@antasphere/chassis-server 1.0.0

package/test/integration/apikey-expiry.test.ts

@@ -0,0 +1,178 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp,
+  host
+} from './helpers.js';
+
+/**
+ * API-key expiry, end to end: the TTL at mint becomes an absolute expires_at,
+ * resolution rejects an expired key with EXACTLY the revoked key's 401 (one
+ * fail-closed path, no behavioural fork), and the nightly sweep normalizes
+ * expired keys to revoked_at without touching live ones.
+ */
+
+const OWNER = { email: 'owner@expiry.test', name: 'Expiry Owner', password: 'expiry-owner-pass-123' };
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+let ownerCookie: string;
+
+const json = (body: unknown) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json' },
+  body: JSON.stringify(body)
+});
+
+async function mint(body: Record<string, unknown>) {
+  return app.app.request('/api/v1/api-keys', {
+    ...json(body),
+    headers: { 'content-type': 'application/json', cookie: ownerCookie }
+  });
+}
+
+async function me(key: string) {
+  return app.app.request('/api/v1/me', { headers: { authorization: `Bearer ${key}` } });
+}
+
+async function expiresAtOf(keyId: string): Promise<Date | null> {
+  const res = await app.db.pool.query<{ expires_at: Date | null }>(
+    'SELECT expires_at FROM api_keys WHERE key_id = $1',
+    [keyId]
+  );
+  return res.rows[0]?.expires_at ?? null;
+}
+
+async function revokedAtOf(keyId: string): Promise<Date | null> {
+  const res = await app.db.pool.query<{ revoked_at: Date | null }>(
+    'SELECT revoked_at FROM api_keys WHERE key_id = $1',
+    [keyId]
+  );
+  return res.rows[0]?.revoked_at ?? null;
+}
+
+beforeAll(async () => {
+  container = await startPostgres();
+  app = await createTestApp(await createDatabase(container, 'apikeyexpiry'));
+  await app.app.request(
+    '/api/v1/setup',
+    json({ setupToken: 'integration-test-setup-token', instanceName: 'Expiry', owner: OWNER })
+  );
+  const signIn = await app.app.request(
+    '/api/v1/auth/sign-in/email',
+    json({ email: OWNER.email, password: OWNER.password })
+  );
+  ownerCookie = extractCookie(signIn);
+}, 240_000);
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+describe('minting with a TTL', () => {
+  it('computes an absolute expiry ~expiresInDays out and surfaces it in the list', async () => {
+    const res = await mint({ name: 'seven-days', scopes: [host.scopes.read], expiresInDays: 7 });
+    expect(res.status).toBe(201);
+    const body = await readJson(res);
+    expect(body.apiKey.expiresAt).toBeTruthy();
+    const expected = Date.now() + 7 * 86_400_000;
+    expect(Math.abs(new Date(body.apiKey.expiresAt).getTime() - expected)).toBeLessThan(5 * 60_000);
+
+    const list = await readJson(
+      await app.app.request('/api/v1/api-keys', { headers: { cookie: ownerCookie } })
+    );
+    const listed = list.apiKeys.find((k: { id: string }) => k.id === body.apiKey.id);
+    expect(listed?.expiresAt).toBe(body.apiKey.expiresAt);
+  });
+
+  it('omitting the TTL mints a never-expiring key', async () => {
+    const res = await mint({ name: 'forever', scopes: [host.scopes.read] });
+    expect(res.status).toBe(201);
+    const body = await readJson(res);
+    expect(body.apiKey.expiresAt).toBeNull();
+  });
+
+  it('rejects expiresInDays: 0 as a validation error', async () => {
+    const res = await mint({ name: 'zero-days', scopes: [host.scopes.read], expiresInDays: 0 });
+    expect(res.status).toBe(400);
+    const body = await readJson(res);
+    expect(body.error.code).toBe('validation_error');
+  });
+});
+
+describe('resolution treats expired exactly like revoked', () => {
+  it('answers an expired key with the identical 401 body a revoked key gets', async () => {
+    const expired = await readJson(
+      await mint({ name: 'to-expire', scopes: [host.scopes.read], expiresInDays: 7 })
+    );
+    const revoked = await readJson(await mint({ name: 'to-revoke', scopes: [host.scopes.read] }));
+
+    // Both keys are live before their terminal states.
+    expect((await me(expired.key)).status).toBe(200);
+    expect((await me(revoked.key)).status).toBe(200);
+
+    await app.db.pool.query(`UPDATE api_keys SET expires_at = now() - interval '1 hour' WHERE key_id = $1`, [
+      expired.apiKey.keyId
+    ]);
+    const revokeRes = await app.app.request(`/api/v1/api-keys/${revoked.apiKey.id}`, {
+      method: 'DELETE',
+      headers: { cookie: ownerCookie }
+    });
+    expect(revokeRes.status).toBe(200);
+
+    const expiredRes = await me(expired.key);
+    const revokedRes = await me(revoked.key);
+    expect(expiredRes.status).toBe(401);
+    expect(revokedRes.status).toBe(401);
+    // Same fail-closed path: the bodies must be indistinguishable.
+    expect(await readJson(expiredRes)).toEqual(await readJson(revokedRes));
+  });
+
+  it('a key expiring in the future still resolves and reports its expiry on /me', async () => {
+    const minted = await readJson(await mint({ name: 'boundary', scopes: [host.scopes.read] }));
+    await app.db.pool.query(`UPDATE api_keys SET expires_at = now() + interval '1 hour' WHERE key_id = $1`, [
+      minted.apiKey.keyId
+    ]);
+    const res = await me(minted.key);
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    expect(body.apiKeyExpiresAt).toBeTruthy();
+    expect(new Date(body.apiKeyExpiresAt).toISOString()).toBe(body.apiKeyExpiresAt);
+  });
+});
+
+describe('nightly expiry sweep', () => {
+  it('normalizes expired keys to revoked_at = expires_at and leaves live keys alone', async () => {
+    const doomed = await readJson(
+      await mint({ name: 'sweep-doomed', scopes: [host.scopes.read], expiresInDays: 7 })
+    );
+    const survivor = await readJson(
+      await mint({ name: 'sweep-survivor', scopes: [host.scopes.read], expiresInDays: 7 })
+    );
+    await app.db.pool.query(`UPDATE api_keys SET expires_at = now() - interval '1 hour' WHERE key_id = $1`, [
+      doomed.apiKey.keyId
+    ]);
+
+    // Trigger the worker's sweep handler out of band (the schedule is 03:00).
+    await app.jobs.boss.send('apikey-expiry-sweep', {});
+
+    const deadline = Date.now() + 15_000;
+    let revokedAt: Date | null = null;
+    while (!revokedAt && Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, 250));
+      revokedAt = await revokedAtOf(doomed.apiKey.keyId);
+    }
+    const expiresAt = await expiresAtOf(doomed.apiKey.keyId);
+    expect(revokedAt).not.toBeNull();
+    expect(revokedAt!.getTime()).toBe(expiresAt!.getTime());
+
+    // The unexpired key is untouched.
+    expect(await revokedAtOf(survivor.apiKey.keyId)).toBeNull();
+  }, 30_000);
+});

package/test/integration/apikey-pepper-rotation.test.ts

@@ -0,0 +1,190 @@
+import { createHash } from 'node:crypto';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp,
+  host
+} from './helpers.js';
+
+/**
+ * API-key pepper versioning (ADR 008), proven end to end across real reboots
+ * of the app against ONE database:
+ *
+ *  1. Zero-config backward compat — version 1 reproduces the historical
+ *     computation byte-identically: sha256(secret + AUTH_SECRET) hex.
+ *  2. Rotation survivability — pin v1, add v2, then ROTATE AUTH_SECRET; keys
+ *     minted under both versions keep authenticating.
+ *  3. Fail-closed — an unknown pepper_version answers the byte-identical 401
+ *     a revoked key gets, and a v1 hash is never accepted against v2's
+ *     pepper (no cross-version acceptance).
+ *
+ * Migration 0010 applies in this harness on every boot (backfill default 1).
+ */
+
+// Test-only throwaway values (same convention as the shared helper's secret).
+const SECRET_OLD = 'rotation-old-auth-secret-0123456789abcdef01234567';
+const SECRET_NEW = 'rotation-new-auth-secret-fedcba9876543210fedcba98';
+const PEPPER_V2 = 'rotation-pepper-v2-abcdef0123456789abcdef012345';
+
+const OWNER = { email: 'owner@pepper.test', name: 'Pepper Owner', password: 'pepper-owner-pass-123' };
+
+let container: StartedPostgreSqlContainer;
+let connectionString: string;
+let app: TestApp;
+
+const json = (body: unknown) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json' },
+  body: JSON.stringify(body)
+});
+
+async function signIn(): Promise<string> {
+  const res = await app.app.request(
+    '/api/v1/auth/sign-in/email',
+    json({ email: OWNER.email, password: OWNER.password })
+  );
+  expect(res.status).toBe(200);
+  return extractCookie(res);
+}
+
+async function mint(cookie: string, name: string) {
+  const res = await app.app.request('/api/v1/api-keys', {
+    ...json({ name, scopes: [host.scopes.read] }),
+    headers: { 'content-type': 'application/json', cookie }
+  });
+  expect(res.status).toBe(201);
+  return readJson(res);
+}
+
+async function me(key: string) {
+  return app.app.request('/api/v1/me', { headers: { authorization: `Bearer ${key}` } });
+}
+
+/**
+ * The secret is everything after `<prefix>_<keyId>_` — sliced by length, NEVER by
+ * splitting on `_` (base64url contains `_`; see LESSONS.md). keyId comes from
+ * the mint response.
+ */
+function secretOf(minted: { key: string; apiKey: { keyId: string } }): string {
+  return minted.key.slice(`${host.identity.apiKeyPrefix}_${minted.apiKey.keyId}_`.length);
+}
+
+/** Today's (pre-versioning) computation, reproduced independently. */
+function legacyHash(secret: string, pepper: string): string {
+  return createHash('sha256')
+    .update(secret + pepper)
+    .digest('hex');
+}
+
+async function keyRow(keyId: string): Promise<{ secret_hash: string; pepper_version: number }> {
+  const res = await app.db.pool.query<{ secret_hash: string; pepper_version: number }>(
+    'SELECT secret_hash, pepper_version FROM api_keys WHERE key_id = $1',
+    [keyId]
+  );
+  expect(res.rows).toHaveLength(1);
+  return res.rows[0]!;
+}
+
+/** Stop the current app and boot a fresh one against the SAME database. */
+async function reboot(extraEnv: Record<string, string>): Promise<void> {
+  await app.stop();
+  app = await createTestApp(connectionString, extraEnv);
+}
+
+beforeAll(async () => {
+  container = await startPostgres();
+  connectionString = await createDatabase(container, 'pepperrotation');
+  app = await createTestApp(connectionString, { AUTH_SECRET: SECRET_OLD });
+  await app.app.request(
+    '/api/v1/setup',
+    json({ setupToken: 'integration-test-setup-token', instanceName: 'Pepper', owner: OWNER })
+  );
+}, 240_000);
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+// Shared across the sequential phases below (vitest runs this file in order).
+let k1: { key: string; apiKey: { keyId: string } };
+let k2: { key: string; apiKey: { keyId: string } };
+
+describe('phase 1 — zero-config backward compatibility (no API_KEY_PEPPERS)', () => {
+  it('mints at pepper_version 1 and the hash reproduces sha256(secret + AUTH_SECRET) byte-identically', async () => {
+    k1 = await mint(await signIn(), 'k1-version-1');
+    const row = await keyRow(k1.apiKey.keyId);
+    expect(row.pepper_version).toBe(1);
+    // The backward-compat proof: version 1 IS the historical computation.
+    expect(row.secret_hash).toBe(legacyHash(secretOf(k1), SECRET_OLD));
+  });
+
+  it('the freshly minted key resolves', async () => {
+    expect((await me(k1.key)).status).toBe(200);
+  });
+});
+
+describe('phase 2 — introduce pepper v2 as current (AUTH_SECRET unchanged)', () => {
+  it('boots with API_KEY_PEPPERS=2:<pepper>; the v1 key still resolves', async () => {
+    await reboot({ AUTH_SECRET: SECRET_OLD, API_KEY_PEPPERS: `2:${PEPPER_V2}` });
+    expect((await me(k1.key)).status).toBe(200);
+  }, 120_000);
+
+  it('new keys mint at version 2, hashed under the v2 pepper', async () => {
+    k2 = await mint(await signIn(), 'k2-version-2');
+    const row = await keyRow(k2.apiKey.keyId);
+    expect(row.pepper_version).toBe(2);
+    expect(row.secret_hash).toBe(legacyHash(secretOf(k2), PEPPER_V2));
+    expect((await me(k2.key)).status).toBe(200);
+  });
+
+  it('no cross-version acceptance: a v1 hash presented against v2 is rejected', async () => {
+    // Point k1's row at v2 — its hash was computed under v1's pepper, so
+    // resolution (which uses the STORED version) must reject, not fall back.
+    await app.db.pool.query('UPDATE api_keys SET pepper_version = 2 WHERE key_id = $1', [k1.apiKey.keyId]);
+    expect((await me(k1.key)).status).toBe(401);
+    await app.db.pool.query('UPDATE api_keys SET pepper_version = 1 WHERE key_id = $1', [k1.apiKey.keyId]);
+    expect((await me(k1.key)).status).toBe(200);
+  });
+});
+
+describe('phase 3 — rotate AUTH_SECRET with v1 pinned (the runbook)', () => {
+  it('BOTH keys survive the rotation, each via its stored version', async () => {
+    await reboot({
+      AUTH_SECRET: SECRET_NEW, // rotated!
+      API_KEY_PEPPERS: `1:${SECRET_OLD};2:${PEPPER_V2}` // v1 pinned to the historical pepper
+    });
+    expect((await me(k1.key)).status).toBe(200); // v1 via the pinned pepper
+    expect((await me(k2.key)).status).toBe(200); // v2 via its own pepper
+  }, 120_000);
+
+  it('an unknown pepper_version fails closed with the byte-identical 401 of a revoked key', async () => {
+    // Sessions died with the AUTH_SECRET rotation (expected, out of scope) —
+    // a fresh password sign-in works and mints under the current version (2).
+    const cookie = await signIn();
+    const orphan = await mint(cookie, 'orphan-unknown-version');
+    const revoked = await mint(cookie, 'revoked-control');
+    expect((await keyRow(orphan.apiKey.keyId)).pepper_version).toBe(2);
+
+    await app.db.pool.query('UPDATE api_keys SET pepper_version = 9 WHERE key_id = $1', [
+      orphan.apiKey.keyId
+    ]);
+    const revokeRes = await app.app.request(`/api/v1/api-keys/${revoked.apiKey.id}`, {
+      method: 'DELETE',
+      headers: { cookie }
+    });
+    expect(revokeRes.status).toBe(200);
+
+    const orphanRes = await me(orphan.key);
+    const revokedRes = await me(revoked.key);
+    expect(orphanRes.status).toBe(401); // never a crash, never another pepper
+    expect(revokedRes.status).toBe(401);
+    // One fail-closed path: the raw bodies must be byte-identical.
+    expect(await orphanRes.text()).toBe(await revokedRes.text());
+  });
+});

package/test/integration/boot-posture.test.ts

@@ -0,0 +1,169 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  SETUP_TOKEN,
+  type TestApp
+} from './helpers.js';
+
+/**
+ * PRDCT-1357, the two members this lane added:
+ *
+ *  - OPS-3: a GDPR erasure lands an append-only tombstone in the data
+ *    volume (outside the dump); a boot that finds a tombstoned user present
+ *    again — the restore-from-an-older-dump shape — re-erases them and
+ *    audits the replay;
+ *  - OPS-6: migration status is hash-based, so a database migrated by a
+ *    NEWER image (a rollback, `:next` behind `:latest`) refuses readiness
+ *    instead of reporting "current".
+ */
+
+const OWNER = { email: 'owner@posture.test', name: 'Owner', password: 'owner-password-12345' };
+
+const json = (body: unknown, headers: Record<string, string> = {}) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json', ...headers },
+  body: JSON.stringify(body)
+});
+
+let container: StartedPostgreSqlContainer;
+
+beforeAll(async () => {
+  container = await startPostgres();
+}, 180_000);
+
+afterAll(async () => {
+  await container?.stop();
+});
+
+describe('erasure tombstone (OPS-3)', () => {
+  let url: string;
+  let app: TestApp;
+  let dataDir: string;
+  let ownerCookie: string;
+  const VICTIM_ID = 'u-erased';
+
+  async function seedMember(a: TestApp, id: string, email: string): Promise<string> {
+    await a.db.pool.query(
+      `INSERT INTO "user" (id, name, email, email_verified, created_at, updated_at)
+       VALUES ($1, $2, $3, true, now(), now())`,
+      [id, email, email]
+    );
+    await a.db.pool.query(
+      `INSERT INTO account (id, account_id, provider_id, user_id, password, created_at, updated_at)
+       VALUES ($1, $2, 'credential', $3, 'hash', now(), now())`,
+      [`acc-${id}`, id, id]
+    );
+    const ws = await a.db.pool.query<{ id: string }>(`SELECT id FROM workspaces LIMIT 1`);
+    const m = await a.db.pool.query<{ id: string }>(
+      `INSERT INTO workspace_members (workspace_id, user_id, role, origin, is_active)
+       VALUES ($1, $2, 'member', 'local', true) RETURNING id`,
+      [ws.rows[0]!.id, id]
+    );
+    return m.rows[0]!.id;
+  }
+
+  beforeAll(async () => {
+    url = await createDatabase(container, 'posture_erasure');
+    app = await createTestApp(url);
+    dataDir = app.env.DATA_DIR;
+    const setup = await app.app.request(
+      '/api/v1/setup',
+      json({ setupToken: SETUP_TOKEN, instanceName: 'Posture', owner: OWNER })
+    );
+    expect(setup.status).toBe(201);
+    ownerCookie = extractCookie(
+      await app.app.request(
+        '/api/v1/auth/sign-in/email',
+        json({ email: OWNER.email, password: OWNER.password })
+      )
+    );
+  });
+
+  afterAll(async () => {
+    await app.stop();
+  });
+
+  it('an admin erasure appends a tombstone that names the user id and hashes (never carries) the email', async () => {
+    const memberId = await seedMember(app, VICTIM_ID, 'victim@posture.test');
+    const res = await app.app.request(`/api/v1/members/${memberId}`, {
+      method: 'DELETE',
+      headers: { cookie: ownerCookie }
+    });
+    expect(res.status).toBe(200);
+    const path = join(dataDir, 'erasures.jsonl');
+    expect(existsSync(path)).toBe(true);
+    const raw = readFileSync(path, 'utf8');
+    const lines = raw
+      .trim()
+      .split('\n')
+      .map((l) => JSON.parse(l) as { userId: string; emailHash: string; at: string });
+    expect(lines).toHaveLength(1);
+    expect(lines[0]!.userId).toBe(VICTIM_ID);
+    expect(lines[0]!.emailHash).toMatch(/^[0-9a-f]{64}$/);
+    expect(raw).not.toContain('victim@posture.test');
+  });
+
+  it('a boot that finds the erased user PRESENT again re-erases them and audits the replay', async () => {
+    // The restore-from-an-older-dump shape: the row (and their password) is back.
+    await seedMember(app, VICTIM_ID, 'victim@posture.test');
+    await app.stop();
+    app = await createTestApp(url, { DATA_DIR: dataDir });
+    const users = await app.db.pool.query(`SELECT 1 FROM "user" WHERE id = $1`, [VICTIM_ID]);
+    expect(users.rows).toHaveLength(0);
+    const members = await app.db.pool.query(`SELECT 1 FROM workspace_members WHERE user_id = $1`, [
+      VICTIM_ID
+    ]);
+    expect(members.rows).toHaveLength(0);
+    const audit = await app.db.pool.query<{ action: string; actor_via: string | null; resource_id: string }>(
+      `SELECT action, actor_via, resource_id FROM audit_log WHERE action = 'user.erasure_replayed'`
+    );
+    expect(audit.rows).toEqual([
+      { action: 'user.erasure_replayed', actor_via: 'system', resource_id: VICTIM_ID }
+    ]);
+  });
+
+  it('a boot with nothing to replay replays nothing (idempotent) and the login still works', async () => {
+    await app.stop();
+    app = await createTestApp(url, { DATA_DIR: dataDir });
+    const audit = await app.db.pool.query(`SELECT 1 FROM audit_log WHERE action = 'user.erasure_replayed'`);
+    expect(audit.rows).toHaveLength(1);
+    const signIn = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: OWNER.email, password: OWNER.password })
+    );
+    expect(signIn.status).toBe(200);
+  });
+});
+
+describe('hash-based migration status (OPS-6)', () => {
+  it('a database carrying a migration this image does not ship refuses readiness (a downgrade), instead of "current"', async () => {
+    const url = await createDatabase(container, 'posture_downgrade');
+    const app = await createTestApp(url);
+    // What a NEWER image leaves behind: an applied hash no file here produces.
+    await app.db.pool.query(`INSERT INTO drizzle.__drizzle_migrations (hash, created_at) VALUES ($1, $2)`, [
+      'f'.repeat(64),
+      Date.now()
+    ]);
+    await app.stop();
+
+    const older = await createTestApp(url);
+    try {
+      expect(older.state.ready).toBe(false);
+      expect(older.state.reason).toMatch(/AHEAD of this image/);
+      const res = await older.app.request('/readyz');
+      expect(res.status).toBe(503);
+      const body = await readJson(res);
+      expect(body.status).toBe('unavailable');
+      expect(body.reason).toMatch(/AHEAD of this image/);
+    } finally {
+      await older.stop();
+    }
+  });
+});