@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/request-helpers.test.js

@@ -12,6 +12,7 @@ var helpers = require("../helpers");
 var b         = helpers.b;
 var check     = helpers.check;
 var _bodyRes  = helpers._bodyRes;
+var _mockRes  = helpers._mockRes;
 
 function testSurface() {
   check("b.requestHelpers exposed",                  typeof b.requestHelpers === "object");
@@ -508,6 +509,11 @@ async function run() {
   testTrustedClientIpResolves();
   testTrustedProxyMappedPeerNormalized();
   testTrustedProtocol();
+  testRequestProtocolNoProxy();
+  testRequestProtocolPeerGatedTrustedProxy();
+  testRequestProtocolPeerGatedUntrustedProxyIgnoresForgedHeader();
+  testRequestProtocolLegacyTrustProxyTrue();
+  testAppendVary();
   testTrustedClientIpValidates();
   testResolveRoutePrefersRoutePattern();
   testResolveRouteFallsBackToUrl();
@@ -627,6 +633,94 @@ function testMakeSkipMatcher() {
                        catch (e) { return e instanceof Error; } })());
 }
 
+function testAppendVary() {
+  // Append preserves prior tokens (compression + auth helpers each add one).
+  var res = _mockRes();
+  res.setHeader("Vary", "Accept-Encoding");
+  b.requestHelpers.appendVary(res, "Authorization");
+  check("appendVary: appends without dropping the prior token",
+        res.getHeader("Vary") === "Accept-Encoding, Authorization");
+
+  // Idempotent — re-adding an existing token (case-insensitive) is a no-op.
+  b.requestHelpers.appendVary(res, "accept-encoding");
+  check("appendVary: re-adding an existing token (case-insensitive) is a no-op",
+        res.getHeader("Vary") === "Accept-Encoding, Authorization");
+
+  // First token when Vary is unset.
+  var fresh = _mockRes();
+  b.requestHelpers.appendVary(fresh, "Origin");
+  check("appendVary: sets Vary when none existed", fresh.getHeader("Vary") === "Origin");
+
+  // Empty-string Vary is treated as unset.
+  var emptyVary = _mockRes();
+  emptyVary.setHeader("Vary", "");
+  b.requestHelpers.appendVary(emptyVary, "Cookie");
+  check("appendVary: empty existing Vary treated as unset", emptyVary.getHeader("Vary") === "Cookie");
+
+  // Silent no-op when res doesn't expose getHeader/setHeader (never throws).
+  var threw = null;
+  try {
+    b.requestHelpers.appendVary(null, "X");
+    b.requestHelpers.appendVary({}, "X");
+    b.requestHelpers.appendVary({ getHeader: function () { return null; } }, "X");
+  } catch (e) { threw = e; }
+  check("appendVary: no-ops (no throw) on a res without header methods", threw === null);
+}
+
+function testRequestProtocolNoProxy() {
+  check("requestProtocol: encrypted socket → https",
+        b.requestHelpers.requestProtocol({ socket: { encrypted: true } }) === "https");
+  check("requestProtocol: plain socket → http",
+        b.requestHelpers.requestProtocol({ socket: { encrypted: false } }) === "http");
+  check("requestProtocol: connection.encrypted fallback → https",
+        b.requestHelpers.requestProtocol({ connection: { encrypted: true } }) === "https");
+  check("requestProtocol: undefined req → http", b.requestHelpers.requestProtocol(undefined) === "http");
+  check("requestProtocol: null req → http", b.requestHelpers.requestProtocol(null) === "http");
+}
+
+function testRequestProtocolPeerGatedTrustedProxy() {
+  // Predicate (peer-gated): X-Forwarded-Proto honored only when the immediate
+  // TCP peer is a trusted proxy — the leftmost hop is returned.
+  var trust = function (addr) { return addr.indexOf("10.") === 0; };
+  var viaProxy = {
+    socket:  { encrypted: false, remoteAddress: "10.0.0.9" },
+    headers: { "x-forwarded-proto": "https, http" },
+  };
+  check("requestProtocol: XFP via trusted proxy peer → https",
+        b.requestHelpers.requestProtocol(viaProxy, { trustProxy: trust }) === "https");
+}
+
+function testRequestProtocolPeerGatedUntrustedProxyIgnoresForgedHeader() {
+  // The bypass: a direct caller whose socket peer is NOT a trusted proxy
+  // cannot forge the scheme — the forged X-Forwarded-Proto is ignored and the
+  // real (cleartext) socket wins.
+  var trust = function (addr) { return addr.indexOf("10.") === 0; };
+  var forged = {
+    socket:  { encrypted: false, remoteAddress: "198.51.100.66" },
+    headers: { "x-forwarded-proto": "https" },
+  };
+  check("requestProtocol: forged XFP from an untrusted peer → http (ignored)",
+        b.requestHelpers.requestProtocol(forged, { trustProxy: trust }) === "http");
+  // Even a peer-gated request with no forwarded header falls back to the socket.
+  var realTls = { socket: { encrypted: true, remoteAddress: "198.51.100.66" }, headers: {} };
+  check("requestProtocol: peer-gated real-TLS socket without XFP → https",
+        b.requestHelpers.requestProtocol(realTls, { trustProxy: trust }) === "https");
+}
+
+function testRequestProtocolLegacyTrustProxyTrue() {
+  // Legacy trustProxy:true reads the leftmost hop WITHOUT checking the peer —
+  // spoofable, documented as safe only behind a header-rewriting edge.
+  var behindEdge = {
+    socket:  { encrypted: false, remoteAddress: "203.0.113.1" },
+    headers: { "x-forwarded-proto": "https, http" },
+  };
+  check("requestProtocol: legacy trustProxy:true → leftmost forwarded hop",
+        b.requestHelpers.requestProtocol(behindEdge, { trustProxy: true }) === "https");
+  // Default (no trustProxy) ignores X-Forwarded-Proto entirely.
+  check("requestProtocol: default ignores X-Forwarded-Proto",
+        b.requestHelpers.requestProtocol(behindEdge) === "http");
+}
+
 module.exports = { run: run };
 
 if (require.main === module) {

package/lib/vendor/blamejs/test/layer-0-primitives/require-bound-key.test.js

@@ -0,0 +1,401 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.middleware.requireBoundKey — Bearer-API-key auth with scope +
+ * bound-fields + peer-cert-fingerprint binding.
+ *
+ * Security-critical middleware: every missing / mismatched / expired /
+ * malformed binding MUST fail closed (401/403/400/500/503, never
+ * next()). These tests drive the real middleware run through
+ * b.testing.mockReq / mockRes and assert it refuses on every hostile
+ * or omitted input, and only calls next() when every check passes.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+// Drive the async middleware to completion. Returns the captured
+// response, whether next() ran, and the (possibly mutated) req.
+async function _drive(mw, req) {
+  var res = b.testing.mockRes();
+  var nextCalled = false;
+  var threw = null;
+  try {
+    await mw(req, res, function () { nextCalled = true; });
+  } catch (e) {
+    threw = e;
+  }
+  return {
+    res:        res,
+    captured:   res._captured(),
+    nextCalled: nextCalled,
+    threw:      threw,
+    req:        req,
+  };
+}
+
+function _bearerReq(token, extra) {
+  var opts = extra || {};
+  opts.headers = Object.assign({ authorization: "Bearer " + token }, opts.headers || {});
+  return b.testing.mockReq(opts);
+}
+
+// A resolver that only knows one key.
+function _resolverFor(record) {
+  return async function (apiKey) {
+    return apiKey === "valid-key" ? record : null;
+  };
+}
+
+async function run() {
+  var RequireBoundKeyError = b.middleware.requireBoundKey.RequireBoundKeyError ||
+    require("../../lib/middleware/require-bound-key").RequireBoundKeyError;
+
+  // ---------------------------------------------------------------
+  // Config-time validation — entry-point tier THROWS on bad opts.
+  // ---------------------------------------------------------------
+  var threwNoResolver = false;
+  try { b.middleware.requireBoundKey({ audit: false }); }
+  catch (e) { threwNoResolver = e instanceof RequireBoundKeyError; }
+  check("config: missing resolver throws RequireBoundKeyError", threwNoResolver);
+
+  var threwBadResolver = false;
+  try { b.middleware.requireBoundKey({ resolver: "not-a-fn", audit: false }); }
+  catch (e) { threwBadResolver = e instanceof RequireBoundKeyError; }
+  check("config: non-function resolver throws", threwBadResolver);
+
+  var threwEmptyScope = false;
+  try {
+    b.middleware.requireBoundKey({
+      resolver: async function () { return null; },
+      requiredScopes: ["ok", ""], audit: false,
+    });
+  } catch (e) { threwEmptyScope = e instanceof RequireBoundKeyError; }
+  check("config: empty-string scope throws bad-scope", threwEmptyScope);
+
+  var threwNonStringScope = false;
+  try {
+    b.middleware.requireBoundKey({
+      resolver: async function () { return null; },
+      requiredScopes: [123], audit: false,
+    });
+  } catch (e) { threwNonStringScope = e instanceof RequireBoundKeyError; }
+  check("config: non-string scope throws bad-scope", threwNonStringScope);
+
+  var threwBadGetter = false;
+  try {
+    b.middleware.requireBoundKey({
+      resolver: async function () { return null; },
+      getBoundField: { tenantId: "not-a-fn" }, audit: false,
+    });
+  } catch (e) { threwBadGetter = e instanceof RequireBoundKeyError; }
+  check("config: non-function bound-field getter throws", threwBadGetter);
+
+  var threwUnknownOpt = false;
+  try {
+    b.middleware.requireBoundKey({
+      resolver: async function () { return null; },
+      notAnOpt: true, audit: false,
+    });
+  } catch (_e) { threwUnknownOpt = true; }
+  check("config: unknown opt rejected by validateOpts", threwUnknownOpt);
+
+  // ---------------------------------------------------------------
+  // Bearer header parsing — fail closed on every non-token shape.
+  // ---------------------------------------------------------------
+  var okRecord = { id: "k1", scopes: ["webhook.ingest"], boundFields: {} };
+  var scopedMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(okRecord),
+    requiredScopes: ["webhook.ingest"],
+    audit: false,
+  });
+
+  var noHeader = await _drive(scopedMw, b.testing.mockReq({ headers: {} }));
+  check("parse: no Authorization header → 401 no-bearer-token",
+    noHeader.captured.status === 401 && !noHeader.nextCalled);
+  check("parse: no-bearer-token body carries reason",
+    /no-bearer-token/.test(noHeader.captured.body));
+  check("parse: 401 no-token challenge omits error code (RFC 6750 §3)",
+    noHeader.captured.headers["www-authenticate"] === 'Bearer realm="api"');
+  check("parse: refusal carries Cache-Control no-store",
+    /no-store/.test(String(noHeader.captured.headers["cache-control"])));
+
+  var basicAuth = await _drive(scopedMw,
+    b.testing.mockReq({ headers: { authorization: "Basic dXNlcjpwYXNz" } }));
+  check("parse: non-Bearer scheme → 401, fail closed",
+    basicAuth.captured.status === 401 && !basicAuth.nextCalled);
+
+  var lowerBearer = await _drive(scopedMw,
+    b.testing.mockReq({ headers: { authorization: "bearer valid-key" } }));
+  check("parse: lowercase 'bearer' scheme is not accepted (case-sensitive) → 401",
+    lowerBearer.captured.status === 401 && !lowerBearer.nextCalled);
+
+  var emptyToken = await _drive(scopedMw,
+    b.testing.mockReq({ headers: { authorization: "Bearer " } }));
+  check("parse: 'Bearer ' with no token → 401, fail closed",
+    emptyToken.captured.status === 401 && !emptyToken.nextCalled);
+
+  var spacedToken = await _drive(scopedMw,
+    b.testing.mockReq({ headers: { authorization: "Bearer  has space" } }));
+  check("parse: token containing a space is rejected → 401",
+    spacedToken.captured.status === 401 && !spacedToken.nextCalled);
+
+  // Uppercase header name still resolves (some proxies capitalize).
+  var upperName = await _drive(scopedMw,
+    b.testing.mockReq({ headers: { Authorization: "Bearer valid-key" } }));
+  check("parse: 'Authorization' (capitalized) header accepted → next()",
+    upperName.nextCalled === true);
+
+  // ---------------------------------------------------------------
+  // Resolver contract — fail closed on throw / null / non-object.
+  // ---------------------------------------------------------------
+  var throwingMw = b.middleware.requireBoundKey({
+    resolver: async function () { throw new Error("db down"); },
+    audit: false,
+  });
+  var resolverThrew = await _drive(throwingMw, _bearerReq("anything"));
+  check("resolver: throw → 503 resolver-unavailable, fail closed",
+    resolverThrew.captured.status === 503 && !resolverThrew.nextCalled && !resolverThrew.threw);
+  check("resolver: 503 challenge advertises scheme without auth-error code",
+    resolverThrew.captured.headers["www-authenticate"] === 'Bearer realm="api"');
+
+  var unknownKeyMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(okRecord), audit: false,
+  });
+  var unknownKey = await _drive(unknownKeyMw, _bearerReq("bogus-key"));
+  check("resolver: unknown key (null record) → 401 key-unknown-or-revoked",
+    unknownKey.captured.status === 401 && !unknownKey.nextCalled &&
+    /key-unknown-or-revoked/.test(unknownKey.captured.body));
+  check("resolver: 401 invalid_token challenge on unknown key",
+    /invalid_token/.test(String(unknownKey.captured.headers["www-authenticate"])));
+
+  var nonObjMw = b.middleware.requireBoundKey({
+    resolver: async function () { return "i-am-a-string"; }, audit: false,
+  });
+  var nonObj = await _drive(nonObjMw, _bearerReq("valid-key"));
+  check("resolver: non-object return → 401, fail closed",
+    nonObj.captured.status === 401 && !nonObj.nextCalled);
+
+  var undefMw = b.middleware.requireBoundKey({
+    resolver: async function () { return undefined; }, audit: false,
+  });
+  var undef = await _drive(undefMw, _bearerReq("valid-key"));
+  check("resolver: undefined return → 401, fail closed",
+    undef.captured.status === 401 && !undef.nextCalled);
+
+  // ---------------------------------------------------------------
+  // Scope check — required scope not held → 403 insufficient_scope.
+  // ---------------------------------------------------------------
+  var missingScopeMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor({ id: "k2", scopes: ["other.scope"], boundFields: {} }),
+    requiredScopes: ["webhook.ingest"], audit: false,
+  });
+  var missingScope = await _drive(missingScopeMw, _bearerReq("valid-key"));
+  check("scope: required scope not held → 403 missing-scope, fail closed",
+    missingScope.captured.status === 403 && !missingScope.nextCalled &&
+    /missing-scope/.test(missingScope.captured.body));
+  check("scope: 403 challenge is insufficient_scope",
+    /insufficient_scope/.test(String(missingScope.captured.headers["www-authenticate"])));
+
+  // A record with a non-array `scopes` must be treated as no scopes.
+  var badScopesMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor({ id: "k3", scopes: "webhook.ingest", boundFields: {} }),
+    requiredScopes: ["webhook.ingest"], audit: false,
+  });
+  var badScopes = await _drive(badScopesMw, _bearerReq("valid-key"));
+  check("scope: string (non-array) scopes treated as empty → 403, fail closed",
+    badScopes.captured.status === 403 && !badScopes.nextCalled);
+
+  // ---------------------------------------------------------------
+  // Bound-field binding — missing / mismatched / getter-error close.
+  // ---------------------------------------------------------------
+  var boundRecord = { id: "k4", scopes: [], boundFields: { tenantId: "acme" } };
+
+  // Registered bound field but no getter configured → 500 (misconfig).
+  var noGetterMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(boundRecord), audit: false,
+  });
+  var noGetter = await _drive(noGetterMw, _bearerReq("valid-key"));
+  check("bound-field: registered field w/o getter → 500 bound-field-no-getter, fail closed",
+    noGetter.captured.status === 500 && !noGetter.nextCalled &&
+    /bound-field-no-getter/.test(noGetter.captured.body));
+
+  var tenantGetterMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(boundRecord),
+    getBoundField: { tenantId: function (req) { return req.headers["x-tenant-id"]; } },
+    audit: false,
+  });
+
+  // Field absent on request → 400 bound-field-missing.
+  var fieldMissing = await _drive(tenantGetterMw, _bearerReq("valid-key"));
+  check("bound-field: absent on request → 400 bound-field-missing, fail closed",
+    fieldMissing.captured.status === 400 && !fieldMissing.nextCalled &&
+    /bound-field-missing/.test(fieldMissing.captured.body));
+  check("bound-field: 400 challenge is invalid_request",
+    /invalid_request/.test(String(fieldMissing.captured.headers["www-authenticate"])));
+
+  // Field present but WRONG value → 403 bound-field-mismatch.
+  var fieldWrong = await _drive(tenantGetterMw,
+    _bearerReq("valid-key", { headers: { "x-tenant-id": "evil-corp" } }));
+  check("bound-field: mismatched value → 403 bound-field-mismatch, fail closed",
+    fieldWrong.captured.status === 403 && !fieldWrong.nextCalled &&
+    /bound-field-mismatch/.test(fieldWrong.captured.body));
+
+  // Field present with an empty string → treated as missing → 400.
+  var fieldEmpty = await _drive(tenantGetterMw,
+    _bearerReq("valid-key", { headers: { "x-tenant-id": "" } }));
+  check("bound-field: empty-string value → 400 bound-field-missing, fail closed",
+    fieldEmpty.captured.status === 400 && !fieldEmpty.nextCalled);
+
+  // Getter throwing → 400 bound-field-getter-threw (no crash).
+  var getterThrowsMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(boundRecord),
+    getBoundField: { tenantId: function () { throw new Error("boom"); } },
+    audit: false,
+  });
+  var getterThrew = await _drive(getterThrowsMw, _bearerReq("valid-key"));
+  check("bound-field: getter throw → 400 bound-field-getter-threw, no uncaught crash",
+    getterThrew.captured.status === 400 && !getterThrew.nextCalled && !getterThrew.threw);
+
+  // Getter returns a non-string (number) → treated as missing → 400.
+  var getterNumberMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(boundRecord),
+    getBoundField: { tenantId: function () { return 12345; } },
+    audit: false,
+  });
+  var getterNumber = await _drive(getterNumberMw, _bearerReq("valid-key"));
+  check("bound-field: non-string getter return → 400 bound-field-missing, fail closed",
+    getterNumber.captured.status === 400 && !getterNumber.nextCalled);
+
+  // Correct bound-field value → passes.
+  var fieldOk = await _drive(tenantGetterMw,
+    _bearerReq("valid-key", { headers: { "x-tenant-id": "acme" } }));
+  check("bound-field: correct value → next() called",
+    fieldOk.nextCalled === true && fieldOk.captured.status === null);
+
+  // ---------------------------------------------------------------
+  // Peer-cert fingerprint pinning — the mTLS cross-check.
+  // ---------------------------------------------------------------
+  var rawCert = Buffer.from("blamejs-test-peer-cert-der-bytes-not-a-real-x509");
+  var fp = b.crypto.hashCertFingerprint(rawCert);
+  var pinnedRecord = { id: "k5", scopes: [], boundFields: {}, peerCertFingerprints: [fp.hex] };
+
+  var pinnedMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(pinnedRecord), audit: false,
+  });
+
+  // No peer cert presented at all → 401 peer-cert-required.
+  var noPeer = await _drive(pinnedMw, _bearerReq("valid-key"));
+  check("peer-cert: pinned key + no peer cert → 401 peer-cert-required, fail closed",
+    noPeer.captured.status === 401 && !noPeer.nextCalled &&
+    /peer-cert-required/.test(noPeer.captured.body));
+
+  // Peer cert whose fingerprint is NOT pinned → 403 peer-cert-not-pinned.
+  var wrongCert = Buffer.from("some-entirely-different-peer-cert-bytes");
+  var wrongReq = _bearerReq("valid-key");
+  wrongReq.peerCert = { raw: wrongCert };
+  var notPinned = await _drive(pinnedMw, wrongReq);
+  check("peer-cert: unpinned fingerprint → 403 peer-cert-not-pinned, fail closed",
+    notPinned.captured.status === 403 && !notPinned.nextCalled &&
+    /peer-cert-not-pinned/.test(notPinned.captured.body));
+
+  // Peer cert whose fingerprint IS pinned (derived from raw) → passes.
+  var goodReq = _bearerReq("valid-key");
+  goodReq.peerCert = { raw: rawCert };
+  var pinnedOk = await _drive(pinnedMw, goodReq);
+  check("peer-cert: pinned fingerprint derived from raw cert → next() called",
+    pinnedOk.nextCalled === true);
+
+  // Pre-attached req.peerFingerprint (from an upstream requireMtls) that
+  // matches, with the raw cert also present → passes.
+  var preFpReq = _bearerReq("valid-key");
+  preFpReq.peerCert = { raw: rawCert };
+  preFpReq.peerFingerprint = { hex: fp.hex, colon: fp.colon };
+  var preFpOk = await _drive(pinnedMw, preFpReq);
+  check("peer-cert: pre-attached matching peerFingerprint + raw → next() called",
+    preFpOk.nextCalled === true);
+
+  // tolerateMissingPeerCert bypass — dev-fixture escape hatch. Pinned
+  // key, no cert, but the opt is explicitly set → passes (audited).
+  var tolerateMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(pinnedRecord),
+    tolerateMissingPeerCert: true, audit: false,
+  });
+  var tolerated = await _drive(tolerateMw, _bearerReq("valid-key"));
+  check("peer-cert: tolerateMissingPeerCert bypass → next() called (audited)",
+    tolerated.nextCalled === true);
+
+  // Fail-closed edge — req.peerFingerprint set by upstream but the raw
+  // cert is NOT attached. Must refuse cleanly, never throw an uncaught
+  // TypeError (which would hang the request instead of returning a
+  // structured refusal).
+  var fpNoCertReq = _bearerReq("valid-key");
+  fpNoCertReq.peerFingerprint = { hex: fp.hex, colon: fp.colon };
+  var fpNoCert = await _drive(pinnedMw, fpNoCertReq);
+  check("peer-cert: peerFingerprint present but no raw cert → clean refusal, no uncaught crash",
+    fpNoCert.threw === null && !fpNoCert.nextCalled &&
+    (fpNoCert.captured.status === 401 || fpNoCert.captured.status === 403));
+
+  // ---------------------------------------------------------------
+  // Success path — req.apiKey populated, bearer secret never re-exposed.
+  // ---------------------------------------------------------------
+  var successMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor({
+      id: "k9", scopes: ["webhook.ingest", "extra"],
+      boundFields: { tenantId: "acme" },
+    }),
+    requiredScopes: ["webhook.ingest"],
+    getBoundField: { tenantId: function (req) { return req.headers["x-tenant-id"]; } },
+    audit: false,
+  });
+  var success = await _drive(successMw,
+    _bearerReq("valid-key", { headers: { "x-tenant-id": "acme" } }));
+  check("success: all checks pass → next() called", success.nextCalled === true);
+  check("success: req.apiKey.id attached", success.req.apiKey && success.req.apiKey.id === "k9");
+  check("success: req.apiKey.scopes copied", success.req.apiKey &&
+    success.req.apiKey.scopes.indexOf("webhook.ingest") !== -1);
+  check("success: req.apiKey never re-exposes the bearer secret",
+    success.req.apiKey && JSON.stringify(success.req.apiKey).indexOf("valid-key") === -1);
+  check("success: req.apiKey.boundFields is a copy of registered",
+    success.req.apiKey && success.req.apiKey.boundFields.tenantId === "acme");
+
+  // ---------------------------------------------------------------
+  // Refusal customization — onDeny hook + problemDetails mode.
+  // ---------------------------------------------------------------
+  var onDenyCalls = [];
+  var onDenyMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(okRecord), audit: false,
+    onDeny: function (req, res, info) {
+      onDenyCalls.push(info);
+      res.writeHead(418, { "content-type": "text/plain" });
+      res.end("teapot");
+    },
+  });
+  var onDenyRes = await _drive(onDenyMw, b.testing.mockReq({ headers: {} }));
+  check("onDeny: hook owns the refusal (418) and receives reason info",
+    onDenyRes.captured.status === 418 && onDenyCalls.length === 1 &&
+    onDenyCalls[0].reason === "no-bearer-token" && !onDenyRes.nextCalled);
+
+  var problemMw = b.middleware.requireBoundKey({
+    resolver: _resolverFor(okRecord), audit: false, problemDetails: true,
+  });
+  var problemRes = await _drive(problemMw,
+    b.testing.mockReq({ headers: { accept: "application/problem+json" } }));
+  // problemDetails.respond commits status via res.statusCode; the machine
+  // status also rides in the RFC 9457 document body.
+  check("problemDetails: emits application/problem+json and fails closed",
+    /application\/problem\+json/.test(String(problemRes.captured.headers["content-type"])) &&
+    /"status":\s*401/.test(problemRes.captured.body) &&
+    !problemRes.nextCalled && !problemRes.threw);
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/restore-empty-manifest-wipe.test.js

@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.restore — empty-manifest silent-wipe defense.
+ *
+ * The bundle writer refuses to emit a bundle with zero file entries
+ * (backup-bundle/empty). The shared manifest validator — the guard the
+ * restore path relies on when it parses an untrusted / tampered
+ * manifest — must mirror that refusal. Otherwise an attacker with write
+ * access to an unsigned bundle in storage strips every file entry from
+ * the manifest (keeping the legitimate vaultKeyEnc, which still
+ * decrypts), and the operator's next restore succeeds with fileCount 0,
+ * swapping an EMPTY staging dir into place — a silent destructive wipe
+ * of the live dataDir with no error signal.
+ *
+ * Root: b.backupManifest.validate accepts files: []. Fix it there (the
+ * single guard parse() / create() / serialize() all route through) so a
+ * zero-entry manifest is refused before it can reach the restore swap.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+var fs      = helpers.fs;
+var os      = helpers.os;
+var path    = helpers.path;
+
+function _validManifestArgs() {
+  return {
+    vaultKeySalt: "ab12",
+    vaultKeyEnc:  Buffer.from("wrapped-vault-key").toString("base64"),
+    files: [{
+      relativePath:  "db.enc",
+      encryptedPath: "files/db.enc.enc",
+      size:          10,
+      encryptedSize: 50,
+      checksum:      "a".repeat(128),
+      salt:          "cd34",
+      kind:          "raw",
+    }],
+  };
+}
+
+function _seed() {
+  var root = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-empty-manifest-"));
+  var dataDir = path.join(root, "data");
+  fs.mkdirSync(dataDir);
+  fs.writeFileSync(path.join(dataDir, "db.enc"), "ORIG-DB-CONTENT");
+  fs.writeFileSync(path.join(dataDir, "db.key.enc"), "SEALED-DEK");
+  return { root: root, dataDir: dataDir, storageRoot: path.join(root, "store") };
+}
+
+async function run() {
+  // --- 1. The shared validator refuses a zero-entry files array. ---
+  var argsEmpty = _validManifestArgs();
+  argsEmpty.files = [];
+  var vEmpty = b.backupManifest.validate({
+    version: 1, framework: "blamejs", frameworkVersion: "0.0.0",
+    createdAt: new Date().toISOString(),
+    vaultKeySalt: argsEmpty.vaultKeySalt, vaultKeyEnc: argsEmpty.vaultKeyEnc,
+    files: [],
+  });
+  check("validate: zero-entry files array is REFUSED",
+        vEmpty.ok === false &&
+        vEmpty.errors.some(function (e) { return /files/.test(e); }));
+
+  // A non-empty valid manifest still validates (no false-positive).
+  var vOk = b.backupManifest.validate(Object.assign(
+    { version: 1, framework: "blamejs", frameworkVersion: "0.0.0",
+      createdAt: new Date().toISOString() },
+    _validManifestArgs()));
+  check("validate: non-empty valid manifest still passes", vOk.ok === true);
+
+  // --- 2. parse() of an empty-files manifest throws. ---
+  var mkEmptyJson = JSON.stringify({
+    version: 1, framework: "blamejs", frameworkVersion: "0.0.0",
+    createdAt: new Date().toISOString(),
+    vaultKeySalt: "ab12", vaultKeyEnc: Buffer.from("x").toString("base64"),
+    files: [],
+  });
+  var parseThrew = null;
+  try { b.backupManifest.parse(mkEmptyJson); } catch (e) { parseThrew = e; }
+  check("parse: empty-files manifest is rejected",
+        parseThrew && parseThrew.code === "backup-manifest/invalid");
+
+  // --- 3. End-to-end: a tampered empty-files bundle must NOT wipe the
+  //        live dataDir; restore must fail-closed. ---
+  var pp = Buffer.from("operator-passphrase-not-secret");
+  var fx = _seed();
+  try {
+    function storage() { return b.backup.diskStorage({ root: fx.storageRoot }); }
+    var r = await b.backup.create({
+      dataDir: fx.dataDir, storage: storage(), passphrase: pp,
+      files: [
+        { relativePath: "db.enc",     kind: "raw", required: true },
+        { relativePath: "db.key.enc", kind: "raw", required: true },
+      ],
+      vaultKeyJson: '{"vault":"orig"}', audit: false,
+    }).run();
+
+    // Belt-and-suspenders: a valid (signed, non-empty) bundle restored with an
+    // opts.filter that matches NO manifest entry yields a zero-file extract.
+    // The manifest parses fine, but swapping the empty staging dir over the
+    // live dataDir would wipe it — restore.run must refuse rather than destroy.
+    var filterThrew = null;
+    try {
+      await b.restore.create({
+        dataDir: fx.dataDir, storage: storage(), passphrase: pp,
+        rollbackRoot: path.join(fx.root, "rb-filter"), audit: false,
+      }).run({ bundleId: r.bundleId, filter: function () { return false; } });
+    } catch (e) { filterThrew = e; }
+    check("restore: a filter matching no manifest entry is REFUSED (no zero-file wipe)",
+          filterThrew && filterThrew.code === "restore/empty-extract-refused");
+    check("restore: live dataDir INTACT after the refused zero-file filter restore",
+          fs.readFileSync(path.join(fx.dataDir, "db.enc")).toString() === "ORIG-DB-CONTENT" &&
+          fs.readFileSync(path.join(fx.dataDir, "db.key.enc")).toString() === "SEALED-DEK");
+
+    var bdir = path.join(fx.storageRoot, r.bundleId);
+    var manifest = JSON.parse(fs.readFileSync(path.join(bdir, "manifest.json"), "utf8"));
+
+    // Attacker strips every file entry (keeps the legit vaultKeyEnc that
+    // still decrypts under the operator passphrase) and drops the signature.
+    manifest.files = [];
+    delete manifest.signature;
+    fs.writeFileSync(path.join(bdir, "manifest.json"), JSON.stringify(manifest));
+
+    var threw = null;
+    try {
+      await b.restore.create({
+        dataDir: fx.dataDir, storage: storage(), passphrase: pp,
+        rollbackRoot: path.join(fx.root, "rb"), audit: false,
+      }).run({ bundleId: r.bundleId });
+    } catch (e) { threw = e; }
+
+    check("restore: tampered empty-files bundle is REFUSED (fail-closed)",
+          threw && /^restore\//.test(threw.code || ""));
+    check("restore: live dataDir is INTACT after the refused restore",
+          fs.existsSync(path.join(fx.dataDir, "db.enc")) &&
+          fs.existsSync(path.join(fx.dataDir, "db.key.enc")) &&
+          fs.readFileSync(path.join(fx.dataDir, "db.enc")).toString() === "ORIG-DB-CONTENT");
+  } finally {
+    fs.rmSync(fx.root, { recursive: true, force: true });
+  }
+
+  console.log("OK — restore empty-manifest wipe defense (" + helpers.getChecks() + " checks)");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}