@bongos/core 1.19.1017 → 1.19.1018

package/tests/idp_device_exchange.mjs

@@ -13,6 +13,9 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import crypto from 'node:crypto';
+// ESM import so the knip ratchet credits these test-facing exports (a
+// createRequire() import does not credit a CJS export).
+import { applicationVouchIdentity, verifyHubApplicationVouch } from '../src/bongos/auth-idp.js';
 
 const require = createRequire(import.meta.url);
 const auth = require('../src/bongos/auth.js');
@@ -194,5 +197,176 @@ t('a logout jti is fresh on first use, seen on replay, and evicted after expiry'
   assert.equal(auth.logoutTokenJtiSeenAndRecord(undefined, exp, now), false, 'missing jti is never "seen"');
 });
 
+// --- Application vouch (ADR 0201 D2, ADR 0208 D2, task 1002285) -------------
+// The hub's join relay carries a THIRD token kind to the target project: an
+// application vouch — identity AND purpose 'application'. ADR 0208 D2 found the
+// hole this closes: verifyHubAssertion never looked at `purpose`, so any
+// identity payload verified AS A LOGIN, and a captured vouch would have been
+// replayable into POST /auth/device/exchange as a device sign-in.
+
+function mintVouch(overrides = {}, opts = {}) {
+  return hubKeys.mintHubApplicationVouch(
+    { clientId: 'client-x', githubId: 42, githubLogin: 'octo', handle: 'octo', ...overrides },
+    { signingKey, ...opts },
+  );
+}
+
+// Sign an ARBITRARY payload with the real hub key — the only way to ask "what
+// does a verifier do with a shape no minter emits today?", which is exactly the
+// window ADR 0208 D2 says to close.
+function signRaw(payload) {
+  const b64u = (o) => Buffer.from(JSON.stringify(o)).toString('base64url');
+  const input = `${b64u({ alg: 'EdDSA', typ: 'JWT' })}.${b64u(payload)}`;
+  return `${input}.${crypto.sign(null, Buffer.from(input), signingKey).toString('base64url')}`;
+}
+const nowS = () => Math.floor(Date.now() / 1000);
+
+console.log('\nhub application vouch mint → instance verify (roundtrip):');
+
+t('a valid vouch verifies, carrying identity + purpose + handle and NO rank', () => {
+  const p = verifyHubApplicationVouch(mintVouch(), { publicKey, clientId: 'client-x' });
+  assert.equal(p.sub, '42');
+  assert.equal(p.applicant_login, 'octo');
+  assert.equal(p.github_login, undefined,
+    'the login rides as applicant_login: every login verifier any core ever shipped demands github_login, '
+    + 'so a core that predates the purpose refusal still cannot take a vouch as a device sign-in');
+  assert.equal(p.handle, 'octo');
+  assert.equal(p.purpose, 'application');
+  assert.equal(p.aud, 'client-x');
+  assert.ok(p.jti, 'a vouch always carries a jti — single use is chosen, not optional');
+  assert.equal(p.rank, undefined, 'a vouch is identity, never authority (ADR 0016)');
+  assert.equal(p.display_name, undefined, 'and not the login assertion’s profile fields either');
+});
+
+console.log('\nadversarial (vouch) — every one of these MUST be rejected:');
+
+t('wrong audience (a vouch for project A cannot vouch at project B)', () => {
+  assert.throws(() => verifyHubApplicationVouch(mintVouch(), { publicKey, clientId: 'other-client' }), /audience/);
+});
+
+t('NO audience configured never verifies — the envelope would otherwise skip the aud check', () => {
+  assert.throws(() => verifyHubApplicationVouch(mintVouch(), { publicKey, clientId: null }), /audience/);
+});
+
+t('expired vouch (minted 10 min ago; TTL is ~120s)', () => {
+  const stale = mintVouch({}, { nowMs: Date.now() - 10 * 60 * 1000 });
+  assert.throws(() => verifyHubApplicationVouch(stale, { publicKey, clientId: 'client-x' }), /expired/);
+});
+
+t('tampered payload (swap sub to another github_id) fails the signature', () => {
+  const [h, p, s] = mintVouch().split('.');
+  const payload = JSON.parse(Buffer.from(p, 'base64url').toString('utf8'));
+  payload.sub = '999';
+  const forged = `${h}.${Buffer.from(JSON.stringify(payload)).toString('base64url')}.${s}`;
+  assert.throws(() => verifyHubApplicationVouch(forged, { publicKey, clientId: 'client-x' }), /signature/);
+});
+
+t('a different signing key, alg "none", malformed and a missing public key are all rejected', () => {
+  const otherPub = crypto.generateKeyPairSync('ed25519').publicKey;
+  assert.throws(() => verifyHubApplicationVouch(mintVouch(), { publicKey: otherPub, clientId: 'client-x' }), /signature/);
+  const [h, p, s] = mintVouch().split('.');
+  const hdr = JSON.parse(Buffer.from(h, 'base64url').toString('utf8'));
+  hdr.alg = 'none';
+  const confused = `${Buffer.from(JSON.stringify(hdr)).toString('base64url')}.${p}.${s}`;
+  assert.throws(() => verifyHubApplicationVouch(confused, { publicKey, clientId: 'client-x' }), /alg|signature/);
+  assert.throws(() => verifyHubApplicationVouch('not-a-jwt', { publicKey, clientId: 'client-x' }), /malformed/);
+  assert.throws(() => verifyHubApplicationVouch(mintVouch(), { publicKey: null, clientId: 'client-x' }), /public key/);
+});
+
+t('a vouch with no jti is rejected — one vouch, one application needs something to count', () => {
+  const noJti = signRaw({ iss: 'cloudbongos-hub', aud: 'client-x', sub: '42', applicant_login: 'octo', purpose: 'application', iat: nowS(), exp: nowS() + 60 });
+  assert.throws(() => verifyHubApplicationVouch(noJti, { publicKey, clientId: 'client-x' }), /jti/);
+});
+
+t('a vouch with no applicant identity is rejected by the verifier itself, not only by the login match', () => {
+  for (const drop of ['sub', 'applicant_login']) {
+    const claims = { iss: 'cloudbongos-hub', aud: 'client-x', sub: '42', applicant_login: 'octo', purpose: 'application', iat: nowS(), exp: nowS() + 60, jti: `no-${drop}` };
+    delete claims[drop];
+    assert.throws(() => verifyHubApplicationVouch(signRaw(claims), { publicKey, clientId: 'client-x' }), /identity/, `missing ${drop}`);
+  }
+});
+
+t('mintHubApplicationVouch refuses without a signing key', () => {
+  assert.throws(() => hubKeys.mintHubApplicationVouch({ clientId: 'c', githubId: 1, githubLogin: 'x' }, {}), /signing key/);
+});
+
+console.log('\nlogin / logout / vouch are mutually NON-interchangeable:');
+
+t('an APPLICATION VOUCH is NOT accepted as a login assertion — the replay ADR 0208 D2 found open', () => {
+  assert.throws(() => auth.verifyHubAssertion(mintVouch(), { publicKey, clientId: 'client-x' }), /identity|purpose/);
+  // And the purpose refusal holds on its own: a vouch-shaped token that ALSO carried
+  // github_login (the shape a bolted-on purpose would have produced) still fails.
+  const both = signRaw({ iss: 'cloudbongos-hub', aud: 'client-x', sub: '42', github_login: 'octo', applicant_login: 'octo', purpose: 'application', iat: nowS(), exp: nowS() + 60, jti: 'both' });
+  assert.throws(() => auth.verifyHubAssertion(both, { publicKey, clientId: 'client-x' }), /purpose/);
+});
+
+t('verifyHubAssertion refuses ANY purpose on an identity payload, not only this one', () => {
+  for (const purpose of ['application', 'anything', '', null]) {
+    const token = signRaw({ iss: 'cloudbongos-hub', aud: 'client-x', sub: '42', github_login: 'octo', purpose, iat: nowS(), exp: nowS() + 60, jti: `p-${purpose}` });
+    assert.throws(() => auth.verifyHubAssertion(token, { publicKey, clientId: 'client-x' }), /purpose/,
+      `purpose=${JSON.stringify(purpose)} must not verify as a login`);
+  }
+});
+
+t('a LOGIN assertion is NOT accepted as an application vouch (no purpose)', () => {
+  assert.throws(() => verifyHubApplicationVouch(mint(), { publicKey, clientId: 'client-x' }), /application vouch/);
+});
+
+t('a LOGOUT token is NOT accepted as an application vouch, nor a vouch as a logout', () => {
+  assert.throws(() => verifyHubApplicationVouch(mintLogout(), { publicKey, clientId: 'client-x' }), /application vouch/);
+  assert.throws(() => auth.verifyHubLogoutToken(mintVouch(), { publicKey, clientId: 'client-x' }), /logout/);
+});
+
+console.log('\napplicationVouchIdentity — what a project may take from a vouch:');
+
+const vouchOpts = (githubLogin, extra = {}) => ({ githubLogin, publicKey, clientId: 'client-x', ...extra });
+
+t('a vouch for the login on the request yields its github id and handle (login case-insensitive)', () => {
+  assert.deepEqual(applicationVouchIdentity(mintVouch(), vouchOpts('Octo')), { githubId: '42', handle: 'octo' });
+});
+
+t('a vouch naming a DIFFERENT account than the request is no vouch at all', () => {
+  assert.equal(applicationVouchIdentity(mintVouch(), vouchOpts('someone-else')), null,
+    'otherwise one account’s vouch could be stapled to a request naming another');
+});
+
+t('one vouch vouches ONE application — the same token twice is vouched once', () => {
+  const token = mintVouch();
+  assert.ok(applicationVouchIdentity(token, vouchOpts('octo')));
+  assert.equal(applicationVouchIdentity(token, vouchOpts('octo')), null, 'the replay is unvouched');
+});
+
+t('an instance with no hub public key or no client id vouches nothing', () => {
+  assert.equal(applicationVouchIdentity(mintVouch(), vouchOpts('octo', { publicKey: null })), null);
+  assert.equal(applicationVouchIdentity(mintVouch(), vouchOpts('octo', { clientId: null })), null);
+});
+
+t('absent, garbage, forged and login-shaped tokens are null — never a throw', () => {
+  for (const token of [undefined, null, '', 'garbage', mint(), mintLogout()]) {
+    assert.equal(applicationVouchIdentity(token, vouchOpts('octo')), null);
+  }
+});
+
+t('LOCKSTEP: every handle the hub can hold survives the instance’s check, and nothing else does', () => {
+  // normalizeHandle is the hub's own rule (platform-identity.js); the instance keeps a
+  // boundary-forced mirror of it. Drive both over the same inputs so a change to
+  // either side that the other does not follow reds here, instead of handles
+  // silently arriving as null.
+  const { normalizeHandle } = require('../modules/platform-identity/platform-identity.js');
+  const inputs = ['octo', 'a', '9', 'a-b', 'builder-123456', 'x'.repeat(39), 'x'.repeat(40), '-a', 'a-', 'a_b', 'A', 'o.o', ''];
+  for (const raw of inputs) {
+    const hubHolds = normalizeHandle(raw) === raw;
+    const got = applicationVouchIdentity(mintVouch({ handle: raw }), vouchOpts('octo'));
+    assert.equal(got.handle, hubHolds ? raw : null, `handle ${JSON.stringify(raw)}: hub holds=${hubHolds}`);
+  }
+});
+
+t('a handle outside the canonical charset rides as null — the identity still stands', () => {
+  for (const handle of ['<b>octo</b>', 'Octo Cat', 'x'.repeat(60), 42, null]) {
+    assert.deepEqual(applicationVouchIdentity(mintVouch({ handle }), vouchOpts('octo')), { githubId: '42', handle: null },
+      `handle=${JSON.stringify(handle)}`);
+  }
+});
+
 console.log(`\nidp_device_exchange: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/tests/module_api.mjs

@@ -47,6 +47,7 @@ const PUBLISHED_SURFACE = [
   'projectJoinDoor', // added by task 1002331 (ADR 0182 D6 / ADR 0247): the COMPOSED join/apply door — visibility × join grant × joinability, one answer, so a module reading a single knob cannot re-open a door the other two closed
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
+  'readApplicationVouch', // added by task 1002285 (ADR 0201 D2): the public access-request write's check of the hub's application vouch. NARROW for the same reason — core supplies the hub key and this instance's client_id, so a module passes a token and a login and can neither swap the key nor re-address the audience
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'isModuleEnabled', // task 1003881: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',