@bongos/core 1.24.96 → 1.25.1

package/src/bongos/passkeys.js

@@ -15,6 +15,8 @@ const crypto = require('node:crypto');
 const CHALLENGE_TTL_SECONDS = 300;
 const MAX_CHALLENGE_TTL_SECONDS = 600;
 const PURPOSES = Object.freeze(['register', 'authenticate']);
+// How long one card tap keeps a session cleared for the protected actions (ADR 0382 D2).
+const STEP_UP_WINDOW_SECONDS = 600;
 
 function defaultPool() { return require('./pool').pool; }
 
@@ -146,7 +148,35 @@ async function renameCredential(builderId, credentialId, nickname, { pool = defa
   return r.rowCount > 0;
 }
 
+// Stamp the session that just passed a card check. Keyed on the builder as well, so a
+// session id that is not the caller's matches no row. Returns true when stamped.
+async function markSessionCardVerified(sessionId, builderId, { pool = defaultPool() } = {}) {
+  const r = await pool.query(
+    `UPDATE builder_sessions SET card_verified_at = now()
+      WHERE id = $1 AND builder_id = $2 AND revoked_at IS NULL`,
+    [sessionId, builderId],
+  );
+  return r.rowCount > 0;
+}
+
+// Where this session stands: is a card required of the builder, and is the session's
+// last tap inside the window? Read fresh from the DB on every call, never cached.
+async function stepUpStatus(sessionId, builderId, { pool = defaultPool(), windowSeconds = STEP_UP_WINDOW_SECONDS } = {}) {
+  const { rows } = await pool.query(
+    `SELECT b.require_card,
+            (s.card_verified_at IS NOT NULL
+               AND s.card_verified_at > now() - make_interval(secs => $3::int)) AS fresh
+       FROM builders b JOIN builder_sessions s ON s.builder_id = b.id
+      WHERE b.id = $1 AND s.id = $2`,
+    [builderId, sessionId, String(windowSeconds)],
+  );
+  const r = rows[0];
+  if (!r) return null;
+  return { required: r.require_card === true, fresh: r.fresh === true };
+}
+
 module.exports = {
+  STEP_UP_WINDOW_SECONDS, markSessionCardVerified, stepUpStatus,
   CHALLENGE_TTL_SECONDS, MAX_CHALLENGE_TTL_SECONDS, PURPOSES, clampTtlSeconds, counterAdvances,
   createChallenge, consumeChallenge, sweepExpiredChallenges,
   getOrCreateUserHandle, addCredential, getCredentialById, listCredentials, recordUse, removeCredential, renameCredential,

package/src/bongos/routes/auth.js

@@ -1418,7 +1418,7 @@ module.exports = function buildAuthRouter() {
   // rank: archon — kills an arbitrary session; can lock other builders out. Gate:
   // requirePermission('auth.session.revoke') — BV1.R104; the seeded rank-role makes
   // the permission and the old rank floor identical (ADR 0151).
-  router.post('/auth/revoke', auth.requireBuilder, auth.requirePermission('auth.session.revoke'), async (req, res) => {
+  router.post('/auth/revoke', auth.requireBuilder, auth.requirePermission('auth.session.revoke'), require('../step-up').requireCardStepUp, async (req, res) => {
     if (validateOrRespond(req, res, { session_id: {} })) return;  // bigint as number or string; validated below
     const sessionId = req.body && req.body.session_id;
     if (sessionId === undefined || sessionId === null) {
@@ -1446,7 +1446,7 @@ module.exports = function buildAuthRouter() {
   // rank: archon — same authority as PATCH /builders/:id/rank. Gate:
   // requirePermission('auth.session.revoke') — BV1.R104; the same atom /auth/revoke
   // gates on (ADR 0151).
-  router.post('/auth/revoke-all', auth.requireBuilder, auth.requirePermission('auth.session.revoke'), async (req, res) => {
+  router.post('/auth/revoke-all', auth.requireBuilder, auth.requirePermission('auth.session.revoke'), require('../step-up').requireCardStepUp, async (req, res) => {
     if (validateOrRespond(req, res, { builder_id: {} })) return;  // bigint as number or string; validated below
     const builderId = req.body && req.body.builder_id;
     if (builderId === undefined || builderId === null) {

package/src/bongos/routes/builders.js

@@ -24,6 +24,7 @@
 
 const express = require('express');
 const auth = require('../auth');
+const { requireCardStepUp } = require('../step-up');
 // WHO DECIDES AT TREASURY (task 1004657; ADR 0363 D5): the budget write refuses a
 // lone act while Treasury's decision-rules row names a sitting. A passed Treasury
 // matter sets the limit through setMonthlyBudget directly (the governor.matterAct
@@ -271,7 +272,7 @@ module.exports = function buildBuildersRouter() {
   // the permission and the old rank floor identical (ADR 0151). The atom is
   // `system: true`, so no CUSTOM role may ever be granted it — only the seeded archon
   // role holds it, which is exactly the meta-escalation wall ADR 0016 wants.
-  router.patch('/builders/:id/rank', auth.requireBuilder, auth.requirePermission('builder.rank.set'), async (req, res) => {
+  router.patch('/builders/:id/rank', auth.requireBuilder, auth.requirePermission('builder.rank.set'), requireCardStepUp, async (req, res) => {
     if (validateOrRespond(req, res, {
       rank: { required: true, type: 'string', maxLength: 32 },
     })) return;

package/src/bongos/routes/module-payouts.js

@@ -28,6 +28,8 @@ module.exports = function buildModulePayoutsRouter({
   requirePermission = auth.requirePermission,
 } = {}) {
   const router = express.Router();
+  // the processor adapter (modules/economy/processor-stripe.js, task 1005040) is a port, resolved per call
+  const proc = () => processor || require('../../module-seams').resolveOptional('economy.processor');
 
   function personal(req, res) {
     const p = store.personalSession(req);
@@ -74,7 +76,7 @@ module.exports = function buildModulePayoutsRouter({
     if (!actor) return;
     if (validateOrRespond(req, res, { processor_sale_ref: { required: true } })) return;
     try {
-      const out = await payouts.recordSale({ processorSaleRef: req.body.processor_sale_ref, actorId: actor.id }, { processor });
+      const out = await payouts.recordSale({ processorSaleRef: req.body.processor_sale_ref, actorId: actor.id }, { processor: proc() });
       res.status(out.already ? 200 : 201).json(out);
     } catch (err) { fail(res, err, 'POST /payouts/module-sales'); }
   });
@@ -104,7 +106,7 @@ module.exports = function buildModulePayoutsRouter({
     if (!actor) return;
     if (validateOrRespond(req, res, { approval_id: { required: true } })) return;
     try {
-      const out = await payouts.payShare({ shareId: req.params.id, approvalId: req.body.approval_id, actorId: actor.id }, { processor });
+      const out = await payouts.payShare({ shareId: req.params.id, approvalId: req.body.approval_id, actorId: actor.id }, { processor: proc() });
       res.set('Cache-Control', 'no-store');
       res.json(out);
     } catch (err) { fail(res, err, 'POST /payouts/module-shares/:id/pay'); }

package/src/bongos/routes/my-cash-outs.js

@@ -30,6 +30,8 @@ function buildMyCashOutsRouter({
   requireBuilder = auth.requireBuilder,
 } = {}) {
   const router = express.Router();
+  // the processor adapter (modules/economy/processor-stripe.js, task 1005040) is a port, resolved per call
+  const proc = () => processor || require('../../module-seams').resolveOptional('economy.processor');
 
   function personal(req, res) {
     const p = approvals.personalSession(req);
@@ -62,7 +64,7 @@ function buildMyCashOutsRouter({
   // GET /api/bongos/me/cash-outs — my withdrawals and where each stands.
   router.get('/me/cash-outs', requireBuilder, async (req, res) => {
     try {
-      const out = await cashOuts.listMyCashOuts(req.builder.id, { processor, limit: req.query.limit, log });
+      const out = await cashOuts.listMyCashOuts(req.builder.id, { processor: proc(), limit: req.query.limit, log });
       res.set('Cache-Control', 'no-store');
       res.json(out);
     } catch (err) { fault(res, err, 'GET /me/cash-outs'); }
@@ -76,7 +78,7 @@ function buildMyCashOutsRouter({
     try {
       const out = await cashOuts.requestCashOut({
         builderId: String(req.builder.id), actor, amountCents: req.body.amount_cents, instructionId: req.body.instruction_id,
-      }, { processor, log });
+      }, { processor: proc(), log });
       answer(res, out);
     } catch (err) { fault(res, err, 'POST /me/cash-outs'); }
   });
@@ -85,7 +87,7 @@ function buildMyCashOutsRouter({
   router.post('/me/cash-outs/:id/retry', requireBuilder, async (req, res) => {
     if (!personal(req, res)) return;
     try {
-      answer(res, await cashOuts.retryCashOut({ builderId: String(req.builder.id), cashOutId: req.params.id }, { processor }));
+      answer(res, await cashOuts.retryCashOut({ builderId: String(req.builder.id), cashOutId: req.params.id }, { processor: proc() }));
     } catch (err) { fault(res, err, 'POST /me/cash-outs/:id/retry'); }
   });
 

package/src/bongos/routes/my-passkeys.js

@@ -206,6 +206,76 @@ module.exports = function buildMyPasskeysRouter({
     }
   });
 
+  // POST /api/bongos/me/passkeys/authenticate/options — start a card check.
+  // rank: any-builder (own identity only). The challenge is bound to the caller.
+  router.post('/me/passkeys/authenticate/options', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {})) return;
+    try {
+      const rp = relyingParty(req);
+      if (!rp) return res.fail('passkeys_not_configured', { status: 503, message: 'security cards are not configured on this site yet' });
+      const cards = await store.listCredentials(req.builder.id);
+      if (!cards.length) return res.fail('no_cards', { status: 409, message: 'register a security card first' });
+      const { challenge } = await store.createChallenge({ purpose: 'authenticate', builderId: req.builder.id });
+      const options = await lib().generateAuthenticationOptions({
+        rpID: rp.rpID,
+        challenge: Buffer.from(challenge, 'base64url'),
+        allowCredentials: cards.map((c) => ({ id: c.credential_id, transports: c.transports })),
+        userVerification: 'required',
+      });
+      res.json({ options });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'authenticate/options failed');
+      res.fail('options_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /api/bongos/me/passkeys/authenticate/verify — finish a card check.
+  // Body: { response } the browser's assertion. On success the CALLER'S session row
+  // is stamped; that stamp (never anything the client sends) is the step-up proof.
+  // rank: any-builder (own identity only).
+  router.post('/me/passkeys/authenticate/verify', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { response: {} })) return;
+    const response = req.body && req.body.response;
+    if (!response || typeof response !== 'object' || typeof response.id !== 'string') {
+      return res.fail('bad_response', { status: 400, message: 'response is required' });
+    }
+    const refuse = () => res.fail('verification_failed', { status: 400, message: 'the card could not be verified' });
+    try {
+      const rp = relyingParty(req);
+      if (!rp) return res.fail('passkeys_not_configured', { status: 503, message: 'security cards are not configured on this site yet' });
+      const sessionId = req.gdsSession && req.gdsSession.session_id;
+      if (sessionId === undefined || sessionId === null) return res.fail('unauthenticated', 401);
+      const cred = await store.getCredentialById(response.id);
+      // One answer whether the card is unknown or somebody else's.
+      if (!cred || String(cred.builder_id) !== String(req.builder.id)) return refuse();
+      let verification;
+      try {
+        verification = await lib().verifyAuthenticationResponse({
+          response,
+          expectedChallenge: async (c) => !!(await store.consumeChallenge(c, { expectPurpose: 'authenticate', expectBuilderId: req.builder.id })),
+          expectedOrigin: rp.origin,
+          expectedRPID: rp.rpID,
+          credential: { id: cred.credential_id, publicKey: new Uint8Array(cred.public_key), counter: Number(cred.sign_count), transports: cred.transports || [] },
+          requireUserVerification: true,
+        });
+      } catch (err) {
+        log.info({ err: err && err.message }, 'authenticate/verify refused');
+        return refuse();
+      }
+      if (!verification.verified || !verification.authenticationInfo) return refuse();
+      const use = await store.recordUse(cred.credential_id, verification.authenticationInfo.newCounter);
+      if (!use.ok) {
+        log.warn({ reason: use.reason, builder_id: String(req.builder.id) }, 'card counter did not advance: possible clone');
+        return refuse();
+      }
+      if (!(await store.markSessionCardVerified(sessionId, req.builder.id))) return refuse();
+      res.json({ ok: true, valid_for_seconds: store.STEP_UP_WINDOW_SECONDS });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'authenticate/verify failed');
+      res.fail('authenticate_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // POST /api/bongos/me/passkeys/rename — Body: { credential_id, nickname }.
   // rank: any-builder (own identity only) — the WHERE clause is the boundary.
   router.post('/me/passkeys/rename', requireBuilder, async (req, res) => {

package/src/bongos/routes/payout-approvals.js

@@ -59,13 +59,15 @@ module.exports = function buildPayoutApprovalsRouter({
   store = require('../payout-approvals'),
   gates = require('../payout-gates'),
   payouts = builderPayouts,
-  // The processor adapter (ADR 0397: the only code that may name the rail) does not exist
-  // yet, so nothing is sent: every builder payout is recorded as owed and held.
+  // The processor adapter (ADR 0397: the only code that may name the rail) is the optional
+  // `economy.processor` port; with none registered nothing is sent and every payout is held.
   processor = null,
   requireBuilder = auth.requireBuilder,
   requirePermission = auth.requirePermission,
 } = {}) {
   const router = express.Router();
+  // the processor adapter (modules/economy/processor-stripe.js, task 1005040) is a port, resolved per call
+  const proc = () => processor || require('../../module-seams').resolveOptional('economy.processor');
 
   function personal(req, res) {
     const p = store.personalSession(req);
@@ -338,7 +340,7 @@ module.exports = function buildPayoutApprovalsRouter({
     if (validateOrRespond(req, res, { approval_id: { required: true }, task_id: { required: true } })) return;
     const body = req.body || {};
     try {
-      const out = await payouts.payForTask({ approvalId: body.approval_id, taskId: body.task_id, actorId: actor.id }, { processor });
+      const out = await payouts.payForTask({ approvalId: body.approval_id, taskId: body.task_id, actorId: actor.id }, { processor: proc() });
       res.set('Cache-Control', 'no-store');
       res.json(out);
     } catch (err) {

package/src/bongos/step-up.js

@@ -0,0 +1,42 @@
+// src/bongos/step-up.js — the card step-up gate (task 1004747, ADR 0382 D2/D5).
+//
+// requireCardStepUp is mounted AFTER requireBuilder (and after any rank/permission
+// gate) on the routes where a stolen session does the most damage. A builder an
+// Archon has NOT switched the requirement on for passes straight through, so landing
+// this changes nothing for anybody. For a builder with the requirement on, the
+// request is refused 403 `card_required` unless THIS session passed a card check in
+// the last 10 minutes — a timestamp on the server-side session row, set only by
+// POST /me/passkeys/authenticate/verify.
+//
+// It fails CLOSED: if the state cannot be read, the request is refused. The flag and
+// the timestamp are read from the DB per request, never from the token or the client.
+'use strict';
+
+const passkeys = require('./passkeys');
+const log = require('./logger').logger.child({ src: 'step-up' });
+
+const CARD_REQUIRED = Object.freeze({
+  status: 403,
+  message: 'This action needs your hardware card. Tap it on the card page, then try again.',
+});
+
+function buildRequireCardStepUp({ store = passkeys } = {}) {
+  return async function requireCardStepUp(req, res, next) {
+    try {
+      const sessionId = req.gdsSession && req.gdsSession.session_id;
+      const builderId = req.builder && req.builder.id;
+      if (sessionId === undefined || sessionId === null || builderId === undefined || builderId === null) {
+        return res.fail('unauthenticated', 401);
+      }
+      const st = await store.stepUpStatus(sessionId, builderId);
+      if (!st) return res.fail('card_required', CARD_REQUIRED);
+      if (!st.required || st.fresh) return next();
+      return res.fail('card_required', CARD_REQUIRED);
+    } catch (err) {
+      log.error({ err: err && err.message }, 'step-up check failed; refusing');
+      return res.fail('card_check_failed', { status: 503, message: 'could not check your hardware card; try again' });
+    }
+  };
+}
+
+module.exports = { requireCardStepUp: buildRequireCardStepUp(), buildRequireCardStepUp };

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.96'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -157,6 +157,10 @@ module.exports = {
   //     sitting, one builder acting alone is refused (409 decided_by_sitting,
   //     pointing at the matter route). No government module → as today.
   get requireActAlone() { return require('./bongos/act-alone').requireActAlone; },
+  // requireCardStepUp — the hardware-card step-up gate (task 1004747; ADR 0382 D2/D5),
+  //     mounted AFTER the route's permission gate. A builder with no card requirement
+  //     passes untouched; one with it on needs a card tap in the last 10 minutes.
+  get requireCardStepUp() { return require('./bongos/step-up').requireCardStepUp; },
   get rankMeetsThreshold() { return require('./bongos/auth').rankMeetsThreshold; },
   get requireBfgPrincipal() { return require('./bongos/auth').requireBfgPrincipal; },
   // allowBoxScope — DEPRECATED no-op, kept so the doorway loses no export inside

package/tests/government_act_alone_buildings.mjs

@@ -197,7 +197,8 @@ test('the source → the record: every mounted gate is listed under the building
 
 // ── 3. every building, through its real router ──────────────────────────────
 
-const fakeBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon', github_login: 'someone' }; next(); };
+const fakeBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon', github_login: 'someone' }; req.gdsSession = { session_id: '1' }; next(); };
+require('../src/bongos/passkeys').stepUpStatus = async () => ({ required: false, fresh: false }); // task 1004747: no DB in this test
 const realApiRequireBuilder = api.requireBuilder;
 const realAuthRequireBuilder = authMod.requireBuilder;
 api.requireBuilder = fakeBuilder;

package/tests/government_treasury.mjs

@@ -288,7 +288,8 @@ const realArchons = db.listActiveArchons;
 let caller = 3;
 let held = ['board.vote.cast'];
 let leads = [];
-api.requireBuilder = (req, res, next) => { req.builder = { id: caller, rank: caller === 3 ? 'archon' : 'metic' }; next(); };
+api.requireBuilder = (req, res, next) => { req.builder = { id: caller, rank: caller === 3 ? 'archon' : 'metic' }; req.gdsSession = { session_id: '1' }; next(); };
+require('../src/bongos/passkeys').stepUpStatus = async () => ({ required: false, fresh: false }); // task 1004747: no DB in this test
 resolver.resolveBuilderPermissions = async () => held;
 db.listLeads = async () => leads;
 db.listActiveArchons = async () => [{ id: '3', github_login: 'ada', display_name: 'Ada' }];

package/tests/module_api.mjs

@@ -23,6 +23,7 @@ const PUBLISHED_SURFACE = [
   'escapeHtml', // task 1004876: THE server-side HTML escaper (1.22.0) — modules render user text through it, never a private copy
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
+  'requireCardStepUp', // added by task 1004747 (ADR 0382): the hardware-card step-up gate a module mounts after its permission gate
   'requireActAlone', // added by task 1004657 (ADR 0363 D5): a building's own page asks its decision-rules row before one builder acts alone. On the doorway because eight buildings' pages live in six modules and core, and each must refuse the same way People does
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   // added by task 1003575 (ADR 0241 §3): the instance's PROJECT OWNER — its first

package/tests/my_passkeys.mjs

@@ -14,7 +14,12 @@ const build = require('../src/bongos/routes/my-passkeys');
 
 const creds = [];
 const consumed = [];
+const stamped = [];
+let counterOk = true;
 const store = {
+  STEP_UP_WINDOW_SECONDS: 600,
+  recordUse: async () => (counterOk ? { ok: true } : { ok: false, reason: 'sign_count_regressed' }),
+  markSessionCardVerified: async (sid, b) => { stamped.push([sid, b]); return true; },
   listCredentials: async (b) => creds.filter((c) => c.builder_id === b),
   getOrCreateUserHandle: async () => 'aGFuZGxl',
   createChallenge: async () => ({ challenge: 'Y2hhbGw' }),
@@ -26,6 +31,12 @@ const store = {
 };
 let verifyOk = true;
 const webauthn = {
+  generateAuthenticationOptions: async (o) => ({ rpId: o.rpID, allowCredentials: o.allowCredentials, userVerification: o.userVerification }),
+  verifyAuthenticationResponse: async (o) => {
+    assert.equal(o.requireUserVerification, true);
+    if (!(await o.expectedChallenge('Y2hhbGw'))) throw new Error('challenge');
+    return { verified: true, authenticationInfo: { newCounter: 5 } };
+  },
   generateRegistrationOptions: async (o) => ({ rp: { id: o.rpID }, excludeCredentials: o.excludeCredentials }),
   verifyRegistrationResponse: async (o) => {
     assert.equal(o.requireUserVerification, true);
@@ -37,7 +48,7 @@ const webauthn = {
 const app = express();
 app.use(express.json());
 app.use((req, res, next) => { res.fail = (code, { status = 400, message } = {}) => res.status(status).json({ error: code, message }); next(); });
-app.use((req, res, next) => { req.builder = { id: '7', github_login: 'me' }; next(); });
+app.use((req, res, next) => { req.builder = { id: '7', github_login: 'me' }; req.gdsSession = { session_id: '42' }; next(); });
 app.use('/', build({ store, webauthn, requireBuilder: (q, r, n) => n() }));
 const server = http.createServer(app).listen(0);
 const port = server.address().port;
@@ -104,5 +115,40 @@ r = await new Promise((resolve) => {
 });
 assert.equal(r.status, 503); ok('unconfigured non-local host refused');
 
+// --- card check (task 1004747) ---
+creds.length = 0;
+r = await call('POST', '/me/passkeys/authenticate/options', {});
+assert.equal(r.status, 409); ok('card check refused when no card is registered');
+creds.push({ credential_id: 'cardA', builder_id: '7', public_key: Buffer.from([1]), sign_count: 1, transports: ['nfc'] });
+creds.push({ credential_id: 'cardB', builder_id: '8', public_key: Buffer.from([1]), sign_count: 1, transports: [] });
+r = await call('POST', '/me/passkeys/authenticate/options', {});
+assert.equal(r.status, 200); assert.equal(r.body.options.userVerification, 'required');
+assert.deepEqual(r.body.options.allowCredentials.map((c) => c.id), ['cardA']); ok('authenticate options list only the caller cards');
+consumed.length = 0;
+r = await call('POST', '/me/passkeys/authenticate/verify', { response: { id: 'cardA' } });
+assert.equal(r.status, 200); assert.deepEqual(stamped[0], ['42', '7']);
+assert.equal(consumed[0][1].expectPurpose, 'authenticate'); assert.equal(consumed[0][1].expectBuilderId, '7'); ok('verify stamps the caller session with an authenticate-bound challenge');
+stamped.length = 0;
+r = await call('POST', '/me/passkeys/authenticate/verify', { response: { id: 'cardB' } });
+assert.equal(r.status, 400); assert.equal(stamped.length, 0); ok('another builder card stamps nothing');
+r = await call('POST', '/me/passkeys/authenticate/verify', { response: { id: 'nope' } });
+assert.equal(r.status, 400); assert.equal(stamped.length, 0); ok('unknown card stamps nothing');
+counterOk = false;
+r = await call('POST', '/me/passkeys/authenticate/verify', { response: { id: 'cardA' } });
+assert.equal(r.status, 400); assert.equal(stamped.length, 0); ok('a counter that did not advance stamps nothing');
+counterOk = true;
+
+// --- the gate itself ---
+const { buildRequireCardStepUp } = require('../src/bongos/step-up');
+const gate = (st) => buildRequireCardStepUp({ store: { stepUpStatus: async () => { if (st instanceof Error) throw st; return st; } } });
+const run = async (mw, req) => { let out = 'next'; const res = { fail: (c, o) => { out = typeof o === 'number' ? [c, o] : [c, o.status]; } }; await mw(req, res, () => {}); return out; };
+const sess = { gdsSession: { session_id: '1' }, builder: { id: '7' } };
+assert.equal(await run(gate({ required: false, fresh: false }), sess), 'next'); ok('gate: requirement off passes');
+assert.equal(await run(gate({ required: true, fresh: true }), sess), 'next'); ok('gate: fresh tap passes');
+assert.deepEqual(await run(gate({ required: true, fresh: false }), sess), ['card_required', 403]); ok('gate: required and stale refused');
+assert.deepEqual(await run(gate(null), sess), ['card_required', 403]); ok('gate: unknown session refused');
+assert.deepEqual(await run(gate(new Error('db down')), sess), ['card_check_failed', 503]); ok('gate: fails closed on error');
+assert.deepEqual(await run(gate({ required: false, fresh: false }), {}), ['unauthenticated', 401]); ok('gate: no session refused');
+
 server.close();
 console.log(`${n} passed`);

package/tests/rank_change_broadcast_port.mjs

@@ -32,12 +32,14 @@ for (const fn of ['execFile', 'spawn', 'exec', 'fork']) {
   cp[fn] = (...args) => { spawned.push([fn, args[0], args[1]]); throw new Error(`test: ${fn} must not be called`); };
 }
 
+require('../src/bongos/passkeys').stepUpStatus = async () => ({ required: false, fresh: false }); // task 1004747: the step-up gate reads the DB; these stubs have none
 const authPath = require.resolve('../src/bongos/auth.js');
 require.cache[authPath] = {
   id: authPath, filename: authPath, loaded: true,
   exports: {
     requireBuilder: (req, _res, next) => {
       req.builder = { id: '1', rank: 'archon', github_login: 'archon1', display_name: 'Archon One' };
+      req.gdsSession = { session_id: '1' };
       next();
     },
     requireRank: () => (_req, _res, next) => next(),