@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/testing/cross_backend/full_spine_mount.js

@@ -5,7 +5,7 @@ import { create_standard_rpc_actions } from '../../auth/standard_rpc_actions.js'
 import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
 import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
 import { create_actor_search_actions } from '../../auth/actor_search_actions.js';
-import { create_testing_action_manifest_action, create_testing_actions } from './testing_reset_actions.js';
+import { create_testing_action_manifest_action, create_testing_actions, create_testing_origin_check_action, create_testing_shorten_credential_expiry_action } from './testing_reset_actions.js';
 import { test_cell_gated_create_authorize } from './test_cell_gated_create_authorize.js';
 import { spine_roles, spine_session_options } from './default_spine_surface.js';
 /**
@@ -39,6 +39,12 @@ export const build_full_spine_rpc_actions = (deps, options) => {
         ...create_all_cell_actions({ ...deps, authorize_create: test_cell_gated_create_authorize }, { roles: spine_roles }),
         ...create_actor_lookup_actions(deps),
         ...create_actor_search_actions(deps),
+        // the origin conformance table's probe — kept out of
+        // `create_testing_actions` (see its spec doc)
+        create_testing_origin_check_action(),
+        // the credential-deadline suite's shorten-only seam — kept out of
+        // `create_testing_actions` for the same reason
+        create_testing_shorten_credential_expiry_action(),
         // `peer/ping` is mounted on the HTTP RPC endpoint too (not just WS) so an
         // HTTP invocation reaches the handler and refuses with `peer_no_transport`
         // rather than `method_not_found`. It's a protocol action, so it's filtered

package/dist/testing/cross_backend/login_security.d.ts

@@ -6,6 +6,22 @@ export interface LoginSecurityCrossTestOptions {
     readonly setup_test: SetupTest;
     /** REST login route path. Default `/api/account/login` (the spine convention). */
     readonly login_path?: string;
+    /** REST password-change route path. Default `/api/account/password`. */
+    readonly password_path?: string;
+    /**
+     * Whether the backend serves concurrent logins — each its own database
+     * transaction — at once, for the burst-of-correct-logins case. Default
+     * `false`: a backend on one in-process connection (pglet-wasm, PGlite)
+     * refuses a second top-level transaction while one runs, so concurrent
+     * successful logins answer `500` there whatever the limiter does.
+     */
+    readonly concurrent_transactions?: boolean;
+    /**
+     * The backend's base URL, for the repeated-`X-Forwarded-For` case, which
+     * needs a raw socket to send two header lines. `null` (the default) skips
+     * that case.
+     */
+    readonly base_url?: string | null;
 }
 export declare const describe_login_security_cross_tests: (options: LoginSecurityCrossTestOptions) => void;
 //# sourceMappingURL=login_security.d.ts.map

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA0BD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA2KF,CAAC"}
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAgDD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA4UF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -24,6 +24,26 @@ import '../assert_dev_env.js';
  *   not `429`). A backend that ignored XFF and keyed on the (loopback) TCP
  *   peer would 429 the fresh-IP request too — so the `401` proves the limiter
  *   keys on the resolved `X-Forwarded-For` client IP.
+ * - **IPv6 clients share a bucket per `/64`** — after one forwarded IPv6
+ *   address exhausts its bucket, another address in the same `/64` is `429`
+ *   and one in the next `/64` is not; the login audit rows keep each full
+ *   address, never the bucket key. A password change, which shares the
+ *   per-IP login limiter, from an address in an exhausted `/64` is `429` too.
+ * - **a concurrent burst gets at most the cap past the limiter** — `2 ×
+ *   ip_limit` wrong logins sent at once from one fresh forwarded IP answer at
+ *   most `ip_limit` `401`s and `429` for the rest. A limiter checked before
+ *   the lookup and recorded after the verify lets the whole burst through; each
+ *   attempt is reserved instead, counted in flight from the check on.
+ * - **a burst of correct logins past the cap waits, then succeeds** — attempts
+ *   count while in flight whatever their outcome, so `2 × ip_limit` correct
+ *   logins at once from one address meet the cap; the ones past it wait for a
+ *   slot (at most the cap of them) and all answer `200`. Runs on a backend
+ *   that serves concurrent transactions (`concurrent_transactions`).
+ * - **every `X-Forwarded-For` line is read** — a client that sends its own
+ *   line ahead of the one the trusted proxy appended can't choose its bucket:
+ *   after exhausting one forwarded IP, a raw request carrying a spoofed line
+ *   first and that IP last still `429`s. Raw socket only (`fetch` merges
+ *   repeated headers into one line), so it runs when `base_url` is given.
  * - **a success does not refund the per-IP budget** — the distributed-spray
  *   backstop. Failed guesses against *distinct* usernames from one forwarded
  *   IP, interleaved with the attacker's own successful logins, must still 429
@@ -50,7 +70,11 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { ERROR_RATE_LIMIT_EXCEEDED } from '../../http/error_schemas.js';
+import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
 import { default_login_account_rate_limit, default_login_ip_rate_limit } from '../../rate_limiter.js';
+import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
+import { cross_rpc_call, expect_output } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
  * RFC 5737 TEST-NET-3 (`203.0.113.0/24`) documentation addresses — guaranteed
  * non-routable, so they never collide with a real client IP. One per bucket the
@@ -63,11 +87,35 @@ const XFF_IP_LIMIT = '203.0.113.1';
 const XFF_SEGREGATION_EXHAUST = '203.0.113.2';
 const XFF_SEGREGATION_FRESH = '203.0.113.3';
 const XFF_SPRAY = '203.0.113.4';
+const XFF_BURST = '203.0.113.5';
+const XFF_CORRECT_BURST = '203.0.113.7';
+const XFF_REPEATED_LINES = '203.0.113.6';
+/** RFC 5737 TEST-NET-2 — the address a client writes into its own first line. */
+const XFF_SPOOFED_LINE = '198.51.100.77';
+/**
+ * RFC 3849 documentation (`2001:db8::/32`) addresses: two in one `/64` — the
+ * second differs past bit 64 only — and one in the next `/64`.
+ */
+const XFF_V6_EXHAUST = '2001:db8:e3:1::1';
+const XFF_V6_SAME_64 = '2001:db8:e3:1:8000::2';
+const XFF_V6_OTHER_64 = '2001:db8:e3:2::1';
+/**
+ * Two addresses in one more `/64`: login exhausts the first, and a password
+ * change — which reserves on the same per-IP login limiter — comes from the
+ * second.
+ */
+const XFF_V6_PASSWORD_EXHAUST = '2001:db8:e3:5::1';
+const XFF_V6_PASSWORD_SAME_64 = '2001:db8:e3:5:8000::2';
+/** How long a raw exchange waits for the login's answer. */
+const RAW_READ_TIMEOUT_MS = 5000;
 /** A non-routable, non-existent identifier — login resolves to the not-found path (records the bucket, returns 401). */
 const PROBE_PASSWORD = 'login_security_wrong_password';
 export const describe_login_security_cross_tests = (options) => {
     const { setup_test } = options;
     const login_path = options.login_path ?? '/api/account/login';
+    const password_path = options.password_path ?? '/api/account/password';
+    const concurrent_transactions = options.concurrent_transactions ?? false;
+    const base_url = options.base_url ?? null;
     /** Per-IP cap shared by both impls (TS `default_login_ip_rate_limit`, Rust `DEFAULT_LOGIN_IP_RATE_LIMIT`). */
     const ip_limit = default_login_ip_rate_limit.max_attempts;
     // The XFF-segregation case enables both limiters (one flag drives both), so
@@ -145,6 +193,112 @@ export const describe_login_security_cross_tests = (options) => {
             const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
             assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
         });
+        test('IPv6 clients share a bucket per /64, and the audit row keeps the full address', async () => {
+            const fixture = await setup_test();
+            for (let i = 0; i < ip_limit; i++) {
+                const outcome = await attempt(fixture, XFF_V6_EXHAUST, 'probe_v6');
+                assert.strictEqual(outcome.status, 401, `attempt ${i + 1} from ${XFF_V6_EXHAUST}`);
+            }
+            // another address in the same /64 draws the same budget
+            const same = await attempt(fixture, XFF_V6_SAME_64, 'probe_v6');
+            assert.strictEqual(same.status, 429, 'an address in the same /64 must be rate-limited');
+            // the next /64 has its own
+            const other = await attempt(fixture, XFF_V6_OTHER_64, 'probe_v6');
+            assert.strictEqual(other.status, 401, 'the next /64 must keep its own budget');
+            // The limiter keys the /64; the audit trail keeps the address. Drain
+            // the fire-and-forget audit writes, then read this test's login rows
+            // (`_testing_reset` wiped the log at setup).
+            const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), SPINE_RPC_PATH, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+            const listed = expect_output(await cross_rpc_call(fixture.transport, SPINE_RPC_PATH, 'audit_log_list', { event_type: 'login', outcome: 'failure' }, fixture.create_session_headers()), AuditLogListOutput);
+            const ips = listed.events.map((e) => e.ip);
+            assert.ok(ips.includes(XFF_V6_EXHAUST), `audit ips: ${JSON.stringify(ips)}`);
+            assert.ok(ips.includes(XFF_V6_OTHER_64), `audit ips: ${JSON.stringify(ips)}`);
+            assert.ok(ips.every((ip) => ip === null || !ip.includes('/')), `no audit row may carry a rate-limit key: ${JSON.stringify(ips)}`);
+        });
+        test('a password change from the /64 an exhausted IPv6 login shares is rate-limited', async () => {
+            const fixture = await setup_test();
+            for (let i = 0; i < ip_limit; i++) {
+                const outcome = await attempt(fixture, XFF_V6_PASSWORD_EXHAUST, 'probe_v6_password');
+                assert.strictEqual(outcome.status, 401, `attempt ${i + 1} from ${XFF_V6_PASSWORD_EXHAUST}`);
+            }
+            // The keeper's session, from another address in the same /64: the
+            // password route reserves on the per-IP login limiter before it
+            // reads the credential or the body, so the /64's spent budget
+            // answers. Keyed on the full address instead, the wrong
+            // `current_password` would answer `401`.
+            const res = await fixture.fresh_transport()(password_path, {
+                method: 'POST',
+                headers: fixture.create_session_headers({
+                    'content-type': 'application/json',
+                    'x-forwarded-for': XFF_V6_PASSWORD_SAME_64
+                }),
+                body: JSON.stringify({
+                    current_password: PROBE_PASSWORD,
+                    new_password: 'login_security_new_password'
+                })
+            });
+            const body = (await res.json().catch(() => undefined));
+            assert.strictEqual(res.status, 429, `password change answered ${JSON.stringify(body)}`);
+            assert.strictEqual(body?.error, ERROR_RATE_LIMIT_EXCEEDED);
+        });
+        test(`a concurrent burst of ${ip_limit * 2} wrong logins gets at most ${ip_limit} past the per-IP limit`, async () => {
+            const fixture = await setup_test();
+            // All sent at once, so every request reaches the limiter before any
+            // has been answered. Its own username keeps the per-account bucket
+            // (cap above the IP cap, asserted above) out of the count.
+            const outcomes = await Promise.all(Array.from({ length: ip_limit * 2 }, () => attempt(fixture, XFF_BURST, 'probe_burst')));
+            const statuses = outcomes.map((o) => o.status);
+            const refused = statuses.filter((status) => status === 401).length;
+            const limited = statuses.filter((status) => status === 429).length;
+            // Exactly the cap: every admitted attempt fails and records, and the
+            // ones past it — waiting for a slot — are refused as those failures
+            // record, so the count is the same however the burst interleaves.
+            assert.strictEqual(refused, ip_limit, `exactly ${ip_limit} may reach the verify (${statuses})`);
+            assert.strictEqual(refused + limited, ip_limit * 2, `the rest must be 429 (${statuses})`);
+            // And the window is spent: the burst can't have left budget behind.
+            const after = await attempt(fixture, XFF_BURST, 'probe_burst');
+            assert.strictEqual(after.status, 429, 'the burst must leave the per-IP bucket full');
+        });
+        test.skipIf(!concurrent_transactions)(`a concurrent burst of ${ip_limit * 2} correct logins all succeed past the per-IP cap`, async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account({
+                username: 'burst_correct',
+                password_value: 'burst_correct_password'
+            });
+            const statuses = await Promise.all(Array.from({ length: ip_limit * 2 }, () => succeed(fixture, XFF_CORRECT_BURST, account.account.username, 'burst_correct_password')));
+            assert.deepStrictEqual(statuses, Array(ip_limit * 2).fill(200), 'the logins past the cap wait for a slot rather than being refused');
+        });
+        test.skipIf(base_url === null)('every X-Forwarded-For line is read (a spoofed first line picks no bucket)', async () => {
+            assert.ok(base_url !== null);
+            const fixture = await setup_test();
+            for (let i = 0; i < ip_limit; i++) {
+                await attempt(fixture, XFF_REPEATED_LINES, 'probe_xff_lines');
+            }
+            const exhausted = await attempt(fixture, XFF_REPEATED_LINES, 'probe_xff_lines');
+            assert.strictEqual(exhausted.status, 429, 'the forwarded IP must be exhausted first');
+            // The client's own line first, the address the proxy appended last.
+            // A backend that read only the first line would key this on the
+            // fresh spoofed address and answer 401.
+            const url = new URL(base_url);
+            const body = JSON.stringify({ username: 'probe_xff_lines', password: PROBE_PASSWORD });
+            const request = `POST ${login_path} HTTP/1.1\r\n` +
+                `host: ${url.host}\r\n` +
+                `content-type: application/json\r\n` +
+                `x-forwarded-for: ${XFF_SPOOFED_LINE}\r\n` +
+                `x-forwarded-for: ${XFF_REPEATED_LINES}\r\n` +
+                `content-length: ${body.length}\r\n` +
+                `connection: close\r\n` +
+                `\r\n` +
+                body;
+            const { received } = await raw_http_exchange(base_url, request, {
+                read_timeout_ms: RAW_READ_TIMEOUT_MS,
+                until: 'response'
+            });
+            const response = raw_http_parse_response(received);
+            assert.ok(response, `no whole response; received: ${received.slice(0, 200)}`);
+            assert.strictEqual(response.status, 429, `the request must key on the proxy-appended line (body: ${response.body})`);
+        });
         test('a success does not refund the per-IP budget (distributed-spray backstop)', async () => {
             const fixture = await setup_test();
             // The attacker's own account. Minting rides the setup path from

package/dist/testing/cross_backend/narrowed_api_token.d.ts

@@ -0,0 +1,23 @@
+import '../assert_dev_env.js';
+import { type RpcCallApp } from '../rpc_helpers.js';
+/** Options for `mint_narrowed_api_token`. */
+export interface MintNarrowedApiTokenOptions {
+    /** Transport the mint goes over — it must carry an allowed `Origin` (the default `rpc_call` one does). */
+    readonly app: RpcCallApp;
+    /** RPC endpoint path `account_token_create` is mounted on. */
+    readonly rpc_path: string;
+    /** Session credential headers of the account that owns the token — the mint is session-only. */
+    readonly session_headers: Record<string, string>;
+    /** The RPC methods the token admits; every other method and every non-RPC surface refuses it. */
+    readonly methods: ReadonlyArray<string>;
+    /** Token label. Default `'narrowed test token'`. */
+    readonly name?: string;
+}
+/**
+ * Mint a narrowed api token and return its raw bearer value.
+ *
+ * @returns the raw token, for an `Authorization: Bearer` header
+ * @throws Error when the mint is refused, naming the status and error
+ */
+export declare const mint_narrowed_api_token: (options: MintNarrowedApiTokenOptions) => Promise<string>;
+//# sourceMappingURL=narrowed_api_token.d.ts.map

package/dist/testing/cross_backend/narrowed_api_token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"narrowed_api_token.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/narrowed_api_token.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiB9B,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEvE,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C,0GAA0G;IAC1G,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,2BAA2B,KAClC,OAAO,CAAC,MAAM,CAmBhB,CAAC"}

package/dist/testing/cross_backend/narrowed_api_token.js

@@ -0,0 +1,40 @@
+import '../assert_dev_env.js';
+/**
+ * Mint a narrowed (method-scoped) api token through the production
+ * `account_token_create` path, for suites that probe what a narrowed token is
+ * refused.
+ *
+ * Minted rather than seeded: the token comes out of the same handler a real
+ * minter uses, on whichever account owns the session the caller passes — so a
+ * suite can put a narrowed token on an account that lacks a gating role, and
+ * the mint itself asserts that a narrowed scope is accepted at the mint
+ * boundary, not merely stored.
+ *
+ * @module
+ */
+import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
+import { rpc_call_for_spec } from '../rpc_helpers.js';
+/**
+ * Mint a narrowed api token and return its raw bearer value.
+ *
+ * @returns the raw token, for an `Authorization: Bearer` header
+ * @throws Error when the mint is refused, naming the status and error
+ */
+export const mint_narrowed_api_token = async (options) => {
+    const { app, rpc_path, session_headers, methods, name = 'narrowed test token' } = options;
+    const res = await rpc_call_for_spec({
+        app,
+        path: rpc_path,
+        spec: account_token_create_action_spec,
+        params: {
+            name,
+            scope: { kind: 'methods', methods: [...methods] },
+            lifetime: { kind: 'eternal' }
+        },
+        headers: session_headers
+    });
+    if (!res.ok) {
+        throw new Error(`minting a narrowed api token failed with ${res.status}: ${JSON.stringify(res.error)}`);
+    }
+    return res.result.token;
+};

package/dist/testing/cross_backend/origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAM9D,eAAO,MAAM,2BAA2B,GAAI,SAAS,sBAAsB,KAAG,IAwC7E,CAAC"}
+{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAM9D,eAAO,MAAM,2BAA2B,GAAI,SAAS,sBAAsB,KAAG,IAqB7E,CAAC"}

package/dist/testing/cross_backend/origin.js

@@ -3,18 +3,17 @@ import '../assert_dev_env.js';
  * Cross-backend parity suite for Origin verification.
  *
  * Origin checking is middleware that runs *before* the RPC dispatcher and
- * returns a flat REST `{error}` body — not a JSON-RPC envelope — so it
- * doesn't fit the envelope-shaped conformance-table runner. This dedicated
- * imperative suite drives raw transport calls instead, mirroring how the
- * in-process origin tests were already hand-rolled. Two cases:
+ * refuses only an `Origin` it doesn't allow. The case here needs a transport
+ * that sends no `Origin` at all (`fresh_transport({origin: null})`), so this
+ * is an imperative suite rather than a conformance-table row. The case:
  *
- * - **disallowed `Origin` → 403** `forbidden_origin`, refused before any
- *   handler runs (the allowlist rejects the cross-origin request even with
- *   a valid session cookie attached).
  * - **absent `Origin` → request passes** — non-browser / direct-access
  *   clients (curl, CLI, server-to-server) carry no `Origin` and must not be
  *   blocked; token auth is the control for those callers.
  *
+ * A disallowed `Origin` → 403 `forbidden_origin`, on every transport, is
+ * pinned by the front-door table (`transport_composition.ts`).
+ *
  * Runs both legs via the shared `setup_test` protocol: the
  * in-process leg (`auth/origin_parity.db.test.ts`, plain `gro test`) and the
  * cross-process leg (`cross_backend/origin.cross.test.ts`, the TS spine
@@ -25,7 +24,6 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
-import { ERROR_FORBIDDEN_ORIGIN } from '../../http/error_schemas.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Build the JSON-RPC envelope body for a nullary `account_verify` call. */
 const verify_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
@@ -33,24 +31,6 @@ export const describe_origin_cross_tests = (options) => {
     const { setup_test } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
     describe('origin verification parity', () => {
-        test('disallowed Origin → 403 forbidden_origin (refused before dispatch)', async () => {
-            const fixture = await setup_test();
-            // Keeper session cookie attached + a rogue Origin header (overrides
-            // the transport's default allowed Origin). The allowlist must reject
-            // before the dispatcher, returning a flat REST error body.
-            const res = await fixture.transport(rpc_path, {
-                method: 'POST',
-                headers: {
-                    ...fixture.create_session_headers(),
-                    origin: 'http://evil.com',
-                    'content-type': 'application/json'
-                },
-                body: verify_envelope('evil-origin')
-            });
-            assert.strictEqual(res.status, 403, 'disallowed Origin must be rejected with 403');
-            const body = (await res.json().catch(() => undefined));
-            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
-        });
         test('absent Origin → request passes (non-browser direct access)', async () => {
             const fixture = await setup_test();
             // `origin: null` so no Origin header is sent at all (a header omission

package/dist/testing/cross_backend/origin_conformance.d.ts

@@ -0,0 +1,152 @@
+import '../assert_dev_env.js';
+import { z } from 'zod';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+import { TestingOriginCheckOutput, type TestingOriginCheckInput } from './testing_reset_actions.js';
+/** One expected refusal of a parse row. */
+export declare const OriginConformanceError: z.ZodObject<{
+    index: z.ZodOptional<z.ZodNumber>;
+    kind: z.ZodEnum<{
+        empty_entry: "empty_entry";
+        not_printable_ascii: "not_printable_ascii";
+        missing_scheme: "missing_scheme";
+        unsupported_scheme: "unsupported_scheme";
+        has_path: "has_path";
+        has_userinfo: "has_userinfo";
+        missing_host: "missing_host";
+        invalid_host_char: "invalid_host_char";
+        unbracketed_ipv6: "unbracketed_ipv6";
+        partial_wildcard: "partial_wildcard";
+        non_canonical_ipv4: "non_canonical_ipv4";
+        unclosed_ipv6: "unclosed_ipv6";
+        invalid_ipv6: "invalid_ipv6";
+        invalid_after_ipv6: "invalid_after_ipv6";
+        invalid_port: "invalid_port";
+        default_port: "default_port";
+        no_origins: "no_origins";
+    }>;
+}, z.core.$strict>;
+export type OriginConformanceError = z.infer<typeof OriginConformanceError>;
+/** A parse row: the value parses (`ok: true`), or is refused with `errors`. */
+export declare const OriginConformanceParseRow: z.ZodUnion<readonly [z.ZodObject<{
+    raw: z.ZodString;
+    ok: z.ZodLiteral<true>;
+    note: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    raw: z.ZodString;
+    errors: z.ZodArray<z.ZodObject<{
+        index: z.ZodOptional<z.ZodNumber>;
+        kind: z.ZodEnum<{
+            empty_entry: "empty_entry";
+            not_printable_ascii: "not_printable_ascii";
+            missing_scheme: "missing_scheme";
+            unsupported_scheme: "unsupported_scheme";
+            has_path: "has_path";
+            has_userinfo: "has_userinfo";
+            missing_host: "missing_host";
+            invalid_host_char: "invalid_host_char";
+            unbracketed_ipv6: "unbracketed_ipv6";
+            partial_wildcard: "partial_wildcard";
+            non_canonical_ipv4: "non_canonical_ipv4";
+            unclosed_ipv6: "unclosed_ipv6";
+            invalid_ipv6: "invalid_ipv6";
+            invalid_after_ipv6: "invalid_after_ipv6";
+            invalid_port: "invalid_port";
+            default_port: "default_port";
+            no_origins: "no_origins";
+        }>;
+    }, z.core.$strict>>;
+    note: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+export type OriginConformanceParseRow = z.infer<typeof OriginConformanceParseRow>;
+/** A match row: a valid allowlist, one `Origin` value or `null`, and the answer. */
+export declare const OriginConformanceMatchRow: z.ZodObject<{
+    patterns: z.ZodString;
+    origin: z.ZodNullable<z.ZodString>;
+    allowed: z.ZodBoolean;
+    note: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type OriginConformanceMatchRow = z.infer<typeof OriginConformanceMatchRow>;
+/** The conformance table. */
+export declare const OriginConformance: z.ZodObject<{
+    parse: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        raw: z.ZodString;
+        ok: z.ZodLiteral<true>;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        raw: z.ZodString;
+        errors: z.ZodArray<z.ZodObject<{
+            index: z.ZodOptional<z.ZodNumber>;
+            kind: z.ZodEnum<{
+                empty_entry: "empty_entry";
+                not_printable_ascii: "not_printable_ascii";
+                missing_scheme: "missing_scheme";
+                unsupported_scheme: "unsupported_scheme";
+                has_path: "has_path";
+                has_userinfo: "has_userinfo";
+                missing_host: "missing_host";
+                invalid_host_char: "invalid_host_char";
+                unbracketed_ipv6: "unbracketed_ipv6";
+                partial_wildcard: "partial_wildcard";
+                non_canonical_ipv4: "non_canonical_ipv4";
+                unclosed_ipv6: "unclosed_ipv6";
+                invalid_ipv6: "invalid_ipv6";
+                invalid_after_ipv6: "invalid_after_ipv6";
+                invalid_port: "invalid_port";
+                default_port: "default_port";
+                no_origins: "no_origins";
+            }>;
+        }, z.core.$strict>>;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>>;
+    match: z.ZodArray<z.ZodObject<{
+        patterns: z.ZodString;
+        origin: z.ZodNullable<z.ZodString>;
+        allowed: z.ZodBoolean;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type OriginConformance = z.infer<typeof OriginConformance>;
+/** The committed table, resolved relative to this module. */
+export declare const ORIGIN_CONFORMANCE_URL: URL;
+/**
+ * Read and validate the committed conformance table.
+ *
+ * @returns the parsed table
+ * @throws Error when the file doesn't match `OriginConformance`
+ */
+export declare const load_origin_conformance: () => OriginConformance;
+/** One table row as the action input that checks it. */
+export interface OriginConformanceCheck {
+    /** A short label naming the row, for a failure message. */
+    readonly label: string;
+    readonly input: TestingOriginCheckInput;
+    readonly expected: TestingOriginCheckOutput;
+}
+/**
+ * Flatten the table into action inputs and the answers they must get. A parse
+ * row sends a `null` origin, so a value that parses answers
+ * `{ok: true, allowed: true}`.
+ *
+ * @param table - the conformance table
+ * @returns one check per row, parse rows first
+ */
+export declare const to_origin_conformance_checks: (table: OriginConformance) => Array<OriginConformanceCheck>;
+/**
+ * Compare each check's answer with its expectation and fail once, listing
+ * every row that disagrees.
+ *
+ * @param checks - the table's checks
+ * @param answer - the answer each check got, in order
+ * @param backend - the name the failure message gives the answerer
+ */
+export declare const assert_origin_conformance: (checks: ReadonlyArray<OriginConformanceCheck>, answer: ReadonlyArray<unknown>, backend: string) => void;
+/** Options for `describe_origin_conformance_cross_tests`. */
+export type OriginConformanceCrossTestOptions = RpcPathCrossSuiteOptions;
+/**
+ * Register the origin conformance suite: every row of the committed table,
+ * sent to the backend's `_testing_origin_check` action over the keeper's
+ * daemon-token channel, must get the answer the table names. The action is on
+ * every spine test binary, so the suite is ungated.
+ */
+export declare const describe_origin_conformance_cross_tests: (options: OriginConformanceCrossTestOptions) => void;
+//# sourceMappingURL=origin_conformance.d.ts.map

package/dist/testing/cross_backend/origin_conformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin_conformance.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin_conformance.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EACN,wBAAwB,EAExB,KAAK,uBAAuB,EAC5B,MAAM,4BAA4B,CAAC;AAEpC,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAOpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,oFAAoF;AACpF,eAAO,MAAM,yBAAyB;;;;;kBAKpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,6BAA6B;AAC7B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,EAAE,GAA2D,CAAC;AAEjG;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAO,iBACuC,CAAC;AAEnF,wDAAwD;AACxD,MAAM,WAAW,sBAAsB;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,iBAAiB,KACtB,KAAK,CAAC,sBAAsB,CAc9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GACrC,QAAQ,aAAa,CAAC,sBAAsB,CAAC,EAC7C,QAAQ,aAAa,CAAC,OAAO,CAAC,EAC9B,SAAS,MAAM,KACb,IAiBF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,GACnD,SAAS,iCAAiC,KACxC,IA4BF,CAAC"}