@fuzdev/fuz_app 0.145.0 → 0.146.0

package/dist/testing/cross_backend/fact_serving.js

@@ -14,7 +14,11 @@ import '../assert_dev_env.js';
  *   though the identical bytes are world-readable via B's cell (one deduped
  *   `fact` row; authz lives on the `(cell, hash)` edge, never unioned);
  * - **404-mask** — a missing cell and a viewable cell that doesn't reference
- *   the hash both 404 (never 403, never "exists elsewhere");
+ *   the hash both 404 (never 403, never "exists elsewhere"), and every masked
+ *   404 is bodyless, so its shape names no branch;
+ * - **hardening headers** — a served fact carries `X-Content-Type-Options:
+ *   nosniff`, the `default-src 'none'; sandbox` CSP, and `Cache-Control:
+ *   private, max-age=300`, whatever its content type;
  * - **bare-hash admin-only** — `GET /api/facts/:hash` is admin (keeper) only:
  *   non-admin → 403, anonymous → 401;
  * - **multi-actor fallthrough** — a multi-actor caller resolves to a null
@@ -22,7 +26,10 @@ import '../assert_dev_env.js';
  *   read its own *private* fact there (admitted only by public cells). Opt-in
  *   (needs the multi-actor setup); every spine resolves the acting actor at the
  *   dispatcher's authorization phase from account-grain credentials, so the
- *   multi-actor account is drivable on TS and Rust alike.
+ *   multi-actor account is drivable on TS and Rust alike;
+ * - **narrowed-token downgrade** — a scope-narrowed API token on the
+ *   cell-scoped route is anonymous, not refused: its owner's private fact 404s
+ *   exactly as for an anonymous caller, while a public cell still serves.
  *
  * Facts are seeded **embedded** via `_testing_put_fact` (the cross-process
  * driver has no DB handle); the referencing cell via the `cell_create` RPC
@@ -40,8 +47,10 @@ import { describe, assert } from 'vitest';
 import { z } from 'zod';
 import { FactHashSchema } from '../../primitive_schemas.js';
 import { CellCreateOutput } from '../../auth/cell_action_specs.js';
+import { FACT_CACHE_CONTROL, FACT_CONTENT_SECURITY_POLICY, FACT_X_CONTENT_TYPE_OPTIONS } from '../../server/fact_security_headers.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, expect_output } from './cell_cross_helpers.js';
+import { mint_narrowed_api_token } from './narrowed_api_token.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A blake3 hash that is a valid form but references no seeded fact. */
 const UNRELATED_HASH = `blake3:${'0'.repeat(64)}`;
@@ -70,15 +79,37 @@ export const cross_put_fact = async (fixture, rpc_path, input) => expect_output(
 // credential when an `Origin` / `Referer` is present (browser
 // context), and cross-process `fixture.transport` auto-adds `Origin`.
 fixture.fresh_transport({ origin: null }), rpc_path, '_testing_put_fact', input, fixture.create_daemon_token_headers()), TestingPutFactOutput).hash;
-/** GET a fact over a cross-process `FetchTransport`; returns `{status, content_type, text}`. */
+/** GET a fact over a cross-process `FetchTransport`; returns `{status, content_type, text, headers}`. */
 const fact_get = async (transport, path, headers) => {
     const res = await transport(path, { method: 'GET', headers });
     return {
         status: res.status,
         content_type: res.headers.get('content-type'),
-        text: await res.text()
+        text: await res.text(),
+        headers: res.headers
     };
 };
+/**
+ * Assert a served fact carries the hardening headers — `nosniff`, the
+ * sandboxing CSP — and the private cache policy. A spine that dropped either
+ * hardening header would serve a user-typed `content_type` (or a sniffable
+ * octet-stream) as executable HTML.
+ */
+const assert_fact_headers = (headers, label) => {
+    assert.strictEqual(headers.get('x-content-type-options'), FACT_X_CONTENT_TYPE_OPTIONS, `${label}: X-Content-Type-Options`);
+    assert.strictEqual(headers.get('content-security-policy'), FACT_CONTENT_SECURITY_POLICY, `${label}: Content-Security-Policy`);
+    assert.strictEqual(headers.get('cache-control'), FACT_CACHE_CONTROL, `${label}: Cache-Control`);
+};
+/**
+ * Assert a 404 is the masked one: no body, so the response says nothing about
+ * which check refused it.
+ */
+const assert_masked_404 = (got, label) => {
+    assert.strictEqual(got.status, 404, `${label} did not 404`);
+    assert.strictEqual(got.text, '', `${label}: a masked 404 has no body`);
+    // TODO: the content type isn't pinned — the Node TS spine answers the
+    // bodyless 404 with `text/plain; charset=UTF-8`, Deno, Bun and Rust with none
+};
 export const describe_fact_serving_cross_tests = (options) => {
     const { setup_test, setup_test_multi_actor, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -105,6 +136,7 @@ export const describe_fact_serving_cross_tests = (options) => {
             assert.strictEqual(got.text, 'public-fact-bytes');
             // The served `Content-Type` echoes the seeded value on both backends.
             assert.strictEqual(got.content_type, 'text/plain', 'served content-type drifted');
+            assert_fact_headers(got.headers, 'cell-scoped text/plain fact');
         });
         test_if(capabilities.fact_serving, 'cross-owner dedup does not leak: A’s private reference stays 404 while B publishes the same bytes', async () => {
             const fixture = await setup_test();
@@ -129,12 +161,13 @@ export const describe_fact_serving_cross_tests = (options) => {
             assert.strictEqual(via_b.status, 200, `B's public cell should serve the fact: ${via_b.text}`);
             // Seeded without a content_type → both backends fall back to octet-stream.
             assert.strictEqual(via_b.content_type, 'application/octet-stream', 'no-content-type fact should serve as octet-stream');
+            assert_fact_headers(via_b.headers, 'octet-stream fact');
             // A's PRIVATE reference must NOT leak — to anon or to B — even though
             // the identical bytes are world-readable via B's public cell.
             const a_via_anon = await fact_get(anon, cell_fact_path(a_cell, hash), {});
-            assert.strictEqual(a_via_anon.status, 404, "A's private reference leaked to anon");
+            assert_masked_404(a_via_anon, "A's private reference read by anon");
             const a_via_b = await fact_get(t, cell_fact_path(a_cell, hash), b.create_session_headers());
-            assert.strictEqual(a_via_b.status, 404, "A's private reference leaked to B");
+            assert_masked_404(a_via_b, "A's private reference read by B");
             // A can read its own private cell's fact.
             const a_via_a = await fact_get(t, cell_fact_path(a_cell, hash), a.create_session_headers());
             assert.strictEqual(a_via_a.status, 200, 'A could not read its own private fact');
@@ -146,29 +179,33 @@ export const describe_fact_serving_cross_tests = (options) => {
             const admin_headers = fixture.create_session_headers();
             // Missing cell → 404.
             const missing = await fact_get(t, cell_fact_path(NIL_UUID, hash), admin_headers);
-            assert.strictEqual(missing.status, 404, 'missing cell did not 404');
+            assert_masked_404(missing, 'missing cell');
             // A viewable (keeper-owned, public) cell that references a DIFFERENT
             // hash → 404 (missing cell→fact edge), even though the caller can view
             // the cell. `path` is admin-only and the keeper is admin.
             const unrelated_cell = await create_cell_with_ref(t, admin_headers, UNRELATED_HASH, 'public');
             const no_edge = await fact_get(t, cell_fact_path(unrelated_cell, hash), admin_headers);
-            assert.strictEqual(no_edge.status, 404, 'cell without the edge did not 404');
+            assert_masked_404(no_edge, 'cell without the edge');
             // Edge present but no `fact` row: the same cell DOES reference
             // `UNRELATED_HASH`, which was never seeded. Cell + edge + view all
             // pass, so this exercises the distinct serve-time "metadata missing"
             // 404 branch — masked identically to the authz 404s above.
             const edge_no_bytes = await fact_get(t, cell_fact_path(unrelated_cell, UNRELATED_HASH), admin_headers);
-            assert.strictEqual(edge_no_bytes.status, 404, 'edge to an absent fact did not 404');
+            assert_masked_404(edge_no_bytes, 'edge to an absent fact');
         });
         test_if(capabilities.fact_serving, 'bare-hash route is admin-only', async () => {
             const fixture = await setup_test();
             const non_admin = await fixture.create_account({ username: 'fact_non_admin' });
-            const hash = await put_fact(fixture, 'bare-hash-bytes');
+            // stored as `text/html` — the type a dropped hardening header would let
+            // execute in the admin's session
+            const hash = await put_fact(fixture, 'bare-hash-bytes', 'text/html');
             const t = fixture.fresh_transport();
-            // keeper holds ROLE_ADMIN → 200 + the actual bytes.
+            // keeper holds ROLE_ADMIN → 200 + the actual bytes, hardened.
             const as_admin = await fact_get(t, `/api/facts/${hash}`, fixture.create_session_headers());
             assert.strictEqual(as_admin.status, 200, `admin bare-hash read failed: ${as_admin.text}`);
             assert.strictEqual(as_admin.text, 'bare-hash-bytes', 'bare-hash route served wrong bytes');
+            assert.strictEqual(as_admin.content_type, 'text/html', 'served content-type drifted');
+            assert_fact_headers(as_admin.headers, 'bare-hash text/html fact');
             // non-admin → 403.
             const as_non_admin = await fact_get(t, `/api/facts/${hash}`, non_admin.create_session_headers());
             assert.strictEqual(as_non_admin.status, 403, 'non-admin reached the bare-hash route');
@@ -177,6 +214,42 @@ export const describe_fact_serving_cross_tests = (options) => {
             const as_anon = await fact_get(anon, `/api/facts/${hash}`, {});
             assert.strictEqual(as_anon.status, 401, 'anon reached the bare-hash route');
         });
+        // A narrowed token reaches no non-RPC surface; on this anonymous-admitting
+        // route it is downgraded to anonymous rather than refused (a 403 would
+        // enforce nothing — the holder drops the header). So the owner's narrowed
+        // token reads exactly what an anonymous caller reads: its private fact
+        // 404s, a public cell still serves. The owner's full-scope bearer reading
+        // the private fact pins that the 404 is the scope, not the bearer.
+        test_if(capabilities.fact_serving, 'narrowed api token is treated as anonymous on the cell-scoped route', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'fact_narrowed_owner' });
+            const hash = await cross_put_fact(fixture, rpc_path, {
+                content: 'narrowed-token-bytes',
+                holder: owner.actor.id
+            });
+            const t = fixture.fresh_transport();
+            const session = owner.create_session_headers();
+            const private_cell = await create_cell_with_ref(t, session, hash, 'private');
+            const public_cell = await create_cell_with_ref(t, session, hash, 'public');
+            const token = await mint_narrowed_api_token({
+                app: fixture.transport,
+                rpc_path,
+                session_headers: session,
+                methods: ['cell_get']
+            });
+            // no `Origin` — a bearer in a browser context is discarded
+            const bare = fixture.fresh_transport({ origin: null });
+            const narrowed = { authorization: `Bearer ${token}` };
+            const full = await fact_get(bare, cell_fact_path(private_cell, hash), owner.create_bearer_headers());
+            assert.strictEqual(full.status, 200, `full-scope bearer read failed: ${full.text}`);
+            const anon_private = await fact_get(bare, cell_fact_path(private_cell, hash), {});
+            const narrowed_private = await fact_get(bare, cell_fact_path(private_cell, hash), narrowed);
+            assert_masked_404(anon_private, 'anon read of a private fact');
+            assert_masked_404(narrowed_private, 'narrowed-token read of a private fact');
+            const narrowed_public = await fact_get(bare, cell_fact_path(public_cell, hash), narrowed);
+            assert.strictEqual(narrowed_public.status, 200, 'narrowed token refused a public cell');
+            assert.strictEqual(narrowed_public.text, 'narrowed-token-bytes');
+        });
         // The cell-scoped route is pure-public — no `acting?` slot — so the handler
         // can't disambiguate a multi-actor account and resolves it to a null
         // (anonymous) context. This pins that fallthrough: a multi-actor caller is
@@ -201,7 +274,7 @@ export const describe_fact_serving_cross_tests = (options) => {
             // Owns a PRIVATE cell, yet reading its own fact back resolves to a null
             // (anonymous) context → 404. The owner path never runs.
             const own_private = await fact_get(t, cell_fact_path(private_cell, hash), keeper);
-            assert.strictEqual(own_private.status, 404, "multi-actor owner's private read was admitted");
+            assert_masked_404(own_private, "multi-actor owner's private read");
             // A PUBLIC cell still admits the anonymous-treated caller → 200, proving
             // the 404 above is the multi-actor fallthrough, not a blanket block.
             const via_public = await fact_get(t, cell_fact_path(public_cell, hash), keeper);

package/dist/testing/cross_backend/identity_parity.d.ts

@@ -8,6 +8,17 @@ export interface IdentityParityCrossTestOptions {
     readonly login_path?: string;
     /** REST signup route path. Default `/api/account/signup` (the spine convention). */
     readonly signup_path?: string;
+    /**
+     * REST bootstrap route path. Default `/api/account/bootstrap` (the spine
+     * convention); `null` skips the bootstrap case, for a surface that mounts no
+     * bootstrap route.
+     */
+    readonly bootstrap_path?: string | null;
+    /**
+     * REST password-change route path, for the malformed-body case. Default
+     * `/api/account/password` (the spine convention); `null` skips that case.
+     */
+    readonly password_path?: string | null;
 }
 export declare const describe_identity_parity_cross_tests: (options: IdentityParityCrossTestOptions) => void;
 //# sourceMappingURL=identity_parity.d.ts.map

package/dist/testing/cross_backend/identity_parity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmG9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAkB5C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AA8JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IA6TF,CAAC"}
+{"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoH9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AA8JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IAieF,CAAC"}

package/dist/testing/cross_backend/identity_parity.js

@@ -25,7 +25,9 @@ import '../assert_dev_env.js';
  *   all-uppercase submission (proves the *lookup* folds case, not merely that
  *   the stored form was lowercased).
  * - **whitespace-trim login** — the same shape logs in with surrounding
- *   whitespace (proves `.trim()` on the lookup path).
+ *   whitespace (proves `.trim()` on the lookup path). The trimmed set is JS
+ *   `String.prototype.trim`'s on every spine: U+FEFF padding is trimmed (→
+ *   200, and alone → 400 empty), U+0085 is not (→ 401 lookup miss).
  * - **no Unicode case-fold collision (negative)** — a Turkish-`İ` (U+0130)
  *   variant of an existing ASCII username must NOT match. Both JS
  *   `.toLowerCase()` and Rust `str::to_lowercase()` map `İ` → `i` + U+0307
@@ -67,6 +69,10 @@ import '../assert_dev_env.js';
  * with mid-string `_`/`-` accepted siblings as the don't-over-reject control.
  * Signup is also strict-object on both spines (TS `z.strictObject`, Rust
  * `#[serde(deny_unknown_fields)]`), so an unknown signup body key → 400.
+ * Nothing trims a creation username: a padded one is refused 400 at signup and
+ * at bootstrap, never trimmed into a legal name. Bootstrap validates its body
+ * before its window check, so the padded bootstrap answers 400 even after
+ * bootstrap completed.
  *
  * **Email format (creation):** the optional signup `email` is validated to a
  * loose `local@domain.tld` shape on both spines — TS `Email`
@@ -78,6 +84,14 @@ import '../assert_dev_env.js';
  * share. This closed a real divergence: the Rust spine previously
  * length-checked the email only, accepting any non-empty string TS rejected.
  *
+ * **Malformed JSON body:** a body typed `application/json` that doesn't parse
+ * (`{`) or parses to anything but an object (`[]`) is 400 `{error:
+ * "invalid_json_body"}`, with no other field, on login, signup, bootstrap
+ * (`bootstrap_path`, parsed ahead of the window check), and the password change
+ * (`password_path`, default `/api/account/password`, `null` to skip) — parsed
+ * only after its credential and session-only gates, so the case sends the
+ * keeper's session, and an anonymous unparseable body is still 401.
+ *
  * Both surfaces are flat REST on every spine, so this is an imperative suite
  * (not a `conformance_table` row) and ungated. Runs both legs via the shared
  * `{setup_test}` protocol: the in-process leg
@@ -88,8 +102,9 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, test, assert } from 'vitest';
-import { ERROR_INVALID_CREDENTIALS, ERROR_INVALID_REQUEST_BODY, ERROR_NO_MATCHING_INVITE } from '../../http/error_schemas.js';
+import { ERROR_ALREADY_BOOTSTRAPPED, ERROR_AUTHENTICATION_REQUIRED, ERROR_INVALID_CREDENTIALS, ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY, ERROR_NO_MATCHING_INVITE } from '../../http/error_schemas.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+import { test_if } from './capabilities.js';
 /**
  * The flat-REST `{error}` reason each terminal login/signup status carries on
  * every spine — the assertion target that turns a status-only check into a
@@ -245,18 +260,29 @@ export const describe_identity_parity_cross_tests = (options) => {
     const { setup_test } = options;
     const login_path = options.login_path ?? '/api/account/login';
     const signup_path = options.signup_path ?? '/api/account/signup';
+    const bootstrap_path = options.bootstrap_path === undefined ? '/api/account/bootstrap' : options.bootstrap_path;
+    const password_path = options.password_path === undefined ? '/api/account/password' : options.password_path;
     /**
-     * POST JSON on a fresh (cookie-jar-free) transport; return the status and the
-     * parsed flat-REST `{error}` reason (`undefined` for success / non-JSON
-     * bodies). Always reads the body so the cross-process socket releases.
+     * POST a raw body typed `application/json` on a fresh (cookie-jar-free)
+     * transport, with the transport's allowed `Origin`; return the status and
+     * the body text. Always reads the body so the cross-process socket releases.
      */
-    const post_json = async (fixture, path, body) => {
+    const post_raw = async (fixture, path, body, headers) => {
         const res = await fixture.fresh_transport()(path, {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(body)
+            headers: { 'content-type': 'application/json', ...headers },
+            body
         });
-        const text = await res.text().catch(() => '');
+        return { status: res.status, text: await res.text().catch(() => '') };
+    };
+    /**
+     * POST JSON on a fresh (cookie-jar-free) transport; return the status and the
+     * parsed flat-REST `{error}` reason (`undefined` for success / non-JSON
+     * bodies).
+     */
+    const post_json = async (fixture, path, body) => {
+        const res = await post_raw(fixture, path, JSON.stringify(body));
+        const text = res.text;
         let error;
         try {
             const parsed = text ? JSON.parse(text) : undefined;
@@ -311,6 +337,23 @@ export const describe_identity_parity_cross_tests = (options) => {
             await fixture.create_account({ username: 'Canon_Trim_User' });
             assert_attempt(await login(fixture, '  canon_trim_user  '), 200, 'whitespace-trim login');
         });
+        // JS `trim` and Rust `str::trim` disagree on two code points: U+FEFF is JS
+        // whitespace but not Unicode `White_Space`, U+0085 the reverse. Every
+        // spine trims the JS set (TS is the oracle).
+        test('U+FEFF padding is trimmed on lookup → 200', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username: 'canon_bom_user' });
+            assert_attempt(await login(fixture, '\ufeffcanon_bom_user\ufeff'), 200, 'U+FEFF-padded login');
+        });
+        test('U+FEFF alone is empty after the trim → 400', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await login(fixture, '\ufeff'), 400, 'U+FEFF-only login');
+        });
+        test('U+0085 padding is not trimmed → 401 lookup miss', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username: 'canon_nel_user' });
+            assert_attempt(await login(fixture, '\u0085canon_nel_user\u0085'), 401, 'U+0085-padded login');
+        });
         test('no Unicode case-fold collision — Turkish İ variant of an ASCII username → 401', async () => {
             const fixture = await setup_test();
             // `canon_admin_user` carries an ASCII `i`; the probe replaces it with İ
@@ -463,5 +506,77 @@ export const describe_identity_parity_cross_tests = (options) => {
                 unexpected_field: 'x'
             }), 400, 'signup unknown body key');
         });
+        // `Username` validates the raw value — nothing trims a creation username,
+        // so padding is refused, never repaired into a legal name (which would
+        // reach the invite gate → 403, or create the account under open signup).
+        for (const [username, label] of [
+            [' padded_signup_user ', 'space padding'],
+            ['padded_signup_user\t', 'trailing tab'],
+            ['\u0085padded_signup_user', 'leading U+0085']
+        ]) {
+            test(`padded username (${label}) → 400, not trimmed`, async () => {
+                const fixture = await setup_test();
+                assert_attempt(await signup(fixture, username), 400, `signup ${label}`);
+            });
+        }
+    });
+    describe('bootstrap input validation parity', () => {
+        // The body is validated before the bootstrap window is consulted on every
+        // spine (the TS route schema runs ahead of the handler), so a padded
+        // username answers 400 `invalid_request_body` even after bootstrap
+        // completed — not the closed window's refusal. The unpadded control, the
+        // same body otherwise, reaches the closed window, so the 400 can only be
+        // the username's.
+        test_if(bootstrap_path !== null, 'padded username → 400, not trimmed, ahead of the window check', async () => {
+            const fixture = await setup_test();
+            const body = {
+                token: 'identity-parity-not-the-token',
+                username: ' padded_keeper ',
+                password: DEFAULT_TEST_PASSWORD
+            };
+            assert_attempt(await post_json(fixture, bootstrap_path, body), 400, 'bootstrap padded username');
+            const control = await post_json(fixture, bootstrap_path, {
+                ...body,
+                username: 'padded_keeper'
+            });
+            assert.deepStrictEqual(control, { status: 403, error: ERROR_ALREADY_BOOTSTRAPPED }, 'bootstrap unpadded control');
+        });
+    });
+    describe('malformed JSON body parity', () => {
+        // A body typed `application/json` that doesn't parse, or parses to
+        // anything but an object, is 400 `invalid_json_body` on every spine —
+        // never the schema's `invalid_request_body`, and with no other field.
+        // Bootstrap parses ahead of its window check (so the 400 holds after
+        // bootstrap completed); the password change parses only after its
+        // credential and session-only gates, so it needs a session, and an
+        // anonymous caller still hears 401.
+        const MALFORMED_BODIES = [
+            ['{', 'unparseable'],
+            ['[]', 'a non-object array']
+        ];
+        const assert_invalid_json_body = (got, label) => {
+            assert.strictEqual(got.status, 400, `${label} — status: ${got.text}`);
+            assert.deepStrictEqual(JSON.parse(got.text), { error: ERROR_INVALID_JSON_BODY }, `${label} — body`);
+        };
+        const routes = [
+            { name: 'login', path: login_path, session: false },
+            { name: 'signup', path: signup_path, session: false },
+            { name: 'bootstrap', path: bootstrap_path, session: false },
+            { name: 'password', path: password_path, session: true }
+        ];
+        for (const { name, path, session } of routes) {
+            for (const [body, label] of MALFORMED_BODIES) {
+                test_if(path !== null, `${name}: ${label} body → 400 invalid_json_body`, async () => {
+                    const fixture = await setup_test();
+                    assert_invalid_json_body(await post_raw(fixture, path, body, session ? fixture.create_session_headers() : undefined), `${name} ${label} body`);
+                });
+            }
+        }
+        test_if(password_path !== null, 'password: an unparseable body without a session → 401, the gates ahead of the parse', async () => {
+            const fixture = await setup_test();
+            const got = await post_raw(fixture, password_path, '{');
+            assert.strictEqual(got.status, 401, `anonymous unparseable password body: ${got.text}`);
+            assert.strictEqual(JSON.parse(got.text).error, ERROR_AUTHENTICATION_REQUIRED);
+        });
     });
 };

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAgDD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA4UF,CAAC"}
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsF9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAmDD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA8XF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -44,6 +44,12 @@ import '../assert_dev_env.js';
  *   after exhausting one forwarded IP, a raw request carrying a spoofed line
  *   first and that IP last still `429`s. Raw socket only (`fetch` merges
  *   repeated headers into one line), so it runs when `base_url` is given.
+ * - **a malformed hop stops the walk** — a trusted proxy that appends a
+ *   non-bare-IP token (`ip:port` here) leaves the client's own entry to its
+ *   left. After exhausting one forwarded IP, a chain with that IP left of an
+ *   `ip:port` entry answers `401`, not `429`: the walk stopped at the malformed
+ *   entry and keyed the request on the connection IP (its audit row says so),
+ *   never on the client-written entry past it.
  * - **a success does not refund the per-IP budget** — the distributed-spray
  *   backstop. Failed guesses against *distinct* usernames from one forwarded
  *   IP, interleaved with the attacker's own successful logins, must still 429
@@ -90,6 +96,9 @@ const XFF_SPRAY = '203.0.113.4';
 const XFF_BURST = '203.0.113.5';
 const XFF_CORRECT_BURST = '203.0.113.7';
 const XFF_REPEATED_LINES = '203.0.113.6';
+const XFF_MALFORMED_HOP = '203.0.113.8';
+/** What a trusted hop that appends `ip:port` (an Azure App Gateway, IIS ARR) writes. */
+const XFF_PORT_SUFFIXED_HOP = '198.51.100.7:5555';
 /** RFC 5737 TEST-NET-2 — the address a client writes into its own first line. */
 const XFF_SPOOFED_LINE = '198.51.100.77';
 /**
@@ -193,6 +202,25 @@ export const describe_login_security_cross_tests = (options) => {
             const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
             assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
         });
+        test('a malformed hop stops the walk: the request keys on the connection IP', async () => {
+            const fixture = await setup_test();
+            for (let i = 0; i < ip_limit; i++) {
+                await attempt(fixture, XFF_MALFORMED_HOP, 'probe_malformed_hop');
+            }
+            const exhausted = await attempt(fixture, XFF_MALFORMED_HOP, 'probe_malformed_hop');
+            assert.strictEqual(exhausted.status, 429, 'the exhausted forwarded IP must be rate-limited');
+            // The client-written entry sits left of the hop's malformed one. A walk
+            // that skipped the malformed entry would key on it again → 429; one
+            // that stops keys on the (loopback) connection IP → 401.
+            const stopped = await attempt(fixture, `${XFF_MALFORMED_HOP}, ${XFF_PORT_SUFFIXED_HOP}`, 'probe_malformed_hop');
+            assert.strictEqual(stopped.status, 401, 'the walk must stop at the malformed hop, not reach the entry left of it');
+            const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), SPINE_RPC_PATH, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+            const listed = expect_output(await cross_rpc_call(fixture.transport, SPINE_RPC_PATH, 'audit_log_list', { event_type: 'login', outcome: 'failure' }, fixture.create_session_headers()), AuditLogListOutput);
+            const ips = listed.events.map((e) => e.ip);
+            assert.ok(ips.some((ip) => ip === '127.0.0.1' || ip === '::1'), `the stopped walk must key on the loopback connection IP: ${JSON.stringify(ips)}`);
+            assert.ok(!ips.includes(XFF_PORT_SUFFIXED_HOP), `a malformed entry is never a client IP: ${JSON.stringify(ips)}`);
+        });
         test('IPv6 clients share a bucket per /64, and the audit row keeps the full address', async () => {
             const fixture = await setup_test();
             for (let i = 0; i < ip_limit; i++) {

package/dist/testing/cross_backend/revocation_drivers.d.ts

@@ -0,0 +1,70 @@
+import '../assert_dev_env.js';
+import type { BackendCapabilities } from './capabilities.js';
+import type { TestAccountFixture, TestFixture } from './setup.js';
+/**
+ * POST a JSON body to a REST route on `account`'s session, asserting `200`.
+ *
+ * @param fixture - the per-test fixture whose fresh transport carries the request
+ * @param account - the account whose session cookie authenticates it
+ * @param path - the REST route path
+ * @param body - the JSON request body
+ */
+export declare const cross_post_as: (fixture: TestFixture, account: TestAccountFixture, path: string, body: unknown) => Promise<void>;
+/**
+ * Revoke every API token of `account_id` over the keeper's admin session
+ * (`admin_token_revoke_all`), asserting success.
+ *
+ * @param fixture - the per-test fixture; its keeper holds the admin role
+ * @param rpc_path - the RPC endpoint path
+ * @param account_id - the account whose tokens to revoke
+ */
+export declare const cross_admin_token_revoke_all: (fixture: TestFixture, rpc_path: string, account_id: string) => Promise<void>;
+/**
+ * Purge `account_id` over the keeper's daemon token (`account_purge`),
+ * asserting success. The request carries no `Origin`, as a daemon-token
+ * caller's wouldn't.
+ *
+ * @param fixture - the per-test fixture
+ * @param rpc_path - the RPC endpoint path
+ * @param account_id - the account to purge
+ */
+export declare const cross_account_purge: (fixture: TestFixture, rpc_path: string, account_id: string) => Promise<void>;
+/** One account-wide revocation, as a row both transport suites iterate. */
+export interface AccountRevocation {
+    /** Names the revocation in a case name and a failure message. */
+    readonly label: string;
+    /**
+     * Distinguishes the target account's username — unique in the table, and
+     * short enough that a suite's prefix keeps the username within `Username`.
+     */
+    readonly slug: string;
+    /** Whether the backend serves the revocation (beyond `rpc_path`, which every row needs). */
+    readonly gate: boolean;
+    /**
+     * Revoke `target`'s credentials and assert the revocation succeeded.
+     * `target` must have been created with `DEFAULT_TEST_PASSWORD`, which the
+     * password-change row presents.
+     */
+    readonly revoke: (fixture: TestFixture, target: TestAccountFixture) => Promise<void>;
+}
+/** Configuration for `create_account_revocations`. */
+export interface AccountRevocationsOptions {
+    /** Backend capability flags; `account_purge` gates on `account_lifecycle`. */
+    readonly capabilities: BackendCapabilities;
+    /** RPC endpoint path the admin and keeper revocations are sent to. */
+    readonly rpc_path: string;
+    /** REST logout route path. */
+    readonly logout_path: string;
+    /** REST password-change route path. */
+    readonly password_path: string;
+}
+/**
+ * The account-wide revocations that close every connection of the target
+ * account: `admin_token_revoke_all`, `POST /logout`, `POST /password`, and
+ * `account_purge` (gated on `capabilities.account_lifecycle`).
+ *
+ * @param options - the backend's capabilities and route paths
+ * @returns the revocation rows, in a stable order
+ */
+export declare const create_account_revocations: (options: AccountRevocationsOptions) => ReadonlyArray<AccountRevocation>;
+//# sourceMappingURL=revocation_drivers.d.ts.map

package/dist/testing/cross_backend/revocation_drivers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation_drivers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/revocation_drivers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACzB,SAAS,WAAW,EACpB,SAAS,kBAAkB,EAC3B,MAAM,MAAM,EACZ,MAAM,OAAO,KACX,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,WAAW,EACpB,UAAU,MAAM,EAChB,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CASd,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,SAAS,WAAW,EACpB,UAAU,MAAM,EAChB,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CASd,CAAC;AAEF,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACzC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8BAA8B;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,GACtC,SAAS,yBAAyB,KAChC,aAAa,CAAC,iBAAiB,CAiCjC,CAAC"}

package/dist/testing/cross_backend/revocation_drivers.js

@@ -0,0 +1,104 @@
+import '../assert_dev_env.js';
+/**
+ * The account-wide revocations the cross-process WS and SSE round-trip suites
+ * both close a live connection on — one table, so a revocation added here is
+ * covered on both transports.
+ *
+ * Each row drives one revocation of a target account's credentials and asserts
+ * it succeeded; the suite opens the target's connections first and asserts
+ * their close after. `describe_cross_process_ws_tests` and
+ * `describe_cross_process_sse_tests` iterate `create_account_revocations`. The
+ * revocations whose close is narrower than the account (one session, one
+ * token, a cap eviction) or that a suite drives differently (session
+ * revoke-all, account delete) stay in their suites.
+ *
+ * The drivers are exported on their own for a consumer suite that closes a
+ * transport of its own on the same revocations.
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+import { account_purge_action_spec, admin_token_revoke_all_action_spec } from '../../auth/admin_action_specs.js';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+import { cross_rpc_call } from './cell_cross_helpers.js';
+/**
+ * POST a JSON body to a REST route on `account`'s session, asserting `200`.
+ *
+ * @param fixture - the per-test fixture whose fresh transport carries the request
+ * @param account - the account whose session cookie authenticates it
+ * @param path - the REST route path
+ * @param body - the JSON request body
+ */
+export const cross_post_as = async (fixture, account, path, body) => {
+    const res = await fixture.fresh_transport()(path, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...account.create_session_headers() },
+        body: JSON.stringify(body)
+    });
+    assert.strictEqual(res.status, 200, `POST ${path}: ${await res.text()}`);
+};
+/**
+ * Revoke every API token of `account_id` over the keeper's admin session
+ * (`admin_token_revoke_all`), asserting success.
+ *
+ * @param fixture - the per-test fixture; its keeper holds the admin role
+ * @param rpc_path - the RPC endpoint path
+ * @param account_id - the account whose tokens to revoke
+ */
+export const cross_admin_token_revoke_all = async (fixture, rpc_path, account_id) => {
+    const res = await cross_rpc_call(fixture.transport, rpc_path, admin_token_revoke_all_action_spec.method, { account_id }, fixture.create_session_headers());
+    assert.ok(res.ok, `admin_token_revoke_all failed: ${JSON.stringify(res.error)}`);
+};
+/**
+ * Purge `account_id` over the keeper's daemon token (`account_purge`),
+ * asserting success. The request carries no `Origin`, as a daemon-token
+ * caller's wouldn't.
+ *
+ * @param fixture - the per-test fixture
+ * @param rpc_path - the RPC endpoint path
+ * @param account_id - the account to purge
+ */
+export const cross_account_purge = async (fixture, rpc_path, account_id) => {
+    const res = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, account_purge_action_spec.method, { account_id, confirm: true }, fixture.create_daemon_token_headers());
+    assert.ok(res.ok, `account_purge failed: ${JSON.stringify(res.error)}`);
+};
+/**
+ * The account-wide revocations that close every connection of the target
+ * account: `admin_token_revoke_all`, `POST /logout`, `POST /password`, and
+ * `account_purge` (gated on `capabilities.account_lifecycle`).
+ *
+ * @param options - the backend's capabilities and route paths
+ * @returns the revocation rows, in a stable order
+ */
+export const create_account_revocations = (options) => {
+    const { capabilities, rpc_path, logout_path, password_path } = options;
+    return [
+        {
+            label: 'admin_token_revoke_all',
+            slug: 'token_revoke_all',
+            gate: true,
+            revoke: (fixture, target) => cross_admin_token_revoke_all(fixture, rpc_path, target.account.id)
+        },
+        {
+            label: 'POST /logout',
+            slug: 'logout',
+            gate: true,
+            revoke: (fixture, target) => cross_post_as(fixture, target, logout_path, {})
+        },
+        {
+            label: 'POST /password',
+            slug: 'password',
+            gate: true,
+            revoke: (fixture, target) => cross_post_as(fixture, target, password_path, {
+                current_password: DEFAULT_TEST_PASSWORD,
+                new_password: 'revoked-new-password-456'
+            })
+        },
+        {
+            label: 'account_purge',
+            slug: 'purge',
+            gate: capabilities.account_lifecycle,
+            revoke: (fixture, target) => cross_account_purge(fixture, rpc_path, target.account.id)
+        }
+    ];
+};