@celilo/e2e 0.9.2 → 0.10.0

package/registry-server/src/server.test.ts

@@ -3,6 +3,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { ADMIN_SCOPE, TokenAuth } from './auth';
+import { IntrospectionVerifier } from './introspection';
 import { createRateLimiter } from './rate-limit';
 import { startServer } from './server';
 
@@ -507,3 +508,264 @@ async function publish(
     body,
   });
 }
+
+// ── idp introspection verify-bridge (ce-s7e) ─────────────────────────────────
+// The real publish path with an idp identity token: the token is unknown to
+// the opaque set, so authorizePackage() verifies it via RFC 7662 introspection
+// against the idp. A fake idp server stands in for authentik; revoking a token
+// there (active:false) denies the next publish.
+
+describe('publish via idp introspection (ce-s7e)', () => {
+  let idp: ReturnType<typeof Bun.serve> | null = null;
+  let idpServer: ReturnType<typeof startServer> | null = null;
+  let idpDataDir: string;
+  let idpBaseUrl: string;
+  // token → introspection claims the fake idp reports for it.
+  const claimsByToken = new Map<string, Record<string, unknown>>();
+
+  beforeEach(() => {
+    claimsByToken.clear();
+    idp = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        const form = new URLSearchParams(await req.text());
+        const token = form.get('token') ?? '';
+        const claims = claimsByToken.get(token) ?? { active: false };
+        return Response.json(claims);
+      },
+    });
+    idpDataDir = mkdtempSync(join(tmpdir(), 'celilo-registry-idp-test-'));
+    idpServer = startServer({
+      dataDir: idpDataDir,
+      port: 0,
+      pathPrefix: '',
+      publicUrl: 'https://example.test',
+      // Opaque admin token still works → backward-compat coverage below.
+      auth: new TokenAuth([{ token: 'opaque-admin', scope: ADMIN_SCOPE }]),
+      introspection: new IntrospectionVerifier({
+        endpoint: `http://localhost:${idp.port}/introspect`,
+        clientId: 'celilo-registry',
+        clientSecret: 'sec',
+        adminGroup: 'celilo-admins',
+        publisherGroup: 'celilo-authors',
+      }),
+    });
+    idpBaseUrl = `http://localhost:${idpServer.port}`;
+  });
+
+  afterEach(() => {
+    idpServer?.stop();
+    idpServer = null;
+    idp?.stop();
+    idp = null;
+    rmSync(idpDataDir, { recursive: true, force: true });
+  });
+
+  function publishTo(token: string, name = 'homebridge', vers = '1.0.0+1'): Promise<Response> {
+    const meta = Buffer.from(JSON.stringify({ name, vers }), 'utf-8');
+    const file = Buffer.from('fake netapp bytes');
+    const metaLen = Buffer.alloc(4);
+    metaLen.writeUInt32LE(meta.length, 0);
+    const fileLen = Buffer.alloc(4);
+    fileLen.writeUInt32LE(file.length, 0);
+    const body = Buffer.concat([metaLen, meta, fileLen, file]);
+    return fetch(`${idpBaseUrl}/api/v1/modules/new`, {
+      method: 'PUT',
+      headers: { Authorization: `Bearer ${token}` },
+      body,
+    });
+  }
+
+  test('active idp token (admin group) authorizes publish', async () => {
+    claimsByToken.set('idp-tok', { active: true, sub: 'alice', groups: ['celilo-admins'] });
+    const res = await publishTo('idp-tok');
+    expect(res.status).toBe(200);
+  });
+
+  test('active idp token not in admin group → 401', async () => {
+    claimsByToken.set('idp-tok', { active: true, sub: 'bob', groups: ['users'] });
+    const res = await publishTo('idp-tok');
+    expect(res.status).toBe(401);
+  });
+
+  test('revoked-at-idp (active:false) → next publish denied 401', async () => {
+    claimsByToken.set('idp-tok', { active: true, groups: ['celilo-admins'] });
+    expect((await publishTo('idp-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    // Revoke at the idp — the token is now inactive.
+    claimsByToken.set('idp-tok', { active: false });
+    expect((await publishTo('idp-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
+  });
+
+  test('opaque publish token still works (backward compat)', async () => {
+    const res = await publishTo('opaque-admin');
+    // 'opaque-admin' is the raw token; it authorizes via the local set,
+    // never touching introspection.
+    expect(res.status).toBe(200);
+  });
+
+  test('idp down (introspection throws) → fails closed 401', async () => {
+    idp?.stop();
+    idp = null;
+    claimsByToken.set('idp-tok', { active: true, groups: ['celilo-admins'] });
+    const res = await publishTo('idp-tok');
+    expect(res.status).toBe(401);
+  });
+});
+
+// ── module-owner table: hybrid group + owner authorization (ce-1ch) ──────────
+// A verified idp publisher may publish only module names it owns. The first
+// verified publisher of an unclaimed name claims it (first-publish-claims);
+// another publisher is then DENIED (confused-deputy defense). Admins publish or
+// reassign anything.
+
+describe('module-owner authorization (ce-1ch)', () => {
+  let idp: ReturnType<typeof Bun.serve> | null = null;
+  let srv: ReturnType<typeof startServer> | null = null;
+  let dir: string;
+  let url: string;
+  const claimsByToken = new Map<string, Record<string, unknown>>();
+
+  beforeEach(() => {
+    claimsByToken.clear();
+    idp = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        const form = new URLSearchParams(await req.text());
+        const token = form.get('token') ?? '';
+        return Response.json(claimsByToken.get(token) ?? { active: false });
+      },
+    });
+    dir = mkdtempSync(join(tmpdir(), 'celilo-registry-owner-test-'));
+    srv = startServer({
+      dataDir: dir,
+      port: 0,
+      pathPrefix: '',
+      publicUrl: 'https://example.test',
+      auth: new TokenAuth([{ token: 'opaque-admin', scope: ADMIN_SCOPE }]),
+      introspection: new IntrospectionVerifier({
+        endpoint: `http://localhost:${idp.port}/introspect`,
+        clientId: 'celilo-registry',
+        clientSecret: 'sec',
+        adminGroup: 'celilo-admins',
+        publisherGroup: 'celilo-authors',
+      }),
+    });
+    url = `http://localhost:${srv.port}`;
+  });
+
+  afterEach(() => {
+    srv?.stop();
+    srv = null;
+    idp?.stop();
+    idp = null;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  function publish(token: string, name: string, vers: string): Promise<Response> {
+    const meta = Buffer.from(JSON.stringify({ name, vers }), 'utf-8');
+    const file = Buffer.from('fake netapp bytes');
+    const metaLen = Buffer.alloc(4);
+    metaLen.writeUInt32LE(meta.length, 0);
+    const fileLen = Buffer.alloc(4);
+    fileLen.writeUInt32LE(file.length, 0);
+    const body = Buffer.concat([metaLen, meta, fileLen, file]);
+    return fetch(`${url}/api/v1/modules/new`, {
+      method: 'PUT',
+      headers: { Authorization: `Bearer ${token}` },
+      body,
+    });
+  }
+
+  test('publisher claims an unclaimed name on first publish', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    // The owner endpoint (admin) now shows alice owns it.
+    const res = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
+      headers: { Authorization: 'Bearer opaque-admin' },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { owner: { ownerSub: string; sourceGroup: string } };
+    expect(body.owner.ownerSub).toBe('alice');
+    expect(body.owner.sourceGroup).toBe('celilo-authors');
+  });
+
+  test('owner may publish more versions of a name it owns', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+2')).status).toBe(200);
+  });
+
+  test('CONFUSED DEPUTY: a different publisher cannot publish someone else’s name', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    claimsByToken.set('bob-tok', { active: true, sub: 'bob', groups: ['celilo-authors'] });
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    // Bob is a valid publisher but does NOT own homebridge → denied.
+    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
+  });
+
+  test('an identity in neither publish group is denied even when verified', async () => {
+    claimsByToken.set('carol-tok', { active: true, sub: 'carol', groups: ['users'] });
+    expect((await publish('carol-tok', 'anything', '1.0.0+1')).status).toBe(401);
+  });
+
+  test('admin group may publish any name and claims it', async () => {
+    claimsByToken.set('admin-tok', { active: true, sub: 'ops', groups: ['celilo-admins'] });
+    expect((await publish('admin-tok', 'caddy', '1.0.0+1')).status).toBe(200);
+    const res = await fetch(`${url}/api/v1/modules/owners/caddy`, {
+      headers: { Authorization: 'Bearer opaque-admin' },
+    });
+    expect((await res.json() as { owner: { ownerSub: string } }).owner.ownerSub).toBe('ops');
+  });
+
+  test('admin reassign lets a new owner publish the name', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    claimsByToken.set('bob-tok', { active: true, sub: 'bob', groups: ['celilo-authors'] });
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    // Bob denied before reassignment.
+    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
+    // Admin reassigns homebridge to bob.
+    const reassign = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
+      method: 'POST',
+      headers: { Authorization: 'Bearer opaque-admin', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ownerSub: 'bob' }),
+    });
+    expect(reassign.status).toBe(200);
+    // Now bob may publish.
+    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(200);
+  });
+
+  test('owner list endpoint requires admin', async () => {
+    const anon = await fetch(`${url}/api/v1/modules/owners`);
+    expect(anon.status).toBe(401);
+    const ok = await fetch(`${url}/api/v1/modules/owners`, {
+      headers: { Authorization: 'Bearer opaque-admin' },
+    });
+    expect(ok.status).toBe(200);
+    expect((await ok.json() as { owners: unknown[] }).owners).toEqual([]);
+  });
+
+  test('owner reassign requires admin (a plain publisher cannot)', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    const res = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
+      method: 'POST',
+      headers: { Authorization: 'Bearer alice-tok', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ownerSub: 'alice' }),
+    });
+    expect(res.status).toBe(401);
+  });
+
+  test('owner show for an unclaimed name → 404', async () => {
+    const res = await fetch(`${url}/api/v1/modules/owners/never-claimed`, {
+      headers: { Authorization: 'Bearer opaque-admin' },
+    });
+    expect(res.status).toBe(404);
+  });
+
+  test('an idp admin token may drive the owner endpoints too', async () => {
+    claimsByToken.set('admin-tok', { active: true, sub: 'ops', groups: ['celilo-admins'] });
+    const res = await fetch(`${url}/api/v1/modules/owners`, {
+      headers: { Authorization: 'Bearer admin-tok' },
+    });
+    expect(res.status).toBe(200);
+  });
+});

package/registry-server/src/server.ts

@@ -20,7 +20,8 @@
  */
 
 import { join } from 'node:path';
-import { TokenAuth } from './auth';
+import { ADMIN_SCOPE, TokenAuth } from './auth';
+import { IntrospectionVerifier } from './introspection';
 import {
   type BootstrapEntry,
   bootstrapIndexEntry,
@@ -29,6 +30,7 @@ import {
   scanUploadsDir,
 } from './bootstrap';
 import { landingResponse } from './landing';
+import { ModuleOwnerStore, fileModuleOwnerPersistence } from './module-owner-store';
 import { type RateLimiter, clientIp, createRateLimiter } from './rate-limit';
 import { ScopedTokenStore, fileScopedTokenPersistence } from './scoped-token-store';
 import { type IndexEntry, RegistryStorage } from './storage';
@@ -76,14 +78,29 @@ interface ServerOptions {
    * loaded into `auth` at startup so minted tokens survive a restart.
    */
   scopedTokenStore?: ScopedTokenStore;
+  /**
+   * RFC 7662 introspection verifier for idp identity tokens (ce-s7e). When
+   * present, a publish token unknown to the opaque set is verified against the
+   * idp and mapped to a scope. When absent, only the opaque-token path applies.
+   */
+  introspection?: IntrospectionVerifier;
+  /**
+   * Module-owner table for the hybrid group + owner authorization (ce-1ch).
+   * Defaults to a JSON file in `dataDir`. Records first-publish-claims so a
+   * verified non-admin publisher may only publish modules it owns.
+   */
+  moduleOwnerStore?: ModuleOwnerStore;
 }
 
 export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve> {
-  const { dataDir, port, pathPrefix, publicUrl, auth } = options;
+  const { dataDir, port, pathPrefix, publicUrl, auth, introspection } = options;
   const storage = new RegistryStorage(dataDir);
   const scopedTokenStore =
     options.scopedTokenStore ??
     new ScopedTokenStore(fileScopedTokenPersistence(join(dataDir, 'scoped-tokens.json')));
+  const moduleOwnerStore =
+    options.moduleOwnerStore ??
+    new ModuleOwnerStore(fileModuleOwnerPersistence(join(dataDir, 'module-owners.json')));
   // Load persisted minted tokens into the in-memory authorizer.
   for (const entry of scopedTokenStore.list()) {
     auth.addHashed(entry.hash, entry.scope);
@@ -134,16 +151,76 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
     return err('Unauthorized — provide a valid publish token in the Authorization header', 401);
   }
 
-  /** True when the request's token may publish/yank `pkg` (admin or exact scope). */
-  function authorizePackage(req: Request, pkg: string): boolean {
-    return auth.authorize(req.headers.get('Authorization') ?? '', pkg);
+  /**
+   * True when the request's token may publish/yank `pkg`. Layered:
+   *   1. **Opaque publish token** (build-bus Phase 3): a locally-known token
+   *      authorizes synchronously by admin/exact scope.
+   *   2. **idp identity token** (ce-s7e verify-bridge + ce-1ch owner table): a
+   *      token unknown to the opaque set is verified via RFC 7662 introspection
+   *      to a {@link VerifiedIdentity}, then gated by the hybrid group + owner
+   *      rule (see {@link authorizeIdentity}). Fails CLOSED (deny) on any error.
+   */
+  async function authorizePackage(req: Request, pkg: string): Promise<boolean> {
+    const header = req.headers.get('Authorization') ?? '';
+    if (auth.authorize(header, pkg)) return true;
+    if (!introspection) return false;
+    const identity = await introspection.identify(header);
+    if (!identity) return false;
+    return authorizeIdentity(identity, pkg);
   }
 
-  /** True when the request carries an admin (`*`-scoped) token — required to mint. */
+  /**
+   * Hybrid group + owner-table decision for a verified identity (ce-1ch, D-C):
+   *   - **admin group** → publish anything; first publish of an unclaimed name
+   *     records ownership (so a subsequent non-admin owner check has an anchor).
+   *   - **publisher group** → unclaimed name: claim it + allow; owned by this
+   *     `sub`: allow; owned by someone else: **DENY** (confused-deputy defense).
+   *   - anything else → deny.
+   */
+  function authorizeIdentity(
+    identity: { sub?: string; isAdmin: boolean; isPublisher: boolean; group?: string },
+    pkg: string,
+  ): boolean {
+    const owner = moduleOwnerStore.get(pkg);
+    if (identity.isAdmin) {
+      // Admins publish anything; claim an unclaimed name only when we have a
+      // sub to attribute it to (an admin token without a sub still publishes).
+      if (!owner && identity.sub) {
+        moduleOwnerStore.claim(pkg, identity.sub, identity.group ?? ADMIN_SCOPE);
+      }
+      return true;
+    }
+    if (identity.isPublisher) {
+      // Ownership can't be attributed without a stable subject → deny.
+      if (!identity.sub) return false;
+      if (!owner) {
+        moduleOwnerStore.claim(pkg, identity.sub, identity.group ?? '');
+        return true;
+      }
+      return owner.ownerSub === identity.sub;
+    }
+    return false;
+  }
+
+  /** True when the request carries an admin (`*`-scoped) opaque token. */
   function authorizeAdmin(req: Request): boolean {
     return auth.isAdmin(req.headers.get('Authorization') ?? '');
   }
 
+  /**
+   * True when the request is admin — via an opaque `*`-scoped token OR a
+   * verified idp identity in the admin group (ce-1ch). Used to gate the
+   * owner-table management endpoints; the CLI drives these with the opaque
+   * admin token, but an operator's idp admin token works too.
+   */
+  async function authorizeAdminReq(req: Request): Promise<boolean> {
+    const header = req.headers.get('Authorization') ?? '';
+    if (auth.isAdmin(header)) return true;
+    if (!introspection) return false;
+    const identity = await introspection.identify(header);
+    return identity?.isAdmin ?? false;
+  }
+
   /**
    * Rate-limit check for write endpoints. Returns a 429 response when
    * exceeded (with Retry-After), null when allowed.
@@ -242,7 +319,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
 
     // Scope check AFTER the name is known: a package-scoped token may publish
     // only its own package; an admin token publishes anything (ISS-0140).
-    if (!authorizePackage(req, name)) return unauthorized();
+    if (!(await authorizePackage(req, name))) return unauthorized();
 
     const fileOffset = 4 + metaLen;
     const fileLen = buf.readUInt32LE(fileOffset);
@@ -322,6 +399,38 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
     return Response.json({ ok: true, repo, revoked: removed.length });
   }
 
+  /** List the whole module-owner table (ce-1ch). Admin-only. */
+  async function handleOwnerList(req: Request): Promise<Response> {
+    if (!(await authorizeAdminReq(req))) return unauthorized();
+    return Response.json({ owners: moduleOwnerStore.list() });
+  }
+
+  /** Show the owner of one module name (ce-1ch). Admin-only. */
+  async function handleOwnerShow(req: Request, name: string): Promise<Response> {
+    if (!(await authorizeAdminReq(req))) return unauthorized();
+    if (!isValidName(name)) return err('Invalid module name');
+    const owner = moduleOwnerStore.get(name);
+    if (!owner) return notFound();
+    return Response.json({ owner });
+  }
+
+  /** Reassign ownership of a module name to a new subject (ce-1ch). Admin-only. */
+  async function handleOwnerSet(req: Request, name: string): Promise<Response> {
+    if (!(await authorizeAdminReq(req))) return unauthorized();
+    if (!isValidName(name)) return err('Invalid module name');
+    let body: { ownerSub?: unknown };
+    try {
+      body = (await req.json()) as { ownerSub?: unknown };
+    } catch {
+      return err('Invalid JSON body');
+    }
+    const ownerSub = typeof body.ownerSub === 'string' ? body.ownerSub.trim() : '';
+    if (!ownerSub) return err('ownerSub is required');
+    const owner = moduleOwnerStore.reassign(name, ownerSub, 'admin-reassign');
+    console.log(`[registry] reassigned owner of ${name} → ${ownerSub}`);
+    return Response.json({ ok: true, owner });
+  }
+
   const server = Bun.serve({
     port,
     async fetch(req, srv) {
@@ -442,6 +551,22 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
         return handleRevokeToken(req);
       }
 
+      // Module-owner table management (admin-only — ce-1ch). Matched before the
+      // generic `${apiBase}/{name}` handlers so a name of "owners" can't shadow
+      // them.
+      if (method === 'GET' && suffix === `${apiBase}/owners`) {
+        return handleOwnerList(req);
+      }
+      if (suffix.startsWith(`${apiBase}/owners/`)) {
+        const name = decodeURIComponent(suffix.slice(`${apiBase}/owners/`.length));
+        if (method === 'GET') return handleOwnerShow(req, name);
+        if (method === 'POST') {
+          const rl = rateLimitOrNull(req, srv);
+          if (rl) return rl;
+          return handleOwnerSet(req, name);
+        }
+      }
+
       if (suffix.startsWith(`${apiBase}/`)) {
         const modulePath = suffix.slice(apiBase.length + 1);
         // URL-decode path segments — module versions use a literal '+' to
@@ -508,7 +633,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
           if (rl) return rl;
           const [name, version] = parts;
           if (!isValidName(name) || !isValidVersion(version)) return notFound();
-          if (!authorizePackage(req, name)) return unauthorized();
+          if (!(await authorizePackage(req, name))) return unauthorized();
           return setYanked(name, version, true);
         }
 
@@ -518,7 +643,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
           if (rl) return rl;
           const [name, version] = parts;
           if (!isValidName(name) || !isValidVersion(version)) return notFound();
-          if (!authorizePackage(req, name)) return unauthorized();
+          if (!(await authorizePackage(req, name))) return unauthorized();
           return setYanked(name, version, false);
         }
       }
@@ -541,6 +666,7 @@ export function startFromEnv(): void {
   const bootstrapUploadsDir = process.env.BOOTSTRAP_UPLOADS_DIR || undefined;
   const bootstrapCacheDir = process.env.BOOTSTRAP_CACHE_DIR || undefined;
   const auth = TokenAuth.fromEnv();
+  const introspection = IntrospectionVerifier.fromEnv();
 
   const server = startServer({
     dataDir,
@@ -551,6 +677,7 @@ export function startFromEnv(): void {
     bootstrapUploadsDir,
     bootstrapCacheDir,
     auth,
+    introspection,
   });
 
   const bootstrapBits = [
@@ -562,7 +689,9 @@ export function startFromEnv(): void {
   console.log(
     `[registry] listening on :${server.port} (prefix=${pathPrefix || '(none)'}, publicUrl=${publicUrl}${
       bootstrapBits ? `, bootstrap=[${bootstrapBits}]` : ''
-    }, auth=${auth.hasTokens() ? 'enabled' : 'disabled (publish will always 401)'})`,
+    }, auth=${auth.hasTokens() ? 'enabled' : 'disabled (publish will always 401)'}, introspection=${
+      introspection ? 'enabled' : 'disabled'
+    })`,
   );
 }