@livedesk/hub 0.1.58 → 0.1.61

package/src/console-direct.test.mjs

@@ -8,6 +8,7 @@ import {
   encodeDirectConsoleWireMessage
 } from '../../runtime-core/src/console-direct-wire.js';
 import { consoleDirectContract, createHubConsoleDirect } from './console-direct.js';
+import { workspaceRoleCanRequest } from './auth/workspace-access.js';
 
 assert.equal(consoleDirectContract.maxDefaultRetryDelayMs, 20_000);
 assert.equal(consoleDirectContract.peerDisconnectedTimeoutMs, 5_000);
@@ -23,6 +24,10 @@ const CONNECTION_ONE = '33333333-3333-4333-8333-333333333333';
 const CONNECTION_TWO = '44444444-4444-4444-8444-444444444444';
 const CHANNEL_ID = '55555555-5555-4555-8555-555555555555';
 const REQUEST_ID = '66666666-6666-4666-8666-666666666666';
+const TEAM_WORKSPACE_ID = '88888888-8888-4888-8888-888888888888';
+const TEAM_OWNER_USER_ID = '99999999-9999-4999-8999-999999999999';
+const TEAM_OPERATOR_USER_ID = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa';
+const CONSOLE_PROXY_TOKEN = 'test-console-proxy-token';
 
 class FakeSocket extends EventEmitter {
   static CONNECTING = 0;
@@ -225,6 +230,8 @@ async function connectedDirect(options = {}) {
     httpBaseUrl: 'http://127.0.0.1:5179',
     stunUrls: options.stunUrls || ['stun:stun.example.test:3478'],
     getAccessToken: async () => 'access-token',
+    ...(options.workspaceAccess ? { getWorkspaceAccess: () => options.workspaceAccess } : {}),
+    ...(options.consoleProxyToken ? { consoleProxyToken: options.consoleProxyToken } : {}),
     SignalingWebSocketImpl: FakeSignalSocket,
     LocalWebSocketImpl: FakeLocalSocket,
     createPeerConnection: (name, config) => new FakePeerConnection(name, config),
@@ -263,18 +270,23 @@ async function connectedDirect(options = {}) {
     type: 'signal-ready',
     role: 'hub',
     deviceId: 'hub-device',
-    hubEpoch: HUB_EPOCH
+    hubEpoch: HUB_EPOCH,
+    ...(options.workspaceAccess ? {
+      workspaceId: options.workspaceAccess.workspaceId,
+      workspaceKind: options.workspaceAccess.workspaceKind
+    } : {})
   }), false);
   return { direct, signal };
 }
 
-function offer(signal, connectionId = CONNECTION_ONE, sdp = 'v=0\r\na=fake-offer\r\n') {
+function offer(signal, connectionId = CONNECTION_ONE, sdp = 'v=0\r\na=fake-offer\r\n', extra = {}) {
   signal.receive(JSON.stringify({
     type: 'rtc-offer',
     consoleId: CONSOLE_ID,
     connectionId,
     hubEpoch: HUB_EPOCH,
-    description: { type: 'offer', sdp }
+    description: { type: 'offer', sdp },
+    ...extra
   }), false);
   return FakePeerConnection.instances.at(-1);
 }
@@ -615,6 +627,323 @@ test('reliable control channel bridges bounded HTTP over fragmented wire message
   direct.close();
 });
 
+test('Team Operator can use Wall and Control but cannot mutate the Hub owner runtime', async () => {
+  const teamWorkspaceAccess = {
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    role: 'owner',
+    membershipRevision: 7
+  };
+  const fetched = [];
+  const { direct, signal } = await connectedDirect({
+    workspaceAccess: teamWorkspaceAccess,
+    consoleProxyToken: CONSOLE_PROXY_TOKEN,
+    fetchImpl: async (url, init) => {
+      fetched.push({ url: String(url), init });
+      return new Response('{"ok":true}', {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' }
+      });
+    }
+  });
+  assert.equal(new URL(signal.url).searchParams.get('workspaceId'), TEAM_WORKSPACE_ID);
+  const hubChallengeNonce = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb';
+  signal.receive(JSON.stringify({
+    type: 'workspace-reauth-required',
+    workspaceId: TEAM_WORKSPACE_ID,
+    challengeNonce: hubChallengeNonce,
+    deadlineAt: Date.now() + 15_000
+  }), false);
+  await waitFor(() => fetched.some(call => call.url.endsWith('/v2/rtc/reauth')));
+  const hubReauth = fetched.find(call => call.url.endsWith('/v2/rtc/reauth'));
+  assert.equal(hubReauth.init.headers.Authorization, 'Bearer access-token');
+  assert.deepEqual(JSON.parse(hubReauth.init.body), {
+    workspaceId: TEAM_WORKSPACE_ID,
+    challengeNonce: hubChallengeNonce
+  });
+  assert.equal(
+    signalingMessages(signal).some(message => JSON.stringify(message).includes('access-token')),
+    false,
+    'A bearer token must never be sent through the signaling WebSocket.'
+  );
+  fetched.length = 0;
+  const accessExpiresAt = Date.now() + 60_000;
+  const peer = offer(signal, CONNECTION_ONE, 'v=0\r\na=fake-offer\r\n', {
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 7,
+    accessExpiresAt
+  });
+  assert.ok(peer);
+  const control = new FakeDataChannel('livedesk-control-v1');
+  peer.emitDataChannel(control);
+  control.open();
+
+  sendWire(control, {
+    type: 'http-request',
+    requestId: CHANNEL_ID,
+    method: 'POST',
+    path: '/api/auth/session',
+    headers: { 'content-type': 'application/json' },
+    bodyBase64: Buffer.from(JSON.stringify({ workspaceId: TEAM_WORKSPACE_ID })).toString('base64')
+  }, { messageId: 30 });
+  await settle();
+  assert.equal(fetched.length, 1);
+  assert.equal(fetched[0].url, 'http://127.0.0.1:5179/api/auth/session');
+  assert.deepEqual(JSON.parse(Buffer.from(fetched[0].init.body).toString('utf8')), {
+    workspaceId: TEAM_WORKSPACE_ID
+  });
+  assert.equal(fetched[0].init.headers.Authorization, undefined);
+  fetched.length = 0;
+
+  sendWire(control, {
+    type: 'http-request',
+    requestId: REQUEST_ID,
+    method: 'POST',
+    path: '/api/update/apply'
+  }, { messageId: 31 });
+  await settle();
+  let responses = decodeWireMessages(control.sent).map(message => JSON.parse(message.data));
+  const forbidden = responses.find(message => message.requestId === REQUEST_ID);
+  assert.equal(forbidden?.status, 403);
+  assert.equal(forbidden?.error, 'workspace-owner-required');
+  assert.equal(fetched.length, 0, 'A denied Operator request must never reach the local Hub API.');
+
+  sendWire(control, {
+    type: 'http-request',
+    requestId: HUB_EPOCH_TWO,
+    method: 'POST',
+    path: '/api/remote/devices/client-1/input',
+    headers: { 'content-type': 'application/json' },
+    bodyBase64: Buffer.from('{"type":"pointermove"}').toString('base64')
+  }, { messageId: 32 });
+  await settle();
+  assert.equal(fetched.length, 1);
+  assert.equal(fetched[0].url, 'http://127.0.0.1:5179/api/remote/devices/client-1/input');
+  assert.equal(fetched[0].init.headers['X-LiveDesk-Console-Proxy'], CONSOLE_PROXY_TOKEN);
+  assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-Id'], TEAM_WORKSPACE_ID);
+  assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-User-Id'], TEAM_OPERATOR_USER_ID);
+  assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-Role'], 'operator');
+  responses = decodeWireMessages(control.sent).map(message => JSON.parse(message.data));
+  assert.equal(responses.find(message => message.requestId === HUB_EPOCH_TWO)?.status, 200);
+
+  signal.receive(JSON.stringify({
+    type: 'workspace-access-refreshed',
+    consoleId: CONSOLE_ID,
+    connectionId: CONNECTION_ONE,
+    hubEpoch: HUB_EPOCH,
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 8,
+    accessExpiresAt: Date.now() + 60_000
+  }), false);
+  assert.equal(direct.inspect().peerConnections, 1, 'A successful Team reauth must preserve the healthy P2P peer.');
+  assert.equal(direct.revokeWorkspaceMember(TEAM_WORKSPACE_ID, TEAM_OPERATOR_USER_ID), 1);
+  assert.equal(peer.closed, true);
+  assert.equal(direct.inspect().peerConnections, 0);
+  assert.equal(direct.inspect().controlChannels, 0);
+  const peerCountBeforeReoffer = FakePeerConnection.instances.length;
+  offer(signal, CONNECTION_TWO, 'v=0\r\na=fake-offer\r\n', {
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 8,
+    accessExpiresAt: Date.now() + 60_000
+  });
+  assert.equal(FakePeerConnection.instances.length, peerCountBeforeReoffer);
+  assert.equal(direct.inspect().peerConnections, 0);
+  assert.equal(direct.inspect().revokedMemberFences, 1);
+  assert.equal(signalingMessages(signal).at(-1).reason, 'workspace-member-revoked');
+  direct.close();
+  assert.equal(direct.inspect().resourceTimers, 0);
+});
+
+test('Team peer access refresh replaces the exact deadline and signaling loss cannot extend access', async () => {
+  const { direct, signal } = await connectedDirect({
+    retryDelaysMs: [60_000],
+    workspaceAccess: {
+      workspaceId: TEAM_WORKSPACE_ID,
+      workspaceKind: 'team',
+      role: 'owner',
+      membershipRevision: 7
+    }
+  });
+  const peer = offer(signal, CONNECTION_ONE, 'v=0\r\na=fake-offer\r\n', {
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 7,
+    accessExpiresAt: Date.now() + 30
+  });
+  const control = new FakeDataChannel('livedesk-control-v1');
+  peer.emitDataChannel(control);
+  control.open();
+  signal.receive(JSON.stringify({
+    type: 'workspace-access-refreshed',
+    consoleId: CONSOLE_ID,
+    connectionId: CONNECTION_ONE,
+    hubEpoch: HUB_EPOCH,
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 8,
+    accessExpiresAt: Date.now() + 100
+  }), false);
+  signal.close(1012, 'signaling-temporarily-offline');
+  await new Promise(resolve => setTimeout(resolve, 45));
+  assert.equal(peer.closed, false, 'The stale pre-refresh deadline must not close a refreshed peer.');
+  assert.equal(direct.inspect().peerConnections, 1);
+  await waitFor(() => peer.closed, 150);
+  assert.equal(direct.inspect().peerConnections, 0, 'A lost signaling socket must not extend Team access past its verified deadline.');
+  assert.equal(direct.inspect().localWebSocketChannels, 0);
+  direct.close();
+  assert.equal(direct.inspect().resourceTimers, 0);
+});
+
+test('verified Personal Owner, Team Owner and Team Operator auth bootstrap discards every caller credential', async () => {
+  for (const scenario of [
+    {
+      workspaceId: TEAM_WORKSPACE_ID,
+      workspaceKind: 'team',
+      userId: TEAM_OWNER_USER_ID,
+      role: 'owner',
+      accessExpiresAt: Date.now() + 60_000
+    },
+    {
+      workspaceId: TEAM_WORKSPACE_ID,
+      workspaceKind: 'team',
+      userId: TEAM_OPERATOR_USER_ID,
+      role: 'operator',
+      accessExpiresAt: Date.now() + 60_000
+    },
+    {
+      workspaceId: TEAM_OWNER_USER_ID,
+      workspaceKind: 'personal',
+      userId: TEAM_OWNER_USER_ID,
+      role: 'owner',
+      accessExpiresAt: 0
+    }
+  ]) {
+    const fetched = [];
+    const { direct, signal } = await connectedDirect({
+      workspaceAccess: {
+        workspaceId: scenario.workspaceId,
+        workspaceKind: scenario.workspaceKind,
+        role: 'owner',
+        membershipRevision: 3
+      },
+      consoleProxyToken: CONSOLE_PROXY_TOKEN,
+      fetchImpl: async (url, init) => {
+        fetched.push({ url: String(url), init });
+        return new Response('{"ok":true}', { headers: { 'Content-Type': 'application/json' } });
+      }
+    });
+    const peer = offer(signal, CONNECTION_ONE, 'v=0\r\na=fake-offer\r\n', {
+      workspaceId: scenario.workspaceId,
+      workspaceKind: scenario.workspaceKind,
+      memberUserId: scenario.userId,
+      memberRole: scenario.role,
+      membershipRevision: 3,
+      accessExpiresAt: scenario.accessExpiresAt
+    });
+    const control = new FakeDataChannel('livedesk-control-v1');
+    peer.emitDataChannel(control);
+    control.open();
+    sendWire(control, {
+      type: 'http-request',
+      requestId: REQUEST_ID,
+      method: 'POST',
+      path: '/api/auth/session',
+      headers: {
+        accept: 'application/attacker-controlled',
+        'content-type': 'text/plain',
+        'if-match': 'attacker-etag',
+        range: 'bytes=0-999',
+        'x-livedesk-csrf': 'attacker-csrf'
+      },
+      bodyBase64: Buffer.from(JSON.stringify({
+        workspaceId: HUB_EPOCH_TWO,
+        accessToken: 'attacker-access-token',
+        refreshToken: 'attacker-refresh-token',
+        user: { id: HUB_EPOCH_TWO },
+        userId: HUB_EPOCH_TWO,
+        expiresAt: 9_999_999_999
+      })).toString('base64')
+    });
+    await settle();
+    assert.equal(fetched.length, 1);
+    assert.equal(fetched[0].init.headers.Authorization, undefined);
+    assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-Role'], scenario.role);
+    assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-Kind'], scenario.workspaceKind);
+    assert.equal(fetched[0].init.headers['content-type'], 'application/json');
+    assert.equal(fetched[0].init.headers.accept, undefined);
+    assert.equal(fetched[0].init.headers['if-match'], undefined);
+    assert.equal(fetched[0].init.headers.range, undefined);
+    assert.equal(fetched[0].init.headers['x-livedesk-csrf'], undefined);
+    assert.deepEqual(JSON.parse(Buffer.from(fetched[0].init.body).toString('utf8')), {
+      workspaceId: scenario.workspaceId
+    });
+    direct.close();
+  }
+});
+
+test('cross-workspace Worker claims are rejected before allocating a P2P peer', async () => {
+  const { direct, signal } = await connectedDirect({
+    workspaceAccess: {
+      workspaceId: TEAM_WORKSPACE_ID,
+      workspaceKind: 'team',
+      role: 'owner',
+      membershipRevision: 1
+    }
+  });
+  offer(signal, CONNECTION_ONE, 'v=0\r\na=fake-offer\r\n', {
+    workspaceId: HUB_EPOCH_TWO,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 1,
+    accessExpiresAt: Date.now() + 60_000
+  });
+  assert.equal(direct.inspect().peerConnections, 0);
+  assert.equal(signalingMessages(signal).some(message => (
+    message.type === 'rtc-close'
+      && message.reason === 'console-workspace-access-invalid'
+  )), true);
+  direct.close();
+});
+
+test('Operator request policy is limited to Wall, Control, audio and self sign-out', () => {
+  assert.equal(workspaceRoleCanRequest('operator', 'GET', '/api/hub/devices'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'GET', '/api/remote/devices/client-1/thumbnail'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'POST', '/api/remote/devices/client-1/thumbnail/request'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'GET', '/api/remote/devices/client-1/live/frame'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'POST', '/api/remote/devices/client-1/live/start'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'POST', '/api/remote/devices/client-1/input'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'POST', '/api/remote/devices/client-1/audio/start'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'DELETE', '/api/auth/session'), true);
+  for (const [method, path] of [
+    ['POST', '/api/runtime/restart'],
+    ['POST', '/api/runtime/shutdown'],
+    ['POST', '/api/runtime/role'],
+    ['POST', '/api/hub/sync'],
+    ['POST', '/api/update/apply'],
+    ['PATCH', '/api/settings/profile'],
+    ['POST', '/api/files/upload'],
+    ['POST', '/api/tasks'],
+    ['POST', `/api/remote/workspace/members/${TEAM_OWNER_USER_ID}/revoke`]
+  ]) {
+    assert.equal(workspaceRoleCanRequest('operator', method, path), false, `${method} ${path}`);
+  }
+  assert.equal(workspaceRoleCanRequest('owner', 'POST', '/api/update/apply'), true);
+});
+
 test('canonical HTTP routing rejects encoded, backslash, duplicate-slash, and external-origin bypasses', async () => {
   const fetchedUrls = [];
   const { direct, signal } = await connectedDirect({