@fuzdev/fuz_app 0.106.1 → 0.108.0

package/dist/testing/cross_backend/testing_backdoor.js

@@ -19,7 +19,7 @@ import '../assert_dev_env.js';
  *
  * For every backdoor method, three principals:
  *
- * - **anonymous** (no credential) → `401` (pre-validation auth refuses an
+ * - **anonymous** (no credential) → `401` (pre-authorization auth refuses an
  *   account-less caller before anything else).
  * - **session** (the keeper's browser-context cookie) → `403`
  *   `credential_type_required` — a session cookie, even one carrying the
@@ -28,10 +28,11 @@ import '../assert_dev_env.js';
  *   `credential_type_required` — same ceiling; an api token cannot reach
  *   keeper operations.
  *
- * Each method is sent with **valid** params so the session/bearer cases
- * clear the dispatcher's input-validation (400) phase and actually reach the
- * post-authorization credential gate (the order is 401 → 400 → 403); the
- * handler never runs (the gate refuses first), so the writes never execute.
+ * Each method is sent with **valid** params so each case varies only the
+ * credential. (Validation runs after the gates — the order is 401 → authz →
+ * 403 → 400 — so the shapes are belt-and-suspenders here rather than load-
+ * bearing.) The handler never runs (the gate refuses first), so the writes
+ * never execute.
  *
  * Complements the spec-level gate check (which pins that each spec *declares*
  * `credential_types: ['daemon_token']`) and the surface-absence invariant

package/dist/testing/cross_backend/token_scope_surface.d.ts

@@ -0,0 +1,9 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+/** Options for the token-scope surface parity suite. */
+export interface TokenScopeSurfaceCrossTestOptions extends RpcPathCrossSuiteOptions {
+    /** Audit-log SSE path. Default `/api/admin/audit/stream`. */
+    readonly sse_path?: string;
+}
+export declare const describe_token_scope_surface_cross_tests: (options: TokenScopeSurfaceCrossTestOptions) => void;
+//# sourceMappingURL=token_scope_surface.d.ts.map

package/dist/testing/cross_backend/token_scope_surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAkB3D,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,wBAAwB;IAClF,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA2DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAwHF,CAAC"}

package/dist/testing/cross_backend/token_scope_surface.js

@@ -0,0 +1,170 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for **token scoping's non-RPC surface rule** —
+ * *a narrowed api token is RPC-only*.
+ *
+ * ## Why this suite exists
+ *
+ * Every existing cross-impl token-scope assertion is the `rpc:<method>` arm
+ * (the `token_scope_cases` batch in the conformance security slate). The
+ * `surface:<name>` arm had **none** — and it is the load-bearing half of the
+ * design. Both spines implement it, at the same named surfaces, returning a
+ * denial body that is an explicit cross-impl contract
+ * (`token_scope_denied_body` ↔ `fuz_auth::token_scope_surface_denied_response`),
+ * and nothing compared the two.
+ *
+ * That gap has the shape this control family keeps finding: the per-method arm
+ * was the one everybody looked at, so it was the one that got a gate. The
+ * surface arm is where a divergence could sit indefinitely — the schema gate
+ * can't see it (no column), the action-manifest gate can't see it (no method),
+ * and the spec-derived suites can't see it (these are REST routes, not the
+ * declared RPC surface).
+ *
+ * ## What it pins
+ *
+ * - **The denial body, byte for byte** — status, `error`, and the exact
+ *   `required_scope` capability string, per surface. A spine that renamed a
+ *   surface, dropped the `surface:` prefix, or emitted the JSON-RPC envelope
+ *   from a REST route fails here.
+ * - **Scope outranks role** — a narrowed token whose account *also* lacks the
+ *   gating role must hear `token_scope_required`, not
+ *   `insufficient_permissions`. This is the observable the TS↔Rust ordering
+ *   divergence produced before both spines converged on running the surface
+ *   gate ahead of the role gate; it was explicitly *invisible* to the
+ *   cross-backend suites, because every scoped-token probe used a token whose
+ *   account happened to hold the role.
+ *
+ * Two non-vacuity controls hold the negatives honest: the narrowed token must
+ * still reach the RPC method it *does* name (otherwise a spine that rejected
+ * the credential outright would pass every denial), and a **full** bearer must
+ * reach the same surface (otherwise a route broken for all bearers would pass
+ * too).
+ *
+ * ## Why the WS upgrade isn't here
+ *
+ * Rule 3's third probeable surface is the WebSocket upgrade, and it is
+ * deliberately omitted: `create_ws_transport` threads cookies, not bearer
+ * headers, and a refused upgrade surfaces as a thrown connection error whose
+ * body — the thing this suite exists to compare — isn't readable. The two HTTP
+ * surfaces are where the denial body is observable, which is what the parity
+ * gate needs. The WS gate keeps its per-spine coverage (fuz_app's surface
+ * census pins the call site; the Rust census pins its own).
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, assert } from 'vitest';
+import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
+import { ERROR_TOKEN_SCOPE_REQUIRED } from '../../http/error_schemas.js';
+import { test_if } from './capabilities.js';
+import { cross_rpc_call } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** Default audit-log SSE path — the `audit_stream` surface. */
+const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
+/**
+ * A well-formed hash that no fact has. The scope gate is a pre-authorization
+ * guard, so it fires before the handler ever looks the hash up — but *params*
+ * validation runs ahead of every auth gate (it is part of addressing the
+ * route), so the value still has to parse.
+ */
+const ABSENT_FACT_HASH = `blake3:${'0'.repeat(64)}`;
+/** The single RPC method the narrowed tokens in this suite admit. */
+const ADMITTED_METHOD = 'account_verify';
+/** The flat denial body both spines must return, for a given surface. */
+const surface_denial_body = (surface) => ({
+    error: ERROR_TOKEN_SCOPE_REQUIRED,
+    required_scope: `surface:${surface}`
+});
+/**
+ * Mint a narrowed bearer token over a session, through the production
+ * `account_token_create` path.
+ *
+ * Deliberately not a fixture-level credential: minting it here means the token
+ * is produced by the same handler a real minter would use, on whichever
+ * account the caller chose — which is what lets the ordering case put a
+ * narrowed token on an account that lacks the gating role.
+ */
+const mint_narrowed_token = async (transport, rpc_path, session_headers) => {
+    const res = await cross_rpc_call(transport, rpc_path, account_token_create_action_spec.method, { scope: { kind: 'methods', methods: [ADMITTED_METHOD] } }, session_headers);
+    assert.ok(res.ok, `minting a narrowed token failed: ${JSON.stringify(res.error)}`);
+    const token = res.result?.token;
+    assert.ok(typeof token === 'string' && token.length > 0, 'mint returned no token');
+    return token;
+};
+/**
+ * Assert a bearer GET is refused with the canonical surface denial.
+ *
+ * `origin: null` so the bearer credential isn't discarded as browser context,
+ * and a fresh jar so no session cookie rides along and answers instead.
+ */
+const assert_surface_denied = async (fresh_transport, path, token, surface) => {
+    const res = await fresh_transport({ origin: null })(path, {
+        headers: { authorization: `Bearer ${token}` }
+    });
+    assert.strictEqual(res.status, 403, `${path} must refuse a narrowed token with 403`);
+    const body = await res.json();
+    assert.deepStrictEqual(body, surface_denial_body(surface), `${path} must return the canonical flat surface denial`);
+};
+export const describe_token_scope_surface_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const sse_path = options.sse_path ?? DEFAULT_SSE_PATH;
+    describe('token scope non-RPC surface parity', () => {
+        /**
+         * The non-vacuity control for every denial below: a narrowed token is
+         * still a working credential. Without this, a spine that rejected the
+         * token outright — or never minted it — would pass all four negatives.
+         */
+        test_if(true, 'a narrowed token still reaches the method it names', async () => {
+            const fixture = await setup_test();
+            const token = await mint_narrowed_token(fixture.transport, rpc_path, fixture.create_session_headers());
+            const res = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, ADMITTED_METHOD, undefined, { authorization: `Bearer ${token}` });
+            assert.ok(res.ok, `admitted method must succeed: ${JSON.stringify(res.error)}`);
+        });
+        test_if(capabilities.sse, 'a narrowed token is refused the audit stream (surface:audit_stream)', async () => {
+            const fixture = await setup_test();
+            const token = await mint_narrowed_token(fixture.transport, rpc_path, fixture.create_session_headers());
+            await assert_surface_denied(fixture.fresh_transport, sse_path, token, 'audit_stream');
+        });
+        test_if(capabilities.fact_serving, 'a narrowed token is refused the bare-hash fact read (surface:fact_bare)', async () => {
+            const fixture = await setup_test();
+            const token = await mint_narrowed_token(fixture.transport, rpc_path, fixture.create_session_headers());
+            await assert_surface_denied(fixture.fresh_transport, `/api/facts/${ABSENT_FACT_HASH}`, token, 'fact_bare');
+        });
+        /**
+         * The surface-level non-vacuity control. A **full** bearer on the same
+         * route must get past the scope gate — proving the denial above is the
+         * scope refusing a narrowed token, not the route refusing every bearer.
+         * A 404 (no such fact) is the expected outcome; anything that isn't the
+         * scope denial satisfies the property, so the assertion is on what the
+         * response must *not* be.
+         */
+        test_if(capabilities.fact_serving, 'a full token is not refused by the scope gate on the same route', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport({ origin: null })(`/api/facts/${ABSENT_FACT_HASH}`, { headers: fixture.create_bearer_headers() });
+            const body = (await res.json().catch(() => undefined));
+            assert.notStrictEqual(body?.error, ERROR_TOKEN_SCOPE_REQUIRED, 'a full-authority bearer must not be refused on scope grounds');
+        });
+        /**
+         * **Scope outranks role**, and this is the case that had no cross-impl
+         * pin while the two spines disagreed about it.
+         *
+         * The surfaces are role-gated, so a narrowed token on an account without
+         * the role could be refused by either gate. The scope gate must answer:
+         * it is the coarser fact about a credential that was never going to be
+         * admitted, and `insufficient_permissions` would instead report on the
+         * deployment's role structure to that credential. Every other
+         * scoped-token probe in the slate uses the keeper's token, whose account
+         * *holds* the role — so both orderings look identical there, which is
+         * exactly why this divergence survived as long as it did.
+         */
+        test_if(capabilities.fact_serving, 'scope outranks role — a narrowed token lacking the role hears about its scope', async () => {
+            const fixture = await setup_test();
+            const non_admin = await fixture.create_account({ username: 'scope_before_role' });
+            const token = await mint_narrowed_token(fixture.fresh_transport(), rpc_path, non_admin.create_session_headers());
+            await assert_surface_denied(fixture.fresh_transport, `/api/facts/${ABSENT_FACT_HASH}`, token, 'fact_bare');
+        });
+    });
+};

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA66CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA86CF,CAAC"}

package/dist/testing/integration.js

@@ -685,8 +685,9 @@ export const describe_standard_integration_tests = (options) => {
                 // Pick an admin REST route where a clean role-denial 403 is
                 // reachable: account-grain (`actor: 'none'`, so the authorization
                 // phase doesn't first demand an acting actor → `actor_required`)
-                // and input/param/query-free (so input validation doesn't 400
-                // first, per the 401 → 400 → 403 phase order). Admin surfaces are
+                // and input/param/query-free (params and query still validate ahead
+                // of the auth phase — only body validation moved behind the gates,
+                // per the 401 → authz → 403 → 400 order). Admin surfaces are
                 // RPC-first now; a consumer may expose no such REST route (fuz_app
                 // itself, zzz) — then this REST-era check is a no-op and RPC denial
                 // is covered by `describe_rpc_attack_surface_tests`.

package/dist/testing/middleware.d.ts

@@ -11,7 +11,6 @@ import './assert_dev_env.js';
 import { vi } from 'vitest';
 import { Hono } from 'hono';
 import type { z } from 'zod';
-import type { RateLimiter } from '../rate_limiter.js';
 import { type RequestContext } from '../auth/request_context.js';
 /** Mock configuration for bearer auth middleware test setup. */
 export interface BearerAuthTestOptions {
@@ -80,7 +79,7 @@ export declare const TEST_CLIENT_IP = "127.0.0.1";
  * The route handler at `/api/test` returns the resolved context in the response body,
  * enabling assertions on `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY`.
  */
-export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions, ip_rate_limiter?: RateLimiter | null) => {
+export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions) => {
     app: Hono;
     mocks: BearerAuthMocks;
 };
@@ -89,7 +88,7 @@ export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions, ip
  *
  * Generates one `test()` per case inside a `describe()` block.
  */
-export declare const describe_bearer_auth_cases: (suite_name: string, cases: Array<BearerAuthTestCase>, ip_rate_limiter?: RateLimiter | null) => void;
+export declare const describe_bearer_auth_cases: (suite_name: string, cases: Array<BearerAuthTestCase>) => void;
 /** Path used by the echo route in `create_test_middleware_stack_app`. */
 export declare const TEST_MIDDLEWARE_PATH = "/api/test";
 /** Options for `create_test_middleware_stack_app`. */
@@ -100,8 +99,6 @@ export interface TestMiddlewareStackOptions {
     allowed_origins?: string;
     /** Connection IP or factory. @default first trusted proxy */
     connection_ip?: string | (() => string | undefined);
-    /** Rate limiter for bearer auth. @default `null` */
-    ip_rate_limiter?: RateLimiter | null;
 }
 /** Return type of `create_test_middleware_stack_app`. */
 export interface TestMiddlewareStackApp {

package/dist/testing/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAe7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2BtF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,EACzB,kBAAiB,WAAW,GAAG,IAAW,KACxC;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAyDrC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,EAChC,kBAAiB,WAAW,GAAG,IAAW,KACxC,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,oDAAoD;IACpD,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBA4DF,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAe7B,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2BtF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,KACvB;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAwDrC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAC9B,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBAwDF,CAAC"}

package/dist/testing/middleware.js

@@ -91,9 +91,9 @@ export const TEST_CLIENT_IP = '127.0.0.1';
  * The route handler at `/api/test` returns the resolved context in the response body,
  * enabling assertions on `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY`.
  */
-export const create_bearer_auth_test_app = (tc, ip_rate_limiter = null) => {
+export const create_bearer_auth_test_app = (tc) => {
     const mocks = create_bearer_auth_mocks(tc);
-    const bearer_middleware = create_bearer_auth_middleware(STUB_DEPS, ip_rate_limiter, new Logger('test', { level: 'off' }));
+    const bearer_middleware = create_bearer_auth_middleware(STUB_DEPS, new Logger('test', { level: 'off' }));
     const app = new Hono();
     // inject pre-existing session identity if the test case specifies one.
     // `pre_context` simulates the session middleware having authenticated
@@ -144,11 +144,11 @@ export const create_bearer_auth_test_app = (tc, ip_rate_limiter = null) => {
  *
  * Generates one `test()` per case inside a `describe()` block.
  */
-export const describe_bearer_auth_cases = (suite_name, cases, ip_rate_limiter = null) => {
+export const describe_bearer_auth_cases = (suite_name, cases) => {
     describe(suite_name, () => {
         for (const tc of cases) {
             test(tc.name, async () => {
-                const { app, mocks } = create_bearer_auth_test_app(tc, ip_rate_limiter);
+                const { app, mocks } = create_bearer_auth_test_app(tc);
                 const res = await app.request('/api/test', {
                     method: 'GET',
                     headers: tc.headers
@@ -227,7 +227,7 @@ export const create_test_middleware_stack_app = (options) => {
     });
     const allowed_patterns = parse_allowed_origins(allowed_origins_str);
     const origin_mw = verify_request_source(allowed_patterns);
-    const bearer_mw = create_bearer_auth_middleware(STUB_DEPS, options?.ip_rate_limiter ?? null, new Logger('test', { level: 'off' }));
+    const bearer_mw = create_bearer_auth_middleware(STUB_DEPS, new Logger('test', { level: 'off' }));
     const app = new Hono();
     app.use('*', proxy_mw);
     app.use('/api/*', origin_mw);

package/dist/testing/rate_limiting.d.ts

@@ -4,7 +4,7 @@ import type { AppServerContext } from '../server/app_server_context.js';
 import type { RouteSpec } from '../http/route_spec.js';
 import { type SuiteAppOptions } from './app_server.js';
 import { type DbFactory } from './db.js';
-import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
+import type { RpcEndpointsSuiteOption } from './rpc_helpers.js';
 /**
  * Configuration for `describe_rate_limiting_tests`.
  */
@@ -25,37 +25,31 @@ export interface RateLimitingTestOptions {
      */
     max_attempts?: number;
     /**
-     * RPC endpoint specs — required so the bearer-auth rate limiting test
-     * can probe an authenticated method via the `account_verify` RPC
-     * action. Hard-fails via `require_rpc_endpoint_path` on setup.
+     * RPC endpoint specs mounted on the test app. Optional — both suites below
+     * exercise REST auth routes, so nothing here needs an RPC path.
      *
      * Accepts either an array (eager) or a factory
      * `(ctx: AppServerContext) => Array<RpcEndpointSpec>` — the factory form
      * is required when action handlers must close over the per-test
-     * `ctx.deps`. The factory must return the same
-     * endpoint `path` regardless of ctx — it is invoked once at setup with
-     * a stub ctx for path lookup and again per-test by `create_app_server`
-     * for live dispatch.
+     * `ctx.deps`.
      */
-    rpc_endpoints: RpcEndpointsSuiteOption;
+    rpc_endpoints?: RpcEndpointsSuiteOption;
 }
 /**
  * Standard rate limiting integration test suite.
  *
- * Creates 3 test groups:
+ * Creates 2 test groups:
  * 1. IP rate limiting on login — fires `max_attempts + 1` login requests,
  *    verifies the last returns 429 with a valid `RateLimitError` body.
  * 2. Per-account rate limiting on login — fires `max_attempts + 1` login
  *    requests with the same username, verifies the last returns 429.
- * 3. Bearer auth IP rate limiting — fires `max_attempts + 1` bearer requests
- *    with an invalid token, verifies the last returns 429.
+ *
+ * There is deliberately no bearer-auth group: the bearer path carries no rate
+ * limiter on either spine, because an API token's entropy — not throttling —
+ * is what bounds guessing it. See `auth/bearer_auth.ts`.
  *
  * Each test group asserts that required routes exist, failing with a descriptive
  * message if the consumer's route specs are misconfigured.
- *
- * @throws Error at setup time when `options.rpc_endpoints` is empty — the
- *   bearer-auth rate-limit test probes via the `account_verify` RPC action,
- *   so the suite hard-fails via `require_rpc_endpoint_path`.
  */
 export declare const describe_rate_limiting_tests: (options: RateLimitingTestOptions) => void;
 //# sourceMappingURL=rate_limiting.d.ts.map

package/dist/testing/rate_limiting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate_limiting.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rate_limiting.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA0B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAK1B;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IAgQ/E,CAAC"}
+{"version":3,"file":"rate_limiting.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rate_limiting.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA0B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAEjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IAqK/E,CAAC"}

package/dist/testing/rate_limiting.js

@@ -27,35 +27,25 @@ import { auth_migration_ns } from '../auth/migrations.js';
 import { create_test_app } from './app_server.js';
 import { create_pglite_factory, create_describe_db, auth_integration_truncate_tables } from './db.js';
 import { find_auth_route, assert_rate_limit_retry_after_header } from './integration_helpers.js';
-import { rpc_call_non_browser, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup } from './rpc_helpers.js';
 import { run_migrations } from '../db/migrate.js';
-import { account_verify_action_spec } from '../auth/account_action_specs.js';
 /**
  * Standard rate limiting integration test suite.
  *
- * Creates 3 test groups:
+ * Creates 2 test groups:
  * 1. IP rate limiting on login — fires `max_attempts + 1` login requests,
  *    verifies the last returns 429 with a valid `RateLimitError` body.
  * 2. Per-account rate limiting on login — fires `max_attempts + 1` login
  *    requests with the same username, verifies the last returns 429.
- * 3. Bearer auth IP rate limiting — fires `max_attempts + 1` bearer requests
- *    with an invalid token, verifies the last returns 429.
+ *
+ * There is deliberately no bearer-auth group: the bearer path carries no rate
+ * limiter on either spine, because an API token's entropy — not throttling —
+ * is what bounds guessing it. See `auth/bearer_auth.ts`.
  *
  * Each test group asserts that required routes exist, failing with a descriptive
  * message if the consumer's route specs are misconfigured.
- *
- * @throws Error at setup time when `options.rpc_endpoints` is empty — the
- *   bearer-auth rate-limit test probes via the `account_verify` RPC action,
- *   so the suite hard-fails via `require_rpc_endpoint_path`.
  */
 export const describe_rate_limiting_tests = (options) => {
     const max_attempts = options.max_attempts ?? 2;
-    // Hard-fail early so consumers see a clear setup error instead of a
-    // confusing test failure when `rpc_endpoints` is missing. Factory-form
-    // callers are resolved with a stub ctx purely to extract the endpoint
-    // path; real handlers run per-test via the top-level `rpc_endpoints` slot on `CreateTestAppOptions`.
-    const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
-    const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
     const init_schema = async (db) => {
         await run_migrations(db, [auth_migration_ns]);
     };
@@ -67,7 +57,7 @@ export const describe_rate_limiting_tests = (options) => {
         // --- 1. IP rate limiting on login ---
         describe('IP rate limiting on login', () => {
             test(`login is blocked after ${max_attempts} failed attempts`, async () => {
-                const ip_rate_limiter = create_test_rate_limiter();
+                const login_ip_rate_limiter = create_test_rate_limiter();
                 try {
                     const test_app = await create_test_app({
                         session_options: options.session_options,
@@ -76,9 +66,8 @@ export const describe_rate_limiting_tests = (options) => {
                         rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            ip_rate_limiter,
-                            login_account_rate_limiter: null,
-                            bearer_ip_rate_limiter: null
+                            login_ip_rate_limiter,
+                            login_account_rate_limiter: null
                         }
                     });
                     const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
@@ -113,7 +102,7 @@ export const describe_rate_limiting_tests = (options) => {
                     assert_rate_limit_retry_after_header(blocked_res, body);
                 }
                 finally {
-                    ip_rate_limiter.dispose();
+                    login_ip_rate_limiter.dispose();
                 }
             });
         });
@@ -129,9 +118,8 @@ export const describe_rate_limiting_tests = (options) => {
                         rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            ip_rate_limiter: null,
-                            login_account_rate_limiter,
-                            bearer_ip_rate_limiter: null
+                            login_ip_rate_limiter: null,
+                            login_account_rate_limiter
                         }
                     });
                     const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
@@ -182,77 +170,5 @@ export const describe_rate_limiting_tests = (options) => {
                 }
             });
         });
-        // --- 3. Bearer auth IP rate limiting ---
-        describe('bearer auth IP rate limiting', () => {
-            test(`bearer auth is blocked after ${max_attempts} invalid token attempts`, async () => {
-                const bearer_ip_rate_limiter = create_test_rate_limiter();
-                try {
-                    const test_app = await create_test_app({
-                        session_options: options.session_options,
-                        create_route_specs: options.create_route_specs,
-                        db: get_db(),
-                        rpc_endpoints: options.rpc_endpoints,
-                        app_options: {
-                            ...options.app_options,
-                            ip_rate_limiter: null,
-                            login_account_rate_limiter: null,
-                            bearer_ip_rate_limiter
-                        }
-                    });
-                    // Probe `account_verify` via RPC with an invalid bearer token.
-                    // The REST `/api/account/verify` shim is status-only (empty body
-                    // for nginx `auth_request`), so we use the RPC surface to exercise
-                    // a typed authenticated method. The bearer_auth rate limiter
-                    // increments per attempt regardless of the route's own auth outcome.
-                    // Use `rpc_call_non_browser` so the default `origin` header is
-                    // suppressed — bearer_auth discards the token when Origin or
-                    // Referer is present (browser context), which would short-circuit
-                    // before the rate limiter records the attempt.
-                    //
-                    // Note: the rate limiter short-circuits before the RPC dispatcher,
-                    // so the 429 response is a REST-shaped `RateLimitError`, not a
-                    // JSON-RPC envelope. We use the underlying `app.request` for the
-                    // blocked probe so `rpc_call_non_browser` doesn't throw on the
-                    // non-envelope body.
-                    const bearer_probe_headers = {
-                        authorization: 'Bearer secret_fuz_token_invalid'
-                    };
-                    // Fire max_attempts invalid bearer requests (sequential — must exhaust the window)
-                    for (let i = 0; i < max_attempts; i++) {
-                        const res = await rpc_call_non_browser({
-                            app: test_app.app,
-                            path: rpc_path,
-                            method: account_verify_action_spec.method,
-                            id: 'rl-probe',
-                            headers: bearer_probe_headers
-                        });
-                        assert.notStrictEqual(res.status, 429, `Request ${i + 1}/${max_attempts} should not be rate limited`);
-                    }
-                    // The next request should be rate limited. The 429 body is REST-shape
-                    // (middleware short-circuits before the RPC dispatcher), so go
-                    // direct — `rpc_call_non_browser` would throw on the non-envelope body.
-                    const blocked_res = await test_app.app.request(rpc_path, {
-                        method: 'POST',
-                        headers: {
-                            host: 'localhost',
-                            'content-type': 'application/json',
-                            ...bearer_probe_headers
-                        },
-                        body: JSON.stringify({
-                            jsonrpc: '2.0',
-                            method: account_verify_action_spec.method,
-                            id: 'rl-probe-blocked'
-                        })
-                    });
-                    assert.strictEqual(blocked_res.status, 429);
-                    const body = await blocked_res.json();
-                    RateLimitError.parse(body);
-                    assert_rate_limit_retry_after_header(blocked_res, body);
-                }
-                finally {
-                    bearer_ip_rate_limiter.dispose();
-                }
-            });
-        });
     });
 };

package/dist/testing/rpc_attack_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAGX,cAAc,EACd,MAAM,oBAAoB,CAAC;AA0B5B,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AA4dD;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}
+{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAGX,cAAc,EACd,MAAM,oBAAoB,CAAC;AA0B5B,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AA8dD;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}

package/dist/testing/rpc_attack_surface.js

@@ -83,8 +83,10 @@ const describe_rpc_auth = (options) => {
                                     const app = apps.by_role.get(wrong_role);
                                     if (!app)
                                         throw new Error(`No test app for role '${wrong_role}'`);
-                                    // Send valid params so we trip the role gate (403), not input
-                                    // validation (400). Dispatcher ordering: 401 → 400 → 403.
+                                    // Send valid params so the probe varies only the role. Dispatcher
+                                    // ordering is 401 → authz → 403 → 400, so the role gate trips
+                                    // ahead of validation regardless; valid params also keep the
+                                    // authorization phase from answering `actor_required` first.
                                     const action = find_rpc_action(rpc_endpoint_specs, endpoint.path, method.name);
                                     const params = action ? generate_valid_body(action.spec.input) : undefined;
                                     const res = await app.request(endpoint.path, create_rpc_post_init(method.name, params));

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAoBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}

package/dist/testing/stubs.js

@@ -199,7 +199,9 @@ export const create_stub_app_server_context = (session_options) => {
         },
         bootstrap_status: { available: false, token_path: null },
         session_options,
-        ip_rate_limiter: null,
+        login_ip_rate_limiter: null,
+        signup_ip_rate_limiter: null,
+        bootstrap_ip_rate_limiter: null,
         login_account_rate_limiter: null,
         signup_account_rate_limiter: null,
         action_ip_rate_limiter: null,

package/dist/testing/testing_rate_limiter.d.ts

@@ -20,7 +20,7 @@ import './assert_dev_env.js';
  * import {TestingRateLimiter} from '@fuzdev/fuz_app/testing/testing_rate_limiter.ts';
  *
  * const limiter = new TestingRateLimiter(default_login_ip_rate_limit);
- * await create_app_server({backend, ip_rate_limiter: limiter, ...});
+ * await create_app_server({backend, login_ip_rate_limiter: limiter, ...});
  *
  * // Inside the `_testing_reset` handler's `reset_state`:
  * limiter.reset_all();
@@ -45,6 +45,12 @@ export declare class TestingRateLimiter extends RateLimiter {
      * safe to call before any check/record activity. Designed to be invoked
      * from a `_testing_reset` handler's `reset_state` callback so the test
      * binary's rate-limit buckets don't leak across test cases.
+     *
+     * This is the **one sanctioned caller that clears IP-aggregate keys** —
+     * `RateLimiter.reset` forbids that for production code, because refunding
+     * the IP bucket on a successful auth reopens the distributed-spray path.
+     * Here it is test-state teardown between cases, not success-forgiveness, so
+     * the rule doesn't apply.
      */
     reset_all(): void;
     /**

package/dist/testing/testing_rate_limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_rate_limiter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/testing_rate_limiter.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;;IAGzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKlD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKjC;;;;;OAKG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAEtC;CACD"}
+{"version":3,"file":"testing_rate_limiter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/testing_rate_limiter.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;;IAGzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKlD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKjC;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAEtC;CACD"}