test(entry)) continue;
+        if (full.endsWith(fallbackPath)) continue;
+        if (/\bsubtle\s*\??\.\s*digest\s*\(/.test(readFileSync(full, "utf8"))) {
+          offenders.push(path.relative(root, full));
+        }
+      }
+    };
+    walk(root);
+    expect(offenders).toEqual([]);
+  });
 });