@antasphere/chassis-server 1.0.0

package/test/integration/last-owner-race.test.ts

@@ -0,0 +1,263 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { and, eq } from 'drizzle-orm';
+import { workspaceMembers } from '@antasphere/chassis-db';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp
+} from './helpers.js';
+
+/**
+ * Last-owner delete race (M9 P0): two concurrent removals of the two last
+ * ACTIVE owners must never both succeed — a zero-active-owner workspace is
+ * unrecoverable (setup is one-shot). Pinned here across all three surfaces:
+ *
+ *  - self-service POST /auth/delete-user (the confirmed-live finding: both
+ *    parallel no-password deletes returned 200 and bricked the workspace);
+ *  - admin DELETE /members/{id};
+ *  - PATCH /members/{id} demotion.
+ *
+ * Contract per race: exactly one winner (200), the loser answers a clean
+ * 400 last_owner (never a 500), and ≥1 active owner survives in the DB. The
+ * DB trigger (migration 0009) is additionally pinned via raw SQL.
+ *
+ * Each round rebuilds the 2-owner state: the survivor of round N plus a
+ * freshly invited owner enter round N+1.
+ */
+
+const OWNER = { email: 'owner@race.test', name: 'Race Owner', password: 'race-owner-password-12' };
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+let workspaceId: string;
+let ipCounter = 0;
+
+/** Fresh XFF per actor so per-IP auth buckets never collide across rounds. */
+function nextIp(): string {
+  ipCounter += 1;
+  return `10.9.${Math.floor(ipCounter / 250)}.${(ipCounter % 250) + 1}`;
+}
+
+const json = (body: unknown, extraHeaders: Record<string, string> = {}) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json', ...extraHeaders },
+  body: JSON.stringify(body)
+});
+
+interface Actor {
+  email: string;
+  cookie: string;
+  ip: string;
+  userId: string;
+  memberId: string;
+}
+
+async function signIn(email: string, password: string, ip: string): Promise<string> {
+  const res = await app.app.request(
+    '/api/v1/auth/sign-in/email',
+    json({ email, password }, { 'x-forwarded-for': ip })
+  );
+  expect(res.status).toBe(200);
+  return extractCookie(res);
+}
+
+async function actorOf(email: string, cookie: string, ip: string): Promise<Actor> {
+  const me = await readJson(await app.app.request('/api/v1/me', { headers: { cookie } }));
+  const { members } = await readJson(
+    await app.app.request('/api/v1/members?limit=100', { headers: { cookie } })
+  );
+  const memberId = members.find((m: { email: string }) => m.email === email).id as string;
+  return { email, cookie, ip, userId: me.user.id as string, memberId };
+}
+
+/** Invite → accept → sign in a brand-new OWNER-role member. */
+async function addOwner(inviterCookie: string, tag: string): Promise<Actor> {
+  const email = `owner-${tag}@race.test`;
+  const password = `race-${tag}-password-1234`;
+  const inv = await readJson(
+    await app.app.request('/api/v1/invitations', {
+      ...json({ email, role: 'owner' }),
+      headers: { 'content-type': 'application/json', cookie: inviterCookie }
+    })
+  );
+  const token = (inv.acceptUrl as string).split('/invite/')[1]!;
+  const acceptIp = nextIp();
+  const accept = await app.app.request(
+    '/api/v1/invitations/accept',
+    json({ token, name: `Owner ${tag}`, password }, { 'x-forwarded-for': acceptIp })
+  );
+  expect(accept.status).toBe(200);
+  const ip = nextIp();
+  const cookie = await signIn(email, password, ip);
+  return actorOf(email, cookie, ip);
+}
+
+async function activeOwnerCount(): Promise<number> {
+  const rows = await app.db.db
+    .select({ id: workspaceMembers.id })
+    .from(workspaceMembers)
+    .where(
+      and(
+        eq(workspaceMembers.workspaceId, workspaceId),
+        eq(workspaceMembers.role, 'owner'),
+        eq(workspaceMembers.isActive, true)
+      )
+    );
+  return rows.length;
+}
+
+/** The two-last-owners invariant assertion shared by every race below. */
+async function assertOneWinner(results: Response[]): Promise<void> {
+  const statuses = results.map((r) => r.status);
+  const winners = statuses.filter((s) => s === 200).length;
+  expect(winners).toBe(1);
+  for (const res of results) {
+    if (res.status === 200) continue;
+    // The loser gets a clean 400 (or a 404 when the winner's cascade already
+    // removed its target row) — never a 500.
+    expect([400, 404]).toContain(res.status);
+    const body = await readJson(res);
+    expect(JSON.stringify(body)).toMatch(/active owner|not found|Not found/i);
+  }
+  expect(await activeOwnerCount()).toBeGreaterThanOrEqual(1);
+}
+
+beforeAll(async () => {
+  container = await startPostgres();
+  app = await createTestApp(await createDatabase(container, 'race'));
+  await app.app.request(
+    '/api/v1/setup',
+    json({ setupToken: 'integration-test-setup-token', instanceName: 'Race', owner: OWNER })
+  );
+  const cookie = await signIn(OWNER.email, OWNER.password, nextIp());
+  const me = await readJson(await app.app.request('/api/v1/me', { headers: { cookie } }));
+  workspaceId = me.workspace.id;
+  // Round state entry point: the setup owner is the initial survivor.
+  survivor = await actorOf(OWNER.email, cookie, nextIp());
+}, 240_000);
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+/** Survivor of the previous round; each race re-arms the 2-owner state from it. */
+let survivor: Actor;
+
+/** Re-resolve the survivor after a race (whichever of the pair still resolves). */
+async function resolveSurvivor(a: Actor, b: Actor): Promise<Actor> {
+  const aliveA = (await app.app.request('/api/v1/me', { headers: { cookie: a.cookie } })).status === 200;
+  return aliveA ? a : b;
+}
+
+describe('self-service delete race (the confirmed-live P0)', () => {
+  const selfDelete = (actor: Actor) =>
+    app.app.request(
+      '/api/v1/auth/delete-user',
+      // Deliberately passwordless: the session is fresh (< freshAge), the
+      // exact shape the live campaign used.
+      json({}, { cookie: actor.cookie, 'x-forwarded-for': actor.ip })
+    );
+
+  for (const round of [1, 2, 3]) {
+    it(`round ${round}: two parallel last-owner self-deletes leave exactly one owner`, async () => {
+      const fresh = await addOwner(survivor.cookie, `self-${round}`);
+      expect(await activeOwnerCount()).toBe(2);
+
+      const results = await Promise.all([selfDelete(survivor), selfDelete(fresh)]);
+      await assertOneWinner(results);
+      expect(await activeOwnerCount()).toBe(1);
+
+      survivor = await resolveSurvivor(survivor, fresh);
+    }, 60_000);
+  }
+});
+
+describe('admin member-delete race (DELETE /members/{id})', () => {
+  it('two owners deleting each other concurrently leave exactly one owner', async () => {
+    const fresh = await addOwner(survivor.cookie, 'admin');
+    const a = await actorOf(survivor.email, survivor.cookie, survivor.ip);
+    expect(await activeOwnerCount()).toBe(2);
+
+    const del = (actorCookie: string, targetMemberId: string) =>
+      app.app.request(`/api/v1/members/${targetMemberId}`, {
+        method: 'DELETE',
+        headers: { cookie: actorCookie }
+      });
+    const results = await Promise.all([del(a.cookie, fresh.memberId), del(fresh.cookie, a.memberId)]);
+    await assertOneWinner(results);
+    expect(await activeOwnerCount()).toBe(1);
+
+    survivor = await resolveSurvivor(a, fresh);
+  }, 60_000);
+});
+
+describe('demotion race (PATCH /members/{id})', () => {
+  it('two owners demoting each other concurrently keep one active owner', async () => {
+    const fresh = await addOwner(survivor.cookie, 'patch');
+    const a = await actorOf(survivor.email, survivor.cookie, survivor.ip);
+    expect(await activeOwnerCount()).toBe(2);
+
+    const demote = (actorCookie: string, targetMemberId: string) =>
+      app.app.request(`/api/v1/members/${targetMemberId}`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json', cookie: actorCookie },
+        body: JSON.stringify({ role: 'member' })
+      });
+    const results = await Promise.all([demote(a.cookie, fresh.memberId), demote(fresh.cookie, a.memberId)]);
+    const statuses = results.map((r) => r.status);
+    expect(statuses.filter((s) => s === 200).length).toBe(1);
+    for (const res of results) {
+      if (res.status === 200) continue;
+      // 400 last_owner from the guard; 403 only when the loser's principal
+      // resolved after the winning demotion already landed.
+      expect([400, 403]).toContain(res.status);
+      if (res.status === 400) {
+        expect((await readJson(res)).error.code).toBe('last_owner');
+      }
+    }
+    expect(await activeOwnerCount()).toBe(1);
+
+    // The demoted member is re-promotable — re-arm for any later test.
+    const alive = await resolveSurvivorByRole(a, fresh);
+    survivor = alive;
+  }, 60_000);
+});
+
+/** After a demotion race the loser still signs in — survivor = the one still an owner. */
+async function resolveSurvivorByRole(a: Actor, b: Actor): Promise<Actor> {
+  const rows = await app.db.db
+    .select({ userId: workspaceMembers.userId })
+    .from(workspaceMembers)
+    .where(
+      and(
+        eq(workspaceMembers.workspaceId, workspaceId),
+        eq(workspaceMembers.role, 'owner'),
+        eq(workspaceMembers.isActive, true)
+      )
+    );
+  const ownerIds = new Set(rows.map((r) => r.userId));
+  return ownerIds.has(a.userId) ? a : b;
+}
+
+describe('DB-level backstop (migration 0009 trigger)', () => {
+  it('raw SQL cannot drop the workspace to zero active owners', async () => {
+    expect(await activeOwnerCount()).toBeGreaterThanOrEqual(1);
+    await expect(
+      app.db.pool.query(`DELETE FROM workspace_members WHERE role = 'owner' AND is_active`)
+    ).rejects.toMatchObject({ code: 'P0409' });
+    // Nothing was deleted — the statement aborted atomically.
+    expect(await activeOwnerCount()).toBeGreaterThanOrEqual(1);
+  });
+
+  it('raw SQL cannot deactivate the last active owner', async () => {
+    await expect(
+      app.db.pool.query(`UPDATE workspace_members SET is_active = false WHERE role = 'owner' AND is_active`)
+    ).rejects.toMatchObject({ code: 'P0409' });
+    expect(await activeOwnerCount()).toBeGreaterThanOrEqual(1);
+  });
+});

package/test/integration/m9-fixes.test.ts

@@ -0,0 +1,290 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp,
+  host
+} from './helpers.js';
+
+/**
+ * M9 adversarial-campaign regression battery:
+ *  - /mcp method handling: non-POST → 405 + Allow: POST, malformed or
+ *    non-JSON-RPC POST → 400 JSON-RPC error (never 500), valid POST works;
+ *  - every {id} path param validates as a UUID → clean 400/404, never a
+ *    Postgres uuid-cast 500 (incl. the DELETE /invitations/lookup residue);
+ *  - audit cursor past bigint precision is ignored like a malformed one;
+ *  - unmatched /api/v1 paths answer a JSON 404, not the SPA HTML, while the
+ *    machine-principal 403 endpoint_not_allowed still fires first;
+ *  - sign-in rejects a foreign Origin header (login-CSRF hardening) while
+ *    same-origin and origin-less (CLI-style) logins keep working.
+ */
+
+const OWNER = { email: 'owner@m9.test', name: 'M9 Owner', password: 'm9-owner-password-1234' };
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+let ownerCookie: string;
+let apiKey: string;
+
+const json = (body: unknown, extraHeaders: Record<string, string> = {}) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json', ...extraHeaders },
+  body: JSON.stringify(body)
+});
+
+beforeAll(async () => {
+  container = await startPostgres();
+  app = await createTestApp(await createDatabase(container, 'm9'));
+  await app.app.request(
+    '/api/v1/setup',
+    json({ setupToken: 'integration-test-setup-token', instanceName: 'M9', owner: OWNER })
+  );
+  const signIn = await app.app.request(
+    '/api/v1/auth/sign-in/email',
+    json({ email: OWNER.email, password: OWNER.password }, { 'x-forwarded-for': '10.7.0.1' })
+  );
+  ownerCookie = extractCookie(signIn);
+  const minted = await readJson(
+    await app.app.request('/api/v1/api-keys', {
+      ...json({ name: 'm9-key', scopes: [host.scopes.read] }),
+      headers: { 'content-type': 'application/json', cookie: ownerCookie }
+    })
+  );
+  apiKey = minted.key as string;
+}, 240_000);
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+describe('/mcp method handling (ADR 002)', () => {
+  const mcp = (init: RequestInit & { headers?: Record<string, string> }) =>
+    app.app.request('/mcp', {
+      ...init,
+      headers: { 'x-forwarded-for': '10.7.1.1', ...init.headers }
+    });
+
+  it('GET is 405 + Allow: POST (no long-lived SSE stream)', async () => {
+    const res = await mcp({ method: 'GET', headers: { accept: 'text/event-stream' } });
+    expect(res.status).toBe(405);
+    expect(res.headers.get('allow')).toBe('POST');
+    expect(res.headers.get('content-type')).toContain('application/json');
+    const body = await readJson(res);
+    expect(body.jsonrpc).toBe('2.0');
+    expect(body.error.code).toBe(-32000);
+  });
+
+  it('GET with Accept: application/json is 405, not 500', async () => {
+    const res = await mcp({ method: 'GET', headers: { accept: 'application/json' } });
+    expect(res.status).toBe(405);
+    expect(res.headers.get('allow')).toBe('POST');
+  });
+
+  it('DELETE is 405', async () => {
+    const res = await mcp({ method: 'DELETE' });
+    expect(res.status).toBe(405);
+    expect(res.headers.get('allow')).toBe('POST');
+  });
+
+  it('a malformed (non-JSON) POST body is a 400 JSON-RPC parse error, not a 500', async () => {
+    const res = await mcp({
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        accept: 'application/json, text/event-stream',
+        authorization: `Bearer ${apiKey}`
+      },
+      body: 'this is not json {'
+    });
+    expect(res.status).toBe(400);
+    const body = await readJson(res);
+    expect(body.jsonrpc).toBe('2.0');
+    expect(body.error.code).toBe(-32700);
+  });
+
+  it('a non-JSON-RPC JSON POST body is a 400 JSON-RPC error, not a 500', async () => {
+    const res = await mcp({
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        accept: 'application/json, text/event-stream',
+        authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify({ hello: 'world' })
+    });
+    expect(res.status).toBe(400);
+    const body = await readJson(res);
+    expect(body.jsonrpc).toBe('2.0');
+    expect([-32700, -32600]).toContain(body.error.code);
+  });
+
+  it('a valid initialize POST still works (stateless one-server-per-POST)', async () => {
+    const res = await mcp({
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        accept: 'application/json, text/event-stream',
+        authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'initialize',
+        params: {
+          protocolVersion: '2025-06-18',
+          capabilities: {},
+          clientInfo: { name: 'm9-test', version: '0.0.0' }
+        }
+      })
+    });
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    expect(body.result.serverInfo.name).toBeTruthy();
+  });
+
+  it('an unauthenticated POST still answers the RFC 9728 challenge', async () => {
+    const res = await mcp({ method: 'POST', headers: { 'content-type': 'application/json' } });
+    expect(res.status).toBe(401);
+    expect(res.headers.get('www-authenticate')).toContain('resource_metadata');
+  });
+});
+
+describe('non-UUID {id} path params answer clean 4xx, never a PG-cast 500', () => {
+  const cases: Array<{ name: string; method: string; path: string; body?: unknown }> = [
+    {
+      name: 'PATCH /members/{id}',
+      method: 'PATCH',
+      path: '/api/v1/members/not-a-uuid',
+      body: { role: 'member' }
+    },
+    { name: 'DELETE /members/{id}', method: 'DELETE', path: '/api/v1/members/not-a-uuid' },
+    { name: 'POST /members/{id}/reset-link', method: 'POST', path: '/api/v1/members/not-a-uuid/reset-link' },
+    {
+      name: 'POST /members/{id}/change-email-link',
+      method: 'POST',
+      path: '/api/v1/members/not-a-uuid/change-email-link',
+      body: { newEmail: 'x@m9.test' }
+    },
+    { name: 'DELETE /api-keys/{id}', method: 'DELETE', path: '/api/v1/api-keys/not-a-uuid' },
+    { name: 'DELETE /invitations/{id}', method: 'DELETE', path: '/api/v1/invitations/not-a-uuid' },
+    { name: 'GET /files/{id}', method: 'GET', path: '/api/v1/files/not-a-uuid' },
+    { name: 'DELETE /files/{id}', method: 'DELETE', path: '/api/v1/files/not-a-uuid' }
+  ];
+
+  for (const { name, method, path, body } of cases) {
+    it(`${name} → 400 validation_error`, async () => {
+      const res = await app.app.request(path, {
+        method,
+        headers: { 'content-type': 'application/json', cookie: ownerCookie },
+        ...(body !== undefined ? { body: JSON.stringify(body) } : {})
+      });
+      expect(res.status).toBe(400);
+      expect((await readJson(res)).error.code).toBe('validation_error');
+    });
+  }
+
+  it('the literal-segment residue: DELETE /invitations/lookup → 400, not 500', async () => {
+    const res = await app.app.request('/api/v1/invitations/lookup', {
+      method: 'DELETE',
+      headers: { cookie: ownerCookie }
+    });
+    expect(res.status).toBe(400);
+    expect((await readJson(res)).error.code).toBe('validation_error');
+  });
+
+  it('the plain-Hono content routes 404 a non-UUID id (GET and HEAD)', async () => {
+    const get = await app.app.request('/api/v1/files/not-a-uuid/content', {
+      headers: { cookie: ownerCookie }
+    });
+    expect(get.status).toBe(404);
+    const head = await app.app.request('/api/v1/files/not-a-uuid/content', {
+      method: 'HEAD',
+      headers: { cookie: ownerCookie }
+    });
+    expect(head.status).toBe(404);
+  });
+});
+
+describe('audit cursor range guard', () => {
+  it('ignores a cursor past bigint precision (page 1, not 500)', async () => {
+    const res = await app.app.request('/api/v1/audit?cursor=99999999999999999999', {
+      headers: { cookie: ownerCookie }
+    });
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    expect(Array.isArray(body.entries)).toBe(true);
+    expect(body.entries.length).toBeGreaterThan(0); // setup + key mint are audited
+  });
+
+  it('still ignores a NaN cursor', async () => {
+    const res = await app.app.request('/api/v1/audit?cursor=banana', {
+      headers: { cookie: ownerCookie }
+    });
+    expect(res.status).toBe(200);
+  });
+});
+
+describe('JSON 404 terminator on /api/v1', () => {
+  it('an unmatched path answers the JSON wire shape for a browser session, not the SPA', async () => {
+    const res = await app.app.request('/api/v1/definitely-not-a-route', {
+      headers: { cookie: ownerCookie }
+    });
+    expect(res.status).toBe(404);
+    expect(res.headers.get('content-type')).toContain('application/json');
+    expect((await readJson(res)).error.code).toBe('not_found');
+  });
+
+  it('an unmatched path is a JSON 404 for anonymous callers too', async () => {
+    const res = await app.app.request('/api/v1/definitely-not-a-route');
+    expect(res.status).toBe(404);
+    expect((await readJson(res)).error.code).toBe('not_found');
+  });
+
+  it('an unmatched method on /auth/* is a JSON 404, not the SPA', async () => {
+    const res = await app.app.request('/api/v1/auth/get-session', { method: 'PUT' });
+    expect(res.status).toBe(404);
+    expect((await readJson(res)).error.code).toBe('not_found');
+  });
+
+  it('machine principals still get 403 endpoint_not_allowed first', async () => {
+    const res = await app.app.request('/api/v1/definitely-not-a-route', {
+      headers: { authorization: `Bearer ${apiKey}` }
+    });
+    expect(res.status).toBe(403);
+    expect((await readJson(res)).error.code).toBe('endpoint_not_allowed');
+  });
+
+  it('the SPA fallback still serves non-API paths', async () => {
+    const res = await app.app.request('/dashboard-route');
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toContain('text/html');
+  });
+});
+
+describe('sign-in Origin hardening (login CSRF)', () => {
+  const signIn = (extraHeaders: Record<string, string>, ip: string) =>
+    app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: OWNER.email, password: OWNER.password }, { 'x-forwarded-for': ip, ...extraHeaders })
+    );
+
+  it('rejects a foreign Origin on sign-in', async () => {
+    const res = await signIn({ origin: 'https://evil.com' }, '10.7.2.1');
+    expect(res.status).toBe(403);
+  });
+
+  it('accepts the configured public origin', async () => {
+    const res = await signIn({ origin: 'http://localhost:3000' }, '10.7.2.2');
+    expect(res.status).toBe(200);
+  });
+
+  it('accepts an origin-less (CLI-style) sign-in', async () => {
+    const res = await signIn({}, '10.7.2.3');
+    expect(res.status).toBe(200);
+  });
+});