@antasphere/chassis-server 1.0.0

package/test/integration/cloud-lifecycle.test.ts

@@ -0,0 +1,233 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import {
+  createDatabase,
+  createTestApp,
+  expectBootRefusal,
+  extractCookie,
+  host,
+  readJson,
+  startPostgres,
+  SETUP_TOKEN,
+  type TestApp
+} from './helpers.js';
+import { seedLocalWorkspace } from './sso-helpers.js';
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const fixturesDir = resolve(dirname(fileURLToPath(import.meta.url)), '../fixtures');
+
+/**
+ * PRDCT-1356 — cloud lifecycle & recovery, the server-side members:
+ *
+ *  - CLOUD-1 / AUTH-13: POST /auth/unlink-account for the `antasphere`
+ *    provider answers 403 on cloud (the /auth mount never saw the principal
+ *    gate; unlinking left hub-origin memberships behind a permanent
+ *    fail-open `no_link` reconcile);
+ *  - EDIT-2: /sign-in/email on cloud is the OPERATOR's + allowlist's door
+ *    only — every other local credential is refused with one 403 (no
+ *    account oracle);
+ *  - CLOUD-5: the invitation-accept account-creation branch is closed on
+ *    cloud (409 sso_required), the same stance as the collaborator claim;
+ *  - EDIT-1/3/4: the oss→cloud flip is REFUSED while an unprojected
+ *    workspace or an unverified user exists, and the reverse flip is
+ *    refused outright.
+ */
+
+const OWNER = { email: 'operator@lifecycle.test', name: 'Operator', password: 'operator-password-123' };
+const HUB_ENV = {
+  EDITION: 'cloud',
+  HUB_ISSUER_URL: 'http://hub.localhost:3300',
+  HUB_CLIENT_ID: host.hubClientId,
+  HUB_CLIENT_SECRET: 'integration-test-hub-secret-0001'
+};
+
+let ipCounter = 0;
+const nextIp = () => `198.51.100.${++ipCounter % 250}`;
+const json = (body: unknown, headers: Record<string, string> = {}) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json', 'x-forwarded-for': nextIp(), ...headers },
+  body: JSON.stringify(body)
+});
+
+let container: StartedPostgreSqlContainer;
+
+beforeAll(async () => {
+  container = await startPostgres();
+}, 180_000);
+
+afterAll(async () => {
+  await container?.stop();
+});
+
+describe("cloud edition: the local doors are the operator's only", () => {
+  let app: TestApp;
+  let operatorCookie: string;
+
+  beforeAll(async () => {
+    app = await createTestApp(await createDatabase(container, 'lifecycle_cloud'), HUB_ENV);
+    const setup = await app.app.request(
+      '/api/v1/setup',
+      json({ setupToken: SETUP_TOKEN, instanceName: 'LC', owner: OWNER })
+    );
+    expect(setup.status).toBe(201);
+    const signIn = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: OWNER.email, password: OWNER.password })
+    );
+    expect(signIn.status).toBe(200);
+    operatorCookie = extractCookie(signIn);
+  });
+
+  afterAll(async () => {
+    await app.stop();
+  });
+
+  it('setup recorded the operator durably on the instance row (CLOUD-3)', async () => {
+    const { rows } = await app.db.pool.query<{ operator_user_id: string | null; email: string }>(
+      `SELECT s.operator_user_id, u.email FROM instance_settings s JOIN "user" u ON u.id = s.operator_user_id`
+    );
+    expect(rows).toHaveLength(1);
+    expect(rows[0]!.email).toBe(OWNER.email);
+  });
+
+  it('migration 0036 backfills operator_user_id from the setup audit row on pre-existing instances (F2)', async () => {
+    // A cloud instance set up BEFORE the column existed: NULL — which would
+    // close the operator's local sign-in door after the upgrade.
+    await app.db.pool.query(`UPDATE instance_settings SET operator_user_id = NULL`);
+    const shut = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: OWNER.email, password: OWNER.password })
+    );
+    expect(shut.status).toBe(403);
+    // Run the migration's backfill statement (everything after the ALTER): a
+    // fixture the chassis owns, whose header says which migration it mirrors.
+    const backfill = readFileSync(join(fixturesDir, 'operator-user-id-backfill.sql'), 'utf8');
+    expect(backfill).toMatch(/UPDATE "instance_settings"/);
+    await app.db.pool.query(backfill);
+    const { rows } = await app.db.pool.query<{ email: string }>(
+      `SELECT u.email FROM instance_settings s JOIN "user" u ON u.id = s.operator_user_id`
+    );
+    expect(rows).toEqual([{ email: OWNER.email }]);
+    const open = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: OWNER.email, password: OWNER.password })
+    );
+    expect(open.status).toBe(200);
+  });
+
+  it('refuses to unlink the antasphere provider (403 hub_unlink_forbidden), even for a signed-in caller', async () => {
+    const res = await app.app.request(
+      '/api/v1/auth/unlink-account',
+      json({ providerId: 'antasphere' }, { cookie: operatorCookie })
+    );
+    expect(res.status).toBe(403);
+    const body = await readJson(res);
+    expect(JSON.stringify(body)).toContain('hub_unlink_forbidden');
+  });
+
+  it('a non-operator, non-allowlisted email is refused at the password door (403 local_signin_disabled)', async () => {
+    const res = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: 'someone@lifecycle.test', password: 'whatever-password-123' })
+    );
+    expect(res.status).toBe(403);
+    expect(JSON.stringify(await readJson(res))).toContain('local_signin_disabled');
+  });
+
+  it('the operator keeps the door (the break-glass identity)', async () => {
+    const res = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: OWNER.email.toUpperCase(), password: OWNER.password })
+    );
+    expect(res.status).toBe(200);
+  });
+
+  it('invitation accept on a cloud-LOCAL workspace never mints a local-password account (409 sso_required)', async () => {
+    const wsId = await seedLocalWorkspace(app, 'Local Host', OWNER.email);
+    const inv = await app.app.request(
+      '/api/v1/invitations',
+      json(
+        { email: 'invitee@lifecycle.test', role: 'member' },
+        { cookie: operatorCookie, 'x-workspace-id': wsId }
+      )
+    );
+    expect(inv.status).toBe(201);
+    const token = ((await readJson(inv)).acceptUrl as string).split('/invite/')[1]!;
+    const accepted = await app.app.request(
+      '/api/v1/invitations/accept',
+      json({ token, name: 'Invitee', password: 'invitee-password-123' })
+    );
+    expect(accepted.status).toBe(409);
+    expect((await readJson(accepted)).error.code).toBe('sso_required');
+    const users = await app.db.pool.query(`SELECT 1 FROM "user" WHERE email = 'invitee@lifecycle.test'`);
+    expect(users.rows).toHaveLength(0);
+  });
+});
+
+describe('the edition flip pre-flights (EDIT-1/3) and the reverse flip is refused (EDIT-4)', () => {
+  let connectionString: string;
+
+  beforeAll(async () => {
+    connectionString = await createDatabase(container, 'lifecycle_flip');
+    const app = await createTestApp(connectionString);
+    const res = await app.app.request(
+      '/api/v1/setup',
+      json({ setupToken: SETUP_TOKEN, instanceName: 'Flip', owner: OWNER })
+    );
+    expect(res.status).toBe(201);
+    await app.stop();
+  });
+
+  it('oss→cloud with the flag is REFUSED while a workspace has no hub projection', async () => {
+    await expectBootRefusal(
+      createTestApp(connectionString, { ...HUB_ENV, EDITION_CHANGE_ALLOWED: 'true' }),
+      /refusing the edition flip 'oss' → 'cloud'.*no hub projection/
+    );
+    // Nothing moved: the stamp is still oss and a plain oss boot still works.
+    const still = await createTestApp(connectionString);
+    const { rows } = await still.db.pool.query<{ edition: string }>(`SELECT edition FROM instance_settings`);
+    expect(rows).toEqual([{ edition: 'oss' }]);
+    await still.stop();
+  });
+
+  it('…and while a user has an unverified email', async () => {
+    const app = await createTestApp(connectionString);
+    // Project the workspace (what the hub onboarding would do) so only the
+    // unverified user stands in the way.
+    await app.db.pool.query(
+      `UPDATE workspaces SET central_account_id = '44444444-aaaa-4bbb-8ccc-000000000001'`
+    );
+    await app.db.pool.query(
+      `INSERT INTO "user" (id, name, email, email_verified, created_at, updated_at)
+       VALUES ('u-unverified', 'Unverified', 'unverified@lifecycle.test', false, now(), now())`
+    );
+    await app.stop();
+    await expectBootRefusal(
+      createTestApp(connectionString, { ...HUB_ENV, EDITION_CHANGE_ALLOWED: 'true' }),
+      /refusing the edition flip 'oss' → 'cloud'.*unverified email/
+    );
+  });
+
+  it('flips once the instance is in shape, then refuses the reverse flip even with the flag', async () => {
+    const app = await createTestApp(connectionString);
+    await app.db.pool.query(`DELETE FROM "user" WHERE id = 'u-unverified'`);
+    await app.stop();
+    const flipped = await createTestApp(connectionString, { ...HUB_ENV, EDITION_CHANGE_ALLOWED: 'true' });
+    const { rows } = await flipped.db.pool.query<{ edition: string }>(
+      `SELECT edition FROM instance_settings`
+    );
+    expect(rows).toEqual([{ edition: 'cloud' }]);
+    await flipped.stop();
+    await expectBootRefusal(
+      createTestApp(connectionString, { EDITION_CHANGE_ALLOWED: 'true' }),
+      /refusing the edition flip 'cloud' → 'oss'/
+    );
+    // …and still stamped cloud.
+    const cloud = await createTestApp(connectionString, HUB_ENV);
+    const after = await cloud.db.pool.query<{ edition: string }>(`SELECT edition FROM instance_settings`);
+    expect(after.rows).toEqual([{ edition: 'cloud' }]);
+    await cloud.stop();
+  });
+});

package/test/integration/credential-boundaries.test.ts

@@ -0,0 +1,195 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { workspaceMembers } from '@antasphere/chassis-db';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp,
+  host
+} from './helpers.js';
+
+/**
+ * Adversarial verifier suite (Stage D, the user-scoped credential core):
+ * three cross-tenant / cross-user boundaries the wider workspace-scoping
+ * suite proves at MINT time but not at RESOLUTION time. Each is a named
+ * attack in the re-architecture's rollout choreography:
+ *
+ *  1. A key is its CREATOR's credential — the creator-only revoke must not
+ *     let another user (even a co-owner of the pinned workspace) revoke or
+ *     probe it; a foreign key answers the SAME 404 as a nonexistent one.
+ *  2. "Stale pin after the membership is deactivated": a pinned key whose
+ *     creator loses their live membership of the pin fails CLOSED with the
+ *     uniform 401 — never the 403 mismatch, never silently served the pin.
+ *  3. Default selection is fail-CLOSED against a non-live default: an
+ *     `is_default` row that is not an ACTIVE membership is ignored, and
+ *     selector-less resolution falls back to the oldest ACTIVE membership.
+ *
+ * Every machine-credential request rotates its forwarded IP so the per-IP
+ * key-failure limiter never colours a deliberate resolution miss.
+ */
+
+const EVE = { email: 'eve@cred.test', name: 'Eve Owner', password: 'a-long-eve-password-12345' };
+const FRANK = { email: 'frank@cred.test', name: 'Frank Owner', password: 'a-long-frank-password-123' };
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+let eveCookie = '';
+let frankCookie = '';
+let eveId = '';
+let frankId = '';
+let wE = ''; // Eve's org, co-owned by Frank (so deactivating Eve never trips the last-owner trigger)
+
+let ipCounter = 0;
+const nextIp = () => `10.77.${Math.floor(ipCounter / 250)}.${(ipCounter++ % 250) + 1}`;
+const keyHeaders = (key: string) => ({ authorization: `Bearer ${key}`, 'x-forwarded-for': nextIp() });
+
+async function signIn(email: string, password: string): Promise<string> {
+  const res = await app.app.request('/api/v1/auth/sign-in/email', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ email, password })
+  });
+  expect(res.status).toBe(200);
+  return extractCookie(res);
+}
+
+async function mintKey(
+  cookie: string,
+  name: string,
+  workspaceId?: string
+): Promise<{ key: string; id: string }> {
+  const res = await app.app.request('/api/v1/api-keys', {
+    method: 'POST',
+    headers: { cookie, 'content-type': 'application/json' },
+    body: JSON.stringify({ name, scopes: [host.scopes.read], ...(workspaceId ? { workspaceId } : {}) })
+  });
+  expect(res.status).toBe(201);
+  const body = await readJson(res);
+  return { key: body.key, id: body.apiKey.id };
+}
+
+beforeAll(async () => {
+  container = await startPostgres();
+  const dbUrl = await createDatabase(container, 'cred_boundaries');
+  app = await createTestApp(dbUrl);
+
+  const setup = await app.app.request('/api/v1/setup', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      setupToken: 'integration-test-setup-token',
+      instanceName: 'Cred Boundaries',
+      owner: EVE
+    })
+  });
+  expect(setup.status).toBe(201);
+
+  eveCookie = await signIn(EVE.email, EVE.password);
+  eveId = (await readJson(await app.app.request('/api/v1/me', { headers: { cookie: eveCookie } }))).user.id;
+
+  const frank = await app.auth.api.signUpEmail({
+    body: { email: FRANK.email, password: FRANK.password, name: FRANK.name }
+  });
+  frankId = frank.user.id;
+
+  // Setup's workspace is Eve's oldest membership (the selector-less default).
+  wE = (await readJson(await app.app.request('/api/v1/me', { headers: { cookie: eveCookie } }))).workspace.id;
+  // Frank co-owns wE — a live second owner so Eve's membership can be
+  // deactivated without the 0009 last-owner trigger firing.
+  await app.db.db.insert(workspaceMembers).values({ workspaceId: wE, userId: frankId, role: 'owner' });
+  frankCookie = await signIn(FRANK.email, FRANK.password);
+}, 240_000);
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+describe('a key is its creator’s credential — revoke is creator-only (attack surface 3)', () => {
+  it('a co-owner of the pinned workspace cannot revoke another user’s key (404, and the key stays live)', async () => {
+    // Eve mints a key PINNED to wE — so the row carries workspace_id = wE and
+    // a (regressed) workspace-scoped revoke WOULD find it. The creator-scoped
+    // revoke must not.
+    const eveKey = await mintKey(eveCookie, 'eve-pinned-key', wE);
+
+    // Frank — a co-owner of the SAME workspace — tries to revoke Eve's key.
+    const foreignRevoke = await app.app.request(`/api/v1/api-keys/${eveKey.id}`, {
+      method: 'DELETE',
+      headers: { cookie: frankCookie }
+    });
+    // Existence is not probeable across users: identical to a nonexistent id.
+    expect(foreignRevoke.status).toBe(404);
+    expect((await readJson(foreignRevoke)).error.code).toBe('not_found');
+
+    // And it truly did NOT revoke: Eve's key still resolves.
+    const stillLive = await app.app.request('/api/v1/me', { headers: keyHeaders(eveKey.key) });
+    expect(stillLive.status).toBe(200);
+
+    // Sanity: the CREATOR revokes it, and only then does it die.
+    const ownRevoke = await app.app.request(`/api/v1/api-keys/${eveKey.id}`, {
+      method: 'DELETE',
+      headers: { cookie: eveCookie }
+    });
+    expect(ownRevoke.status).toBe(200);
+    const dead = await app.app.request('/api/v1/me', { headers: keyHeaders(eveKey.key) });
+    expect(dead.status).toBe(401);
+  });
+});
+
+describe('a stale pin fails closed once the creator’s membership is deactivated (attack surface 1)', () => {
+  it('the pinned key answers the uniform 401 — never the 403 mismatch, never served the pin', async () => {
+    const pinned = await mintKey(eveCookie, 'eve-stale-pin', wE);
+    // Works while Eve is a live member of the pin.
+    expect((await app.app.request('/api/v1/me', { headers: keyHeaders(pinned.key) })).status).toBe(200);
+
+    // Deactivate Eve's membership of the pinned workspace (Frank keeps wE alive).
+    await app.db.pool.query(
+      `UPDATE workspace_members SET is_active = false WHERE user_id = $1 AND workspace_id = $2`,
+      [eveId, wE]
+    );
+    try {
+      // No X-Workspace-Id header: the pin resolves to no live membership →
+      // the uniform 401 (invalid_api_key), indistinguishable from any other
+      // resolution miss. A regression that trusted the pin without the live
+      // isActive check would answer 200 here.
+      const res = await app.app.request('/api/v1/me', { headers: keyHeaders(pinned.key) });
+      expect(res.status).toBe(401);
+      expect((await readJson(res)).error.code).toBe('invalid_api_key');
+    } finally {
+      await app.db.pool.query(
+        `UPDATE workspace_members SET is_active = true WHERE user_id = $1 AND workspace_id = $2`,
+        [eveId, wE]
+      );
+    }
+    // Reactivated: the very same key resolves again (the row, not the token,
+    // is the authorization).
+    expect((await app.app.request('/api/v1/me', { headers: keyHeaders(pinned.key) })).status).toBe(200);
+  });
+});
+
+describe('default selection is fail-closed against a non-live default (attack surface 2)', () => {
+  it('an is_default flag on an INACTIVE membership is ignored; resolution falls back to the oldest ACTIVE', async () => {
+    // A second org for Eve; make it her DEFAULT but mark the membership
+    // INACTIVE. Frank co-owns it so deactivating Eve never trips the 0009
+    // last-owner trigger (this test is about default selection, not lifecycle).
+    const wE2 = (await app.registry.workspaces.create('Eve Org Two', eveId)).workspaceId;
+    await app.db.db.insert(workspaceMembers).values({ workspaceId: wE2, userId: frankId, role: 'owner' });
+    await app.db.pool.query(
+      `UPDATE workspace_members SET is_default = true, is_active = false WHERE user_id = $1 AND workspace_id = $2`,
+      [eveId, wE2]
+    );
+    try {
+      // Selector-less resolution must NOT land on the dead default; it falls
+      // back to the oldest ACTIVE membership (wE, the setup workspace).
+      const me = await readJson(await app.app.request('/api/v1/me', { headers: { cookie: eveCookie } }));
+      expect(me.activeWorkspaceId).toBe(wE);
+      // The inactive workspace is not even enumerated (the /me isActive filter).
+      expect(me.workspaces.map((w: { id: string }) => w.id)).not.toContain(wE2);
+    } finally {
+      await app.db.pool.query(`UPDATE workspace_members SET is_default = false WHERE user_id = $1`, [eveId]);
+    }
+  });
+});