@bongos/core 1.19.887 → 1.19.889

package/tests/own_session_revoke.mjs

@@ -30,6 +30,7 @@
 // Run:  node tests/own_session_revoke.mjs
 
 import { strict as assert } from 'node:assert';
+import crypto from 'node:crypto';
 import { createRequire } from 'node:module';
 import http from 'node:http';
 import { readFileSync } from 'node:fs';
@@ -37,6 +38,13 @@ import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
 const require = createRequire(import.meta.url);
+// core_249: the bearer is stored and matched as its SHA-256. Computed here with
+// node:crypto rather than imported from db-kernel — requiring the kernel at this
+// point would bind the REAL pool before the fake below is installed in the
+// require cache, and every case would then try to reach Postgres. The two cannot
+// drift unnoticed: tests/session_token_hash.mjs pins the kernel's helper against
+// exactly this expression.
+const sessionTokenHash = (t) => crypto.createHash('sha256').update(String(t), 'utf8').digest('hex');
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 
 let passed = 0;
@@ -124,7 +132,11 @@ function predicateFor(sql, params) {
   // would tear it in half and leave a dangling `OR` behind.
   take(/\(?expires_at IS NULL OR expires_at > now\(\)\)?/,
     () => (r) => r.expires_at === null || r.expires_at > new Date());
-  take(/\b(?:s\.)?token = \$(\d+)/, (v) => (r) => r.token === v);
+  // core_249: the bearer is matched as its SHA-256, never as itself. The fixture
+  // rows below carry `token` as the plaintext a client would present, so the
+  // predicate hashes the row rather than the parameter — which also means a
+  // regression to `token = $1` stops matching here instead of quietly passing.
+  take(/\b(?:s\.)?token_hash = \$(\d+)/, (v) => (r) => sessionTokenHash(r.token) === v);
   take(/(?<!_)\b(?:s\.)?id = \$(\d+)/, (v) => (r) => String(r.id) === String(v));
   take(/\bbuilder_id = \$(\d+)/, (v) => (r) => String(r.builder_id) === String(v));
   take(/\brevoked_at IS NULL/, () => (r) => r.revoked_at === null);

package/tests/session_token_hash.mjs

@@ -0,0 +1,139 @@
+// tests/session_token_hash.mjs — core_249 / task 1003372 (audit A1). DB-FREE.
+//
+// The property this file exists to hold is NEGATIVE: the plaintext bearer must
+// never reach the database. A negative is exactly what a green test suite is
+// worst at — the code can stop hashing and every functional assertion still
+// passes, because a system that stores and compares plaintext works perfectly.
+// So this file does not check that sessions resolve (the DB sibling does that);
+// it checks what the kernel HANDS THE POOL, by standing in front of it and
+// reading every query and parameter that goes past.
+//
+// The real-DB sibling `session_token_hash_db.mjs` proves the halves this cannot:
+// that Postgres accepts the migration, that the SQL digest equals the Node one,
+// and that a bearer minted before the migration still authenticates after it.
+// It self-skips without a database, and a skipped case is not a passing one —
+// which is the whole reason this file is not optional.
+//
+// Run:  node tests/session_token_hash.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+import crypto from 'node:crypto';
+
+const require = createRequire(import.meta.url);
+const here = dirname(fileURLToPath(import.meta.url));
+
+// Stand in front of the pool BEFORE the kernel binds it, and record everything.
+const seen = [];
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true,
+  exports: {
+    pool: {
+      query: async (text, params) => {
+        seen.push({ text, params: params || [] });
+        return { rows: [], rowCount: 0 };
+      },
+    },
+  },
+};
+const kernel = require('../src/bongos/db-kernel.js');
+
+let passed = 0, failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+const BEARER = 'a-perfectly-ordinary-looking-bearer-token-5f21c9';
+const DIGEST = crypto.createHash('sha256').update(BEARER, 'utf8').digest('hex');
+
+await t('sessionTokenHash is SHA-256 hex, pinned against an independent digest', () => {
+  assert.equal(kernel.sessionTokenHash(BEARER), DIGEST);
+  assert.equal(kernel.sessionTokenHash(BEARER).length, 64);
+  assert.match(kernel.sessionTokenHash(BEARER), /^[0-9a-f]{64}$/);
+});
+
+await t('it is the SAME digest the migration computes, spelled the SQL way', () => {
+  // Not a re-derivation of the value — a check that the migration's expression
+  // is the one this hash corresponds to. If someone changes either side to
+  // sha512, base64, or a salted form, the two stop agreeing and every session
+  // that predates the deploy dies. The DB sibling proves the values match by
+  // running both; this catches the edit that causes it.
+  const sql = readFileSync(join(here, '..', 'migrations', 'core_249_session_token_hash.sql'), 'utf8');
+  assert.match(sql, /encode\(\s*sha256\(\s*token::bytea\s*\)\s*,\s*'hex'\s*\)/,
+    'the backfill no longer computes sha256-hex of the plaintext');
+});
+
+await t('THE NEGATIVE: createSession never hands the pool the plaintext', async () => {
+  seen.length = 0;
+  await kernel.createSession({ builderId: '1', token: BEARER, source: 'cli', userAgent: 'probe', expiresAt: null });
+  assert.equal(seen.length, 1, 'expected exactly one query');
+  const [q] = seen;
+  assert.ok(!q.params.includes(BEARER), 'the plaintext bearer was passed as a query parameter');
+  assert.ok(q.params.includes(DIGEST), 'the digest was not passed');
+  assert.ok(!q.text.includes('token,') && !/\btoken\b\s*=/.test(q.text),
+    'the statement still names the dropped plaintext column');
+  assert.match(q.text, /token_hash/);
+});
+
+await t('THE NEGATIVE: lookupSession never hands the pool the plaintext', async () => {
+  seen.length = 0;
+  await kernel.lookupSession(BEARER);
+  const read = seen[0];
+  assert.ok(read, 'no query was issued');
+  assert.ok(!read.params.includes(BEARER), 'the plaintext bearer was used as the lookup key');
+  assert.deepEqual(read.params, [DIGEST]);
+  assert.match(read.text, /s\.token_hash = \$1/);
+});
+
+await t('THE NEGATIVE: revokeSession never hands the pool the plaintext', async () => {
+  seen.length = 0;
+  const db = require('../src/bongos/db.js');
+  await db.revokeSession(BEARER);
+  const q = seen.find((s) => /revoked_at = now\(\)/.test(s.text));
+  assert.ok(q, 'no revoke statement was issued');
+  assert.ok(!q.params.includes(BEARER), 'revoke still matches on the plaintext bearer');
+  assert.deepEqual(q.params, [DIGEST]);
+  assert.match(q.text, /token_hash = \$1/);
+});
+
+await t('the probe would CATCH a regression — it is not vacuously green', async () => {
+  // A negative assertion is worth nothing unless it can fail. This runs the same
+  // checks against a deliberately-wrong call (the plaintext passed straight
+  // through) and requires them to reject it. Without this, a stub that recorded
+  // nothing, or an `includes` against the wrong array, would pass every case
+  // above while the kernel stored plaintext.
+  seen.length = 0;
+  const fakePool = { query: async (text, params) => { seen.push({ text, params }); return { rows: [] }; } };
+  await fakePool.query('SELECT 1 FROM builder_sessions WHERE token = $1', [BEARER]);
+  const bad = seen[0];
+  assert.ok(bad.params.includes(BEARER), 'the recorder is not capturing parameters at all');
+  assert.ok(!bad.params.includes(DIGEST), 'the recorder would accept a plaintext query as hashed');
+});
+
+await t('the migration drops the plaintext column rather than emptying it', () => {
+  const sql = readFileSync(join(here, '..', 'migrations', 'core_249_session_token_hash.sql'), 'utf8');
+  assert.match(sql, /ALTER TABLE builder_sessions DROP COLUMN token\b/);
+  assert.match(sql, /CREATE UNIQUE INDEX IF NOT EXISTS ux_builder_sessions_token_hash/);
+  assert.match(sql, /DROP INDEX IF EXISTS idx_builder_sessions_token/);
+});
+
+await t('the migration does NOT touch expiry — ADR 0294 and ADR 0206 stand', () => {
+  // The audit also asked for refresh-on-use to stop and an absolute session
+  // lifetime to be added. Both were decided the other way, by the owner, AFTER
+  // the audit was written: ADR 0294 keeps the roll-forward for rows that have an
+  // expiry, and ADR 0206 + ADR 0294 both reject an absolute ceiling by name. A
+  // hashing migration that quietly reintroduced either would be the tail wagging
+  // the dog, so the absence is asserted rather than left to reading.
+  const sql = readFileSync(join(here, '..', 'migrations', 'core_249_session_token_hash.sql'), 'utf8');
+  const statements = sql.split('\n').filter((l) => !l.trim().startsWith('--')).join('\n');
+  assert.ok(!/expires_at/.test(statements),
+    'core_249 writes expires_at — that belongs to ADR 0294, not to a hashing migration');
+});
+
+console.log(`\nsession_token_hash: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/session_token_hash_db.mjs

@@ -0,0 +1,193 @@
+// tests/session_token_hash_db.mjs — core_249 / task 1003372 (audit A1, real DB).
+//
+// The bearer stored in `builder_sessions` was plaintext, NOT NULL UNIQUE and
+// INDEXED: every row was a directly replayable credential. This file proves the
+// two properties that fix has to carry, and they pull against each other:
+//
+//   1. NOTHING REPLAYABLE IS LEFT. The plaintext column is gone, and a dump of
+//      the table yields no value that authenticates.
+//   2. NOBODY IS SIGNED OUT. A session minted BEFORE the migration still
+//      authenticates AFTER it, with the same bearer its holder is still carrying.
+//
+// (2) is the one worth a real database. It is the whole reason the migration
+// backfills instead of letting sessions re-mint, and it can only be proved by
+// running the actual SQL against rows in the actual old shape. A mistake here
+// does not fail loudly in review — it signs out every builder and every dev box
+// on deploy day, including whoever would have to log in to fix it.
+//
+// The sibling `session_token_hash.mjs` is DB-free and pins the hash itself plus
+// the statements' shape. What it cannot see is whether Postgres accepts the
+// migration at all, or whether the digest the migration computes in SQL equals
+// the one the kernel computes in Node — a mismatch that would leave every
+// pre-existing session dead while every new one worked, which is exactly the
+// failure a code-only test reads straight past.
+//
+// Real-DB integration test: self-skips without a reachable Postgres.
+//
+// Run:  DATABASE_URL=... node tests/session_token_hash_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIGRATION = join(here, '..', 'migrations', 'core_249_session_token_hash.sql');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`session_token_hash_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const SCHEMA = `tokhash_probe_${process.pid}`;
+await pool.query(`CREATE SCHEMA ${SCHEMA}`);
+await pool.query(`SET search_path TO ${SCHEMA}`);
+
+// The table in its PRE-migration shape — plaintext `token`, NOT NULL UNIQUE,
+// indexed. Copied from migrations/003_pms.sql so the migration is exercised
+// against what it will actually meet on a live instance.
+await pool.query(`
+  CREATE TABLE builders (id bigserial PRIMARY KEY, github_id text, github_login text,
+    display_name text, avatar_url text, total_credits int DEFAULT 0, rank text DEFAULT 'archon',
+    status text DEFAULT 'active', system_role text, anthropic_user_id text);
+  CREATE TABLE builder_sessions (id bigserial PRIMARY KEY, builder_id bigint REFERENCES builders(id),
+    token text NOT NULL UNIQUE, source text, user_agent text, created_at timestamptz DEFAULT now(),
+    last_used_at timestamptz DEFAULT now(), expires_at timestamptz, revoked_at timestamptz);
+  CREATE INDEX idx_builder_sessions_token ON builder_sessions (token);
+  INSERT INTO builders (github_login) VALUES ('probe');
+`);
+
+const client = await pool.connect();
+await client.query(`SET search_path TO ${SCHEMA}`);
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: client } };
+const kernel = require('../src/bongos/db-kernel.js');
+
+let passed = 0, failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+const row = async (sql, p) => (await client.query(sql, p)).rows[0];
+
+// Sessions that exist BEFORE the migration, written the old way. These stand in
+// for every builder holding a live bearer on deploy day.
+const LIVE_CLI = 'pre-existing-cli-bearer-2f8a';
+const LIVE_WEB = 'pre-existing-web-bearer-91cd';
+await client.query(
+  `INSERT INTO builder_sessions (builder_id, token, source, expires_at)
+   VALUES (1,$1,'cli',NULL), (1,$2,'web', now() + interval '30 days')`,
+  [LIVE_CLI, LIVE_WEB]
+);
+
+// ── the migration, for real ───────────────────────────────────────────────────
+
+const migrationSql = readFileSync(MIGRATION, 'utf8');
+await client.query(migrationSql);
+
+await t('THE ONE THAT MATTERS: a bearer minted before the migration still authenticates after it', async () => {
+  // If this fails, the deploy signs out every builder holding a session — the
+  // failure the backfill exists to prevent, and the one nobody can undo from
+  // outside because fixing it needs a session.
+  const got = await kernel.lookupSession(LIVE_CLI);
+  assert.ok(got, 'the pre-existing CLI bearer no longer resolves');
+  assert.equal(got.github_login, 'probe');
+});
+
+await t('a pre-existing WEB session survives too, expiry intact', async () => {
+  const got = await kernel.lookupSession(LIVE_WEB);
+  assert.ok(got, 'the pre-existing web bearer no longer resolves');
+  assert.ok(got.expires_at instanceof Date, 'the web row lost its expiry');
+});
+
+await t('the SQL digest equals the Node digest — the two halves agree', async () => {
+  // The backfill computes encode(sha256(token::bytea),'hex') in Postgres; the
+  // kernel computes sha256 hex in Node. If these ever diverge, new sessions work
+  // and every migrated one is dead — a split nothing else here would localise.
+  const got = await row(`SELECT token_hash FROM builder_sessions WHERE source='cli'`);
+  assert.equal(got.token_hash, kernel.sessionTokenHash(LIVE_CLI));
+});
+
+// ── nothing replayable is left ────────────────────────────────────────────────
+
+await t('the plaintext column is GONE, not merely emptied', async () => {
+  const got = await row(
+    `SELECT count(*)::int AS n FROM information_schema.columns
+      WHERE table_schema=$1 AND table_name='builder_sessions' AND column_name='token'`,
+    [SCHEMA]
+  );
+  assert.equal(got.n, 0, 'builder_sessions.token still exists');
+});
+
+await t('no stored value authenticates — a dump of the table is inert', async () => {
+  // The actual security claim, asserted the way an attacker would test it: take
+  // everything the table holds and try to log in with it. Reading token_hash and
+  // presenting it must NOT work — if lookupSession hashed nothing, or compared
+  // the presented value to itself, this is where that shows.
+  const { rows } = await client.query(`SELECT token_hash FROM builder_sessions`);
+  assert.ok(rows.length >= 2, 'fixture rows missing — the assertion would be vacuous');
+  for (const r of rows) {
+    assert.equal(await kernel.lookupSession(r.token_hash), null,
+      'a value read straight out of the table authenticated');
+  }
+});
+
+await t('the uniqueness guarantee moved with the column', async () => {
+  await assert.rejects(
+    () => client.query(
+      `INSERT INTO builder_sessions (builder_id, token_hash, source) VALUES (1,$1,'cli')`,
+      [kernel.sessionTokenHash(LIVE_CLI)]
+    ),
+    /duplicate key|unique/i,
+    'two sessions may not share a bearer'
+  );
+});
+
+// ── round-trip through the live code path ─────────────────────────────────────
+
+await t('a session minted AFTER the migration resolves, and stores only its digest', async () => {
+  const fresh = 'freshly-minted-bearer-77b0';
+  await kernel.createSession({ builderId: '1', token: fresh, source: 'cli', userAgent: 'probe', expiresAt: null });
+  const got = await kernel.lookupSession(fresh);
+  assert.ok(got && got.github_login === 'probe', 'a new session did not resolve');
+  const stored = await row(`SELECT token_hash FROM builder_sessions WHERE token_hash = $1`,
+    [kernel.sessionTokenHash(fresh)]);
+  assert.ok(stored, 'the new row is not keyed on the digest');
+});
+
+await t('createSession hands the caller back the bearer it was given', async () => {
+  // The mint response has to carry the plaintext to the client — it is the only
+  // copy that will ever exist. It now comes from the ARGUMENT, since the row
+  // cannot return it.
+  const tok = 'returned-to-caller-a301';
+  const s = await kernel.createSession({ builderId: '1', token: tok, source: 'cli', userAgent: 'probe', expiresAt: null });
+  assert.equal(s.token, tok);
+});
+
+await t('revokeSession still kills a session it is handed by bearer', async () => {
+  const db = require('../src/bongos/db.js');
+  const tok = 'to-be-revoked-5e12';
+  await kernel.createSession({ builderId: '1', token: tok, source: 'cli', userAgent: 'probe', expiresAt: null });
+  assert.ok(await kernel.lookupSession(tok), 'precondition: the session should resolve first');
+  await db.revokeSession(tok);
+  assert.equal(await kernel.lookupSession(tok), null, 'revoke by bearer no longer reaches the row');
+});
+
+await t('the migration is idempotent — a second run is a no-op, not an error', async () => {
+  await client.query(migrationSql);
+  assert.ok(await kernel.lookupSession(LIVE_CLI), 'a re-run broke a live session');
+});
+
+client.release();
+await pool.query(`DROP SCHEMA ${SCHEMA} CASCADE`);
+await pool.end();
+console.log(`\nsession_token_hash_db: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);