@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/permissions.test.js

@@ -511,11 +511,523 @@ function testDbRoleFor() {
     /BAD_ROLE/);
 }
 
+// ---- Role-table validation: uncovered adversarial branches ----
+
+function testRoleTableValidationEdgeCases() {
+  function expect(label, fn, code) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check(label, threw && threw.code === code);
+  }
+
+  // permissions must be an array (lib line 137-138)
+  expect("create: permissions not an array → BAD_ROLE",
+    function () { b.permissions.create({ roles: { admin: { permissions: "users:read" } } }); },
+    "BAD_ROLE");
+
+  // null entry short-circuits the `entry && typeof === object` guard →
+  // falls to the catch-all throw (lib line 169; left-operand false branch)
+  expect("create: null role entry → BAD_ROLE",
+    function () { b.permissions.create({ roles: { admin: null } }); },
+    "BAD_ROLE");
+  expect("create: boolean role entry → BAD_ROLE",
+    function () { b.permissions.create({ roles: { admin: true } }); },
+    "BAD_ROLE");
+
+  // mfaWindowMs must be a positive finite number (lib line 160-163)
+  expect("create: negative role mfaWindowMs → BAD_ROLE",
+    function () { b.permissions.create({ roles: { a: { permissions: ["x:y"], mfaWindowMs: -1 } } }); },
+    "BAD_ROLE");
+  expect("create: zero role mfaWindowMs → BAD_ROLE",
+    function () { b.permissions.create({ roles: { a: { permissions: ["x:y"], mfaWindowMs: 0 } } }); },
+    "BAD_ROLE");
+  expect("create: NaN role mfaWindowMs → BAD_ROLE",
+    function () { b.permissions.create({ roles: { a: { permissions: ["x:y"], mfaWindowMs: NaN } } }); },
+    "BAD_ROLE");
+  expect("create: Infinity role mfaWindowMs → BAD_ROLE",
+    function () { b.permissions.create({ roles: { a: { permissions: ["x:y"], mfaWindowMs: Infinity } } }); },
+    "BAD_ROLE");
+  expect("create: string role mfaWindowMs → BAD_ROLE",
+    function () { b.permissions.create({ roles: { a: { permissions: ["x:y"], mfaWindowMs: "600000" } } }); },
+    "BAD_ROLE");
+
+  // valid mfaWindowMs is accepted + a role with extends but NO permissions
+  // key exercises the `entry.permissions || []` default (lib line 136, 164-165)
+  var ok = b.permissions.create({
+    roles: {
+      base:  ["reports:read"],
+      admin: { extends: ["base"], requireMfa: true, mfaWindowMs: 600000 },
+    },
+  });
+  check("create: role with valid mfaWindowMs + no own permissions builds",
+    ok.expand(["admin"]).indexOf("reports:read") !== -1);
+
+  // empty-string role name (Object.keys yields "") (lib line 184-185)
+  expect("create: empty-string role name → BAD_ROLE",
+    function () { b.permissions.create({ roles: { "": ["a:b"] } }); },
+    "BAD_ROLE");
+
+  // extends entries must be non-empty strings (lib line 191-193)
+  expect("create: empty-string extends entry → BAD_ROLE",
+    function () { b.permissions.create({ roles: { a: { extends: [""], permissions: [] } } }); },
+    "BAD_ROLE");
+  expect("create: non-string extends entry → BAD_ROLE",
+    function () { b.permissions.create({ roles: { a: { extends: [42], permissions: [] } } }); },
+    "BAD_ROLE");
+}
+
+// Per-segment wildcard where required has fewer segments (lib line 99)
+function testMatchPerSegmentWildcardShortRequired() {
+  var m = b.permissions.match;
+  check("users:*:read vs users → false (required too short at wildcard)",
+    m("users:*:read", "users") === false);
+  check("a:*:c vs a → false",  m("a:*:c", "a") === false);
+  check("*:read vs empty-segmentless still handled",
+    m("a:*:c", "a:x") === false); // required exhausted after non-wildcard match at index 2
+}
+
+// ---- Middleware registration-time opt validation (lib 465-469, 476-477) ----
+
+function testMiddlewareOptValidation() {
+  var p = b.permissions.create({ roles: { admin: ["*"] } });
+  function expect(label, fn, code) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check(label, threw && threw.code === code);
+  }
+  expect("require: negative mfaWindowMs → BAD_OPT",
+    function () { p.require("users:read", { mfaWindowMs: -5 }); }, "BAD_OPT");
+  expect("require: zero mfaWindowMs → BAD_OPT",
+    function () { p.require("users:read", { mfaWindowMs: 0 }); }, "BAD_OPT");
+  expect("require: NaN mfaWindowMs → BAD_OPT",
+    function () { p.require("users:read", { mfaWindowMs: NaN }); }, "BAD_OPT");
+  expect("require: Infinity mfaWindowMs → BAD_OPT",
+    function () { p.require("users:read", { mfaWindowMs: Infinity }); }, "BAD_OPT");
+  expect("require: string mfaWindowMs → BAD_OPT",
+    function () { p.require("users:read", { mfaWindowMs: "1000" }); }, "BAD_OPT");
+  expect("require: non-function context → BAD_OPT",
+    function () { p.require("users:read", { context: "not-a-fn" }); }, "BAD_OPT");
+  expect("require: object context → BAD_OPT",
+    function () { p.require("users:read", { context: {} }); }, "BAD_OPT");
+
+  // A valid, explicit mfaWindowMs opt is accepted at registration.
+  var mw = p.require("users:read", { mfaWindowMs: 600000, context: function (req) { return req; } });
+  check("require: valid mfaWindowMs + context opts accepted", typeof mw === "function");
+}
+
+// ---- policy() registration (lib 350-382) ----
+
+function testPolicyRegistration() {
+  var p = b.permissions.create({ roles: { svc: ["orders:read", "orders:write"] } });
+  function expect(label, fn, code) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check(label, threw && threw.code === code);
+  }
+
+  // Bad scope shape rejected (lib 351)
+  expect("policy: bad scope shape → BAD_SCOPE",
+    function () { p.policy("Bad:Scope", function (a, c) { return true; }); }, "BAD_SCOPE");
+  // Non-function predicate (lib 352-353)
+  expect("policy: non-function predicate → BAD_OPT",
+    function () { p.policy("orders:read", "nope"); }, "BAD_OPT");
+
+  // First registration succeeds; second on same scope is refused (lib 355-357)
+  p.policy("orders:read", function (a, c) { return true; });
+  expect("policy: duplicate scope → DUPLICATE_POLICY",
+    function () { p.policy("orders:read", function (a, c) { return true; }); }, "DUPLICATE_POLICY");
+}
+
+function testPolicyPredicateArityWarning() {
+  var audit = b.testing.captureAudit();
+  var p = b.permissions.create({ roles: { svc: ["orders:write"] }, audit: audit });
+
+  // Arity-1 predicate (forgot the context param) → one-time register-time
+  // audit warning (lib 365-380).
+  p.policy("orders:write", function (actor) { return true; });
+  var warns = audit.byAction("permissions.policy_predicate_shape_warning");
+  check("policy: arity<2 predicate emits shape warning", warns.length === 1);
+  check("policy: shape warning carries the scope + arity",
+    warns[0].metadata && warns[0].metadata.scope === "orders:write" && warns[0].metadata.arity === 1);
+
+  // Arity-0 predicate also warns.
+  p.policy("orders:read", function () { return true; });
+  check("policy: arity-0 predicate warns too",
+    audit.byAction("permissions.policy_predicate_shape_warning").length === 2);
+
+  // A correct arity-2 predicate does NOT warn.
+  audit.clear();
+  var p2 = b.permissions.create({ roles: { svc: ["orders:write"] }, audit: audit });
+  p2.policy("orders:write", function (actor, ctx) { return true; });
+  check("policy: arity-2 predicate does not warn",
+    audit.byAction("permissions.policy_predicate_shape_warning").length === 0);
+
+  // Arity<2 with NO audit sink must not throw (drop-silent guard, lib 366-379).
+  var p3 = b.permissions.create({ roles: { svc: ["orders:write"] } });
+  var threw = null;
+  try { p3.policy("orders:write", function (a) { return true; }); } catch (e) { threw = e; }
+  check("policy: arity<2 without audit sink does not throw", threw === null);
+}
+
+// ---- MFA enforcement gate (lib 526-604) ----
+
+function testMfaPerRouteEnforcement() {
+  var minutes = b.constants.TIME.minutes;
+  var p = b.permissions.create({
+    roles: { editor: ["users:read", "users:write"] },
+    // Default resolver drops mfaAuthenticated/mfaAt; MFA-aware operators
+    // return the full user object.
+    resolver: function (req) { return req.user || null; },
+  });
+
+  // Route requires MFA; actor never stepped up → mfa_required deny.
+  return (async function () {
+    var mw = p.require("users:write", { requireMfa: true });
+
+    var noMfa = await _runMiddleware(mw, Object.assign(_mockReq(), { user: { roles: ["editor"] } }));
+    check("mfa route: un-stepped-up actor denied", noMfa.res._endedStatus === 403);
+    check("mfa route: mfa_required in body", /mfa_required/.test(noMfa.res._captured));
+    check("mfa route: next() not called", noMfa.nextCalled === false);
+
+    // Fresh MFA stamp → passes (window floor 15m, mfaAt = now).
+    var fresh = await _runMiddleware(mw, Object.assign(_mockReq(), {
+      user: { roles: ["editor"], mfaAuthenticated: true, mfaAt: Date.now() },
+    }));
+    check("mfa route: fresh step-up passes", fresh.nextCalled === true);
+
+    // Stale MFA stamp beyond the 15m default window floor → denied (lib 578-586).
+    var stale = await _runMiddleware(mw, Object.assign(_mockReq(), {
+      user: { roles: ["editor"], mfaAuthenticated: true, mfaAt: Date.now() - minutes(20) },
+    }));
+    check("mfa route: stale step-up beyond default window denied", stale.res._endedStatus === 403);
+
+    // Explicit larger window lets the same stale stamp through (lib 464-468 valid path).
+    var wide = p.require("users:write", { requireMfa: true, mfaWindowMs: minutes(30) });
+    var wideR = await _runMiddleware(wide, Object.assign(_mockReq(), {
+      user: { roles: ["editor"], mfaAuthenticated: true, mfaAt: Date.now() - minutes(20) },
+    }));
+    check("mfa route: explicit 30m window admits a 20m-old step-up", wideR.nextCalled === true);
+  })();
+}
+
+async function testMfaPerRoleEnforcement() {
+  var minutes = b.constants.TIME.minutes;
+  var cap = b.testing.captureMetricsTap();
+  var audit = b.testing.captureAudit();
+  try {
+    var p = b.permissions.create({
+      roles: {
+        admin:   { permissions: ["users:delete"], requireMfa: true, mfaWindowMs: minutes(10) },
+        billing: { permissions: ["billing:read"], requireMfa: true },
+        reader:  ["users:read"],
+      },
+      audit:    audit,
+      resolver: function (req) { return req.user || null; },
+    });
+
+    // Route has NO requireMfa; the admin role's requireMfa forces the gate
+    // because admin grants the requested users:delete (lib 536-568).
+    var mw = p.require("users:delete");
+    var denied = await _runMiddleware(mw, Object.assign(_mockReq(), { user: { roles: ["admin"] } }));
+    check("mfa role: role-level requireMfa forces gate → deny", denied.res._endedStatus === 403);
+    check("mfa role: mfa.required audit emitted",
+      audit.byAction("permissions.mfa.required").length > 0);
+    check("mfa role: mfa_required metric emitted",
+      cap.byName("permissions.mfa_required").length > 0);
+
+    // With a fresh step-up (within the role's 10m window) → passes.
+    var okr = await _runMiddleware(mw, Object.assign(_mockReq(), {
+      user: { roles: ["admin"], mfaAuthenticated: true, mfaAt: Date.now() },
+    }));
+    check("mfa role: fresh step-up within role window passes", okr.nextCalled === true);
+
+    // Stale beyond the role's 10m window → denied (lib 564-566 window propagation).
+    var staleR = await _runMiddleware(mw, Object.assign(_mockReq(), {
+      user: { roles: ["admin"], mfaAuthenticated: true, mfaAt: Date.now() - minutes(15) },
+    }));
+    check("mfa role: stale beyond role's own window denied", staleR.res._endedStatus === 403);
+
+    // A requireMfa role whose scopes DON'T match the request does NOT force
+    // the gate; a second non-mfa role satisfies RBAC (lib 554-555 no-match,
+    // 547 non-mfa-role continue). billing.requireMfa but grants billing:read,
+    // reader grants users:read — request users:read → no MFA.
+    var mwRead = p.require("users:read");
+    var noGate = await _runMiddleware(mwRead, Object.assign(_mockReq(), {
+      user: { roles: ["billing", "reader"] },
+    }));
+    check("mfa role: non-matching requireMfa role does not force gate", noGate.nextCalled === true);
+
+    // Non-string entry in actor.roles is skipped during the MFA walk (lib 544).
+    var mixed = await _runMiddleware(mwRead, Object.assign(_mockReq(), {
+      user: { roles: [42, "reader"] },
+    }));
+    check("mfa role: non-string role entry skipped in MFA walk", mixed.nextCalled === true);
+  } finally {
+    cap.restore();
+  }
+}
+
+// ---- ABAC policy evaluation in the request lifecycle (lib 606-684) ----
+
+async function testPolicyAbacSingleMode() {
+  var audit = b.testing.captureAudit();
+  var cap = b.testing.captureMetricsTap();
+  try {
+    // Policy passes → request proceeds (lib 615, 647-652, 668 true, 686 success).
+    var pass = b.permissions.create({ roles: { svc: ["orders:write"] }, audit: audit });
+    pass.policy("orders:write", function (actor, ctx) { return true; });
+    var passR = await _runMiddleware(pass.require("orders:write"),
+      Object.assign(_mockReq(), { user: { scopes: ["orders:write"] } }));
+    check("abac single: passing policy proceeds", passR.nextCalled === true);
+
+    // Policy returns falsy → 403 policy_denied + policy.deny audit (lib 668-682).
+    var deny = b.permissions.create({ roles: { svc: ["orders:write"] }, audit: audit });
+    deny.policy("orders:write", function (actor, ctx) { return false; });
+    var denyR = await _runMiddleware(deny.require("orders:write"),
+      Object.assign(_mockReq(), { user: { scopes: ["orders:write"] } }));
+    check("abac single: failing policy → 403", denyR.res._endedStatus === 403);
+    check("abac single: policy_denied in body", /policy_denied/.test(denyR.res._captured));
+    check("abac single: policy.deny audit emitted",
+      audit.byAction("permissions.policy.deny").length > 0);
+
+    // Predicate throws → 403 policy_error + policy.error audit (lib 653-667).
+    var thrower = b.permissions.create({ roles: { svc: ["orders:write"] }, audit: audit });
+    thrower.policy("orders:write", function (actor, ctx) { throw new Error("boom-predicate"); });
+    var throwR = await _runMiddleware(thrower.require("orders:write"),
+      Object.assign(_mockReq(), { user: { scopes: ["orders:write"] } }));
+    check("abac single: throwing predicate → 403", throwR.res._endedStatus === 403);
+    check("abac single: policy_error in body", /policy_error/.test(throwR.res._captured));
+    var perr = audit.byAction("permissions.policy.error");
+    check("abac single: policy.error audit with predicate-threw reason",
+      perr.some(function (e) { return e.reason === "predicate-threw"; }));
+    check("abac single: policy_error metric emitted",
+      cap.byName("permissions.policy_error").length > 0);
+  } finally {
+    cap.restore();
+  }
+}
+
+async function testPolicyAbacContextProvider() {
+  var audit = b.testing.captureAudit();
+  var cap = b.testing.captureMetricsTap();
+  try {
+    // Context provider result is threaded into the predicate (lib 626-629).
+    var p = b.permissions.create({ roles: { svc: ["orders:write"] }, audit: audit });
+    p.policy("orders:write", function (actor, ctx) { return ctx && ctx.tenant === "acme"; });
+    var mw = p.require("orders:write", {
+      context: async function (req) { return { tenant: req.tenant }; },
+    });
+
+    var okReq = Object.assign(_mockReq(), { user: { scopes: ["orders:write"] }, tenant: "acme" });
+    var okR = await _runMiddleware(mw, okReq);
+    check("abac context: matching context admits request", okR.nextCalled === true);
+
+    var badReq = Object.assign(_mockReq(), { user: { scopes: ["orders:write"] }, tenant: "evil" });
+    var badR = await _runMiddleware(mw, badReq);
+    check("abac context: non-matching context → 403", badR.res._endedStatus === 403);
+
+    // Context provider throws → policy_context_error + context-provider-threw
+    // audit (lib 628-645), BEFORE the predicate runs.
+    var predicateRan = false;
+    var p2 = b.permissions.create({ roles: { svc: ["orders:write"] }, audit: audit });
+    p2.policy("orders:write", function (actor, ctx) { predicateRan = true; return true; });
+    var mw2 = p2.require("orders:write", {
+      context: function (req) { throw new Error("ctx-boom"); },
+    });
+    var ctxErr = await _runMiddleware(mw2,
+      Object.assign(_mockReq(), { user: { scopes: ["orders:write"] } }));
+    check("abac context: provider throw → 403", ctxErr.res._endedStatus === 403);
+    check("abac context: policy_context_error in body",
+      /policy_context_error/.test(ctxErr.res._captured));
+    check("abac context: predicate NOT reached when provider throws", predicateRan === false);
+    check("abac context: context-provider-threw audit reason",
+      audit.byAction("permissions.policy.error").some(function (e) {
+        return e.reason === "context-provider-threw";
+      }));
+    check("abac context: policy_context_error metric emitted",
+      cap.byName("permissions.policy_context_error").length > 0);
+  } finally {
+    cap.restore();
+  }
+}
+
+async function testPolicyAbacAllAndAnyModes() {
+  // requireAll: every requested scope's policy must pass (lib 617-623 all branch).
+  var pAll = b.permissions.create({ roles: { svc: ["orders:read", "orders:write"] } });
+  pAll.policy("orders:read",  function (a, c) { return true; });
+  pAll.policy("orders:write", function (a, c) { return true; });
+  var allR = await _runMiddleware(
+    pAll.requireAll(["orders:read", "orders:write"]),
+    Object.assign(_mockReq(), { user: { scopes: ["orders:read", "orders:write"] } }));
+  check("abac all: both policies pass → proceed", allR.nextCalled === true);
+
+  // requireAll: a single failing policy short-circuits to deny.
+  var pAllDeny = b.permissions.create({ roles: { svc: ["orders:read", "orders:write"] } });
+  pAllDeny.policy("orders:read",  function (a, c) { return true; });
+  pAllDeny.policy("orders:write", function (a, c) { return false; });
+  var allDenyR = await _runMiddleware(
+    pAllDeny.requireAll(["orders:read", "orders:write"]),
+    Object.assign(_mockReq(), { user: { scopes: ["orders:read", "orders:write"] } }));
+  check("abac all: one failing policy → 403", allDenyR.res._endedStatus === 403);
+
+  // requireAny: a policy on a scope the actor does NOT hold is skipped so its
+  // existence never leaks (lib 619-622, the `!check → continue` path). The
+  // held scope's passing policy admits the request even though the unheld
+  // scope carries a would-deny policy.
+  var pAny = b.permissions.create({ roles: { svc: ["orders:read", "orders:write"] } });
+  pAny.policy("orders:read",  function (a, c) { return true; });
+  pAny.policy("orders:write", function (a, c) { return false; });
+  var anyR = await _runMiddleware(
+    pAny.requireAny(["orders:read", "orders:write"]),
+    Object.assign(_mockReq(), { user: { scopes: ["orders:read"] } }));
+  check("abac any: unheld scope's policy skipped, held scope admits", anyR.nextCalled === true);
+}
+
+// ---- Audit opt-out for failures (lib 393 failure branch) ----
+
+async function testAuditFailuresOptOut() {
+  var audit = b.testing.captureAudit();
+  var p = b.permissions.create({
+    roles: { viewer: ["*:read"] },
+    audit: audit,
+    auditFailures: false,
+  });
+  var mwDeny = p.require("users:write");
+  await _runMiddleware(mwDeny, Object.assign(_mockReq(), { user: { roles: ["viewer"] } }));
+  check("opt-out: deny NOT audited when auditFailures=false",
+    audit.byAction("permissions.check.deny").length === 0);
+}
+
+// ---- dbRoleFor: non-string / unknown role names + shared-ancestor guard ----
+
+function testDbRoleForAdversarialRoles() {
+  var p = b.permissions.create({
+    roles: {
+      analyst: { permissions: ["users:read"], dbRole: "analytics_user" },
+      // Two roles share a dbRole-less ancestor to exercise the visited guard
+      // in _findDbRole (lib 752).
+      shared: { permissions: ["x:y"] },
+      a: { extends: ["shared"], permissions: [] },
+      b: { extends: ["shared"], permissions: [] },
+    },
+  });
+
+  // Non-string + unknown role names are skipped before a valid one resolves
+  // (lib 728-729).
+  check("dbRoleFor: non-string + unknown roles skipped, valid one wins",
+    p.dbRoleFor({ roles: [123, "ghost", "analyst"] }) === "analytics_user");
+
+  // Both top-level roles walk into the same dbRole-less ancestor; the second
+  // walk re-encounters the already-visited ancestor → null overall.
+  check("dbRoleFor: shared dbRole-less ancestor → null (visited guard)",
+    p.dbRoleFor({ roles: ["a", "b"] }) === null);
+}
+
+// ---- Residual defensive/default branches reached through the consumer path ----
+
+// Returns a truthy non-Error value with no `.message` — thrown to drive the
+// `(e && e.message) || String(e)` fallback. Routed through a call so it isn't
+// a throw-literal.
+function _nonErrorValue(tag) { return { note: tag }; }
+
+async function testBranchCleanups() {
+  var minutes = b.constants.TIME.minutes;
+
+  function expect(label, fn, code) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check(label, threw && threw.code === code);
+  }
+
+  // denyStatus upper-bound (lib 257 `> 599` operand) + no-arg create()
+  // hitting the `opts || {}` default (lib 324).
+  expect("create: denyStatus above 599 → BAD_OPT",
+    function () { b.permissions.create({ roles: { a: ["*"] }, denyStatus: 600 }); }, "BAD_OPT");
+  expect("create: no args → roles-missing BAD_OPT (opts||{} default)",
+    function () { b.permissions.create(); }, "BAD_OPT");
+
+  // checkAll / checkAny non-array required-scopes → false (lib 425, 433).
+  var p = b.permissions.create({ roles: { admin: ["*"] } });
+  check("checkAll: non-array required → false", p.checkAll({ scopes: ["users:read"] }, "nope") === false);
+  check("checkAny: non-array required → false", p.checkAny({ scopes: ["users:read"] }, null) === false);
+
+  // Missing-actor hint branch when the resolver returns null despite an
+  // actor being present on the request (lib 486-487 path0).
+  var auditA = b.testing.captureAudit();
+  var pNull = b.permissions.create({
+    roles: { admin: ["*"] }, audit: auditA, resolver: function () { return null; },
+  });
+  var reqWithUser = _mockReq();
+  reqWithUser.user = { roles: ["admin"] };
+  await _runMiddleware(pNull.require("users:read"), reqWithUser);
+  var ma = auditA.byAction("permissions.missing_actor")[0];
+  check("missing-actor hint reflects resolver-returned-null-despite-actor",
+    ma && /actor present on req but resolver returned null/.test(ma.metadata.hint));
+
+  // Resolver-supplied userId flows into the audit actor shape (lib 778 path0).
+  var auditB = b.testing.captureAudit();
+  var pUid = b.permissions.create({
+    roles: { admin: ["*"] }, audit: auditB,
+    resolver: function () { return { userId: "svc-1", scopes: ["users:read"] }; },
+  });
+  await _runMiddleware(pUid.require("users:read"), _mockReq());
+  var succ = auditB.byAction("permissions.check.success")[0];
+  check("resolver-supplied userId appears in audit actor", succ && succ.actor.userId === "svc-1");
+
+  // MFA gate with an actor that set mfaAuthenticated but NO numeric mfaAt →
+  // mfaAt coerces to 0 → treated as ancient → denied (lib 583 `: 0`).
+  var pMfa = b.permissions.create({
+    roles: { editor: ["users:write"] },
+    resolver: function (req) { return req.user || null; },
+  });
+  var noStamp = await _runMiddleware(
+    pMfa.require("users:write", { requireMfa: true, mfaWindowMs: minutes(30) }),
+    Object.assign(_mockReq(), { user: { roles: ["editor"], mfaAuthenticated: true } }));
+  check("mfa: mfaAuthenticated without numeric mfaAt is treated as stale → 403",
+    noStamp.res._endedStatus === 403);
+
+  // Per-role requireMfa forcing the gate on a multi-scope (requireAny) route
+  // exercises the non-single `requestedList` branch (lib 554 `: requested`).
+  var pAnyMfa = b.permissions.create({
+    roles: {
+      admin:  { permissions: ["users:delete"], requireMfa: true },
+      reader: ["users:read"],
+    },
+    resolver: function (req) { return req.user || null; },
+  });
+  var anyMfa = await _runMiddleware(
+    pAnyMfa.requireAny(["users:delete", "posts:read"]),
+    Object.assign(_mockReq(), { user: { roles: ["admin"] } }));
+  check("mfa: per-role gate on requireAny route denies un-stepped-up actor",
+    anyMfa.res._endedStatus === 403);
+
+  // Non-Error throws fall through the `String(e)` audit-metadata fallback in
+  // both ABAC error paths (lib 638 context, lib 660 predicate).
+  // A thrown value with no `.message` (here a bare object, not an Error)
+  // drives the `String(e)` fallback in the audit-metadata construction.
+  var pCtxStr = b.permissions.create({ roles: { svc: ["orders:write"] } });
+  pCtxStr.policy("orders:write", function (a, c) { return true; });
+  var ctxStr = await _runMiddleware(
+    pCtxStr.require("orders:write", { context: function () { throw _nonErrorValue("ctx"); } }),
+    Object.assign(_mockReq(), { user: { scopes: ["orders:write"] } }));
+  check("abac: non-Error context throw still denies (String(e) fallback)",
+    ctxStr.res._endedStatus === 403);
+
+  var pPredStr = b.permissions.create({ roles: { svc: ["orders:write"] } });
+  pPredStr.policy("orders:write", function (a, c) { throw _nonErrorValue("pred"); });
+  var predStr = await _runMiddleware(
+    pPredStr.require("orders:write"),
+    Object.assign(_mockReq(), { user: { scopes: ["orders:write"] } }));
+  check("abac: non-Error predicate throw still denies (String(e) fallback)",
+    predStr.res._endedStatus === 403);
+}
+
 // ---- Run ----
 
 async function run() {
   testSurface();
   testMatchTable();
+  testMatchPerSegmentWildcardShortRequired();
   testRoleExpansion();
   testRoleExpansionDeepInheritance();
   testRolesProperty();
@@ -533,9 +1045,21 @@ async function run() {
   await testAuditAndObservabilityEmission();
   await testAuditDefaults();
   await testAuditSuccessOptOut();
+  await testAuditFailuresOptOut();
   await testFiveWsAuditPropagation();
   testCreateRejectsBadOpts();
+  testRoleTableValidationEdgeCases();
+  testMiddlewareOptValidation();
+  testPolicyRegistration();
+  testPolicyPredicateArityWarning();
+  await testMfaPerRouteEnforcement();
+  await testMfaPerRoleEnforcement();
+  await testPolicyAbacSingleMode();
+  await testPolicyAbacContextProvider();
+  await testPolicyAbacAllAndAnyModes();
   testDbRoleFor();
+  testDbRoleForAdversarialRoles();
+  await testBranchCleanups();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/pqc-agent-curve.test.js

@@ -59,6 +59,25 @@ function testNarrowToFrameworkSubset() {
   two.destroy();
 }
 
+function testGroupsMirrorEcdhCurve() {
+  // The negotiated TLS `groups` list must track the resolved `ecdhCurve`
+  // string, not be independently re-derived from network-tls's
+  // tlsKeyShares ordering. A caller who narrows/reorders ecdhCurve and
+  // gets a groups list that ignores it would negotiate a different key
+  // share than requested.
+  var agent = b.pqcAgent.create();
+  check("default: groups mirrors ecdhCurve exactly",
+        agent.options.groups === agent.options.ecdhCurve);
+  agent.destroy();
+
+  // Narrowing to a single hybrid — groups tracks the narrowed value.
+  var narrowed = b.pqcAgent.create({ ecdhCurve: "SecP256r1MLKEM768" });
+  check("narrowed: groups mirrors the narrowed ecdhCurve",
+        narrowed.options.groups === "SecP256r1MLKEM768" &&
+        narrowed.options.ecdhCurve === "SecP256r1MLKEM768");
+  narrowed.destroy();
+}
+
 function testRefuseUnknownGroupByDefault() {
   var threw = false;
   try {
@@ -104,6 +123,8 @@ async function testAllowOperatorGroupsAuditEmit() {
     });
     check("secp256r1 accepted under allowOperatorGroups",
           agent.options.ecdhCurve === "secp256r1");
+    check("operator-group: groups mirrors the operator-supplied ecdhCurve",
+          agent.options.groups === "secp256r1");
     agent.destroy();
 
     await b.audit.flush();
@@ -151,6 +172,7 @@ function testReloadAfterBuild() {
 async function run() {
   await testDefaultGroupList();
   testNarrowToFrameworkSubset();
+  testGroupsMirrorEcdhCurve();
   testRefuseUnknownGroupByDefault();
   await testAllowOperatorGroupsAuditEmit();
   testKnownTlsGroupsExposed();