@celilo/e2e 0.9.3 → 0.10.2

package/registry-server/src/server.test.ts

@@ -0,0 +1,771 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ADMIN_SCOPE, TokenAuth } from './auth';
+import { IntrospectionVerifier } from './introspection';
+import { createRateLimiter } from './rate-limit';
+import { startServer } from './server';
+
+let dataDir: string;
+let server: ReturnType<typeof startServer> | null = null;
+let baseUrl: string;
+
+beforeEach(() => {
+  dataDir = mkdtempSync(join(tmpdir(), 'celilo-registry-server-test-'));
+  server = startServer({
+    dataDir,
+    port: 0, // let Bun pick an ephemeral port
+    pathPrefix: '',
+    publicUrl: 'https://example.test',
+    auth: new TokenAuth([{ token: 'valid-token', scope: ADMIN_SCOPE }]),
+  });
+  baseUrl = `http://localhost:${server.port}`;
+});
+
+afterEach(() => {
+  server?.stop();
+  server = null;
+  rmSync(dataDir, { recursive: true, force: true });
+});
+
+// ── landing-page polite-301 ──────────────────────────────────────────────────
+// See apps/celilo/designs/REGISTRY_BROWSE_UI.md (decision D2). The bare
+// registry root redirects to /modules/ on the same origin (the celilo.computer
+// site), with a minimal HTML body for clients that don't follow redirects.
+
+describe('GET / (landing page)', () => {
+  test('returns 301 with Location → /modules/ and HTML body', async () => {
+    const res = await fetch(`${baseUrl}/`, { redirect: 'manual' });
+    expect(res.status).toBe(301);
+    expect(res.headers.get('location')).toBe('https://example.test/modules/');
+    expect(res.headers.get('content-type')).toMatch(/text\/html/);
+    const body = await res.text();
+    expect(body).toContain('Celilo Module Registry');
+    expect(body).toContain('https://example.test/modules/');
+    expect(body).toContain('curl -fsSL https://example.test/install.sh | bash');
+  });
+
+  test('/index.html behaves the same as /', async () => {
+    const res = await fetch(`${baseUrl}/index.html`, { redirect: 'manual' });
+    expect(res.status).toBe(301);
+    expect(res.headers.get('location')).toBe('https://example.test/modules/');
+  });
+});
+
+// ── sparse index config ──────────────────────────────────────────────────────
+
+describe('GET /index/config.json', () => {
+  test('returns dl + api pointing at publicUrl', async () => {
+    const res = await fetch(`${baseUrl}/index/config.json`);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { dl: string; api: string };
+    expect(body.dl).toBe('https://example.test/api/v1/modules/{name}/{version}/download');
+    expect(body.api).toBe('https://example.test');
+  });
+});
+
+// ── sparse index path routing ─────────────────────────────────────────────────
+
+describe('GET /index/{path}/{name}', () => {
+  test('404 for unknown module', async () => {
+    const res = await fetch(`${baseUrl}/index/ho/me/homebridge`);
+    expect(res.status).toBe(404);
+  });
+
+  test('returns NDJSON for a published module', async () => {
+    // Publish first so we have something in the index
+    const publishRes = await publish('homebridge', '1.0.0+1', 'valid-token');
+    expect(publishRes.status).toBe(200);
+
+    const res = await fetch(`${baseUrl}/index/ho/me/homebridge`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toContain('text/plain');
+    const body = await res.text();
+    const lines = body.trim().split('\n');
+    expect(lines).toHaveLength(1);
+    const entry = JSON.parse(lines[0]) as { name: string; vers: string; cksum: string };
+    expect(entry.name).toBe('homebridge');
+    expect(entry.vers).toBe('1.0.0+1');
+    expect(entry.cksum).toMatch(/^sha256:[0-9a-f]{64}$/);
+  });
+});
+
+// ── publish ──────────────────────────────────────────────────────────────────
+
+describe('PUT /api/v1/modules/new', () => {
+  test('401 without token', async () => {
+    const res = await publish('homebridge', '1.0.0+1', '');
+    expect(res.status).toBe(401);
+  });
+
+  test('401 with wrong token', async () => {
+    const res = await publish('homebridge', '1.0.0+1', 'wrong');
+    expect(res.status).toBe(401);
+  });
+
+  test('200 with valid token, stores + indexes', async () => {
+    const res = await publish('homebridge', '1.0.0+1', 'valid-token');
+    expect(res.status).toBe(200);
+
+    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) => r.json())) as {
+      name: string;
+      versions: { num: string }[];
+    };
+    expect(meta.name).toBe('homebridge');
+    expect(meta.versions).toHaveLength(1);
+    expect(meta.versions[0].num).toBe('1.0.0+1');
+  });
+
+  test('409 on duplicate version', async () => {
+    const first = await publish('homebridge', '1.0.0+1', 'valid-token');
+    expect(first.status).toBe(200);
+    const second = await publish('homebridge', '1.0.0+1', 'valid-token');
+    expect(second.status).toBe(409);
+  });
+
+  test('400 on invalid module name (uppercase / underscore)', async () => {
+    const res1 = await publish('MyModule', '1.0.0+1', 'valid-token');
+    expect(res1.status).toBe(400);
+    const res2 = await publish('my_module', '1.0.0+1', 'valid-token');
+    expect(res2.status).toBe(400);
+  });
+
+  test('400 on path-traversal name', async () => {
+    const res = await publish('../etc', '1.0.0+1', 'valid-token');
+    expect(res.status).toBe(400);
+  });
+
+  test('400 on invalid version (freeform string)', async () => {
+    const res = await publish('homebridge', '1.0.0', 'valid-token');
+    expect(res.status).toBe(400);
+  });
+
+  test('400 on path-traversal version', async () => {
+    // Blocks the #1 CRITICAL attack: token-holder with malicious vers trying
+    // to escape the data dir via fs.writeFileSync path normalization.
+    const res = await publish('homebridge', '../../../etc/cron.d/evil', 'valid-token');
+    expect(res.status).toBe(400);
+  });
+
+  test('413 when metadata length exceeds the cap', async () => {
+    // Craft a body that declares a huge metadata length (120KB > 64KB cap).
+    const name = 'homebridge';
+    const vers = '1.0.0+1';
+    const fattenedMeta = JSON.stringify({ name, vers, pad: 'x'.repeat(120_000) });
+    const meta = Buffer.from(fattenedMeta, 'utf-8');
+    const file = Buffer.from('fake netapp bytes');
+    const metaLen = Buffer.alloc(4);
+    metaLen.writeUInt32LE(meta.length, 0);
+    const fileLen = Buffer.alloc(4);
+    fileLen.writeUInt32LE(file.length, 0);
+    const body = Buffer.concat([metaLen, meta, fileLen, file]);
+
+    const res = await fetch(`${baseUrl}/api/v1/modules/new`, {
+      method: 'PUT',
+      headers: { Authorization: 'valid-token' },
+      body,
+    });
+    expect(res.status).toBe(413);
+  });
+
+  // Not exercising the Content-Length header check in a unit test — Bun's
+  // fetch computes its own Content-Length and ignores the caller's override,
+  // so we can't realistically lie about body size from the client side here.
+  // The header-based early rejection still helps against clients that honor
+  // user-supplied headers (curl, Python requests, etc.) and is covered by
+  // manual verification / reading the code.
+});
+
+// ── search ───────────────────────────────────────────────────────────────────
+
+describe('GET /api/v1/modules (search)', () => {
+  test('returns published modules with their captured description', async () => {
+    // Phase 2 step 0 — description from manifest is round-tripped through
+    // the publish payload into storage, then surfaced in the search response.
+    const pub = await publish(
+      'homebridge',
+      '1.0.0+1',
+      'valid-token',
+      'Apple HomeKit bridge for non-HomeKit devices',
+    );
+    expect(pub.status).toBe(200);
+
+    const res = await fetch(`${baseUrl}/api/v1/modules`);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      modules: Array<{ name: string; max_version: string; description: string }>;
+      total: number;
+    };
+    const found = body.modules.find((m) => m.name === 'homebridge');
+    expect(found).toBeTruthy();
+    expect(found?.max_version).toBe('1.0.0+1');
+    expect(found?.description).toBe('Apple HomeKit bridge for non-HomeKit devices');
+  });
+
+  test('returns empty description for publishes that omit it', async () => {
+    // Backwards-compat — pre-Phase-2 publishes don't include description
+    // and must still round-trip cleanly with description: ''.
+    const pub = await publish('homebridge', '1.0.0+1', 'valid-token');
+    expect(pub.status).toBe(200);
+
+    const res = await fetch(`${baseUrl}/api/v1/modules`);
+    const body = (await res.json()) as {
+      modules: Array<{ name: string; description: string }>;
+    };
+    const found = body.modules.find((m) => m.name === 'homebridge');
+    expect(found?.description).toBe('');
+  });
+
+  test('total_downloads reflects actual download count, sort=downloads orders by it', async () => {
+    // Publish two modules, hit one's download endpoint several times.
+    // The search response should show those counts and sort=downloads
+    // should put the more-downloaded one first.
+    expect((await publish('alpha', '1.0.0+1', 'valid-token')).status).toBe(200);
+    expect((await publish('bravo', '1.0.0+1', 'valid-token')).status).toBe(200);
+
+    for (let i = 0; i < 3; i++) {
+      const r = await fetch(`${baseUrl}/api/v1/modules/alpha/1.0.0+1/download`);
+      expect(r.status).toBe(200);
+    }
+    const r = await fetch(`${baseUrl}/api/v1/modules/bravo/1.0.0+1/download`);
+    expect(r.status).toBe(200);
+
+    // Default sort: alphabetical; counts reflect downloads.
+    const def = (await fetch(`${baseUrl}/api/v1/modules`).then((r) => r.json())) as {
+      modules: Array<{ name: string; total_downloads: number }>;
+    };
+    const alpha = def.modules.find((m) => m.name === 'alpha');
+    const bravo = def.modules.find((m) => m.name === 'bravo');
+    expect(alpha?.total_downloads).toBe(3);
+    expect(bravo?.total_downloads).toBe(1);
+
+    // sort=downloads: alpha (3) before bravo (1).
+    const byDl = (await fetch(`${baseUrl}/api/v1/modules?sort=downloads`).then((r) =>
+      r.json(),
+    )) as { modules: Array<{ name: string }> };
+    const idxAlpha = byDl.modules.findIndex((m) => m.name === 'alpha');
+    const idxBravo = byDl.modules.findIndex((m) => m.name === 'bravo');
+    expect(idxAlpha).toBeGreaterThanOrEqual(0);
+    expect(idxBravo).toBeGreaterThanOrEqual(0);
+    expect(idxAlpha).toBeLessThan(idxBravo);
+  });
+});
+
+// ── per-module metadata download count ───────────────────────────────────────
+
+describe('GET /api/v1/modules/{name} (metadata) — total_downloads', () => {
+  test('returns the same count as the search endpoint', async () => {
+    expect((await publish('homebridge', '1.0.0+1', 'valid-token')).status).toBe(200);
+    await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
+    await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
+
+    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) => r.json())) as {
+      name: string;
+      total_downloads: number;
+    };
+    expect(meta.total_downloads).toBe(2);
+  });
+});
+
+// ── path-traversal on GET endpoints ──────────────────────────────────────────
+
+describe('GET endpoints reject traversal attempts', () => {
+  // These verify the HIGH-severity fix: `name` / `version` from URL segments
+  // can't reach the storage layer if they aren't valid module identifiers.
+
+  test.each([
+    '/index/..%2F..%2Fetc',
+    '/index/ho/me/..%2Fpasswd',
+    '/api/v1/modules/..%2F..%2Fetc',
+    '/api/v1/modules/..%2F..%2Fetc/1.0.0+1/download',
+    '/api/v1/modules/homebridge/..%2F..%2Fetc/download',
+    '/api/v1/modules/homebridge/1.0.0+1%2F..%2F..%2Fetc/download',
+  ])('404 for %s', async (path) => {
+    const res = await fetch(`${baseUrl}${path}`);
+    expect(res.status).toBe(404);
+  });
+
+  test('DELETE yank with traversal is rejected (401 before 404 is fine)', async () => {
+    const res = await fetch(`${baseUrl}/api/v1/modules/..%2Fetc/1.0.0+1/yank`, {
+      method: 'DELETE',
+      headers: { Authorization: 'valid-token' },
+    });
+    expect([401, 404]).toContain(res.status);
+    expect(res.status).not.toBe(200);
+  });
+});
+
+// ── download ─────────────────────────────────────────────────────────────────
+
+describe('GET /api/v1/modules/{name}/{version}/download', () => {
+  test('returns stored bytes after publish', async () => {
+    await publish('homebridge', '1.0.0+1', 'valid-token');
+    const res = await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toBe('application/octet-stream');
+    const body = await res.arrayBuffer();
+    expect(Buffer.from(body).toString()).toBe('fake netapp bytes');
+  });
+
+  test('404 for unknown version', async () => {
+    const res = await fetch(`${baseUrl}/api/v1/modules/homebridge/9.9.9+1/download`);
+    expect(res.status).toBe(404);
+  });
+});
+
+// ── yank / unyank ────────────────────────────────────────────────────────────
+
+describe('DELETE /yank, PUT /unyank', () => {
+  test('yank requires auth and flips the yanked flag', async () => {
+    await publish('homebridge', '1.0.0+1', 'valid-token');
+
+    const unauth = await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/yank`, {
+      method: 'DELETE',
+    });
+    expect(unauth.status).toBe(401);
+
+    const res = await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/yank`, {
+      method: 'DELETE',
+      headers: { Authorization: 'valid-token' },
+    });
+    expect(res.status).toBe(200);
+
+    const indexRes = await fetch(`${baseUrl}/index/ho/me/homebridge`);
+    const entry = JSON.parse((await indexRes.text()).trim()) as { yanked: boolean };
+    expect(entry.yanked).toBe(true);
+  });
+});
+
+// ── rate limiting ────────────────────────────────────────────────────────────
+
+describe('write endpoints are rate limited', () => {
+  test('429 with Retry-After once the per-IP budget is spent', async () => {
+    const tightDataDir = mkdtempSync(join(tmpdir(), 'celilo-registry-rl-'));
+    const tight = startServer({
+      dataDir: tightDataDir,
+      port: 0,
+      pathPrefix: '',
+      publicUrl: 'https://example.test',
+      auth: new TokenAuth([{ token: 'tok', scope: ADMIN_SCOPE }]),
+      rateLimiter: createRateLimiter({ max: 2, windowMs: 60_000 }),
+    });
+    try {
+      const b = `http://localhost:${tight.port}`;
+      // Send 3 unauthenticated publishes — first two return 401 (past the
+      // rate-limit gate), third trips the limiter → 429. Using 401 here is
+      // fine because the rate-limiter runs BEFORE auth, by design.
+      const mkBody = () => {
+        const meta = Buffer.from(JSON.stringify({ name: 'x', vers: '1.0.0+1' }), 'utf-8');
+        const file = Buffer.from('f');
+        const metaLen = Buffer.alloc(4);
+        metaLen.writeUInt32LE(meta.length, 0);
+        const fileLen = Buffer.alloc(4);
+        fileLen.writeUInt32LE(file.length, 0);
+        return Buffer.concat([metaLen, meta, fileLen, file]);
+      };
+      const call = () => fetch(`${b}/api/v1/modules/new`, { method: 'PUT', body: mkBody() });
+
+      const r1 = await call();
+      expect(r1.status).toBe(401);
+      const r2 = await call();
+      expect(r2.status).toBe(401);
+      const r3 = await call();
+      expect(r3.status).toBe(429);
+      expect(r3.headers.get('Retry-After')).not.toBeNull();
+    } finally {
+      tight.stop();
+      rmSync(tightDataDir, { recursive: true, force: true });
+    }
+  });
+});
+
+// ── path prefix ──────────────────────────────────────────────────────────────
+
+describe('path prefix routing', () => {
+  test('requests under /registry are accepted when pathPrefix is /registry', async () => {
+    const prefixed = startServer({
+      dataDir: mkdtempSync(join(tmpdir(), 'celilo-registry-prefix-')),
+      port: 0,
+      pathPrefix: '/registry',
+      publicUrl: 'https://example.test/registry',
+      auth: new TokenAuth([{ token: 'valid-token', scope: ADMIN_SCOPE }]),
+    });
+    try {
+      const base = `http://localhost:${prefixed.port}`;
+      const res = await fetch(`${base}/registry/index/config.json`);
+      expect(res.status).toBe(200);
+      const nope = await fetch(`${base}/index/config.json`);
+      expect(nope.status).toBe(404);
+    } finally {
+      prefixed.stop();
+    }
+  });
+});
+
+// ── scoped publish tokens (ISS-0140) ──────────────────────────────────────────
+
+describe('POST /api/v1/modules/tokens/mint + scoped publish', () => {
+  async function mint(repo: string, scope: string, token: string): Promise<Response> {
+    return fetch(`${baseUrl}/api/v1/modules/tokens/mint`, {
+      method: 'POST',
+      headers: token ? { Authorization: token, 'Content-Type': 'application/json' } : {},
+      body: JSON.stringify({ repo, scope }),
+    });
+  }
+
+  test('admin token mints a scoped token; non-admin / no token is 401', async () => {
+    const noTok = await mint('celilo/lunacycle', 'lunacycle', '');
+    expect(noTok.status).toBe(401);
+
+    const ok = await mint('celilo/lunacycle', 'lunacycle', 'valid-token');
+    expect(ok.status).toBe(200);
+    const body = (await ok.json()) as { ok: boolean; token: string; scope: string };
+    expect(body.ok).toBe(true);
+    expect(body.scope).toBe('lunacycle');
+    expect(body.token.length).toBeGreaterThan(10);
+  });
+
+  test('a minted scoped token publishes ONLY its package', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+
+    // Can publish its own package…
+    const ok = await publish('lunacycle', '1.0.0+1', minted.token);
+    expect(ok.status).toBe(200);
+
+    // …but NOT another module.
+    const denied = await publish('caddy', '1.0.0+1', minted.token);
+    expect(denied.status).toBe(401);
+  });
+
+  test('a scoped token cannot mint (not admin)', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const reMint = await mint('celilo/caddy', 'caddy', minted.token);
+    expect(reMint.status).toBe(401);
+  });
+
+  test('re-minting rotates: the old token stops working, the new one publishes', async () => {
+    const first = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const second = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    expect(second.token).not.toBe(first.token);
+
+    const oldDenied = await publish('lunacycle', '2.0.0+1', first.token);
+    expect(oldDenied.status).toBe(401);
+    const newOk = await publish('lunacycle', '2.0.0+1', second.token);
+    expect(newOk.status).toBe(200);
+  });
+
+  test('revoke disables the token', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const revoke = await fetch(`${baseUrl}/api/v1/modules/tokens/revoke`, {
+      method: 'POST',
+      headers: { Authorization: 'valid-token', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ repo: 'celilo/lunacycle' }),
+    });
+    expect(revoke.status).toBe(200);
+    const denied = await publish('lunacycle', '1.0.0+1', minted.token);
+    expect(denied.status).toBe(401);
+  });
+
+  test('mint rejects an invalid scope (not a valid package name)', async () => {
+    const res = await mint('celilo/lunacycle', 'Bad_Scope', 'valid-token');
+    expect(res.status).toBe(400);
+  });
+});
+
+// ─── helpers ──────────────────────────────────────────────────────────────────
+
+async function publish(
+  name: string,
+  vers: string,
+  token: string,
+  description?: string,
+): Promise<Response> {
+  const meta = Buffer.from(
+    JSON.stringify({ name, vers, ...(description ? { description } : {}) }),
+    'utf-8',
+  );
+  const file = Buffer.from('fake netapp bytes');
+  const metaLen = Buffer.alloc(4);
+  metaLen.writeUInt32LE(meta.length, 0);
+  const fileLen = Buffer.alloc(4);
+  fileLen.writeUInt32LE(file.length, 0);
+  const body = Buffer.concat([metaLen, meta, fileLen, file]);
+
+  return fetch(`${baseUrl}/api/v1/modules/new`, {
+    method: 'PUT',
+    headers: token ? { Authorization: token } : {},
+    body,
+  });
+}
+
+// ── idp introspection verify-bridge (ce-s7e) ─────────────────────────────────
+// The real publish path with an idp identity token: the token is unknown to
+// the opaque set, so authorizePackage() verifies it via RFC 7662 introspection
+// against the idp. A fake idp server stands in for authentik; revoking a token
+// there (active:false) denies the next publish.
+
+describe('publish via idp introspection (ce-s7e)', () => {
+  let idp: ReturnType<typeof Bun.serve> | null = null;
+  let idpServer: ReturnType<typeof startServer> | null = null;
+  let idpDataDir: string;
+  let idpBaseUrl: string;
+  // token → introspection claims the fake idp reports for it.
+  const claimsByToken = new Map<string, Record<string, unknown>>();
+
+  beforeEach(() => {
+    claimsByToken.clear();
+    idp = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        const form = new URLSearchParams(await req.text());
+        const token = form.get('token') ?? '';
+        const claims = claimsByToken.get(token) ?? { active: false };
+        return Response.json(claims);
+      },
+    });
+    idpDataDir = mkdtempSync(join(tmpdir(), 'celilo-registry-idp-test-'));
+    idpServer = startServer({
+      dataDir: idpDataDir,
+      port: 0,
+      pathPrefix: '',
+      publicUrl: 'https://example.test',
+      // Opaque admin token still works → backward-compat coverage below.
+      auth: new TokenAuth([{ token: 'opaque-admin', scope: ADMIN_SCOPE }]),
+      introspection: new IntrospectionVerifier({
+        endpoint: `http://localhost:${idp.port}/introspect`,
+        clientId: 'celilo-registry',
+        clientSecret: 'sec',
+        adminGroup: 'celilo-admins',
+        publisherGroup: 'celilo-authors',
+      }),
+    });
+    idpBaseUrl = `http://localhost:${idpServer.port}`;
+  });
+
+  afterEach(() => {
+    idpServer?.stop();
+    idpServer = null;
+    idp?.stop();
+    idp = null;
+    rmSync(idpDataDir, { recursive: true, force: true });
+  });
+
+  function publishTo(token: string, name = 'homebridge', vers = '1.0.0+1'): Promise<Response> {
+    const meta = Buffer.from(JSON.stringify({ name, vers }), 'utf-8');
+    const file = Buffer.from('fake netapp bytes');
+    const metaLen = Buffer.alloc(4);
+    metaLen.writeUInt32LE(meta.length, 0);
+    const fileLen = Buffer.alloc(4);
+    fileLen.writeUInt32LE(file.length, 0);
+    const body = Buffer.concat([metaLen, meta, fileLen, file]);
+    return fetch(`${idpBaseUrl}/api/v1/modules/new`, {
+      method: 'PUT',
+      headers: { Authorization: `Bearer ${token}` },
+      body,
+    });
+  }
+
+  test('active idp token (admin group) authorizes publish', async () => {
+    claimsByToken.set('idp-tok', { active: true, sub: 'alice', groups: ['celilo-admins'] });
+    const res = await publishTo('idp-tok');
+    expect(res.status).toBe(200);
+  });
+
+  test('active idp token not in admin group → 401', async () => {
+    claimsByToken.set('idp-tok', { active: true, sub: 'bob', groups: ['users'] });
+    const res = await publishTo('idp-tok');
+    expect(res.status).toBe(401);
+  });
+
+  test('revoked-at-idp (active:false) → next publish denied 401', async () => {
+    claimsByToken.set('idp-tok', { active: true, groups: ['celilo-admins'] });
+    expect((await publishTo('idp-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    // Revoke at the idp — the token is now inactive.
+    claimsByToken.set('idp-tok', { active: false });
+    expect((await publishTo('idp-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
+  });
+
+  test('opaque publish token still works (backward compat)', async () => {
+    const res = await publishTo('opaque-admin');
+    // 'opaque-admin' is the raw token; it authorizes via the local set,
+    // never touching introspection.
+    expect(res.status).toBe(200);
+  });
+
+  test('idp down (introspection throws) → fails closed 401', async () => {
+    idp?.stop();
+    idp = null;
+    claimsByToken.set('idp-tok', { active: true, groups: ['celilo-admins'] });
+    const res = await publishTo('idp-tok');
+    expect(res.status).toBe(401);
+  });
+});
+
+// ── module-owner table: hybrid group + owner authorization (ce-1ch) ──────────
+// A verified idp publisher may publish only module names it owns. The first
+// verified publisher of an unclaimed name claims it (first-publish-claims);
+// another publisher is then DENIED (confused-deputy defense). Admins publish or
+// reassign anything.
+
+describe('module-owner authorization (ce-1ch)', () => {
+  let idp: ReturnType<typeof Bun.serve> | null = null;
+  let srv: ReturnType<typeof startServer> | null = null;
+  let dir: string;
+  let url: string;
+  const claimsByToken = new Map<string, Record<string, unknown>>();
+
+  beforeEach(() => {
+    claimsByToken.clear();
+    idp = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        const form = new URLSearchParams(await req.text());
+        const token = form.get('token') ?? '';
+        return Response.json(claimsByToken.get(token) ?? { active: false });
+      },
+    });
+    dir = mkdtempSync(join(tmpdir(), 'celilo-registry-owner-test-'));
+    srv = startServer({
+      dataDir: dir,
+      port: 0,
+      pathPrefix: '',
+      publicUrl: 'https://example.test',
+      auth: new TokenAuth([{ token: 'opaque-admin', scope: ADMIN_SCOPE }]),
+      introspection: new IntrospectionVerifier({
+        endpoint: `http://localhost:${idp.port}/introspect`,
+        clientId: 'celilo-registry',
+        clientSecret: 'sec',
+        adminGroup: 'celilo-admins',
+        publisherGroup: 'celilo-authors',
+      }),
+    });
+    url = `http://localhost:${srv.port}`;
+  });
+
+  afterEach(() => {
+    srv?.stop();
+    srv = null;
+    idp?.stop();
+    idp = null;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  function publish(token: string, name: string, vers: string): Promise<Response> {
+    const meta = Buffer.from(JSON.stringify({ name, vers }), 'utf-8');
+    const file = Buffer.from('fake netapp bytes');
+    const metaLen = Buffer.alloc(4);
+    metaLen.writeUInt32LE(meta.length, 0);
+    const fileLen = Buffer.alloc(4);
+    fileLen.writeUInt32LE(file.length, 0);
+    const body = Buffer.concat([metaLen, meta, fileLen, file]);
+    return fetch(`${url}/api/v1/modules/new`, {
+      method: 'PUT',
+      headers: { Authorization: `Bearer ${token}` },
+      body,
+    });
+  }
+
+  test('publisher claims an unclaimed name on first publish', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    // The owner endpoint (admin) now shows alice owns it.
+    const res = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
+      headers: { Authorization: 'Bearer opaque-admin' },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { owner: { ownerSub: string; sourceGroup: string } };
+    expect(body.owner.ownerSub).toBe('alice');
+    expect(body.owner.sourceGroup).toBe('celilo-authors');
+  });
+
+  test('owner may publish more versions of a name it owns', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+2')).status).toBe(200);
+  });
+
+  test('CONFUSED DEPUTY: a different publisher cannot publish someone else’s name', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    claimsByToken.set('bob-tok', { active: true, sub: 'bob', groups: ['celilo-authors'] });
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    // Bob is a valid publisher but does NOT own homebridge → denied.
+    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
+  });
+
+  test('an identity in neither publish group is denied even when verified', async () => {
+    claimsByToken.set('carol-tok', { active: true, sub: 'carol', groups: ['users'] });
+    expect((await publish('carol-tok', 'anything', '1.0.0+1')).status).toBe(401);
+  });
+
+  test('admin group may publish any name and claims it', async () => {
+    claimsByToken.set('admin-tok', { active: true, sub: 'ops', groups: ['celilo-admins'] });
+    expect((await publish('admin-tok', 'caddy', '1.0.0+1')).status).toBe(200);
+    const res = await fetch(`${url}/api/v1/modules/owners/caddy`, {
+      headers: { Authorization: 'Bearer opaque-admin' },
+    });
+    expect((await res.json() as { owner: { ownerSub: string } }).owner.ownerSub).toBe('ops');
+  });
+
+  test('admin reassign lets a new owner publish the name', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    claimsByToken.set('bob-tok', { active: true, sub: 'bob', groups: ['celilo-authors'] });
+    expect((await publish('alice-tok', 'homebridge', '1.0.0+1')).status).toBe(200);
+    // Bob denied before reassignment.
+    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(401);
+    // Admin reassigns homebridge to bob.
+    const reassign = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
+      method: 'POST',
+      headers: { Authorization: 'Bearer opaque-admin', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ownerSub: 'bob' }),
+    });
+    expect(reassign.status).toBe(200);
+    // Now bob may publish.
+    expect((await publish('bob-tok', 'homebridge', '1.0.0+2')).status).toBe(200);
+  });
+
+  test('owner list endpoint requires admin', async () => {
+    const anon = await fetch(`${url}/api/v1/modules/owners`);
+    expect(anon.status).toBe(401);
+    const ok = await fetch(`${url}/api/v1/modules/owners`, {
+      headers: { Authorization: 'Bearer opaque-admin' },
+    });
+    expect(ok.status).toBe(200);
+    expect((await ok.json() as { owners: unknown[] }).owners).toEqual([]);
+  });
+
+  test('owner reassign requires admin (a plain publisher cannot)', async () => {
+    claimsByToken.set('alice-tok', { active: true, sub: 'alice', groups: ['celilo-authors'] });
+    const res = await fetch(`${url}/api/v1/modules/owners/homebridge`, {
+      method: 'POST',
+      headers: { Authorization: 'Bearer alice-tok', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ownerSub: 'alice' }),
+    });
+    expect(res.status).toBe(401);
+  });
+
+  test('owner show for an unclaimed name → 404', async () => {
+    const res = await fetch(`${url}/api/v1/modules/owners/never-claimed`, {
+      headers: { Authorization: 'Bearer opaque-admin' },
+    });
+    expect(res.status).toBe(404);
+  });
+
+  test('an idp admin token may drive the owner endpoints too', async () => {
+    claimsByToken.set('admin-tok', { active: true, sub: 'ops', groups: ['celilo-admins'] });
+    const res = await fetch(`${url}/api/v1/modules/owners`, {
+      headers: { Authorization: 'Bearer admin-tok' },
+    });
+    expect(res.status).toBe(200);
+  });
+});