@aurabase/aurabase-js 0.3.0

package/packages/auth/tests/getclaims.test.ts

@@ -0,0 +1,780 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { AuthService } from '../src/AuthService'
+import { __resetJwksCache } from '../src/jwks'
+import { BaseAuthStore } from '@aurabase/core'
+import type { AuraClientLike, User, AuraObservabilityEvent } from '@aurabase/core'
+
+// --- helpers -----------------------------------------------------------------
+
+function b64url(obj: unknown): string {
+  return btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+function b64urlBytes(bytes: Uint8Array): string {
+  let bin = ''
+  for (const b of bytes) bin += String.fromCharCode(b)
+  return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+/** Génère une paire RS256 et exporte la clé publique en JWK (avec kid). */
+async function genRs256(kid?: string): Promise<{ pair: CryptoKeyPair; jwk: JsonWebKey }> {
+  const pair = await crypto.subtle.generateKey(
+    { name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' },
+    true,
+    ['sign', 'verify'],
+  )
+  const jwk = await crypto.subtle.exportKey('jwk', pair.publicKey)
+  if (kid) (jwk as { kid?: string }).kid = kid
+  return { pair, jwk }
+}
+
+/** Signe un JWT RS256 avec la clé privée fournie. */
+async function signRs256(
+  payload: Record<string, unknown>,
+  priv: CryptoKey,
+  kid?: string,
+): Promise<string> {
+  const header = { alg: 'RS256', typ: 'JWT', ...(kid ? { kid } : {}) }
+  const signingInput = `${b64url(header)}.${b64url(payload)}`
+  const sig = await crypto.subtle.sign(
+    { name: 'RSASSA-PKCS1-v1_5' },
+    priv,
+    new TextEncoder().encode(signingInput),
+  )
+  return `${signingInput}.${b64urlBytes(new Uint8Array(sig))}`
+}
+
+/** JWT HS256 factice (signature non vérifiable localement → fallback getUser). */
+function hs256Jwt(sub = 'u1', ttlSec = 3600): string {
+  const exp = Math.floor(Date.now() / 1000) + ttlSec
+  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub, exp })}.sig`
+}
+
+/** JWT HS256 factice avec payload arbitraire (pour tester iss/aud/exp au fallback). */
+function hs256WithClaims(payload: Record<string, unknown>): string {
+  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url(payload)}.sig`
+}
+
+function fakeUser(id = 'u1'): User {
+  return {
+    id,
+    email: 't@e.com',
+    role: 'authenticated',
+    email_verified: true,
+    is_banned: false,
+    is_anonymous: false,
+    mfa_enabled: false,
+    user_metadata: {},
+    app_metadata: {},
+    created_at: '2025-01-01T00:00:00Z',
+  }
+}
+
+class FakeBC {
+  static instances: FakeBC[] = []
+  onmessage: ((e: { data: unknown }) => void) | null = null
+  posted: unknown[] = []
+  closed = false
+  constructor(public name: string) {
+    FakeBC.instances.push(this)
+  }
+  postMessage(d: unknown) {
+    this.posted.push(d)
+  }
+  close() {
+    this.closed = true
+  }
+}
+
+beforeEach(() => {
+  FakeBC.instances = []
+  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
+  // Le cache JWKS est process-global (limite connue, documentée dans jwks.ts) :
+  // on l'isole entre tests plutôt que de multiplier les baseUrls distincts.
+  __resetJwksCache()
+})
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
+  __resetJwksCache()
+})
+
+function makeAuth(
+  baseUrl: string,
+  fetchFn: typeof globalThis.fetch,
+  store = new BaseAuthStore(),
+  onEvent?: (e: AuraObservabilityEvent) => void,
+) {
+  const client: AuraClientLike = {
+    baseUrl,
+    projectId: 'p',
+    apiKey: 'k',
+    fetchFn,
+    authStore: store,
+    auth: null as unknown as AuraClientLike['auth'],
+    ...(onEvent ? { onEvent } : {}),
+  }
+  const svc = new AuthService(client, { autoRefresh: false, persistSession: false })
+  ;(client as { auth: unknown }).auth = svc
+  return { svc, client, store }
+}
+
+/** fetchFn servant un JWKS + l'endpoint /user, avec compteur de fetch JWKS. */
+function makeFetch(
+  jwks: () => { keys: JsonWebKey[] },
+  user: User = fakeUser(),
+  opts: { jwksStatus?: number; cacheControl?: string; delayMs?: number } = {},
+) {
+  const counts = { jwks: 0, user: 0 }
+  const fetchFn = (async (url: string | URL | Request) => {
+    const u = String(url)
+    if (u.includes('/.well-known/jwks.json')) {
+      counts.jwks++
+      if (opts.delayMs) await new Promise((r) => setTimeout(r, opts.delayMs))
+      const status = opts.jwksStatus ?? 200
+      if (status >= 400) return new Response('fail', { status })
+      return new Response(JSON.stringify(jwks()), {
+        status,
+        headers: {
+          'Content-Type': 'application/json',
+          'Cache-Control': opts.cacheControl ?? 'max-age=600',
+        },
+      })
+    }
+    if (u.endsWith('/user')) {
+      counts.user++
+      return new Response(JSON.stringify(user), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+    return new Response('{}', { status: 200 })
+  }) as unknown as typeof globalThis.fetch
+  return { fetchFn, counts }
+}
+
+// --- tests -------------------------------------------------------------------
+
+describe('AuthService.getClaims — vérif JWT locale via JWKS', () => {
+  it('vérifie un JWT RS256 valide localement → claims', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600, role: 'authenticated' },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }))
+    const { svc } = makeAuth('http://rs256-ok.local', fetchFn)
+
+    const { data, error } = await svc.getClaims(token)
+
+    expect(error).toBeNull()
+    expect(data?.claims.sub).toBe('u1')
+    expect(data?.header.alg).toBe('RS256')
+    expect(counts.jwks).toBe(1)
+    expect(counts.user).toBe(0) // pas de fallback réseau
+  })
+
+  it('signature falsifiée → error signature_invalid', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k1',
+    )
+    // Altère le PREMIER caractère de la signature (le dernier caractère base64url
+    // ne porte que des bits de padding inutilisés → décoderait les mêmes octets).
+    const parts = token.split('.')
+    parts[2] = (parts[2][0] === 'A' ? 'B' : 'A') + parts[2].slice(1)
+    const tampered = parts.join('.')
+    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
+    const { svc } = makeAuth('http://rs256-tampered.local', fetchFn)
+
+    const { data, error } = await svc.getClaims(tampered)
+
+    expect(data).toBeNull()
+    expect((error as { code?: string })?.code).toBe('signature_invalid')
+  })
+
+  it('token expiré → error token_expired', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) - 60 },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
+    const { svc } = makeAuth('http://rs256-expired.local', fetchFn)
+
+    const { data, error } = await svc.getClaims(token)
+
+    expect(data).toBeNull()
+    expect((error as { code?: string })?.code).toBe('token_expired')
+  })
+
+  it('alg HS256 (token de session) → fallback getUser (mocké)', async () => {
+    // Chemin nominal CLIENT : le token HS256 EST celui de la session (store).
+    // getClaims() no-arg → usingStoreToken → fallback getUser autorisé.
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(hs256Jwt('u1'), 'refresh', fakeUser('u1'))
+    const { svc } = makeAuth('http://hs256.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims()
+
+    expect(error).toBeNull()
+    expect(data?.claims.sub).toBe('u1')
+    // alg non supporté → aucune tentative de fetch JWKS, fallback direct getUser.
+    expect(counts.jwks).toBe(0)
+    expect(counts.user).toBe(1)
+  })
+
+  it('LOT D : token HS256 ÉTRANGER (≠ session) → getUser(foreignToken) valide le token ÉTRANGER (pas le store)', async () => {
+    // Le store porte u_store ; on demande les claims d'un token étranger u_foreign
+    // (même projet). Avant LOT D : le SDK ne pouvait PAS cibler le token étranger
+    // (Authorization toujours écrasé par store.token) → fail-closed unverifiable_token.
+    // Après LOT D : getUser(foreignToken) envoie le token ÉTRANGER en Authorization,
+    // le backend le valide (isolation projet native) et renvoie SON identité.
+    // Preuve anti-misattribution : /user renvoie le sub du token RÉELLEMENT présenté.
+    const fetchFn = (async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url)
+      if (u.includes('/.well-known/jwks.json')) {
+        return new Response(JSON.stringify({ keys: [] }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json', 'Cache-Control': 'max-age=600' },
+        })
+      }
+      if (u.endsWith('/user')) {
+        // Décode le sub du JWT présenté dans Authorization (le backend validerait
+        // réellement la signature ; ici on prouve QUEL token est présenté).
+        const auth = (init?.headers as Record<string, string> | undefined)?.['Authorization'] ?? ''
+        const jwt = auth.replace(/^Bearer /, '')
+        const payload = jwt.split('.')[1] ?? ''
+        const b64 = payload.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(payload.length / 4) * 4, '=')
+        const sub = (JSON.parse(atob(b64)) as { sub?: string }).sub ?? 'unknown'
+        return new Response(JSON.stringify(fakeUser(sub)), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const store = new BaseAuthStore()
+    store.save(hs256Jwt('u_store'), 'refresh', fakeUser('u_store'))
+    const { svc } = makeAuth('http://foreign-token.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims(hs256Jwt('u_foreign'))
+
+    expect(error).toBeNull()
+    // Les claims proviennent du token ÉTRANGER validé serveur, PAS du store.
+    expect(data?.claims.sub).toBe('u_foreign')
+  })
+
+  it('LOT D : token étranger refusé par le backend (403 autre projet / invalide) → error, pas de fabrication', async () => {
+    // Isolation projet native : un token d'un AUTRE projet → 403 côté gateway.
+    // getClaims doit remonter l'AuraError, jamais fabriquer des claims.
+    const fetchFn = (async (url: string | URL | Request) => {
+      const u = String(url)
+      if (u.includes('/.well-known/jwks.json')) {
+        return new Response(JSON.stringify({ keys: [] }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json', 'Cache-Control': 'max-age=600' },
+        })
+      }
+      if (u.endsWith('/user')) {
+        return new Response(JSON.stringify({ error: { code: 'forbidden', message: 'wrong project' } }), {
+          status: 403,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const store = new BaseAuthStore()
+    store.save(hs256Jwt('u_store'), 'refresh', fakeUser('u_store'))
+    const { svc } = makeAuth('http://foreign-403.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims(hs256Jwt('u_foreign'))
+
+    expect(data).toBeNull()
+    expect((error as { status?: number })?.status).toBe(403)
+  })
+
+  it('LOT D : getUser(jwt) valide le token passé, pas celui du store', async () => {
+    const seen: string[] = []
+    const fetchFn = (async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url)
+      if (u.endsWith('/user')) {
+        const auth = (init?.headers as Record<string, string> | undefined)?.['Authorization'] ?? ''
+        seen.push(auth)
+        return new Response(JSON.stringify(fakeUser('u_foreign')), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const store = new BaseAuthStore()
+    store.save(hs256Jwt('u_store'), 'refresh', fakeUser('u_store'))
+    const { svc } = makeAuth('http://getuser-jwt.local', fetchFn, store)
+
+    const { data, error } = await svc.getUser('the-foreign-jwt')
+
+    expect(error).toBeNull()
+    expect(data?.id).toBe('u_foreign')
+    expect(seen).toContain('Bearer the-foreign-jwt') // le token PASSÉ, pas le store
+  })
+
+  it('JWKS vide (token de session) → fallback getUser', async () => {
+    const { pair } = await genRs256() // token RS256 SANS kid
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+    )
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1')) // token de session → fallback autorisé
+    const { svc } = makeAuth('http://jwks-empty.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims() // no-arg
+
+    expect(error).toBeNull()
+    expect(data?.claims.sub).toBe('u1')
+    expect(counts.jwks).toBe(1) // pas de kid → pas de refetch
+    expect(counts.user).toBe(1)
+  })
+
+  it('JWK malformé (kty compatible) → error signature_invalid, sans rejet ni fallback', async () => {
+    // Token RS256 valide, mais le JWKS sert une clé RSA corrompue (n/e invalides).
+    // Le match par kty la sélectionne, puis crypto.subtle.importKey *jette*.
+    const { pair } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k1',
+    )
+    const badJwk: JsonWebKey = { kty: 'RSA', kid: 'k1', n: '!!!not-base64url!!!', e: 'AQAB', alg: 'RS256' }
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [badJwk] }), fakeUser('u1'))
+    const { svc } = makeAuth('http://jwk-malformed.local', fetchFn)
+
+    // Ne doit jamais rejeter la promesse : le contrat est AuraResponse { data, error }.
+    const { data, error } = await svc.getClaims(token)
+
+    expect(data).toBeNull()
+    expect((error as { code?: string })?.code).toBe('signature_invalid')
+    expect(counts.user).toBe(0) // fail-closed : pas de fallback getUser sur JWKS corrompu
+  })
+
+  it('kid inconnu → refetch JWKS une fois, puis fallback si toujours absent', async () => {
+    const { pair } = await genRs256('unknown-kid')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'unknown-kid',
+    )
+    // JWKS toujours vide → aucune clé ne matchera, ni par kid ni par kty.
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1')) // token de session → fallback autorisé
+    const { svc } = makeAuth('http://kid-unknown.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims() // no-arg
+
+    expect(error).toBeNull()
+    expect(data?.claims.sub).toBe('u1')
+    expect(counts.jwks).toBe(2) // 1 initial + 1 refetch forcé (rotation)
+    expect(counts.user).toBe(1) // puis fallback getUser
+  })
+
+  it('rotation RS256 : kid absent mais autre clé RSA présente → fallback (jamais signature_invalid)', async () => {
+    // Token signé avec kid='k-old' ; le JWKS ne sert qu'une AUTRE clé RSA valide
+    // (kid='k-new'). selectKey borné au kid ne doit PAS sélectionner k-new (sinon
+    // verify échoue → signature_invalid SANS fallback). On veut no_matching_key →
+    // fallback getUser (le token est le token de session).
+    const { pair } = await genRs256('k-old') // clé de signature (k-old)
+    const { jwk: jwkNew } = await genRs256('k-new') // 2e paire, clé publique servie
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k-old',
+    )
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwkNew] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1')) // token de session → fallback autorisé
+    const { svc } = makeAuth('http://rs256-rotation.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims() // no-arg
+
+    expect(error).toBeNull()
+    expect(data?.claims.sub).toBe('u1')
+    expect(counts.user).toBe(1) // fallback getUser, PAS signature_invalid
+    expect(counts.jwks).toBe(2) // initial + refetch forcé (kid présent introuvable)
+  })
+})
+
+describe('AuthService.getClaims — robustesse JWKS (LOT 1)', () => {
+  it('#1 dédup in-flight : 2 getClaims concurrents cache froid → 1 seul fetch JWKS', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }), fakeUser(), { delayMs: 5 })
+    const { svc } = makeAuth('http://jwks-dedup.local', fetchFn)
+
+    const [a, b] = await Promise.all([svc.getClaims(token), svc.getClaims(token)])
+
+    expect(a.error).toBeNull()
+    expect(b.error).toBeNull()
+    expect(counts.jwks).toBe(1) // un SEUL appel réseau malgré 2 vérifs concurrentes
+  })
+
+  it('#2 cooldown : 2 tokens à kid inconnu rapprochés → 1 seul refetch forcé', async () => {
+    const { pair } = await genRs256('unknown-kid')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'unknown-kid',
+    )
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1'))
+    const { svc } = makeAuth('http://jwks-cooldown.local', fetchFn, store)
+
+    await svc.getClaims() // 1 initial + 1 refetch forcé = 2
+    await svc.getClaims() // initial servi du cache ; refetch forcé bloqué par cooldown
+
+    // Sans cooldown : 3 (le 2e appel referait un refetch forcé). Avec : borné à 2.
+    expect(counts.jwks).toBe(2)
+  })
+
+  it('#3 negative-cache : fetch KO puis re-appel < TTL → pas de 2e réseau', async () => {
+    const { pair } = await genRs256('k1')
+    const rsToken = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'), { jwksStatus: 500 })
+    const store = new BaseAuthStore()
+    store.save(rsToken, 'r', fakeUser('u1'))
+    const { svc } = makeAuth('http://jwks-negcache.local', fetchFn, store)
+
+    await svc.getClaims() // fetch réseau → 500 → jwks_fetch_failed → fallback getUser
+    await svc.getClaims() // < TTL → negative-cache → PAS de 2e réseau
+
+    expect(counts.jwks).toBe(1)
+  })
+
+  it('#4 cap max-age : max-age=999999999 plafonné (refetch après la borne haute)', async () => {
+    vi.useFakeTimers()
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 10_000_000 },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }), fakeUser(), {
+      cacheControl: 'max-age=999999999',
+    })
+    const { svc } = makeAuth('http://jwks-cap.local', fetchFn)
+
+    const r1 = await svc.getClaims(token)
+    expect(r1.error).toBeNull()
+    expect(counts.jwks).toBe(1)
+
+    // Avance de 25h : au-delà du cap 24h mais très en deçà de 999999999s.
+    vi.advanceTimersByTime(25 * 60 * 60 * 1000)
+
+    const r2 = await svc.getClaims(token)
+    expect(r2.error).toBeNull()
+    // Sans cap : toujours en cache → 1. Avec cap 24h : cache périmé → refetch → 2.
+    expect(counts.jwks).toBe(2)
+  })
+
+  it('#6 sélection no-kid : 2 clés RSA sans kid, token signé par la 2e → succès', async () => {
+    const { jwk: jwk1 } = await genRs256() // clé leurre (ne signe pas)
+    const { pair: pair2, jwk: jwk2 } = await genRs256() // clé de signature
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair2.privateKey,
+    ) // pas de kid
+    const { fetchFn } = makeFetch(() => ({ keys: [jwk1, jwk2] }))
+    const { svc } = makeAuth('http://jwks-nokid.local', fetchFn)
+
+    const { data, error } = await svc.getClaims(token)
+
+    expect(error).toBeNull()
+    expect(data?.claims.sub).toBe('u1')
+    expect(data?.header.alg).toBe('RS256')
+  })
+
+  it('#7 fallback : alg RÉEL du token (RS256), pas HS256 en dur ; exp non fabriqué', async () => {
+    // Vrai token RS256 en session, mais fetch JWKS KO → fallback getUser.
+    const { pair } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn } = makeFetch(() => ({ keys: [] }), fakeUser('u1'), { jwksStatus: 503 })
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1'))
+    const { svc } = makeAuth('http://jwks-fallback-alg.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims()
+
+    expect(error).toBeNull()
+    expect(data?.header.alg).toBe('RS256') // alg réel décodé, PAS 'HS256' en dur
+    // Honnêteté de type : le fallback ne fabrique pas d'exp/iat.
+    expect(data?.claims.exp).toBeUndefined()
+    expect(data?.claims.iat).toBeUndefined()
+  })
+
+  it('#7b local RS256 : exp présent (number) sur le chemin de vérif locale', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const exp = Math.floor(Date.now() / 1000) + 3600
+    const token = await signRs256({ sub: 'u1', exp }, pair.privateKey, 'k1')
+    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
+    const { svc } = makeAuth('http://jwks-local-exp.local', fetchFn)
+
+    const { data } = await svc.getClaims(token)
+
+    expect(typeof data?.claims.exp).toBe('number')
+    expect(data?.claims.exp).toBe(exp)
+  })
+
+  it('#8 issuer/audience : validés sur le chemin local (RS256)', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      {
+        sub: 'u1',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+        iss: 'https://issuer.a',
+        aud: 'aud-1',
+      },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
+    const { svc } = makeAuth('http://jwks-issaud.local', fetchFn)
+
+    const ok = await svc.getClaims(token, { issuer: 'https://issuer.a', audience: 'aud-1' })
+    expect(ok.error).toBeNull()
+    expect(ok.data?.claims.sub).toBe('u1')
+
+    const badIss = await svc.getClaims(token, { issuer: 'https://issuer.b' })
+    expect(badIss.data).toBeNull()
+    expect((badIss.error as { code?: string })?.code).toBe('invalid_issuer')
+
+    const badAud = await svc.getClaims(token, { audience: 'aud-2' })
+    expect(badAud.data).toBeNull()
+    expect((badAud.error as { code?: string })?.code).toBe('invalid_audience')
+  })
+})
+
+describe('AuthService.getClaims — observabilité jwks-fetch-failed (LOT 3, I8)', () => {
+  it('fetch JWKS en échec (500) → onEvent reçoit {kind:"jwks-fetch-failed", baseUrl}', async () => {
+    const { pair } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn } = makeFetch(() => ({ keys: [] }), fakeUser('u1'), { jwksStatus: 500 })
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1'))
+    const events: AuraObservabilityEvent[] = []
+    const { svc } = makeAuth('http://jwks-obs-fail.local', fetchFn, store, (e) => events.push(e))
+
+    const { error } = await svc.getClaims()
+
+    expect(error).toBeNull() // fallback getUser réussit malgré l'échec JWKS
+    expect(events).toContainEqual({
+      kind: 'jwks-fetch-failed',
+      baseUrl: 'http://jwks-obs-fail.local',
+    })
+  })
+
+  it('kid inconnu → refetch forcé qui échoue → onEvent reçoit aussi jwks-fetch-failed', async () => {
+    const { pair } = await genRs256('unknown-kid')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'unknown-kid',
+    )
+    // 1er fetch JWKS OK (cache froid, vide) ; le refetch forcé (kid inconnu) échoue.
+    let call = 0
+    const fetchFn = (async (url: string | URL | Request) => {
+      const u = String(url)
+      if (u.includes('/.well-known/jwks.json')) {
+        call++
+        if (call === 1) {
+          return new Response(JSON.stringify({ keys: [] }), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json', 'Cache-Control': 'max-age=0' },
+          })
+        }
+        return new Response('fail', { status: 500 })
+      }
+      if (u.endsWith('/user')) {
+        return new Response(JSON.stringify(fakeUser('u1')), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1'))
+    const events: AuraObservabilityEvent[] = []
+    const { svc } = makeAuth('http://jwks-obs-refetch-fail.local', fetchFn, store, (e) => events.push(e))
+
+    const { error } = await svc.getClaims()
+
+    expect(error).toBeNull()
+    expect(events).toContainEqual({
+      kind: 'jwks-fetch-failed',
+      baseUrl: 'http://jwks-obs-refetch-fail.local',
+    })
+  })
+
+  it('onEvent absent : aucun throw, comportement getClaims inchangé', async () => {
+    const { pair } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn } = makeFetch(() => ({ keys: [] }), fakeUser('u1'), { jwksStatus: 500 })
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1'))
+    const { svc } = makeAuth('http://jwks-obs-noop.local', fetchFn, store) // pas d'onEvent
+
+    const { error, data } = await svc.getClaims()
+    expect(error).toBeNull()
+    expect(data?.claims.sub).toBe('u1')
+  })
+})
+
+describe('AuthService.getClaims — SEC-F1 : options iss/aud/allowExpired appliquées AU FALLBACK', () => {
+  it('audience ≠ aud sur token HS256 (fallback) → invalid_audience (pas un no-op), AVANT tout appel serveur', async () => {
+    const now = Math.floor(Date.now() / 1000)
+    const token = hs256WithClaims({ sub: 'u1', exp: now + 3600, aud: 'real-aud' })
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1')) // token de session → fallback autorisé
+    const { svc } = makeAuth('http://f1-aud.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims(token, { audience: 'x' })
+
+    expect(data).toBeNull()
+    expect((error as { code?: string })?.code).toBe('invalid_audience')
+    expect(counts.user).toBe(0) // rejeté localement, aucun fallback réseau
+  })
+
+  it('issuer ≠ iss sur token HS256 (fallback) → invalid_issuer', async () => {
+    const now = Math.floor(Date.now() / 1000)
+    const token = hs256WithClaims({ sub: 'u1', exp: now + 3600, iss: 'https://issuer.a' })
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1'))
+    const { svc } = makeAuth('http://f1-iss.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims(token, { issuer: 'https://issuer.b' })
+
+    expect(data).toBeNull()
+    expect((error as { code?: string })?.code).toBe('invalid_issuer')
+    expect(counts.user).toBe(0)
+  })
+
+  it('iss/aud conformes sur token HS256 (fallback) → fallback getUser OK', async () => {
+    const now = Math.floor(Date.now() / 1000)
+    const token = hs256WithClaims({ sub: 'u1', exp: now + 3600, iss: 'https://issuer.a', aud: 'aud-1' })
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1'))
+    const { svc } = makeAuth('http://f1-ok.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims(token, { issuer: 'https://issuer.a', audience: 'aud-1' })
+
+    expect(error).toBeNull()
+    expect(data?.claims.sub).toBe('u1')
+    expect(counts.user).toBe(1) // options conformes → le fallback s'exécute
+  })
+
+  it('allowExpired sur token HS256 EXPIRÉ (fallback) → code cohérent allow_expired_unsupported_on_fallback', async () => {
+    const now = Math.floor(Date.now() / 1000)
+    const token = hs256WithClaims({ sub: 'u1', exp: now - 60 }) // expiré
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [] }), fakeUser('u1'))
+    const store = new BaseAuthStore()
+    store.save(token, 'r', fakeUser('u1'))
+    const { svc } = makeAuth('http://f1-exp.local', fetchFn, store)
+
+    const { data, error } = await svc.getClaims(token, { allowExpired: true })
+
+    expect(data).toBeNull()
+    expect((error as { code?: string })?.code).toBe('allow_expired_unsupported_on_fallback')
+    expect(counts.user).toBe(0) // pas d'appel serveur voué à un 401 trompeur
+  })
+})
+
+describe('AuthService.getClaims — SEC-F2 : isolation projet sur le chemin LOCAL (RS256)', () => {
+  it('token RS256 valide d’un AUTRE projet → rejeté project_isolation_violation', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600, project_id: 'other-project' },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }))
+    // makeAuth : projectId = 'p'.
+    const { svc } = makeAuth('http://f2-iso.local', fetchFn)
+
+    const { data, error } = await svc.getClaims(token)
+
+    expect(data).toBeNull()
+    expect((error as { code?: string })?.code).toBe('project_isolation_violation')
+    expect(counts.user).toBe(0) // rejeté localement, pas de fabrication ni fallback
+  })
+
+  it('token RS256 du BON projet (project_id === client.projectId) → accepté', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600, project_id: 'p' },
+      pair.privateKey,
+      'k1',
+    )
+    const { fetchFn } = makeFetch(() => ({ keys: [jwk] }))
+    const { svc } = makeAuth('http://f2-ok.local', fetchFn)
+
+    const { data, error } = await svc.getClaims(token)
+
+    expect(error).toBeNull()
+    expect(data?.claims.project_id).toBe('p')
+  })
+})
+
+describe('AuthService.getClaims — SEC-F4 : cache JWKS CLIENT-SCOPED (WeakMap)', () => {
+  it('deux clients distincts (même baseUrl) → caches JWKS ISOLÉS (chacun fetch le sien)', async () => {
+    const { pair, jwk } = await genRs256('k1')
+    const token = await signRs256(
+      { sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 },
+      pair.privateKey,
+      'k1',
+    )
+    // Un SEUL fetchFn/baseUrl partagé, mais DEUX clients (services) distincts.
+    const { fetchFn, counts } = makeFetch(() => ({ keys: [jwk] }))
+    const { svc: a } = makeAuth('http://f4-shared.local', fetchFn, new BaseAuthStore())
+    const { svc: b } = makeAuth('http://f4-shared.local', fetchFn, new BaseAuthStore())
+
+    const ra = await a.getClaims(token)
+    const rb = await b.getClaims(token)
+
+    expect(ra.error).toBeNull()
+    expect(rb.error).toBeNull()
+    // Cache global → 1 seul fetch. Client-scoped → chaque client fetch le sien = 2.
+    expect(counts.jwks).toBe(2)
+  })
+})