@bongos/core 1.19.417 → 1.19.419

package/tests/own_session_revoke.mjs

@@ -0,0 +1,410 @@
+// tests/own_session_revoke.mjs — the own-scoped session self-service
+// (task 1003341, goal 1000045; src/bongos/routes/my-sessions.js).
+//
+// The gap these routes close: a CLI bearer refreshes to now()+24h on every call,
+// so a leaked one never expires, and the only revoke endpoints were gated on the
+// admin `auth.session.revoke` atom — the victim needed an Archon. What this file
+// pins is therefore the ISOLATION, not the plumbing:
+//
+//   1. a non-admin builder (xenos, the bottom rung) CAN list and revoke their
+//      own sessions, and sign out everywhere, with no rank and no permission;
+//   2. that same builder CANNOT see or kill anybody else's — not by naming a
+//      builder in the query string, not by naming one in the body, and not by
+//      guessing a stranger's session id;
+//   3. a revoked bearer stops authenticating on the very next request;
+//   4. the token value never appears in a response.
+//
+// DB-FREE, and deliberately NOT a mock of the route's own answers: the fake pool
+// below is a small in-memory `builder_sessions` table plus a mini-interpreter
+// that builds each statement's filter FROM THAT STATEMENT'S OWN WHERE CLAUSE. So
+// if `builder_id = $2` were ever dropped from the own-scoped revoke, the filter
+// would genuinely widen and test 2 would genuinely fail — the isolation is
+// executed, not asserted against a string. The interpreter refuses any statement
+// whose placeholders it did not all consume, so a rewritten predicate it cannot
+// read is a loud error rather than a silently weaker filter.
+//
+// Everything above the pool is REAL: the real auth.requireBuilder, the real
+// db-kernel lookupSession (refresh-on-use and all), the real router, over real
+// HTTP. Nothing about identity is stubbed, which is what makes (3) a proof.
+//
+// Run:  node tests/own_session_revoke.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ===========================================================================
+// The in-memory builder_sessions table + its statement interpreter
+// ===========================================================================
+
+const DAY = 24 * 60 * 60 * 1000;
+const BUILDERS = {
+  1: { github_id: 1001, github_login: 'ada', display_name: 'Ada', avatar_url: null,
+       total_credits: 0, rank: 'xenos', status: 'active', system_role: null, anthropic_user_id: null },
+  2: { github_id: 1002, github_login: 'bo', display_name: 'Bo', avatar_url: null,
+       total_credits: 0, rank: 'xenos', status: 'active', system_role: null, anthropic_user_id: null },
+};
+
+let sessions = [];
+function seed() {
+  const now = Date.now();
+  sessions = [
+    // Ada's — a CLI bearer (the leaked-token case), a browser cookie, one already
+    // revoked and one already expired (neither may ever surface in a list).
+    { id: 101, builder_id: 1, token: 'adacli', source: 'cli', user_agent: 'cloud-bongos-cli',
+      created_at: new Date(now - 30 * DAY), last_used_at: new Date(now - 60_000), expires_at: new Date(now + DAY), revoked_at: null },
+    { id: 102, builder_id: 1, token: 'adaweb', source: 'web', user_agent: 'Mozilla/5.0',
+      created_at: new Date(now - 2 * DAY), last_used_at: new Date(now - 3_600_000), expires_at: new Date(now + DAY), revoked_at: null },
+    { id: 103, builder_id: 1, token: 'adaold', source: 'cli', user_agent: 'old laptop',
+      created_at: new Date(now - 90 * DAY), last_used_at: new Date(now - 80 * DAY), expires_at: new Date(now + DAY), revoked_at: new Date(now - 80 * DAY) },
+    { id: 104, builder_id: 1, token: 'adagone', source: 'cli', user_agent: 'lapsed',
+      created_at: new Date(now - 90 * DAY), last_used_at: new Date(now - 70 * DAY), expires_at: new Date(now - 60 * DAY), revoked_at: null },
+    // Bo's — the stranger's session Ada must never reach.
+    { id: 201, builder_id: 2, token: 'bocli', source: 'cli', user_agent: 'bo-cli',
+      created_at: new Date(now - DAY), last_used_at: new Date(now - 120_000), expires_at: new Date(now + DAY), revoked_at: null },
+  ];
+}
+
+// Build a row filter from the statement's OWN where clause. Every placeholder the
+// clause mentions must be consumed by a fragment below; one that is not throws,
+// so a predicate this cannot read can never degrade into "no constraint".
+function predicateFor(sql, params) {
+  const where = sql.includes(' WHERE ') ? sql.slice(sql.indexOf(' WHERE ') + 7) : '';
+  const tests = [];
+  const consumed = new Set();
+  const take = (re, make) => {
+    const m = re.exec(where);
+    if (!m) return;
+    consumed.add(m[1]);
+    tests.push(make(params[Number(m[1]) - 1]));
+  };
+  take(/\b(?:s\.)?token = \$(\d+)/, (v) => (r) => r.token === v);
+  take(/(?<!_)\b(?:s\.)?id = \$(\d+)/, (v) => (r) => String(r.id) === String(v));
+  take(/\bbuilder_id = \$(\d+)/, (v) => (r) => String(r.builder_id) === String(v));
+  if (/revoked_at IS NULL/.test(where)) tests.push((r) => r.revoked_at === null);
+  if (/expires_at IS NULL OR expires_at > now\(\)/.test(where)) {
+    tests.push((r) => r.expires_at === null || r.expires_at > new Date());
+  }
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — the interpreter must not silently ignore a filter`);
+    }
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+// The columns a SELECT actually names, so a projection that started shipping
+// `token` would put it in the response body (and trip the leak test) rather than
+// be quietly dropped by a hand-written fake.
+function selectedColumns(sql) {
+  const m = /^SELECT (.+?) FROM /.exec(sql);
+  return m[1].split(',').map((c) => c.trim());
+}
+
+let calls = [];
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    calls.push({ sql, params });
+    const match = predicateFor(sql, params);
+    if (/^SELECT/.test(sql) && /AS session_id/.test(sql)) {
+      // db-kernel lookupSession: the token→session join. It applies the revoked
+      // and expiry checks itself in JS, so the SQL filters on token alone.
+      const s = sessions.find(match);
+      if (!s) return { rows: [], rowCount: 0 };
+      return { rows: [{ session_id: s.id, builder_id: s.builder_id, expires_at: s.expires_at,
+        revoked_at: s.revoked_at, source: s.source, ...BUILDERS[s.builder_id] }], rowCount: 1 };
+    }
+    if (/^SELECT/.test(sql)) {
+      const cols = selectedColumns(sql);
+      const rows = sessions.filter(match)
+        .sort((a, b) => b.last_used_at - a.last_used_at || b.id - a.id)
+        .map((r) => Object.fromEntries(cols.map((c) => [c, r[c]])));
+      return { rows, rowCount: rows.length };
+    }
+    if (/^UPDATE builder_sessions SET revoked_at/.test(sql)) {
+      const hit = sessions.filter(match);
+      for (const r of hit) r.revoked_at = new Date();
+      return { rows: [], rowCount: hit.length };
+    }
+    if (/^UPDATE builder_sessions SET last_used_at/.test(sql)) {
+      const hit = sessions.filter(match);
+      for (const r of hit) { r.last_used_at = new Date(); r.expires_at = new Date(Date.now() + DAY); }
+      return { rows: [], rowCount: hit.length };
+    }
+    throw new Error(`fake pool: unhandled statement — ${sql.slice(0, 90)}`);
+  },
+  on: () => {},
+};
+
+// Pin the fake pool BEFORE anything that reaches for a connection is loaded, so
+// db, db-kernel and auth all resolve to it and no real pg Pool is ever built.
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true,
+  exports: { pool, instanceDbName: () => 'test' },
+};
+
+const auth = require('../src/bongos/auth.js');
+const buildMySessionsRouter = require('../src/bongos/routes/my-sessions.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const express = require('express');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildMySessionsRouter());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const BASE = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+async function call(method, path, { token, body } = {}) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: {
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+      ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) };
+}
+
+const aliveFor = (builderId) => sessions.filter((s) => s.builder_id === builderId && s.revoked_at === null).map((s) => s.id);
+
+// ===========================================================================
+// 1 — a xenos can see and kill their OWN sessions, with no Archon in sight
+// ===========================================================================
+
+console.log('own scope — a non-admin builder manages their own sessions:');
+
+await t('GET /me/sessions lists only the caller\'s LIVE sessions', async () => {
+  seed(); calls = [];
+  const r = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.body.sessions.map((s) => s.id), ['101', '102'],
+    'newest-used first; the revoked (103) and expired (104) rows must not appear, and Bo\'s 201 never can');
+});
+
+await t('the list carries enough to RECOGNISE a session, and marks the current one', async () => {
+  seed();
+  const r = await call('GET', '/me/sessions', { token: 'adacli' });
+  const cli = r.body.sessions.find((s) => s.id === '101');
+  assert.equal(cli.source, 'cli');
+  assert.equal(cli.user_agent, 'cloud-bongos-cli');
+  assert.ok(cli.created_at && cli.last_used_at && cli.expires_at, 'created / last used / expires must all be present');
+  assert.equal(cli.current, true, 'the session that made the request is the current one');
+  assert.equal(r.body.sessions.find((s) => s.id === '102').current, false);
+});
+
+await t('the token value is never selected and never returned', async () => {
+  seed();
+  const r = await call('GET', '/me/sessions', { token: 'adacli' });
+  const raw = JSON.stringify(r.body);
+  assert.ok(!/token/i.test(raw), 'no token field may appear in the list body');
+  for (const s of sessions) assert.ok(!raw.includes(s.token), `the raw token ${s.token} leaked into the response`);
+});
+
+await t('POST /me/sessions/revoke kills one of the caller\'s own sessions', async () => {
+  seed();
+  const r = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 102 } });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.revoked, 1);
+  // 104 is the already-expired row: unrevoked, so still here, but it never lists
+  // and its bearer can no longer authenticate. Revoking one session touches one.
+  assert.deepEqual(aliveFor(1), [101, 104], 'the web session is gone, the CLI one survives');
+});
+
+await t('POST /me/sessions/revoke-all signs the caller out everywhere, current session included', async () => {
+  seed();
+  const r = await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.revoked, 3, 'the two live rows plus the not-yet-expired-but-unrevoked one');
+  assert.deepEqual(aliveFor(1), [], 'nothing of Ada\'s is left alive');
+});
+
+await t('no rank or permission is involved — the caller is a xenos throughout', async () => {
+  seed();
+  assert.equal(BUILDERS[1].rank, 'xenos', 'the fixture must stay on the bottom rung or this proves nothing');
+  const list = await call('GET', '/me/sessions', { token: 'adacli' });
+  const kill = await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  assert.equal(list.status, 200);
+  assert.equal(kill.status, 200);
+});
+
+// ===========================================================================
+// 2 — the same builder cannot reach anybody else's
+// ===========================================================================
+
+console.log('\ncross-builder isolation — a stranger\'s sessions stay out of reach:');
+
+await t('a builder_id in the QUERY STRING changes nothing about whose list comes back', async () => {
+  seed();
+  const r = await call('GET', '/me/sessions?builder_id=2&builder=2', { token: 'adacli' });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.body.sessions.map((s) => s.id), ['101', '102'], 'still Ada\'s own list');
+  const listQuery = calls.filter((c) => /FROM builder_sessions WHERE builder_id/.test(c.sql)).pop();
+  assert.deepEqual(listQuery.params, [1], 'the account queried is the SESSION\'s builder, never the one named in the URL');
+});
+
+await t('guessing a stranger\'s session id revokes nothing and leaks nothing', async () => {
+  seed();
+  const r = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 201 } });
+  assert.equal(r.status, 200, 'a miss is not a 404 — that would confirm which ids exist');
+  assert.equal(r.body.revoked, 0);
+  assert.deepEqual(aliveFor(2), [201], 'Bo\'s session is untouched');
+  assert.ok(!JSON.stringify(r.body).includes('bo'), 'nothing about the other account may come back');
+});
+
+await t('an unknown id and a stranger\'s id are indistinguishable', async () => {
+  seed();
+  const stranger = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 201 } });
+  const nobody = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 999999 } });
+  assert.deepEqual(stranger.body, nobody.body, 'the two answers must be byte-identical');
+});
+
+await t('naming a builder in the BODY is rejected outright, and kills nothing', async () => {
+  seed();
+  const all = await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: { builder_id: 2 } });
+  assert.equal(all.status, 400, 'an unknown field must fail validation rather than be quietly ignored');
+  const one = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 201, builder_id: 2 } });
+  assert.equal(one.status, 400);
+  assert.deepEqual(aliveFor(2), [201], 'Bo keeps his session either way');
+});
+
+await t('Ada signing out everywhere leaves Bo signed in', async () => {
+  seed();
+  await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  assert.deepEqual(aliveFor(1), []);
+  assert.deepEqual(aliveFor(2), [201]);
+  const bo = await call('GET', '/me/sessions', { token: 'bocli' });
+  assert.equal(bo.status, 200);
+  assert.deepEqual(bo.body.sessions.map((s) => s.id), ['201']);
+});
+
+await t('every statement the routes issue is scoped to the caller\'s own account', async () => {
+  seed(); calls = [];
+  await call('GET', '/me/sessions', { token: 'adacli' });
+  await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 102 } });
+  await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  const owned = calls.filter((c) => !/AS session_id/.test(c.sql) && !/SET last_used_at/.test(c.sql));
+  assert.equal(owned.length, 3, 'one list, one single revoke, one sweep');
+  for (const c of owned) {
+    assert.ok(/builder_id = \$\d/.test(c.sql), `statement without an owner predicate: ${c.sql}`);
+    assert.ok(c.params.includes(1), `statement not bound to the caller: ${c.sql} ${JSON.stringify(c.params)}`);
+    assert.ok(!c.params.includes(2), 'no statement may ever carry another account\'s id');
+  }
+});
+
+// ===========================================================================
+// 3 — a revoked bearer stops authenticating (the whole point of the feature)
+// ===========================================================================
+
+console.log('\nthe remedy actually works — a revoked bearer is dead on the next request:');
+
+await t('an unauthenticated caller gets 401 from all three routes', async () => {
+  seed();
+  for (const [m, p] of [['GET', '/me/sessions'], ['POST', '/me/sessions/revoke'], ['POST', '/me/sessions/revoke-all']]) {
+    const r = await call(m, p, { body: m === 'GET' ? undefined : {} });
+    assert.equal(r.status, 401, `${m} ${p} must refuse an anonymous caller`);
+  }
+});
+
+await t('the leaked CLI bearer stops working the moment its owner revokes it', async () => {
+  seed();
+  const before = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(before.status, 200, 'the bearer works to begin with');
+  // Ada kills the leaked token from her browser session, not from the CLI.
+  const kill = await call('POST', '/me/sessions/revoke', { token: 'adaweb', body: { session_id: 101 } });
+  assert.equal(kill.body.revoked, 1);
+  const after = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(after.status, 401, 'the revoked bearer must no longer authenticate');
+  assert.equal(after.body.error && after.body.error.code, 'unauthenticated');
+});
+
+await t('sign-out-everywhere kills the session that asked for it, too', async () => {
+  seed();
+  const kill = await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  assert.equal(kill.status, 200, 'the request that was already authenticated still gets its answer');
+  const after = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(after.status, 401);
+  const web = await call('GET', '/me/sessions', { token: 'adaweb' });
+  assert.equal(web.status, 401, 'the browser cookie is gone as well — that is what "everywhere" means');
+});
+
+await t('refresh-on-use cannot resurrect a revoked session', async () => {
+  seed();
+  await call('POST', '/me/sessions/revoke', { token: 'adaweb', body: { session_id: 101 } });
+  await call('GET', '/me/sessions', { token: 'adacli' });          // the leaked token keeps trying
+  const row = sessions.find((s) => s.id === 101);
+  assert.ok(row.revoked_at instanceof Date, 'still revoked');
+  const r = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(r.status, 401, 'no amount of use walks the expiry forward once revoked_at is set');
+});
+
+// ===========================================================================
+// 4 — the source itself never takes an owner from the request
+// ===========================================================================
+
+console.log('\nroute source structure — the owner can only come from the session:');
+
+const ROUTE_SRC = readFileSync(join(ROOT, 'src/bongos/routes/my-sessions.js'), 'utf8');
+
+await t('no owner is ever read from the query string, the body, or the path', () => {
+  // Asserted over the RAW source, comments included: this file is own-scoped
+  // end to end, so unlike the mixed route files there is no legitimate reason
+  // for any of these spellings to appear in it at all.
+  for (const bad of [/req\.query\.builder/i, /req\.body\.builder/i, /req\.body\.owner/i, /req\.params\.builderId/i]) {
+    assert.ok(!bad.test(ROUTE_SRC), `my-sessions.js must not contain ${bad}`);
+  }
+});
+
+await t('every db call in the file passes req.builder.id', () => {
+  const dbCalls = ROUTE_SRC.split('\n')
+    .map((line) => /db\.[A-Za-z]+\((.*)\)/.exec(line))
+    .filter(Boolean)
+    .map((m) => m[1]);
+  assert.equal(dbCalls.length, 3, 'three db calls: list, revoke one, revoke all');
+  for (const args of dbCalls) {
+    assert.ok(/req\.builder\.id/.test(args), `db call not bound to the session builder: (${args})`);
+  }
+});
+
+await t('the admin cross-builder pair is untouched and still permission-gated', () => {
+  const authSrc = readFileSync(join(ROOT, 'src/bongos/routes/auth.js'), 'utf8');
+  for (const route of ["'/auth/revoke'", "'/auth/revoke-all'"]) {
+    const i = authSrc.indexOf(route);
+    assert.ok(i > 0, `${route} must still be declared`);
+    assert.ok(/requirePermission\('auth\.session\.revoke'\)/.test(authSrc.slice(i, i + 220)),
+      `${route} must keep its admin gate — the own-scoped routes are an addition, not a replacement`);
+  }
+});
+
+await t('the three own-scoped routes are pinned to any-builder in the rank auditor', () => {
+  const { checkRouteRanks } = require('../src/bongos/route-rank-check.js');
+  const r = checkRouteRanks();
+  assert.equal(r.hardFail, false, 'no route may be left unclassified or downgraded');
+  const pinSrc = readFileSync(join(ROOT, 'src/bongos/route-rank-check.js'), 'utf8');
+  for (const route of ['GET /me/sessions', 'POST /me/sessions/revoke', 'POST /me/sessions/revoke-all']) {
+    assert.ok(pinSrc.includes(`'${route}': 'any-builder'`), `${route} must be pinned so a later gate change fails loud`);
+  }
+});
+
+// ===========================================================================
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);