@celilo/e2e 0.20.0 → 0.20.2

package/registry-server/src/introspection.test.ts

@@ -1,243 +0,0 @@
-import { afterEach, describe, expect, test } from 'bun:test';
-import { ADMIN_SCOPE } from './auth';
-import { IntrospectionVerifier, claimToScope, introspectionConfigFromEnv } from './introspection';
-
-const CONFIG = {
-  endpoint: 'https://idp.test/application/o/introspect/',
-  clientId: 'celilo-registry',
-  clientSecret: 'super-secret',
-  adminGroup: 'celilo-admins',
-  publisherGroup: 'celilo-authors',
-};
-
-/** Replace global fetch with a stub returning `body` at `status`; restore after. */
-function stubFetch(handler: (url: string, init: RequestInit) => Response): void {
-  // @ts-expect-error - overriding the global for the duration of a test
-  globalThis.fetch = async (url: string | URL | Request, init?: RequestInit) =>
-    handler(String(url), init ?? {});
-}
-
-const realFetch = globalThis.fetch;
-afterEach(() => {
-  globalThis.fetch = realFetch;
-});
-
-function introspectResponse(payload: unknown, status = 200): Response {
-  return new Response(JSON.stringify(payload), {
-    status,
-    headers: { 'Content-Type': 'application/json' },
-  });
-}
-
-describe('claimToScope', () => {
-  test('admin-group member → ADMIN_SCOPE', () => {
-    expect(claimToScope({ active: true, groups: ['celilo-admins'] }, 'celilo-admins')).toBe(
-      ADMIN_SCOPE,
-    );
-  });
-
-  test('non-admin identity → null (owner table is ce-1ch)', () => {
-    expect(claimToScope({ active: true, groups: ['users'] }, 'celilo-admins')).toBeNull();
-    expect(claimToScope({ active: true }, 'celilo-admins')).toBeNull();
-  });
-});
-
-describe('introspectionConfigFromEnv', () => {
-  const KEYS = [
-    'OIDC_INTROSPECTION_ENDPOINT',
-    'OIDC_CLIENT_ID',
-    'OIDC_CLIENT_SECRET',
-    'REGISTRY_ADMIN_GROUP',
-    'REGISTRY_PUBLISHER_GROUP',
-  ];
-  afterEach(() => {
-    for (const k of KEYS) delete process.env[k];
-  });
-
-  test('null when any required var is missing', () => {
-    expect(introspectionConfigFromEnv()).toBeNull();
-    process.env.OIDC_INTROSPECTION_ENDPOINT = 'https://idp.test/introspect/';
-    process.env.OIDC_CLIENT_ID = 'cid';
-    // secret still missing
-    expect(introspectionConfigFromEnv()).toBeNull();
-  });
-
-  test('config when all required vars present; admin group defaults', () => {
-    process.env.OIDC_INTROSPECTION_ENDPOINT = 'https://idp.test/introspect/';
-    process.env.OIDC_CLIENT_ID = 'cid';
-    process.env.OIDC_CLIENT_SECRET = 'sec';
-    expect(introspectionConfigFromEnv()).toEqual({
-      endpoint: 'https://idp.test/introspect/',
-      clientId: 'cid',
-      clientSecret: 'sec',
-      adminGroup: 'celilo-admins',
-      publisherGroup: 'celilo-authors',
-    });
-    process.env.REGISTRY_ADMIN_GROUP = 'ops';
-    expect(introspectionConfigFromEnv()?.adminGroup).toBe('ops');
-    process.env.REGISTRY_PUBLISHER_GROUP = 'authors';
-    expect(introspectionConfigFromEnv()?.publisherGroup).toBe('authors');
-  });
-});
-
-describe('IntrospectionVerifier.scopeOf', () => {
-  const verifier = new IntrospectionVerifier(CONFIG);
-
-  test('active admin-group token → ADMIN_SCOPE', async () => {
-    stubFetch(() => introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'] }));
-    expect(await verifier.scopeOf('Bearer idp-token')).toBe(ADMIN_SCOPE);
-  });
-
-  test('active non-admin token → null', async () => {
-    stubFetch(() => introspectResponse({ active: true, sub: 'bob', groups: ['users'] }));
-    expect(await verifier.scopeOf('idp-token')).toBeNull();
-  });
-
-  test('active:false → null (revoked at idp)', async () => {
-    stubFetch(() => introspectResponse({ active: false }));
-    expect(await verifier.scopeOf('idp-token')).toBeNull();
-  });
-
-  test('expired exp → null even if active', async () => {
-    const pastSec = Math.floor(Date.now() / 1000) - 60;
-    stubFetch(() => introspectResponse({ active: true, groups: ['celilo-admins'], exp: pastSec }));
-    expect(await verifier.scopeOf('idp-token')).toBeNull();
-  });
-
-  test('future exp → honored', async () => {
-    const futureSec = Math.floor(Date.now() / 1000) + 3600;
-    stubFetch(() =>
-      introspectResponse({ active: true, groups: ['celilo-admins'], exp: futureSec }),
-    );
-    expect(await verifier.scopeOf('idp-token')).toBe(ADMIN_SCOPE);
-  });
-
-  test('non-2xx response → null (fail closed)', async () => {
-    stubFetch(() => introspectResponse({ error: 'boom' }, 500));
-    expect(await verifier.scopeOf('idp-token')).toBeNull();
-  });
-
-  test('fetch throws → null (fail closed)', async () => {
-    stubFetch(() => {
-      throw new Error('connection refused');
-    });
-    expect(await verifier.scopeOf('idp-token')).toBeNull();
-  });
-
-  test('malformed body (no active field) → null', async () => {
-    stubFetch(() => introspectResponse({ sub: 'alice' }));
-    expect(await verifier.scopeOf('idp-token')).toBeNull();
-  });
-
-  test('empty header → null without calling the idp', async () => {
-    let called = false;
-    stubFetch(() => {
-      called = true;
-      return introspectResponse({ active: true, groups: ['celilo-admins'] });
-    });
-    expect(await verifier.scopeOf('')).toBeNull();
-    expect(called).toBe(false);
-  });
-
-  test('authenticates with HTTP Basic client creds; sends the token in the body', async () => {
-    let seenAuth = '';
-    let seenBody = '';
-    stubFetch((_url, init) => {
-      seenAuth = new Headers(init.headers).get('Authorization') ?? '';
-      seenBody = String(init.body ?? '');
-      return introspectResponse({ active: true, groups: ['celilo-admins'] });
-    });
-    await verifier.scopeOf('Bearer the-token');
-    const expected = `Basic ${Buffer.from('celilo-registry:super-secret').toString('base64')}`;
-    expect(seenAuth).toBe(expected);
-    expect(seenBody).toContain('token=the-token');
-  });
-
-  test('does not log the token or client secret on failure', async () => {
-    const logs: string[] = [];
-    const realErr = console.error;
-    console.error = (...args: unknown[]) => {
-      logs.push(args.map(String).join(' '));
-    };
-    try {
-      stubFetch(() => {
-        throw new Error('boom');
-      });
-      await verifier.scopeOf('Bearer top-secret-token');
-    } finally {
-      console.error = realErr;
-    }
-    const joined = logs.join('\n');
-    expect(joined).not.toContain('top-secret-token');
-    expect(joined).not.toContain('super-secret');
-  });
-});
-
-describe('IntrospectionVerifier.identify (ce-1ch)', () => {
-  const verifier = new IntrospectionVerifier(CONFIG);
-
-  test('admin-group member → isAdmin, group=adminGroup', async () => {
-    stubFetch(() => introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'] }));
-    expect(await verifier.identify('Bearer t')).toEqual({
-      sub: 'alice',
-      isAdmin: true,
-      isPublisher: false,
-      group: 'celilo-admins',
-    });
-  });
-
-  test('publisher-group member → isPublisher, group=publisherGroup', async () => {
-    stubFetch(() => introspectResponse({ active: true, sub: 'bob', groups: ['celilo-authors'] }));
-    expect(await verifier.identify('Bearer t')).toEqual({
-      sub: 'bob',
-      isAdmin: false,
-      isPublisher: true,
-      group: 'celilo-authors',
-    });
-  });
-
-  test('member of neither publish group → verified but no group', async () => {
-    stubFetch(() => introspectResponse({ active: true, sub: 'carol', groups: ['users'] }));
-    expect(await verifier.identify('Bearer t')).toEqual({
-      sub: 'carol',
-      isAdmin: false,
-      isPublisher: false,
-      group: undefined,
-    });
-  });
-
-  test('admin with no sub → identified (admins publish without an ownership anchor)', async () => {
-    stubFetch(() => introspectResponse({ active: true, groups: ['celilo-admins'] }));
-    expect(await verifier.identify('Bearer t')).toEqual({
-      sub: undefined,
-      isAdmin: true,
-      isPublisher: false,
-      group: 'celilo-admins',
-    });
-  });
-
-  test('active:false → null (fail closed)', async () => {
-    stubFetch(() => introspectResponse({ active: false }));
-    expect(await verifier.identify('Bearer t')).toBeNull();
-  });
-
-  test('expired exp → null even if active', async () => {
-    const pastSec = Math.floor(Date.now() / 1000) - 60;
-    stubFetch(() =>
-      introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'], exp: pastSec }),
-    );
-    expect(await verifier.identify('Bearer t')).toBeNull();
-  });
-
-  test('admin group is configurable, not a literal', async () => {
-    const custom = new IntrospectionVerifier({
-      ...CONFIG,
-      adminGroup: 'ops',
-      publisherGroup: 'devs',
-    });
-    stubFetch(() => introspectResponse({ active: true, sub: 'dan', groups: ['ops'] }));
-    const id = await custom.identify('Bearer t');
-    expect(id?.isAdmin).toBe(true);
-    expect(id?.group).toBe('ops');
-  });
-});

package/registry-server/src/module-owner-store.test.ts

@@ -1,85 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import {
-  type ModuleOwnerEntry,
-  type ModuleOwnerPersistence,
-  ModuleOwnerStore,
-} from './module-owner-store';
-
-/** In-memory persistence seam so the store is testable without the filesystem. */
-function memPersistence(initial: ModuleOwnerEntry[] = []): ModuleOwnerPersistence & {
-  saved: ModuleOwnerEntry[];
-} {
-  const state = { saved: [...initial] };
-  return {
-    saved: state.saved,
-    load: () => [...state.saved],
-    save(entries) {
-      state.saved.length = 0;
-      state.saved.push(...entries);
-    },
-  };
-}
-
-const fixedNow = () => '2026-01-01T00:00:00.000Z';
-
-describe('ModuleOwnerStore', () => {
-  test('claim records ownership of an unclaimed name', () => {
-    const p = memPersistence();
-    const store = new ModuleOwnerStore(p, fixedNow);
-    const entry = store.claim('homebridge', 'alice', 'celilo-authors');
-    expect(entry).toEqual({
-      moduleName: 'homebridge',
-      ownerSub: 'alice',
-      claimedAt: fixedNow(),
-      sourceGroup: 'celilo-authors',
-    });
-    expect(store.get('homebridge')?.ownerSub).toBe('alice');
-    expect(p.saved).toHaveLength(1);
-  });
-
-  test('claim never steals an already-owned name (returns existing)', () => {
-    const store = new ModuleOwnerStore(memPersistence(), fixedNow);
-    store.claim('homebridge', 'alice', 'celilo-authors');
-    const second = store.claim('homebridge', 'bob', 'celilo-authors');
-    expect(second.ownerSub).toBe('alice');
-    expect(store.get('homebridge')?.ownerSub).toBe('alice');
-  });
-
-  test('reassign overwrites an existing owner (admin path)', () => {
-    const store = new ModuleOwnerStore(memPersistence(), fixedNow);
-    store.claim('homebridge', 'alice', 'celilo-authors');
-    const reassigned = store.reassign('homebridge', 'bob', 'admin-reassign');
-    expect(reassigned.ownerSub).toBe('bob');
-    expect(store.get('homebridge')?.ownerSub).toBe('bob');
-    // No duplicate rows for the same name.
-    expect(store.list().filter((e) => e.moduleName === 'homebridge')).toHaveLength(1);
-  });
-
-  test('reassign creates a record when the name was unclaimed', () => {
-    const store = new ModuleOwnerStore(memPersistence(), fixedNow);
-    store.reassign('caddy', 'carol', 'admin-reassign');
-    expect(store.get('caddy')?.ownerSub).toBe('carol');
-  });
-
-  test('get returns undefined for an unclaimed name', () => {
-    const store = new ModuleOwnerStore(memPersistence(), fixedNow);
-    expect(store.get('nope')).toBeUndefined();
-  });
-
-  test('loads persisted entries on construction', () => {
-    const p = memPersistence([
-      { moduleName: 'caddy', ownerSub: 'dan', claimedAt: fixedNow(), sourceGroup: 'celilo-admins' },
-    ]);
-    const store = new ModuleOwnerStore(p, fixedNow);
-    expect(store.get('caddy')?.ownerSub).toBe('dan');
-    expect(store.list()).toHaveLength(1);
-  });
-
-  test('list returns a copy (mutating it does not affect the store)', () => {
-    const store = new ModuleOwnerStore(memPersistence(), fixedNow);
-    store.claim('a', 'x', 'g');
-    const list = store.list();
-    list.pop();
-    expect(store.list()).toHaveLength(1);
-  });
-});

package/registry-server/src/rate-limit.test.ts

@@ -1,62 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { clientIp, createRateLimiter } from './rate-limit';
-
-describe('createRateLimiter', () => {
-  test('allows up to max, then rejects', () => {
-    const limiter = createRateLimiter({ max: 3, windowMs: 60_000, now: () => 0 });
-    expect(limiter.take('1.1.1.1').ok).toBe(true);
-    expect(limiter.take('1.1.1.1').ok).toBe(true);
-    expect(limiter.take('1.1.1.1').ok).toBe(true);
-    const over = limiter.take('1.1.1.1');
-    expect(over.ok).toBe(false);
-    if (!over.ok) expect(over.retryAfterSec).toBeGreaterThan(0);
-  });
-
-  test('distinct IPs are tracked separately', () => {
-    const limiter = createRateLimiter({ max: 1, windowMs: 60_000, now: () => 0 });
-    expect(limiter.take('1.1.1.1').ok).toBe(true);
-    expect(limiter.take('2.2.2.2').ok).toBe(true); // different IP, fresh allowance
-    expect(limiter.take('1.1.1.1').ok).toBe(false);
-  });
-
-  test('bucket resets after window elapses', () => {
-    let t = 0;
-    const limiter = createRateLimiter({ max: 1, windowMs: 1000, now: () => t });
-    expect(limiter.take('1.1.1.1').ok).toBe(true);
-    expect(limiter.take('1.1.1.1').ok).toBe(false);
-    t = 1001;
-    expect(limiter.take('1.1.1.1').ok).toBe(true);
-  });
-
-  test('retryAfterSec reflects remaining window', () => {
-    const limiter = createRateLimiter({ max: 1, windowMs: 60_000, now: () => 0 });
-    limiter.take('1.1.1.1');
-    const r = limiter.take('1.1.1.1');
-    expect(r.ok).toBe(false);
-    if (!r.ok) {
-      expect(r.retryAfterSec).toBeLessThanOrEqual(60);
-      expect(r.retryAfterSec).toBeGreaterThan(0);
-    }
-  });
-});
-
-describe('clientIp', () => {
-  function req(headers: Record<string, string>): Request {
-    return new Request('http://x/', { headers });
-  }
-  const stubServer = {
-    requestIP: () => ({ address: '10.0.0.1' }),
-  };
-
-  test('uses X-Forwarded-For first entry when present', () => {
-    expect(clientIp(req({ 'x-forwarded-for': '1.1.1.1, 2.2.2.2' }), stubServer)).toBe('1.1.1.1');
-  });
-
-  test('falls back to Bun.Server.requestIP when XFF absent', () => {
-    expect(clientIp(req({}), stubServer)).toBe('10.0.0.1');
-  });
-
-  test('returns "unknown" when neither available', () => {
-    expect(clientIp(req({}), { requestIP: () => null })).toBe('unknown');
-  });
-});

package/registry-server/src/scoped-token-store.test.ts

@@ -1,93 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { hashToken } from './auth';
-import {
-  type ScopedTokenEntry,
-  type ScopedTokenPersistence,
-  ScopedTokenStore,
-} from './scoped-token-store';
-
-/** In-memory persistence so the store is testable without the filesystem. */
-function memoryPersistence(seed: ScopedTokenEntry[] = []): ScopedTokenPersistence & {
-  saved: ScopedTokenEntry[];
-} {
-  const state = { saved: [...seed] };
-  return {
-    saved: state.saved,
-    load() {
-      return [...state.saved];
-    },
-    save(entries) {
-      state.saved.length = 0;
-      state.saved.push(...entries);
-    },
-  };
-}
-
-/** Deterministic token generator (avoids randomness in assertions). */
-function seqGen() {
-  let n = 0;
-  return () => `tok-${++n}`;
-}
-
-describe('ScopedTokenStore.mint (ISS-0140)', () => {
-  test('mints a scoped token and persists only the hash', () => {
-    const p = memoryPersistence();
-    const store = new ScopedTokenStore(p, seqGen(), () => '2026-06-20T00:00:00Z');
-    const { token, entry, revokedHashes } = store.mint('celilo/lunacycle', 'lunacycle');
-
-    expect(token).toBe('tok-1');
-    expect(entry.scope).toBe('lunacycle');
-    expect(entry.repo).toBe('celilo/lunacycle');
-    expect(entry.hash).toBe(hashToken('tok-1'));
-    expect(revokedHashes).toEqual([]);
-    // Persisted form holds the hash, never the cleartext token.
-    expect(JSON.stringify(p.saved)).not.toContain('tok-1');
-    expect(p.saved).toHaveLength(1);
-  });
-
-  test('re-minting for the same repo rotates the token (reconcile)', () => {
-    const p = memoryPersistence();
-    const store = new ScopedTokenStore(p, seqGen(), () => 't');
-    const first = store.mint('celilo/lunacycle', 'lunacycle');
-    const second = store.mint('celilo/lunacycle', 'lunacycle');
-
-    expect(second.token).toBe('tok-2');
-    expect(second.revokedHashes).toEqual([first.entry.hash]);
-    // Still exactly one active token for the repo.
-    expect(store.list().filter((e) => e.repo === 'celilo/lunacycle')).toHaveLength(1);
-    expect(store.list()).toHaveLength(1);
-  });
-
-  test('different repos coexist independently', () => {
-    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
-    store.mint('celilo/lunacycle', 'lunacycle');
-    store.mint('celilo/caddy', 'caddy');
-    expect(store.list()).toHaveLength(2);
-  });
-});
-
-describe('ScopedTokenStore.revoke', () => {
-  test('removes all tokens for a repo and returns their hashes', () => {
-    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
-    const { entry } = store.mint('celilo/lunacycle', 'lunacycle');
-    const removed = store.revoke('celilo/lunacycle');
-    expect(removed).toEqual([entry.hash]);
-    expect(store.list()).toHaveLength(0);
-  });
-
-  test('revoking an unknown repo is a no-op', () => {
-    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
-    expect(store.revoke('celilo/nope')).toEqual([]);
-  });
-});
-
-describe('ScopedTokenStore startup load', () => {
-  test('loads persisted entries on construction', () => {
-    const seed: ScopedTokenEntry[] = [
-      { hash: hashToken('x'), scope: 'caddy', repo: 'celilo/caddy', mintedAt: 't' },
-    ];
-    const store = new ScopedTokenStore(memoryPersistence(seed), seqGen(), () => 't');
-    expect(store.list()).toHaveLength(1);
-    expect(store.list()[0]?.repo).toBe('celilo/caddy');
-  });
-});