@bevel-software/platform-core-backend 0.1.0 → 0.2.0

package/src/modules/tool-auth/__tests__/internal-token.service.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'vitest';
-import { InternalTokenService } from '../internal-token.service.js';
+import {
+  InternalTokenService,
+  deriveInternalTokenSecret,
+} from '../internal-token.service.js';
 import { createTokenVerifier } from '../tool-auth.middleware.js';
 import type { IExternalApiKeyService } from '../external-api-key.interface.js';
 
@@ -40,6 +43,27 @@ describe('InternalTokenService', () => {
     expect(svc.verify(token)).toBeNull();
   });
 
+  it('verifies a token minted by a SIBLING instance sharing the secret (CLI → server)', () => {
+    // The routine CLI and a second replica each build their own service graph;
+    // with the same configured secret their tokens must verify across
+    // instances — this is what makes the loopback tool surface reachable from
+    // a process other than the server itself.
+    const secret = deriveInternalTokenSecret('deployment-jwt-secret');
+    const cliSide = new InternalTokenService({ secret });
+    const serverSide = new InternalTokenService({ secret });
+    expect(serverSide.verify(cliSide.mint(claim))).toEqual(claim);
+  });
+
+  it('derives a stable, domain-separated internal secret from the JWT secret', () => {
+    const derived = deriveInternalTokenSecret('deployment-jwt-secret');
+    // Deterministic (same input → same key) …
+    expect(deriveInternalTokenSecret('deployment-jwt-secret')).toBe(derived);
+    // … but never the JWT secret itself, and different per input.
+    expect(derived).not.toBe('deployment-jwt-secret');
+    expect(deriveInternalTokenSecret('other-secret')).not.toBe(derived);
+    expect(derived).toMatch(/^[0-9a-f]{64}$/);
+  });
+
   it('rejects a connection-key-shaped bearer', () => {
     const svc = new InternalTokenService({ secret: 's' });
     expect(svc.verify('bevel_abc123')).toBeNull();

package/src/modules/tool-auth/internal-token.service.ts

@@ -36,6 +36,19 @@ interface SignedPayload extends InternalTokenClaim {
 
 const DEFAULT_PREFIX = 'bevel-int_';
 
+/**
+ * Derive the stable internal-token HMAC key from the deployment's JWT secret.
+ * Domain-separated (the constant label), so the two token systems never share
+ * key material and neither key reveals the other. A STABLE key — rather than
+ * the per-boot random default — is what lets a sibling process that shares the
+ * deployment env (the enterprise routine CLI, a second replica) mint tokens
+ * this server verifies; the composition root uses this whenever
+ * `INTERNAL_TOKEN_SECRET` is not set explicitly.
+ */
+export function deriveInternalTokenSecret(jwtSecret: string): string {
+  return createHmac('sha256', jwtSecret).update('bevel-internal-token').digest('hex');
+}
+
 function b64url(buf: Buffer): string {
   return buf.toString('base64url');
 }