@indigoai-us/hq-cloud 6.14.12 → 6.14.14

package/src/cognito-auth.test.ts

@@ -338,3 +338,230 @@ describe("expiresAt shape round-trip", () => {
     expect(typeof onDisk?.expiresAt).toBe("number");
   });
 });
+
+// ---------------------------------------------------------------------------
+// Concurrency-safe token refresh (cross-process lock)
+//
+// Boxes run several hq processes (`hq auth refresh` on a timer, the sync runner,
+// replica-sync) that refresh the SAME cached session at once. Without
+// coordination they race on the shared cache; and if the app client issues
+// single-use (rotated) tokens, concurrent refreshers invalidate each other —
+// the first consumes the token, the second gets `invalid_grant`. These pin the
+// fix: a cross-process lock + a re-read of the freshest token inside the lock,
+// so refreshes serialize and a consumed token is never reused. (Rotation does
+// NOT reset the 30-day lifetime — see ADR-0009; durable never-log-out is per-box
+// machine identity, which reuses this same lock for its mint sequence.)
+// ---------------------------------------------------------------------------
+describe("refreshTokens — concurrency-safe refresh (cross-process lock)", () => {
+  const config = {
+    region: "us-east-1",
+    userPoolDomain: "vault-indigo-hq-dev",
+    clientId: "test-client",
+  };
+
+  // A minimal unsigned JWT carrying a client_id claim, so the cache's
+  // client-ownership check (decodeAccessTokenClientId) resolves in tests.
+  const jwtFor = (clientId: string, extra: Record<string, unknown> = {}) =>
+    "eyJhbGciOiJub25lIn0." +
+    Buffer.from(JSON.stringify({ client_id: clientId, ...extra })).toString(
+      "base64url",
+    ) +
+    ".sig";
+
+  // Models Cognito refresh-token ROTATION with single-use enforcement: a valid
+  // refresh mints a new token and consumes the old one; reusing a consumed
+  // token returns 400 invalid_grant (exactly what took the outposts offline).
+  function rotatingCognitoFetch(initialToken: string) {
+    let current = initialToken;
+    const consumed = new Set<string>();
+    let counter = 0;
+    return vi.fn(async (_url: string, init?: { body?: string }) => {
+      const sent = new URLSearchParams(init?.body ?? "").get("refresh_token") ?? "";
+      if (sent !== current || consumed.has(sent)) {
+        return new Response(JSON.stringify({ error: "invalid_grant" }), {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        });
+      }
+      consumed.add(sent);
+      counter += 1;
+      current = `refresh-${counter}`;
+      return new Response(
+        JSON.stringify({
+          access_token: jwtFor("test-client", { n: counter }),
+          id_token: jwtFor("test-client", { n: counter }),
+          refresh_token: current,
+          expires_in: 3600,
+          token_type: "Bearer",
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      );
+    });
+  }
+
+  it("persists the rotated refresh token when Cognito returns one", async () => {
+    vi.stubGlobal("fetch", rotatingCognitoFetch("R0"));
+    const { refreshTokens, loadCachedTokens } = await importModule();
+    const result = await refreshTokens(config, "R0");
+    expect(result.refreshToken).toBe("refresh-1");
+    expect(loadCachedTokens()?.refreshToken).toBe("refresh-1");
+  });
+
+  it("serializes concurrent refreshers: ONE network refresh, neither gets invalid_grant", async () => {
+    const fetchMock = rotatingCognitoFetch("R0");
+    vi.stubGlobal("fetch", fetchMock);
+    const { refreshTokens, saveCachedTokens, loadCachedTokens } =
+      await importModule();
+    // Seed an EXPIRED session (for THIS client) so both callers attempt refresh.
+    saveCachedTokens({
+      ...baseTokens,
+      accessToken: jwtFor("test-client"),
+      refreshToken: "R0",
+      expiresAt: Date.now() - 1000,
+    });
+
+    // Two processes refresh the same expiring session at once. Without the lock
+    // both send "R0"; the second would hit the mock's invalid_grant and throw.
+    const [a, b] = await Promise.all([
+      refreshTokens(config, "R0"),
+      refreshTokens(config, "R0"),
+    ]);
+
+    // Neither threw; the network was hit exactly once (the waiter reused the
+    // winner's fresh token under the lock); both hold that same token.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(a.refreshToken).toBe("refresh-1");
+    expect(b.refreshToken).toBe("refresh-1");
+    expect(a.accessToken).toBe(b.accessToken);
+    expect(loadCachedTokens()?.refreshToken).toBe("refresh-1");
+  });
+
+  it("reclaims a lock whose holder process has died (no deadlock)", async () => {
+    vi.stubGlobal("fetch", rotatingCognitoFetch("R0"));
+    const { refreshTokens } = await importModule();
+    // A crashed refresher left its lock behind, tagged with a pid that is not
+    // running — reclaimed by pid-liveness, not by an mtime heuristic.
+    const hqDir = path.join(tmpHome, ".hq");
+    fs.mkdirSync(hqDir, { recursive: true });
+    const lockPath = path.join(hqDir, "cognito-tokens.json.lock");
+    fs.writeFileSync(lockPath, "2147483646");
+
+    const result = await refreshTokens(config, "R0");
+    expect(result.refreshToken).toBe("refresh-1");
+    // Our own lock is released after the refresh completes (no leak).
+    expect(fs.existsSync(lockPath)).toBe(false);
+  });
+
+  it("does NOT reuse a cached session minted by a different app client", async () => {
+    const fetchMock = rotatingCognitoFetch("R-B");
+    vi.stubGlobal("fetch", fetchMock);
+    const { refreshTokens, saveCachedTokens } = await importModule();
+    // Cache holds a FRESH token, but for a DIFFERENT client.
+    saveCachedTokens({
+      ...baseTokens,
+      accessToken: jwtFor("other-client"),
+      refreshToken: "R-other",
+      expiresAt: Date.now() + 3600 * 1000,
+    });
+
+    // A caller for "test-client" must NOT be handed the other client's cached
+    // token; it must exchange the token it supplied.
+    const result = await refreshTokens(config, "R-B");
+    expect(fetchMock).toHaveBeenCalledTimes(1); // did not short-circuit on the wrong-client cache
+    expect(result.refreshToken).toBe("refresh-1");
+  });
+});
+
+describe("refresh expiry hardening", () => {
+  it("retries one transient refresh failure and preserves the refresh token", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ message: "temporarily unavailable" }), {
+          status: 503,
+        }),
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            access_token: "fresh-access",
+            id_token: "fresh-id",
+            expires_in: 3600,
+            token_type: "Bearer",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+      );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const { refreshTokens } = await importModule();
+    const result = await refreshTokens(baseConfig, "preserved-refresh");
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(result.accessToken).toBe("fresh-access");
+    expect(result.refreshToken).toBe("preserved-refresh");
+  });
+
+  it("clears an expired refresh session after one 401 retry", async () => {
+    const fetchMock = vi.fn(async () =>
+      new Response(JSON.stringify({ message: "refresh token expired" }), {
+        status: 401,
+      }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const { saveCachedTokens, loadCachedTokens, getValidAccessToken } =
+      await importModule();
+    saveCachedTokens({ ...baseTokens, expiresAt: 0 });
+
+    await expect(
+      getValidAccessToken(baseConfig, { interactive: false }),
+    ).rejects.toThrow(/quick refresh/i);
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(loadCachedTokens()).toBeNull();
+  });
+
+  it("keeps the stored session after two transient network failures", async () => {
+    const fetchMock = vi.fn(async () => {
+      throw new Error("ECONNRESET");
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const { saveCachedTokens, loadCachedTokens, getValidAccessToken } =
+      await importModule();
+    saveCachedTokens({ ...baseTokens, expiresAt: 0 });
+
+    await expect(
+      getValidAccessToken(baseConfig, { interactive: false }),
+    ).rejects.toThrow(/ECONNRESET/);
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(loadCachedTokens()?.refreshToken).toBe("refresh");
+  });
+
+  it("does not invalidate a newer login when an older token fails late", async () => {
+    const {
+      accessTokenFingerprint,
+      invalidateCachedTokensByFingerprint,
+      loadCachedTokens,
+      saveCachedTokens,
+    } = await importModule();
+
+    saveCachedTokens({
+      ...baseTokens,
+      accessToken: "old-access",
+      expiresAt: Date.now() + 60_000,
+    });
+    const oldFingerprint = accessTokenFingerprint("old-access");
+
+    saveCachedTokens({
+      ...baseTokens,
+      accessToken: "new-access",
+      expiresAt: Date.now() + 60_000,
+    });
+    invalidateCachedTokensByFingerprint(oldFingerprint);
+
+    expect(loadCachedTokens()?.accessToken).toBe("new-access");
+  });
+});