@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/saml-subjectconfirmation-notonorafter.test.js

@@ -0,0 +1,287 @@
+"use strict";
+/**
+ * b.auth.saml.sp.verifyResponse — SubjectConfirmationData NotOnOrAfter
+ * is mandatory and must fail closed.
+ *
+ * SAML 2.0 Web Browser SSO Profile §4.1.4.2 requires every Bearer
+ * SubjectConfirmationData to carry a `NotOnOrAfter` attribute that
+ * bounds the assertion's freshness window. A SubjectConfirmationData
+ * with no NotOnOrAfter — or an unparseable one — must be rejected:
+ * accepting it grants an unbounded, replay-forever confirmation. The
+ * Holder-of-Key confirmation (Profile §3.1, which incorporates the
+ * §3 time-bounding by reference) has the same requirement.
+ *
+ * These tests drive the shipped consumer path:
+ *   sp = b.auth.saml.sp.create({ ... }); sp.verifyResponse(b64, vopts).
+ * They mint a self-signed RSA IdP cert, build a genuinely XMLDSig-
+ * signed SAML Response (digest + SignatureValue computed through the
+ * framework's own b.xmlC14n so the verifier's recomputation matches),
+ * and vary ONLY the SubjectConfirmationData's NotOnOrAfter between the
+ * accepted and refused cases.
+ */
+
+var helpers    = require("../helpers");
+var check      = helpers.check;
+var b          = helpers.b;
+var nodeCrypto = require("node:crypto");
+var c14n       = require("../../lib/xml-c14n");
+
+var DS  = "http://www.w3.org/2000/09/xmldsig#";
+var EXC = "http://www.w3.org/2001/10/xml-exc-c14n#";
+
+var IDP_ENTITY_ID = "https://idp.example";
+var SP_ENTITY_ID  = "https://sp.example";
+var ACS_URL       = "https://sp.example/saml/acs";
+
+// Mint a self-signed RSA cert via the vendored @peculiar/x509 bundle.
+// verifyResponse parses idpCertPem with nodeCrypto.createPublicKey and
+// verifies an rsa-sha256 PKCS1 signature, so a real RSA cert + matching
+// private key is required — there is no test bypass of the signature
+// check.
+async function _mintRsaCert(cn) {
+  var pki  = require("../../lib/vendor/pki.cjs");
+  var x509 = pki.x509;
+  var keys = await nodeCrypto.webcrypto.subtle.generateKey(
+    { name: "RSASSA-PKCS1-v1_5", modulusLength: 2048,                                           // allow:raw-byte-literal — RFC 8301 §3.1 RSA bit floor
+      publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+    true, ["sign", "verify"]);
+  var now = new Date();
+  var cert = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber:     "01",
+    name:             "CN=" + cn,
+    notBefore:        now,
+    notAfter:         new Date(now.getTime() + 365 * 24 * 3600 * 1000),                         // allow:raw-time-literal — 1y fixture validity
+    signingAlgorithm: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    keys:             keys,
+  });
+  var pkcs8 = await nodeCrypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  var keyPem = "-----BEGIN PRIVATE KEY-----\n" +
+    Buffer.from(pkcs8).toString("base64").match(/.{1,64}/g).join("\n") +
+    "\n-----END PRIVATE KEY-----\n";
+  return { certPem: cert.toString("pem"), keyPem: keyPem };
+}
+
+function _isoFromNow(ms) { return new Date(Date.now() + ms).toISOString(); }
+
+// Build a SAML Response with an Assertion-level enveloped XMLDSig
+// signature. The Assertion's Signature child is stripped before the
+// digest (the enveloped-signature transform), and both the digest and
+// the SignedInfo are canonicalized through b.xmlC14n so the values
+// match exactly what verifyResponse recomputes.
+function _buildSignedResponse(idp, parts) {
+  var assertionId  = "_assertion-" + parts.tag;
+  var responseId   = "_response-" + parts.tag;
+  var issueInstant = _isoFromNow(0);
+  var subjectConfirmation =
+    "<saml:SubjectConfirmation Method=\"" + parts.method + "\">" +
+    parts.scd +
+    "</saml:SubjectConfirmation>";
+
+  var assertionInner =
+    "<saml:Issuer>" + IDP_ENTITY_ID + "</saml:Issuer>" +
+    "SIGNATURE_PLACEHOLDER" +
+    "<saml:Subject>" +
+    "<saml:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">" +
+    parts.nameId + "</saml:NameID>" +
+    subjectConfirmation +
+    "</saml:Subject>" +
+    "<saml:Conditions NotBefore=\"" + _isoFromNow(-5 * 60 * 1000) +                             // allow:raw-time-literal — 5m skew window
+    "\" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\">" +                                 // allow:raw-time-literal — 5m skew window
+    "<saml:AudienceRestriction><saml:Audience>" + SP_ENTITY_ID +
+    "</saml:Audience></saml:AudienceRestriction>" +
+    "</saml:Conditions>" +
+    "<saml:AuthnStatement SessionIndex=\"_sess-1\" AuthnInstant=\"" + issueInstant + "\">" +
+    "<saml:AuthnContext><saml:AuthnContextClassRef>" +
+    "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" +
+    "</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>";
+
+  var assertionOpen =
+    "<saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" " +
+    "ID=\"" + assertionId + "\" Version=\"2.0\" IssueInstant=\"" + issueInstant + "\">";
+  var assertionClose = "</saml:Assertion>";
+
+  // Digest the assertion with no Signature child (enveloped-signature
+  // transform output), canonicalized through b.xmlC14n.
+  var assertionNoSig = assertionOpen +
+    assertionInner.replace("SIGNATURE_PLACEHOLDER", "") + assertionClose;
+  var digest = nodeCrypto.createHash("sha256")
+    .update(c14n.canonicalize(assertionNoSig)).digest("base64");
+
+  var signedInfo =
+    "<ds:SignedInfo xmlns:ds=\"" + DS + "\">" +
+    "<ds:CanonicalizationMethod Algorithm=\"" + EXC + "\"></ds:CanonicalizationMethod>" +
+    "<ds:SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\"></ds:SignatureMethod>" +
+    "<ds:Reference URI=\"#" + assertionId + "\">" +
+    "<ds:Transforms>" +
+    "<ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"></ds:Transform>" +
+    "<ds:Transform Algorithm=\"" + EXC + "\"></ds:Transform>" +
+    "</ds:Transforms>" +
+    "<ds:DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></ds:DigestMethod>" +
+    "<ds:DigestValue>" + digest + "</ds:DigestValue>" +
+    "</ds:Reference>" +
+    "</ds:SignedInfo>";
+  var priv = nodeCrypto.createPrivateKey({ key: idp.keyPem, format: "pem" });
+  var sigValue = nodeCrypto.sign("sha256", c14n.canonicalize(signedInfo),
+    { key: priv, padding: nodeCrypto.constants.RSA_PKCS1_PADDING }).toString("base64");
+
+  var signatureXml =
+    "<ds:Signature xmlns:ds=\"" + DS + "\">" + signedInfo +
+    "<ds:SignatureValue>" + sigValue + "</ds:SignatureValue></ds:Signature>";
+  var assertionFull = assertionOpen +
+    assertionInner.replace("SIGNATURE_PLACEHOLDER", signatureXml) + assertionClose;
+
+  var response =
+    "<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" " +
+    "xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" " +
+    "ID=\"" + responseId + "\" Version=\"2.0\" IssueInstant=\"" + issueInstant + "\" " +
+    "Destination=\"" + ACS_URL + "\">" +
+    "<saml:Issuer>" + IDP_ENTITY_ID + "</saml:Issuer>" +
+    "<samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status>" +
+    assertionFull + "</samlp:Response>";
+
+  return Buffer.from(response, "utf8").toString("base64");
+}
+
+function _bearerScd(notOnOrAfterAttr, inResponseTo) {
+  return "<saml:SubjectConfirmationData" + notOnOrAfterAttr +
+    " Recipient=\"" + ACS_URL + "\"" +
+    " InResponseTo=\"" + inResponseTo + "\"/>";
+}
+
+function _certBodyB64(pem) {
+  return pem.replace(/-----BEGIN CERTIFICATE-----/, "")
+            .replace(/-----END CERTIFICATE-----/, "")
+            .replace(/\s+/g, "");
+}
+
+function _hokScd(notOnOrAfterAttr, holderCertPem) {
+  return "<saml:SubjectConfirmationData" + notOnOrAfterAttr +
+    " Recipient=\"" + ACS_URL + "\">" +
+    "<ds:KeyInfo xmlns:ds=\"" + DS + "\"><ds:X509Data><ds:X509Certificate>" +
+    _certBodyB64(holderCertPem) +
+    "</ds:X509Certificate></ds:X509Data></ds:KeyInfo>" +
+    "</saml:SubjectConfirmationData>";
+}
+
+function _newSp(idp) {
+  return b.auth.saml.sp.create({
+    entityId:                    SP_ENTITY_ID,
+    assertionConsumerServiceUrl: ACS_URL,
+    idpEntityId:                 IDP_ENTITY_ID,
+    idpSsoUrl:                   "https://idp.example/sso",
+    idpCertPem:                  idp.certPem,
+  });
+}
+
+function _verifyThrows(sp, b64, vopts) {
+  try { sp.verifyResponse(b64, vopts); return null; }
+  catch (e) { return e.code || e.message; }
+}
+
+// Case 1 — a valid future NotOnOrAfter succeeds. Proves the signer +
+// harness are correct and the fail-closed fix does not break the
+// happy path.
+async function testBearerValidNotOnOrAfterAccepted() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-valid";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-valid",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"", inResponseTo),   // allow:raw-time-literal — 5m future
+  });
+  var info = sp.verifyResponse(b64, { expectedInResponseTo: inResponseTo });
+  check("Bearer with valid NotOnOrAfter verifies",       info && typeof info === "object");
+  check("Bearer valid: nameId returned",                 info.nameId === "alice@example.com");
+  check("Bearer valid: issuer matches IdP entityID",     info.issuer === IDP_ENTITY_ID);
+  check("Bearer valid: inResponseTo captured",           info.inResponseTo === inResponseTo);
+}
+
+// Case 2 — a Bearer SubjectConfirmationData with NO NotOnOrAfter must
+// be refused (§4.1.4.2). This is the RED case: on the unfixed tree the
+// confirmation is wrongly accepted as fresh-forever.
+async function testBearerMissingNotOnOrAfterRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-missing";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-missing",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd("", inResponseTo),
+  });
+  var code = _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo });
+  check("Bearer missing NotOnOrAfter is refused",
+    code === "auth-saml/no-valid-confirmation");
+}
+
+// Case 3 — a Bearer SubjectConfirmationData with an UNPARSEABLE
+// NotOnOrAfter must be refused (it cannot bound freshness).
+async function testBearerUnparseableNotOnOrAfterRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-bad";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-bad",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotOnOrAfter=\"not-a-date\"", inResponseTo),
+  });
+  var code = _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo });
+  check("Bearer unparseable NotOnOrAfter is refused",
+    code === "auth-saml/no-valid-confirmation");
+}
+
+// Case 4 — the Holder-of-Key sibling: an HoK SubjectConfirmationData
+// missing NotOnOrAfter (and one with an unparseable value) must be
+// refused. On the unfixed tree both are wrongly accepted (the missing
+// case skips the check; the unparseable case is masked by an `&&`
+// short-circuit).
+async function testHolderOfKeyNotOnOrAfterRefused() {
+  var idp    = await _mintRsaCert("idp.example");
+  var holder = await _mintRsaCert("holder.example");
+  var sp     = _newSp(idp);
+  var vopts  = { holderOfKey: { presentedCertPem: holder.certPem } };
+
+  // Sanity — a valid HoK NotOnOrAfter verifies (harness correctness).
+  var b64ok = _buildSignedResponse(idp, {
+    tag:    "hok-valid",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key",
+    nameId: "bob@example.com",
+    scd:    _hokScd(" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"", holder.certPem),    // allow:raw-time-literal — 5m future
+  });
+  var info = sp.verifyResponse(b64ok, vopts);
+  check("HoK with valid NotOnOrAfter verifies",          info && info.nameId === "bob@example.com");
+
+  var b64missing = _buildSignedResponse(idp, {
+    tag:    "hok-missing",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key",
+    nameId: "bob@example.com",
+    scd:    _hokScd("", holder.certPem),
+  });
+  check("HoK missing NotOnOrAfter is refused",
+    _verifyThrows(sp, b64missing, vopts) === "auth-saml/no-valid-confirmation");
+
+  var b64bad = _buildSignedResponse(idp, {
+    tag:    "hok-bad",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key",
+    nameId: "bob@example.com",
+    scd:    _hokScd(" NotOnOrAfter=\"not-a-date\"", holder.certPem),
+  });
+  check("HoK unparseable NotOnOrAfter is refused",
+    _verifyThrows(sp, b64bad, vopts) === "auth-saml/no-valid-confirmation");
+}
+
+async function run() {
+  await testBearerValidNotOnOrAfterAccepted();
+  await testBearerMissingNotOnOrAfterRefused();
+  await testBearerUnparseableNotOnOrAfterRefused();
+  await testHolderOfKeyNotOnOrAfterRefused();
+}
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/sd-jwt-vc-ecdsa-p1363.test.js

@@ -0,0 +1,79 @@
+"use strict";
+// #135: SD-JWT-VC ES256/ES384 signatures must be JOSE-encoded (raw r||s,
+// "ieee-p1363"), not node:crypto's default DER. A DER signature (ASN.1
+// SEQUENCE, leading 0x30, ~70-72 bytes for P-256) is rejected by every
+// conformant JOSE / EUDI-wallet verifier, and this library would likewise
+// reject a conformant wallet's raw-r||s signature. The issuer JWT and the
+// holder KB-JWT both sign through the core _signJwt, so the format applies
+// to both.
+//
+// RED on the buggy tree: the issuer-JWT signature is DER (length != 64,
+// first byte 0x30) and a JOSE-conformant verifier (dsaEncoding ieee-p1363)
+// rejects it. GREEN after the fix: signature is exactly 64 bytes and the
+// conformant verifier accepts it.
+
+var helpers = require("../helpers");
+var b = helpers.b;
+var check = helpers.check;
+var nodeCrypto = require("node:crypto");
+var sdJwtVc = b.auth.sdJwtVc;
+
+function _b64uToBuf(s) {
+  return Buffer.from(s, "base64url");
+}
+
+async function run() {
+  var issuer = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+
+  var sd = sdJwtVc.issue({
+    issuer:  "https://issuer.example.com",
+    subject: "did:web:alice",
+    vct:     "https://example.com/vct/identity",
+    claims:  { given_name: "Alice", country: "US" },
+    selectivelyDisclosed: ["given_name"],
+    issuerKey: issuer.privateKey,
+    algorithm: "ES256",
+  });
+
+  // An SD-JWT serializes as <issuerJWT>~<disclosure>~…~ — strip the
+  // tilde-joined disclosures to get the issuer JWT before splitting on ".".
+  var issuerJwt = sd.token.split("~")[0];
+  var parts = issuerJwt.split(".");
+  check("issuer JWT has 3 parts", parts.length === 3);
+  var signingInput = parts[0] + "." + parts[1];
+  var sig = _b64uToBuf(parts[2]);
+
+  // ES256 raw r||s is exactly 64 bytes; DER is variable (~70-72) and starts
+  // with the 0x30 SEQUENCE tag.
+  check("#135 ES256 signature is JOSE raw r||s (64 bytes), not DER",
+        sig.length === 64);
+  check("#135 ES256 signature does not carry the DER SEQUENCE tag",
+        sig[0] !== 0x30 || sig.length === 64);
+
+  // A JOSE-conformant verifier (explicit ieee-p1363) must accept it. On the
+  // buggy tree the signature is DER, so a conformant verifier rejects it.
+  var conformantOk = nodeCrypto.verify(
+    "sha256",
+    Buffer.from(signingInput, "ascii"),
+    { key: issuer.publicKey, dsaEncoding: "ieee-p1363" },
+    sig);
+  check("#135 a JOSE-conformant verifier (ieee-p1363) accepts the issuer JWT",
+        conformantOk === true);
+
+  // ES384 carries the same root — exercise it too (96-byte raw r||s).
+  var issuer384 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-384" });
+  var sd384 = sdJwtVc.issue({
+    issuer:  "https://issuer.example.com",
+    subject: "did:web:carol",
+    vct:     "https://example.com/vct/identity",
+    claims:  { given_name: "Carol" },
+    selectivelyDisclosed: ["given_name"],
+    issuerKey: issuer384.privateKey,
+    algorithm: "ES384",
+  });
+  var sig384 = _b64uToBuf(sd384.token.split("~")[0].split(".")[2]);
+  check("#135 ES384 signature is JOSE raw r||s (96 bytes), not DER",
+        sig384.length === 96);
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/sd-jwt-vc.test.js

@@ -695,6 +695,55 @@ async function testHolderAlgFromKeyType() {
         rsaThrew && rsaThrew.code === "auth-sd-jwt-vc/holder-key-unsupported");
 }
 
+// ---- FIX 4B: holder KB-JWT alg/kty cross-check ----
+
+// The KB-JWT header alg is attacker-controllable (the holder mints the
+// KB-JWT). The verifier must cross-check it against the holder's cnf.jwk
+// key type BEFORE handing bytes to node:crypto.verify — the same
+// CVE-2026-22817 defense the issuer path applies. An EC cnf key with a
+// KB-JWT header claiming EdDSA (which requires kty=OKP) must be refused
+// with the precise alg-mismatch error.
+async function testKbAlgKtyCrossCheck() {
+  var issuer = _newKeyPair();
+  var holder = _newKeyPair();   // EC P-256
+  var sd = sdJwtVc.issue({
+    issuer:   "https://issuer", vct: "x",
+    claims:   { given_name: "Alice" },
+    selectivelyDisclosed: ["given_name"],
+    issuerKey: issuer.privateKey,
+    holderKey: _jwk(holder.publicKey),
+  });
+  // Build a valid presentation, then replace its real KB-JWT with a forged
+  // one whose header declares EdDSA against the EC holder key.
+  var pres = sdJwtVc.present({
+    sdJwt:               sd.token,
+    disclosedClaimNames: ["given_name"],
+    audience:            "https://verifier",
+    nonce:               "n-1",
+    holderKey:           holder.privateKey,
+    algorithm:           "ES256",
+  });
+  var segs = pres.presentation.split("~");
+  // Forge a KB-JWT segment: EdDSA header (OKP), EC holder key → mismatch.
+  function b64u(obj) { return Buffer.from(JSON.stringify(obj), "utf8").toString("base64url"); }
+  var forgedHeader = b64u({ typ: "kb+jwt", alg: "EdDSA" });
+  var forgedPayload = b64u({ aud: "https://verifier", nonce: "n-1", iat: Math.floor(Date.now() / 1000), sd_hash: "x" });
+  segs[segs.length - 1] = forgedHeader + "." + forgedPayload + ".AAAA";
+  var forgedPres = segs.join("~");
+
+  var threw = null;
+  try {
+    await sdJwtVc.verify(forgedPres, {
+      issuerKeyResolver: async function () { return issuer.publicKey; },
+      audience:          "https://verifier",
+      nonce:             "n-1",
+      requireKeyBinding: true,
+    });
+  } catch (e) { threw = e; }
+  check("KB alg/kty: mismatched KB-JWT alg refused with precise error",
+        threw && threw.code === "auth-jwt-external/alg-kty-mismatch");
+}
+
 // ---- Module exports ----
 
 function testExports() {
@@ -742,5 +791,6 @@ function testExports() {
   await testHolderPresentNonexistent();
   testHolderValidation();
   await testHolderAlgFromKeyType();
+  await testKbAlgKtyCrossCheck();
   testExports();
 })().catch(function (e) { console.error(e); process.exit(1); });

package/lib/vendor/blamejs/test/layer-0-primitives/security-headers.test.js

@@ -168,8 +168,9 @@ function testReportOnlyHeadersEmittedWhenOptedIn() {
 
 function testReportOnlyDoesNotTouchEnforcingHeaders() {
   // Monitor-mode opt-ins must not alter the enforcing COOP / COEP /
-  // Document-Policy headers: COOP stays same-origin, COEP stays off by
-  // default, Document-Policy keeps its enforcing default.
+  // Document-Policy headers: COOP stays same-origin, the enforcing COEP
+  // keeps its default-on `credentialless` value (the report-only opt is a
+  // separate header), Document-Policy keeps its enforcing default.
   var mw = b.middleware.securityHeaders({
     coopReportOnly: "same-origin",
     coepReportOnly: "require-corp",
@@ -178,8 +179,8 @@ function testReportOnlyDoesNotTouchEnforcingHeaders() {
   mw({ headers: {} }, res, function () {});
   check("enforcing COOP unchanged by coopReportOnly",
     res._hdrs["Cross-Origin-Opener-Policy"] === "same-origin");
-  check("COEP stays off by default despite coepReportOnly",
-    res._hdrs["Cross-Origin-Embedder-Policy"] === undefined);
+  check("enforcing COEP keeps its default-on value despite coepReportOnly",
+    res._hdrs["Cross-Origin-Embedder-Policy"] === "credentialless");
   check("enforcing Document-Policy unchanged by report-only opts",
     res._hdrs["Document-Policy"] === b.middleware._modules.securityHeaders.DEFAULT_DOCUMENT_POLICY);
 }
@@ -254,6 +255,31 @@ function testUnknownOptStillRefused() {
   check("typo'd report-only opt refused at config-time", threw);
 }
 
+function testCoepDefaultOnAndOptOut() {
+  // Default-on (v0.15.0): the enforcing Cross-Origin-Embedder-Policy is
+  // emitted as `credentialless` with no operator action, so COOP+COEP
+  // together yield cross-origin isolation out of the box.
+  var resDefault = _mkRes();
+  b.middleware.securityHeaders()({ headers: {} }, resDefault, function () {});
+  check("COEP default-on: Cross-Origin-Embedder-Policy is credentialless",
+    resDefault._hdrs["Cross-Origin-Embedder-Policy"] === "credentialless");
+  check("COOP stays same-origin alongside the default COEP",
+    resDefault._hdrs["Cross-Origin-Opener-Policy"] === "same-origin");
+
+  // Tighten: operators serving only same-origin / CORP-marked subresources
+  // pass coep: "require-corp" for the strict enforcing mode.
+  var resStrict = _mkRes();
+  b.middleware.securityHeaders({ coep: "require-corp" })({ headers: {} }, resStrict, function () {});
+  check("COEP tighten: coep:'require-corp' overrides the default",
+    resStrict._hdrs["Cross-Origin-Embedder-Policy"] === "require-corp");
+
+  // Documented opt-out: coep:false disables COEP entirely (no header).
+  var resOff = _mkRes();
+  b.middleware.securityHeaders({ coep: false })({ headers: {} }, resOff, function () {});
+  check("COEP opt-out: coep:false emits no Cross-Origin-Embedder-Policy header",
+    resOff._hdrs["Cross-Origin-Embedder-Policy"] === undefined);
+}
+
 async function run() {
   testFencedFrameSrcInDefaultCsp();
   testDocumentPolicyDefault();
@@ -276,6 +302,7 @@ async function run() {
   testServiceWorkerAllowedDefaultOff();
   testNewOptsNonStringIgnored();
   testUnknownOptStillRefused();
+  testCoepDefaultOnAndOptOut();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/session-extensions.test.js

@@ -273,6 +273,50 @@ async function testUpdateDataPreservesFingerprint() {
   }
 }
 
+async function testRotateRekeysFingerprint() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-rotate-fp-"));
+  try {
+    await setupTestDb(tmpDir);
+    var req = _makeReq({ "user-agent": "ua-rot-1", "x-forwarded-for": "203.0.113.10" });
+    var s = await b.session.create({
+      userId:            "u-rot",
+      data:              { roles: ["user"] },
+      req:               req,
+      fingerprintFields: ["clientIp", "userAgent"],
+    });
+    var pre = await b.session.verify(s.token, { req: req, fingerprintFields: ["clientIp", "userAgent"] });
+    check("rotate-fp: pre-rotation no drift", pre && pre.fingerprintDrift === false);
+
+    // Rotation (login transition / role escalation) moves the sid. __bj_fingerprint
+    // is sid-keyed, so the new session must RE-KEY the binding to the new sid from
+    // the live request — otherwise verify(newToken, sameReq) recomputes against the
+    // new sid and falsely reports drift (logout under strict operators), or the
+    // binding silently breaks.
+    var rotated = await b.session.rotate(s.token, {
+      req: req, fingerprintFields: ["clientIp", "userAgent"],
+    });
+    check("rotate-fp: rotation returns a new token", rotated && typeof rotated.token === "string");
+
+    var sameDevice = await b.session.verify(rotated.token, {
+      req: req, fingerprintFields: ["clientIp", "userAgent"],
+    });
+    check("rotate-fp: same device → no drift after rotation (binding re-keyed)",
+          sameDevice && sameDevice.fingerprintDrift === false);
+    check("rotate-fp: operator data carried across rotation",
+          sameDevice && sameDevice.data && sameDevice.data.roles && sameDevice.data.roles[0] === "user");
+
+    // A different device must still drift — proves the binding is live, not dropped.
+    var otherReq = _makeReq({ "user-agent": "ua-OTHER", "x-forwarded-for": "198.51.100.7" });
+    var otherDevice = await b.session.verify(rotated.token, {
+      req: otherReq, fingerprintFields: ["clientIp", "userAgent"],
+    });
+    check("rotate-fp: different device → drift after rotation (binding still enforced)",
+          otherDevice && otherDevice.fingerprintDrift === true);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function run() {
   await testSealedCookieDefault();
   await testSealedCookieRotateAndDestroy();
@@ -283,6 +327,7 @@ async function run() {
   await testPluggableStoreValidation();
   await testUpdateDataReplaceAndMerge();
   await testUpdateDataPreservesFingerprint();
+  await testRotateRekeysFingerprint();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/sigv4-bucket-ops.test.js

@@ -14,6 +14,7 @@
 var helpers = require("../helpers");
 var http               = require("http");
 var bucketOps          = require("../../lib/object-store/sigv4-bucket-ops");
+var sigv4              = require("../../lib/object-store/sigv4");
 var b                  = helpers.b;
 var check              = helpers.check;
 var listenOnRandomPort = helpers.listenOnRandomPort;
@@ -969,8 +970,56 @@ async function testPerCallActorOverrideHonored() {
   }
 }
 
+function testCanonicalPathSingleEncodeForS3() {
+  // Regression: S3 (and S3-compatible stores + GCS's V4) URI-encode the
+  // canonical path ONCE; the older code double-encoded it, so any object key
+  // with a space / + / & / unicode signed a path the wire never carried →
+  // SignatureDoesNotMatch (403). Drive the real signRequest path with a
+  // special-char key and assert the canonical path line equals the wire
+  // pathname byte-for-byte. (Pre-fix this matched only for ASCII keys, which
+  // is why every shipped test passed while real keys 403'd.)
+  var key = "my report (v2)+final & draft.txt";
+  var encodedKey = key.split("/").map(function (s) { return sigv4.awsUriEncode(s, true); }).join("/");
+  var url = new URL("https://bucket.s3.example.com");
+  url.pathname = "/" + encodedKey;
+
+  var s3 = sigv4.signRequest({
+    method: "GET", url: url, headers: {}, payloadHash: "UNSIGNED-PAYLOAD",
+    region: "us-east-1", accessKeyId: "AK", secretAccessKey: "sk", date: new Date(0),
+  });
+  var s3CanonPath = s3.canonicalRequest.split("\n")[1];
+  check("S3 canonical path single-encodes — equals the wire pathname (no double-encode)",
+        s3CanonPath === url.pathname);
+  check("S3 canonical path has no double-encoded %25 sequence",
+        s3CanonPath.indexOf("%25") === -1 && url.pathname.indexOf("%25") === -1);
+
+  // The non-S3 services (sqs/logs/sns) MUST keep the double-encode (AWS spec).
+  var u2 = new URL("https://sqs.us-east-1.amazonaws.com");
+  u2.pathname = "/a%20b";
+  var sqs = sigv4.signRequest({
+    method: "GET", url: u2, headers: {}, payloadHash: sigv4.sha256Hex(""),
+    region: "us-east-1", service: "sqs", accessKeyId: "AK", secretAccessKey: "sk", date: new Date(0),
+  });
+  var sqsCanonPath = sqs.canonicalRequest.split("\n")[1];
+  check("non-S3 service still double-encodes the canonical path (spec-correct, unchanged)",
+        sqsCanonPath === "/a%2520b");
+
+  // awsUriEncode escapes the AWS reserved set (!*'()) that encodeURIComponent
+  // leaves alone, so the bucket-ops wire path matches the bytes S3 signs over.
+  check("awsUriEncode escapes !*'() that encodeURIComponent leaves raw",
+        sigv4.awsUriEncode("a!b*c'd(e)", true) === "a%21b%2Ac%27d%28e%29");
+
+  // A key with a non-BMP code point (emoji, CJK extension B, ...) must encode
+  // by code point, not UTF-16 unit — otherwise the surrogate pair is split and
+  // encodeURIComponent throws "URIError: URI malformed" before the request is
+  // even signed.
+  check("awsUriEncode encodes a non-BMP code point as one UTF-8 sequence (no URIError)",
+        sigv4.awsUriEncode("photo-\u{1F600}.jpg", true) === "photo-%F0%9F%98%80.jpg");
+}
+
 async function run() {
   testSurface();
+  testCanonicalPathSingleEncodeForS3();
   testFactoryValidation();
   testBucketNameValidation();
   testLifecycleXml();