@celilo/e2e 0.9.3 → 0.10.0

package/registry-server/src/auth.ts

@@ -0,0 +1,105 @@
+import { createHash } from 'node:crypto';
+
+/**
+ * Package-scoped token auth (build-bus Phase 3, ISS-0140).
+ *
+ * Each token carries a SCOPE — either a single package name (the token may
+ * publish only that module) or the admin scope `*` (publish anything + mint
+ * scoped tokens). Tokens are stored SHA-256 hashed; cleartext never lives in
+ * the auth set once the server starts.
+ *
+ *   PUBLISH_TOKENS env (newline-separated), per line:
+ *     <token>              → admin scope `*` (publish any package, mint tokens)
+ *     <token> <package>    → scoped to that one package
+ *
+ * A bare `<token>` line is the admin/bootstrap token — this preserves the
+ * pre-scoping behavior (any configured token publishes anything) AND is the
+ * privilege that the `registry_publish` capability uses to mint per-repo
+ * scoped tokens. Minted scoped tokens are added at runtime via {@link addHashed}
+ * (loaded from the persisted store) and removed via {@link removeHashed}.
+ */
+
+/** Admin scope: publish any package + mint scoped tokens. */
+export const ADMIN_SCOPE = '*';
+
+export interface TokenSpec {
+  token: string;
+  /** Package name, or {@link ADMIN_SCOPE}. */
+  scope: string;
+}
+
+/** SHA-256 of a token (trimmed). The persisted scoped-token store hashes too. */
+export function hashToken(token: string): string {
+  return createHash('sha256').update(token.trim()).digest('hex');
+}
+
+/** Strip an optional `Bearer ` prefix and surrounding whitespace from a header. */
+export function bearerToken(header: string): string {
+  return header.replace(/^Bearer\s+/i, '').trim();
+}
+
+export class TokenAuth {
+  /** hash → scope. */
+  private readonly scopeByHash = new Map<string, string>();
+
+  constructor(specs: TokenSpec[]) {
+    for (const s of specs) this.addRaw(s.token, s.scope);
+  }
+
+  /**
+   * Parse the `PUBLISH_TOKENS` env format into the scoped auth set. Each line is
+   * `<token>` (admin scope) or `<token> <package>` (scoped to one package).
+   */
+  static fromEnv(): TokenAuth {
+    const raw = process.env.PUBLISH_TOKENS ?? '';
+    const specs: TokenSpec[] = [];
+    for (const line of raw.split('\n')) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const [token, scope] = trimmed.split(/\s+/, 2);
+      specs.push({ token, scope: scope || ADMIN_SCOPE });
+    }
+    return new TokenAuth(specs);
+  }
+
+  /** Add a cleartext token (hashes it). Empty tokens are ignored. */
+  addRaw(rawToken: string, scope: string): void {
+    const t = rawToken.trim();
+    if (!t) return;
+    this.scopeByHash.set(hashToken(t), scope.trim() || ADMIN_SCOPE);
+  }
+
+  /** Add an already-hashed token (used when loading the persisted minted-token store). */
+  addHashed(hash: string, scope: string): void {
+    this.scopeByHash.set(hash, scope);
+  }
+
+  /** Remove a token by its hash (token revocation). */
+  removeHashed(hash: string): void {
+    this.scopeByHash.delete(hash);
+  }
+
+  /** If no tokens are configured, the server treats every write as unauthorized. */
+  hasTokens(): boolean {
+    return this.scopeByHash.size > 0;
+  }
+
+  /** The scope of a token (from an Authorization header value), or null if unknown. */
+  scopeOf(header: string): string | null {
+    const t = bearerToken(header);
+    if (!t) return null;
+    return this.scopeByHash.get(hashToken(t)) ?? null;
+  }
+
+  /** True when the token may publish/yank the given package (admin or exact scope). */
+  authorize(header: string, pkg: string): boolean {
+    const scope = this.scopeOf(header);
+    if (scope === null) return false;
+    return scope === ADMIN_SCOPE || scope === pkg;
+  }
+
+  /** True when the token is an admin token (scope `*`) — required to mint scoped tokens. */
+  isAdmin(header: string): boolean {
+    return this.scopeOf(header) === ADMIN_SCOPE;
+  }
+}

package/registry-server/src/bootstrap-packaging.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Lockstep gate (ISS-0046): the registry-server's on-demand `walkDir` packager
+ * can't import the canonical node_modules-bundling rule at runtime (this server
+ * ships standalone, with no @celilo deps), so it carries a structural copy.
+ * This test imports the canonical rule directly (zero-dependency module, safe to
+ * pull in at test time from the workspace) and asserts walkDir's actual output
+ * conforms to it — so a drift in either copy fails here instead of shipping a
+ * broken `.netapp`.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+// Canonical rule lives in apps/celilo; importing it cross-package is fine in a
+// workspace test (it's not bundled into the standalone registry-sim image).
+import { includeNodeModulesPath } from '../../../apps/celilo/src/module/packaging/package-rules';
+import { walkDir } from './bootstrap';
+
+describe('bootstrap walkDir stays in lockstep with the canonical packaging rule', () => {
+  let dir: string;
+
+  // Representative node_modules paths spanning both branches of the rule.
+  const nmFiles = [
+    'scripts/node_modules/@celilo/capabilities/src/dns-internal.ts',
+    'scripts/node_modules/tldts/index.js',
+    'scripts/node_modules/drizzle-orm/index.js',
+    'scripts/node_modules/.bin/tldts',
+    'node_modules/@celilo/capabilities/index.js',
+    'node_modules/lodash/index.js',
+    'node_modules/@celilo/e2e/index.js',
+  ];
+
+  function write(rel: string): void {
+    const full = join(dir, rel);
+    mkdirSync(join(full, '..'), { recursive: true });
+    writeFileSync(full, 'x');
+  }
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-bootstrap-rule-'));
+    write('manifest.yml');
+    write('scripts/on-install.ts');
+    for (const f of nmFiles) write(f);
+  });
+
+  afterEach(() => {
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  it("walkDir's node_modules decisions match includeNodeModulesPath", () => {
+    const bundled = new Set(walkDir(dir));
+    for (const rel of nmFiles) {
+      expect(bundled.has(rel)).toBe(includeNodeModulesPath(rel));
+    }
+  });
+
+  it('bundles scripts deps (tldts), drops .bin shims and non-scripts cruft', () => {
+    const bundled = new Set(walkDir(dir));
+    expect(bundled.has('scripts/node_modules/tldts/index.js')).toBe(true);
+    expect(bundled.has('scripts/node_modules/drizzle-orm/index.js')).toBe(true);
+    expect(bundled.has('scripts/node_modules/.bin/tldts')).toBe(false);
+    expect(bundled.has('node_modules/lodash/index.js')).toBe(false);
+    expect(bundled.has('node_modules/@celilo/e2e/index.js')).toBe(false);
+    expect(bundled.has('node_modules/@celilo/capabilities/index.js')).toBe(true);
+  });
+});

package/registry-server/src/bootstrap.ts

@@ -0,0 +1,246 @@
+/**
+ * Bootstrap mode — optional behavior for the e2e stand-in registry.
+ *
+ * When BOOTSTRAP_MODULES_DIR is set, the server also serves modules whose
+ * source lives in that directory. Each immediate subdirectory containing a
+ * manifest.yml is treated as a module; its manifest's `id` and `version`
+ * become the sparse index entry. On download, the directory is packaged
+ * into a .netapp tarball on the fly (cached on disk).
+ *
+ * This preserves the existing packages/e2e/docker/Dockerfile.registry
+ * behavior where tests can import any module from the repo without having
+ * to explicitly publish each dependency first.
+ *
+ * In production, BOOTSTRAP_MODULES_DIR is unset and this whole layer is
+ * inert — storage.ts is the only code that touches disk.
+ */
+
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, relative } from 'node:path';
+import { createHash } from 'node:crypto';
+import type { IndexEntry } from './storage';
+
+export interface BootstrapEntry {
+  name: string;
+  version: string;
+  /** Source directory to package on demand (source mode). */
+  sourceDir?: string;
+  /** Pre-built .netapp to serve directly (upload mode). */
+  netappPath?: string;
+  /**
+   * Manifest's `description` field, when present. Used by the search
+   * endpoint to populate the module-list payload — see
+   * apps/celilo/designs/REGISTRY_BROWSE_UI.md (Phase 2 step 0).
+   */
+  description?: string;
+}
+
+/**
+ * Scan a directory for modules. Each subdirectory is a module iff it contains
+ * a manifest.yml. Manifest parsing is line-regex (not full YAML) so we don't
+ * need a YAML dependency at runtime — this matches packages/e2e/src/registry-server.ts.
+ */
+export function scanBootstrapDir(bootstrapDir: string): Map<string, BootstrapEntry> {
+  const entries = new Map<string, BootstrapEntry>();
+  if (!existsSync(bootstrapDir)) return entries;
+
+  for (const entry of readdirSync(bootstrapDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const manifestPath = join(bootstrapDir, entry.name, 'manifest.yml');
+    if (!existsSync(manifestPath)) continue;
+    try {
+      const yaml = readFileSync(manifestPath, 'utf-8');
+      const idMatch = yaml.match(/^id:\s*['"]?([^\s'"#]+)['"]?/m);
+      const versionMatch = yaml.match(/^version:\s*['"]?([^\s'"#]+)['"]?/m);
+      // Description is the rest-of-line up to (but not including) the
+      // newline. The manifest schema allows multi-line scalars, but
+      // existing modules use the single-line form so the line-regex is
+      // sufficient. We strip surrounding quotes if present.
+      const descriptionMatch = yaml.match(/^description:\s*(.+?)\s*$/m);
+      const name = idMatch?.[1]?.trim() ?? entry.name;
+      const version = versionMatch?.[1]?.trim() ?? '0.0.0';
+      const description = descriptionMatch?.[1]?.trim().replace(/^['"]|['"]$/g, '');
+      entries.set(name, {
+        name,
+        version,
+        sourceDir: join(bootstrapDir, entry.name),
+        description,
+      });
+    } catch {
+      // skip malformed manifests — matches e2e server behavior
+    }
+  }
+  return entries;
+}
+
+/**
+ * Scan a directory for pre-built .netapp files. Filename (minus suffix) is
+ * the module name. Version defaults to the filename's version suffix or to
+ * 0.0.0+1 — real version data is in the archive's manifest but parsing that
+ * at startup is overkill for the e2e bootstrap use case.
+ *
+ * Used by the shared-infra stand-in: the e2e harness's publishModule helper
+ * copies .netapps into BOOTSTRAP_UPLOADS_DIR with `docker cp`, and the
+ * server picks them up without needing the full HTTP publish protocol.
+ */
+export function scanUploadsDir(uploadsDir: string): Map<string, BootstrapEntry> {
+  const entries = new Map<string, BootstrapEntry>();
+  if (!existsSync(uploadsDir)) return entries;
+
+  for (const file of readdirSync(uploadsDir)) {
+    if (!file.endsWith('.netapp')) continue;
+    const name = file.slice(0, -7);
+    entries.set(name, {
+      name,
+      version: '0.0.0',
+      netappPath: join(uploadsDir, file),
+    });
+  }
+  return entries;
+}
+
+/** Render a bootstrap entry as an IndexEntry suitable for the sparse index. */
+export function bootstrapIndexEntry(entry: BootstrapEntry): IndexEntry {
+  const vers = entry.version.includes('+') ? entry.version : `${entry.version}+1`;
+  return {
+    name: entry.name,
+    vers,
+    deps: [],
+    cksum: 'bootstrap',
+    yanked: false,
+  };
+}
+
+/**
+ * Walk a directory, skipping hidden entries, *.test.ts files, the
+ * module's e2e/ tree (tests + their deps don't ship with the module),
+ * and most of node_modules.
+ *
+ * `scripts/node_modules` (the module's hook runtime) is bundled IN FULL
+ * (ISS-0046): hook scripts run on the target, where the package registry can
+ * be unreachable, so the `.netapp` must carry @celilo/capabilities AND its
+ * third-party deps (tldts, drizzle-orm, …). Any OTHER node_modules ships only
+ * `@celilo/capabilities` — the framework SDK the module was authored against.
+ *
+ * This is the structural twin of the canonical `includeNodeModulesPath` rule in
+ * apps/celilo/src/module/packaging/package-rules.ts. We can't import that at
+ * runtime (this server ships in a standalone Docker image with no @celilo deps),
+ * so the two are held in lockstep by bootstrap-packaging.test.ts, which asserts
+ * `walkDir`'s output conforms to the canonical rule. `walkDir` is exported for
+ * that test.
+ */
+export function walkDir(dir: string, base = dir): string[] {
+  const results: string[] = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name.startsWith('.')) continue;
+    if (entry.name.endsWith('.test.ts')) continue;
+
+    const fullPath = join(dir, entry.name);
+
+    // Module's e2e/ directory at the root is tests + their devDependencies.
+    // Detected by being a sibling of manifest.yml.
+    if (entry.name === 'e2e' && existsSync(join(dir, 'manifest.yml'))) {
+      continue;
+    }
+
+    if (entry.name === 'node_modules') {
+      if (basename(dir) === 'scripts') {
+        // The hook-script runtime closure — bundle it whole (incl. nested deps).
+        // walkAll keeps the hidden-entry / *.test.ts skips, so .bin shims drop.
+        results.push(...walkAll(fullPath, base));
+      } else {
+        // Other node_modules: collect only @celilo/capabilities.
+        const capDir = join(fullPath, '@celilo', 'capabilities');
+        if (existsSync(capDir)) {
+          results.push(...walkDir(capDir, base));
+        }
+      }
+      continue;
+    }
+
+    if (entry.isDirectory()) {
+      results.push(...walkDir(fullPath, base));
+    } else {
+      results.push(relative(base, fullPath));
+    }
+  }
+  return results;
+}
+
+/**
+ * Collect every file under `dir` (recursing into nested node_modules too),
+ * skipping only hidden entries (`.bin` symlink shims) and `*.test.ts`. Used to
+ * bundle a module's full `scripts/node_modules` runtime closure.
+ */
+function walkAll(dir: string, base: string): string[] {
+  const results: string[] = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name.startsWith('.')) continue;
+    if (entry.name.endsWith('.test.ts')) continue;
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...walkAll(fullPath, base));
+    } else {
+      results.push(relative(base, fullPath));
+    }
+  }
+  return results;
+}
+
+/**
+ * Package a module directory into a .netapp tarball. Cached by module name
+ * in cacheDir; cache is keyed by name only (assume the source is immutable
+ * for the lifetime of the server — fine for e2e).
+ */
+export async function packageBootstrapModule(
+  entry: BootstrapEntry,
+  cacheDir: string,
+): Promise<string> {
+  // Upload-mode entries are already .netapp files — serve as-is.
+  if (entry.netappPath) return entry.netappPath;
+  const sourceDir = entry.sourceDir;
+  if (!sourceDir) {
+    throw new Error(`bootstrap entry ${entry.name} has neither sourceDir nor netappPath`);
+  }
+  mkdirSync(cacheDir, { recursive: true });
+  const cachePath = join(cacheDir, `${entry.name}.netapp`);
+  if (existsSync(cachePath)) return cachePath;
+
+  const filePaths = walkDir(sourceDir);
+  const fileHashes: Record<string, string> = {};
+  for (const relPath of filePaths) {
+    const data = readFileSync(join(sourceDir, relPath));
+    fileHashes[relPath] = createHash('sha256').update(data).digest('hex');
+  }
+
+  const checksumsJson = JSON.stringify(
+    { version: '1', generated: new Date().toISOString(), files: fileHashes },
+    null,
+    2,
+  );
+
+  // Source dir may be read-only (volume-mounted) — stage in /tmp first.
+  const stagingDir = join('/tmp', `celilo-bootstrap-${entry.name}-${Date.now()}`);
+  mkdirSync(stagingDir, { recursive: true });
+  try {
+    for (const relPath of filePaths) {
+      mkdirSync(dirname(join(stagingDir, relPath)), { recursive: true });
+      writeFileSync(join(stagingDir, relPath), readFileSync(join(sourceDir, relPath)));
+    }
+    writeFileSync(join(stagingDir, 'checksums.json'), checksumsJson);
+
+    const proc = Bun.spawn(['tar', '-czf', cachePath, '-C', stagingDir, '.'], {
+      stderr: 'inherit',
+    });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0) throw new Error(`tar exited with code ${exitCode}`);
+  } finally {
+    try {
+      Bun.spawnSync(['rm', '-rf', stagingDir]);
+    } catch {
+      // best-effort cleanup
+    }
+  }
+
+  return cachePath;
+}

package/registry-server/src/index.ts

@@ -0,0 +1,16 @@
+export { RegistryStorage } from './storage';
+export type { IndexEntry, ModuleVersion } from './storage';
+export { TokenAuth } from './auth';
+export { startServer, startFromEnv } from './server';
+export {
+  scanBootstrapDir,
+  bootstrapIndexEntry,
+  packageBootstrapModule,
+} from './bootstrap';
+export type { BootstrapEntry } from './bootstrap';
+
+import { startFromEnv } from './server';
+
+if (import.meta.main) {
+  startFromEnv();
+}

package/registry-server/src/introspection.test.ts

@@ -0,0 +1,247 @@
+import { afterEach, describe, expect, test } from 'bun:test';
+import { ADMIN_SCOPE } from './auth';
+import {
+  IntrospectionVerifier,
+  claimToScope,
+  introspectionConfigFromEnv,
+} from './introspection';
+
+const CONFIG = {
+  endpoint: 'https://idp.test/application/o/introspect/',
+  clientId: 'celilo-registry',
+  clientSecret: 'super-secret',
+  adminGroup: 'celilo-admins',
+  publisherGroup: 'celilo-authors',
+};
+
+/** Replace global fetch with a stub returning `body` at `status`; restore after. */
+function stubFetch(handler: (url: string, init: RequestInit) => Response): void {
+  // @ts-expect-error - overriding the global for the duration of a test
+  globalThis.fetch = async (url: string | URL | Request, init?: RequestInit) =>
+    handler(String(url), init ?? {});
+}
+
+const realFetch = globalThis.fetch;
+afterEach(() => {
+  globalThis.fetch = realFetch;
+});
+
+function introspectResponse(payload: unknown, status = 200): Response {
+  return new Response(JSON.stringify(payload), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+describe('claimToScope', () => {
+  test('admin-group member → ADMIN_SCOPE', () => {
+    expect(claimToScope({ active: true, groups: ['celilo-admins'] }, 'celilo-admins')).toBe(
+      ADMIN_SCOPE,
+    );
+  });
+
+  test('non-admin identity → null (owner table is ce-1ch)', () => {
+    expect(claimToScope({ active: true, groups: ['users'] }, 'celilo-admins')).toBeNull();
+    expect(claimToScope({ active: true }, 'celilo-admins')).toBeNull();
+  });
+});
+
+describe('introspectionConfigFromEnv', () => {
+  const KEYS = [
+    'OIDC_INTROSPECTION_ENDPOINT',
+    'OIDC_CLIENT_ID',
+    'OIDC_CLIENT_SECRET',
+    'REGISTRY_ADMIN_GROUP',
+    'REGISTRY_PUBLISHER_GROUP',
+  ];
+  afterEach(() => {
+    for (const k of KEYS) delete process.env[k];
+  });
+
+  test('null when any required var is missing', () => {
+    expect(introspectionConfigFromEnv()).toBeNull();
+    process.env.OIDC_INTROSPECTION_ENDPOINT = 'https://idp.test/introspect/';
+    process.env.OIDC_CLIENT_ID = 'cid';
+    // secret still missing
+    expect(introspectionConfigFromEnv()).toBeNull();
+  });
+
+  test('config when all required vars present; admin group defaults', () => {
+    process.env.OIDC_INTROSPECTION_ENDPOINT = 'https://idp.test/introspect/';
+    process.env.OIDC_CLIENT_ID = 'cid';
+    process.env.OIDC_CLIENT_SECRET = 'sec';
+    expect(introspectionConfigFromEnv()).toEqual({
+      endpoint: 'https://idp.test/introspect/',
+      clientId: 'cid',
+      clientSecret: 'sec',
+      adminGroup: 'celilo-admins',
+      publisherGroup: 'celilo-authors',
+    });
+    process.env.REGISTRY_ADMIN_GROUP = 'ops';
+    expect(introspectionConfigFromEnv()?.adminGroup).toBe('ops');
+    process.env.REGISTRY_PUBLISHER_GROUP = 'authors';
+    expect(introspectionConfigFromEnv()?.publisherGroup).toBe('authors');
+  });
+});
+
+describe('IntrospectionVerifier.scopeOf', () => {
+  const verifier = new IntrospectionVerifier(CONFIG);
+
+  test('active admin-group token → ADMIN_SCOPE', async () => {
+    stubFetch(() =>
+      introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'] }),
+    );
+    expect(await verifier.scopeOf('Bearer idp-token')).toBe(ADMIN_SCOPE);
+  });
+
+  test('active non-admin token → null', async () => {
+    stubFetch(() => introspectResponse({ active: true, sub: 'bob', groups: ['users'] }));
+    expect(await verifier.scopeOf('idp-token')).toBeNull();
+  });
+
+  test('active:false → null (revoked at idp)', async () => {
+    stubFetch(() => introspectResponse({ active: false }));
+    expect(await verifier.scopeOf('idp-token')).toBeNull();
+  });
+
+  test('expired exp → null even if active', async () => {
+    const pastSec = Math.floor(Date.now() / 1000) - 60;
+    stubFetch(() =>
+      introspectResponse({ active: true, groups: ['celilo-admins'], exp: pastSec }),
+    );
+    expect(await verifier.scopeOf('idp-token')).toBeNull();
+  });
+
+  test('future exp → honored', async () => {
+    const futureSec = Math.floor(Date.now() / 1000) + 3600;
+    stubFetch(() =>
+      introspectResponse({ active: true, groups: ['celilo-admins'], exp: futureSec }),
+    );
+    expect(await verifier.scopeOf('idp-token')).toBe(ADMIN_SCOPE);
+  });
+
+  test('non-2xx response → null (fail closed)', async () => {
+    stubFetch(() => introspectResponse({ error: 'boom' }, 500));
+    expect(await verifier.scopeOf('idp-token')).toBeNull();
+  });
+
+  test('fetch throws → null (fail closed)', async () => {
+    stubFetch(() => {
+      throw new Error('connection refused');
+    });
+    expect(await verifier.scopeOf('idp-token')).toBeNull();
+  });
+
+  test('malformed body (no active field) → null', async () => {
+    stubFetch(() => introspectResponse({ sub: 'alice' }));
+    expect(await verifier.scopeOf('idp-token')).toBeNull();
+  });
+
+  test('empty header → null without calling the idp', async () => {
+    let called = false;
+    stubFetch(() => {
+      called = true;
+      return introspectResponse({ active: true, groups: ['celilo-admins'] });
+    });
+    expect(await verifier.scopeOf('')).toBeNull();
+    expect(called).toBe(false);
+  });
+
+  test('authenticates with HTTP Basic client creds; sends the token in the body', async () => {
+    let seenAuth = '';
+    let seenBody = '';
+    stubFetch((_url, init) => {
+      seenAuth = new Headers(init.headers).get('Authorization') ?? '';
+      seenBody = String(init.body ?? '');
+      return introspectResponse({ active: true, groups: ['celilo-admins'] });
+    });
+    await verifier.scopeOf('Bearer the-token');
+    const expected = `Basic ${Buffer.from('celilo-registry:super-secret').toString('base64')}`;
+    expect(seenAuth).toBe(expected);
+    expect(seenBody).toContain('token=the-token');
+  });
+
+  test('does not log the token or client secret on failure', async () => {
+    const logs: string[] = [];
+    const realErr = console.error;
+    console.error = (...args: unknown[]) => {
+      logs.push(args.map(String).join(' '));
+    };
+    try {
+      stubFetch(() => {
+        throw new Error('boom');
+      });
+      await verifier.scopeOf('Bearer top-secret-token');
+    } finally {
+      console.error = realErr;
+    }
+    const joined = logs.join('\n');
+    expect(joined).not.toContain('top-secret-token');
+    expect(joined).not.toContain('super-secret');
+  });
+});
+
+describe('IntrospectionVerifier.identify (ce-1ch)', () => {
+  const verifier = new IntrospectionVerifier(CONFIG);
+
+  test('admin-group member → isAdmin, group=adminGroup', async () => {
+    stubFetch(() => introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'] }));
+    expect(await verifier.identify('Bearer t')).toEqual({
+      sub: 'alice',
+      isAdmin: true,
+      isPublisher: false,
+      group: 'celilo-admins',
+    });
+  });
+
+  test('publisher-group member → isPublisher, group=publisherGroup', async () => {
+    stubFetch(() => introspectResponse({ active: true, sub: 'bob', groups: ['celilo-authors'] }));
+    expect(await verifier.identify('Bearer t')).toEqual({
+      sub: 'bob',
+      isAdmin: false,
+      isPublisher: true,
+      group: 'celilo-authors',
+    });
+  });
+
+  test('member of neither publish group → verified but no group', async () => {
+    stubFetch(() => introspectResponse({ active: true, sub: 'carol', groups: ['users'] }));
+    expect(await verifier.identify('Bearer t')).toEqual({
+      sub: 'carol',
+      isAdmin: false,
+      isPublisher: false,
+      group: undefined,
+    });
+  });
+
+  test('admin with no sub → identified (admins publish without an ownership anchor)', async () => {
+    stubFetch(() => introspectResponse({ active: true, groups: ['celilo-admins'] }));
+    expect(await verifier.identify('Bearer t')).toEqual({
+      sub: undefined,
+      isAdmin: true,
+      isPublisher: false,
+      group: 'celilo-admins',
+    });
+  });
+
+  test('active:false → null (fail closed)', async () => {
+    stubFetch(() => introspectResponse({ active: false }));
+    expect(await verifier.identify('Bearer t')).toBeNull();
+  });
+
+  test('expired exp → null even if active', async () => {
+    const pastSec = Math.floor(Date.now() / 1000) - 60;
+    stubFetch(() =>
+      introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'], exp: pastSec }),
+    );
+    expect(await verifier.identify('Bearer t')).toBeNull();
+  });
+
+  test('admin group is configurable, not a literal', async () => {
+    const custom = new IntrospectionVerifier({ ...CONFIG, adminGroup: 'ops', publisherGroup: 'devs' });
+    stubFetch(() => introspectResponse({ active: true, sub: 'dan', groups: ['ops'] }));
+    const id = await custom.identify('Bearer t');
+    expect(id?.isAdmin).toBe(true);
+    expect(id?.group).toBe('ops');
+  });
+});