@celilo/e2e 0.7.15 → 0.7.17

package/registry-server/src/scoped-token-store.ts

@@ -0,0 +1,110 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { hashToken } from './auth';
+
+/**
+ * Persisted store of minted, package-scoped publish tokens (build-bus Phase 3,
+ * ISS-0140). The `registry_publish` capability mints one token per registered
+ * repo, scoped to the single package that repo publishes — so a compromised
+ * runner can ship only its own module, never another.
+ *
+ * Only the token HASH is persisted (never cleartext) — the raw token is returned
+ * exactly once at mint time, for the caller to set as the repo's Forgejo Actions
+ * secret. At startup the server loads this store into its {@link TokenAuth} via
+ * `addHashed`; mint/revoke update both the in-memory auth and this file, so a
+ * minted token works without a server restart.
+ */
+
+export interface ScopedTokenEntry {
+  /** SHA-256 of the raw token. */
+  hash: string;
+  /** Package this token may publish. */
+  scope: string;
+  /** Repo path on the source forge this token was minted for (the reconcile key). */
+  repo: string;
+  /** ISO timestamp of mint. */
+  mintedAt: string;
+}
+
+export interface MintResult {
+  /** The raw token — returned ONCE; never persisted in cleartext. */
+  token: string;
+  entry: ScopedTokenEntry;
+  /** Hashes of tokens this mint superseded for the same repo (revoke them in auth). */
+  revokedHashes: string[];
+}
+
+/** I/O seam (Rule 2.3) so the store is unit-testable without the filesystem. */
+export interface ScopedTokenPersistence {
+  load(): ScopedTokenEntry[];
+  save(entries: ScopedTokenEntry[]): void;
+}
+
+/** File-backed persistence: a JSON array at `filePath`, tolerant of a missing file. */
+export function fileScopedTokenPersistence(filePath: string): ScopedTokenPersistence {
+  return {
+    load() {
+      if (!existsSync(filePath)) return [];
+      try {
+        const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+        return Array.isArray(parsed) ? (parsed as ScopedTokenEntry[]) : [];
+      } catch {
+        return [];
+      }
+    },
+    save(entries) {
+      mkdirSync(dirname(filePath), { recursive: true });
+      writeFileSync(filePath, JSON.stringify(entries, null, 2));
+    },
+  };
+}
+
+function defaultGenToken(): string {
+  return `cpt_${randomBytes(32).toString('base64url')}`;
+}
+
+export class ScopedTokenStore {
+  private entries: ScopedTokenEntry[];
+
+  constructor(
+    private readonly persistence: ScopedTokenPersistence,
+    private readonly genToken: () => string = defaultGenToken,
+    private readonly now: () => string = () => new Date().toISOString(),
+  ) {
+    this.entries = persistence.load();
+  }
+
+  list(): ScopedTokenEntry[] {
+    return [...this.entries];
+  }
+
+  /**
+   * Mint a fresh scoped token for `repo`, reconciling: any existing token for the
+   * same repo is superseded (its hash returned in `revokedHashes`). Idempotent at
+   * the repo level — re-running rotates the token cleanly.
+   */
+  mint(repo: string, scope: string): MintResult {
+    const revokedHashes = this.entries.filter((e) => e.repo === repo).map((e) => e.hash);
+    const token = this.genToken();
+    const entry: ScopedTokenEntry = {
+      hash: hashToken(token),
+      scope,
+      repo,
+      mintedAt: this.now(),
+    };
+    this.entries = [...this.entries.filter((e) => e.repo !== repo), entry];
+    this.persistence.save(this.entries);
+    return { token, entry, revokedHashes };
+  }
+
+  /** Revoke all tokens for `repo`. Returns the removed hashes. */
+  revoke(repo: string): string[] {
+    const removed = this.entries.filter((e) => e.repo === repo).map((e) => e.hash);
+    if (removed.length > 0) {
+      this.entries = this.entries.filter((e) => e.repo !== repo);
+      this.persistence.save(this.entries);
+    }
+    return removed;
+  }
+}

package/registry-server/src/server.test.ts

@@ -2,7 +2,7 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { TokenAuth } from './auth';
+import { ADMIN_SCOPE, TokenAuth } from './auth';
 import { createRateLimiter } from './rate-limit';
 import { startServer } from './server';
 
@@ -17,7 +17,7 @@ beforeEach(() => {
     port: 0, // let Bun pick an ephemeral port
     pathPrefix: '',
     publicUrl: 'https://example.test',
-    auth: new TokenAuth(['valid-token']),
+    auth: new TokenAuth([{ token: 'valid-token', scope: ADMIN_SCOPE }]),
   });
   baseUrl = `http://localhost:${server.port}`;
 });
@@ -107,9 +107,10 @@ describe('PUT /api/v1/modules/new', () => {
     const res = await publish('homebridge', '1.0.0+1', 'valid-token');
     expect(res.status).toBe(200);
 
-    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) =>
-      r.json(),
-    )) as { name: string; versions: { num: string }[] };
+    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) => r.json())) as {
+      name: string;
+      versions: { num: string }[];
+    };
     expect(meta.name).toBe('homebridge');
     expect(meta.versions).toHaveLength(1);
     expect(meta.versions[0].num).toBe('1.0.0+1');
@@ -258,9 +259,10 @@ describe('GET /api/v1/modules/{name} (metadata) — total_downloads', () => {
     await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
     await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
 
-    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) =>
-      r.json(),
-    )) as { name: string; total_downloads: number };
+    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) => r.json())) as {
+      name: string;
+      total_downloads: number;
+    };
     expect(meta.total_downloads).toBe(2);
   });
 });
@@ -344,7 +346,7 @@ describe('write endpoints are rate limited', () => {
       port: 0,
       pathPrefix: '',
       publicUrl: 'https://example.test',
-      auth: new TokenAuth(['tok']),
+      auth: new TokenAuth([{ token: 'tok', scope: ADMIN_SCOPE }]),
       rateLimiter: createRateLimiter({ max: 2, windowMs: 60_000 }),
     });
     try {
@@ -386,7 +388,7 @@ describe('path prefix routing', () => {
       port: 0,
       pathPrefix: '/registry',
       publicUrl: 'https://example.test/registry',
-      auth: new TokenAuth(['valid-token']),
+      auth: new TokenAuth([{ token: 'valid-token', scope: ADMIN_SCOPE }]),
     });
     try {
       const base = `http://localhost:${prefixed.port}`;
@@ -400,6 +402,86 @@ describe('path prefix routing', () => {
   });
 });
 
+// ── scoped publish tokens (ISS-0140) ──────────────────────────────────────────
+
+describe('POST /api/v1/modules/tokens/mint + scoped publish', () => {
+  async function mint(repo: string, scope: string, token: string): Promise<Response> {
+    return fetch(`${baseUrl}/api/v1/modules/tokens/mint`, {
+      method: 'POST',
+      headers: token ? { Authorization: token, 'Content-Type': 'application/json' } : {},
+      body: JSON.stringify({ repo, scope }),
+    });
+  }
+
+  test('admin token mints a scoped token; non-admin / no token is 401', async () => {
+    const noTok = await mint('celilo/lunacycle', 'lunacycle', '');
+    expect(noTok.status).toBe(401);
+
+    const ok = await mint('celilo/lunacycle', 'lunacycle', 'valid-token');
+    expect(ok.status).toBe(200);
+    const body = (await ok.json()) as { ok: boolean; token: string; scope: string };
+    expect(body.ok).toBe(true);
+    expect(body.scope).toBe('lunacycle');
+    expect(body.token.length).toBeGreaterThan(10);
+  });
+
+  test('a minted scoped token publishes ONLY its package', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+
+    // Can publish its own package…
+    const ok = await publish('lunacycle', '1.0.0+1', minted.token);
+    expect(ok.status).toBe(200);
+
+    // …but NOT another module.
+    const denied = await publish('caddy', '1.0.0+1', minted.token);
+    expect(denied.status).toBe(401);
+  });
+
+  test('a scoped token cannot mint (not admin)', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const reMint = await mint('celilo/caddy', 'caddy', minted.token);
+    expect(reMint.status).toBe(401);
+  });
+
+  test('re-minting rotates: the old token stops working, the new one publishes', async () => {
+    const first = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const second = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    expect(second.token).not.toBe(first.token);
+
+    const oldDenied = await publish('lunacycle', '2.0.0+1', first.token);
+    expect(oldDenied.status).toBe(401);
+    const newOk = await publish('lunacycle', '2.0.0+1', second.token);
+    expect(newOk.status).toBe(200);
+  });
+
+  test('revoke disables the token', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const revoke = await fetch(`${baseUrl}/api/v1/modules/tokens/revoke`, {
+      method: 'POST',
+      headers: { Authorization: 'valid-token', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ repo: 'celilo/lunacycle' }),
+    });
+    expect(revoke.status).toBe(200);
+    const denied = await publish('lunacycle', '1.0.0+1', minted.token);
+    expect(denied.status).toBe(401);
+  });
+
+  test('mint rejects an invalid scope (not a valid package name)', async () => {
+    const res = await mint('celilo/lunacycle', 'Bad_Scope', 'valid-token');
+    expect(res.status).toBe(400);
+  });
+});
+
 // ─── helpers ──────────────────────────────────────────────────────────────────
 
 async function publish(

package/registry-server/src/server.ts

@@ -19,19 +19,19 @@
  * can publish-then-import against a live registry.
  */
 
-import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { TokenAuth } from './auth';
-import { landingResponse } from './landing';
 import {
+  type BootstrapEntry,
   bootstrapIndexEntry,
   packageBootstrapModule,
   scanBootstrapDir,
   scanUploadsDir,
-  type BootstrapEntry,
 } from './bootstrap';
-import { clientIp, createRateLimiter, type RateLimiter } from './rate-limit';
-import { RegistryStorage, type IndexEntry } from './storage';
+import { landingResponse } from './landing';
+import { type RateLimiter, clientIp, createRateLimiter } from './rate-limit';
+import { ScopedTokenStore, fileScopedTokenPersistence } from './scoped-token-store';
+import { type IndexEntry, RegistryStorage } from './storage';
 import { isValidName, isValidVersion, validateNameAndVersion } from './validation';
 
 /** Max total publish body size. Real modules are a few MB; 100MB is generous. */
@@ -70,14 +70,26 @@ interface ServerOptions {
    * to slow a bad actor to a crawl.
    */
   rateLimiter?: RateLimiter;
+  /**
+   * Store of minted, per-repo package-scoped tokens (build-bus Phase 3,
+   * ISS-0140). Defaults to a JSON file in `dataDir`. Its persisted hashes are
+   * loaded into `auth` at startup so minted tokens survive a restart.
+   */
+  scopedTokenStore?: ScopedTokenStore;
 }
 
 export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve> {
   const { dataDir, port, pathPrefix, publicUrl, auth } = options;
   const storage = new RegistryStorage(dataDir);
+  const scopedTokenStore =
+    options.scopedTokenStore ??
+    new ScopedTokenStore(fileScopedTokenPersistence(join(dataDir, 'scoped-tokens.json')));
+  // Load persisted minted tokens into the in-memory authorizer.
+  for (const entry of scopedTokenStore.list()) {
+    auth.addHashed(entry.hash, entry.scope);
+  }
   const bootstrapCacheDir = options.bootstrapCacheDir ?? join(dataDir, '.bootstrap-cache');
-  const rateLimiter =
-    options.rateLimiter ?? createRateLimiter({ max: 30, windowMs: 60_000 });
+  const rateLimiter = options.rateLimiter ?? createRateLimiter({ max: 30, windowMs: 60_000 });
 
   /**
    * Rescan every request so .netapps dropped into bootstrapUploadsDir at
@@ -122,15 +134,24 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
     return err('Unauthorized — provide a valid publish token in the Authorization header', 401);
   }
 
-  function requireAuth(req: Request): boolean {
-    return auth.verify(req.headers.get('Authorization') ?? '');
+  /** True when the request's token may publish/yank `pkg` (admin or exact scope). */
+  function authorizePackage(req: Request, pkg: string): boolean {
+    return auth.authorize(req.headers.get('Authorization') ?? '', pkg);
+  }
+
+  /** True when the request carries an admin (`*`-scoped) token — required to mint. */
+  function authorizeAdmin(req: Request): boolean {
+    return auth.isAdmin(req.headers.get('Authorization') ?? '');
   }
 
   /**
    * Rate-limit check for write endpoints. Returns a 429 response when
    * exceeded (with Retry-After), null when allowed.
    */
-  function rateLimitOrNull(req: Request, srv: { requestIP(r: Request): { address: string } | null }): Response | null {
+  function rateLimitOrNull(
+    req: Request,
+    srv: { requestIP(r: Request): { address: string } | null },
+  ): Response | null {
     const ip = clientIp(req, srv);
     const result = rateLimiter.take(ip);
     if (result.ok) return null;
@@ -214,12 +235,15 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
     // celilo CLI reads manifest.yml#description and includes it). When
     // not provided we leave it undefined; the search endpoint falls
     // back to bootstrap data or empty.
-    const description =
-      typeof meta.description === 'string' ? meta.description : undefined;
+    const description = typeof meta.description === 'string' ? meta.description : undefined;
 
     const validation = validateNameAndVersion(name, vers);
     if (!validation.ok) return err(validation.message);
 
+    // Scope check AFTER the name is known: a package-scoped token may publish
+    // only its own package; an admin token publishes anything (ISS-0140).
+    if (!authorizePackage(req, name)) return unauthorized();
+
     const fileOffset = 4 + metaLen;
     const fileLen = buf.readUInt32LE(fileOffset);
     if (buf.length < fileOffset + 4 + fileLen) return err('Request body truncated (file)');
@@ -253,6 +277,51 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
     return Response.json({ ok: true });
   }
 
+  /**
+   * Mint a per-repo, package-scoped publish token (ISS-0140). Admin-only. The
+   * `registry_publish` capability calls this on behalf of `source_forge.
+   * registerRepo`. Reconciled: re-minting for the same repo rotates the token.
+   * The raw token is returned ONCE — the caller sets it as the repo's Actions
+   * secret; the server keeps only its hash.
+   */
+  async function handleMintToken(req: Request): Promise<Response> {
+    if (!authorizeAdmin(req)) return unauthorized();
+    let body: { repo?: unknown; scope?: unknown };
+    try {
+      body = (await req.json()) as { repo?: unknown; scope?: unknown };
+    } catch {
+      return err('Invalid JSON body');
+    }
+    const repo = typeof body.repo === 'string' ? body.repo.trim() : '';
+    const scope = typeof body.scope === 'string' ? body.scope.trim() : '';
+    if (!repo) return err('repo is required');
+    if (!scope || !isValidName(scope)) return err('scope must be a valid package name');
+
+    const { token, entry, revokedHashes } = scopedTokenStore.mint(repo, scope);
+    for (const h of revokedHashes) auth.removeHashed(h);
+    auth.addHashed(entry.hash, entry.scope);
+    console.log(`[registry] minted scoped token for ${repo} → ${scope}`);
+    return Response.json({ ok: true, token, scope, repo });
+  }
+
+  /** Revoke all scoped tokens for a repo (ISS-0140). Admin-only. */
+  async function handleRevokeToken(req: Request): Promise<Response> {
+    if (!authorizeAdmin(req)) return unauthorized();
+    let body: { repo?: unknown };
+    try {
+      body = (await req.json()) as { repo?: unknown };
+    } catch {
+      return err('Invalid JSON body');
+    }
+    const repo = typeof body.repo === 'string' ? body.repo.trim() : '';
+    if (!repo) return err('repo is required');
+
+    const removed = scopedTokenStore.revoke(repo);
+    for (const h of removed) auth.removeHashed(h);
+    console.log(`[registry] revoked ${removed.length} scoped token(s) for ${repo}`);
+    return Response.json({ ok: true, repo, revoked: removed.length });
+  }
+
   const server = Bun.serve({
     port,
     async fetch(req, srv) {
@@ -273,10 +342,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
       //   - suffix='/'       → request was prefix + '/', or just '/'
       //   - suffix='/index.html'
       // See apps/celilo/designs/REGISTRY_BROWSE_UI.md (decision D2).
-      if (
-        method === 'GET' &&
-        (suffix === '' || suffix === '/' || suffix === '/index.html')
-      ) {
+      if (method === 'GET' && (suffix === '' || suffix === '/' || suffix === '/index.html')) {
         return landingResponse(publicUrl);
       }
 
@@ -329,10 +395,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
           //   3. Empty string (older publishes that pre-date the
           //      description capture and haven't been republished).
           const bootstrapEntry = bootstrap.get(name);
-          const description =
-            latest?.description ??
-            bootstrapEntry?.description ??
-            '';
+          const description = latest?.description ?? bootstrapEntry?.description ?? '';
           return {
             name,
             max_version: latest?.vers ?? '0.0.0',
@@ -359,14 +422,26 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
       }
 
       // Publish — rate-limit before even checking auth so a bad-token flood
-      // can't crowd out legitimate traffic on the shared buckets.
+      // can't crowd out legitimate traffic on the shared buckets. The scope
+      // check happens inside handlePublish, once the package name is known.
       if (method === 'PUT' && suffix === `${apiBase}/new`) {
         const rl = rateLimitOrNull(req, srv);
         if (rl) return rl;
-        if (!requireAuth(req)) return unauthorized();
         return handlePublish(req);
       }
 
+      // Mint / revoke per-repo scoped publish tokens (admin-only — ISS-0140).
+      if (method === 'POST' && suffix === `${apiBase}/tokens/mint`) {
+        const rl = rateLimitOrNull(req, srv);
+        if (rl) return rl;
+        return handleMintToken(req);
+      }
+      if (method === 'POST' && suffix === `${apiBase}/tokens/revoke`) {
+        const rl = rateLimitOrNull(req, srv);
+        if (rl) return rl;
+        return handleRevokeToken(req);
+      }
+
       if (suffix.startsWith(`${apiBase}/`)) {
         const modulePath = suffix.slice(apiBase.length + 1);
         // URL-decode path segments — module versions use a literal '+' to
@@ -387,10 +462,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
           // endpoint — see notes there.
           const latest = entries.filter((v) => !v.yanked).at(-1) ?? entries.at(-1);
           const bootstrapEntry = resolveBootstrap().get(name);
-          const description =
-            latest?.description ??
-            bootstrapEntry?.description ??
-            '';
+          const description = latest?.description ?? bootstrapEntry?.description ?? '';
           return Response.json({
             name,
             description,
@@ -434,9 +506,9 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
         if (method === 'DELETE' && parts.length === 3 && parts[2] === 'yank') {
           const rl = rateLimitOrNull(req, srv);
           if (rl) return rl;
-          if (!requireAuth(req)) return unauthorized();
           const [name, version] = parts;
           if (!isValidName(name) || !isValidVersion(version)) return notFound();
+          if (!authorizePackage(req, name)) return unauthorized();
           return setYanked(name, version, true);
         }
 
@@ -444,9 +516,9 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
         if (method === 'PUT' && parts.length === 3 && parts[2] === 'unyank') {
           const rl = rateLimitOrNull(req, srv);
           if (rl) return rl;
-          if (!requireAuth(req)) return unauthorized();
           const [name, version] = parts;
           if (!isValidName(name) || !isValidVersion(version)) return notFound();
+          if (!authorizePackage(req, name)) return unauthorized();
           return setYanked(name, version, false);
         }
       }
@@ -464,8 +536,7 @@ export function startFromEnv(): void {
   const port = Number(process.env.PORT ?? 3000);
   const pathPrefix = (process.env.PATH_PREFIX ?? '').replace(/\/$/, '');
   const publicUrl =
-    process.env.PUBLIC_URL ??
-    `https://${process.env.DOMAIN ?? 'celilo.computer'}${pathPrefix}`;
+    process.env.PUBLIC_URL ?? `https://${process.env.DOMAIN ?? 'celilo.computer'}${pathPrefix}`;
   const bootstrapModulesDir = process.env.BOOTSTRAP_MODULES_DIR || undefined;
   const bootstrapUploadsDir = process.env.BOOTSTRAP_UPLOADS_DIR || undefined;
   const bootstrapCacheDir = process.env.BOOTSTRAP_CACHE_DIR || undefined;
@@ -485,7 +556,9 @@ export function startFromEnv(): void {
   const bootstrapBits = [
     bootstrapModulesDir ? `modulesDir=${bootstrapModulesDir}` : '',
     bootstrapUploadsDir ? `uploadsDir=${bootstrapUploadsDir}` : '',
-  ].filter(Boolean).join(', ');
+  ]
+    .filter(Boolean)
+    .join(', ');
   console.log(
     `[registry] listening on :${server.port} (prefix=${pathPrefix || '(none)'}, publicUrl=${publicUrl}${
       bootstrapBits ? `, bootstrap=[${bootstrapBits}]` : ''