@aria_asi/cli 0.2.40 → 0.2.41

package/src/__tests__/anthropic-oauth.test.ts

@@ -1,186 +0,0 @@
-// anthropic-oauth.test.ts — unit tests for the Anthropic login flow.
-//
-// Coverage:
-//   - _validateKey: 200 = valid, 401 = invalid, network failure = invalid
-//   - loginAnthropic: bad key gracefully returns ok: false with descriptive error
-//   - loginAnthropic: good key persists to config and returns ok: true
-//
-// Strategy: mock globalThis.fetch (Node 18+ built-in) + mock readline to avoid
-// interactive prompts. No file I/O touches real ~/.aria — we stub fs.writeFileSync.
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-
-// ── We test the exported internals directly. ─────────────────────────────────
-// anthropic-oauth.ts exports _validateKey for testability; loginAnthropic is
-// also tested end-to-end with readline + fs mocked out.
-
-// Hoist mocks before module import so Node's ESM loader sees them.
-vi.mock('node:fs', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('node:fs')>();
-  return {
-    ...actual,
-    existsSync: vi.fn(() => false),
-    mkdirSync: vi.fn(),
-    writeFileSync: vi.fn(),
-    readFileSync: vi.fn(() => '{}'),
-  };
-});
-
-vi.mock('node:readline', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('node:readline')>();
-  return {
-    ...actual,
-    createInterface: vi.fn(() => ({
-      question: vi.fn((_prompt: string, cb: (a: string) => void) => cb('sk-ant-fake-key-for-tests')),
-      close: vi.fn(),
-    })),
-  };
-});
-
-vi.mock('node:child_process', () => ({
-  spawn: vi.fn(() => ({ unref: vi.fn() })),
-}));
-
-import { _validateKey, loginAnthropic } from '../anthropic-oauth.js';
-
-// ── Helpers ───────────────────────────────────────────────────────────────────
-
-function mockFetch(status: number, body: unknown = {}): void {
-  vi.stubGlobal(
-    'fetch',
-    vi.fn().mockResolvedValue({
-      status,
-      ok: status >= 200 && status < 300,
-      json: async () => body,
-    }),
-  );
-}
-
-function mockFetchNetworkError(): void {
-  vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error("I couldn't reach Anthropic")));
-}
-
-// ── _validateKey ─────────────────────────────────────────────────────────────
-
-describe('_validateKey', () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it('returns true when Anthropic /v1/models responds 200', async () => {
-    mockFetch(200, { data: [] });
-    const result = await _validateKey('sk-ant-valid');
-    expect(result).toBe(true);
-  });
-
-  it('returns false when Anthropic /v1/models responds 401 (bad key)', async () => {
-    mockFetch(401, { error: { message: 'invalid x-api-key' } });
-    const result = await _validateKey('sk-ant-bad');
-    expect(result).toBe(false);
-  });
-
-  it('returns false when Anthropic /v1/models responds 403 (revoked key)', async () => {
-    mockFetch(403, { error: { message: 'forbidden' } });
-    const result = await _validateKey('sk-ant-revoked');
-    expect(result).toBe(false);
-  });
-
-  it('returns false on network error — does not throw', async () => {
-    mockFetchNetworkError();
-    const result = await _validateKey('sk-ant-any');
-    expect(result).toBe(false);
-  });
-
-  it('sends x-api-key and anthropic-version headers', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ status: 200, ok: true, json: async () => ({}) });
-    vi.stubGlobal('fetch', fetchMock);
-
-    await _validateKey('sk-ant-check-headers');
-
-    expect(fetchMock).toHaveBeenCalledWith(
-      'https://api.anthropic.com/v1/models',
-      expect.objectContaining({
-        headers: expect.objectContaining({
-          'x-api-key': 'sk-ant-check-headers',
-          'anthropic-version': '2023-06-01',
-        }),
-      }),
-    );
-  });
-});
-
-// ── loginAnthropic ────────────────────────────────────────────────────────────
-
-describe('loginAnthropic', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it('returns ok: false with descriptive Aria-voice error when key fails validation', async () => {
-    // readline mock returns 'sk-ant-fake-key-for-tests'; validate returns 401
-    mockFetch(401, { error: { message: 'invalid key' } });
-
-    const result = await loginAnthropic({ noBrowser: true });
-
-    expect(result.ok).toBe(false);
-    expect(result.error).toMatch(/I couldn't verify/);
-    // Ensure the error message does NOT contain internal cluster paths or IP addresses
-    expect(result.error).not.toMatch(/10\.\d+\.\d+\.\d+/);
-    expect(result.error).not.toMatch(/cluster\.local/);
-  });
-
-  it('returns ok: true and apiKey when key passes validation', async () => {
-    // readline returns 'sk-ant-fake-key-for-tests'; validate returns 200
-    mockFetch(200, { data: [{ id: 'claude-sonnet-4-20250514' }] });
-
-    const result = await loginAnthropic({ noBrowser: true });
-
-    expect(result.ok).toBe(true);
-    expect(result.apiKey).toBe('sk-ant-fake-key-for-tests');
-  });
-
-  it('returns ok: false when user pastes an empty string', async () => {
-    // Override readline mock to return empty string for this test
-    const readline = await import('node:readline');
-    vi.mocked(readline.createInterface).mockReturnValueOnce({
-      question: vi.fn((_: string, cb: (a: string) => void) => cb('')),
-      close: vi.fn(),
-    } as any);
-
-    mockFetch(200, {});
-
-    const result = await loginAnthropic({ noBrowser: true });
-
-    expect(result.ok).toBe(false);
-    // Should not proceed to validation when key is empty
-    expect(result.error).toBeTruthy();
-  });
-
-  it('returns ok: false gracefully on network failure during validation', async () => {
-    mockFetchNetworkError();
-
-    const result = await loginAnthropic({ noBrowser: true });
-
-    expect(result.ok).toBe(false);
-    // Should surface a human-readable error, not a raw Error object
-    expect(typeof result.error).toBe('string');
-    expect(result.error!.length).toBeGreaterThan(10);
-  });
-
-  it('persists apiKey to config when validation succeeds', async () => {
-    mockFetch(200, { data: [] });
-    const fs = await import('node:fs');
-
-    await loginAnthropic({ noBrowser: true });
-
-    expect(vi.mocked(fs.writeFileSync)).toHaveBeenCalledWith(
-      expect.stringContaining('config.json'),
-      expect.stringContaining('sk-ant-fake-key-for-tests'),
-      expect.objectContaining({ mode: 0o600 }),
-    );
-  });
-});

package/src/__tests__/auth-commands.test.ts

@@ -1,132 +0,0 @@
-import { login, status, logout, revoke } from '../auth-commands';
-import { loadLicense, saveLicense } from '../auth';
-import { harnessClient } from '../harness-client';
-import * as fs from 'fs';
-import * as path from 'path';
-
-jest.mock('../auth');
-jest.mock('../harness-client');
-
-const LICENSE_PATH = path.join(require('os').homedir(), '.aria', 'license.json');
-
-const mockClaims = {
-  jti: 'test-jti-123',
-  sub: 'user-test',
-  tier: 'pro',
-  exp: Math.floor(Date.now() / 1000) + 86400,
-  iat: Math.floor(Date.now() / 1000),
-};
-
-beforeEach(() => {
-  jest.clearAllMocks();
-  // Clean up any leftover license file
-  try { fs.unlinkSync(LICENSE_PATH); } catch {}
-});
-
-describe('login', () => {
-  it('should validate token and persist license', async () => {
-    (harnessClient.get as jest.Mock).mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({ claims: mockClaims }),
-    });
-
-    const result = await login('valid-token');
-
-    expect(result.ok).toBe(true);
-    expect(result.tier).toBe('pro');
-    expect(result.jti).toBe('test-jti-123');
-    expect(result.expiresAt).toBeDefined();
-
-    // Verify file was written with mode 0600
-    const written = JSON.parse(fs.readFileSync(LICENSE_PATH, 'utf-8'));
-    expect(written.jti).toBe('test-jti-123');
-  });
-
-  it('should return error on invalid token', async () => {
-    (harnessClient.get as jest.Mock).mockResolvedValue({
-      ok: false,
-      json: () => Promise.resolve({ error: 'Invalid token' }),
-    });
-
-    const result = await login('bad-token');
-    expect(result.ok).toBe(false);
-    expect(result.error).toBe('Invalid token');
-  });
-});
-
-describe('status', () => {
-  it('should return logged out when no local license', async () => {
-    (loadLicense as jest.Mock).mockReturnValue(null);
-
-    const result = await status();
-    expect(result.loggedIn).toBe(false);
-  });
-
-  it('should return status from server when licensed', async () => {
-    (loadLicense as jest.Mock).mockReturnValue(mockClaims);
-    (harnessClient.get as jest.Mock).mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: () => Promise.resolve({ claims: mockClaims }),
-    });
-
-    const result = await status();
-    expect(result.loggedIn).toBe(true);
-    expect(result.tier).toBe('pro');
-    expect(result.revoked).toBe(false);
-  });
-
-  it('should detect revoked license from 410', async () => {
-    (loadLicense as jest.Mock).mockReturnValue(mockClaims);
-    (harnessClient.get as jest.Mock).mockResolvedValue({
-      ok: false,
-      status: 410,
-    });
-
-    const result = await status();
-    expect(result.loggedIn).toBe(true);
-    expect(result.revoked).toBe(true);
-  });
-});
-
-describe('logout', () => {
-  it('should delete license file', async () => {
-    // Create a fake license file
-    fs.writeFileSync(LICENSE_PATH, JSON.stringify(mockClaims), { mode: 0o600 });
-    expect(fs.existsSync(LICENSE_PATH)).toBe(true);
-
-    const result = await logout();
-    expect(result.ok).toBe(true);
-    expect(fs.existsSync(LICENSE_PATH)).toBe(false);
-  });
-
-  it('should succeed even without license file', async () => {
-    const result = await logout();
-    expect(result.ok).toBe(true);
-  });
-});
-
-describe('revoke', () => {
-  it('should revoke license server-side and clear local', async () => {
-    (loadLicense as jest.Mock).mockReturnValue(mockClaims);
-    (harnessClient.post as jest.Mock).mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({}),
-    });
-
-    const result = await revoke('Test revocation');
-    expect(result.ok).toBe(true);
-    expect(result.jti).toBe('test-jti-123');
-    expect(harnessClient.post).toHaveBeenCalledWith('/api/license/revoke', {
-      body: { jti: 'test-jti-123', reason: 'Test revocation', revokedBy: 'self' },
-    });
-  });
-
-  it('should fail without active license', async () => {
-    (loadLicense as jest.Mock).mockReturnValue(null);
-
-    const result = await revoke();
-    expect(result.ok).toBe(false);
-    expect(result.error).toBe('No active license to revoke');
-  });
-});

package/src/__tests__/owner-login.test.ts

@@ -1,311 +0,0 @@
-/**
- * Smoke test — Phase 11 #25 owner-login mode
- *
- * Verifies the end-to-end owner-mode flow with mocked network:
- *   1. loginOwner() writes ~/.aria/owner-token with mode 0600.
- *   2. Subsequent harness requests include x-aria-owner: true.
- *   3. ownerMiddleware logic: valid JWT → isOwner=true; invalid → 401.
- *   4. /api/admin/state returns 501 when authed; 401 when not.
- *
- * No real network calls — fetch is mocked globally.
- * No real FS writes beyond the tmp owner-token path (cleaned up in afterEach).
- */
-
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import * as crypto from 'node:crypto';
-
-// ── Isolate the owner-token path to a temp dir so we don't pollute ~/.aria ──
-const TEST_ARIA_DIR = path.join(os.tmpdir(), `aria-owner-test-${process.pid}`);
-const TEST_OWNER_TOKEN_PATH = path.join(TEST_ARIA_DIR, 'owner-token');
-
-// We need to mock the OWNER_TOKEN_PATH used in the modules under test.
-// Because the path is derived from homedir() at module load time, we intercept
-// via jest.mock on the 'node:os' module to redirect homedir to our temp dir.
-jest.mock('node:os', () => ({
-  ...jest.requireActual('node:os'),
-  homedir: () => TEST_ARIA_DIR,
-}));
-
-// Mock fetch globally — no real network calls in unit tests.
-const mockFetch = jest.fn();
-global.fetch = mockFetch as any;
-
-// Import under test AFTER mocks are established.
-import { loginOwner, logout, OWNER_TOKEN_PATH } from '../auth-commands';
-
-const JWT_SECRET = 'arya-hq-jwt-secret-2026-reinationwide';
-
-/** Build a valid owner JWT signed with the default HQ_JWT_SECRET. */
-function buildOwnerJWT(overrides: { sub?: string; tier?: string; exp?: number } = {}): string {
-  const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
-  const now = Math.floor(Date.now() / 1000);
-  const payload = Buffer.from(
-    JSON.stringify({
-      sub: overrides.sub ?? 'hamza',
-      tier: overrides.tier ?? 'owner',
-      iat: now,
-      exp: overrides.exp ?? now + 365 * 24 * 3600,
-    }),
-  ).toString('base64url');
-  const sig = crypto
-    .createHmac('sha256', JWT_SECRET)
-    .update(`${header}.${payload}`)
-    .digest('base64url');
-  return `${header}.${payload}.${sig}`;
-}
-
-beforeAll(() => {
-  if (!fs.existsSync(TEST_ARIA_DIR)) {
-    fs.mkdirSync(TEST_ARIA_DIR, { recursive: true, mode: 0o700 });
-  }
-});
-
-afterEach(() => {
-  jest.clearAllMocks();
-  // Clean up owner-token between tests.
-  try { fs.unlinkSync(TEST_OWNER_TOKEN_PATH); } catch {}
-});
-
-afterAll(() => {
-  // Remove temp dir.
-  try { fs.rmSync(TEST_ARIA_DIR, { recursive: true, force: true }); } catch {}
-});
-
-// ── 1. loginOwner() writes ~/.aria/owner-token with mode 0600 ──────────────
-
-describe('loginOwner()', () => {
-  it('writes owner-token with mode 0600 on success', async () => {
-    const ownerJWT = buildOwnerJWT();
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ ok: true, token: ownerJWT, tier: 'owner', sub: 'hamza' }),
-    });
-
-    const result = await loginOwner('valid-master-token');
-
-    expect(result.ok).toBe(true);
-    expect(result.owner).toBe(true);
-    expect(result.tier).toBe('owner');
-
-    // File must exist.
-    expect(fs.existsSync(OWNER_TOKEN_PATH)).toBe(true);
-
-    // File content must be the JWT.
-    const stored = fs.readFileSync(OWNER_TOKEN_PATH, 'utf-8').trim();
-    expect(stored).toBe(ownerJWT);
-
-    // File permissions must be 0600.
-    const stat = fs.statSync(OWNER_TOKEN_PATH);
-    // mode & 0o777 masks the file-type bits, leaving only permission bits.
-    expect(stat.mode & 0o777).toBe(0o600);
-  });
-
-  it('returns error when server returns 401', async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: false,
-      status: 401,
-      json: async () => ({ ok: false, error: 'Invalid master token' }),
-    });
-
-    const result = await loginOwner('bad-master-token');
-
-    expect(result.ok).toBe(false);
-    expect(result.error).toBe('Invalid master token');
-    expect(fs.existsSync(OWNER_TOKEN_PATH)).toBe(false);
-  });
-
-  it('returns error on network failure', async () => {
-    mockFetch.mockRejectedValueOnce(new Error('ECONNREFUSED'));
-
-    const result = await loginOwner('some-token');
-
-    expect(result.ok).toBe(false);
-    expect(result.error).toContain('ECONNREFUSED');
-    expect(fs.existsSync(OWNER_TOKEN_PATH)).toBe(false);
-  });
-
-  it('posts to /auth/owner with Authorization header (master token never in body)', async () => {
-    const ownerJWT = buildOwnerJWT();
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ ok: true, token: ownerJWT }),
-    });
-
-    await loginOwner('super-secret-master');
-
-    const [url, init] = mockFetch.mock.calls[0];
-    expect(url).toContain('/auth/owner');
-    expect(init.headers['Authorization']).toBe('Bearer super-secret-master');
-    // Body must be empty (master token not in body).
-    expect(init.body).toBeUndefined();
-  });
-});
-
-// ── 2. logout() deletes owner-token ────────────────────────────────────────
-
-describe('logout()', () => {
-  it('deletes owner-token on logout', async () => {
-    fs.writeFileSync(OWNER_TOKEN_PATH, 'some-jwt', { mode: 0o600 });
-    expect(fs.existsSync(OWNER_TOKEN_PATH)).toBe(true);
-
-    const result = await logout();
-
-    expect(result.ok).toBe(true);
-    expect(fs.existsSync(OWNER_TOKEN_PATH)).toBe(false);
-  });
-
-  it('succeeds even when owner-token does not exist', async () => {
-    expect(fs.existsSync(OWNER_TOKEN_PATH)).toBe(false);
-    const result = await logout();
-    expect(result.ok).toBe(true);
-  });
-});
-
-// ── 2b. harnessClient shim attaches x-aria-owner when owner-token exists ───
-
-describe('harnessClient shim owner header injection', () => {
-  it('sends x-aria-owner: true when owner-token exists', async () => {
-    const ownerJWT = buildOwnerJWT();
-    // Write a real owner-token so the shim's ownerHeaders() picks it up.
-    fs.mkdirSync(TEST_ARIA_DIR, { recursive: true });
-    fs.writeFileSync(TEST_OWNER_TOKEN_PATH, ownerJWT, { mode: 0o600 });
-
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({}),
-    });
-
-    // Import harnessClient after the mock is set up — homedir() is mocked.
-    const { harnessClient } = await import('../harness-client');
-    await harnessClient.get('/api/test').catch(() => {});
-
-    const [_url, init] = mockFetch.mock.calls[0];
-    expect(init.headers['x-aria-owner']).toBe('true');
-    expect(init.headers['Authorization']).toBe(`Bearer ${ownerJWT}`);
-  });
-
-  afterEach(() => {
-    // Remove owner-token so other tests start clean.
-    try { fs.unlinkSync(TEST_OWNER_TOKEN_PATH); } catch {}
-    jest.resetModules(); // Force re-import with fresh module state.
-  });
-});
-
-// ── 3. ownerMiddleware JWT validation logic (unit-tested inline) ────────────
-// The middleware lives in server.ts (Express runtime). We test the JWT
-// verification logic directly here — same HMAC-HS256 algorithm.
-
-describe('owner JWT verification logic', () => {
-  function verifyOwnerJWT(
-    token: string,
-    secret: string = JWT_SECRET,
-  ): { valid: boolean; claims?: { sub?: string; tier?: string; exp?: number }; reason?: string } {
-    try {
-      const parts = token.split('.');
-      if (parts.length !== 3) return { valid: false, reason: 'wrong part count' };
-      const [headerB64, payloadB64, sigB64] = parts;
-      const expectedSig = crypto
-        .createHmac('sha256', secret)
-        .update(`${headerB64}.${payloadB64}`)
-        .digest('base64url');
-      if (sigB64 !== expectedSig) return { valid: false, reason: 'signature mismatch' };
-      const claims = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf-8'));
-      if (claims.exp && claims.exp < Math.floor(Date.now() / 1000)) {
-        return { valid: false, reason: 'expired' };
-      }
-      return { valid: true, claims };
-    } catch (e) {
-      return { valid: false, reason: String(e) };
-    }
-  }
-
-  it('validates a well-formed owner JWT with tier:owner sub:hamza', () => {
-    const jwt = buildOwnerJWT();
-    const result = verifyOwnerJWT(jwt);
-    expect(result.valid).toBe(true);
-    expect(result.claims?.tier).toBe('owner');
-    expect(result.claims?.sub).toBe('hamza');
-  });
-
-  it('rejects a JWT with wrong secret', () => {
-    const jwt = buildOwnerJWT();
-    const result = verifyOwnerJWT(jwt, 'wrong-secret');
-    expect(result.valid).toBe(false);
-    expect(result.reason).toContain('signature');
-  });
-
-  it('rejects an expired JWT', () => {
-    const expiredJWT = buildOwnerJWT({ exp: Math.floor(Date.now() / 1000) - 3600 });
-    const result = verifyOwnerJWT(expiredJWT);
-    expect(result.valid).toBe(false);
-    expect(result.reason).toBe('expired');
-  });
-
-  it('middleware logic: rejects when tier is owner but sub is not hamza (defense-in-depth)', () => {
-    const jwt = buildOwnerJWT({ sub: 'eve', tier: 'owner' });
-    const result = verifyOwnerJWT(jwt);
-    // JWT itself is valid — the middleware must ALSO check sub === 'hamza'.
-    expect(result.valid).toBe(true);
-    expect(result.claims?.sub).not.toBe('hamza');
-    // Simulate middleware check:
-    const isOwner = result.valid && result.claims?.tier === 'owner' && result.claims?.sub === 'hamza';
-    expect(isOwner).toBe(false);
-  });
-});
-
-// ── 4. Admin route gate behavior (simulated) ───────────────────────────────
-// The actual Express handler for /api/admin/state lives in api/admin/state.ts.
-// We test its exported function directly to verify 401/501 behavior.
-
-describe('admin/state handler gate', () => {
-  let handler: (req: any, res: any) => any;
-
-  beforeAll(async () => {
-    // Import the handler directly — no Express middleware chain needed.
-    const mod = await import('../../apps/arias-soul/api/admin/state.ts').catch(() => null);
-    if (!mod) {
-      // If cross-package import fails in this test runner, use a local re-implementation
-      // of the gate logic to verify the contract.
-      handler = (req, res) => {
-        if (!req.isOwner) {
-          return res.status(401).json({ ok: false, error: 'owner token required' });
-        }
-        return res.status(501).json({ ok: false, error: 'Not implemented — Phase 11 #25 follow-up task' });
-      };
-    } else {
-      handler = mod.default;
-    }
-  });
-
-  it('returns 401 when isOwner is falsy', () => {
-    const req = { isOwner: false } as any;
-    const res = {
-      _status: 0,
-      _body: null as any,
-      status(code: number) { this._status = code; return this; },
-      json(body: any) { this._body = body; return this; },
-    };
-    handler(req, res);
-    expect(res._status).toBe(401);
-    expect(res._body.error).toContain('owner token required');
-  });
-
-  it('returns 501 with TODO body when isOwner is true', () => {
-    const req = { isOwner: true } as any;
-    const res = {
-      _status: 0,
-      _body: null as any,
-      status(code: number) { this._status = code; return this; },
-      json(body: any) { this._body = body; return this; },
-    };
-    handler(req, res);
-    expect(res._status).toBe(501);
-    expect(res._body.ok).toBe(false);
-    expect(res._body.error).toContain('Not implemented');
-    // Must have TODO body, not silently no-op.
-    expect(res._body.todo).toBeDefined();
-    expect(res._body.todo.description).toBeTruthy();
-  });
-});