@bongos/core 1.21.135 → 1.21.137

package/src/bongos/routes.js

@@ -28,6 +28,7 @@ const buildMeRouter = require('./routes/me');
 // task 1003341). Its own router rather than three more routes on the /me
 // aggregator or the admin pair in routes/auth.js — see that file's header.
 const buildMySessionsRouter = require('./routes/my-sessions');
+const buildMyPasskeysRouter = require('./routes/my-passkeys');
 const buildBuildersRouter = require('./routes/builders');
 // The LIFECYCLE routes (tasks · claims · versions · done-when · goals ·
 // dependencies · gate-approvals · analytics) carved into modules/lifecycle/
@@ -161,6 +162,7 @@ function buildGdsRouter() {
   router.use(buildGithubRouter());
   router.use(buildMeRouter());
   router.use(buildMySessionsRouter());
+  router.use(buildMyPasskeysRouter());
   router.use(buildBuildersRouter());
   // tasks · claims · versions · done-when · goals · dependencies · analytics now
   // mount via moduleLoader.mountModuleRoutes below (lifecycle module, BV1.R86) —

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.135'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.137'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/my_passkeys.mjs

@@ -0,0 +1,108 @@
+// tests/my_passkeys.mjs — own-scoped card registration routes (task 1004746, ADR 0382).
+// DB-free: a fake store and fake WebAuthn library behind the real router, over real HTTP.
+// Pins: list/rename/remove are keyed on the CALLER's id; register/verify hands the
+// library a challenge check that consumes via the store, bound to purpose 'register'
+// and the caller; a failed verification stores nothing.
+// Run:  node tests/my_passkeys.mjs
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+delete process.env.PASSKEY_RP_ID; delete process.env.PASSKEY_ORIGIN;
+const require = createRequire(import.meta.url);
+const express = require('express');
+const build = require('../src/bongos/routes/my-passkeys');
+
+const creds = [];
+const consumed = [];
+const store = {
+  listCredentials: async (b) => creds.filter((c) => c.builder_id === b),
+  getOrCreateUserHandle: async () => 'aGFuZGxl',
+  createChallenge: async () => ({ challenge: 'Y2hhbGw' }),
+  consumeChallenge: async (c, o) => { consumed.push([c, o]); return { purpose: 'register', builderId: o.expectBuilderId }; },
+  getCredentialById: async (id) => creds.find((c) => c.credential_id === id) || null,
+  addCredential: async (c) => { creds.push({ credential_id: c.credentialId, builder_id: c.builderId, nickname: c.nickname, transports: c.transports, created_at: 'x' }); },
+  renameCredential: async (b, id, n) => { const c = creds.find((x) => x.builder_id === b && x.credential_id === id); if (c) c.nickname = n; return !!c; },
+  removeCredential: async (b, id) => { const i = creds.findIndex((x) => x.builder_id === b && x.credential_id === id); if (i < 0) return false; creds.splice(i, 1); return true; },
+};
+let verifyOk = true;
+const webauthn = {
+  generateRegistrationOptions: async (o) => ({ rp: { id: o.rpID }, excludeCredentials: o.excludeCredentials }),
+  verifyRegistrationResponse: async (o) => {
+    assert.equal(o.requireUserVerification, true);
+    if (!(await o.expectedChallenge('Y2hhbGw'))) throw new Error('challenge');
+    if (!verifyOk) return { verified: false };
+    return { verified: true, registrationInfo: { aaguid: 'a', credential: { id: 'cred1', publicKey: new Uint8Array([1]), counter: 0, transports: ['nfc'] } } };
+  },
+};
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => { res.fail = (code, { status = 400, message } = {}) => res.status(status).json({ error: code, message }); next(); });
+app.use((req, res, next) => { req.builder = { id: '7', github_login: 'me' }; next(); });
+app.use('/', build({ store, webauthn, requireBuilder: (q, r, n) => n() }));
+const server = http.createServer(app).listen(0);
+const port = server.address().port;
+const call = (method, path, body) => new Promise((resolve) => {
+  const r = http.request({ port, path, method, headers: { 'content-type': 'application/json', host: 'localhost' } }, (res) => {
+    let d = ''; res.on('data', (c) => (d += c)); res.on('end', () => { let b = null; try { b = JSON.parse(d); } catch { /* not json */ } resolve({ status: res.statusCode, body: b }); });
+  });
+  if (body) r.write(JSON.stringify(body));
+  r.end();
+});
+
+let n = 0;
+const ok = (name) => { n++; console.log(`ok - ${name}`); };
+
+let r = await call('POST', '/me/passkeys/register/options', {});
+assert.equal(r.status, 200); assert.equal(r.body.options.rp.id, 'localhost'); ok('options issues for caller');
+
+verifyOk = false;
+r = await call('POST', '/me/passkeys/register/verify', { response: { id: 'x' } });
+assert.equal(r.status, 400); assert.equal(creds.length, 0); ok('failed verification stores nothing');
+
+verifyOk = true;
+r = await call('POST', '/me/passkeys/register/verify', { response: { id: 'x' }, nickname: '  My   card ' });
+assert.equal(r.status, 200); assert.equal(creds[0].nickname, 'My card'); assert.equal(creds[0].builder_id, '7');
+assert.deepEqual(consumed.at(-1)[1], { expectPurpose: 'register', expectBuilderId: '7' }); ok('verify stores; challenge bound to caller and purpose');
+
+r = await call('POST', '/me/passkeys/register/verify', { response: { id: 'x' } });
+assert.equal(r.status, 409); ok('duplicate card refused');
+
+creds.push({ credential_id: 'other', builder_id: '9', nickname: 'theirs' });
+r = await call('POST', '/me/passkeys/remove', { credential_id: 'other' });
+assert.equal(r.status, 404); assert.equal(creds.length, 2); ok("cannot remove another builder's card");
+r = await call('POST', '/me/passkeys/rename', { credential_id: 'other', nickname: 'mine now' });
+assert.equal(r.status, 404); assert.equal(creds[1].nickname, 'theirs'); ok("cannot rename another builder's card");
+
+r = await call('GET', '/me/passkeys');
+assert.equal(r.body.passkeys.length, 1); assert.ok(!('public_key' in r.body.passkeys[0])); ok('list is own-only, no key material');
+
+r = await call('POST', '/me/passkeys/rename', { credential_id: 'cred1', nickname: 'x'.repeat(61) });
+assert.equal(r.status, 400); ok('long nickname refused');
+r = await call('POST', '/me/passkeys/rename', { credential_id: 'cred1', nickname: 'Desk' });
+assert.equal(r.status, 200); assert.equal(creds[0].nickname, 'Desk'); ok('rename');
+r = await call('POST', '/me/passkeys/remove', { credential_id: 'cred1' });
+assert.equal(r.status, 200); ok('remove');
+
+r = await call('GET', '/me/passkeys/browser.js');
+assert.equal(r.status, 200); ok('browser bundle is served');
+
+r = await call('POST', '/me/passkeys/rename', { credential_id: 'x' });
+assert.equal(r.status, 400); ok('rename without a nickname is refused');
+
+// Past the cap: options and verify both refuse.
+creds.length = 0;
+for (let i = 0; i < 10; i++) creds.push({ credential_id: 'c' + i, builder_id: '7' });
+r = await call('POST', '/me/passkeys/register/options', {});
+assert.equal(r.status, 409);
+r = await call('POST', '/me/passkeys/register/verify', { response: { id: 'x' } });
+assert.equal(r.status, 409); assert.equal(creds.length, 10); ok('card cap enforced on options and verify');
+
+// A non-local host with no configured RP is refused, not guessed.
+r = await new Promise((resolve) => {
+  const q = http.request({ port, path: '/me/passkeys/register/options', method: 'POST', headers: { 'content-type': 'application/json', host: 'evil.example', 'x-forwarded-host': 'evil.example' } }, (res) => { res.resume(); resolve({ status: res.statusCode }); });
+  q.write('{}'); q.end();
+});
+assert.equal(r.status, 503); ok('unconfigured non-local host refused');
+
+server.close();
+console.log(`${n} passed`);

package/tests/own_scope_guard.mjs

@@ -84,6 +84,11 @@ const OWN_SCOPED_SURFACES = [
     why: "the caller's OWN auth sessions — list, revoke one, sign out everywhere (task 1003341, ADR 0206). Every statement carries builder_id = req.builder.id, so a session id belonging to somebody else matches no row. Kept OUT of routes/auth.js precisely so this whole file can be held to the own-scope rule: the admin cross-builder pair next door takes its target from the body, which is what makes it admin.",
     crossOwner: [],
   },
+  {
+    file: 'src/bongos/routes/my-passkeys.js',
+    why: "the caller's OWN hardware security cards — list, register, rename, remove (task 1004746, ADR 0382). Every store call is keyed on req.builder.id; a credential id belonging to somebody else matches no row. The one ungated route serves a vendored static library file.",
+    crossOwner: [],
+  },
   {
     file: 'modules/specialities/routes/specialities.js',
     why: "role sub-specialities (task 1003855, ADR 0296). The own-scoped route here is GET /me/specialities — the CALLER's own adoptions, taken from req.builder.id with nothing read off the request. The rest of the router is /specialities/* rather than /me/*, and those are ownership-checked per row against req.builder.id after re-reading the speciality server-side, never from a client-supplied owner id.",

package/tests/passkey_foundation_db.mjs

@@ -0,0 +1,90 @@
+// tests/passkey_foundation_db.mjs — task 1004750 (ADR 0382 D1, D6). Real DB.
+// The passkey tables built from the real migration in a throwaway schema, and the
+// store's rules: single-use challenges, TTL, sweep, unique credential ids, sign-count.
+// Self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=... node tests/passkey_foundation_db.mjs
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const here = dirname(fileURLToPath(import.meta.url));
+
+const pgPool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try { client = await pgPool.connect(); } catch (e) {
+  console.log(`passkey_foundation_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pgPool.end().catch(() => {});
+  process.exit(0);
+}
+const SCHEMA = `t1004750_${process.pid}`;
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+
+try {
+  await client.query(`CREATE SCHEMA ${SCHEMA}`);
+  await client.query(`SET search_path TO ${SCHEMA}`);
+  await client.query('CREATE TABLE builders (id bigserial PRIMARY KEY)');
+  await client.query('CREATE TABLE schema_migrations (version text PRIMARY KEY)');
+  await client.query(readFileSync(join(here, '..', 'migrations', 'core_277_passkey_foundation.sql'), 'utf8'));
+  await client.query('INSERT INTO builders DEFAULT VALUES');
+  await client.query('INSERT INTO builders DEFAULT VALUES');
+
+  const pk = require('../src/bongos/passkeys.js');
+  const o = { pool: client };
+
+  const c = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok(typeof c.challenge === 'string' && c.challenge.length >= 40, 'challenge is long random base64url');
+  const got = await pk.consumeChallenge(c.challenge, o);
+  ok(got && got.purpose === 'register' && got.builderId === '1', 'a live challenge is consumed once');
+  ok((await pk.consumeChallenge(c.challenge, o)) === null, 'a second consume (replay) finds nothing');
+
+  const expire = (ch) => client.query("UPDATE passkey_challenges SET expires_at = now() - interval '1 second' WHERE challenge = $1", [ch]);
+  const old = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(old.challenge);
+  ok((await pk.consumeChallenge(old.challenge, o)) === null, 'an expired challenge is refused');
+  const stale = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(stale.challenge);
+  const live = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  ok((await client.query('SELECT 1 FROM passkey_challenges WHERE challenge = $1', [stale.challenge])).rowCount === 0, 'issuing a challenge sweeps expired rows');
+  const stale2 = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(stale2.challenge);
+  ok((await pk.sweepExpiredChallenges(o)) === 1, 'sweep removes only expired challenges');
+  ok((await pk.consumeChallenge(live.challenge, o)) !== null, 'sweep left the live one');
+  await assert.rejects(pk.createChallenge({ purpose: 'nope', ...o }));
+  pass++; console.log('  ok - unknown purpose rejected');
+  await assert.rejects(client.query("INSERT INTO passkey_challenges (challenge, purpose, expires_at) VALUES ('x','bogus', now())"));
+  pass++; console.log('  ok - the table itself refuses an unknown purpose');
+
+  const wrong = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(wrong.challenge, { ...o, expectPurpose: 'authenticate' })) === null, 'a challenge for another purpose is refused');
+  ok((await pk.consumeChallenge(wrong.challenge, o)) === null, 'and it is spent by the wrong presentation');
+  const b1 = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(b1.challenge, { ...o, expectBuilderId: 2 })) === null, 'a challenge for another builder is refused');
+  const b2 = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(b2.challenge, { ...o, expectPurpose: 'register', expectBuilderId: 1 })) !== null, 'matching purpose and builder pass');
+
+  const h1 = await pk.getOrCreateUserHandle(1, o);
+  ok(h1 === await pk.getOrCreateUserHandle(1, o) && h1 !== await pk.getOrCreateUserHandle(2, o), 'user handle is stable per builder and distinct');
+
+  await pk.addCredential({ builderId: 1, credentialId: 'cred-a', publicKey: Buffer.from([1, 2, 3]), transports: ['usb'], nickname: 'card' }, o);
+  await assert.rejects(pk.addCredential({ builderId: 2, credentialId: 'cred-a', publicKey: Buffer.from([9]) }, o));
+  pass++; console.log('  ok - a credential id belongs to one builder');
+  ok((await pk.listCredentials(1, o)).length === 1 && (await pk.listCredentials(2, o)).length === 0, 'credentials listed per builder');
+
+  ok((await pk.recordUse('cred-a', 5, o)).ok, 'sign count advances');
+  ok((await pk.recordUse('cred-a', 5, o)).reason === 'sign_count_regressed', 'a non-advancing counter is refused');
+  ok((await pk.recordUse('cred-a', 3, o)).reason === 'sign_count_regressed' && Number((await pk.getCredentialById('cred-a', o)).sign_count) === 5, 'a lower counter never overwrites the stored one');
+  ok((await pk.recordUse('nope', 1, o)).reason === 'unknown_credential', 'unknown credential reported');
+  ok((await pk.getCredentialById('cred-a', o)).last_used_at != null, 'last_used_at is stamped');
+  ok(!(await pk.removeCredential(2, 'cred-a', o)), 'another builder cannot remove it');
+  ok(await pk.removeCredential(1, 'cred-a', o), 'owner removes it');
+  console.log(`passkey_foundation_db.mjs: ${pass} passed`);
+} finally {
+  await client.query('SET search_path TO public').catch(() => {});
+  await client.query(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => {});
+  client.release();
+  await pgPool.end();
+}

package/tests/passkey_pure.mjs

@@ -0,0 +1,24 @@
+// tests/passkey_pure.mjs — task 1004750 (ADR 0382 D6). DB-free: the pure rules of
+// src/bongos/passkeys.js that the required unit lane can run. The real-SQL half is
+// tests/passkey_foundation_db.mjs.
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const pk = require('../src/bongos/passkeys.js');
+
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+
+ok(pk.PURPOSES.includes('register') && pk.PURPOSES.includes('authenticate') && pk.PURPOSES.length === 2, 'two ceremony purposes');
+ok(pk.clampTtlSeconds(60) === 60, 'a sane TTL passes through');
+ok(pk.clampTtlSeconds(-5) === pk.CHALLENGE_TTL_SECONDS, 'a negative TTL falls back to the default');
+ok(pk.clampTtlSeconds('abc') === pk.CHALLENGE_TTL_SECONDS, 'a non-number falls back to the default');
+ok(pk.clampTtlSeconds(86400) === pk.MAX_CHALLENGE_TTL_SECONDS, 'a huge TTL is capped');
+ok(pk.counterAdvances(0, 0), 'a card with no counter is accepted');
+ok(pk.counterAdvances(5, 6), 'an advancing counter is accepted');
+ok(!pk.counterAdvances(5, 5), 'a repeated counter is refused');
+ok(!pk.counterAdvances(5, 3), 'a lower counter is refused');
+ok(!pk.counterAdvances(5, 0), 'a counter reset to zero is refused');
+await assert.rejects(pk.createChallenge({ purpose: 'bogus', pool: { query: async () => { throw new Error('should not query'); } } }));
+pass++; console.log('  ok - an unknown purpose is rejected before any query');
+console.log(`passkey_pure.mjs: ${pass} passed`);