@celilo/e2e 0.9.3 → 0.10.0

package/registry-server/src/scoped-token-store.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, test } from 'bun:test';
+import { hashToken } from './auth';
+import {
+  type ScopedTokenEntry,
+  type ScopedTokenPersistence,
+  ScopedTokenStore,
+} from './scoped-token-store';
+
+/** In-memory persistence so the store is testable without the filesystem. */
+function memoryPersistence(seed: ScopedTokenEntry[] = []): ScopedTokenPersistence & {
+  saved: ScopedTokenEntry[];
+} {
+  const state = { saved: [...seed] };
+  return {
+    saved: state.saved,
+    load() {
+      return [...state.saved];
+    },
+    save(entries) {
+      state.saved.length = 0;
+      state.saved.push(...entries);
+    },
+  };
+}
+
+/** Deterministic token generator (avoids randomness in assertions). */
+function seqGen() {
+  let n = 0;
+  return () => `tok-${++n}`;
+}
+
+describe('ScopedTokenStore.mint (ISS-0140)', () => {
+  test('mints a scoped token and persists only the hash', () => {
+    const p = memoryPersistence();
+    const store = new ScopedTokenStore(p, seqGen(), () => '2026-06-20T00:00:00Z');
+    const { token, entry, revokedHashes } = store.mint('celilo/lunacycle', 'lunacycle');
+
+    expect(token).toBe('tok-1');
+    expect(entry.scope).toBe('lunacycle');
+    expect(entry.repo).toBe('celilo/lunacycle');
+    expect(entry.hash).toBe(hashToken('tok-1'));
+    expect(revokedHashes).toEqual([]);
+    // Persisted form holds the hash, never the cleartext token.
+    expect(JSON.stringify(p.saved)).not.toContain('tok-1');
+    expect(p.saved).toHaveLength(1);
+  });
+
+  test('re-minting for the same repo rotates the token (reconcile)', () => {
+    const p = memoryPersistence();
+    const store = new ScopedTokenStore(p, seqGen(), () => 't');
+    const first = store.mint('celilo/lunacycle', 'lunacycle');
+    const second = store.mint('celilo/lunacycle', 'lunacycle');
+
+    expect(second.token).toBe('tok-2');
+    expect(second.revokedHashes).toEqual([first.entry.hash]);
+    // Still exactly one active token for the repo.
+    expect(store.list().filter((e) => e.repo === 'celilo/lunacycle')).toHaveLength(1);
+    expect(store.list()).toHaveLength(1);
+  });
+
+  test('different repos coexist independently', () => {
+    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
+    store.mint('celilo/lunacycle', 'lunacycle');
+    store.mint('celilo/caddy', 'caddy');
+    expect(store.list()).toHaveLength(2);
+  });
+});
+
+describe('ScopedTokenStore.revoke', () => {
+  test('removes all tokens for a repo and returns their hashes', () => {
+    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
+    const { entry } = store.mint('celilo/lunacycle', 'lunacycle');
+    const removed = store.revoke('celilo/lunacycle');
+    expect(removed).toEqual([entry.hash]);
+    expect(store.list()).toHaveLength(0);
+  });
+
+  test('revoking an unknown repo is a no-op', () => {
+    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
+    expect(store.revoke('celilo/nope')).toEqual([]);
+  });
+});
+
+describe('ScopedTokenStore startup load', () => {
+  test('loads persisted entries on construction', () => {
+    const seed: ScopedTokenEntry[] = [
+      { hash: hashToken('x'), scope: 'caddy', repo: 'celilo/caddy', mintedAt: 't' },
+    ];
+    const store = new ScopedTokenStore(memoryPersistence(seed), seqGen(), () => 't');
+    expect(store.list()).toHaveLength(1);
+    expect(store.list()[0]?.repo).toBe('celilo/caddy');
+  });
+});

package/registry-server/src/scoped-token-store.ts

@@ -0,0 +1,110 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { hashToken } from './auth';
+
+/**
+ * Persisted store of minted, package-scoped publish tokens (build-bus Phase 3,
+ * ISS-0140). The `registry_publish` capability mints one token per registered
+ * repo, scoped to the single package that repo publishes — so a compromised
+ * runner can ship only its own module, never another.
+ *
+ * Only the token HASH is persisted (never cleartext) — the raw token is returned
+ * exactly once at mint time, for the caller to set as the repo's Forgejo Actions
+ * secret. At startup the server loads this store into its {@link TokenAuth} via
+ * `addHashed`; mint/revoke update both the in-memory auth and this file, so a
+ * minted token works without a server restart.
+ */
+
+export interface ScopedTokenEntry {
+  /** SHA-256 of the raw token. */
+  hash: string;
+  /** Package this token may publish. */
+  scope: string;
+  /** Repo path on the source forge this token was minted for (the reconcile key). */
+  repo: string;
+  /** ISO timestamp of mint. */
+  mintedAt: string;
+}
+
+export interface MintResult {
+  /** The raw token — returned ONCE; never persisted in cleartext. */
+  token: string;
+  entry: ScopedTokenEntry;
+  /** Hashes of tokens this mint superseded for the same repo (revoke them in auth). */
+  revokedHashes: string[];
+}
+
+/** I/O seam (Rule 2.3) so the store is unit-testable without the filesystem. */
+export interface ScopedTokenPersistence {
+  load(): ScopedTokenEntry[];
+  save(entries: ScopedTokenEntry[]): void;
+}
+
+/** File-backed persistence: a JSON array at `filePath`, tolerant of a missing file. */
+export function fileScopedTokenPersistence(filePath: string): ScopedTokenPersistence {
+  return {
+    load() {
+      if (!existsSync(filePath)) return [];
+      try {
+        const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+        return Array.isArray(parsed) ? (parsed as ScopedTokenEntry[]) : [];
+      } catch {
+        return [];
+      }
+    },
+    save(entries) {
+      mkdirSync(dirname(filePath), { recursive: true });
+      writeFileSync(filePath, JSON.stringify(entries, null, 2));
+    },
+  };
+}
+
+function defaultGenToken(): string {
+  return `cpt_${randomBytes(32).toString('base64url')}`;
+}
+
+export class ScopedTokenStore {
+  private entries: ScopedTokenEntry[];
+
+  constructor(
+    private readonly persistence: ScopedTokenPersistence,
+    private readonly genToken: () => string = defaultGenToken,
+    private readonly now: () => string = () => new Date().toISOString(),
+  ) {
+    this.entries = persistence.load();
+  }
+
+  list(): ScopedTokenEntry[] {
+    return [...this.entries];
+  }
+
+  /**
+   * Mint a fresh scoped token for `repo`, reconciling: any existing token for the
+   * same repo is superseded (its hash returned in `revokedHashes`). Idempotent at
+   * the repo level — re-running rotates the token cleanly.
+   */
+  mint(repo: string, scope: string): MintResult {
+    const revokedHashes = this.entries.filter((e) => e.repo === repo).map((e) => e.hash);
+    const token = this.genToken();
+    const entry: ScopedTokenEntry = {
+      hash: hashToken(token),
+      scope,
+      repo,
+      mintedAt: this.now(),
+    };
+    this.entries = [...this.entries.filter((e) => e.repo !== repo), entry];
+    this.persistence.save(this.entries);
+    return { token, entry, revokedHashes };
+  }
+
+  /** Revoke all tokens for `repo`. Returns the removed hashes. */
+  revoke(repo: string): string[] {
+    const removed = this.entries.filter((e) => e.repo === repo).map((e) => e.hash);
+    if (removed.length > 0) {
+      this.entries = this.entries.filter((e) => e.repo !== repo);
+      this.persistence.save(this.entries);
+    }
+    return removed;
+  }
+}