@claude-flow/security 3.0.0-alpha.1 → 3.0.0-alpha.11

package/__tests__/keychain-adapter.test.ts

@@ -0,0 +1,60 @@
+/**
+ * Keychain adapter tests. `SessionOnlyKeychainAdapter` is fully covered
+ * offline (no native backend needed). `createKeychainAdapter()`'s native
+ * path is exercised only behind a real `isAvailable()` canary probe — CI
+ * environments with no reachable keychain backend skip gracefully rather
+ * than faking success, per ADR-306's degrade-to-session-only contract.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { createKeychainAdapter, SessionOnlyKeychainAdapter } from '../src/keychain-adapter.js';
+
+describe('SessionOnlyKeychainAdapter', () => {
+  it('round-trips a secret in memory', async () => {
+    const adapter = new SessionOnlyKeychainAdapter();
+    await adapter.setSecret('svc', 'acct', 'topsecret');
+    expect(await adapter.getSecret('svc', 'acct')).toBe('topsecret');
+  });
+
+  it('returns null for a secret that was never set', async () => {
+    const adapter = new SessionOnlyKeychainAdapter();
+    expect(await adapter.getSecret('svc', 'nobody')).toBeNull();
+  });
+
+  it('deletes a secret', async () => {
+    const adapter = new SessionOnlyKeychainAdapter();
+    await adapter.setSecret('svc', 'acct', 'topsecret');
+    await adapter.deleteSecret('svc', 'acct');
+    expect(await adapter.getSecret('svc', 'acct')).toBeNull();
+  });
+
+  it('is always available', async () => {
+    expect(await new SessionOnlyKeychainAdapter().isAvailable()).toBe(true);
+  });
+
+  it('keeps distinct (service, account) pairs isolated', async () => {
+    const adapter = new SessionOnlyKeychainAdapter();
+    await adapter.setSecret('svc-a', 'acct', 'secret-a');
+    await adapter.setSecret('svc-b', 'acct', 'secret-b');
+    expect(await adapter.getSecret('svc-a', 'acct')).toBe('secret-a');
+    expect(await adapter.getSecret('svc-b', 'acct')).toBe('secret-b');
+  });
+});
+
+describe('createKeychainAdapter', () => {
+  it('resolves to an adapter that is always available (native or session-only fallback)', async () => {
+    const adapter = await createKeychainAdapter();
+    expect(await adapter.isAvailable()).toBe(true);
+  });
+
+  it('round-trips a canary secret through whatever backend was selected', async () => {
+    const adapter = await createKeychainAdapter();
+    const account = `ruflo-test-${Date.now()}`;
+    await adapter.setSecret('ruflo-security-test', account, 'round-trip-value');
+    try {
+      expect(await adapter.getSecret('ruflo-security-test', account)).toBe('round-trip-value');
+    } finally {
+      await adapter.deleteSecret('ruflo-security-test', account);
+    }
+  });
+});

package/__tests__/oauth-browser.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+import { browserCommand } from '../src/oauth/browser.js';
+
+describe('OAuth browser launcher', () => {
+  it('preserves the complete OAuth query string on Windows without cmd.exe', () => {
+    const url = 'https://auth.cognitum.one/oauth/authorize?response_type=code&client_id=meta-proxy&state=test';
+    const launch = browserCommand(url, 'win32');
+
+    expect(launch.cmd).toBe('rundll32.exe');
+    expect(launch.args).toEqual(['url.dll,FileProtocolHandler', url]);
+    expect(launch.args[1]).toContain('&client_id=meta-proxy&');
+  });
+});

package/__tests__/oauth-export-surface.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import * as security from '../src/index.js';
+
+describe('OAuth public export surface', () => {
+  it('exports every primitive required by ruflo auth', () => {
+    for (const name of [
+      'authorizeUrl',
+      'exchangeCode',
+      'refreshToken',
+      'exchangeManualCode',
+      'generatePkce',
+      'CallbackServer',
+      'openBrowser',
+      'createKeychainAdapter',
+      'OAuthError',
+    ] as const) {
+      expect(security[name]).toBeTypeOf('function');
+    }
+    expect(security.OOB_REDIRECT_URI).toBeTypeOf('string');
+  });
+});

package/__tests__/oauth-pkce.test.ts

@@ -0,0 +1,37 @@
+/**
+ * PKCE (RFC 7636) generation tests — the port's correctness check against
+ * the same values meta-proxy's Rust `pkce.rs` test suite verifies.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { generate, challengeFromVerifier } from '../src/oauth/pkce.js';
+
+describe('oauth/pkce', () => {
+  it('generates a verifier within RFC 7636 length bounds (43-128 chars)', () => {
+    const req = generate();
+    expect(req.codeVerifier.length).toBeGreaterThanOrEqual(43);
+    expect(req.codeVerifier.length).toBeLessThanOrEqual(128);
+  });
+
+  it('produces a deterministic challenge for a given verifier', () => {
+    const req = generate();
+    expect(challengeFromVerifier(req.codeVerifier)).toBe(req.codeChallenge);
+  });
+
+  it('never collides across two generations', () => {
+    const a = generate();
+    const b = generate();
+    expect(a.state).not.toBe(b.state);
+    expect(a.codeVerifier).not.toBe(b.codeVerifier);
+    expect(a.codeChallenge).not.toBe(b.codeChallenge);
+  });
+
+  it('matches the RFC 7636 Appendix B worked example', () => {
+    // The exact vector meta-proxy's pkce.rs test suite uses — confirms this
+    // port's encoding (base64url, no padding) and hash (SHA-256) match byte
+    // for byte, since a verifier generated here must validate against the
+    // same identity server meta-proxy already talks to successfully.
+    const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+    expect(challengeFromVerifier(verifier)).toBe('E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM');
+  });
+});

package/__tests__/password-hasher.test.ts

@@ -1,239 +1,239 @@
-/**
- * Password Hasher Tests - CVE-2 Remediation Validation
- *
- * Tests verify:
- * - bcrypt is used instead of SHA-256
- * - 12 rounds minimum
- * - Password validation rules
- * - Timing-safe comparison
- */
-
-import { describe, it, expect, beforeEach } from 'vitest';
-import {
-  PasswordHasher,
-  PasswordHashError,
-  createPasswordHasher,
-} from '../../security/password-hasher.js';
-
-describe('PasswordHasher', () => {
-  let hasher: PasswordHasher;
-
-  beforeEach(() => {
-    hasher = new PasswordHasher({ rounds: 12 });
-  });
-
-  describe('Configuration', () => {
-    it('should create hasher with default 12 rounds', () => {
-      const defaultHasher = new PasswordHasher();
-      expect(defaultHasher.getConfig().rounds).toBe(12);
-    });
-
-    it('should reject rounds below 10', () => {
-      expect(() => new PasswordHasher({ rounds: 8 })).toThrow(PasswordHashError);
-    });
-
-    it('should reject rounds above 20', () => {
-      expect(() => new PasswordHasher({ rounds: 22 })).toThrow(PasswordHashError);
-    });
-
-    it('should reject minimum password length below 8', () => {
-      expect(() => new PasswordHasher({ minLength: 4 })).toThrow(PasswordHashError);
-    });
-  });
-
-  describe('Password Validation', () => {
-    it('should reject empty password', () => {
-      const result = hasher.validate('');
-      expect(result.isValid).toBe(false);
-      expect(result.errors).toContain('Password is required');
-    });
-
-    it('should reject password shorter than minimum', () => {
-      const result = hasher.validate('short');
-      expect(result.isValid).toBe(false);
-      expect(result.errors.some(e => e.includes('at least'))).toBe(true);
-    });
-
-    it('should reject password without uppercase', () => {
-      const result = hasher.validate('password123');
-      expect(result.isValid).toBe(false);
-      expect(result.errors.some(e => e.includes('uppercase'))).toBe(true);
-    });
-
-    it('should reject password without lowercase', () => {
-      const result = hasher.validate('PASSWORD123');
-      expect(result.isValid).toBe(false);
-      expect(result.errors.some(e => e.includes('lowercase'))).toBe(true);
-    });
-
-    it('should reject password without digit', () => {
-      const result = hasher.validate('PasswordNoDigit');
-      expect(result.isValid).toBe(false);
-      expect(result.errors.some(e => e.includes('digit'))).toBe(true);
-    });
-
-    it('should accept valid password', () => {
-      const result = hasher.validate('SecurePass123');
-      expect(result.isValid).toBe(true);
-      expect(result.errors).toHaveLength(0);
-    });
-
-    it('should optionally require special character', () => {
-      const strictHasher = new PasswordHasher({ requireSpecial: true });
-      const result = strictHasher.validate('SecurePass123');
-      expect(result.isValid).toBe(false);
-      expect(result.errors.some(e => e.includes('special'))).toBe(true);
-    });
-
-    it('should accept password with special character when required', () => {
-      const strictHasher = new PasswordHasher({ requireSpecial: true });
-      const result = strictHasher.validate('SecurePass123!');
-      expect(result.isValid).toBe(true);
-    });
-  });
-
-  describe('Password Hashing', () => {
-    it('should hash password with bcrypt', async () => {
-      const hash = await hasher.hash('SecurePass123');
-
-      // bcrypt hashes start with $2a$, $2b$, or $2y$
-      expect(hash).toMatch(/^\$2[aby]\$\d{2}\$/);
-    });
-
-    it('should produce different hashes for same password', async () => {
-      const hash1 = await hasher.hash('SecurePass123');
-      const hash2 = await hasher.hash('SecurePass123');
-
-      expect(hash1).not.toBe(hash2); // Different salts
-    });
-
-    it('should include rounds in hash', async () => {
-      const hash = await hasher.hash('SecurePass123');
-
-      // Hash format: $2b$12$...
-      expect(hash).toContain('$12$');
-    });
-
-    it('should throw for invalid password', async () => {
-      await expect(hasher.hash('short')).rejects.toThrow(PasswordHashError);
-    });
-
-    it('should throw for empty password', async () => {
-      await expect(hasher.hash('')).rejects.toThrow(PasswordHashError);
-    });
-  });
-
-  describe('Password Verification', () => {
-    it('should verify correct password', async () => {
-      const password = 'SecurePass123';
-      const hash = await hasher.hash(password);
-
-      const isValid = await hasher.verify(password, hash);
-      expect(isValid).toBe(true);
-    });
-
-    it('should reject incorrect password', async () => {
-      const hash = await hasher.hash('SecurePass123');
-
-      const isValid = await hasher.verify('WrongPass123', hash);
-      expect(isValid).toBe(false);
-    });
-
-    it('should return false for empty password', async () => {
-      const hash = await hasher.hash('SecurePass123');
-
-      const isValid = await hasher.verify('', hash);
-      expect(isValid).toBe(false);
-    });
-
-    it('should return false for empty hash', async () => {
-      const isValid = await hasher.verify('SecurePass123', '');
-      expect(isValid).toBe(false);
-    });
-
-    it('should return false for invalid hash format', async () => {
-      const isValid = await hasher.verify('SecurePass123', 'invalid-hash');
-      expect(isValid).toBe(false);
-    });
-
-    it('should return false for SHA-256 hash (old format)', async () => {
-      // SHA-256 hash format (what we're replacing)
-      const sha256Hash = 'a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3';
-
-      const isValid = await hasher.verify('password', sha256Hash);
-      expect(isValid).toBe(false);
-    });
-  });
-
-  describe('Rehash Detection', () => {
-    it('should not need rehash for current rounds', async () => {
-      const hash = await hasher.hash('SecurePass123');
-      expect(hasher.needsRehash(hash)).toBe(false);
-    });
-
-    it('should need rehash for lower rounds', () => {
-      // Hash with 10 rounds
-      const lowRoundsHash = '$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy';
-      expect(hasher.needsRehash(lowRoundsHash)).toBe(true);
-    });
-
-    it('should need rehash for invalid format', () => {
-      expect(hasher.needsRehash('invalid-hash')).toBe(true);
-    });
-
-    it('should need rehash for SHA-256 hash', () => {
-      const sha256Hash = 'a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3';
-      expect(hasher.needsRehash(sha256Hash)).toBe(true);
-    });
-  });
-
-  describe('Factory Function', () => {
-    it('should create hasher with specified rounds', () => {
-      const hasher12 = createPasswordHasher(12);
-      expect(hasher12.getConfig().rounds).toBe(12);
-
-      const hasher14 = createPasswordHasher(14);
-      expect(hasher14.getConfig().rounds).toBe(14);
-    });
-
-    it('should use default 12 rounds', () => {
-      const hasher = createPasswordHasher();
-      expect(hasher.getConfig().rounds).toBe(12);
-    });
-  });
-
-  describe('CVE-2 Security Verification', () => {
-    it('should NOT use hardcoded salt', async () => {
-      // Generate multiple hashes and verify they have different salts
-      const hashes = await Promise.all([
-        hasher.hash('SecurePass123'),
-        hasher.hash('SecurePass123'),
-        hasher.hash('SecurePass123'),
-      ]);
-
-      // Extract salts (22 chars after $2b$12$)
-      const salts = hashes.map(h => h.substring(7, 29));
-
-      // All salts should be unique
-      const uniqueSalts = new Set(salts);
-      expect(uniqueSalts.size).toBe(3);
-    });
-
-    it('should NOT produce same hash for same input (unlike SHA-256)', async () => {
-      // SHA-256 with hardcoded salt would produce identical output
-      const hash1 = await hasher.hash('SecurePass123');
-      const hash2 = await hasher.hash('SecurePass123');
-
-      expect(hash1).not.toBe(hash2);
-    });
-
-    it('should produce hash that takes time to compute', async () => {
-      const start = Date.now();
-      await hasher.hash('SecurePass123');
-      const duration = Date.now() - start;
-
-      // bcrypt with 12 rounds should take measurable time (>10ms typically)
-      expect(duration).toBeGreaterThan(5);
-    });
-  });
-});
+/**
+ * Password Hasher Tests - CVE-2 Remediation Validation
+ *
+ * Tests verify:
+ * - bcrypt is used instead of SHA-256
+ * - 12 rounds minimum
+ * - Password validation rules
+ * - Timing-safe comparison
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+  PasswordHasher,
+  PasswordHashError,
+  createPasswordHasher,
+} from '../src/password-hasher.js';
+
+describe('PasswordHasher', () => {
+  let hasher: PasswordHasher;
+
+  beforeEach(() => {
+    hasher = new PasswordHasher({ rounds: 12 });
+  });
+
+  describe('Configuration', () => {
+    it('should create hasher with default 12 rounds', () => {
+      const defaultHasher = new PasswordHasher();
+      expect(defaultHasher.getConfig().rounds).toBe(12);
+    });
+
+    it('should reject rounds below 10', () => {
+      expect(() => new PasswordHasher({ rounds: 8 })).toThrow(PasswordHashError);
+    });
+
+    it('should reject rounds above 20', () => {
+      expect(() => new PasswordHasher({ rounds: 22 })).toThrow(PasswordHashError);
+    });
+
+    it('should reject minimum password length below 8', () => {
+      expect(() => new PasswordHasher({ minLength: 4 })).toThrow(PasswordHashError);
+    });
+  });
+
+  describe('Password Validation', () => {
+    it('should reject empty password', () => {
+      const result = hasher.validate('');
+      expect(result.isValid).toBe(false);
+      expect(result.errors).toContain('Password is required');
+    });
+
+    it('should reject password shorter than minimum', () => {
+      const result = hasher.validate('short');
+      expect(result.isValid).toBe(false);
+      expect(result.errors.some(e => e.includes('at least'))).toBe(true);
+    });
+
+    it('should reject password without uppercase', () => {
+      const result = hasher.validate('password123');
+      expect(result.isValid).toBe(false);
+      expect(result.errors.some(e => e.includes('uppercase'))).toBe(true);
+    });
+
+    it('should reject password without lowercase', () => {
+      const result = hasher.validate('PASSWORD123');
+      expect(result.isValid).toBe(false);
+      expect(result.errors.some(e => e.includes('lowercase'))).toBe(true);
+    });
+
+    it('should reject password without digit', () => {
+      const result = hasher.validate('PasswordNoDigit');
+      expect(result.isValid).toBe(false);
+      expect(result.errors.some(e => e.includes('digit'))).toBe(true);
+    });
+
+    it('should accept valid password', () => {
+      const result = hasher.validate('SecurePass123');
+      expect(result.isValid).toBe(true);
+      expect(result.errors).toHaveLength(0);
+    });
+
+    it('should optionally require special character', () => {
+      const strictHasher = new PasswordHasher({ requireSpecial: true });
+      const result = strictHasher.validate('SecurePass123');
+      expect(result.isValid).toBe(false);
+      expect(result.errors.some(e => e.includes('special'))).toBe(true);
+    });
+
+    it('should accept password with special character when required', () => {
+      const strictHasher = new PasswordHasher({ requireSpecial: true });
+      const result = strictHasher.validate('SecurePass123!');
+      expect(result.isValid).toBe(true);
+    });
+  });
+
+  describe('Password Hashing', () => {
+    it('should hash password with bcrypt', async () => {
+      const hash = await hasher.hash('SecurePass123');
+
+      // bcrypt hashes start with $2a$, $2b$, or $2y$
+      expect(hash).toMatch(/^\$2[aby]\$\d{2}\$/);
+    });
+
+    it('should produce different hashes for same password', async () => {
+      const hash1 = await hasher.hash('SecurePass123');
+      const hash2 = await hasher.hash('SecurePass123');
+
+      expect(hash1).not.toBe(hash2); // Different salts
+    });
+
+    it('should include rounds in hash', async () => {
+      const hash = await hasher.hash('SecurePass123');
+
+      // Hash format: $2b$12$...
+      expect(hash).toContain('$12$');
+    });
+
+    it('should throw for invalid password', async () => {
+      await expect(hasher.hash('short')).rejects.toThrow(PasswordHashError);
+    });
+
+    it('should throw for empty password', async () => {
+      await expect(hasher.hash('')).rejects.toThrow(PasswordHashError);
+    });
+  });
+
+  describe('Password Verification', () => {
+    it('should verify correct password', async () => {
+      const password = 'SecurePass123';
+      const hash = await hasher.hash(password);
+
+      const isValid = await hasher.verify(password, hash);
+      expect(isValid).toBe(true);
+    });
+
+    it('should reject incorrect password', async () => {
+      const hash = await hasher.hash('SecurePass123');
+
+      const isValid = await hasher.verify('WrongPass123', hash);
+      expect(isValid).toBe(false);
+    });
+
+    it('should return false for empty password', async () => {
+      const hash = await hasher.hash('SecurePass123');
+
+      const isValid = await hasher.verify('', hash);
+      expect(isValid).toBe(false);
+    });
+
+    it('should return false for empty hash', async () => {
+      const isValid = await hasher.verify('SecurePass123', '');
+      expect(isValid).toBe(false);
+    });
+
+    it('should return false for invalid hash format', async () => {
+      const isValid = await hasher.verify('SecurePass123', 'invalid-hash');
+      expect(isValid).toBe(false);
+    });
+
+    it('should return false for SHA-256 hash (old format)', async () => {
+      // SHA-256 hash format (what we're replacing)
+      const sha256Hash = 'a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3';
+
+      const isValid = await hasher.verify('password', sha256Hash);
+      expect(isValid).toBe(false);
+    });
+  });
+
+  describe('Rehash Detection', () => {
+    it('should not need rehash for current rounds', async () => {
+      const hash = await hasher.hash('SecurePass123');
+      expect(hasher.needsRehash(hash)).toBe(false);
+    });
+
+    it('should need rehash for lower rounds', () => {
+      // Hash with 10 rounds
+      const lowRoundsHash = '$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy';
+      expect(hasher.needsRehash(lowRoundsHash)).toBe(true);
+    });
+
+    it('should need rehash for invalid format', () => {
+      expect(hasher.needsRehash('invalid-hash')).toBe(true);
+    });
+
+    it('should need rehash for SHA-256 hash', () => {
+      const sha256Hash = 'a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3';
+      expect(hasher.needsRehash(sha256Hash)).toBe(true);
+    });
+  });
+
+  describe('Factory Function', () => {
+    it('should create hasher with specified rounds', () => {
+      const hasher12 = createPasswordHasher(12);
+      expect(hasher12.getConfig().rounds).toBe(12);
+
+      const hasher14 = createPasswordHasher(14);
+      expect(hasher14.getConfig().rounds).toBe(14);
+    });
+
+    it('should use default 12 rounds', () => {
+      const hasher = createPasswordHasher();
+      expect(hasher.getConfig().rounds).toBe(12);
+    });
+  });
+
+  describe('CVE-2 Security Verification', () => {
+    it('should NOT use hardcoded salt', async () => {
+      // Generate multiple hashes and verify they have different salts
+      const hashes = await Promise.all([
+        hasher.hash('SecurePass123'),
+        hasher.hash('SecurePass123'),
+        hasher.hash('SecurePass123'),
+      ]);
+
+      // Extract salts (22 chars after $2b$12$)
+      const salts = hashes.map(h => h.substring(7, 29));
+
+      // All salts should be unique
+      const uniqueSalts = new Set(salts);
+      expect(uniqueSalts.size).toBe(3);
+    });
+
+    it('should NOT produce same hash for same input (unlike SHA-256)', async () => {
+      // SHA-256 with hardcoded salt would produce identical output
+      const hash1 = await hasher.hash('SecurePass123');
+      const hash2 = await hasher.hash('SecurePass123');
+
+      expect(hash1).not.toBe(hash2);
+    });
+
+    it('should produce hash that takes time to compute', async () => {
+      const start = Date.now();
+      await hasher.hash('SecurePass123');
+      const duration = Date.now() - start;
+
+      // bcrypt with 12 rounds should take measurable time (>10ms typically)
+      expect(duration).toBeGreaterThan(5);
+    });
+  });
+});