@fuzdev/fuz_app 0.107.0 → 0.109.0

package/dist/testing/cross_backend/login_security.js

@@ -24,6 +24,13 @@ import '../assert_dev_env.js';
  *   not `429`). A backend that ignored XFF and keyed on the (loopback) TCP
  *   peer would 429 the fresh-IP request too — so the `401` proves the limiter
  *   keys on the resolved `X-Forwarded-For` client IP.
+ * - **a success does not refund the per-IP budget** — the distributed-spray
+ *   backstop. Failed guesses against *distinct* usernames from one forwarded
+ *   IP, interleaved with the attacker's own successful logins, must still 429
+ *   within a bounded total-request budget. Both spines used to clear the IP
+ *   bucket on success, which made that budget unbounded: one credential (or,
+ *   under open signup, none) bought unlimited guesses against arbitrary victims
+ *   from a single address. Only the account-grain bucket is forgiven now.
  *
  * **Determinism without a limiter reset.** Limiter state is in-memory and the
  * per-test `_testing_reset` wipes only the DB, never the buckets — so each
@@ -58,6 +65,7 @@ import { default_login_account_rate_limit, default_login_ip_rate_limit } from '.
 const XFF_IP_LIMIT = '203.0.113.1';
 const XFF_SEGREGATION_EXHAUST = '203.0.113.2';
 const XFF_SEGREGATION_FRESH = '203.0.113.3';
+const XFF_SPRAY = '203.0.113.4';
 /** A non-routable, non-existent identifier — login resolves to the not-found path (records the bucket, returns 401). */
 const PROBE_PASSWORD = 'login_security_wrong_password';
 export const describe_login_security_cross_tests = (options) => {
@@ -93,6 +101,20 @@ export const describe_login_security_cross_tests = (options) => {
             retry_after_header: res.headers.get('retry-after')
         };
     };
+    /**
+     * POST a login expected to *succeed*, on a fresh transport with the given
+     * `X-Forwarded-For`. The mirror of `attempt` — used to prove that a success
+     * does not refund the resolved IP's bucket.
+     */
+    const succeed = async (fixture, forwarded_for, username, password) => {
+        const res = await fixture.fresh_transport()(login_path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-forwarded-for': forwarded_for },
+            body: JSON.stringify({ username, password })
+        });
+        await res.text();
+        return res.status;
+    };
     describe('login rate limiting + trusted-proxy parity', () => {
         test(`per-IP login limit fires 429 + Retry-After after ${ip_limit} attempts from one forwarded IP`, async () => {
             const fixture = await setup_test();
@@ -126,5 +148,42 @@ export const describe_login_security_cross_tests = (options) => {
             const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
             assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
         });
+        test('a success does not refund the per-IP budget (distributed-spray backstop)', async () => {
+            const fixture = await setup_test();
+            // The attacker's own account. Minting rides the setup path from
+            // loopback with no XFF, so it lands on a different bucket than
+            // XFF_SPRAY and can't confound the count.
+            const attacker = await fixture.create_account({
+                username: 'spray_attacker',
+                password_value: 'spray_attacker_password'
+            });
+            let budget = 0;
+            let limited = false;
+            for (let i = 0; i < ip_limit * 3; i++) {
+                // Their own successful login — the move that used to zero the
+                // whole IP window — then one guess against a fresh victim
+                // username, so no per-account bucket accumulates and only the
+                // IP aggregate can stop this.
+                const own = await succeed(fixture, XFF_SPRAY, attacker.account.username, 'spray_attacker_password');
+                budget++;
+                // Either leg may trip: the aggregate governs the *address*, so
+                // once it fills even the attacker's own login is refused. That
+                // is the property — no move from this IP buys more attempts.
+                if (own === 429) {
+                    limited = true;
+                    break;
+                }
+                assert.strictEqual(own, 200, "the attacker's own login must succeed");
+                const guess = await attempt(fixture, XFF_SPRAY, `spray_victim_${i}`);
+                budget++;
+                if (guess.status === 429) {
+                    limited = true;
+                    break;
+                }
+                assert.strictEqual(guess.status, 401, 'a guess against an unknown user must 401');
+            }
+            assert(limited, 'the per-IP aggregate must eventually 429 the spray');
+            assert(budget <= ip_limit * 2 + 2, `interleaved successes must not extend the per-IP budget (spent ${budget})`);
+        });
     });
 };

package/dist/testing/cross_backend/query_shape.d.ts

@@ -0,0 +1,10 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+/**
+ * Options for the query-shape parity suite. The standard RPC-dispatched
+ * cross-suite shape (`setup_test` / `capabilities` / `rpc_path`); aliases the
+ * shared `RpcPathCrossSuiteOptions` rather than minting a duplicate.
+ */
+export type QueryShapeCrossTestOptions = RpcPathCrossSuiteOptions;
+export declare const describe_query_shape_cross_tests: (options: QueryShapeCrossTestOptions) => void;
+//# sourceMappingURL=query_shape.d.ts.map

package/dist/testing/cross_backend/query_shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/query_shape.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAQlE,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAwHtF,CAAC"}

package/dist/testing/cross_backend/query_shape.js

@@ -0,0 +1,128 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend query-string shape parity suite.
+ *
+ * The TS pipeline reads queries through Hono's `c.req.query()` — a duplicated
+ * key resolves to its **first** occurrence — and only routes that declare a
+ * `z.strictObject` query schema 400 unknown keys, in the pipeline's
+ * params → query → 401 → authz → 403 phase order. A derived-serde axum
+ * extractor diverges on every axis (a plain-text pre-handler "duplicate
+ * field" 400 observable anonymously, silently ignored unknown keys, query
+ * rejection ahead of the 401), so each spine surface that reads a query is
+ * pinned here on both backends:
+ *
+ * - **`GET /api/account/status`** — NO query schema: a duplicated `acting`
+ *   reads first-wins (the persona resolves), unknown keys are ignored, and an
+ *   anonymous caller with junk query hears 401, never a query 400.
+ * - **the JSON-RPC GET endpoint** — `method` / `id` / `params` read
+ *   first-wins; a duplicated `method` must dispatch the first one on every
+ *   backend (a last-wins reader dispatches a different method per backend on
+ *   the same request).
+ * - **`GET /api/facts/:hash`** (gated on `capabilities.fact_serving`) —
+ *   strict query schema: unknown keys and a malformed `acting` are 400
+ *   `invalid_query_params` even for an anonymous caller (query precedes the
+ *   401 guard), while a duplicated `acting` takes the first occurrence.
+ *
+ * The per-surface in-process TS pins live beside each module's own tests
+ * (`account_status.test.ts`, `action_rpc.test.ts`,
+ * `serve_fact_route.db.test.ts`); this suite is the cross-impl gate, so it is
+ * cross-process only — like `login_security.ts` and `testing_backdoor.ts`.
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { account_verify_action_spec } from '../../auth/account_action_specs.js';
+import { ERROR_INVALID_QUERY_PARAMS } from '../../http/error_schemas.js';
+import { test_if } from './capabilities.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** The status route every spine serves (bundled into the account family). */
+const STATUS_PATH = '/api/account/status';
+/** A well-formed blake3 hash that references no stored fact. */
+const MISSING_HASH = `blake3:${'a'.repeat(64)}`;
+export const describe_query_shape_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    describe('query-shape parity (duplicate keys, unknown keys, phase order)', () => {
+        test_if(capabilities.account_status, 'status: duplicated acting takes the first occurrence (persona resolves)', async () => {
+            const fixture = await setup_test();
+            // First occurrence is the keeper's real actor; the second is a
+            // mismatching-but-well-formed uuid. First-wins resolves the real
+            // persona; last-wins would fall through to `actor: null`, and a
+            // derived-serde extractor would 400 before the handler ran.
+            const nil = '00000000-0000-0000-0000-000000000000';
+            const res = await fixture.transport(`${STATUS_PATH}?acting=${fixture.actor.id}&acting=${nil}`, { method: 'GET', headers: fixture.create_session_headers() });
+            assert.strictEqual(res.status, 200);
+            const body = (await res.json());
+            assert.strictEqual(body.actor?.id, fixture.actor.id, 'first acting occurrence must win');
+        });
+        test_if(capabilities.account_status, 'status: anonymous with duplicated/unknown query keys → 401, never a query 400', async () => {
+            const fixture = await setup_test();
+            const anon = fixture.fresh_transport();
+            // The status route has no query schema — an anonymous prober with a
+            // junk query must hear the same 401 as a clean one (a pre-handler
+            // query reject here is a backend fingerprint).
+            const dup = await anon(`${STATUS_PATH}?acting=a&acting=b`, { method: 'GET' });
+            assert.strictEqual(dup.status, 401);
+            const unknown = await anon(`${STATUS_PATH}?foo=1&bar=2`, { method: 'GET' });
+            assert.strictEqual(unknown.status, 401);
+        });
+        test_if(capabilities.account_status, 'status: unknown query keys are ignored for an authed caller (no strict schema)', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.transport(`${STATUS_PATH}?foo=1`, {
+                method: 'GET',
+                headers: fixture.create_session_headers()
+            });
+            assert.strictEqual(res.status, 200);
+        });
+        test('rpc GET: duplicated method and id keys take the first occurrence', async () => {
+            const fixture = await setup_test();
+            const method = account_verify_action_spec.method;
+            // First-wins dispatches `account_verify` with id 7; a last-wins
+            // reader dispatches the missing method (method_not_found) with id 8.
+            const res = await fixture.transport(`${rpc_path}?method=${method}&method=definitely_missing_method&id=7&id=8`, { method: 'GET', headers: fixture.create_session_headers() });
+            assert.strictEqual(res.status, 200);
+            const body = (await res.json());
+            assert.strictEqual(body.id, 7, 'first id occurrence must win');
+            assert.ok(body.result !== undefined, 'first method occurrence must dispatch');
+        });
+        test_if(capabilities.fact_serving, 'bare-hash facts: unknown query key → 400 invalid_query_params, even anonymous', async () => {
+            const fixture = await setup_test();
+            // Authed admin (the keeper): the strict query schema refuses the
+            // unknown key before the handler can 404 the missing fact.
+            const as_admin = await fixture.transport(`/api/facts/${MISSING_HASH}?foo=1`, {
+                method: 'GET',
+                headers: fixture.create_session_headers()
+            });
+            assert.strictEqual(as_admin.status, 400);
+            const body = (await as_admin.json());
+            assert.strictEqual(body.error, ERROR_INVALID_QUERY_PARAMS);
+            // Anonymous: query validation precedes the 401 guard (phase
+            // order), with the clean anonymous request as the 401 control.
+            const anon = fixture.fresh_transport();
+            const anon_bad = await anon(`/api/facts/${MISSING_HASH}?foo=1`, { method: 'GET' });
+            assert.strictEqual(anon_bad.status, 400);
+            const anon_clean = await anon(`/api/facts/${MISSING_HASH}`, { method: 'GET' });
+            assert.strictEqual(anon_clean.status, 401);
+        });
+        test_if(capabilities.fact_serving, 'bare-hash facts: duplicated acting takes the first occurrence; malformed acting → 400', async () => {
+            const fixture = await setup_test();
+            // First occurrence is the keeper's real actor; the second is
+            // garbage. First-wins passes the query phase and reaches the
+            // handler's masked 404 (the hash references nothing) — a
+            // derived-serde extractor would 400 the duplication instead.
+            const dup = await fixture.transport(`/api/facts/${MISSING_HASH}?acting=${fixture.actor.id}&acting=not-a-uuid`, { method: 'GET', headers: fixture.create_session_headers() });
+            assert.strictEqual(dup.status, 404, 'duplicated acting must resolve first-wins');
+            // A malformed single acting is refused at the query phase.
+            const bad = await fixture.transport(`/api/facts/${MISSING_HASH}?acting=not-a-uuid`, {
+                method: 'GET',
+                headers: fixture.create_session_headers()
+            });
+            assert.strictEqual(bad.status, 400);
+            const body = (await bad.json());
+            assert.strictEqual(body.error, ERROR_INVALID_QUERY_PARAMS);
+        });
+    });
+};

package/dist/testing/cross_backend/session_cap.d.ts

@@ -0,0 +1,19 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the session-cap parity suite. */
+export interface SessionCapCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /**
+     * The cap both spines enforce. Defaults to `DEFAULT_MAX_SESSIONS` — the TS
+     * route default and the Rust `const`. A consumer that overrides
+     * `max_sessions` on the TS side passes its value here.
+     */
+    readonly max_sessions?: number;
+    /** REST login route path. Default `/api/account/login`. */
+    readonly login_path?: string;
+    /** REST account-status route path. Default `/api/account/status`. */
+    readonly status_path?: string;
+}
+export declare const describe_session_cap_cross_tests: (options: SessionCapCrossTestOptions) => void;
+//# sourceMappingURL=session_cap.d.ts.map

package/dist/testing/cross_backend/session_cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA6DtF,CAAC"}

package/dist/testing/cross_backend/session_cap.js

@@ -0,0 +1,93 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the **per-account concurrent-session cap**
+ * over real HTTP.
+ *
+ * The cap is a shipped control on the TS spine (`query_session_enforce_limit`,
+ * `DEFAULT_MAX_SESSIONS`) that the Rust spine went without — its session INSERT
+ * carried no eviction, so every Rust-backed deployment served unlimited
+ * concurrent sessions per account. That divergence survived because nothing crossed the
+ * wire on it — the TS half is pinned by in-process tests
+ * (`session_middleware.lifecycle.db.test.ts`, `session_token_limits.integration.db.test.ts`)
+ * whose Rust counterparts simply didn't exist to fail. This suite is the pin
+ * that runs on *both*, so the next spine to lose the cap fails here rather than
+ * in production. Two properties:
+ *
+ * - **the cap bounds concurrent sessions, by eviction not refusal** — logging in
+ *   `max_sessions + 1` times succeeds every time (a login is never denied for
+ *   being the one over the line), and the newest cookie resolves afterward.
+ * - **the evicted session is the oldest** — the first login's cookie no longer
+ *   authenticates once the cap is exceeded. A spine with no cap authenticates it
+ *   fine, which is exactly the defect this catches.
+ *
+ * **Why `max_sessions + 1` logins and not `max_sessions`.** The starting session
+ * count isn't zero and isn't guaranteed equal across impls — `create_account`
+ * seeds its own session on the Rust cradle. Overshooting by one guarantees at
+ * least one eviction whatever the baseline is, and the *oldest* login is the
+ * first to go either way. Asserting on the first and last sessions rather than
+ * on a row count keeps the case wire-observable (no DB channel) and
+ * baseline-independent.
+ *
+ * Both surfaces are flat REST (`POST /api/account/login`, `GET /api/account/status`)
+ * on every spine, so this is an imperative suite (not a `conformance_table` row)
+ * — the sibling of `cookie_attributes.ts` / `origin.ts` / `login_security.ts`.
+ * **Cross-process only**, and load-bearingly so: each login is held on its own
+ * `fresh_transport` and identified by that transport's cookie jar, which
+ * in-process is a jar-less passthrough. That also keeps the suite free of a
+ * fourth `Set-Cookie` parser — reading the raw header is `cookie_attributes.ts`'s
+ * job, and this case only needs "does this login still authenticate".
+ *
+ * What it does **not** pin: concurrent creators. Two simultaneous logins can
+ * each evict against a stale count under Read Committed and both commit above
+ * the cap — see `query_session_enforce_limit`'s race note. That needs a
+ * barrier-based test against one backend, not a parity case.
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { DEFAULT_MAX_SESSIONS } from '../../auth/account_route_schema.js';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+export const describe_session_cap_cross_tests = (options) => {
+    const { setup_test } = options;
+    const max_sessions = options.max_sessions ?? DEFAULT_MAX_SESSIONS;
+    const login_path = options.login_path ?? '/api/account/login';
+    const status_path = options.status_path ?? '/api/account/status';
+    // Fresh-keeper-per-test wipes the DB between tests, so a literal username
+    // never collides (see `setup.ts`).
+    const username = 'session_cap_user';
+    describe('per-account session cap parity', () => {
+        test(`logging in ${max_sessions + 1} times evicts the oldest session (newest cookie resolves, first does not)`, async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            // One transport per login, each with its own empty jar, so each ends up
+            // holding exactly that login's session cookie and re-sends it on any
+            // later request. That's why this suite is cross-process only: in-process
+            // `fresh_transport` is a jar-less passthrough and every session would
+            // look alike. Held oldest-first.
+            const sessions = [];
+            for (let i = 0; i < max_sessions + 1; i++) {
+                const transport = fixture.fresh_transport();
+                const res = await transport(login_path, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD })
+                });
+                assert.strictEqual(res.status, 200, `login ${i + 1}/${max_sessions + 1} must succeed — the cap evicts, it never refuses`);
+                assert.ok(transport.cookies().length > 0, `login ${i + 1} must set a session cookie on its jar`);
+                sessions.push(transport);
+            }
+            /** `GET /status` on one login's transport: 200 authenticated, 401 not. */
+            const status_on = async (transport) => {
+                const res = await transport(status_path, { method: 'GET' });
+                await res.text();
+                return res.status;
+            };
+            assert.strictEqual(await status_on(sessions[sessions.length - 1]), 200, 'the newest session must still resolve — the cap must evict, not refuse');
+            assert.strictEqual(await status_on(sessions[0]), 401, `the oldest session must be evicted once the account exceeds ${max_sessions} sessions ` +
+                '(a spine with no cap authenticates this cookie)');
+        });
+    });
+};

package/dist/testing/middleware.d.ts

@@ -11,7 +11,6 @@ import './assert_dev_env.js';
 import { vi } from 'vitest';
 import { Hono } from 'hono';
 import type { z } from 'zod';
-import type { RateLimiter } from '../rate_limiter.js';
 import { type RequestContext } from '../auth/request_context.js';
 /** Mock configuration for bearer auth middleware test setup. */
 export interface BearerAuthTestOptions {
@@ -80,7 +79,7 @@ export declare const TEST_CLIENT_IP = "127.0.0.1";
  * The route handler at `/api/test` returns the resolved context in the response body,
  * enabling assertions on `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY`.
  */
-export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions, ip_rate_limiter?: RateLimiter | null) => {
+export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions) => {
     app: Hono;
     mocks: BearerAuthMocks;
 };
@@ -89,7 +88,7 @@ export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions, ip
  *
  * Generates one `test()` per case inside a `describe()` block.
  */
-export declare const describe_bearer_auth_cases: (suite_name: string, cases: Array<BearerAuthTestCase>, ip_rate_limiter?: RateLimiter | null) => void;
+export declare const describe_bearer_auth_cases: (suite_name: string, cases: Array<BearerAuthTestCase>) => void;
 /** Path used by the echo route in `create_test_middleware_stack_app`. */
 export declare const TEST_MIDDLEWARE_PATH = "/api/test";
 /** Options for `create_test_middleware_stack_app`. */
@@ -100,8 +99,6 @@ export interface TestMiddlewareStackOptions {
     allowed_origins?: string;
     /** Connection IP or factory. @default first trusted proxy */
     connection_ip?: string | (() => string | undefined);
-    /** Rate limiter for bearer auth. @default `null` */
-    ip_rate_limiter?: RateLimiter | null;
 }
 /** Return type of `create_test_middleware_stack_app`. */
 export interface TestMiddlewareStackApp {

package/dist/testing/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAe7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2BtF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,EACzB,kBAAiB,WAAW,GAAG,IAAW,KACxC;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAyDrC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,EAChC,kBAAiB,WAAW,GAAG,IAAW,KACxC,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,oDAAoD;IACpD,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBA4DF,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAe7B,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2BtF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,KACvB;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAwDrC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAC9B,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBAwDF,CAAC"}

package/dist/testing/middleware.js

@@ -91,9 +91,9 @@ export const TEST_CLIENT_IP = '127.0.0.1';
  * The route handler at `/api/test` returns the resolved context in the response body,
  * enabling assertions on `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY`.
  */
-export const create_bearer_auth_test_app = (tc, ip_rate_limiter = null) => {
+export const create_bearer_auth_test_app = (tc) => {
     const mocks = create_bearer_auth_mocks(tc);
-    const bearer_middleware = create_bearer_auth_middleware(STUB_DEPS, ip_rate_limiter, new Logger('test', { level: 'off' }));
+    const bearer_middleware = create_bearer_auth_middleware(STUB_DEPS, new Logger('test', { level: 'off' }));
     const app = new Hono();
     // inject pre-existing session identity if the test case specifies one.
     // `pre_context` simulates the session middleware having authenticated
@@ -144,11 +144,11 @@ export const create_bearer_auth_test_app = (tc, ip_rate_limiter = null) => {
  *
  * Generates one `test()` per case inside a `describe()` block.
  */
-export const describe_bearer_auth_cases = (suite_name, cases, ip_rate_limiter = null) => {
+export const describe_bearer_auth_cases = (suite_name, cases) => {
     describe(suite_name, () => {
         for (const tc of cases) {
             test(tc.name, async () => {
-                const { app, mocks } = create_bearer_auth_test_app(tc, ip_rate_limiter);
+                const { app, mocks } = create_bearer_auth_test_app(tc);
                 const res = await app.request('/api/test', {
                     method: 'GET',
                     headers: tc.headers
@@ -227,7 +227,7 @@ export const create_test_middleware_stack_app = (options) => {
     });
     const allowed_patterns = parse_allowed_origins(allowed_origins_str);
     const origin_mw = verify_request_source(allowed_patterns);
-    const bearer_mw = create_bearer_auth_middleware(STUB_DEPS, options?.ip_rate_limiter ?? null, new Logger('test', { level: 'off' }));
+    const bearer_mw = create_bearer_auth_middleware(STUB_DEPS, new Logger('test', { level: 'off' }));
     const app = new Hono();
     app.use('*', proxy_mw);
     app.use('/api/*', origin_mw);

package/dist/testing/rate_limiting.d.ts

@@ -4,7 +4,7 @@ import type { AppServerContext } from '../server/app_server_context.js';
 import type { RouteSpec } from '../http/route_spec.js';
 import { type SuiteAppOptions } from './app_server.js';
 import { type DbFactory } from './db.js';
-import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
+import type { RpcEndpointsSuiteOption } from './rpc_helpers.js';
 /**
  * Configuration for `describe_rate_limiting_tests`.
  */
@@ -25,37 +25,31 @@ export interface RateLimitingTestOptions {
      */
     max_attempts?: number;
     /**
-     * RPC endpoint specs — required so the bearer-auth rate limiting test
-     * can probe an authenticated method via the `account_verify` RPC
-     * action. Hard-fails via `require_rpc_endpoint_path` on setup.
+     * RPC endpoint specs mounted on the test app. Optional — both suites below
+     * exercise REST auth routes, so nothing here needs an RPC path.
      *
      * Accepts either an array (eager) or a factory
      * `(ctx: AppServerContext) => Array<RpcEndpointSpec>` — the factory form
      * is required when action handlers must close over the per-test
-     * `ctx.deps`. The factory must return the same
-     * endpoint `path` regardless of ctx — it is invoked once at setup with
-     * a stub ctx for path lookup and again per-test by `create_app_server`
-     * for live dispatch.
+     * `ctx.deps`.
      */
-    rpc_endpoints: RpcEndpointsSuiteOption;
+    rpc_endpoints?: RpcEndpointsSuiteOption;
 }
 /**
  * Standard rate limiting integration test suite.
  *
- * Creates 3 test groups:
+ * Creates 2 test groups:
  * 1. IP rate limiting on login — fires `max_attempts + 1` login requests,
  *    verifies the last returns 429 with a valid `RateLimitError` body.
  * 2. Per-account rate limiting on login — fires `max_attempts + 1` login
  *    requests with the same username, verifies the last returns 429.
- * 3. Bearer auth IP rate limiting — fires `max_attempts + 1` bearer requests
- *    with an invalid token, verifies the last returns 429.
+ *
+ * There is deliberately no bearer-auth group: the bearer path carries no rate
+ * limiter on either spine, because an API token's entropy — not throttling —
+ * is what bounds guessing it. See `auth/bearer_auth.ts`.
  *
  * Each test group asserts that required routes exist, failing with a descriptive
  * message if the consumer's route specs are misconfigured.
- *
- * @throws Error at setup time when `options.rpc_endpoints` is empty — the
- *   bearer-auth rate-limit test probes via the `account_verify` RPC action,
- *   so the suite hard-fails via `require_rpc_endpoint_path`.
  */
 export declare const describe_rate_limiting_tests: (options: RateLimitingTestOptions) => void;
 //# sourceMappingURL=rate_limiting.d.ts.map

package/dist/testing/rate_limiting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate_limiting.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rate_limiting.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA0B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAK1B;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IAgQ/E,CAAC"}
+{"version":3,"file":"rate_limiting.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rate_limiting.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA0B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAEjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IAqK/E,CAAC"}