@bevel-software/platform-core-backend 0.1.0

package/src/modules/secrets-vault/__tests__/scopes-covered.test.ts

@@ -0,0 +1,101 @@
+import { describe, expect, it } from 'vitest';
+import { scopesCovered, missingScopes } from '../secrets-vault.contract.js';
+
+/**
+ * `scopesCovered(required, granted)` — the pure predicate the MCP pre-check and the
+ * connect route share to decide whether a token still covers a tool's live scopes.
+ */
+describe('scopesCovered', () => {
+  it('is trivially covered when nothing is required', () => {
+    expect(scopesCovered(undefined, undefined)).toBe(true);
+    expect(scopesCovered([], 'openid')).toBe(true);
+  });
+
+  it('covers when every required scope is granted (order/extra-granted irrelevant)', () => {
+    expect(scopesCovered(['openid'], 'openid')).toBe(true);
+    expect(scopesCovered(['a', 'b'], 'b a c')).toBe(true);
+  });
+
+  it('does not cover when a required scope is missing', () => {
+    expect(scopesCovered(['openid', 'calendar'], 'openid')).toBe(false);
+  });
+
+  it('does not cover when the granted set is unknown but scopes are required', () => {
+    expect(scopesCovered(['openid'], undefined)).toBe(false);
+    expect(scopesCovered(['openid'], '')).toBe(false);
+  });
+
+  it('ignores extra whitespace between granted scopes', () => {
+    expect(scopesCovered(['a', 'b'], '  a   b  ')).toBe(true);
+  });
+
+  // Google canonicalizes `email`/`profile` to userinfo.* URLs in the echoed grant.
+  describe('Google OIDC alias canonicalization', () => {
+    const EMAIL_URL = 'https://www.googleapis.com/auth/userinfo.email';
+    const PROFILE_URL = 'https://www.googleapis.com/auth/userinfo.profile';
+    const CAL = 'https://www.googleapis.com/auth/calendar.readonly';
+
+    it('covers a bare `email` required against the URL Google granted (the reported bug)', () => {
+      expect(scopesCovered(['email'], EMAIL_URL)).toBe(true);
+    });
+
+    it('covers symmetrically: URL required, bare alias granted', () => {
+      expect(scopesCovered([EMAIL_URL], 'email')).toBe(true);
+    });
+
+    it('covers the `profile` pair the same way', () => {
+      expect(scopesCovered(['profile'], PROFILE_URL)).toBe(true);
+    });
+
+    it('covers the full google.tool grant after re-consent (requirement #1)', () => {
+      expect(scopesCovered(['openid', 'email', CAL], `openid ${EMAIL_URL} ${CAL}`)).toBe(true);
+    });
+
+    it('still gates a token missing calendar.readonly (requirement #2)', () => {
+      expect(scopesCovered(['openid', 'email', CAL], `openid ${EMAIL_URL}`)).toBe(false);
+    });
+
+    it('preserves fail-closed on unknown/empty granted through canonicalization', () => {
+      expect(scopesCovered(['email'], undefined)).toBe(false);
+      expect(scopesCovered(['email'], '')).toBe(false);
+    });
+
+    it('does NOT treat a subsumption as coverage (no subsumption leaked into the table)', () => {
+      expect(scopesCovered(['https://www.googleapis.com/auth/contacts'], 'https://www.google.com/m8/feeds/')).toBe(false);
+    });
+
+    it('keeps `openid` verbatim — never aliased to a URL', () => {
+      expect(scopesCovered(['openid'], 'openid')).toBe(true);
+      expect(scopesCovered(['openid'], EMAIL_URL)).toBe(false);
+    });
+  });
+});
+
+/**
+ * `missingScopes(required, granted)` — the declared scopes a token doesn't cover,
+ * in their ORIGINAL form, for showing "what it can't do" in the secrets UI.
+ */
+describe('missingScopes', () => {
+  const EMAIL_URL = 'https://www.googleapis.com/auth/userinfo.email';
+  const CAL = 'https://www.googleapis.com/auth/calendar.readonly';
+  const GMAIL = 'https://www.googleapis.com/auth/gmail.readonly';
+
+  it('returns [] when everything required is covered', () => {
+    expect(missingScopes(['openid', 'email'], `openid ${EMAIL_URL}`)).toEqual([]);
+    expect(missingScopes(undefined, 'anything')).toEqual([]);
+    expect(missingScopes([], undefined)).toEqual([]);
+  });
+
+  it('lists the uncovered scopes in their declared form', () => {
+    // A token granted calendar but not gmail (the reported scenario).
+    expect(missingScopes(['openid', 'email', CAL, GMAIL], `openid ${EMAIL_URL} ${CAL}`)).toEqual([GMAIL]);
+  });
+
+  it('treats an alias as covered (email vs userinfo.email)', () => {
+    expect(missingScopes(['email'], EMAIL_URL)).toEqual([]);
+  });
+
+  it('lists everything required when granted is unknown (fail-closed)', () => {
+    expect(missingScopes(['openid', 'email'], undefined)).toEqual(['openid', 'email']);
+  });
+});

package/src/modules/secrets-vault/__tests__/secrets-variable-loader.test.ts

@@ -0,0 +1,54 @@
+import { describe, test, expect } from 'vitest';
+import {
+  BevelSecretsVariableLoader,
+  registerBevelSecretsVariableLoader,
+} from '../secrets-variable-loader.js';
+import type { ISecretsVaultService } from '../secrets-vault.contract.js';
+
+describe('BevelSecretsVariableLoader', () => {
+  // Binds the user id the loader is EXPECTED to forward; the fake fails the test
+  // if `resolve` is ever called with a different (or missing) user, so the loader
+  // can't silently switch to a global / other-user secret lookup.
+  const fakeVault = (expectedUserId: string, secrets: Record<string, string>): ISecretsVaultService =>
+    ({
+      resolve: async (userId: string, key: string) => {
+        expect(userId).toBe(expectedUserId);
+        return secrets[key] ?? null;
+      },
+    }) as unknown as ISecretsVaultService;
+
+  test('resolves the UTCP-namespaced key against the vault verbatim, as the active user', async () => {
+    // The vault is keyed by the full `<manual>_<VAR>` namespace, so a secret is
+    // bound to ONE manual — and it is looked up for the loader's own user.
+    registerBevelSecretsVariableLoader(fakeVault('user-1', { weather_WEATHER_KEY: 'sk-123' }));
+    const loader = new BevelSecretsVariableLoader('user-1');
+    expect(await loader.get('weather_WEATHER_KEY')).toBe('sk-123');
+  });
+
+  test("does not resolve another manual's namespace (isolation)", async () => {
+    // `weather` configured its secret; an `evil` manual referencing the same
+    // bare `${WEATHER_KEY}` looks up `evil_WEATHER_KEY` and misses — it cannot
+    // harvest a secret bound to a different manual.
+    registerBevelSecretsVariableLoader(fakeVault('user-1', { weather_WEATHER_KEY: 'sk-123' }));
+    const loader = new BevelSecretsVariableLoader('user-1');
+    expect(await loader.get('evil_WEATHER_KEY')).toBeNull();
+  });
+
+  test('resolves for the correct user (distinct users do not share the lookup)', async () => {
+    registerBevelSecretsVariableLoader(fakeVault('user-2', { weather_WEATHER_KEY: 'sk-2' }));
+    const loader = new BevelSecretsVariableLoader('user-2');
+    expect(await loader.get('weather_WEATHER_KEY')).toBe('sk-2');
+  });
+
+  test('returns null for an unknown secret', async () => {
+    registerBevelSecretsVariableLoader(fakeVault('user-1', {}));
+    const loader = new BevelSecretsVariableLoader('user-1');
+    expect(await loader.get('weather_MISSING')).toBeNull();
+  });
+
+  test('returns null when the loader has no bound user (never calls resolve)', async () => {
+    registerBevelSecretsVariableLoader(fakeVault('unreachable', { m_X: 'y' }));
+    const loader = new BevelSecretsVariableLoader('');
+    expect(await loader.get('m_X')).toBeNull();
+  });
+});

package/src/modules/secrets-vault/__tests__/tool-owner-gate.route.test.ts

@@ -0,0 +1,143 @@
+import type { Server as HttpServer } from 'node:http';
+import express from 'express';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createSecretsVaultRoutes } from '../secrets-vault.routes.js';
+
+/**
+ * THE OWNER GATE: a tool's shared (admin) secrets — plain values and OAuth
+ * client secrets — are settable by whoever can WRITE that `.tool` FILE (its
+ * frontmatter `write:`/`owner:` verbs + the access.md chain), and by no one
+ * else. There is deliberately NO platform-role check here: a non-Admin who
+ * manages a `.tool` configures it; an Admin who can't write the file doesn't.
+ * The per-file resolution itself (frontmatter verbs on `.tool` files) is
+ * covered in access-control.service.test.ts — this locks the route gate to
+ * `canWrite(path)` so no role-based shortcut regresses it.
+ */
+
+const TOOL_PATH = 'Tools/weather.tool';
+const WRITER = 'writer@x.com';
+const READER = 'reader@x.com';
+
+const toolManualService = {
+  listAccessible: async () => [
+    {
+      slug: 'weather',
+      name: 'weather',
+      path: TOOL_PATH,
+      type: 'mcp' as const,
+      variables: [
+        { name: 'SHARED_KEY', scope: 'admin' as const, label: 'Org key' },
+        {
+          name: 'SIGNIN',
+          scope: 'user' as const,
+          label: 'Weather sign-in',
+          oauth: {
+            authorizationUrl: 'https://auth.example.com/authorize',
+            tokenUrl: 'https://auth.example.com/token',
+            clientId: 'client-1',
+          },
+        },
+      ],
+    },
+  ],
+} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['toolManualService'];
+
+const putSharedStatic = vi.fn(async () => ({ id: 's1' }));
+const putSharedOAuthClientSecret = vi.fn(async () => {});
+const secretsVault = {
+  putSharedStatic,
+  putSharedOAuthClientSecret,
+} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['secretsVault'];
+
+// Per-FILE write: only WRITER may write THIS tool's path. No role concept at all.
+const accessControl = {
+  canRead: async () => true,
+  canWrite: async (_ws: string, email: string, path: string) => email === WRITER && path === TOOL_PATH,
+} as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['accessControl'];
+
+let httpServer: HttpServer | undefined;
+
+async function baseUrlAs(email: string): Promise<string> {
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.userId = `id-${email}`;
+    req.userEmail = email;
+    next();
+  });
+  app.use(
+    '/api',
+    createSecretsVaultRoutes({
+      secretsVault,
+      toolManualService,
+      accessControl,
+      stateSecret: 'test-secret',
+      publicBackendUrl: 'http://localhost:3000',
+      publicFrontendUrl: 'http://localhost:5173',
+    }),
+  );
+  httpServer = await new Promise<HttpServer>((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  const port = (httpServer.address() as { port: number }).port;
+  return `http://127.0.0.1:${port}`;
+}
+
+afterEach(async () => {
+  if (httpServer) await new Promise<void>((r) => httpServer!.close(() => r()));
+  httpServer = undefined;
+  putSharedStatic.mockClear();
+  putSharedOAuthClientSecret.mockClear();
+});
+
+describe('tool owner gate — shared config requires WRITE on the `.tool` file', () => {
+  it('a writer of the file sets the shared admin value', async () => {
+    const base = await baseUrlAs(WRITER);
+    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SHARED_KEY/admin`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ value: 'k-123' }),
+    });
+    expect(res.status).toBe(201);
+    expect(putSharedStatic).toHaveBeenCalledWith(expect.objectContaining({ key: 'weather_SHARED_KEY' }));
+  });
+
+  it('a non-writer is refused (403), even though they can READ the tool', async () => {
+    const base = await baseUrlAs(READER);
+    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SHARED_KEY/admin`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ value: 'k-123' }),
+    });
+    expect(res.status).toBe(403);
+    expect(putSharedStatic).not.toHaveBeenCalled();
+  });
+
+  it('a writer of the file sets the OAuth client secret, pinned to the declared provider', async () => {
+    const base = await baseUrlAs(WRITER);
+    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SIGNIN/oauth/admin`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ clientSecret: 'cs-123' }),
+    });
+    expect(res.status).toBe(201);
+    expect(putSharedOAuthClientSecret).toHaveBeenCalledWith(
+      expect.objectContaining({
+        key: 'weather_SIGNIN',
+        clientSecret: 'cs-123',
+        provider: expect.objectContaining({ clientId: 'client-1' }),
+      }),
+    );
+  });
+
+  it('a non-writer cannot set the client secret (403)', async () => {
+    const base = await baseUrlAs(READER);
+    const res = await fetch(`${base}/api/secrets/tools/weather/vars/SIGNIN/oauth/admin`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ clientSecret: 'cs-123' }),
+    });
+    expect(res.status).toBe(403);
+    expect(putSharedOAuthClientSecret).not.toHaveBeenCalled();
+  });
+});