@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/auth/tests/getclaims.test.ts

@@ -1,780 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
-import { AuthService } from '../src/AuthService'
-import { __resetJwksCache } from '../src/jwks'
-import { BaseAuthStore } from '@aurabase/core'
-import type { AuraClientLike, User, AuraObservabilityEvent } from '@aurabase/core'
-
-// --- helpers -----------------------------------------------------------------
-
-function b64url(obj: unknown): string {
-  return btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
-}
-
-function b64urlBytes(bytes: Uint8Array): string {
-  let bin = ''
-  for (const b of bytes) bin += String.fromCharCode(b)
-  return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
-}
-
-/** Génère une paire RS256 et exporte la clé publique en JWK (avec kid). */
-async function genRs256(kid?: string): Promise<{ pair: CryptoKeyPair; jwk: JsonWebKey }> {
-  const pair = await crypto.subtle.generateKey(
-    { name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' },
-    true,
-    ['sign', 'verify'],
-  )
-  const jwk = await crypto.subtle.exportKey('jwk', pair.publicKey)
-  if (kid) (jwk as { kid?: string }).kid = kid
-  return { pair, jwk }
-}
-
-/** Signe un JWT RS256 avec la clé privée fournie. */
-async function signRs256(
-  payload: Record<string, unknown>,
-  priv: CryptoKey,
-  kid?: string,
-): Promise<string> {
-  const header = { alg: 'RS256', typ: 'JWT', ...(kid ? { kid } : {}) }
-  const signingInput = `${b64url(header)}.${b64url(payload)}`
-  const sig = await crypto.subtle.sign(
-    { name: 'RSASSA-PKCS1-v1_5' },
-    priv,
-    new TextEncoder().encode(signingInput),
-  )
-  return `${signingInput}.${b64urlBytes(new Uint8Array(sig))}`
-}
-
-/** JWT HS256 factice (signature non vérifiable localement → fallback getUser). */
-function hs256Jwt(sub = 'u1', ttlSec = 3600): string {
-  const exp = Math.floor(Date.now() / 1000) + ttlSec
-  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub, exp })}.sig`
-}
-
-/** JWT HS256 factice avec payload arbitraire (pour tester iss/aud/exp au fallback). */
-function hs256WithClaims(payload: Record<string, unknown>): string {
-  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url(payload)}.sig`
-}
-
-function fakeUser(id = 'u1'): User {
-  return {
-    id,
-    email: 't@e.com',
-    role: 'authenticated',
-    email_verified: true,
-    is_banned: false,
-    is_anonymous: false,
-    mfa_enabled: false,
-    user_metadata: {},
-    app_metadata: {},
-    created_at: '2025-01-01T00:00:00Z',
-  }
-}
-
-class FakeBC {
-  static instances: FakeBC[] = []
-  onmessage: ((e: { data: unknown }) => void) | null = null
-  posted: unknown[] = []
-  closed = false
-  constructor(public name: string) {
-    FakeBC.instances.push(this)
-  }
-  postMessage(d: unknown) {
-    this.posted.push(d)
-  }
-  close() {
-    this.closed = true
-  }
-}
-
-beforeEach(() => {
-  FakeBC.instances = []
-  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
-  // Le cache JWKS est process-global (limite connue, documentée dans jwks.ts) :
-  // on l'isole entre tests plutôt que de multiplier les baseUrls distincts.
-  __resetJwksCache()
-})
-afterEach(() => {
-  vi.useRealTimers()
-  vi.restoreAllMocks()
-  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
-  __resetJwksCache()
-})
-
-function makeAuth(
-  baseUrl: string,
-  fetchFn: typeof globalThis.fetch,
-  store = new BaseAuthStore(),
-  onEvent?: (e: AuraObservabilityEvent) => void,
-) {
-  const client: AuraClientLike = {
-    baseUrl,
-    projectId: 'p',
-    apiKey: 'k',
-    fetchFn,
-    authStore: store,
-    auth: null as unknown as AuraClientLike['auth'],
-    ...(onEvent ? { onEvent } : {}),
-  }
-  const svc = new AuthService(client, { autoRefresh: false, persistSession: false })
-  ;(client as { auth: unknown }).auth = svc
-  return { svc, client, store }
-}
-
-/** fetchFn servant un JWKS + l'endpoint /user, avec compteur de fetch JWKS. */
-function makeFetch(
-  jwks: () => { keys: JsonWebKey[] },
-  user: User = fakeUser(),
-  opts: { jwksStatus?: number; cacheControl?: string; delayMs?: number } = {},
-) {
-  const counts = { jwks: 0, user: 0 }
-  const fetchFn = (async (url: string | URL | Request) => {
-    const u = String(url)
-    if (u.includes('/.well-known/jwks.json')) {
-      counts.jwks++
-      if (opts.delayMs) await new Promise((r) => setTimeout(r, opts.delayMs))
-      const status = opts.jwksStatus ?? 200
-      if (status >= 400) return new Response('fail', { status })
-      return new Response(JSON.stringify(jwks()), {
-        status,
-        headers: {
-          'Content-Type': 'application/json',
-          'Cache-Control': opts.cacheControl ?? 'max-age=600',
-        },
-      })
-    }
-    if (u.endsWith('/user')) {
-      counts.user++
-      return new Response(JSON.stringify(user), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      })
-    }
-    return new Response('{}', { status: 200 })
-  }) as unknown as typeof globalThis.fetch
-  return { fetchFn, counts }
-}
-
-// --- tests -------------------------------------------------------------------
-
-describe('AuthService.getClaims — vérif JWT locale via JWKS', () => {
-  it('vérifie un JWT RS256 valide localement → claims', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600, role: 'authenticated' },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }))
-    const { svc } = makeAuth('http://rs256-ok.local', fetchFn)
-
-    const { data, error } = await svc.getClaims(token)
-
-    expect(error).toBeNull()
-    expect(data?.claims.sub).toBe('u1')
-    expect(data?.header.alg).toBe('RS256')
-    expect(counts.jwks).toBe(1)
-    expect(counts.user).toBe(0) // pas de fallback réseau
-  })
-
-  it('signature falsifiée → error signature_invalid', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k1',
-    )
-    // Altère le PREMIER caractère de la signature (le dernier caractère base64url
-    // ne porte que des bits de padding inutilisés → décoderait les mêmes octets).
-    const parts = token.split('.')
-    parts[2] = (parts[2][0] === 'A' ? 'B' : 'A') + parts[2].slice(1)
-    const tampered = parts.join('.')
-    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
-    const { svc } = makeAuth('http://rs256-tampered.local', fetchFn)
-
-    const { data, error } = await svc.getClaims(tampered)
-
-    expect(data).toBeNull()
-    expect((error as { code?: string })?.code).toBe('signature_invalid')
-  })
-
-  it('token expiré → error token_expired', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) - 60 },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
-    const { svc } = makeAuth('http://rs256-expired.local', fetchFn)
-
-    const { data, error } = await svc.getClaims(token)
-
-    expect(data).toBeNull()
-    expect((error as { code?: string })?.code).toBe('token_expired')
-  })
-
-  it('alg HS256 (token de session) → fallback getUser (mocké)', async () => {
-    // Chemin nominal CLIENT : le token HS256 EST celui de la session (store).
-    // getClaims() no-arg → usingStoreToken → fallback getUser autorisé.
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(hs256Jwt('u1'), 'refresh', fakeUser('u1'))
-    const { svc } = makeAuth('http://hs256.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims()
-
-    expect(error).toBeNull()
-    expect(data?.claims.sub).toBe('u1')
-    // alg non supporté → aucune tentative de fetch JWKS, fallback direct getUser.
-    expect(counts.jwks).toBe(0)
-    expect(counts.user).toBe(1)
-  })
-
-  it('LOT D : token HS256 ÉTRANGER (≠ session) → getUser(foreignToken) valide le token ÉTRANGER (pas le store)', async () => {
-    // Le store porte u_store ; on demande les claims d'un token étranger u_foreign
-    // (même projet). Avant LOT D : le SDK ne pouvait PAS cibler le token étranger
-    // (Authorization toujours écrasé par store.token) → fail-closed unverifiable_token.
-    // Après LOT D : getUser(foreignToken) envoie le token ÉTRANGER en Authorization,
-    // le backend le valide (isolation projet native) et renvoie SON identité.
-    // Preuve anti-misattribution : /user renvoie le sub du token RÉELLEMENT présenté.
-    const fetchFn = (async (url: string | URL | Request, init?: RequestInit) => {
-      const u = String(url)
-      if (u.includes('/.well-known/jwks.json')) {
-        return new Response(JSON.stringify({ keys: [] }), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json', 'Cache-Control': 'max-age=600' },
-        })
-      }
-      if (u.endsWith('/user')) {
-        // Décode le sub du JWT présenté dans Authorization (le backend validerait
-        // réellement la signature ; ici on prouve QUEL token est présenté).
-        const auth = (init?.headers as Record<string, string> | undefined)?.['Authorization'] ?? ''
-        const jwt = auth.replace(/^Bearer /, '')
-        const payload = jwt.split('.')[1] ?? ''
-        const b64 = payload.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(payload.length / 4) * 4, '=')
-        const sub = (JSON.parse(atob(b64)) as { sub?: string }).sub ?? 'unknown'
-        return new Response(JSON.stringify(fakeUser(sub)), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      }
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const store = new BaseAuthStore()
-    store.save(hs256Jwt('u_store'), 'refresh', fakeUser('u_store'))
-    const { svc } = makeAuth('http://foreign-token.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims(hs256Jwt('u_foreign'))
-
-    expect(error).toBeNull()
-    // Les claims proviennent du token ÉTRANGER validé serveur, PAS du store.
-    expect(data?.claims.sub).toBe('u_foreign')
-  })
-
-  it('LOT D : token étranger refusé par le backend (403 autre projet / invalide) → error, pas de fabrication', async () => {
-    // Isolation projet native : un token d'un AUTRE projet → 403 côté gateway.
-    // getClaims doit remonter l'AuraError, jamais fabriquer des claims.
-    const fetchFn = (async (url: string | URL | Request) => {
-      const u = String(url)
-      if (u.includes('/.well-known/jwks.json')) {
-        return new Response(JSON.stringify({ keys: [] }), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json', 'Cache-Control': 'max-age=600' },
-        })
-      }
-      if (u.endsWith('/user')) {
-        return new Response(JSON.stringify({ error: { code: 'forbidden', message: 'wrong project' } }), {
-          status: 403,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      }
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const store = new BaseAuthStore()
-    store.save(hs256Jwt('u_store'), 'refresh', fakeUser('u_store'))
-    const { svc } = makeAuth('http://foreign-403.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims(hs256Jwt('u_foreign'))
-
-    expect(data).toBeNull()
-    expect((error as { status?: number })?.status).toBe(403)
-  })
-
-  it('LOT D : getUser(jwt) valide le token passé, pas celui du store', async () => {
-    const seen: string[] = []
-    const fetchFn = (async (url: string | URL | Request, init?: RequestInit) => {
-      const u = String(url)
-      if (u.endsWith('/user')) {
-        const auth = (init?.headers as Record<string, string> | undefined)?.['Authorization'] ?? ''
-        seen.push(auth)
-        return new Response(JSON.stringify(fakeUser('u_foreign')), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      }
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const store = new BaseAuthStore()
-    store.save(hs256Jwt('u_store'), 'refresh', fakeUser('u_store'))
-    const { svc } = makeAuth('http://getuser-jwt.local', fetchFn, store)
-
-    const { data, error } = await svc.getUser('the-foreign-jwt')
-
-    expect(error).toBeNull()
-    expect(data?.id).toBe('u_foreign')
-    expect(seen).toContain('Bearer the-foreign-jwt') // le token PASSÉ, pas le store
-  })
-
-  it('JWKS vide (token de session) → fallback getUser', async () => {
-    const { pair } = await genRs256() // token RS256 SANS kid
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-    )
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1')) // token de session → fallback autorisé
-    const { svc } = makeAuth('http://jwks-empty.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims() // no-arg
-
-    expect(error).toBeNull()
-    expect(data?.claims.sub).toBe('u1')
-    expect(counts.jwks).toBe(1) // pas de kid → pas de refetch
-    expect(counts.user).toBe(1)
-  })
-
-  it('JWK malformé (kty compatible) → error signature_invalid, sans rejet ni fallback', async () => {
-    // Token RS256 valide, mais le JWKS sert une clé RSA corrompue (n/e invalides).
-    // Le match par kty la sélectionne, puis crypto.subtle.importKey *jette*.
-    const { pair } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k1',
-    )
-    const badJwk: JsonWebKey = { kty: 'RSA', kid: 'k1', n: '!!!not-base64url!!!', e: 'AQAB', alg: 'RS256' }
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [badJwk] }), fakeUser('u1'))
-    const { svc } = makeAuth('http://jwk-malformed.local', fetchFn)
-
-    // Ne doit jamais rejeter la promesse : le contrat est AuraResponse { data, error }.
-    const { data, error } = await svc.getClaims(token)
-
-    expect(data).toBeNull()
-    expect((error as { code?: string })?.code).toBe('signature_invalid')
-    expect(counts.user).toBe(0) // fail-closed : pas de fallback getUser sur JWKS corrompu
-  })
-
-  it('kid inconnu → refetch JWKS une fois, puis fallback si toujours absent', async () => {
-    const { pair } = await genRs256('unknown-kid')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'unknown-kid',
-    )
-    // JWKS toujours vide → aucune clé ne matchera, ni par kid ni par kty.
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1')) // token de session → fallback autorisé
-    const { svc } = makeAuth('http://kid-unknown.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims() // no-arg
-
-    expect(error).toBeNull()
-    expect(data?.claims.sub).toBe('u1')
-    expect(counts.jwks).toBe(2) // 1 initial + 1 refetch forcé (rotation)
-    expect(counts.user).toBe(1) // puis fallback getUser
-  })
-
-  it('rotation RS256 : kid absent mais autre clé RSA présente → fallback (jamais signature_invalid)', async () => {
-    // Token signé avec kid='k-old' ; le JWKS ne sert qu'une AUTRE clé RSA valide
-    // (kid='k-new'). selectKey borné au kid ne doit PAS sélectionner k-new (sinon
-    // verify échoue → signature_invalid SANS fallback). On veut no_matching_key →
-    // fallback getUser (le token est le token de session).
-    const { pair } = await genRs256('k-old') // clé de signature (k-old)
-    const { jwk: jwkNew } = await genRs256('k-new') // 2e paire, clé publique servie
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k-old',
-    )
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwkNew] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1')) // token de session → fallback autorisé
-    const { svc } = makeAuth('http://rs256-rotation.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims() // no-arg
-
-    expect(error).toBeNull()
-    expect(data?.claims.sub).toBe('u1')
-    expect(counts.user).toBe(1) // fallback getUser, PAS signature_invalid
-    expect(counts.jwks).toBe(2) // initial + refetch forcé (kid présent introuvable)
-  })
-})
-
-describe('AuthService.getClaims — robustesse JWKS (LOT 1)', () => {
-  it('#1 dédup in-flight : 2 getClaims concurrents cache froid → 1 seul fetch JWKS', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }), fakeUser(), { delayMs: 5 })
-    const { svc } = makeAuth('http://jwks-dedup.local', fetchFn)
-
-    const [a, b] = await Promise.all([svc.getClaims(token), svc.getClaims(token)])
-
-    expect(a.error).toBeNull()
-    expect(b.error).toBeNull()
-    expect(counts.jwks).toBe(1) // un SEUL appel réseau malgré 2 vérifs concurrentes
-  })
-
-  it('#2 cooldown : 2 tokens à kid inconnu rapprochés → 1 seul refetch forcé', async () => {
-    const { pair } = await genRs256('unknown-kid')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'unknown-kid',
-    )
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1'))
-    const { svc } = makeAuth('http://jwks-cooldown.local', fetchFn, store)
-
-    await svc.getClaims() // 1 initial + 1 refetch forcé = 2
-    await svc.getClaims() // initial servi du cache ; refetch forcé bloqué par cooldown
-
-    // Sans cooldown : 3 (le 2e appel referait un refetch forcé). Avec : borné à 2.
-    expect(counts.jwks).toBe(2)
-  })
-
-  it('#3 negative-cache : fetch KO puis re-appel < TTL → pas de 2e réseau', async () => {
-    const { pair } = await genRs256('k1')
-    const rsToken = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'), { jwksStatus: 500 })
-    const store = new BaseAuthStore()
-    store.save(rsToken, 'r', fakeUser('u1'))
-    const { svc } = makeAuth('http://jwks-negcache.local', fetchFn, store)
-
-    await svc.getClaims() // fetch réseau → 500 → jwks_fetch_failed → fallback getUser
-    await svc.getClaims() // < TTL → negative-cache → PAS de 2e réseau
-
-    expect(counts.jwks).toBe(1)
-  })
-
-  it('#4 cap max-age : max-age=999999999 plafonné (refetch après la borne haute)', async () => {
-    vi.useFakeTimers()
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 10_000_000 },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }), fakeUser(), {
-      cacheControl: 'max-age=999999999',
-    })
-    const { svc } = makeAuth('http://jwks-cap.local', fetchFn)
-
-    const r1 = await svc.getClaims(token)
-    expect(r1.error).toBeNull()
-    expect(counts.jwks).toBe(1)
-
-    // Avance de 25h : au-delà du cap 24h mais très en deçà de 999999999s.
-    vi.advanceTimersByTime(25 * 60 * 60 * 1000)
-
-    const r2 = await svc.getClaims(token)
-    expect(r2.error).toBeNull()
-    // Sans cap : toujours en cache → 1. Avec cap 24h : cache périmé → refetch → 2.
-    expect(counts.jwks).toBe(2)
-  })
-
-  it('#6 sélection no-kid : 2 clés RSA sans kid, token signé par la 2e → succès', async () => {
-    const { jwk: jwk1 } = await genRs256() // clé leurre (ne signe pas)
-    const { pair: pair2, jwk: jwk2 } = await genRs256() // clé de signature
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair2.privateKey,
-    ) // pas de kid
-    const { fetchFn } = makeFetch(() => ({ keys: [jwk1, jwk2] }))
-    const { svc } = makeAuth('http://jwks-nokid.local', fetchFn)
-
-    const { data, error } = await svc.getClaims(token)
-
-    expect(error).toBeNull()
-    expect(data?.claims.sub).toBe('u1')
-    expect(data?.header.alg).toBe('RS256')
-  })
-
-  it('#7 fallback : alg RÉEL du token (RS256), pas HS256 en dur ; exp non fabriqué', async () => {
-    // Vrai token RS256 en session, mais fetch JWKS KO → fallback getUser.
-    const { pair } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn } = makeFetch(() => ({ keys: [] }), fakeUser('u1'), { jwksStatus: 503 })
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1'))
-    const { svc } = makeAuth('http://jwks-fallback-alg.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims()
-
-    expect(error).toBeNull()
-    expect(data?.header.alg).toBe('RS256') // alg réel décodé, PAS 'HS256' en dur
-    // Honnêteté de type : le fallback ne fabrique pas d'exp/iat.
-    expect(data?.claims.exp).toBeUndefined()
-    expect(data?.claims.iat).toBeUndefined()
-  })
-
-  it('#7b local RS256 : exp présent (number) sur le chemin de vérif locale', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const exp = Math.floor(Date.now() / 1000) + 3600
-    const token = await signRs256({ sub: 'u1', exp }, pair.privateKey, 'k1')
-    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
-    const { svc } = makeAuth('http://jwks-local-exp.local', fetchFn)
-
-    const { data } = await svc.getClaims(token)
-
-    expect(typeof data?.claims.exp).toBe('number')
-    expect(data?.claims.exp).toBe(exp)
-  })
-
-  it('#8 issuer/audience : validés sur le chemin local (RS256)', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      {
-        sub: 'u1',
-        exp: Math.floor(Date.now() / 1000) + 3600,
-        iss: 'https://issuer.a',
-        aud: 'aud-1',
-      },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
-    const { svc } = makeAuth('http://jwks-issaud.local', fetchFn)
-
-    const ok = await svc.getClaims(token, { issuer: 'https://issuer.a', audience: 'aud-1' })
-    expect(ok.error).toBeNull()
-    expect(ok.data?.claims.sub).toBe('u1')
-
-    const badIss = await svc.getClaims(token, { issuer: 'https://issuer.b' })
-    expect(badIss.data).toBeNull()
-    expect((badIss.error as { code?: string })?.code).toBe('invalid_issuer')
-
-    const badAud = await svc.getClaims(token, { audience: 'aud-2' })
-    expect(badAud.data).toBeNull()
-    expect((badAud.error as { code?: string })?.code).toBe('invalid_audience')
-  })
-})
-
-describe('AuthService.getClaims — observabilité jwks-fetch-failed (LOT 3, I8)', () => {
-  it('fetch JWKS en échec (500) → onEvent reçoit {kind:"jwks-fetch-failed", baseUrl}', async () => {
-    const { pair } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn } = makeFetch(() => ({ keys: [] }), fakeUser('u1'), { jwksStatus: 500 })
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1'))
-    const events: AuraObservabilityEvent[] = []
-    const { svc } = makeAuth('http://jwks-obs-fail.local', fetchFn, store, (e) => events.push(e))
-
-    const { error } = await svc.getClaims()
-
-    expect(error).toBeNull() // fallback getUser réussit malgré l'échec JWKS
-    expect(events).toContainEqual({
-      kind: 'jwks-fetch-failed',
-      baseUrl: 'http://jwks-obs-fail.local',
-    })
-  })
-
-  it('kid inconnu → refetch forcé qui échoue → onEvent reçoit aussi jwks-fetch-failed', async () => {
-    const { pair } = await genRs256('unknown-kid')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'unknown-kid',
-    )
-    // 1er fetch JWKS OK (cache froid, vide) ; le refetch forcé (kid inconnu) échoue.
-    let call = 0
-    const fetchFn = (async (url: string | URL | Request) => {
-      const u = String(url)
-      if (u.includes('/.well-known/jwks.json')) {
-        call++
-        if (call === 1) {
-          return new Response(JSON.stringify({ keys: [] }), {
-            status: 200,
-            headers: { 'Content-Type': 'application/json', 'Cache-Control': 'max-age=0' },
-          })
-        }
-        return new Response('fail', { status: 500 })
-      }
-      if (u.endsWith('/user')) {
-        return new Response(JSON.stringify(fakeUser('u1')), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      }
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1'))
-    const events: AuraObservabilityEvent[] = []
-    const { svc } = makeAuth('http://jwks-obs-refetch-fail.local', fetchFn, store, (e) => events.push(e))
-
-    const { error } = await svc.getClaims()
-
-    expect(error).toBeNull()
-    expect(events).toContainEqual({
-      kind: 'jwks-fetch-failed',
-      baseUrl: 'http://jwks-obs-refetch-fail.local',
-    })
-  })
-
-  it('onEvent absent : aucun throw, comportement getClaims inchangé', async () => {
-    const { pair } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn } = makeFetch(() => ({ keys: [] }), fakeUser('u1'), { jwksStatus: 500 })
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1'))
-    const { svc } = makeAuth('http://jwks-obs-noop.local', fetchFn, store) // pas d'onEvent
-
-    const { error, data } = await svc.getClaims()
-    expect(error).toBeNull()
-    expect(data?.claims.sub).toBe('u1')
-  })
-})
-
-describe('AuthService.getClaims — SEC-F1 : options iss/aud/allowExpired appliquées AU FALLBACK', () => {
-  it('audience ≠ aud sur token HS256 (fallback) → invalid_audience (pas un no-op), AVANT tout appel serveur', async () => {
-    const now = Math.floor(Date.now() / 1000)
-    const token = hs256WithClaims({ sub: 'u1', exp: now + 3600, aud: 'real-aud' })
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1')) // token de session → fallback autorisé
-    const { svc } = makeAuth('http://f1-aud.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims(token, { audience: 'x' })
-
-    expect(data).toBeNull()
-    expect((error as { code?: string })?.code).toBe('invalid_audience')
-    expect(counts.user).toBe(0) // rejeté localement, aucun fallback réseau
-  })
-
-  it('issuer ≠ iss sur token HS256 (fallback) → invalid_issuer', async () => {
-    const now = Math.floor(Date.now() / 1000)
-    const token = hs256WithClaims({ sub: 'u1', exp: now + 3600, iss: 'https://issuer.a' })
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1'))
-    const { svc } = makeAuth('http://f1-iss.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims(token, { issuer: 'https://issuer.b' })
-
-    expect(data).toBeNull()
-    expect((error as { code?: string })?.code).toBe('invalid_issuer')
-    expect(counts.user).toBe(0)
-  })
-
-  it('iss/aud conformes sur token HS256 (fallback) → fallback getUser OK', async () => {
-    const now = Math.floor(Date.now() / 1000)
-    const token = hs256WithClaims({ sub: 'u1', exp: now + 3600, iss: 'https://issuer.a', aud: 'aud-1' })
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1'))
-    const { svc } = makeAuth('http://f1-ok.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims(token, { issuer: 'https://issuer.a', audience: 'aud-1' })
-
-    expect(error).toBeNull()
-    expect(data?.claims.sub).toBe('u1')
-    expect(counts.user).toBe(1) // options conformes → le fallback s'exécute
-  })
-
-  it('allowExpired sur token HS256 EXPIRÉ (fallback) → code cohérent allow_expired_unsupported_on_fallback', async () => {
-    const now = Math.floor(Date.now() / 1000)
-    const token = hs256WithClaims({ sub: 'u1', exp: now - 60 }) // expiré
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
-    const store = new BaseAuthStore()
-    store.save(token, 'r', fakeUser('u1'))
-    const { svc } = makeAuth('http://f1-exp.local', fetchFn, store)
-
-    const { data, error } = await svc.getClaims(token, { allowExpired: true })
-
-    expect(data).toBeNull()
-    expect((error as { code?: string })?.code).toBe('allow_expired_unsupported_on_fallback')
-    expect(counts.user).toBe(0) // pas d'appel serveur voué à un 401 trompeur
-  })
-})
-
-describe('AuthService.getClaims — SEC-F2 : isolation projet sur le chemin LOCAL (RS256)', () => {
-  it('token RS256 valide d’un AUTRE projet → rejeté project_isolation_violation', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600, project_id: 'other-project' },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }))
-    // makeAuth : projectId = 'p'.
-    const { svc } = makeAuth('http://f2-iso.local', fetchFn)
-
-    const { data, error } = await svc.getClaims(token)
-
-    expect(data).toBeNull()
-    expect((error as { code?: string })?.code).toBe('project_isolation_violation')
-    expect(counts.user).toBe(0) // rejeté localement, pas de fabrication ni fallback
-  })
-
-  it('token RS256 du BON projet (project_id === client.projectId) → accepté', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600, project_id: 'p' },
-      pair.privateKey,
-      'k1',
-    )
-    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
-    const { svc } = makeAuth('http://f2-ok.local', fetchFn)
-
-    const { data, error } = await svc.getClaims(token)
-
-    expect(error).toBeNull()
-    expect(data?.claims.project_id).toBe('p')
-  })
-})
-
-describe('AuthService.getClaims — SEC-F4 : cache JWKS CLIENT-SCOPED (WeakMap)', () => {
-  it('deux clients distincts (même baseUrl) → caches JWKS ISOLÉS (chacun fetch le sien)', async () => {
-    const { pair, jwk } = await genRs256('k1')
-    const token = await signRs256(
-      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
-      pair.privateKey,
-      'k1',
-    )
-    // Un SEUL fetchFn/baseUrl partagé, mais DEUX clients (services) distincts.
-    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }))
-    const { svc: a } = makeAuth('http://f4-shared.local', fetchFn, new BaseAuthStore())
-    const { svc: b } = makeAuth('http://f4-shared.local', fetchFn, new BaseAuthStore())
-
-    const ra = await a.getClaims(token)
-    const rb = await b.getClaims(token)
-
-    expect(ra.error).toBeNull()
-    expect(rb.error).toBeNull()
-    // Cache global → 1 seul fetch. Client-scoped → chaque client fetch le sien = 2.
-    expect(counts.jwks).toBe(2)
-  })
-})