@agenthippo-ai/agenthippo 0.1.0

package/out/test/auth-broker.test.js

@@ -0,0 +1,434 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const pkce_js_1 = require("../auth-broker/pkce.js");
+const jwt_js_1 = require("../auth-broker/jwt.js");
+const server_js_1 = require("../auth-broker/server.js");
+const types_js_1 = require("../auth/types.js");
+function testConfig(port) {
+    return {
+        port,
+        publicBaseUrl: `http://127.0.0.1:${port}`,
+        jwtSecret: 'test-jwt-secret',
+        accessTokenTtlSec: 3600,
+        refreshTokenTtlSec: 86400,
+        allowedEmailDomains: ['agenthippo.ai', 'example.com'],
+        devMode: true,
+        rateLimitPerMin: 0,
+        logPii: true,
+        cookieName: 'ah_token',
+        cookieDomain: '.agenthippo.ai',
+        idpBaseUrl: 'http://127.0.0.1:0',
+        team: {
+            id: 'team_test',
+            name: 'Test Team',
+            storeRepo: 'acme/agent-store',
+            storeIndexUrl: 'https://acme.github.io/agent-store',
+            githubOrg: 'acme',
+            litellmBaseUrl: 'http://127.0.0.1:4000',
+            litellmApiKey: 'ahk_test_key',
+        },
+    };
+}
+async function postForm(url, fields) {
+    const body = new URLSearchParams(fields);
+    return fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body,
+    });
+}
+suite('AuthBroker', () => {
+    test('PKCE login issues tokens and bootstrap payload', async () => {
+        const config = testConfig(0);
+        const broker = (0, server_js_1.createAuthBrokerServer)(config);
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        broker.baseUrl = baseUrl;
+        try {
+            const verifier = (0, pkce_js_1.generateCodeVerifier)();
+            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
+            const redirectUri = 'agenthippo://auth/callback';
+            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    email: 'dev@agenthippo.ai',
+                    client_id: types_js_1.AUTH_CLIENT_ID,
+                    redirect_uri: redirectUri,
+                    code_challenge: challenge,
+                }),
+            });
+            assert.strictEqual(devRes.status, 200);
+            const devJson = await devRes.json();
+            assert.ok(devJson.code);
+            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
+                grant_type: 'authorization_code',
+                client_id: types_js_1.AUTH_CLIENT_ID,
+                code: devJson.code,
+                redirect_uri: redirectUri,
+                code_verifier: verifier,
+            });
+            assert.strictEqual(tokenRes.status, 200);
+            const tokens = await tokenRes.json();
+            assert.ok(tokens.access_token);
+            assert.ok(tokens.refresh_token);
+            const bootstrapRes = await fetch(`${baseUrl}/api/ide/bootstrap`, {
+                headers: { Authorization: `Bearer ${tokens.access_token}` },
+            });
+            assert.strictEqual(bootstrapRes.status, 200);
+            const bootstrap = await bootstrapRes.json();
+            assert.strictEqual(bootstrap.store.repo, 'acme/agent-store');
+            assert.strictEqual(bootstrap.routing.litellmBaseUrl, 'http://127.0.0.1:4000');
+            assert.strictEqual(bootstrap.team.id, 'team_test');
+            const refreshRes = await postForm(`${baseUrl}/oauth/token`, {
+                grant_type: 'refresh_token',
+                client_id: types_js_1.AUTH_CLIENT_ID,
+                refresh_token: tokens.refresh_token,
+            });
+            assert.strictEqual(refreshRes.status, 200);
+            const refreshed = await refreshRes.json();
+            assert.ok(refreshed.access_token);
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('rejects disallowed email domains', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const res = await fetch(`${baseUrl}/oauth/dev/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    email: 'evil@bad-domain.test',
+                    client_id: types_js_1.AUTH_CLIENT_ID,
+                    redirect_uri: 'agenthippo://auth/callback',
+                    code_challenge: (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)()),
+                }),
+            });
+            assert.strictEqual(res.status, 500);
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('bootstrap refresh re-issues routing credentials', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const verifier = (0, pkce_js_1.generateCodeVerifier)();
+            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
+            const redirectUri = 'agenthippo://auth/callback';
+            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    email: 'dev@agenthippo.ai',
+                    client_id: types_js_1.AUTH_CLIENT_ID,
+                    redirect_uri: redirectUri,
+                    code_challenge: challenge,
+                }),
+            });
+            const devJson = await devRes.json();
+            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
+                grant_type: 'authorization_code',
+                client_id: types_js_1.AUTH_CLIENT_ID,
+                code: devJson.code,
+                redirect_uri: redirectUri,
+                code_verifier: verifier,
+            });
+            const tokens = await tokenRes.json();
+            const refreshRes = await fetch(`${baseUrl}/api/ide/bootstrap/refresh`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${tokens.access_token}` },
+            });
+            assert.strictEqual(refreshRes.status, 200);
+            const body = await refreshRes.json();
+            assert.strictEqual(body.routing.litellmApiKey, 'ahk_test_key');
+            assert.ok(body.routing.litellmApiKeyExpiresAt);
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('persists users across broker restarts', async () => {
+        const fs = await import('fs');
+        const os = await import('os');
+        const path = await import('path');
+        const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'auth-broker-test-'));
+        const persistPath = path.join(dataDir, 'auth-store.json');
+        const config = { ...testConfig(0), dataDir };
+        const broker1 = (0, server_js_1.createAuthBrokerServer)(config);
+        await new Promise((resolve) => broker1.server.listen(0, '127.0.0.1', resolve));
+        const address = broker1.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const verifier = (0, pkce_js_1.generateCodeVerifier)();
+            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
+            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    email: 'persist@agenthippo.ai',
+                    client_id: types_js_1.AUTH_CLIENT_ID,
+                    redirect_uri: 'agenthippo://auth/callback',
+                    code_challenge: challenge,
+                }),
+            });
+            assert.strictEqual(devRes.status, 200);
+        }
+        finally {
+            await broker1.close();
+        }
+        assert.ok(fs.existsSync(persistPath));
+        const broker2 = (0, server_js_1.createAuthBrokerServer)(config);
+        await new Promise((resolve) => broker2.server.listen(0, '127.0.0.1', resolve));
+        const address2 = broker2.server.address();
+        if (!address2 || typeof address2 === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl2 = `http://127.0.0.1:${address2.port}`;
+        try {
+            const meRes = await fetch(`${baseUrl2}/oauth/dev/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    email: 'persist@agenthippo.ai',
+                    client_id: types_js_1.AUTH_CLIENT_ID,
+                    redirect_uri: 'agenthippo://auth/callback',
+                    code_challenge: (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)()),
+                }),
+            });
+            assert.strictEqual(meRes.status, 200);
+        }
+        finally {
+            await broker2.close();
+            fs.rmSync(dataDir, { recursive: true, force: true });
+        }
+    });
+    test('introspect requires a bearer token', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const verifier = (0, pkce_js_1.generateCodeVerifier)();
+            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
+            const redirectUri = 'agenthippo://auth/callback';
+            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    email: 'dev@agenthippo.ai',
+                    client_id: types_js_1.AUTH_CLIENT_ID,
+                    redirect_uri: redirectUri,
+                    code_challenge: challenge,
+                }),
+            });
+            const devJson = await devRes.json();
+            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
+                grant_type: 'authorization_code',
+                client_id: types_js_1.AUTH_CLIENT_ID,
+                code: devJson.code,
+                redirect_uri: redirectUri,
+                code_verifier: verifier,
+            });
+            const tokens = await tokenRes.json();
+            // Anonymous introspect must be rejected.
+            const anonRes = await postForm(`${baseUrl}/oauth/introspect`, { token: tokens.access_token });
+            assert.strictEqual(anonRes.status, 401);
+            // Authenticated introspect returns active claims.
+            const authedRes = await fetch(`${baseUrl}/oauth/introspect`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${tokens.access_token}`,
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({ token: tokens.access_token }),
+            });
+            assert.strictEqual(authedRes.status, 200);
+            const introspected = await authedRes.json();
+            assert.strictEqual(introspected.active, true);
+            assert.strictEqual(introspected.email, 'dev@agenthippo.ai');
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('per-IP rate limit returns 429 on the token endpoint past the cap', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)({ ...testConfig(0), rateLimitPerMin: 2 });
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            // Invalid grant bodies still consume the limiter (the gate runs before parsing).
+            const first = await postForm(`${baseUrl}/oauth/token`, { grant_type: 'authorization_code' });
+            const second = await postForm(`${baseUrl}/oauth/token`, { grant_type: 'authorization_code' });
+            const third = await postForm(`${baseUrl}/oauth/token`, { grant_type: 'authorization_code' });
+            assert.notStrictEqual(first.status, 429);
+            assert.notStrictEqual(second.status, 429);
+            assert.strictEqual(third.status, 429);
+            assert.ok(third.headers.get('retry-after'));
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('federated token verifies at /api/ide/me without a local user record (A′ trust)', async () => {
+        // Simulate an IdP-issued federated token: sign with the shared secret, never create the
+        // user in THIS broker's store (fresh broker, empty store — like an edge service). The
+        // verified JWT claims must be trusted directly.
+        const config = testConfig(0);
+        const broker = (0, server_js_1.createAuthBrokerServer)(config);
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const token = (0, jwt_js_1.signJwt)({ sub: 'user_federated_123', email: 'trung@agenthippo.ai', name: 'Trung', team_id: 'team_test' }, config.jwtSecret, 3600);
+            const meRes = await fetch(`${baseUrl}/api/ide/me`, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            assert.strictEqual(meRes.status, 200);
+            assert.strictEqual(meRes.headers.get('X-Agent-User'), 'trung@agenthippo.ai');
+            const body = await meRes.json();
+            assert.strictEqual(body.user.id, 'user_federated_123');
+            assert.strictEqual(body.user.displayName, 'Trung');
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('federated cookie verifies at /api/ide/me (browser flow, no Bearer header)', async () => {
+        const config = testConfig(0);
+        const broker = (0, server_js_1.createAuthBrokerServer)(config);
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            // Mint a JWT via the dev login + token flow, then present it as a Cookie (not Bearer).
+            const verifier = (0, pkce_js_1.generateCodeVerifier)();
+            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
+            const redirectUri = 'agenthippo://auth/callback';
+            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email: 'dev@agenthippo.ai', client_id: types_js_1.AUTH_CLIENT_ID, redirect_uri: redirectUri, code_challenge: challenge }),
+            });
+            const devJson = await devRes.json();
+            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
+                grant_type: 'authorization_code', client_id: types_js_1.AUTH_CLIENT_ID,
+                code: devJson.code, redirect_uri: redirectUri, code_verifier: verifier,
+            });
+            const tokens = await tokenRes.json();
+            const meRes = await fetch(`${baseUrl}/api/ide/me`, {
+                headers: { Cookie: `${config.cookieName}=${tokens.access_token}` },
+            });
+            assert.strictEqual(meRes.status, 200);
+            assert.strictEqual(meRes.headers.get('X-Agent-User'), 'dev@agenthippo.ai');
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('browser-login stamps the shared cookie and redirects to a same-domain return_to', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const res = await fetch(`${baseUrl}/oauth/browser-login?return_to=https://cs.agenthippo.ai/app`, {
+                redirect: 'manual',
+                headers: { 'X-Auth-Request-Email': 'dev@agenthippo.ai' },
+            });
+            assert.strictEqual(res.status, 302);
+            const setCookie = res.headers.get('set-cookie') || '';
+            assert.ok(setCookie.includes('ah_token='), 'Set-Cookie has ah_token');
+            assert.ok(setCookie.includes('Domain=.agenthippo.ai'), 'cookie scoped to parent domain');
+            assert.ok(setCookie.toLowerCase().includes('httponly'), 'cookie is HttpOnly');
+            assert.strictEqual(res.headers.get('location'), 'https://cs.agenthippo.ai/app');
+            // A return_to on an unrelated domain must NOT be honored — fall back to publicBaseUrl.
+            const bad = await fetch(`${baseUrl}/oauth/browser-login?return_to=https://evil.example.com/`, {
+                redirect: 'manual', headers: { 'X-Auth-Request-Email': 'dev@agenthippo.ai' },
+            });
+            assert.strictEqual(bad.status, 302);
+            assert.notStrictEqual(bad.headers.get('location'), 'https://evil.example.com/');
+            // No X-Auth-Request-Email (not behind oauth2-proxy) → 401.
+            const noAuth = await fetch(`${baseUrl}/oauth/browser-login`, { redirect: 'manual' });
+            assert.strictEqual(noAuth.status, 401);
+        }
+        finally {
+            await broker.close();
+        }
+    });
+});

package/out/test/auth-callback.test.js

@@ -0,0 +1,62 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const callbackUriParse_js_1 = require("../auth/callbackUriParse.js");
+const types_js_1 = require("../auth/types.js");
+suite('Auth callback URI', () => {
+    test('parseAuthCallbackFromText accepts extension-scoped redirect', () => {
+        const state = 'test-state-123';
+        const url = `cursor://${types_js_1.AUTH_EXTENSION_AUTHORITY}${types_js_1.AUTH_CALLBACK_PATH}?code=abc&state=${state}`;
+        assert.strictEqual((0, callbackUriParse_js_1.parseAuthCallbackFromText)(url, state), 'abc');
+    });
+    test('parseAuthCallbackFromText rejects wrong state', () => {
+        const url = `cursor://${types_js_1.AUTH_EXTENSION_AUTHORITY}${types_js_1.AUTH_CALLBACK_PATH}?code=abc&state=other`;
+        assert.strictEqual((0, callbackUriParse_js_1.parseAuthCallbackFromText)(url, 'expected'), undefined);
+    });
+    test('legacy auth/callback authority is not accepted', () => {
+        const url = 'cursor://auth/callback?code=abc&state=s';
+        assert.strictEqual((0, callbackUriParse_js_1.parseAuthCallbackFromText)(url, 's'), undefined);
+    });
+    test('parseAuthCallbackFromLoopbackUrl accepts localhost redirect', () => {
+        const state = 'loop-state';
+        const url = `http://127.0.0.1:8765/callback?code=loopcode&state=${state}`;
+        assert.strictEqual((0, callbackUriParse_js_1.parseAuthCallbackFromLoopbackUrl)(url, state), 'loopcode');
+    });
+});