@blamejs/blamejs-shop 0.3.12 → 0.3.14

package/lib/vendor/blamejs/test/layer-0-primitives/db-key-aad.test.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * b.db encryption-key AAD binding.
+ *
+ * The database encryption key (db.key.enc) is sealed with additional
+ * authenticated data bound to its purpose, data directory, and key
+ * path. That binding means a sealed key blob cannot be silently
+ * relocated to a different deployment / path and unsealed there — the
+ * AEAD authentication fails. A legacy plain-sealed key (pre-binding)
+ * is transparently upgraded to the AAD-sealed format on next load.
+ */
+
+var helpers = require("../helpers");
+var b              = helpers.b;
+var check          = helpers.check;
+var fs             = helpers.fs;
+var os             = helpers.os;
+var path           = helpers.path;
+var setupTestDb    = helpers.setupTestDb;
+
+var DB_KEY_PURPOSE = "blamejs/db-encryption-key/v1";
+var SCHEMA = [{
+  name: "things",
+  columns: { _id: "TEXT PRIMARY KEY", v: "TEXT" },
+}];
+
+function dbKeyAad(tmp, keyPath) {
+  return b.vault.aad.buildContextAad({
+    purpose: DB_KEY_PURPOSE,
+    dataDir: path.resolve(tmp),
+    keyPath: path.resolve(keyPath),
+  });
+}
+
+async function reinitDbOnly(tmp) {
+  helpers.setTestPassphraseEnv();
+  b.db._resetForTest();
+  await b.db.init({ dataDir: tmp, tmpDir: path.join(tmp, "tmpfs"), schema: SCHEMA });
+}
+
+async function run() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-dbkey-aad-"));
+  // setupTestDb resets + inits vault and db; vault stays initialized
+  // through every phase below (we only reset db between phases).
+  await setupTestDb(tmp, SCHEMA);
+  b.db.from("things").insertOne({ _id: "x", v: "secret" });
+
+  var keyPath = path.join(tmp, "db.key.enc");
+  var sealed = fs.readFileSync(keyPath, "utf8");
+
+  // ---- on-disk key is AAD-sealed ----
+  check("db.key.enc is AAD-sealed", b.vault.aad.isAadSealed(sealed) === true);
+
+  // ---- correct AAD unseals to a non-empty key ----
+  var b64 = b.vault.aad.unseal(sealed, dbKeyAad(tmp, keyPath));
+  check("correct AAD unseals db key to non-empty base64", typeof b64 === "string" && b64.length > 0);
+
+  // ---- binding: a different keyPath / dataDir fails to unseal ----
+  var bindKeyPathThrew = false;
+  try { b.vault.aad.unseal(sealed, dbKeyAad(tmp, path.join(tmp, "elsewhere.enc"))); }
+  catch (_e) { bindKeyPathThrew = true; }
+  check("db key won't unseal under a different keyPath", bindKeyPathThrew);
+
+  var bindDirThrew = false;
+  try {
+    b.vault.aad.unseal(sealed, b.vault.aad.buildContextAad({
+      purpose: DB_KEY_PURPOSE,
+      dataDir: path.resolve(tmp, "..", "some-other-deployment"),
+      keyPath: path.resolve(keyPath),
+    }));
+  } catch (_e) { bindDirThrew = true; }
+  check("db key won't unseal under a different dataDir", bindDirThrew);
+
+  // ---- round-trip: re-init at the same dir decrypts the row ----
+  b.db.close();
+  await reinitDbOnly(tmp);
+  check("re-init at same dir decrypts row through AAD-sealed key",
+    b.db.from("things").where({ _id: "x" }).first().v === "secret");
+
+  // ---- legacy plain-sealed key is upgraded to AAD on next load ----
+  b.db.close();
+  fs.writeFileSync(keyPath, b.vault.seal(b64), { mode: 0o600 });
+  check("legacy seed: db.key.enc is NOT AAD-sealed",
+    b.vault.aad.isAadSealed(fs.readFileSync(keyPath, "utf8")) === false);
+  await reinitDbOnly(tmp);
+  check("legacy plain-sealed key upgraded to AAD on load",
+    b.vault.aad.isAadSealed(fs.readFileSync(keyPath, "utf8")) === true);
+  check("row still decrypts after legacy key upgrade",
+    b.db.from("things").where({ _id: "x" }).first().v === "secret");
+
+  b.db.close();
+  b.audit._resetForTest();
+  b.db._resetForTest();
+  b.vault._resetForTest();
+  b.cluster._resetForTest();
+  try { fs.rmSync(tmp, { recursive: true, force: true }); } catch (_e) {}
+
+  console.log("OK — db-key AAD tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  // Rethrow on failure so Node surfaces the error and exits non-zero,
+  // instead of logging the caught error object — a taint analyzer traces
+  // a logged error back to the test passphrase fixture (a non-secret
+  // constant) and raises a false clear-text-logging alert.
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/external-db-hardening.test.js

@@ -168,6 +168,59 @@ async function run() {
   await new Promise(function (r) { setImmediate(r); });
   check("D-M2: 42501 emit completes without crashing", true);
 
+  // ---- attempted-relation extraction for auth-failure audits ----
+  // A rejected credential's audit row records WHICH relation it tried
+  // to reach, so triage can scope blast radius without the raw SQL log.
+  // _extractTargetRelation is the defensive parser behind that field.
+  var xr = b.externalDb._extractTargetRelation;
+  check("extractRelation: bare table after FROM",
+    xr("SELECT * FROM accounts WHERE id = $1") === "accounts");
+  check("extractRelation: INTO target",
+    xr("INSERT INTO audit_log (a) VALUES ($1)") === "audit_log");
+  check("extractRelation: UPDATE target",
+    xr("UPDATE users SET x = 1") === "users");
+  check("extractRelation: schema-qualified",
+    xr("SELECT * FROM public.secrets") === "public.secrets");
+  check("extractRelation: double-quoted identifier (quotes stripped)",
+    xr('SELECT * FROM "Order Items"') === "Order Items");
+  check("extractRelation: backtick-quoted identifier (ticks stripped)",
+    xr("SELECT * FROM `weird table`") === "weird table");
+  check("extractRelation: JOIN target picks first relation",
+    xr("SELECT * FROM a JOIN b ON a.id = b.id") === "a");
+  // Defensive: unparseable / control-char input returns null rather
+  // than leaking a partial fragment into the audit metadata.
+  check("extractRelation: no relation keyword returns null", xr("SELECT 1") === null);
+  check("extractRelation: non-SQL input returns null",
+    xr("just some words here") === null);
+  check("extractRelation: empty input returns null", xr("") === null);
+
+  // The audit hook stamps attemptedTable from the parser. Drive a
+  // rejection through the query path and confirm the field is present
+  // on the captured audit row.
+  var auditRows = [];
+  var origEmit = b.audit && b.audit.safeEmit;
+  if (origEmit) {
+    b.audit.safeEmit = function (rec) {
+      if (rec && rec.action === "db.auth.failed") auditRows.push(rec);
+      return origEmit.apply(b.audit, arguments);
+    };
+  }
+  try {
+    var d6 = _instrumentingDriver({
+      failOnce: { match: /^SELECT \* FROM payroll/i, code: "28000", message: "auth failed" },
+    });
+    b.externalDb._resetForTest();
+    b.externalDb.init({ backends: { main: { connect: d6.connect, query: d6.query, close: d6.close } } });
+    try { await b.externalDb.query("SELECT * FROM payroll WHERE id = $1", [1]); } catch (_e) { /* expected */ }
+    await new Promise(function (r) { setImmediate(r); });
+  } finally {
+    if (origEmit) b.audit.safeEmit = origEmit;
+  }
+  var payrollRow = auditRows.filter(function (r) {
+    return r.metadata && r.metadata.attemptedTable === "payroll";
+  });
+  check("auth-failure audit carries attemptedTable", payrollRow.length >= 1);
+
   b.externalDb._resetForTest();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/incident-report.test.js

@@ -25,5 +25,70 @@ var check = helpers.check;
   try { await ir2.open({}); } catch (e) { threwBadSpec = e.code === "incident-report/bad-regime"; }
   check("incident.open refuses bad spec", threwBadSpec);
 
+  // ---- createDeadlineClock — running-clock approaching/passed alerts ----
+  // Manual-tick mode (autoStart:false) keeps the test deterministic and
+  // sleep-free; thresholds fire as the injected "now" crosses fractions
+  // of each stage deadline.
+  check("createDeadlineClock is fn", typeof b.incident.report.createDeadlineClock === "function");
+
+  var sent = [];
+  var clk = b.incident.report.createDeadlineClock({
+    notify: { send: function (m) { sent.push(m); } },
+    autoStart: false,
+    approachThresholds: [0.5, 0.9],
+  });
+  // detectedAt=0; stage deadlines initial=100, intermediate=200, final=300.
+  clk.track({ id: "inc-1", detectedAt: 0, regime: "gdpr", dueBy: { initial: 100, intermediate: 200, final: 300 } });
+  check("deadline clock: tracked=1", clk.status().tracked === 1);
+
+  clk.tick(50);   // 50% of initial → approaching@0.5
+  check("tick@50: one approaching@0.5 (initial)",
+    sent.length === 1 && sent[0].kind === "deadline_approaching" &&
+    sent[0].stage === "initial" && sent[0].threshold === 0.5);
+
+  clk.tick(55);   // still <0.9 of initial → dedupe, no new alert
+  check("tick@55: dedupe (no new alert)", sent.length === 1);
+
+  clk.tick(95);   // 95% of initial → approaching@0.9
+  check("tick@95: approaching@0.9 fires", sent.length === 2 && sent[1].threshold === 0.9);
+
+  clk.tick(150);  // initial(100) passed
+  check("tick@150: initial passed fires once",
+    sent.filter(function (m) { return m.kind === "deadline_passed" && m.stage === "initial"; }).length === 1);
+
+  clk.tick(160);  // no duplicate passed for initial
+  check("tick@160: no duplicate passed",
+    sent.filter(function (m) { return m.kind === "deadline_passed" && m.stage === "initial"; }).length === 1);
+
+  // Acknowledging a stage suppresses its further alerts.
+  clk.acknowledgeSubmission("inc-1", "intermediate");
+  clk.tick(250);  // intermediate(200) would be passed, but acked → suppressed
+  check("acknowledged stage: no passed alert",
+    sent.filter(function (m) { return m.stage === "intermediate" && m.kind === "deadline_passed"; }).length === 0);
+
+  // Construction-time + track-time input validation.
+  var badThresh = false;
+  try { b.incident.report.createDeadlineClock({ approachThresholds: [1.5] }); }
+  catch (e) { badThresh = /between 0 and 1/.test(e.message); }
+  check("createDeadlineClock rejects threshold > 1", badThresh);
+
+  var badTrack = false;
+  try { clk.track({ id: "x" }); } catch (e) { badTrack = /dueBy/.test(e.message); }
+  check("deadline clock: track without dueBy rejected", badTrack);
+
+  // Faster regime crosses before slower one on the same tick
+  // (registry windows differ — DORA vs GDPR here).
+  var sent2 = [];
+  var clk2 = b.incident.report.createDeadlineClock({
+    notify: { send: function (m) { sent2.push(m); } }, autoStart: false,
+  });
+  clk2.track({ id: "dora-1", detectedAt: 0, regime: "dora", dueBy: { initial: 4, intermediate: 8, final: 12 } });
+  clk2.track({ id: "gdpr-1", detectedAt: 0, regime: "gdpr", dueBy: { initial: 72, intermediate: 100, final: 200 } });
+  clk2.tick(5);  // DORA initial(4) passed; GDPR initial(72) only ~7% → nothing
+  check("deadline clock: faster regime crosses first",
+    sent2.filter(function (m) { return m.incidentId === "dora-1" && m.kind === "deadline_passed"; }).length === 1 &&
+    sent2.filter(function (m) { return m.incidentId === "gdpr-1"; }).length === 0);
+  clk2.stop();
+
   console.log("OK — incident.report tests");
 })().catch(function (e) { console.error(e); process.exit(1); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {