@learncard/lca-api-service 1.5.3 → 1.6.1

package/test/keys-auth-share-escrow.spec.ts

@@ -0,0 +1,103 @@
+import { randomUUID } from 'crypto';
+
+import { client } from '@mongo';
+import { createUserKeysIndexes, getUserKeysCollection, type MongoUserKeyType } from '@models';
+
+import { getClient } from './helpers/getClient';
+
+const makeMockToken = (email: string, uid: string): string => {
+    const payload = Buffer.from(JSON.stringify({ sub: uid, email })).toString('base64url');
+
+    return `header.${payload}.signature`;
+};
+
+const makeUser = (
+    uid: string,
+    email: string,
+    recoveryMethods: MongoUserKeyType['recoveryMethods']
+): MongoUserKeyType => {
+    const now = new Date();
+
+    return {
+        contactMethod: { type: 'email', value: email },
+        authProviders: [{ type: 'firebase', id: uid }],
+        primaryDid: `did:key:z${uid}`,
+        linkedDids: [],
+        keyProvider: 'sss',
+        authShare: { encryptedData: 'auth-share', encryptedDek: '', iv: '' },
+        shareVersion: 3,
+        shareUpdatedAt: now,
+        previousAuthShares: [],
+        securityLevel: 'enhanced',
+        recoveryMethods,
+        migratedFromWeb3Auth: false,
+        sssActivationState: 'active',
+        createdAt: now,
+        updatedAt: now,
+    };
+};
+
+beforeAll(async () => {
+    process.env.IS_E2E_TEST = 'true';
+    process.env.SEED ||= 'a'.repeat(64);
+    await client.connect();
+    await createUserKeysIndexes();
+});
+
+afterAll(async () => {
+    await client.close();
+});
+
+describe('getAuthShare priorEscrowEnrollment', () => {
+    const statusFor = async (recoveryMethods: MongoUserKeyType['recoveryMethods']) => {
+        const uid = `auth-share-escrow-${randomUUID()}`;
+        const email = `${uid}@example.com`;
+        const collection = getUserKeysCollection();
+        await collection.insertOne(makeUser(uid, email, recoveryMethods));
+        try {
+            return await getClient().keys.getAuthShare({
+                authToken: makeMockToken(email, uid),
+                providerType: 'firebase',
+            });
+        } finally {
+            await collection.deleteMany({ 'authProviders.id': uid });
+        }
+    };
+    const now = new Date();
+
+    it('is false for an escrow method confirmed at the current share version', async () => {
+        const status = await statusFor([
+            {
+                type: 'escrow',
+                createdAt: now,
+                shareVersion: 3,
+                confirmationStatus: 'confirmed',
+                confirmedAt: now,
+            },
+        ]);
+        expect(status?.priorEscrowEnrollment).toBe(false);
+        expect(status?.recoveryMethods).toHaveLength(1);
+    });
+
+    it('is true for an escrow method left pending by an identity-recovery rebind', async () => {
+        const status = await statusFor([
+            { type: 'escrow', createdAt: now, shareVersion: 3, confirmationStatus: 'pending' },
+        ]);
+        expect(status?.priorEscrowEnrollment).toBe(true);
+        // The pending method itself is still never exposed.
+        expect(status?.recoveryMethods).toEqual([]);
+    });
+
+    it('is false when the account has no escrow method', async () => {
+        const status = await statusFor([
+            {
+                type: 'phrase',
+                createdAt: now,
+                shareVersion: 3,
+                confirmationStatus: 'confirmed',
+                confirmedAt: now,
+            },
+        ]);
+        expect(status?.priorEscrowEnrollment).toBe(false);
+    });
+});

package/test/keys-lifecycle-invariants.spec.ts

@@ -676,6 +676,82 @@ describe('P0-1 provisional SSS activation', () => {
     });
 });
 
+describe('P0-1 provisional purge spares escrow-enrolled migrations', () => {
+    const expiredMigration = (
+        email: string,
+        uid: string,
+        did: string,
+        escrow: { blob: boolean; method?: 'confirmed' | 'pending' }
+    ): MongoUserKeyType => {
+        const key = makeUserKey(email, uid, did, 'migrated-share');
+
+        Object.assign(key, {
+            keyProvider: 'web3auth' as const,
+            sssActivationState: 'provisional' as const,
+            provisionalCreatedAt: new Date(Date.now() - PROVISIONAL_MIGRATION_TTL_MS - 1_000),
+            recoveryMethods: escrow.method
+                ? [
+                      {
+                          type: 'escrow' as const,
+                          createdAt: new Date(),
+                          confirmationStatus: escrow.method,
+                          ...(escrow.method === 'confirmed' ? { confirmedAt: new Date() } : {}),
+                          shareVersion: 1,
+                      },
+                  ]
+                : [],
+            // Only presence matters to the purge filter.
+            ...(escrow.blob
+                ? { escrowBlob: { shareVersion: 1 } as unknown as MongoUserKeyType['escrowBlob'] }
+                : {}),
+        });
+
+        return key;
+    };
+
+    it.each([
+        ['confirmed escrow enrollment', false, { blob: true, method: 'confirmed' as const }],
+        [
+            'escrow blob without a confirmed method',
+            true,
+            { blob: true, method: 'pending' as const },
+        ],
+        ['confirmed method without a blob', true, { blob: false, method: 'confirmed' as const }],
+    ])('%s → purged: %s', async (_name, purged, escrow) => {
+        const suffix = `${Date.now()}-${randomUUID()}`;
+        const email = `escrow-purge-${suffix}@example.com`;
+        const uid = `uid-${suffix}`;
+        const { learnCard } = await getUser('5'.repeat(64));
+        const collection = getUserKeysCollection();
+
+        await collection.insertOne(expiredMigration(email, uid, learnCard.id.did(), escrow));
+
+        try {
+            const result = await getClient().keys.getAuthShare({
+                authToken: makeMockToken(email, uid),
+                providerType: 'firebase',
+            });
+            const stored = await collection.findOne({
+                authProviders: { $elemMatch: { type: 'firebase', id: uid } },
+            });
+
+            if (purged) {
+                expect(result?.authShare).toBeNull();
+                expect(stored?.authShare).toBeUndefined();
+                expect(stored?.escrowBlob).toBeUndefined();
+                expect(stored?.sssActivationState).toBeUndefined();
+            } else {
+                expect(stored?.authShare?.encryptedData).toBe('migrated-share');
+                expect(stored?.escrowBlob).toBeDefined();
+                expect(stored?.sssActivationState).toBe('provisional');
+                expect(stored?.keyProvider).toBe('web3auth');
+            }
+        } finally {
+            await collection.deleteMany({ 'contactMethod.value': email });
+        }
+    });
+});
+
 describe('P0-6 fresh DID authorization', () => {
     it('issues short-lived challenges that can only be consumed once', async () => {
         const did = `did:key:${randomUUID()}`;

package/test/oidc.spec.ts

@@ -6,6 +6,7 @@ import { issueLoginTicket, redeemLoginTicket } from '../src/cache/login-tickets'
 import cache from '@cache';
 import { GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
 import { getOidcSigningKey, resetOidcSigningKeyForTests } from '../src/helpers/oidc.helpers';
+import { ACCESS_TOKEN_PREFIX } from '../src/helpers/login-ticket.helpers';
 
 const { env, entries, sendSecret } = vi.hoisted(() => ({
     sendSecret: vi.fn(),
@@ -188,8 +189,12 @@ beforeEach(async () => {
     });
 });
 afterEach(async () => {
-    await app.close();
-    vi.restoreAllMocks();
+    try {
+        await app.close();
+    } finally {
+        vi.useRealTimers();
+        vi.restoreAllMocks();
+    }
 });
 
 describe('OIDC provider', () => {
@@ -397,6 +402,11 @@ describe('OIDC provider', () => {
     it.each<BasicMode>(['encoded', 'raw', false])(
         'exchanges a code using Basic=%s and verifies RS256 through served JWKS',
         async basic => {
+            // Freeze wall-clock time only; Fastify's I/O timers keep running normally.
+            // expires_in is remaining time, so an uncontrolled second boundary can
+            // make it 299 even though the signed JWT lifetime is exactly 300 seconds.
+            vi.useFakeTimers({ toFake: ['Date'] });
+            vi.setSystemTime(new Date('2026-10-14T12:00:00.999Z'));
             const response = await exchange(await code(), {}, basic);
             expect(response.statusCode).toBe(200);
             const tokens = response.json();
@@ -427,6 +437,35 @@ describe('OIDC provider', () => {
             expect(response.headers.pragma).toBe('no-cache');
         }
     );
+    it('reports 299 seconds remaining when access-token persistence crosses a second', async () => {
+        vi.useFakeTimers({ toFake: ['Date'] });
+        const start = new Date('2026-10-14T12:00:00.999Z');
+        vi.setSystemTime(start);
+        const set = cache.set.bind(cache);
+        vi.spyOn(cache, 'set').mockImplementation(async (...args) => {
+            const result = await set(...args);
+            if (args[0].startsWith(ACCESS_TOKEN_PREFIX)) {
+                // Advance after JWT signing, before expires_in is calculated.
+                vi.setSystemTime(start.getTime() + 1);
+            }
+            return result;
+        });
+
+        const response = await exchange(await code());
+        expect(response.statusCode).toBe(200);
+        const tokens = response.json();
+        const jwks = createLocalJWKSet((await app.inject('/oidc/jwks')).json());
+        const options = { issuer: env.OIDC_ISSUER, audience: env.OIDC_CLIENT_ID };
+        const { payload } = await jwtVerify(tokens.id_token, jwks, options);
+        expect(payload.exp! - payload.iat!).toBe(300);
+        expect(tokens.expires_in).toBe(299);
+
+        // The clock control must not hide an extended JWT lifetime.
+        vi.setSystemTime(payload.exp! * 1000);
+        await expect(jwtVerify(tokens.id_token, jwks, options)).rejects.toMatchObject({
+            code: 'ERR_JWT_EXPIRED',
+        });
+    });
     it('URL-decodes Basic client credentials', async () => {
         env.OIDC_CLIENT_SECRET = 'a+b:c %';
         expect((await exchange(await code(), {}, 'encoded')).statusCode).toBe(200);

package/tsconfig.bedrock.json

@@ -0,0 +1,10 @@
+{
+    "extends": "./tsconfig.json",
+    "compilerOptions": { "noEmit": true },
+    "include": [
+        "src/helpers/bedrockGeneration.ts",
+        "src/helpers/bedrockGeneration.test.ts",
+        "src/helpers/bedrockSchema.ts",
+        "src/types/skills.ts"
+    ]
+}

package/tsconfig.json

@@ -17,21 +17,20 @@
         "emitDeclarationOnly": true,
         "sourceMap": true,
         "rootDir": ".",
-        "baseUrl": ".",
         "paths": {
-            "@accesslayer/*": ["src/accesslayer/*"],
-            "@cache": ["src/cache/index.ts"],
-            "@cache/*": ["src/cache/*"],
-            "@config/*": ["src/config/*"],
-            "@environment": ["src/config/environment.ts"],
-            "@helpers/*": ["src/helpers/*"],
-            "@instance": ["src/instance.ts"],
-            "@firebase": ["src/firebase.ts"],
-            "@mongo": ["src/mongo.ts"],
-            "@models": ["src/models/index.ts"],
-            "@routes": ["src/routes/index.ts"],
-            "@routes/*": ["src/routes/*"],
-            "types/*": ["src/types/*"]
+            "@accesslayer/*": ["./src/accesslayer/*"],
+            "@cache": ["./src/cache/index.ts"],
+            "@cache/*": ["./src/cache/*"],
+            "@config/*": ["./src/config/*"],
+            "@environment": ["./src/config/environment.ts"],
+            "@helpers/*": ["./src/helpers/*"],
+            "@instance": ["./src/instance.ts"],
+            "@firebase": ["./src/firebase.ts"],
+            "@mongo": ["./src/mongo.ts"],
+            "@models": ["./src/models/index.ts"],
+            "@routes": ["./src/routes/index.ts"],
+            "@routes/*": ["./src/routes/*"],
+            "types/*": ["./src/types/*"]
         },
         "allowJs": false
     },