@learncard/lca-api-service 1.5.2 → 1.6.0

package/test/keys-escrow.spec.ts

@@ -48,6 +48,7 @@ import {
     getEscrowEnclave,
     getEscrowBlobStaleReason,
     EscrowPolicyError,
+    EscrowCodeError,
     EscrowBlobError,
     EscrowPinMismatchError,
     EscrowUnavailableError,
@@ -419,6 +420,26 @@ describe('authority enrollment persistence', () => {
         expect(stored?.requiresConfirmation).toBe(true);
         expect(stored?.startedNotificationPending).toBe(false);
     });
+    it('persists an awaiting-confirmation hold even when code delivery failed', async () => {
+        await enroll();
+        const enclave = getEscrowEnclave();
+        const create = enclave.createHold.bind(enclave);
+        const delivery = { codeSent: false, proof: { ...receipt, kind: 'snapshot' as const } };
+        vi.spyOn(enclave, 'createHold').mockImplementation(async input => ({
+            ...(await create(input)),
+            delivery,
+        }));
+        __setEscrowEnclaveForTests(
+            Object.assign(enclave, { confirmHold: async () => ({ success: true as const }) })
+        );
+        const started = await start();
+        expect(started.codeSent).toBe(false);
+        expect(started.delivery).toEqual(delivery);
+        const stored = await findEscrowHoldById(started.holdId);
+        expect(stored?.holdRecord).toEqual(started.holdRecord);
+        expect(stored?.requiresConfirmation).toBe(true);
+        expect(stored?.confirmedAt).toBeUndefined();
+    });
     it('persists a cancellation commit receipt before clearing the durable pending marker', async () => {
         await enroll();
         const started = await start();
@@ -1464,6 +1485,27 @@ describe('P2-c confirmRecovery reconciliation', () => {
     }));
     beforeEach(() => idempotentConfirmHold.mockClear());
 
+    it.each(['codeMismatch', 'codeExpired', 'codeLocked'] as const)(
+        'returns sanitized confirmation reason %s without confirming',
+        async reason => {
+            const { hold, resumeToken } = await createConfirmableHold();
+            const enclave = getEscrowEnclave();
+            enclave.confirmHold = vi.fn().mockRejectedValue(new EscrowCodeError(reason));
+            try {
+                await expect(
+                    getClient().escrow.confirmRecovery({
+                        holdId: hold._id,
+                        resumeToken,
+                        code: '12345678',
+                    })
+                ).rejects.toMatchObject({ code: 'FORBIDDEN', message: reason });
+                expect((await findEscrowHoldById(hold._id))?.confirmedAt).toBeUndefined();
+            } finally {
+                delete enclave.confirmHold;
+            }
+        }
+    );
+
     it('allows the SDK commit-to-v2-snapshot readback without a second persistence or deadline shift', async () => {
         const { hold, resumeToken } = await createConfirmableHold();
         const snapshotReceipt = {
@@ -1908,10 +1950,14 @@ describe('escrow PIN release', () => {
     it('burns a mismatched hold; a new hold with the correct PIN succeeds', async () => {
         await enrollPin();
         const first = await startPin();
+        const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
         await expect(completePin(first, wrongProof)).rejects.toMatchObject({
             code: 'FORBIDDEN',
             message: 'Incorrect PIN. 9 attempts left.',
         });
+        expect(warn).toHaveBeenCalledExactlyOnceWith('[LCA escrow] enclave operation failed', {
+            reason: 'pin_mismatch',
+        });
         expect(await findEscrowHoldById(first.holdId)).toMatchObject({
             status: 'cancelled',
             cancelledBy: 'system',
@@ -2259,6 +2305,25 @@ describe('escrow PIN release', () => {
         expect((await getClient().escrow.getStatus(auth)).hold?.holdId).toBe(hold.holdId);
     });
 
+    it('logs an unexpected non-PIN mismatch once without refunding a PIN attempt', async () => {
+        await enroll();
+        const hold = await start();
+        advanceToRelease(hold);
+        const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+        const refund = vi.spyOn(models, 'refundEscrowPinAttempt');
+        vi.spyOn(getEscrowEnclave(), 'releaseEscrow').mockRejectedValueOnce(
+            new EscrowPinMismatchError()
+        );
+        await expect(getClient().escrow.completeRecovery(resume(hold))).rejects.toMatchObject({
+            code: 'INTERNAL_SERVER_ERROR',
+        });
+        expect(warn).toHaveBeenCalledExactlyOnceWith('[LCA escrow] enclave operation failed', {
+            reason: 'pin_mismatch',
+        });
+        expect(refund).not.toHaveBeenCalled();
+        expect(await findEscrowHoldById(hold.holdId)).toMatchObject({ status: 'pending' });
+    });
+
     it.each([new EscrowUnavailableError(), new EscrowBlobError()])(
         'refunds non-mismatch enclave failures: %s',
         async error => {

package/test/oidc.spec.ts

@@ -6,6 +6,7 @@ import { issueLoginTicket, redeemLoginTicket } from '../src/cache/login-tickets'
 import cache from '@cache';
 import { GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
 import { getOidcSigningKey, resetOidcSigningKeyForTests } from '../src/helpers/oidc.helpers';
+import { ACCESS_TOKEN_PREFIX } from '../src/helpers/login-ticket.helpers';
 
 const { env, entries, sendSecret } = vi.hoisted(() => ({
     sendSecret: vi.fn(),
@@ -188,8 +189,12 @@ beforeEach(async () => {
     });
 });
 afterEach(async () => {
-    await app.close();
-    vi.restoreAllMocks();
+    try {
+        await app.close();
+    } finally {
+        vi.useRealTimers();
+        vi.restoreAllMocks();
+    }
 });
 
 describe('OIDC provider', () => {
@@ -397,6 +402,11 @@ describe('OIDC provider', () => {
     it.each<BasicMode>(['encoded', 'raw', false])(
         'exchanges a code using Basic=%s and verifies RS256 through served JWKS',
         async basic => {
+            // Freeze wall-clock time only; Fastify's I/O timers keep running normally.
+            // expires_in is remaining time, so an uncontrolled second boundary can
+            // make it 299 even though the signed JWT lifetime is exactly 300 seconds.
+            vi.useFakeTimers({ toFake: ['Date'] });
+            vi.setSystemTime(new Date('2026-10-14T12:00:00.999Z'));
             const response = await exchange(await code(), {}, basic);
             expect(response.statusCode).toBe(200);
             const tokens = response.json();
@@ -427,6 +437,35 @@ describe('OIDC provider', () => {
             expect(response.headers.pragma).toBe('no-cache');
         }
     );
+    it('reports 299 seconds remaining when access-token persistence crosses a second', async () => {
+        vi.useFakeTimers({ toFake: ['Date'] });
+        const start = new Date('2026-10-14T12:00:00.999Z');
+        vi.setSystemTime(start);
+        const set = cache.set.bind(cache);
+        vi.spyOn(cache, 'set').mockImplementation(async (...args) => {
+            const result = await set(...args);
+            if (args[0].startsWith(ACCESS_TOKEN_PREFIX)) {
+                // Advance after JWT signing, before expires_in is calculated.
+                vi.setSystemTime(start.getTime() + 1);
+            }
+            return result;
+        });
+
+        const response = await exchange(await code());
+        expect(response.statusCode).toBe(200);
+        const tokens = response.json();
+        const jwks = createLocalJWKSet((await app.inject('/oidc/jwks')).json());
+        const options = { issuer: env.OIDC_ISSUER, audience: env.OIDC_CLIENT_ID };
+        const { payload } = await jwtVerify(tokens.id_token, jwks, options);
+        expect(payload.exp! - payload.iat!).toBe(300);
+        expect(tokens.expires_in).toBe(299);
+
+        // The clock control must not hide an extended JWT lifetime.
+        vi.setSystemTime(payload.exp! * 1000);
+        await expect(jwtVerify(tokens.id_token, jwks, options)).rejects.toMatchObject({
+            code: 'ERR_JWT_EXPIRED',
+        });
+    });
     it('URL-decodes Basic client credentials', async () => {
         env.OIDC_CLIENT_SECRET = 'a+b:c %';
         expect((await exchange(await code(), {}, 'encoded')).statusCode).toBe(200);

package/tsconfig.bedrock.json

@@ -0,0 +1,10 @@
+{
+    "extends": "./tsconfig.json",
+    "compilerOptions": { "noEmit": true },
+    "include": [
+        "src/helpers/bedrockGeneration.ts",
+        "src/helpers/bedrockGeneration.test.ts",
+        "src/helpers/bedrockSchema.ts",
+        "src/types/skills.ts"
+    ]
+}