@antseed/cli 0.1.179 → 0.1.180

package/dist/gateway/auth/reauth.test.js

@@ -0,0 +1,108 @@
+import assert from 'node:assert/strict';
+import { afterEach, describe, it } from 'node:test';
+import { Wallet } from 'ethers';
+import { sessionSignIn } from './db.js';
+import { enrollWallet, reauthWallet, sessionId, SoftwarePasskey, startHarness } from './test-helpers.js';
+let harness;
+afterEach(async () => {
+    await harness?.close();
+});
+const MINUTE = 60_000;
+/** Invites a member, enrolls the given passkey or wallet, and returns the signed-in browser. */
+async function enroll(h, label, credential, orgRole = 'member') {
+    if (!credential.passkey)
+        return enrollWallet(h, label, credential.wallet, orgRole);
+    const { member, token } = h.store.invite({ label, orgRole }, [['ws_default', 'admin']]);
+    const browser = h.browser();
+    const enrollment = (await browser.request('POST', '/auth/invite', { token })).body.enrollment;
+    const options = await browser.request('POST', '/auth/passkey/register/options', { enrollment });
+    const verified = await browser.request('POST', '/auth/passkey/register/verify', { enrollment, response: credential.passkey.register(options.body, `http://${browser.host}`) });
+    assert.equal(verified.status, 200, JSON.stringify(verified.body));
+    return { member, browser };
+}
+async function reauthPasskey(browser, passkey) {
+    const options = await browser.request('POST', '/auth/reauth/passkey/options', {});
+    assert.equal(options.status, 200, JSON.stringify(options.body));
+    return browser.request('POST', '/auth/reauth/passkey/verify', { response: passkey.login(options.body, `http://${browser.host}`) });
+}
+describe('console auth: re-authentication', () => {
+    it('refreshes authenticated_at on the same session with the member\'s own passkey', async () => {
+        harness = await startHarness();
+        const passkey = new SoftwarePasskey();
+        const { member, browser } = await enroll(harness, 'Owner', { passkey }, 'owner');
+        const before = sessionId(browser);
+        const signedInAt = sessionSignIn(harness.store.database, before).authenticatedAt;
+        harness.clock.now += 30 * MINUTE;
+        const options = await browser.request('POST', '/auth/reauth/passkey/options', {});
+        assert.deepEqual(options.body.allowCredentials.map((entry) => entry.id), [passkey.id], 'only this member\'s passkeys are offered');
+        const result = await browser.request('POST', '/auth/reauth/passkey/verify', { response: passkey.login(options.body, `http://${browser.host}`) });
+        assert.equal(result.status, 200, JSON.stringify(result.body));
+        assert.equal(result.body.me.member.id, member.id);
+        assert.equal(browser.lastSetCookies.length, 0, 'no new session cookie');
+        assert.equal(sessionId(browser), before);
+        assert.equal(sessionSignIn(harness.store.database, before)?.authenticatedAt, signedInAt + 30 * MINUTE);
+    });
+    it('refuses another member\'s passkey and leaves the session untouched', async () => {
+        harness = await startHarness();
+        const ownPasskey = new SoftwarePasskey();
+        const otherPasskey = new SoftwarePasskey();
+        const { browser } = await enroll(harness, 'Owner', { passkey: ownPasskey }, 'owner');
+        const { member: other } = await enroll(harness, 'Other', { passkey: otherPasskey });
+        const session = sessionId(browser);
+        const signedInAt = sessionSignIn(harness.store.database, session)?.authenticatedAt;
+        harness.clock.now += 30 * MINUTE;
+        const refused = await reauthPasskey(browser, otherPasskey);
+        assert.equal(refused.status, 403);
+        assert.equal(refused.body.error.code, 'reauth_wrong_member');
+        assert.equal(browser.lastSetCookies.length, 0);
+        assert.equal(sessionId(browser), session);
+        assert.equal(sessionSignIn(harness.store.database, session)?.authenticatedAt, signedInAt);
+        const me = await browser.request('GET', '/auth/me');
+        assert.notEqual(me.body.me.member.id, other.id, 'still signed in as the owner');
+        // A plain sign-in challenge (bound to no member) can't be used to re-authenticate.
+        const loginOptions = await browser.request('POST', '/auth/passkey/login/options', {});
+        const replayed = await browser.request('POST', '/auth/reauth/passkey/verify', { response: ownPasskey.login(loginOptions.body, `http://${browser.host}`) });
+        assert.equal(replayed.status, 400);
+        assert.equal(replayed.body.error.code, 'invalid_challenge');
+    });
+    it('refreshes with the member\'s own wallet and refuses another member\'s or an unknown one', async () => {
+        harness = await startHarness();
+        const ownWallet = Wallet.createRandom();
+        const otherWallet = Wallet.createRandom();
+        const { browser } = await enroll(harness, 'Owner', { wallet: ownWallet }, 'owner');
+        await enroll(harness, 'Other', { wallet: otherWallet });
+        const session = sessionId(browser);
+        const signedInAt = sessionSignIn(harness.store.database, session).authenticatedAt;
+        harness.clock.now += 10 * MINUTE;
+        for (const wallet of [otherWallet, Wallet.createRandom()]) {
+            const refused = await reauthWallet(browser, wallet);
+            assert.equal(refused.status, 403);
+            assert.equal(refused.body.error.code, 'reauth_wrong_member');
+            assert.equal(sessionSignIn(harness.store.database, session)?.authenticatedAt, signedInAt);
+        }
+        // A signature by a wallet other than the one the nonce was issued to.
+        const nonce = (await browser.request('POST', '/auth/reauth/wallet/nonce', { address: ownWallet.address })).body.message;
+        const forged = await browser.request('POST', '/auth/reauth/wallet/verify', { message: nonce, signature: await otherWallet.signMessage(nonce) });
+        assert.equal(forged.status, 401);
+        const ok = await reauthWallet(browser, ownWallet);
+        assert.equal(ok.status, 200, JSON.stringify(ok.body));
+        assert.equal(sessionId(browser), session);
+        assert.equal(sessionSignIn(harness.store.database, session)?.authenticatedAt, signedInAt + 10 * MINUTE);
+    });
+    it('needs a member session', async () => {
+        harness = await startHarness();
+        const anonymous = harness.browser();
+        assert.equal((await anonymous.request('POST', '/auth/reauth/wallet/nonce', { address: Wallet.createRandom().address })).status, 401);
+        assert.equal((await anonymous.request('POST', '/auth/reauth/passkey/options', {})).status, 401);
+        const key = harness.store.addKey();
+        const keySession = harness.browser();
+        await keySession.request('POST', '/auth/api-key', { key: key.secret });
+        assert.equal((await keySession.request('POST', '/auth/reauth/passkey/options', {})).status, 403);
+        // A wallet-only member has no passkey to confirm with.
+        const { browser } = await enroll(harness, 'Wallet only', { wallet: Wallet.createRandom() });
+        const options = await browser.request('POST', '/auth/reauth/passkey/options', {});
+        assert.equal(options.status, 400);
+        assert.equal(options.body.error.code, 'no_passkey');
+    });
+});
+//# sourceMappingURL=reauth.test.js.map

package/dist/gateway/auth/reauth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reauth.test.js","sourceRoot":"","sources":["../../../src/gateway/auth/reauth.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,MAAM,EAAqB,MAAM,QAAQ,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAA8B,MAAM,mBAAmB,CAAA;AAEpI,IAAI,OAAgB,CAAA;AACpB,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,MAAM,MAAM,GAAG,MAAM,CAAA;AAErB,gGAAgG;AAChG,KAAK,UAAU,MAAM,CAAC,CAAU,EAAE,KAAa,EAAE,UAAgE,EAAE,UAA8B,QAAQ;IACvJ,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,MAAO,EAAE,OAAO,CAAC,CAAA;IACnF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IACvF,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAA;IAC3B,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;IAC7F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,+BAA+B,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAC9K,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACjE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC5B,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,OAAwB;IACrE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAA;IACjF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;AACpI,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAA;QACrC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;QAChF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAE,CAAC,eAAe,CAAA;QAEjF,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAA;QACjF,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAqB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,0CAA0C,CAAC,CAAA;QAClJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QAChJ,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAA;QACvE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,eAAe,EAAE,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;IACxG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAA;QAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA;QACpF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACnF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,CAAA;QAElF,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;QACzC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,CAAA;QACzF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACnD,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAE/E,mFAAmF;QACnF,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAA;QACrF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1J,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACvC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACzC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAA;QAClF,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAE,CAAC,eAAe,CAAA;QAElF,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACnD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;YAC5D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,CAAA;QAC3F,CAAC;QAED,sEAAsE;QACtE,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QACvH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC/I,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAEhC,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;QACzC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;IACzG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE/F,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACpC,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACtE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAEhG,uDAAuD;QACvD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;QAC3F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAA;QACjF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/gateway/auth/store-integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store-integration.test.d.ts.map

package/dist/gateway/auth/store-integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-integration.test.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/store-integration.test.ts"],"names":[],"mappings":""}

package/dist/gateway/auth/store-integration.test.js

@@ -0,0 +1,100 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, it } from 'node:test';
+import { Wallet } from 'ethers';
+import { exportJWK, generateKeyPair, SignJWT, createLocalJWKSet } from 'jose';
+import { GatewayStore } from '../store.js';
+import { SoftwarePasskey, startHarness } from './test-helpers.js';
+let harness = null;
+let dataDir = null;
+afterEach(async () => {
+    await harness?.close();
+    harness = null;
+    if (dataDir)
+        rmSync(dataDir, { recursive: true, force: true });
+    dataDir = null;
+});
+function realStore() {
+    dataDir = mkdtempSync(join(tmpdir(), 'antseed-auth-'));
+    const dir = dataDir;
+    return (now) => new GatewayStore(dir, now);
+}
+describe('console auth against the real GatewayStore', () => {
+    it('claims the console, signs in, and accepts store-issued management tokens and invites', async () => {
+        harness = await startHarness({ makeStore: realStore() });
+        const store = harness.store;
+        const browser = harness.browser();
+        const token = harness.auth.createSetupLink().split('#')[1];
+        const setup = await browser.request('POST', '/auth/setup', { token, email: 'owner@example.com' });
+        assert.equal(setup.status, 200, JSON.stringify(setup.body));
+        const passkey = new SoftwarePasskey();
+        const options = await browser.request('POST', '/auth/passkey/register/options', { enrollment: setup.body.enrollment });
+        const registered = await browser.request('POST', '/auth/passkey/register/verify', {
+            enrollment: setup.body.enrollment, response: passkey.register(options.body, `http://${browser.host}`),
+        });
+        assert.equal(registered.status, 200, JSON.stringify(registered.body));
+        assert.equal(registered.body.me.member.orgRole, 'owner');
+        assert.ok(registered.body.me.workspaces.some((entry) => entry.workspace.isDefault));
+        assert.throws(() => harness.auth.createSetupLink());
+        const { secret, token: adminToken } = store.createAdminToken({ label: 'CI', scope: 'admin', createdBy: null });
+        const principal = await harness.auth.authenticate({ headers: { authorization: `Bearer ${secret}` }, socket: { remoteAddress: '127.0.0.1' } });
+        assert.deepEqual(principal, { kind: 'token', tokenId: adminToken.id, scope: 'admin' });
+        const invite = store.createInvite({ label: 'Dana', email: 'dana@example.com', orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 3_600_000, createdBy: null });
+        const enrollment = await harness.browser().request('POST', '/auth/invite', { token: invite.token });
+        assert.equal(enrollment.status, 200);
+        assert.equal(enrollment.body.label, 'Dana');
+        const key = store.createKey({ label: 'CI key', buyerIdentity: 'default', limits: { daily: null, weekly: null, monthly: 2_000_000, total: null }, expiresAt: null });
+        const keyLogin = await harness.browser().request('POST', '/auth/api-key', { key: key.secret });
+        assert.equal(keyLogin.status, 200, JSON.stringify(keyLogin.body));
+        assert.equal(keyLogin.body.me.key.workspaceId, key.key.workspaceId);
+        assert.equal(keyLogin.body.me.key.limits.monthly, '2.000000');
+    });
+    it('says why an invite or API key did not work', async () => {
+        harness = await startHarness({ makeStore: realStore() });
+        const store = harness.store;
+        const browser = harness.browser();
+        // The invite stays open until a sign-in method is registered, then it is used.
+        const used = store.createInvite({ label: 'Eli', email: null, orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 3_600_000, createdBy: null });
+        assert.equal((await browser.request('POST', '/auth/invite', { token: used.token })).status, 200);
+        const reopened = await browser.request('POST', '/auth/invite', { token: used.token });
+        assert.equal(reopened.status, 200, 'opening the link again before signing up works');
+        assert.equal(store.getMember(used.invite.memberId).status, 'invited');
+        const wallet = Wallet.createRandom();
+        const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const enrolled = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment: reopened.body.enrollment });
+        assert.equal(enrolled.status, 200, JSON.stringify(enrolled.body));
+        assert.equal(store.getMember(used.invite.memberId).status, 'active');
+        assert.notEqual(store.getInvite(used.invite.id).usedAt, null);
+        const again = await browser.request('POST', '/auth/invite', { token: used.token });
+        assert.equal(again.body.error.code, 'invite_used');
+        const expired = store.createInvite({ label: 'Fay', email: null, orgRole: 'member', workspaces: [], expiresAt: harness.clock.now - 1, createdBy: null });
+        assert.equal((await browser.request('POST', '/auth/invite', { token: expired.token })).body.error.code, 'invite_expired');
+        assert.equal((await browser.request('POST', '/auth/invite', { token: 'not-a-token' })).body.error.code, 'invalid_token');
+        const limits = { daily: null, weekly: null, monthly: null, total: null };
+        const revoked = store.createKey({ label: 'old', buyerIdentity: 'default', limits, expiresAt: null });
+        store.revokeKey(revoked.key.id);
+        assert.equal((await browser.request('POST', '/auth/api-key', { key: revoked.secret })).body.error.code, 'key_revoked');
+        const lapsed = store.createKey({ label: 'lapsed', buyerIdentity: 'default', limits, expiresAt: harness.clock.now - 1 });
+        assert.equal((await browser.request('POST', '/auth/api-key', { key: lapsed.secret })).body.error.code, 'key_expired');
+        assert.equal((await browser.request('POST', '/auth/api-key', { key: 'antseed_nope' })).body.error.code, 'invalid_key');
+    });
+    it('auto-joins an allowed domain through Cloudflare Access using the store invite path', async () => {
+        const { privateKey, publicKey } = await generateKeyPair('RS256');
+        const jwks = createLocalJWKSet({ keys: [{ ...(await exportJWK(publicKey)), kid: 'cf1', alg: 'RS256' }] });
+        harness = await startHarness({
+            makeStore: realStore(),
+            env: { ANTSEED_CF_ACCESS_TEAM_DOMAIN: 'myteam.cloudflareaccess.com', ANTSEED_CF_ACCESS_AUD: 'aud-1', ANTSEED_OIDC_ALLOWED_DOMAINS: 'acme.example' },
+            authOptions: { cloudflareAccessKeys: jwks },
+        });
+        const assertion = await new SignJWT({ email: 'new@acme.example' }).setProtectedHeader({ alg: 'RS256', kid: 'cf1' })
+            .setIssuer('https://myteam.cloudflareaccess.com').setAudience('aud-1').setSubject('s').setIssuedAt().setExpirationTime('5m').sign(privateKey);
+        const me = await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': assertion });
+        assert.equal(me.status, 200, JSON.stringify(me.body));
+        assert.equal(me.body.me.member.email, 'new@acme.example');
+        assert.equal(me.body.me.member.status, 'active');
+        assert.deepEqual(me.body.me.workspaces.map((entry) => [entry.workspace.isDefault, entry.role]), [[true, 'member']]);
+    });
+});
+//# sourceMappingURL=store-integration.test.js.map

package/dist/gateway/auth/store-integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-integration.test.js","sourceRoot":"","sources":["../../../src/gateway/auth/store-integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAY,MAAM,MAAM,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAgB,MAAM,mBAAmB,CAAA;AAE/E,IAAI,OAAO,GAAmB,IAAI,CAAA;AAClC,IAAI,OAAO,GAAkB,IAAI,CAAA;AACjC,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,KAAK,EAAE,CAAA;IACtB,OAAO,GAAG,IAAI,CAAA;IACd,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,OAAO,GAAG,IAAI,CAAA;AAChB,CAAC,CAAC,CAAA;AAEF,SAAS,SAAS;IAChB,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,OAAO,CAAA;IACnB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;QACjG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QACtH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,+BAA+B,EAAE;YAChF,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC;SACtG,CAAC,CAAA;QACF,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QACrE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAA4C,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAA;QAC1H,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;QAEpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9G,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAW,CAAC,CAAA;QACtJ,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7K,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QACnG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAE3C,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAW,CAAC,CAAA;QAC5K,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QACjE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAEjC,+EAA+E;QAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5J,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QACrF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,gDAAgD,CAAC,CAAA;QACpF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAC/G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QACtK,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QACjE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACrE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QAClF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QAElD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvJ,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAA;QACzH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;QAExH,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAW,CAAC,CAAA;QAC7G,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QACtH,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAW,CAAC,CAAA;QAChI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QACrH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACxH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;QAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAS,CAAC,EAAE,CAAC,CAAA;QAChH,OAAO,GAAG,MAAM,YAAY,CAAC;YAC3B,SAAS,EAAE,SAAS,EAAE;YACtB,GAAG,EAAE,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,cAAc,EAAE;YACnJ,WAAW,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAChH,SAAS,CAAC,qCAAqC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC/I,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC,CAAA;QAClH,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;QACzD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAChD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAA0D,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC1K,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/gateway/auth/test-helpers.d.ts

@@ -0,0 +1,167 @@
+import Database from 'better-sqlite3';
+import type { HDNodeWallet } from 'ethers';
+import * as http from 'node:http';
+import type { WorkspaceRole, WorkspaceSummary } from '../console-api/types.js';
+import { type ConsoleAuthService } from './index.js';
+import type { AuthKey, AuthMember, AuthStore, ConsoleAuthOptions, NewAuthMember } from './types.js';
+export declare function sha256(value: string): string;
+export declare class FakeStore implements AuthStore {
+    private readonly _now;
+    readonly database: Database.Database;
+    readonly members: Map<string, AuthMember>;
+    readonly roles: Map<string, Map<string, WorkspaceRole>>;
+    readonly invites: Map<string, {
+        memberId: string;
+        expiresAt: number;
+        used: boolean;
+    }>;
+    readonly keys: Map<string, AuthKey & {
+        secret: string;
+    }>;
+    readonly adminTokens: Map<string, {
+        id: string;
+        scope: "admin" | "read";
+        revokedAt: number | null;
+        lastUsedAt: number | null;
+    }>;
+    readonly workspaces: WorkspaceSummary[];
+    readonly audits: Array<{
+        actor: {
+            kind: string;
+            id: string | null;
+            label?: string | null;
+        };
+        action: string;
+        details?: Record<string, unknown>;
+    }>;
+    private _seq;
+    constructor(_now: () => number);
+    recordAudit(input: {
+        actor: {
+            kind: string;
+            id: string | null;
+            label?: string | null;
+        };
+        action: string;
+        details?: Record<string, unknown>;
+    }): void;
+    private _id;
+    addMember(input: Partial<AuthMember> & {
+        label: string;
+    }, workspaces?: Array<[string, WorkspaceRole]>): AuthMember;
+    invite(input: Partial<AuthMember> & {
+        label: string;
+    }, workspaces?: Array<[string, WorkspaceRole]>): {
+        member: AuthMember;
+        token: string;
+    };
+    addKey(input?: Partial<AuthKey>): AuthKey & {
+        secret: string;
+    };
+    setStatus(id: string, status: AuthMember['status']): void;
+    getMember(id: string): AuthMember | null;
+    findMemberByEmail(email: string): AuthMember | null;
+    memberWorkspaceRoles(memberId: string): ReadonlyMap<string, WorkspaceRole>;
+    isSetupComplete(): boolean;
+    createOwner(input: {
+        label: string;
+        email: string | null;
+    }): AuthMember;
+    liveInviteHash(memberId: string, now: number): string | null;
+    peekInvite(tokenHash: string, now: number): {
+        member: AuthMember;
+    } | null;
+    consumeInvite(tokenHash: string, now: number): AuthMember | null;
+    inviteState(tokenHash: string, now: number): 'used' | 'expired' | 'unknown';
+    findAdminTokenBySecret(secret: string): {
+        id: string;
+        scope: 'admin' | 'read';
+        revokedAt: number | null;
+    } | null;
+    touchAdminToken(id: string): void;
+    findKeyBySecret(secret: string): AuthKey | null;
+    getKey(id: string): AuthKey | null;
+    getWorkspace(id: string): WorkspaceSummary | null;
+    listWorkspaces(): WorkspaceSummary[];
+    usageStats(): {
+        requests: number;
+        spentUsdc: number;
+    };
+    createMember(input: NewAuthMember): AuthMember;
+}
+export interface Clock {
+    now: number;
+}
+export interface HarnessResponse {
+    status: number;
+    headers: http.IncomingHttpHeaders;
+    body: any;
+}
+/** A cookie jar per "browser". */
+export declare class Browser {
+    readonly harness: Harness;
+    readonly host: string;
+    readonly extraHeaders: Record<string, string>;
+    readonly cookies: Map<string, string>;
+    lastSetCookies: string[];
+    constructor(harness: Harness, host: string, extraHeaders?: Record<string, string>);
+    request(method: string, path: string, body?: unknown, headers?: Record<string, string>): Promise<HarnessResponse>;
+}
+/** The id of the console session a browser holds (the hash of its cookie). */
+export declare function sessionId(browser: Browser): string;
+/** Invites a member and enrolls `wallet` as their sign-in method; returns the signed-in browser. */
+export declare function enrollWallet(h: Harness, label: string, wallet: HDNodeWallet, orgRole?: 'owner' | 'member'): Promise<{
+    member: AuthMember;
+    browser: Browser;
+}>;
+/** Confirms the browser's session with a wallet signature; resolves to the verify answer. */
+export declare function reauthWallet(browser: Browser, wallet: HDNodeWallet): Promise<HarnessResponse>;
+export interface Harness {
+    url: string;
+    port: number;
+    store: FakeStore;
+    auth: ConsoleAuthService;
+    clock: Clock;
+    logs: string[];
+    raw(method: string, path: string, body: unknown, headers: Record<string, string>): Promise<HarnessResponse>;
+    browser(host?: string, extraHeaders?: Record<string, string>): Browser;
+    close(): Promise<void>;
+}
+/** Mirrors the console API server: principal resolution, public/allow checks, JSON bodies, ConsoleResponse/ConsoleError. */
+export declare function startHarness(options?: {
+    publicUrl?: string | null;
+    env?: Record<string, string>;
+    authOptions?: Partial<ConsoleAuthOptions>;
+    clock?: Clock;
+    /** Run against another store (e.g. the real GatewayStore); `harness.store` is then that store, typed loosely. */
+    makeStore?: (now: () => number) => AuthStore;
+}): Promise<Harness>;
+export declare class SoftwarePasskey {
+    readonly credentialId: NonSharedBuffer;
+    private readonly _privateKey;
+    private readonly _publicJwk;
+    counter: number;
+    userHandle: string | null;
+    constructor();
+    get id(): string;
+    /** `userVerified: false` clears the UV flag: the authenticator proved presence, not who is holding it. */
+    register(options: {
+        challenge: string;
+        rp: {
+            id?: string;
+        };
+        user: {
+            id: string;
+        };
+    }, origin: string, overrides?: {
+        userVerified?: boolean;
+    }): unknown;
+    login(options: {
+        challenge: string;
+        rpId?: string;
+    }, origin: string, overrides?: {
+        counter?: number;
+        userVerified?: boolean;
+    }): unknown;
+}
+//# sourceMappingURL=test-helpers.d.ts.map

package/dist/gateway/auth/test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/test-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAE1C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAGjC,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEnG,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,qBAAa,SAAU,YAAW,SAAS;IAc7B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAbjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAA2B;IAC/D,QAAQ,CAAC,OAAO,0BAAgC;IAChD,QAAQ,CAAC,KAAK,0CAAgD;IAC9D,QAAQ,CAAC,OAAO;kBAA+B,MAAM;mBAAa,MAAM;cAAQ,OAAO;OAAK;IAC5F,QAAQ,CAAC,IAAI;gBAAuC,MAAM;OAAK;IAC/D,QAAQ,CAAC,WAAW;YAAyB,MAAM;eAAS,OAAO,GAAG,MAAM;mBAAa,MAAM,GAAG,IAAI;oBAAc,MAAM,GAAG,IAAI;OAAK;IACtI,QAAQ,CAAC,UAAU,EAAE,gBAAgB,EAAE,CAGtC;IACD,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAK;IACrJ,OAAO,CAAC,IAAI,CAAI;gBAEa,IAAI,EAAE,MAAM,MAAM;IAE/C,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI;IAIlJ,OAAO,CAAC,GAAG;IAKX,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,UAAU,GAAE,KAAK,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAM,GAAG,UAAU;IAUtH,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,UAAU,GAAE,KAAK,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAM,GAAG;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAO9I,MAAM,CAAC,KAAK,GAAE,OAAO,CAAC,OAAO,CAAM,GAAG,OAAO,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;IAWlE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI;IAIzD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAIxC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAInD,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC;IAI1E,eAAe,IAAI,OAAO;IAI1B,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,UAAU;IAIvE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAO5D,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI;IAMzE,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAQhE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS;IAO3E,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAIhH,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIjC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI;IAI/C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI;IAIlC,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAIjD,cAAc,IAAI,gBAAgB,EAAE;IAIpC,UAAU,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAIrD,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU;CAG/C;AAED,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAA;IACjC,IAAI,EAAE,GAAG,CAAA;CACV;AAED,kCAAkC;AAClC,qBAAa,OAAO;IAIN,QAAQ,CAAC,OAAO,EAAE,OAAO;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAH3G,QAAQ,CAAC,OAAO,sBAA4B;IAC5C,cAAc,EAAE,MAAM,EAAE,CAAK;gBAER,OAAO,EAAE,OAAO,EAAW,IAAI,EAAE,MAAM,EAAW,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAE1G,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAqB5H;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAElD;AAED,oGAAoG;AACpG,wBAAsB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAE,OAAO,GAAG,QAAmB;;;GAQzH;AAED,6FAA6F;AAC7F,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAInG;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,SAAS,CAAA;IAChB,IAAI,EAAE,kBAAkB,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3G,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAA;IACtE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,4HAA4H;AAC5H,wBAAsB,YAAY,CAAC,OAAO,GAAE;IAC1C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACzC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,iHAAiH;IACjH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,MAAM,KAAK,SAAS,CAAA;CACxC,GAAG,OAAO,CAAC,OAAO,CAAC,CAsFxB;AA2BD,qBAAa,eAAe;IAC1B,QAAQ,CAAC,YAAY,kBAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,SAAI;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAO;;IAShC,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,0GAA0G;IAC1G,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO;IAyBxJ,KAAK,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO;CAoB5I"}