@antasphere/chassis-server 1.0.0

package/test/integration/zz-adv-replay-owner.test.ts

@@ -0,0 +1,205 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { appendFileSync } from 'node:fs';
+import { join } from 'node:path';
+import pg from 'pg';
+import {
+  createDatabase,
+  createTestApp,
+  readJson,
+  startPostgres,
+  SETUP_TOKEN,
+  type TestApp
+} from './helpers.js';
+
+/**
+ * PRDCT-1809 (found by the adversarial e2e pass of 2026-08-29, red repro on
+ * adv/sl-e2e@c3d1416): the boot-time tombstone replay when the erased
+ * subject is the SOLE active owner in the restored dump.
+ *
+ * Before the fix the replay called the cascade OUTSIDE the last-owner guard:
+ * the 0009 trigger refused the membership delete mid-cascade, the error was
+ * swallowed, boot continued (readyz 200, PII back, password working, no
+ * audit row) and — because Better Auth drops the account rows BEFORE the
+ * user row — the owner was left half-erased (no credential, membership
+ * intact).
+ *
+ * The contract now: FAIL CLOSED. The guard refuses before any row is
+ * touched; the boot audits the refusal, keeps /readyz red with the reason
+ * and CLOSES the service surface (503 service_closed on every route but the
+ * probes) until an operator promotes another owner and restarts, at which
+ * point the replay erases the subject under the guard and the instance
+ * serves.
+ */
+const OWNER = { email: 'alice@adv.test', name: 'Alice', password: 'alice-password-12345' };
+const BOB_ID = 'bob-adv-restore-0001';
+const json = (body: unknown) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json' },
+  body: JSON.stringify(body)
+});
+
+let container: StartedPostgreSqlContainer;
+beforeAll(async () => {
+  container = await startPostgres();
+}, 180_000);
+afterAll(async () => {
+  await container?.stop();
+});
+
+async function seedMember(a: TestApp, id: string, email: string): Promise<string> {
+  await a.db.pool.query(
+    `INSERT INTO "user" (id, name, email, email_verified, created_at, updated_at)
+     VALUES ($1, $2, $3, true, now(), now())`,
+    [id, id, email]
+  );
+  await a.db.pool.query(
+    `INSERT INTO account (id, user_id, provider_id, account_id, password, created_at, updated_at)
+     VALUES ($1, $2, 'credential', $3, 'hash', now(), now())`,
+    [`acc-${id}`, id, id]
+  );
+  const ws = await a.db.pool.query<{ id: string }>(`SELECT id FROM workspaces LIMIT 1`);
+  await a.db.pool.query(
+    `INSERT INTO workspace_members (workspace_id, user_id, role, origin, is_active)
+     VALUES ($1, $2, 'member', 'local', true)`,
+    [ws.rows[0]!.id, id]
+  );
+  return ws.rows[0]!.id;
+}
+
+describe('PRDCT-1809: tombstone replay when the erased subject is the sole active owner in the restored dump', () => {
+  it('fails CLOSED: nothing touched, refusal audited, readiness red, the service surface 503s; a promoted owner + restart erases and serves', async () => {
+    const url = await createDatabase(container, 'adv_replay_owner');
+    let app: TestApp = await createTestApp(url);
+    const dataDir = app.env.DATA_DIR;
+    const setup = await app.app.request(
+      '/api/v1/setup',
+      json({ setupToken: SETUP_TOKEN, instanceName: 'Adv', owner: OWNER })
+    );
+    expect(setup.status).toBe(201);
+    const { ownerUserId } = await readJson(setup);
+    // Bob is a plain member in the OLDER dump being restored.
+    const workspaceId = await seedMember(app, BOB_ID, 'bob@adv.test');
+
+    // The live timeline: Alice promoted Bob, Bob erased Alice → tombstone.
+    // The dump predates the promotion: Alice is still the sole active owner.
+    appendFileSync(
+      join(dataDir, 'erasures.jsonl'),
+      JSON.stringify({ userId: ownerUserId, emailHash: 'x', at: new Date().toISOString() }) + '\n'
+    );
+    await app.stop();
+
+    // ── Boot 1: the refusal ───────────────────────────────────────────────
+    app = await createTestApp(url, { DATA_DIR: dataDir });
+    try {
+      expect(app.state.ready).toBe(false);
+      expect(app.state.closed).toMatch(/erasure tombstone/);
+
+      const ready = await app.app.request('/readyz');
+      expect(ready.status).toBe(503);
+      const readyBody = await readJson(ready);
+      expect(readyBody).toMatchObject({
+        status: 'unavailable',
+        reason: expect.stringContaining('erasure tombstone')
+      });
+      // Coarse on purpose: the probe is unauthenticated and the subject asked to be forgotten.
+      expect(JSON.stringify(readyBody)).not.toContain(ownerUserId);
+      expect(JSON.stringify(readyBody)).not.toContain(OWNER.email);
+      // …but the remedy names the cause the operator faces: a last-owner refusal, not a generic failure.
+      expect(readyBody.reason).toContain('promote another member to owner');
+      expect(readyBody.reason).not.toContain('re-erasure(s) failed');
+      expect((await app.app.request('/healthz')).status).toBe(200);
+
+      // The surface is CLOSED: the resurrected owner cannot sign in, nothing else serves either.
+      const signIn = await app.app.request(
+        '/api/v1/auth/sign-in/email',
+        json({ email: OWNER.email, password: OWNER.password })
+      );
+      expect(signIn.status).toBe(503);
+      expect(await readJson(signIn)).toMatchObject({ error: { code: 'service_closed' } });
+      expect((await app.app.request('/api/v1/me')).status).toBe(503);
+      // Every other mount is behind the closure too: the dashboard, the share-link
+      // viewer, MCP, discovery, static assets.
+      for (const path of [
+        '/',
+        '/v/not-a-real-secret/',
+        '/mcp',
+        '/.well-known/openid-configuration',
+        '/favicon.ico'
+      ]) {
+        const res = await app.app.request(path, { headers: { accept: 'text/html' } });
+        expect(res.status, path).toBe(503);
+      }
+
+      // NOTHING was touched: no half-erased owner (credential, membership, row all intact).
+      const acc = await app.db.pool.query(`SELECT count(*)::int AS n FROM account WHERE user_id = $1`, [
+        ownerUserId
+      ]);
+      const mem = await app.db.pool.query(
+        `SELECT count(*)::int AS n FROM workspace_members WHERE user_id = $1`,
+        [ownerUserId]
+      );
+      const u = await app.db.pool.query(`SELECT email FROM "user" WHERE id = $1`, [ownerUserId]);
+      expect(acc.rows[0].n).toBe(1);
+      expect(mem.rows[0].n).toBe(1);
+      expect(u.rows).toHaveLength(1);
+
+      // The refusal is on the record; no replay row was minted.
+      const audit = await app.db.pool.query<{
+        action: string;
+        actor_via: string | null;
+        resource_id: string;
+      }>(`SELECT action, actor_via, resource_id FROM audit_log WHERE action LIKE 'user.erasure_replay%'`);
+      expect(audit.rows).toEqual([
+        { action: 'user.erasure_replay_refused', actor_via: 'system', resource_id: ownerUserId }
+      ]);
+    } finally {
+      await app.stop();
+    }
+
+    // ── The operator's remedy (the runbook's psql statement), then restart ──
+    const operator = new pg.Client({ connectionString: url });
+    await operator.connect();
+    try {
+      await operator.query(
+        `UPDATE workspace_members SET role = 'owner', is_active = true WHERE workspace_id = $1 AND user_id = $2`,
+        [workspaceId, BOB_ID]
+      );
+    } finally {
+      await operator.end();
+    }
+
+    // ── Boot 2: the replay applies under the guard and the instance serves ─
+    app = await createTestApp(url, { DATA_DIR: dataDir });
+    try {
+      expect(app.state.closed).toBeNull();
+      expect((await app.app.request('/readyz')).status).toBe(200);
+      const users = await app.db.pool.query(`SELECT 1 FROM "user" WHERE id = $1`, [ownerUserId]);
+      expect(users.rows).toHaveLength(0);
+      const mem = await app.db.pool.query(`SELECT 1 FROM workspace_members WHERE user_id = $1`, [
+        ownerUserId
+      ]);
+      expect(mem.rows).toHaveLength(0);
+      const signIn = await app.app.request(
+        '/api/v1/auth/sign-in/email',
+        json({ email: OWNER.email, password: OWNER.password })
+      );
+      expect(signIn.status).not.toBe(200);
+      const audit = await app.db.pool.query<{ action: string }>(
+        `SELECT action FROM audit_log WHERE action LIKE 'user.erasure_replay%' ORDER BY created_at`
+      );
+      expect(audit.rows.map((r) => r.action)).toEqual([
+        'user.erasure_replay_refused',
+        'user.erasure_replayed'
+      ]);
+      // Bob owns the workspace; the workspace kept an active owner throughout.
+      const owners = await app.db.pool.query<{ user_id: string }>(
+        `SELECT user_id FROM workspace_members WHERE workspace_id = $1 AND role = 'owner' AND is_active`,
+        [workspaceId]
+      );
+      expect(owners.rows.map((r) => r.user_id)).toEqual([BOB_ID]);
+    } finally {
+      await app.stop();
+    }
+  }, 180_000);
+});

package/test/unit/apikey-peppers.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, it } from 'vitest';
+import { buildPepperRegistry, parseApiKeyPeppers } from '@antasphere/chassis-server/apikeys';
+import { buildEnvSchema } from '@antasphere/chassis-server/env';
+
+// The chassis schema alone: API_KEY_PEPPERS is a chassis key.
+const envSchema = buildEnvSchema({ version: '0.0.0-test' });
+
+const AUTH_SECRET = 'unit-auth-secret-0123456789abcdef0123456789abcdef';
+const SECRET_A = 'pepper-secret-a-0123456789abcdef0123456789abcdef';
+const SECRET_B = 'pepper-secret-b-0123456789abcdef0123456789abcdef';
+
+describe('buildPepperRegistry', () => {
+  it('zero-config: registry is exactly { 1: authSecret }, current = 1', () => {
+    const registry = buildPepperRegistry(AUTH_SECRET);
+    expect(registry.current).toBe(1);
+    expect(registry.v1Pinned).toBe(false);
+    // Version 1 IS the auth secret verbatim — the pre-versioning pepper.
+    expect(registry.get(1)).toBe(AUTH_SECRET);
+    expect(registry.get(2)).toBeUndefined();
+    expect(registry.get(0)).toBeUndefined();
+  });
+
+  it('adding a version keeps v1 = authSecret and mints under the highest', () => {
+    const registry = buildPepperRegistry(AUTH_SECRET, `2:${SECRET_A}`);
+    expect(registry.current).toBe(2);
+    expect(registry.v1Pinned).toBe(false);
+    expect(registry.get(1)).toBe(AUTH_SECRET);
+    expect(registry.get(2)).toBe(SECRET_A);
+  });
+
+  it('pinning version 1 overrides the AUTH_SECRET default (the rotation prerequisite)', () => {
+    const registry = buildPepperRegistry(
+      'rotated-auth-secret-now-something-else-entirely',
+      `1:${SECRET_A};2:${SECRET_B}`
+    );
+    expect(registry.current).toBe(2);
+    expect(registry.v1Pinned).toBe(true);
+    expect(registry.get(1)).toBe(SECRET_A);
+    expect(registry.get(2)).toBe(SECRET_B);
+  });
+
+  it('current is the highest version regardless of entry order', () => {
+    const registry = buildPepperRegistry(AUTH_SECRET, `3:${SECRET_B};2:${SECRET_A}`);
+    expect(registry.current).toBe(3);
+  });
+
+  it('an unknown version yields undefined — the caller fails closed', () => {
+    const registry = buildPepperRegistry(AUTH_SECRET, `2:${SECRET_A}`);
+    expect(registry.get(7)).toBeUndefined();
+  });
+});
+
+describe('parseApiKeyPeppers', () => {
+  it('tolerates whitespace and trailing separators', () => {
+    const map = parseApiKeyPeppers(` 1:${SECRET_A}; 2:${SECRET_B} ;`);
+    expect(map.get(1)).toBe(SECRET_A);
+    // Trailing whitespace after the secret survives the entry trim only at
+    // the edges — the secret itself is taken verbatim after the first colon.
+    expect(map.get(2)).toBe(`${SECRET_B}`);
+  });
+
+  it('splits each entry at the FIRST colon so secrets may contain colons', () => {
+    const secretWithColon = `left:${SECRET_A}`;
+    const map = parseApiKeyPeppers(`2:${secretWithColon}`);
+    expect(map.get(2)).toBe(secretWithColon);
+  });
+
+  it.each([
+    ['no colon', 'abcdef'],
+    ['empty version', `:${SECRET_A}`],
+    ['non-integer version', `two:${SECRET_A}`],
+    ['version 0', `0:${SECRET_A}`],
+    ['version beyond smallint', `32768:${SECRET_A}`],
+    ['duplicate version', `2:${SECRET_A};2:${SECRET_B}`],
+    ['short secret', '2:tooshort'],
+    ['only separators', ' ; ; ']
+  ])('rejects %s', (_label, raw) => {
+    expect(() => parseApiKeyPeppers(raw)).toThrow();
+  });
+
+  it('never echoes the secret in the duplicate/short error messages', () => {
+    try {
+      parseApiKeyPeppers(`2:${SECRET_A};2:${SECRET_B}`);
+      expect.unreachable();
+    } catch (err) {
+      expect((err as Error).message).not.toContain(SECRET_A);
+      expect((err as Error).message).not.toContain(SECRET_B);
+    }
+  });
+});
+
+describe('env schema API_KEY_PEPPERS', () => {
+  const minimal = { DATABASE_URL: 'postgres://u:p@localhost:5432/db' };
+
+  it('is optional and blank means unset (compose VAR= convention)', () => {
+    expect(envSchema.parse(minimal).API_KEY_PEPPERS).toBeUndefined();
+    expect(envSchema.parse({ ...minimal, API_KEY_PEPPERS: '' }).API_KEY_PEPPERS).toBeUndefined();
+    expect(envSchema.parse({ ...minimal, API_KEY_PEPPERS: '  ' }).API_KEY_PEPPERS).toBeUndefined();
+  });
+
+  it('accepts a valid map and preserves it verbatim', () => {
+    const raw = `1:${SECRET_A};2:${SECRET_B}`;
+    expect(envSchema.parse({ ...minimal, API_KEY_PEPPERS: raw }).API_KEY_PEPPERS).toBe(raw);
+  });
+
+  it('refuses boot on a malformed value', () => {
+    const result = envSchema.safeParse({ ...minimal, API_KEY_PEPPERS: '2:tooshort' });
+    expect(result.success).toBe(false);
+  });
+});

package/test/unit/apikey-prefix.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest';
+import type { Db } from '@antasphere/chassis-db';
+import { ApiKeyService, buildPepperRegistry } from '@antasphere/chassis-server/apikeys';
+
+/**
+ * The key prefix is the tool's, and the service builds its key pattern from
+ * it. A prefix is matched LITERALLY: a RegExp metacharacter in it (`a.b`) must
+ * never widen the pattern, or a bearer of another shape (`axb_…`) would be
+ * taken for an API key of this tool. `isToken` is the shape check alone (no
+ * lookup), so no database is needed here; `resolve` reads the same pattern.
+ */
+const KEY_ID = 'AAAAAAAA';
+const SECRET = 'a'.repeat(43);
+const peppers = buildPepperRegistry('unit-auth-secret-0123456789abcdef0123456789abcdef');
+const service = (prefix: string) => new ApiKeyService(undefined as unknown as Db, peppers, prefix);
+
+describe('ApiKeyService key prefix', () => {
+  it('matches a prefix holding a RegExp metacharacter literally', () => {
+    const keys = service('a.b');
+    expect(keys.isToken(`a.b_${KEY_ID}_${SECRET}`)).toBe(true);
+    expect(keys.isToken(`axb_${KEY_ID}_${SECRET}`)).toBe(false);
+  });
+
+  it('accepts its own prefix only, in the fixed shape', () => {
+    const keys = service('thg');
+    expect(keys.isToken(`thg_${KEY_ID}_${SECRET}`)).toBe(true);
+    expect(keys.isToken(`other_${KEY_ID}_${SECRET}`)).toBe(false);
+    expect(keys.isToken(`thg_${KEY_ID}`)).toBe(false);
+  });
+
+  it('refuses to be built without a prefix', () => {
+    expect(() => service('')).toThrow('the key prefix is required');
+  });
+});

package/test/unit/audit-filters.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, it } from 'vitest';
+import { and, type SQL } from 'drizzle-orm';
+import { PgDialect } from 'drizzle-orm/pg-core';
+import { auditListQuerySchema } from '@antasphere/chassis-contract';
+import {
+  auditFilterConditions,
+  cursorId,
+  escapeLike,
+  parseActionList,
+  parseViaList
+} from '@antasphere/chassis-server/audit';
+
+/**
+ * The audit list's filters: what the contract admits, how the free-text
+ * ones become LIKE patterns, and that every admitted value lands in the
+ * WHERE as a bound parameter, never in the SQL text.
+ */
+
+const parse = (query: Record<string, string>) => auditListQuerySchema.safeParse(query);
+
+describe('the audit list query contract', () => {
+  it('admits every filter, and the page without one', () => {
+    expect(parse({}).success).toBe(true);
+    const full = parse({
+      q: 'owner@example',
+      action: 'presentation.,apikey.create,post /api/v1/things',
+      actorVia: 'session,api_key',
+      actor: 'system',
+      resourceType: 'presentation',
+      resourceId: '0f0f0f0f-0000-4000-8000-000000000000',
+      from: '2026-09-01T00:00:00.000Z',
+      to: '2026-09-19T23:59:59.999Z',
+      limit: '20'
+    });
+    expect(full.success).toBe(true);
+    if (full.success) expect(full.data.limit).toBe(20);
+  });
+
+  it('refuses control characters, an unknown via, a bad date and an oversize list', () => {
+    expect(parse({ q: 'a\u0000b' }).success).toBe(false);
+    expect(parse({ resourceType: 'x\u0007' }).success).toBe(false);
+    expect(parse({ actorVia: 'session,browser' }).success).toBe(false);
+    expect(parse({ from: 'yesterday' }).success).toBe(false);
+    expect(parse({ action: "presentation.'; drop table audit_log; --" }).success).toBe(false);
+    expect(parse({ action: Array.from({ length: 21 }, (_, i) => `a${i}.x`).join(',') }).success).toBe(false);
+    expect(parse({ actor: '' }).success).toBe(false);
+  });
+});
+
+describe('the free-text pattern', () => {
+  it('escapes the LIKE wildcards so typed text matches itself', () => {
+    expect(escapeLike('50%_done\\')).toBe('50\\%\\_done\\\\');
+    expect(escapeLike('plain')).toBe('plain');
+  });
+});
+
+describe('the action list', () => {
+  it('splits families from exact actions and drops blanks and repeats', () => {
+    expect(parseActionList('presentation.,apikey.create, ,apikey.create,member.')).toEqual({
+      exact: ['apikey.create'],
+      families: ['presentation.', 'member.']
+    });
+  });
+
+  it('splits and de-duplicates the via list', () => {
+    expect(parseViaList('session,api_key,session')).toEqual(['session', 'api_key']);
+  });
+});
+
+describe('the cursor', () => {
+  it('serves page 1 for a missing, malformed or out-of-range cursor', () => {
+    expect(cursorId(undefined)).toBeNull();
+    expect(cursorId('banana')).toBeNull();
+    expect(cursorId('0')).toBeNull();
+    expect(cursorId('99999999999999999999')).toBeNull();
+    expect(cursorId('42')).toBe(42);
+  });
+});
+
+describe('the WHERE conditions', () => {
+  const dialect = new PgDialect();
+  const render = (conditions: SQL[]) => dialect.sqlToQuery(and(...conditions)!);
+
+  it('is empty when nothing filters', () => {
+    const parsed = parse({});
+    expect(parsed.success).toBe(true);
+    if (parsed.success) expect(auditFilterConditions(parsed.data)).toEqual([]);
+  });
+
+  it('binds every value as a parameter and never inlines it into the SQL text', () => {
+    const parsed = parse({
+      q: "o'neil%",
+      action: 'presentation.,apikey.create',
+      actorVia: 'session,api_key',
+      actor: 'user-1',
+      resourceType: 'presentation',
+      resourceId: 'deck-1',
+      from: '2026-09-01T00:00:00.000Z',
+      to: '2026-09-19T00:00:00.000Z'
+    });
+    expect(parsed.success).toBe(true);
+    if (!parsed.success) return;
+    const conditions = auditFilterConditions(parsed.data);
+    // one condition per filter, AND-ed by the route
+    expect(conditions).toHaveLength(8);
+    const { sql: text, params } = render(conditions);
+    expect(text).not.toContain("o'neil");
+    expect(text).not.toContain('presentation');
+    expect(text).not.toContain('user-1');
+    expect(text).toMatch(/ilike/i);
+    expect(params).toContain("%o'neil\\%%");
+    expect(params).toContain('presentation.%');
+    expect(params).toContain('apikey.create');
+    expect(params).toContain('session');
+    expect(params).toContain('api_key');
+    expect(params).toContain('user-1');
+    expect(params).toContain('presentation');
+    expect(params).toContain('deck-1');
+    // the two instants ride as parameters too, in the driver's own shape
+    expect(params.filter((p) => typeof p === 'string' && p.startsWith('2026-09-'))).toHaveLength(2);
+  });
+
+  it('turns `system` into an IS NULL on the actor and keeps a user id as an equality', () => {
+    const system = parse({ actor: 'system' });
+    const user = parse({ actor: 'abc' });
+    expect(system.success && user.success).toBe(true);
+    if (!system.success || !user.success) return;
+    const nullCheck = render(auditFilterConditions(system.data));
+    const equality = render(auditFilterConditions(user.data));
+    expect(nullCheck.sql).toMatch(/actor_user_id" is null/);
+    expect(nullCheck.params).toEqual([]);
+    expect(equality.sql).toMatch(/actor_user_id" = \$1/);
+    expect(equality.params).toEqual(['abc']);
+  });
+});

package/test/unit/auth-origins.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, it } from 'vitest';
+import { signInOriginRefused, trustedOriginsFor } from '@antasphere/chassis-server/identity';
+
+/**
+ * PRDCT-1352, the auth-layer second locks. The host gate keeps the auth
+ * surface off the viewer hostname and the cross-site guard refuses the viewer
+ * Origin before Better Auth ever runs — so these two arms are only reachable
+ * once BOTH have regressed. That is exactly why they must be pinned on their
+ * own: the verifier proved that with gate + guard bypassed, dropping the
+ * sign-in arm turns a viewer-origin sign-in from 403 into 200 + Set-Cookie.
+ */
+const APP = 'https://app.example.com';
+const VIEWER = 'https://decks.example.net';
+
+describe('trustedOriginsFor', () => {
+  it('trusts the public origin and the serving origin', () => {
+    const fn = trustedOriginsFor(APP, []);
+    expect(fn(new Request('http://localhost:5173/api/v1/auth/get-session'))).toEqual([
+      APP,
+      'http://localhost:5173'
+    ]);
+    expect(fn()).toEqual([APP]);
+  });
+
+  it('never returns the viewer origin, even when it is the serving origin', () => {
+    const fn = trustedOriginsFor(APP, [VIEWER]);
+    expect(fn(new Request(`${VIEWER}/api/v1/auth/sign-in/email`))).toEqual([APP]);
+    // Served on the app origin, the serving origin is appended (a duplicate, harmless).
+    expect(fn(new Request(`${APP}/api/v1/auth/sign-in/email`))).toEqual([APP, APP]);
+  });
+
+  it('would not even trust the viewer origin if it were the configured public origin', () => {
+    // parseEnv refuses this shape; the filter is origin-blind on purpose.
+    expect(trustedOriginsFor(VIEWER, [VIEWER])()).toEqual([]);
+  });
+});
+
+describe('signInOriginRefused', () => {
+  const trustedApp = (o: string) => o === APP;
+
+  it('accepts the serving origin and any trusted origin', () => {
+    expect(
+      signInOriginRefused({
+        origin: 'http://localhost:5173',
+        servingOrigin: 'http://localhost:5173',
+        untrustedOrigins: [VIEWER],
+        isTrustedOrigin: trustedApp
+      })
+    ).toBe(false);
+    expect(
+      signInOriginRefused({
+        origin: APP,
+        servingOrigin: null,
+        untrustedOrigins: [VIEWER],
+        isTrustedOrigin: trustedApp
+      })
+    ).toBe(false);
+  });
+
+  it('refuses a foreign origin', () => {
+    expect(
+      signInOriginRefused({
+        origin: 'https://evil.example',
+        servingOrigin: APP,
+        untrustedOrigins: [VIEWER],
+        isTrustedOrigin: trustedApp
+      })
+    ).toBe(true);
+  });
+
+  it('refuses the viewer origin even as the serving origin AND even if the trusted list says yes', () => {
+    expect(
+      signInOriginRefused({
+        origin: VIEWER,
+        servingOrigin: VIEWER,
+        untrustedOrigins: [VIEWER],
+        isTrustedOrigin: () => true
+      })
+    ).toBe(true);
+  });
+
+  it('is unchanged when no viewer origin is configured', () => {
+    expect(
+      signInOriginRefused({
+        origin: VIEWER,
+        servingOrigin: VIEWER,
+        untrustedOrigins: [],
+        isTrustedOrigin: trustedApp
+      })
+    ).toBe(false);
+  });
+});

package/test/unit/body-cap.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, it } from 'vitest';
+import { Hono } from 'hono';
+import { deferrableBodyCap } from '../../src/middleware/body-cap.js';
+import { pendingBodyRefusal } from '../../src/middleware/body-refusal.js';
+
+/**
+ * The size cap's deferral (PRDCT-2632): on a deferring route a declared
+ * oversize body is parked for the gate and the request loses its body, so
+ * no later middleware can read a byte of it; everywhere else hono's cap
+ * answers as before (the header refusal, the mid-stream cut, the pass).
+ */
+const cap = {
+  maxBytes: 100,
+  onError: (c: { json: (b: unknown, s: 413) => Response }) =>
+    c.json({ error: { code: 'too_big', message: 'the cap' } }, 413)
+};
+
+function app(isDeferring: boolean) {
+  const seen: { pending: boolean; body: string | null; pulls: number }[] = [];
+  const a = new Hono();
+  a.use(
+    '*',
+    deferrableBodyCap(cap, () => isDeferring)
+  );
+  // A reader in the middle: the body a deferred request carries is gone.
+  a.post('/up', async (c) => {
+    const pending = Boolean(pendingBodyRefusal(c));
+    const body = c.req.raw.body ? await c.req.text() : null;
+    seen.push({ pending, body, pulls: body?.length ?? 0 });
+    const refusal = pendingBodyRefusal(c);
+    return refusal ? refusal() : c.json({ ok: true }, 201);
+  });
+  return { a, seen };
+}
+
+describe('deferrableBodyCap', () => {
+  it('on a deferring route: a declared oversize body is parked for the gate and dropped, nothing downstream reads it', async () => {
+    const { a, seen } = app(true);
+    const res = await a.request('/up', {
+      method: 'POST',
+      headers: { 'content-length': '500', 'content-type': 'application/json' },
+      body: 'x'.repeat(500)
+    });
+    expect(res.status).toBe(413); // the handler fired the parked refusal
+    expect(seen).toEqual([{ pending: true, body: null, pulls: 0 }]);
+  });
+
+  it('elsewhere: the header refusal happens at once, before any handler', async () => {
+    const { a, seen } = app(false);
+    const res = await a.request('/up', {
+      method: 'POST',
+      headers: { 'content-length': '500' },
+      body: 'x'.repeat(500)
+    });
+    expect(res.status).toBe(413);
+    expect(seen).toEqual([]);
+  });
+
+  it('a body within the cap passes untouched on either kind of route', async () => {
+    for (const deferring of [true, false]) {
+      const { a, seen } = app(deferring);
+      const res = await a.request('/up', {
+        method: 'POST',
+        headers: { 'content-length': '5' },
+        body: 'hello'
+      });
+      expect(res.status).toBe(201);
+      expect(seen).toEqual([{ pending: false, body: 'hello', pulls: 5 }]);
+    }
+  });
+
+  it('an undeclared oversize body is still cut by the cap on a deferring route', async () => {
+    const { a, seen } = app(true);
+    const stream = new ReadableStream({
+      start(controller) {
+        for (let i = 0; i < 20; i += 1) controller.enqueue(new TextEncoder().encode('y'.repeat(10)));
+        controller.close();
+      }
+    });
+    const res = await a.request('/up', { method: 'POST', body: stream, duplex: 'half' } as RequestInit);
+    expect(res.status).toBe(413);
+    expect(seen.every((s) => !s.pending)).toBe(true);
+  });
+});