@fuzdev/fuz_app 0.103.0 → 0.105.0

package/dist/testing/admin_integration.js

@@ -31,11 +31,11 @@ import { GRANT_PATH_ADMIN } from '../auth/grant_path_schema.js';
 import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 import { role_grant_offer_and_accept } from './role_grant_helpers.js';
 import { find_auth_route } from './integration_helpers.js';
-import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE, } from './error_coverage.js';
-import { rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup, } from './rpc_helpers.js';
-import { role_grant_offer_create_action_spec, role_grant_revoke_action_spec, } from '../auth/role_grant_offer_action_specs.js';
-import { admin_account_list_action_spec, ADMIN_ACCOUNT_LIST_LIMIT_MAX, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec, } from '../auth/admin_action_specs.js';
-import { account_token_create_action_spec, account_verify_action_spec, } from '../auth/account_action_specs.js';
+import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE } from './error_coverage.js';
+import { rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup } from './rpc_helpers.js';
+import { role_grant_offer_create_action_spec, role_grant_revoke_action_spec } from '../auth/role_grant_offer_action_specs.js';
+import { admin_account_list_action_spec, ADMIN_ACCOUNT_LIST_LIMIT_MAX, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec } from '../auth/admin_action_specs.js';
+import { account_token_create_action_spec, account_verify_action_spec } from '../auth/account_action_specs.js';
 /**
  * Pick a role for admin-grant testing, preferring a non-admin app-defined
  * role whose `RoleSpec.grant_paths` includes `'admin'` (the
@@ -96,7 +96,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                 return;
             }
             assert_error_coverage(error_collector, admin_routes, {
-                min_coverage: DEFAULT_INTEGRATION_ERROR_COVERAGE,
+                min_coverage: DEFAULT_INTEGRATION_ERROR_COVERAGE
             });
         });
         /** Make request headers for a given session cookie. */
@@ -104,7 +104,7 @@ export const describe_standard_admin_integration_tests = (options) => {
             host: 'localhost',
             origin: 'http://localhost:5173',
             cookie: `${cookie_name}=${session_cookie}`,
-            ...extra,
+            ...extra
         });
         /**
          * Suite-local wrapper around `role_grant_offer_and_accept` that closes
@@ -130,7 +130,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_account_list_action_spec,
                     params: { limit: ADMIN_ACCOUNT_LIST_LIMIT_MAX },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `admin_account_list failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.ok(Array.isArray(res.result.accounts), 'Expected accounts array');
@@ -150,7 +150,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_account_list_action_spec,
                     params: {},
-                    headers: non_admin.create_session_headers(),
+                    headers: non_admin.create_session_headers()
                 });
                 assert.ok(!res.ok, 'Expected admin_account_list to fail for non-admin');
                 assert.strictEqual(res.status, 403);
@@ -178,7 +178,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_account_list_action_spec,
                     params: {},
-                    headers: non_admin_keeper.create_session_headers(),
+                    headers: non_admin_keeper.create_session_headers()
                 });
                 assert.ok(!res.ok, 'Expected admin_account_list to fail for keeper-only account');
                 assert.strictEqual(res.status, 403);
@@ -202,7 +202,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_session_list_action_spec,
                     params: {},
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `admin_session_list failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.ok(Array.isArray(res.result.sessions), 'Expected sessions array');
@@ -217,7 +217,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: create_headers(user_two.session_cookie),
+                    headers: create_headers(user_two.session_cookie)
                 });
                 assert.strictEqual(before.status, 200);
                 // Admin revokes all sessions for user_two via RPC
@@ -226,7 +226,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_session_revoke_all_action_spec,
                     params: { account_id: user_two.account.id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `admin_session_revoke_all failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.strictEqual(res.result.ok, true);
@@ -237,7 +237,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: create_headers(user_two.session_cookie),
+                    headers: create_headers(user_two.session_cookie)
                 });
                 assert.strictEqual(after.status, 401);
             });
@@ -249,7 +249,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_session_revoke_all_action_spec,
                     params: { account_id: fixture.account.id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `admin_session_revoke_all failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.strictEqual(res.result.ok, true);
@@ -260,7 +260,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.strictEqual(after.status, 401);
             });
@@ -282,7 +282,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { authorization: `Bearer ${user_two.api_token}` },
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(before.status, 200);
                 // Admin revokes all tokens for user_two via RPC
@@ -291,7 +291,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_token_revoke_all_action_spec,
                     params: { account_id: user_two.account.id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `admin_token_revoke_all failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.strictEqual(res.result.ok, true);
@@ -304,7 +304,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     spec: account_verify_action_spec,
                     params: undefined,
                     headers: { authorization: `Bearer ${user_two.api_token}` },
-                    suppress_default_origin: true,
+                    suppress_default_origin: true
                 });
                 assert.strictEqual(after.status, 401);
             });
@@ -318,7 +318,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
                     params: {},
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `audit_log_list failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.ok(Array.isArray(res.result.events), 'Expected events array');
@@ -333,7 +333,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: role_grant_offer_create_action_spec,
                     params: { to_account_id: user_two.account.id, role: grantable_role },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(offer_res.ok, 'role_grant_offer_create should succeed');
                 const res = await rpc_call_for_spec({
@@ -341,7 +341,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
                     params: { event_type: 'role_grant_offer_create' },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `audit_log_list failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.ok(res.result.events.length >= 1, 'Expected at least 1 role_grant_offer_create event');
@@ -358,14 +358,14 @@ export const describe_standard_admin_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     grantor: fixture,
                     recipient: user_two,
-                    role: grantable_role,
+                    role: grantable_role
                 });
                 const res = await rpc_call_for_spec({
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: audit_log_role_grant_history_action_spec,
                     params: {},
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `audit_log_role_grant_history failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.ok(res.result.events.length >= 1, 'Expected at least 1 role_grant history event');
@@ -387,7 +387,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     rpc_path,
                     grantor: fixture,
                     recipient: user_two,
-                    role: grantable_role,
+                    role: grantable_role
                 });
                 // Revoke via RPC
                 const revoke_res = await rpc_call_for_spec({
@@ -395,7 +395,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: role_grant_revoke_action_spec,
                     params: { actor_id: user_two.actor.id, role_grant_id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(revoke_res.ok, `role_grant_revoke failed: ${revoke_res.ok ? '' : JSON.stringify(revoke_res.error)}`);
                 // Check audit log for role_grant_revoke event
@@ -404,7 +404,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
                     params: { event_type: 'role_grant_revoke' },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(audit_res.ok, `audit_log_list failed: ${audit_res.ok ? '' : JSON.stringify(audit_res.error)}`);
                 assert.ok(audit_res.result.events.length >= 1, 'Expected role_grant_revoke audit event');
@@ -419,7 +419,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_session_revoke_all_action_spec,
                     params: { account_id: user_two.account.id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(revoke_res.ok, `admin_session_revoke_all failed: ${revoke_res.ok ? '' : JSON.stringify(revoke_res.error)}`);
                 // Check audit log
@@ -428,7 +428,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
                     params: { event_type: 'session_revoke_all' },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(audit_res.ok, 'audit_log_list should succeed');
                 assert.ok(audit_res.result.events.length >= 1, 'Expected session_revoke_all audit event');
@@ -443,7 +443,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_token_revoke_all_action_spec,
                     params: { account_id: user_two.account.id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(revoke_res.ok, `admin_token_revoke_all failed: ${revoke_res.ok ? '' : JSON.stringify(revoke_res.error)}`);
                 // Check audit log
@@ -452,7 +452,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
                     params: { event_type: 'token_revoke_all' },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(audit_res.ok, 'audit_log_list should succeed');
                 assert.ok(audit_res.result.events.length >= 1, 'Expected token_revoke_all audit event');
@@ -468,7 +468,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_session_revoke_all_action_spec,
                     params: { account_id: missing_id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(!res.ok, 'Expected 404 for missing account');
                 assert.strictEqual(res.status, 404);
@@ -481,7 +481,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
                     params: { event_type: 'session_revoke_all' },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(audit_res.ok, 'audit_log_list should succeed');
                 const failure = audit_res.result.events.find((e) => e.outcome === 'failure');
@@ -499,7 +499,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_token_revoke_all_action_spec,
                     params: { account_id: missing_id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(!res.ok, 'Expected 404 for missing account');
                 assert.strictEqual(res.status, 404);
@@ -509,7 +509,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
                     params: { event_type: 'token_revoke_all' },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(audit_res.ok, 'audit_log_list should succeed');
                 const failure = audit_res.result.events.find((e) => e.outcome === 'failure');
@@ -546,12 +546,12 @@ export const describe_standard_admin_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: user_two.account.username,
-                        password: DEFAULT_TEST_PASSWORD,
-                    }),
+                        password: DEFAULT_TEST_PASSWORD
+                    })
                 });
                 assert.strictEqual(login_res.status, 200);
                 // extract user_two session cookie for logout
@@ -567,8 +567,8 @@ export const describe_standard_admin_integration_tests = (options) => {
                         headers: {
                             host: 'localhost',
                             origin: 'http://localhost:5173',
-                            cookie: `${cookie_name}=${user_two_cookie}`,
-                        },
+                            cookie: `${cookie_name}=${user_two_cookie}`
+                        }
                     });
                 }
                 // 3. offer role_grant (admin offers grantable_role to user_two) — full
@@ -578,7 +578,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     grantor: fixture,
                     recipient: user_two,
-                    role: grantable_role,
+                    role: grantable_role
                 });
                 // 4. revoke role_grant (RPC)
                 const revoke_res = await rpc_call_for_spec({
@@ -586,7 +586,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: role_grant_revoke_action_spec,
                     params: { actor_id: user_two.actor.id, role_grant_id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(revoke_res.ok, `role_grant_revoke failed: ${revoke_res.ok ? '' : JSON.stringify(revoke_res.error)}`);
                 // 5. create token (RPC)
@@ -595,19 +595,19 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_token_create_action_spec,
                     params: { name: 'audit-test-token' },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(token_res.ok, `account_token_create failed: ${token_res.ok ? '' : JSON.stringify(token_res.error)}`);
                 // 6. password change
                 await fixture.transport(password_route.path, {
                     method: 'POST',
                     headers: fixture.create_session_headers({
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     }),
                     body: JSON.stringify({
                         current_password: DEFAULT_TEST_PASSWORD,
-                        new_password: 'new-audit-password-789',
-                    }),
+                        new_password: 'new-audit-password-789'
+                    })
                 });
                 // query audit log and verify events
                 // re-login as admin since password change revoked sessions
@@ -616,12 +616,12 @@ export const describe_standard_admin_integration_tests = (options) => {
                     headers: {
                         host: 'localhost',
                         origin: 'http://localhost:5173',
-                        'content-type': 'application/json',
+                        'content-type': 'application/json'
                     },
                     body: JSON.stringify({
                         username: fixture.account.username,
-                        password: 'new-audit-password-789',
-                    }),
+                        password: 'new-audit-password-789'
+                    })
                 });
                 assert.strictEqual(relogin_res.status, 200);
                 const relogin_cookie_header = relogin_res.headers.get('set-cookie');
@@ -630,14 +630,14 @@ export const describe_standard_admin_integration_tests = (options) => {
                 const relogin_headers = {
                     host: 'localhost',
                     origin: 'http://localhost:5173',
-                    cookie: `${cookie_name}=${relogin_match[1]}`,
+                    cookie: `${cookie_name}=${relogin_match[1]}`
                 };
                 const audit_res = await rpc_call_for_spec({
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
                     params: {},
-                    headers: relogin_headers,
+                    headers: relogin_headers
                 });
                 assert.ok(audit_res.ok, `audit_log_list failed: ${audit_res.ok ? '' : JSON.stringify(audit_res.error)}`);
                 const events = audit_res.result.events;
@@ -652,7 +652,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     'role_grant_create',
                     'role_grant_revoke',
                     'token_create',
-                    'password_change',
+                    'password_change'
                 ];
                 for (const event_type of expected_types) {
                     const found = events.filter((e) => e.event_type === event_type);
@@ -668,7 +668,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                 // Bootstrap user is admin A. Create admin B.
                 const admin_b = await fixture.create_account({
                     username: 'admin_b_iso',
-                    roles: ['admin'],
+                    roles: ['admin']
                 });
                 // Seed an active role_grant for admin B via the production
                 // consent flow. The revoke IDOR check is the subject of this
@@ -679,7 +679,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     rpc_path,
                     grantor: fixture,
                     recipient: admin_b,
-                    role: grantable_role,
+                    role: grantable_role
                 });
                 // Admin B revokes their own role_grant via RPC — should succeed
                 const revoke_res = await rpc_call_for_spec({
@@ -687,7 +687,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: role_grant_revoke_action_spec,
                     params: { actor_id: admin_b.actor.id, role_grant_id },
-                    headers: create_headers(admin_b.session_cookie),
+                    headers: create_headers(admin_b.session_cookie)
                 });
                 assert.ok(revoke_res.ok, `role_grant_revoke failed: ${revoke_res.ok ? '' : JSON.stringify(revoke_res.error)}`);
                 assert.strictEqual(revoke_res.result.revoked, true);
@@ -696,7 +696,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                 const fixture = await options.setup_test();
                 const admin_b = await fixture.create_account({
                     username: 'admin_b_sess',
-                    roles: ['admin'],
+                    roles: ['admin']
                 });
                 // Admin A revokes all of admin B's sessions via RPC
                 const res = await rpc_call_for_spec({
@@ -704,7 +704,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_session_revoke_all_action_spec,
                     params: { account_id: admin_b.account.id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `admin_session_revoke_all failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.ok(typeof res.result.count === 'number', 'Expected count field in response');
@@ -714,7 +714,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                 const fixture = await options.setup_test();
                 const admin_b = await fixture.create_account({
                     username: 'admin_b_tok',
-                    roles: ['admin'],
+                    roles: ['admin']
                 });
                 // Admin B creates an API token via RPC
                 const token_res = await rpc_call_for_spec({
@@ -722,7 +722,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_token_create_action_spec,
                     params: { name: 'admin-b-token' },
-                    headers: create_headers(admin_b.session_cookie),
+                    headers: create_headers(admin_b.session_cookie)
                 });
                 assert.ok(token_res.ok, `account_token_create failed: ${token_res.ok ? '' : JSON.stringify(token_res.error)}`);
                 // Admin A revokes all of admin B's tokens via RPC
@@ -731,7 +731,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_token_revoke_all_action_spec,
                     params: { account_id: admin_b.account.id },
-                    headers: fixture.create_session_headers(),
+                    headers: fixture.create_session_headers()
                 });
                 assert.ok(res.ok, `admin_token_revoke_all failed: ${res.ok ? '' : JSON.stringify(res.error)}`);
                 assert.ok(typeof res.result.count === 'number', 'Expected count field in response');
@@ -747,7 +747,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                     path: rpc_path,
                     spec: admin_account_list_action_spec,
                     params: {},
-                    headers: create_headers(regular_user.session_cookie),
+                    headers: create_headers(regular_user.session_cookie)
                 });
                 assert.ok(!res.ok, 'Expected admin_account_list to fail for non-admin');
                 assert.strictEqual(res.status, 403);
@@ -768,7 +768,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                 for (const route of admin_routes) {
                     const res = await fixture.transport(route.path, {
                         method: route.method,
-                        headers: { host: 'localhost' },
+                        headers: { host: 'localhost' }
                     });
                     if (res.status === 401 || res.status === 403) {
                         error_collector.record(route_specs, route.method, route.path, res.status);

package/dist/testing/adversarial_404.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_404.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_404.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAC,sBAAsB,EAAC,MAAM,qBAAqB,CAAC;AAyBhE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,IA2E1E,CAAC"}
+{"version":3,"file":"adversarial_404.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_404.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAyBlE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,IA2E1E,CAAC"}

package/dist/testing/adversarial_404.js

@@ -86,7 +86,7 @@ export const describe_adversarial_404 = (options) => {
                 return spec;
             return {
                 ...spec,
-                handler: (c) => c.json({ error: error_code }, 404),
+                handler: (c) => c.json({ error: error_code }, 404)
             };
         });
         const apps = create_auth_test_apps(stub_specs, roles);

package/dist/testing/adversarial_headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAG3B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAIzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CAiE7B,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}
+{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAIzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CAiE7B,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}

package/dist/testing/adversarial_headers.js

@@ -9,7 +9,7 @@ import './assert_dev_env.js';
  */
 import { test, assert, describe } from 'vitest';
 import { ApiError, ERROR_FORBIDDEN_ORIGIN } from '../http/error_schemas.js';
-import { create_test_middleware_stack_app, TEST_MIDDLEWARE_PATH, } from './middleware.js';
+import { create_test_middleware_stack_app, TEST_MIDDLEWARE_PATH } from './middleware.js';
 // --- Standard adversarial header cases ---
 /**
  * 7 standard adversarial header cases applicable to any middleware stack.
@@ -27,44 +27,44 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         name: 'bearer token with Origin header is rejected before token validation',
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
-            Origin: 'https://attacker.com',
+            Origin: 'https://attacker.com'
         },
         expected_status: 403,
         expected_error: ERROR_FORBIDDEN_ORIGIN,
-        validate_expectation: 'not_called',
+        validate_expectation: 'not_called'
     },
     {
         name: 'bearer token with allowed Origin — bearer silently discarded (browser context)',
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
-            Origin: allowed_origin,
+            Origin: allowed_origin
         },
         expected_status: 200,
-        validate_expectation: 'not_called',
+        validate_expectation: 'not_called'
     },
     {
         name: 'request with no auth headers passes through all middleware',
         headers: {},
         expected_status: 200,
-        validate_expectation: 'not_called',
+        validate_expectation: 'not_called'
     },
     {
         name: 'empty Origin header is rejected by origin middleware before bearer auth (defense-in-depth)',
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
-            Origin: '',
+            Origin: ''
         },
         expected_status: 403,
         expected_error: ERROR_FORBIDDEN_ORIGIN,
-        validate_expectation: 'not_called',
+        validate_expectation: 'not_called'
     },
     {
         name: 'lowercase bearer scheme is recognized (case-insensitive per RFC 7235), soft-fails',
         headers: {
-            Authorization: 'bearer secret_fuz_token_test',
+            Authorization: 'bearer secret_fuz_token_test'
         },
         expected_status: 200,
-        validate_expectation: 'called',
+        validate_expectation: 'called'
     },
     {
         name: 'bearer token with rogue Referer (no Origin) passes origin check, bearer silently discarded (browser-context indicator)',
@@ -73,20 +73,20 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         // the token, so the request reaches the route as unauthenticated.
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
-            Referer: 'https://attacker.com/page',
+            Referer: 'https://attacker.com/page'
         },
         expected_status: 200,
-        validate_expectation: 'not_called',
+        validate_expectation: 'not_called'
     },
     {
         name: 'bearer token with allowed Referer (no Origin) — bearer silently discarded (browser context)',
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
-            Referer: `${allowed_origin}/page`,
+            Referer: `${allowed_origin}/page`
         },
         expected_status: 200,
-        validate_expectation: 'not_called',
-    },
+        validate_expectation: 'not_called'
+    }
 ];
 // --- Convenience wrapper ---
 /**

package/dist/testing/adversarial_input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAUtB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAC,sBAAsB,EAAC,MAAM,qBAAqB,CAAC;AA8ChE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAkN5E,CAAC"}
+{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA8ClE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAkN5E,CAAC"}