@antasphere/chassis-server 1.0.0

package/test/unit/files-head-route.test.ts

@@ -0,0 +1,155 @@
+import { describe, expect, it } from 'vitest';
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { Readable } from 'node:stream';
+import { pino } from 'pino';
+import { defineChassisContract, type Principal } from '@antasphere/chassis-contract';
+import { defineChassisRoutes } from '@antasphere/chassis-contract/routes';
+import { registerFileRoutes } from '@antasphere/chassis-server/api';
+import type { FileService } from '@antasphere/chassis-server/files';
+import type { PlatformRegistry } from '@antasphere/chassis-server/platform';
+import type { StorageDriver } from '@antasphere/chassis-server/storage';
+import { THINGS_COPY, THINGS_IDENTITY, THINGS_ROUTES_COPY } from '../host/identity.js';
+
+/**
+ * PLT-39, the half that actually matters: the REGISTERED ROUTE must answer a
+ * HEAD with metadata and no body.
+ *
+ * `head-rewrite.test.ts` pins Hono's rewrite and greps for the dead
+ * `api.on('HEAD', …)` idiom, but neither of those touches `api/files.ts` — a
+ * mutation that hardcodes `headOnly` to `false` leaves both of them green
+ * while every HEAD silently streams the whole blob again. This test drives the
+ * real handler, so the `c.req.method === 'HEAD'` derivation is covered by
+ * something that fails when it is removed.
+ */
+const { fileDeleteRoute } = defineChassisRoutes(
+  defineChassisContract({ scopes: [THINGS_IDENTITY.scopes.read] }),
+  THINGS_IDENTITY,
+  THINGS_ROUTES_COPY
+);
+
+const WORKSPACE = '11111111-2222-3333-4444-555555555555';
+const SHA = 'a'.repeat(64);
+const BODY = 'hello head';
+
+const principal = {
+  userId: 'u1',
+  workspaceId: WORKSPACE,
+  role: 'owner',
+  origin: 'member',
+  via: 'session',
+  scopes: null
+} as unknown as Principal;
+
+function app(): OpenAPIHono {
+  const api = new OpenAPIHono();
+  api.use('*', async (c, next) => {
+    c.set('principal', principal);
+    return next();
+  });
+
+  const storage: StorageDriver = {
+    name: 'local',
+    put: async () => {},
+    getStream: async () => Readable.from([Buffer.from(BODY)]),
+    exists: async () => true,
+    head: async () => ({ sizeBytes: BODY.length }),
+    delete: async () => {},
+    healthcheck: async () => {}
+  } as unknown as StorageDriver;
+
+  const service = {
+    get: async () => ({
+      id: '99999999-8888-7777-6666-555555555555',
+      workspaceId: WORKSPACE,
+      sha256: SHA,
+      sizeBytes: BODY.length,
+      contentType: 'text/plain',
+      originalName: 'head-probe.txt',
+      createdBy: 'u1',
+      createdAt: new Date()
+    })
+  } as unknown as FileService;
+
+  registerFileRoutes(api, {
+    service,
+    storage,
+    registry: { entitlements: { check: async () => ({ allowed: true }) } } as unknown as PlatformRegistry,
+    env: { MAX_FILE_SIZE_MB: 100 },
+    logger: pino({ level: 'silent' }),
+    // PRDCT-1343 made per-deck scoping a required dep. This suite exercises the
+    // HEAD route shape (PLT-39), not authorization, so it takes the operator
+    // view: undefined = unscoped, exactly what an admin/owner principal gets.
+    blobReadScope: () => undefined,
+    blobInUse: async () => false,
+    fileDeleteRoute,
+    fileInUse: THINGS_COPY.fileInUse
+  });
+  return api;
+}
+
+const CONTENT_PATH = '/files/99999999-8888-7777-6666-555555555555/content';
+
+describe('GET/HEAD /files/:id/content (one registration, verb read off the request)', () => {
+  it('answers HEAD with the metadata headers and NO body', async () => {
+    const res = await app().request(CONTENT_PATH, { method: 'HEAD' });
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-length')).toBe(String(BODY.length));
+    expect(res.headers.get('accept-ranges')).toBe('bytes');
+    expect(res.headers.get('etag')).toBe(`"${SHA}"`);
+    // The whole point: no bytes were read out of storage for a HEAD.
+    expect(await res.text()).toBe('');
+  });
+
+  it('still streams the bytes on GET — the shared handler did not go headOnly for everyone', async () => {
+    const res = await app().request(CONTENT_PATH);
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe(BODY);
+  });
+
+  it('never opens the blob stream for a HEAD', async () => {
+    let streamOpened = 0;
+    const api = new OpenAPIHono();
+    api.use('*', async (c, next) => {
+      c.set('principal', principal);
+      return next();
+    });
+    registerFileRoutes(api, {
+      service: {
+        get: async () => ({
+          id: '99999999-8888-7777-6666-555555555555',
+          workspaceId: WORKSPACE,
+          sha256: SHA,
+          sizeBytes: BODY.length,
+          contentType: 'text/plain',
+          originalName: 'head-probe.txt',
+          createdBy: 'u1',
+          createdAt: new Date()
+        })
+      } as unknown as FileService,
+      storage: {
+        name: 'local',
+        exists: async () => true,
+        getStream: async () => {
+          streamOpened++;
+          return Readable.from([Buffer.from(BODY)]);
+        }
+      } as unknown as StorageDriver,
+      registry: { entitlements: { check: async () => ({ allowed: true }) } } as unknown as PlatformRegistry,
+      env: { MAX_FILE_SIZE_MB: 100 },
+      logger: pino({ level: 'silent' }),
+      // PRDCT-1343 made per-deck scoping a required dep. This suite exercises the
+      // HEAD route shape (PLT-39), not authorization, so it takes the operator
+      // view: undefined = unscoped, exactly what an admin/owner principal gets.
+      blobReadScope: () => undefined,
+      blobInUse: async () => false,
+      fileDeleteRoute,
+      fileInUse: THINGS_COPY.fileInUse
+    });
+
+    await api.request(CONTENT_PATH, { method: 'HEAD' });
+    expect(streamOpened).toBe(0);
+    const get = await api.request(CONTENT_PATH);
+    await get.text();
+    expect(streamOpened).toBe(1);
+  });
+});

package/test/unit/files-http.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, it } from 'vitest';
+import { contentDispositionFor, parseRangeHeader } from '@antasphere/chassis-server/files';
+import { blobKey } from '@antasphere/chassis-server/storage';
+
+describe('parseRangeHeader', () => {
+  const SIZE = 100;
+
+  it('no header → full body', () => {
+    expect(parseRangeHeader(undefined, SIZE)).toEqual({ kind: 'none' });
+  });
+
+  it('closed range', () => {
+    expect(parseRangeHeader('bytes=0-3', SIZE)).toEqual({ kind: 'range', range: { start: 0, end: 3 } });
+  });
+
+  it('open-ended range', () => {
+    expect(parseRangeHeader('bytes=95-', SIZE)).toEqual({ kind: 'range', range: { start: 95, end: 99 } });
+  });
+
+  it('suffix range (last N bytes)', () => {
+    expect(parseRangeHeader('bytes=-10', SIZE)).toEqual({ kind: 'range', range: { start: 90, end: 99 } });
+  });
+
+  it('end clamped to size', () => {
+    expect(parseRangeHeader('bytes=90-500', SIZE)).toEqual({ kind: 'range', range: { start: 90, end: 99 } });
+  });
+
+  it('start beyond size → 416', () => {
+    expect(parseRangeHeader('bytes=100-', SIZE)).toEqual({ kind: 'unsatisfiable' });
+  });
+
+  it('inverted range → 416', () => {
+    expect(parseRangeHeader('bytes=50-10', SIZE)).toEqual({ kind: 'unsatisfiable' });
+  });
+
+  it('multi-range → 416 (single range only, DoS guard)', () => {
+    expect(parseRangeHeader('bytes=0-1,5-9', SIZE)).toEqual({ kind: 'unsatisfiable' });
+  });
+
+  it('non-bytes unit ignored → full body', () => {
+    expect(parseRangeHeader('items=0-5', SIZE)).toEqual({ kind: 'none' });
+  });
+
+  it('empty spec → 416', () => {
+    expect(parseRangeHeader('bytes=-', SIZE)).toEqual({ kind: 'unsatisfiable' });
+  });
+
+  it('zero-size file with any range → 416', () => {
+    expect(parseRangeHeader('bytes=-5', 0)).toEqual({ kind: 'unsatisfiable' });
+  });
+});
+
+describe('contentDispositionFor (safe serving, brief §2.6)', () => {
+  it('active content downloads: html, svg, xml never render on the app origin', () => {
+    for (const type of [
+      'text/html',
+      'image/svg+xml',
+      'application/xml',
+      'text/xml',
+      'application/xhtml+xml'
+    ]) {
+      expect(contentDispositionFor(type, 'f')).toMatch(/^attachment/);
+    }
+  });
+
+  it('passive media may render inline', () => {
+    for (const type of ['image/png', 'image/jpeg', 'video/mp4', 'application/pdf', 'text/plain']) {
+      expect(contentDispositionFor(type, 'f')).toMatch(/^inline/);
+    }
+  });
+
+  it('unknown types download', () => {
+    expect(contentDispositionFor('application/octet-stream', 'f')).toMatch(/^attachment/);
+  });
+
+  it('handles charset suffixes and sanitizes names', () => {
+    expect(contentDispositionFor('TEXT/HTML; charset=utf-8', 'a"b\\c.html')).toMatch(/^attachment/);
+    const value = contentDispositionFor('image/png', 'héllo.png');
+    expect(value).toContain('filename="h_llo.png"');
+    expect(value).toContain("filename*=UTF-8''h%C3%A9llo.png");
+  });
+});
+
+describe('blobKey', () => {
+  const WS = '123e4567-e89b-42d3-a456-426614174000';
+  const SHA = 'a'.repeat(64);
+
+  it('shards by the first two sha chars', () => {
+    expect(blobKey(WS, SHA)).toBe(`ws/${WS}/aa/${SHA}`);
+  });
+
+  it('rejects traversal-shaped inputs', () => {
+    expect(() => blobKey(WS, '../../../etc/passwd')).toThrow();
+    expect(() => blobKey('../..', SHA)).toThrow();
+    expect(() => blobKey(WS, SHA.toUpperCase())).toThrow();
+  });
+});

package/test/unit/head-rewrite.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest';
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { Hono } from 'hono';
+
+/**
+ * PLT-39: Hono answers a HEAD request by running the GET handler. A separate
+ * `app.on('HEAD', …)` registration therefore NEVER fires — which made the
+ * `headOnly` flag on the file-content route dead code, so every HEAD read the
+ * blob and streamed the whole body.
+ *
+ * Two tests: one pins the framework behaviour (so a Hono bump that changes it
+ * fails here first), one greps the API surface so the dead idiom cannot come
+ * back on a future route.
+ */
+describe('Hono HEAD handling (pinned)', () => {
+  it('runs the GET handler and never the HEAD registration', async () => {
+    const app = new Hono();
+    let getHits = 0;
+    let headHits = 0;
+    app.get('/x', (c) => {
+      getHits++;
+      return c.text('body');
+    });
+    app.on('HEAD', '/x', (c) => {
+      headHits++;
+      return c.body(null, 200);
+    });
+    const res = await app.request('/x', { method: 'HEAD' });
+    expect(res.status).toBe(200);
+    expect(getHits).toBe(1);
+    expect(headHits).toBe(0);
+  });
+
+  it('still reports HEAD as the method inside the GET handler', async () => {
+    const app = new Hono();
+    let seen = '';
+    app.get('/x', (c) => {
+      seen = c.req.method;
+      return c.text('body');
+    });
+    await app.request('/x', { method: 'HEAD' });
+    // This is the ONLY signal that survives the rewrite, so it is what the
+    // file-content route branches on.
+    expect(seen).toBe('HEAD');
+  });
+});
+
+describe('no dead HEAD registrations under /api/v1', () => {
+  it('has none', () => {
+    // The routers live in two places since the chassis extraction: the generic
+    // ones here, the tool's in the app that composes it. This audits the
+    // generic ones; the tool audits its own in its own unit suite
+    // (apps/server/test/unit/api-registrations.test.ts in the tool template).
+    const apiDirs = [join(import.meta.dirname, '../../src/api')];
+    const offenders: string[] = [];
+    const files = apiDirs.flatMap((dir) => readdirSync(dir).map((file) => join(dir, file)));
+    for (const file of files) {
+      if (!file.endsWith('.ts')) continue;
+      const source = readFileSync(file, 'utf8');
+      const code = source
+        .split('\n')
+        .filter((line) => {
+          const t = line.trim();
+          return !t.startsWith('//') && !t.startsWith('*') && !t.startsWith('/*');
+        })
+        .join('\n');
+      if (/\.on\(\s*(\[[^\]]*)?['"]HEAD['"]/.test(code)) offenders.push(file);
+    }
+    expect(offenders).toEqual([]);
+  });
+});

package/test/unit/hub-create-org.test.ts

@@ -0,0 +1,181 @@
+import { describe, expect, it, vi } from 'vitest';
+import { classifyHubOrgCreateAnswer, HubUserClient } from '@antasphere/chassis-server/identity';
+import type { GrantAccess, HubGrantService } from '@antasphere/chassis-server/identity';
+import type { Logger } from '@antasphere/chassis-server/logger';
+
+/**
+ * The ONE hub call behind POST /workspaces on cloud (PRDCT-2443):
+ * `HubUserClient.createOrg` and its pure answer classifier. The grant is a
+ * stub — what matters here is WHICH token is presented, how often, and that
+ * an ambiguous answer is never retried (a blind second POST could create a
+ * second organization).
+ */
+const ORG_ID = '7d0c9a52-3f5e-4a4b-9a57-0e6c1c2f9b11';
+const silent = { info() {}, warn() {}, error() {}, debug() {} } as unknown as Logger;
+
+function stubGrant(over: Partial<Record<'accessToken' | 'refresh', GrantAccess>> = {}) {
+  const grant = {
+    accessToken: vi.fn(
+      async (): Promise<GrantAccess> => over.accessToken ?? { kind: 'ok', accessToken: 'at-1' }
+    ),
+    refresh: vi.fn(async (): Promise<GrantAccess> => over.refresh ?? { kind: 'ok', accessToken: 'at-2' }),
+    invalidateAccess: vi.fn(),
+    prime: vi.fn()
+  };
+  return grant;
+}
+
+function client(grant: ReturnType<typeof stubGrant>, fetchImpl: typeof fetch) {
+  return new HubUserClient({
+    grant: grant as unknown as HubGrantService,
+    issuerUrl: 'https://hub.test/',
+    logger: silent,
+    timeoutMs: 1_000,
+    fetchImpl
+  });
+}
+
+const answer = (status: number, body: unknown) =>
+  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+
+describe('classifyHubOrgCreateAnswer', () => {
+  it('201 with a well-formed org is created; the role is validated, never invented', () => {
+    expect(
+      classifyHubOrgCreateAnswer(201, { org: { id: ORG_ID, name: 'Acme', role: 'owner', personal: false } })
+    ).toEqual({ kind: 'created', org: { id: ORG_ID, name: 'Acme', role: 'owner' } });
+    expect(classifyHubOrgCreateAnswer(201, { org: { id: ORG_ID, name: ' ', role: 'emperor' } })).toEqual({
+      kind: 'created',
+      org: { id: ORG_ID, name: null, role: null }
+    });
+  });
+
+  it('a 2xx without a valid org id is inconclusive — never a guessed id', () => {
+    expect(classifyHubOrgCreateAnswer(201, { org: { id: 'not-a-uuid' } })).toEqual({ kind: 'inconclusive' });
+    expect(classifyHubOrgCreateAnswer(201, {})).toEqual({ kind: 'inconclusive' });
+    expect(classifyHubOrgCreateAnswer(201, null)).toEqual({ kind: 'inconclusive' });
+  });
+
+  it('the hub cap, in either spelling and either status, is limit_reached', () => {
+    for (const status of [403, 409]) {
+      for (const code of ['org_limit_reached', 'org_cap_reached']) {
+        expect(classifyHubOrgCreateAnswer(status, { error: { code } })).toEqual({ kind: 'limit_reached' });
+      }
+    }
+  });
+
+  it('403 insufficient_scope — exactly that — is reauth_required; no other 403 is', () => {
+    expect(classifyHubOrgCreateAnswer(403, { error: { code: 'insufficient_scope' } })).toEqual({
+      kind: 'reauth_required'
+    });
+    // The same code on another status, and the hub's OTHER 403s, are not a
+    // reason to send someone through a sign-in that would change nothing.
+    expect(classifyHubOrgCreateAnswer(401, { error: { code: 'insufficient_scope' } }).kind).toBe('refused');
+    expect(classifyHubOrgCreateAnswer(403, { error: { code: 'forbidden' } }).kind).toBe('refused');
+    expect(classifyHubOrgCreateAnswer(403, { error: { code: 'endpoint_not_allowed' } }).kind).toBe('refused');
+    expect(classifyHubOrgCreateAnswer(403, null).kind).toBe('refused');
+  });
+
+  it('400/422 is invalid; any other 4xx is a definitive refusal; 5xx is inconclusive', () => {
+    expect(classifyHubOrgCreateAnswer(400, { error: { code: 'validation_error' } })).toEqual({
+      kind: 'invalid'
+    });
+    expect(classifyHubOrgCreateAnswer(422, null)).toEqual({ kind: 'invalid' });
+    expect(classifyHubOrgCreateAnswer(403, { error: { code: 'forbidden' } })).toEqual({
+      kind: 'refused',
+      status: 403,
+      code: 'forbidden'
+    });
+    expect(classifyHubOrgCreateAnswer(409, { error: { code: 'other' } })).toEqual({
+      kind: 'refused',
+      status: 409,
+      code: 'other'
+    });
+    expect(classifyHubOrgCreateAnswer(500, null)).toEqual({ kind: 'inconclusive' });
+    expect(classifyHubOrgCreateAnswer(502, 'gateway')).toEqual({ kind: 'inconclusive' });
+  });
+});
+
+describe('HubUserClient.createOrg', () => {
+  it('POSTs { name } to <hub>/api/v1/orgs with the USER grant as the bearer — and nothing naming a user', async () => {
+    const grant = stubGrant();
+    const fetchImpl = vi.fn(async () => answer(201, { org: { id: ORG_ID, name: 'Acme', role: 'owner' } }));
+    const result = await client(grant, fetchImpl as unknown as typeof fetch).createOrg('user-1', 'Acme');
+    expect(result).toEqual({ kind: 'created', org: { id: ORG_ID, name: 'Acme', role: 'owner' } });
+    expect(grant.accessToken).toHaveBeenCalledWith('user-1');
+    expect(fetchImpl).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchImpl.mock.calls[0] as unknown as [string, RequestInit];
+    expect(url).toBe('https://hub.test/api/v1/orgs');
+    expect(init.method).toBe('POST');
+    expect((init.headers as Record<string, string>).authorization).toBe('Bearer at-1');
+    // The body is the name and ONLY the name: no target-user parameter exists.
+    expect(JSON.parse(init.body as string)).toEqual({ name: 'Acme' });
+    expect(init.signal).toBeInstanceOf(AbortSignal);
+  });
+
+  it('passes the grant verdicts through without calling the hub', async () => {
+    for (const kind of ['no_link', 'grant_dead', 'inconclusive'] as const) {
+      const fetchImpl = vi.fn();
+      const result = await client(
+        stubGrant({ accessToken: { kind } }),
+        fetchImpl as unknown as typeof fetch
+      ).createOrg('user-1', 'Acme');
+      expect(result).toEqual({ kind });
+      expect(fetchImpl).not.toHaveBeenCalled();
+    }
+  });
+
+  it('a 401 earns ONE forced refresh and ONE retry with the fresh token', async () => {
+    const grant = stubGrant();
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValueOnce(answer(401, { error: { code: 'invalid_token' } }))
+      .mockResolvedValueOnce(answer(201, { org: { id: ORG_ID, name: 'Acme', role: 'owner' } }));
+    const result = await client(grant, fetchImpl as unknown as typeof fetch).createOrg('user-1', 'Acme');
+    expect(result.kind).toBe('created');
+    expect(grant.invalidateAccess).toHaveBeenCalledWith('user-1');
+    expect(grant.refresh).toHaveBeenCalledTimes(1);
+    expect(fetchImpl).toHaveBeenCalledTimes(2);
+    const retryInit = fetchImpl.mock.calls[1]?.[1] as RequestInit;
+    expect((retryInit.headers as Record<string, string>).authorization).toBe('Bearer at-2');
+  });
+
+  it('a dead grant discovered by that refresh is grant_dead; a second 401 is a refusal, not a loop', async () => {
+    const dead = stubGrant({ refresh: { kind: 'grant_dead' } });
+    const once = vi.fn(async () => answer(401, {}));
+    expect(await client(dead, once as unknown as typeof fetch).createOrg('u', 'A')).toEqual({
+      kind: 'grant_dead'
+    });
+    expect(once).toHaveBeenCalledTimes(1);
+
+    const twice = vi.fn(async () => answer(401, {}));
+    expect(await client(stubGrant(), twice as unknown as typeof fetch).createOrg('u', 'A')).toEqual({
+      kind: 'refused',
+      status: 401,
+      code: null
+    });
+    expect(twice).toHaveBeenCalledTimes(2);
+  });
+
+  it('NEVER retries a 403, a 5xx, or a network failure — the hub may have committed', async () => {
+    const cases: Array<[() => Promise<Response>, string]> = [
+      [async () => answer(403, { error: { code: 'org_limit_reached' } }), 'limit_reached'],
+      [async () => answer(403, { error: { code: 'forbidden' } }), 'refused'],
+      [async () => answer(403, { error: { code: 'insufficient_scope' } }), 'reauth_required'],
+      [async () => answer(500, { error: { code: 'internal' } }), 'inconclusive'],
+      [
+        async () => {
+          throw new TypeError('fetch failed');
+        },
+        'inconclusive'
+      ]
+    ];
+    for (const [impl, kind] of cases) {
+      const grant = stubGrant();
+      const fetchImpl = vi.fn(impl);
+      const result = await client(grant, fetchImpl as unknown as typeof fetch).createOrg('u', 'A');
+      expect(result.kind).toBe(kind);
+      expect(fetchImpl).toHaveBeenCalledTimes(1);
+      expect(grant.refresh).not.toHaveBeenCalled();
+    }
+  });
+});

package/test/unit/hub-jwt.test.ts

@@ -0,0 +1,93 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { HubJwtVerifier } from '@antasphere/chassis-server/identity';
+import { FakeHub } from '@antasphere/chassis-server/testing';
+
+/**
+ * HubJwtVerifier — the cloud edition's trust anchor for hub-minted tokens
+ * (internal/federation.md). Mirrors oauth-jwt.ts's discipline: hard issuer +
+ * audience pinning, RS256 allowlist, one forced key refresh on an unknown
+ * signature. Every rejection here is a fail-closed SSO login.
+ */
+
+const RESOURCE = 'http://localhost:3000/mcp';
+
+const USER = {
+  sub: 'hub-user-1',
+  email: 'user@hub.test',
+  workspaceId: '5f0c1f9a-1111-4222-8333-444455556666',
+  role: 'member'
+};
+
+let hub: FakeHub;
+let verifier: HubJwtVerifier;
+
+beforeAll(async () => {
+  hub = await FakeHub.start({ clientId: 'tool-things-cloud' });
+  verifier = new HubJwtVerifier(hub.issuer);
+});
+
+afterAll(async () => {
+  await hub.stop();
+});
+
+describe('HubJwtVerifier', () => {
+  it('accepts a hub-minted token and yields the org claims', async () => {
+    const token = await hub.signAccessToken(USER, RESOURCE);
+    const payload = await verifier.verify(token, RESOURCE);
+    expect(payload.sub).toBe(USER.sub);
+    expect(payload.workspace_id).toBe(USER.workspaceId);
+    expect(payload.role).toBe('member');
+    expect(payload.workspace_name).toBe('Fake Org');
+  });
+
+  it('accepts the array-shaped aud (resource + hub userinfo) by matching our element', async () => {
+    const token = await hub.signAccessToken(USER, RESOURCE);
+    // The fake mints aud = [resource, <issuer>/…/userinfo], like the real hub
+    // when openid is scoped — pinning OUR resource must still verify.
+    await expect(verifier.verify(token, RESOURCE)).resolves.toBeTruthy();
+  });
+
+  it('rejects a token minted for another resource (aud pinning)', async () => {
+    const token = await hub.signAccessToken(
+      { ...USER, overrides: { accessAud: ['http://other-tool.test/mcp'] } },
+      RESOURCE
+    );
+    await expect(verifier.verify(token, RESOURCE)).rejects.toThrow();
+  });
+
+  it('rejects a token from another issuer (iss pinning)', async () => {
+    const token = await hub.signAccessToken(
+      { ...USER, overrides: { iss: 'http://evil-hub.test' } },
+      RESOURCE
+    );
+    await expect(verifier.verify(token, RESOURCE)).rejects.toThrow();
+  });
+
+  it('rejects an expired token', async () => {
+    const token = await hub.signAccessToken({ ...USER, overrides: { expiresInSeconds: -60 } }, RESOURCE);
+    await expect(verifier.verify(token, RESOURCE)).rejects.toThrow();
+  });
+
+  it('rejects a non-JWT (opaque) token', async () => {
+    await expect(verifier.verify('opaque_not_a_jwt', RESOURCE)).rejects.toThrow();
+  });
+
+  it('survives a hub signing-key rotation (fresh JWKS on unknown kid)', async () => {
+    // Prime the key cache with the current key…
+    await verifier.verify(await hub.signAccessToken(USER, RESOURCE), RESOURCE);
+    // …rotate the hub key, then verify a token signed with the NEW key: the
+    // cached set does not know the kid, jose refetches, verification passes.
+    await hub.rotateKey();
+    const fresh = await hub.signAccessToken(USER, RESOURCE);
+    const payload = await verifier.verify(fresh, RESOURCE);
+    expect(payload.sub).toBe(USER.sub);
+  });
+
+  it('refuses a discovery document claiming a different issuer', async () => {
+    // A verifier configured to trust a DIFFERENT issuer than the one the
+    // discovery document self-reports must fail closed before trusting keys.
+    const misconfigured = new HubJwtVerifier(hub.issuer.replace('127.0.0.1', 'localhost'));
+    const token = await hub.signAccessToken(USER, RESOURCE);
+    await expect(misconfigured.verify(token, RESOURCE)).rejects.toThrow(/issuer mismatch|fetch failed/);
+  });
+});

package/test/unit/hub-sso-params.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest';
+import { ssoAuthorizationUrlParams } from '@antasphere/chassis-server/identity';
+
+/**
+ * The SL-1 authorize-params whitelist: the ONLY thing the caller-controlled
+ * `additionalData` blob may ever contribute to the hub authorize URL is the
+ * literal `prompt=none` pair (the dashboard's silent auto-connect). Every
+ * other value, key, and shape is dropped — an attacker-shaped sign-in body
+ * can never smuggle params (prompt=consent re-prompts, login_hint,
+ * request_uri, …) into the hub redirect.
+ */
+describe('ssoAuthorizationUrlParams (strict whitelist)', () => {
+  it("passes exactly { prompt: 'none' } for additionalData.prompt === 'none'", () => {
+    expect(ssoAuthorizationUrlParams({ additionalData: { prompt: 'none' } })).toEqual({ prompt: 'none' });
+  });
+
+  it('drops every other prompt value', () => {
+    for (const prompt of ['consent', 'login', 'select_account', 'NONE', 'none ', '', 0, true, null]) {
+      expect(ssoAuthorizationUrlParams({ additionalData: { prompt } }), String(prompt)).toEqual({});
+    }
+  });
+
+  it('never forwards extra additionalData keys — even next to a valid prompt', () => {
+    expect(
+      ssoAuthorizationUrlParams({
+        additionalData: { prompt: 'none', login_hint: 'a@b.c', request_uri: 'https://evil.example' }
+      })
+    ).toEqual({ prompt: 'none' });
+  });
+
+  it('answers {} for absent/malformed bodies (plain sign-ins stay param-free)', () => {
+    expect(ssoAuthorizationUrlParams(undefined)).toEqual({});
+    expect(ssoAuthorizationUrlParams(null)).toEqual({});
+    expect(ssoAuthorizationUrlParams({})).toEqual({});
+    expect(ssoAuthorizationUrlParams({ additionalData: null })).toEqual({});
+    expect(ssoAuthorizationUrlParams({ additionalData: 'none' })).toEqual({});
+    expect(ssoAuthorizationUrlParams({ additionalData: ['none'] })).toEqual({});
+  });
+});