@celilo/e2e 0.9.3 → 0.10.2

package/registry-server/src/module-owner-store.ts

@@ -0,0 +1,108 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+/**
+ * Persisted module-owner table (SECURE_MODULE_PUBLISH.md §5[D-C], ce-1ch).
+ *
+ * The introspection verify-bridge (ce-s7e) proves *who* a publish token belongs
+ * to (a verified `sub` + group claims). This table gates *which modules* that
+ * identity may publish: a module name is **first-publish-claims** — the first
+ * verified publisher of an unclaimed name records ownership; thereafter only the
+ * owner (or an admin) may publish it. This defends the confused-deputy case:
+ * Author-A holding a valid idp token cannot publish Author-B's module.
+ *
+ * Ownership is low-friction / npm-style: no pre-registration, admin can reassign.
+ * Mirrors {@link ScopedTokenStore} (JSON file + I/O seam for unit testing).
+ */
+
+export interface ModuleOwnerEntry {
+  /** Module name this ownership record governs. */
+  moduleName: string;
+  /** Verified idp subject that owns the name (from introspection `sub`). */
+  ownerSub: string;
+  /** ISO timestamp the name was first claimed. */
+  claimedAt: string;
+  /** Group claim that granted the claim (admin or publisher group at claim time). */
+  sourceGroup: string;
+}
+
+/** I/O seam (Rule 2.3) so the store is unit-testable without the filesystem. */
+export interface ModuleOwnerPersistence {
+  load(): ModuleOwnerEntry[];
+  save(entries: ModuleOwnerEntry[]): void;
+}
+
+/** File-backed persistence: a JSON array at `filePath`, tolerant of a missing file. */
+export function fileModuleOwnerPersistence(filePath: string): ModuleOwnerPersistence {
+  return {
+    load() {
+      if (!existsSync(filePath)) return [];
+      try {
+        const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+        return Array.isArray(parsed) ? (parsed as ModuleOwnerEntry[]) : [];
+      } catch {
+        return [];
+      }
+    },
+    save(entries) {
+      mkdirSync(dirname(filePath), { recursive: true });
+      writeFileSync(filePath, JSON.stringify(entries, null, 2));
+    },
+  };
+}
+
+export class ModuleOwnerStore {
+  private entries: ModuleOwnerEntry[];
+
+  constructor(
+    private readonly persistence: ModuleOwnerPersistence,
+    private readonly now: () => string = () => new Date().toISOString(),
+  ) {
+    this.entries = persistence.load();
+  }
+
+  list(): ModuleOwnerEntry[] {
+    return [...this.entries];
+  }
+
+  /** The ownership record for `moduleName`, or undefined when unclaimed. */
+  get(moduleName: string): ModuleOwnerEntry | undefined {
+    return this.entries.find((e) => e.moduleName === moduleName);
+  }
+
+  /**
+   * Record ownership of an **unclaimed** name for `ownerSub`. If the name is
+   * already claimed this is a no-op and returns the *existing* entry — claiming
+   * never steals a name (use {@link reassign} for admin overwrite). Returns the
+   * effective owner entry either way.
+   */
+  claim(moduleName: string, ownerSub: string, sourceGroup: string): ModuleOwnerEntry {
+    const existing = this.get(moduleName);
+    if (existing) return existing;
+    const entry: ModuleOwnerEntry = {
+      moduleName,
+      ownerSub,
+      claimedAt: this.now(),
+      sourceGroup,
+    };
+    this.entries = [...this.entries, entry];
+    this.persistence.save(this.entries);
+    return entry;
+  }
+
+  /**
+   * Overwrite (or create) the ownership record for `moduleName` — admin
+   * reassignment. Unlike {@link claim} this steals an already-owned name.
+   */
+  reassign(moduleName: string, ownerSub: string, sourceGroup: string): ModuleOwnerEntry {
+    const entry: ModuleOwnerEntry = {
+      moduleName,
+      ownerSub,
+      claimedAt: this.now(),
+      sourceGroup,
+    };
+    this.entries = [...this.entries.filter((e) => e.moduleName !== moduleName), entry];
+    this.persistence.save(this.entries);
+    return entry;
+  }
+}

package/registry-server/src/rate-limit.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, test } from 'bun:test';
+import { clientIp, createRateLimiter } from './rate-limit';
+
+describe('createRateLimiter', () => {
+  test('allows up to max, then rejects', () => {
+    const limiter = createRateLimiter({ max: 3, windowMs: 60_000, now: () => 0 });
+    expect(limiter.take('1.1.1.1').ok).toBe(true);
+    expect(limiter.take('1.1.1.1').ok).toBe(true);
+    expect(limiter.take('1.1.1.1').ok).toBe(true);
+    const over = limiter.take('1.1.1.1');
+    expect(over.ok).toBe(false);
+    if (!over.ok) expect(over.retryAfterSec).toBeGreaterThan(0);
+  });
+
+  test('distinct IPs are tracked separately', () => {
+    const limiter = createRateLimiter({ max: 1, windowMs: 60_000, now: () => 0 });
+    expect(limiter.take('1.1.1.1').ok).toBe(true);
+    expect(limiter.take('2.2.2.2').ok).toBe(true); // different IP, fresh allowance
+    expect(limiter.take('1.1.1.1').ok).toBe(false);
+  });
+
+  test('bucket resets after window elapses', () => {
+    let t = 0;
+    const limiter = createRateLimiter({ max: 1, windowMs: 1000, now: () => t });
+    expect(limiter.take('1.1.1.1').ok).toBe(true);
+    expect(limiter.take('1.1.1.1').ok).toBe(false);
+    t = 1001;
+    expect(limiter.take('1.1.1.1').ok).toBe(true);
+  });
+
+  test('retryAfterSec reflects remaining window', () => {
+    const limiter = createRateLimiter({ max: 1, windowMs: 60_000, now: () => 0 });
+    limiter.take('1.1.1.1');
+    const r = limiter.take('1.1.1.1');
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.retryAfterSec).toBeLessThanOrEqual(60);
+      expect(r.retryAfterSec).toBeGreaterThan(0);
+    }
+  });
+});
+
+describe('clientIp', () => {
+  function req(headers: Record<string, string>): Request {
+    return new Request('http://x/', { headers });
+  }
+  const stubServer = {
+    requestIP: () => ({ address: '10.0.0.1' }),
+  };
+
+  test('uses X-Forwarded-For first entry when present', () => {
+    expect(clientIp(req({ 'x-forwarded-for': '1.1.1.1, 2.2.2.2' }), stubServer)).toBe('1.1.1.1');
+  });
+
+  test('falls back to Bun.Server.requestIP when XFF absent', () => {
+    expect(clientIp(req({}), stubServer)).toBe('10.0.0.1');
+  });
+
+  test('returns "unknown" when neither available', () => {
+    expect(clientIp(req({}), { requestIP: () => null })).toBe('unknown');
+  });
+});

package/registry-server/src/rate-limit.ts

@@ -0,0 +1,83 @@
+/**
+ * Simple in-memory per-IP rate limiter for the auth-gated endpoints
+ * (publish, yank, unyank). The public-read endpoints (download, index,
+ * search) are left unlimited — they're cacheable and the body-size cap
+ * on publish already covers the main DoS vector.
+ *
+ * We implement this in-process rather than in Caddy because the stock
+ * apt-installed Caddy doesn't include the community `caddy-ratelimit`
+ * plugin. If we ever switch the caddy module to `xcaddy build` with the
+ * plugin, we can move this upstream and delete this file.
+ *
+ * The limiter is a fixed window counter: each IP gets a fresh allowance
+ * every `windowMs`. No burst smoothing, which is fine for the tiny
+ * traffic a registry actually sees — we just want to keep a bad actor
+ * from flooding the disk via repeated publish attempts.
+ */
+
+interface Bucket {
+  count: number;
+  /** Epoch ms when this bucket resets to 0 and `windowMs` restarts. */
+  resetAt: number;
+}
+
+export interface RateLimiter {
+  /**
+   * Record one hit from `ip`. Returns {ok: true, remaining} if under the
+   * limit; {ok: false, retryAfterSec} if the window is exhausted.
+   */
+  take(ip: string): { ok: true; remaining: number } | { ok: false; retryAfterSec: number };
+}
+
+export function createRateLimiter(opts: {
+  /** Max events per IP per window. */
+  max: number;
+  /** Window length in ms. */
+  windowMs: number;
+  /** Inject a clock for tests; defaults to Date.now. */
+  now?: () => number;
+}): RateLimiter {
+  const buckets = new Map<string, Bucket>();
+  const now = opts.now ?? (() => Date.now());
+
+  // Opportunistic cleanup: if the map grows past a size threshold, drop
+  // expired entries. Keeps memory bounded even under churny attackers
+  // hitting from rotating IPs.
+  const CLEANUP_AT = 1000;
+
+  return {
+    take(ip: string) {
+      const t = now();
+      let bucket = buckets.get(ip);
+      if (!bucket || t >= bucket.resetAt) {
+        bucket = { count: 0, resetAt: t + opts.windowMs };
+        buckets.set(ip, bucket);
+      }
+      bucket.count += 1;
+      if (bucket.count > opts.max) {
+        return { ok: false, retryAfterSec: Math.max(1, Math.ceil((bucket.resetAt - t) / 1000)) };
+      }
+      if (buckets.size > CLEANUP_AT) {
+        for (const [k, v] of buckets) if (t >= v.resetAt) buckets.delete(k);
+      }
+      return { ok: true, remaining: opts.max - bucket.count };
+    },
+  };
+}
+
+/**
+ * Extract the caller's IP for rate-limit keying. Prefers the first entry
+ * of X-Forwarded-For (trusted-proxy assumption — we sit behind Caddy);
+ * falls back to the raw socket peer via Bun.Server.requestIP.
+ */
+export function clientIp(
+  req: Request,
+  server: { requestIP(r: Request): { address: string } | null },
+): string {
+  const xff = req.headers.get('x-forwarded-for');
+  if (xff) {
+    const first = xff.split(',')[0]?.trim();
+    if (first) return first;
+  }
+  return server.requestIP(req)?.address ?? 'unknown';
+}

package/registry-server/src/scoped-token-store.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, test } from 'bun:test';
+import { hashToken } from './auth';
+import {
+  type ScopedTokenEntry,
+  type ScopedTokenPersistence,
+  ScopedTokenStore,
+} from './scoped-token-store';
+
+/** In-memory persistence so the store is testable without the filesystem. */
+function memoryPersistence(seed: ScopedTokenEntry[] = []): ScopedTokenPersistence & {
+  saved: ScopedTokenEntry[];
+} {
+  const state = { saved: [...seed] };
+  return {
+    saved: state.saved,
+    load() {
+      return [...state.saved];
+    },
+    save(entries) {
+      state.saved.length = 0;
+      state.saved.push(...entries);
+    },
+  };
+}
+
+/** Deterministic token generator (avoids randomness in assertions). */
+function seqGen() {
+  let n = 0;
+  return () => `tok-${++n}`;
+}
+
+describe('ScopedTokenStore.mint (ISS-0140)', () => {
+  test('mints a scoped token and persists only the hash', () => {
+    const p = memoryPersistence();
+    const store = new ScopedTokenStore(p, seqGen(), () => '2026-06-20T00:00:00Z');
+    const { token, entry, revokedHashes } = store.mint('celilo/lunacycle', 'lunacycle');
+
+    expect(token).toBe('tok-1');
+    expect(entry.scope).toBe('lunacycle');
+    expect(entry.repo).toBe('celilo/lunacycle');
+    expect(entry.hash).toBe(hashToken('tok-1'));
+    expect(revokedHashes).toEqual([]);
+    // Persisted form holds the hash, never the cleartext token.
+    expect(JSON.stringify(p.saved)).not.toContain('tok-1');
+    expect(p.saved).toHaveLength(1);
+  });
+
+  test('re-minting for the same repo rotates the token (reconcile)', () => {
+    const p = memoryPersistence();
+    const store = new ScopedTokenStore(p, seqGen(), () => 't');
+    const first = store.mint('celilo/lunacycle', 'lunacycle');
+    const second = store.mint('celilo/lunacycle', 'lunacycle');
+
+    expect(second.token).toBe('tok-2');
+    expect(second.revokedHashes).toEqual([first.entry.hash]);
+    // Still exactly one active token for the repo.
+    expect(store.list().filter((e) => e.repo === 'celilo/lunacycle')).toHaveLength(1);
+    expect(store.list()).toHaveLength(1);
+  });
+
+  test('different repos coexist independently', () => {
+    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
+    store.mint('celilo/lunacycle', 'lunacycle');
+    store.mint('celilo/caddy', 'caddy');
+    expect(store.list()).toHaveLength(2);
+  });
+});
+
+describe('ScopedTokenStore.revoke', () => {
+  test('removes all tokens for a repo and returns their hashes', () => {
+    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
+    const { entry } = store.mint('celilo/lunacycle', 'lunacycle');
+    const removed = store.revoke('celilo/lunacycle');
+    expect(removed).toEqual([entry.hash]);
+    expect(store.list()).toHaveLength(0);
+  });
+
+  test('revoking an unknown repo is a no-op', () => {
+    const store = new ScopedTokenStore(memoryPersistence(), seqGen(), () => 't');
+    expect(store.revoke('celilo/nope')).toEqual([]);
+  });
+});
+
+describe('ScopedTokenStore startup load', () => {
+  test('loads persisted entries on construction', () => {
+    const seed: ScopedTokenEntry[] = [
+      { hash: hashToken('x'), scope: 'caddy', repo: 'celilo/caddy', mintedAt: 't' },
+    ];
+    const store = new ScopedTokenStore(memoryPersistence(seed), seqGen(), () => 't');
+    expect(store.list()).toHaveLength(1);
+    expect(store.list()[0]?.repo).toBe('celilo/caddy');
+  });
+});

package/registry-server/src/scoped-token-store.ts

@@ -0,0 +1,110 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { hashToken } from './auth';
+
+/**
+ * Persisted store of minted, package-scoped publish tokens (build-bus Phase 3,
+ * ISS-0140). The `registry_publish` capability mints one token per registered
+ * repo, scoped to the single package that repo publishes — so a compromised
+ * runner can ship only its own module, never another.
+ *
+ * Only the token HASH is persisted (never cleartext) — the raw token is returned
+ * exactly once at mint time, for the caller to set as the repo's Forgejo Actions
+ * secret. At startup the server loads this store into its {@link TokenAuth} via
+ * `addHashed`; mint/revoke update both the in-memory auth and this file, so a
+ * minted token works without a server restart.
+ */
+
+export interface ScopedTokenEntry {
+  /** SHA-256 of the raw token. */
+  hash: string;
+  /** Package this token may publish. */
+  scope: string;
+  /** Repo path on the source forge this token was minted for (the reconcile key). */
+  repo: string;
+  /** ISO timestamp of mint. */
+  mintedAt: string;
+}
+
+export interface MintResult {
+  /** The raw token — returned ONCE; never persisted in cleartext. */
+  token: string;
+  entry: ScopedTokenEntry;
+  /** Hashes of tokens this mint superseded for the same repo (revoke them in auth). */
+  revokedHashes: string[];
+}
+
+/** I/O seam (Rule 2.3) so the store is unit-testable without the filesystem. */
+export interface ScopedTokenPersistence {
+  load(): ScopedTokenEntry[];
+  save(entries: ScopedTokenEntry[]): void;
+}
+
+/** File-backed persistence: a JSON array at `filePath`, tolerant of a missing file. */
+export function fileScopedTokenPersistence(filePath: string): ScopedTokenPersistence {
+  return {
+    load() {
+      if (!existsSync(filePath)) return [];
+      try {
+        const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+        return Array.isArray(parsed) ? (parsed as ScopedTokenEntry[]) : [];
+      } catch {
+        return [];
+      }
+    },
+    save(entries) {
+      mkdirSync(dirname(filePath), { recursive: true });
+      writeFileSync(filePath, JSON.stringify(entries, null, 2));
+    },
+  };
+}
+
+function defaultGenToken(): string {
+  return `cpt_${randomBytes(32).toString('base64url')}`;
+}
+
+export class ScopedTokenStore {
+  private entries: ScopedTokenEntry[];
+
+  constructor(
+    private readonly persistence: ScopedTokenPersistence,
+    private readonly genToken: () => string = defaultGenToken,
+    private readonly now: () => string = () => new Date().toISOString(),
+  ) {
+    this.entries = persistence.load();
+  }
+
+  list(): ScopedTokenEntry[] {
+    return [...this.entries];
+  }
+
+  /**
+   * Mint a fresh scoped token for `repo`, reconciling: any existing token for the
+   * same repo is superseded (its hash returned in `revokedHashes`). Idempotent at
+   * the repo level — re-running rotates the token cleanly.
+   */
+  mint(repo: string, scope: string): MintResult {
+    const revokedHashes = this.entries.filter((e) => e.repo === repo).map((e) => e.hash);
+    const token = this.genToken();
+    const entry: ScopedTokenEntry = {
+      hash: hashToken(token),
+      scope,
+      repo,
+      mintedAt: this.now(),
+    };
+    this.entries = [...this.entries.filter((e) => e.repo !== repo), entry];
+    this.persistence.save(this.entries);
+    return { token, entry, revokedHashes };
+  }
+
+  /** Revoke all tokens for `repo`. Returns the removed hashes. */
+  revoke(repo: string): string[] {
+    const removed = this.entries.filter((e) => e.repo === repo).map((e) => e.hash);
+    if (removed.length > 0) {
+      this.entries = this.entries.filter((e) => e.repo !== repo);
+      this.persistence.save(this.entries);
+    }
+    return removed;
+  }
+}