@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/test/serve-hardening.test.js

@@ -63,6 +63,49 @@ suite('serve-hardening: resolveStateDir', () => {
         assert.ok(r.dir.startsWith(os.tmpdir()));
     });
 });
+suite('serve-hardening: resolveAnalyticsSessionsDir', () => {
+    // getAgentideHome() reads process.env directly (not injectable), so tests that need it to
+    // resolve deterministically save/restore the real env vars around themselves.
+    const saved = {};
+    setup(() => {
+        saved.AGENT_HOME_DIR = process.env.AGENT_HOME_DIR;
+        saved.AGENTHIPPO_HOME = process.env.AGENTHIPPO_HOME;
+        delete process.env.AGENT_HOME_DIR;
+        delete process.env.AGENTHIPPO_HOME;
+    });
+    teardown(() => {
+        if (saved.AGENT_HOME_DIR === undefined) {
+            delete process.env.AGENT_HOME_DIR;
+        }
+        else {
+            process.env.AGENT_HOME_DIR = saved.AGENT_HOME_DIR;
+        }
+        if (saved.AGENTHIPPO_HOME === undefined) {
+            delete process.env.AGENTHIPPO_HOME;
+        }
+        else {
+            process.env.AGENTHIPPO_HOME = saved.AGENTHIPPO_HOME;
+        }
+    });
+    test('AGENTHIPPO_HOME set → uses getAgentideHome(), not stateDir (stays discoverable to Spotlight/DuckDB)', () => {
+        process.env.AGENTHIPPO_HOME = '/data/.agent-hippo';
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/data/.agent-hippo/serve-state', false, { AGENTHIPPO_HOME: '/data/.agent-hippo' });
+        assert.strictEqual(dir, path.join('/data/.agent-hippo', 'analytics', 'sessions'));
+    });
+    test('AGENT_HOME_DIR set → same precedence as AGENTHIPPO_HOME', () => {
+        process.env.AGENT_HOME_DIR = '/data/.agent-hippo';
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/data/.agent-hippo/serve-state', false, { AGENT_HOME_DIR: '/data/.agent-hippo' });
+        assert.strictEqual(dir, path.join('/data/.agent-hippo', 'analytics', 'sessions'));
+    });
+    test('no home-dir env var, explicit non-ephemeral --state-dir → uses stateDir (never regress durability for discoverability)', () => {
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/mnt/durable-vol', false, {});
+        assert.strictEqual(dir, path.join('/mnt/durable-vol', 'analytics', 'sessions'));
+    });
+    test('no home-dir env var, ephemeral state (nothing durable configured) → falls back to getAgentideHome() default', () => {
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)(path.join(os.tmpdir(), 'agenthippo-server'), true, {});
+        assert.strictEqual(dir, path.join(os.homedir(), '.agent-hippo', 'analytics', 'sessions'));
+    });
+});
 suite('serve-hardening: resolveBindHost', () => {
     test('defaults to loopback', () => {
         assert.strictEqual((0, serve_hardening_1.resolveBindHost)(undefined, {}), serve_hardening_1.DEFAULT_BIND_HOST);
@@ -124,9 +167,40 @@ suite('serve-hardening: RateLimiter', () => {
     });
 });
 suite('serve-hardening: resolveUserId', () => {
-    test('X-Agent-User header wins over body', () => {
-        const id = (0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'alice' }, { user_id: 'bob' });
-        assert.strictEqual(id, 'alice');
+    /**
+     * BREAKING, and deliberately so. `x-agent-user` used to be the FIRST trusted alias, so on any
+     * deployment that had not pinned AGENTHIPPO_IDENTITY_HEADER, any HTTP client could send
+     * `x-agent-user: victim@example.com` and be namespaced into that user's session state, attach
+     * to their conversation, and be issued a data-plane turn nonce scoped to them. No platform
+     * strips it — Cloud Run IAP strips `X-Goog-*` and forwards this one untouched.
+     */
+    test('x-agent-user is NOT trusted by default — it is not stripped by any platform', () => {
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'victim@example.com' }, undefined, {}), undefined);
+    });
+    test('x-agent-user IS trusted when the deployment pins it (the Caddy forward_auth flow)', () => {
+        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' };
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'alice@corp.com' }, { user_id: 'bob' }, env), 'alice@corp.com');
+    });
+    test('an unpinned deployment is told which env var to set, and why', () => {
+        const advice = (0, serve_hardening_1.identityHeaderAdvice)({});
+        assert.ok(advice.length > 0);
+        assert.ok(advice.every((l) => /AGENTHIPPO_IDENTITY_HEADER/.test(l)));
+        assert.ok(advice.some((l) => /x-agent-user/.test(l)), 'the removal must be explained, not silent');
+        assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)({ AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' }), [], 'a pinned deployment is quiet');
+    });
+    test('advice severity follows reachability, so the loud case stays loud', () => {
+        const loopback = (0, serve_hardening_1.identityHeaderAdvice)({}, '127.0.0.1');
+        assert.strictEqual(loopback.length, 1, 'a local run gets one short note, not a lecture');
+        assert.ok(loopback.every((l) => /AGENTHIPPO_IDENTITY_HEADER/.test(l)));
+        assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)({}, 'localhost').length, 1);
+        assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)({}, '::1').length, 1);
+        const exposed = (0, serve_hardening_1.identityHeaderAdvice)({}, '0.0.0.0');
+        assert.ok(exposed.length > loopback.length, 'an exposed bind must say strictly more');
+        assert.ok(exposed.some((l) => /reachable beyond this machine/.test(l)));
+        assert.ok(exposed.every((l) => /AGENTHIPPO_IDENTITY_HEADER/.test(l)));
+        // Pinning silences both, exposed or not.
+        const pinned = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
+        assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)(pinned, '0.0.0.0'), []);
     });
     test('Databricks X-Forwarded-Email', () => {
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-forwarded-email': 'priya@meridian.com' }, undefined), 'priya@meridian.com');
@@ -138,12 +212,20 @@ suite('serve-hardening: resolveUserId', () => {
     test('Cloudflare Access header', () => {
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'cf-access-authenticated-user-email': 'susan@meridian.com' }, undefined), 'susan@meridian.com');
     });
-    test('falls back to body.user_id when no header', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: 'bob' }), 'bob');
+    test('body.user_id is ignored unless explicitly opted in (§10 hole 3)', () => {
+        // Safe-by-convention was the hole: any deployment that forgot to pin a header let
+        // every caller name an arbitrary victim via the client-controlled body.
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: 'bob' }, {}), undefined);
+    });
+    test('AGENTHIPPO_ALLOW_BODY_IDENTITY=1 restores the dev-convenience body fallback', () => {
+        const env = { AGENTHIPPO_ALLOW_BODY_IDENTITY: '1' };
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: 'bob' }, env), 'bob');
+        // A trusted platform header still wins over the body even when opted in.
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-forwarded-email': 'alice@corp.com' }, { user_id: 'bob' }, env), 'alice@corp.com');
     });
     test('undefined when nothing present', () => {
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, undefined), undefined);
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: '   ' }), undefined);
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: '   ' }, { AGENTHIPPO_ALLOW_BODY_IDENTITY: '1' }), undefined);
     });
     test('AGENTHIPPO_IDENTITY_HEADER pins trust to one header — spoofed aliases are ignored', () => {
         const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
@@ -297,3 +379,40 @@ suite('serve-hardening: readBodyWithCap', () => {
         assert.strictEqual(serve_hardening_1.DEFAULT_MAX_BODY_BYTES, 1024 * 1024);
     });
 });
+suite('serve-hardening: resolveServeSessionKey (secure-obo-design §3.4 Phase 0)', () => {
+    const PINNED = { AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email' };
+    test('verified user + session_id → user-namespaced key', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
+        assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--chat-1`);
+        assert.strictEqual(r.rejected, undefined);
+    });
+    test('two users presenting the SAME session_id can never share a key (the defect this closes)', () => {
+        const a = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
+        const b = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'bob@corp.com', PINNED);
+        assert.notStrictEqual(a.sessionKey, b.sessionKey);
+    });
+    test('verified user without session_id → stable per-user default key', () => {
+        const r1 = (0, serve_hardening_1.resolveServeSessionKey)(undefined, 'alice@corp.com', PINNED);
+        const r2 = (0, serve_hardening_1.resolveServeSessionKey)('', 'alice@corp.com', PINNED);
+        assert.strictEqual(r1.sessionKey, r2.sessionKey);
+        assert.strictEqual(r1.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--default`);
+    });
+    test('pinned identity + session_id but NO verified user → fail closed', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, PINNED);
+        assert.strictEqual(r.rejected, serve_hardening_1.SESSION_WITHOUT_USER_REASON);
+    });
+    test('unpinned (local dev) keeps raw session_id behavior', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, {});
+        assert.strictEqual(r.sessionKey, 'chat-1');
+        assert.strictEqual(r.rejected, undefined);
+    });
+    test('unpinned, no user, no session_id → legacy anon bucket', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)(undefined, undefined, {});
+        assert.strictEqual(r.sessionKey, 'anon-unknown');
+    });
+    test('the key never embeds the raw user id (emails are not path segments)', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('s', 'alice@corp.com', PINNED);
+        assert.ok(!r.sessionKey.includes('alice@corp.com'));
+        assert.ok(!r.sessionKey.includes('@'));
+    });
+});

package/out/test/serveClient.test.js

@@ -98,11 +98,12 @@ suite('ServeClient', () => {
     test('normalizeServeBaseUrl strips trailing slashes', () => {
         assert.strictEqual((0, serveClient_js_1.normalizeServeBaseUrl)('http://127.0.0.1:8787/'), 'http://127.0.0.1:8787');
     });
-    test('buildServeAuthHeaders includes bearer and identity', () => {
-        assert.deepStrictEqual((0, serveClient_js_1.buildServeAuthHeaders)({ accessToken: 'tok', userEmail: 'you@acme.com' }), {
-            Authorization: 'Bearer tok',
-            'X-Agent-User': 'you@acme.com',
-        });
+    test('buildServeAuthHeaders sends the bearer token and NO self-asserted identity', () => {
+        // `X-Agent-User` used to ride along here, and the serve side trusts `x-agent-user` as its
+        // first identity alias. On a deployment that does not pin AGENTHIPPO_IDENTITY_HEADER, a
+        // client could name someone else and be namespaced into that user's session/state and
+        // handed a data-plane nonce scoped to them. The bearer already carries a verified identity.
+        assert.deepStrictEqual((0, serveClient_js_1.buildServeAuthHeaders)({ accessToken: 'tok', userEmail: 'you@acme.com' }), { Authorization: 'Bearer tok' });
     });
     test('streamRemoteServeChat sends Authorization when auth provided', async () => {
         const mock = await startMockServeServer([
@@ -173,4 +174,36 @@ suite('ServeClient', () => {
             });
         });
     });
+    test('streamRemoteServeChat surfaces fail-closed credential rejection as HTTP error (not silent success)', async () => {
+        // Mirrors serve.ts after the fix: warrant denial happens BEFORE SSE writeHead(200),
+        // so the client sees a real non-2xx JSON error instead of 200 + raw body fallthrough.
+        const server = http.createServer((_req, res) => {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: 'OBO data token present without a verified user in request scope (fail-closed: token_without_verified_user)',
+            }));
+        });
+        await new Promise((resolve, reject) => {
+            server.listen(0, '127.0.0.1', async () => {
+                try {
+                    const address = server.address();
+                    if (!address || typeof address === 'string') {
+                        throw new Error('bad address');
+                    }
+                    const emitter = createCaptureEmitter();
+                    const result = await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
+                    assert.strictEqual(result.ok, false);
+                    assert.match(result.error ?? '', /token_without_verified_user/);
+                    assert.deepStrictEqual(emitter.events.map((e) => e.type), ['error', 'done']);
+                    resolve();
+                }
+                catch (err) {
+                    reject(err);
+                }
+                finally {
+                    server.close();
+                }
+            });
+        });
+    });
 });