@openparachute/hub 0.5.7 → 0.5.10-rc.10

package/src/__tests__/csrf.test.ts

@@ -29,7 +29,7 @@ describe("generateCsrfToken", () => {
 });
 
 describe("buildCsrfCookie", () => {
-  test("emits the expected attributes", () => {
+  test("emits the expected attributes (default secure)", () => {
     const v = buildCsrfCookie("abc");
     expect(v).toContain(`${CSRF_COOKIE_NAME}=abc`);
     expect(v).toContain("HttpOnly");
@@ -38,6 +38,19 @@ describe("buildCsrfCookie", () => {
     expect(v).toContain("Path=/");
     expect(v).toContain("Max-Age=");
   });
+
+  test("omits Secure when secure: false (HTTP localhost)", () => {
+    const v = buildCsrfCookie("abc", { secure: false });
+    expect(v).toContain(`${CSRF_COOKIE_NAME}=abc`);
+    expect(v).toContain("HttpOnly");
+    expect(v).not.toContain("Secure");
+    expect(v).toContain("SameSite=Lax");
+  });
+
+  test("keeps Secure when secure: true (explicit)", () => {
+    const v = buildCsrfCookie("abc", { secure: true });
+    expect(v).toContain("Secure");
+  });
 });
 
 describe("parseCsrfCookie", () => {
@@ -71,6 +84,32 @@ describe("ensureCsrfToken", () => {
     expect(result.token.length).toBeGreaterThan(0);
     expect(result.setCookie).toBeDefined();
   });
+
+  // Bug 1 (rc.5 → rc.6) regression: cookies minted over plain HTTP must
+  // NOT carry the Secure attribute or browsers silently drop them on
+  // http://localhost:1939, breaking the very next double-submit POST.
+  test("sets Secure when the request URL is https://", () => {
+    const req = new Request("https://hub.example/admin/setup");
+    const result = ensureCsrfToken(req);
+    expect(result.setCookie).toContain("Secure");
+  });
+
+  test("omits Secure when the request URL is http://localhost", () => {
+    const req = new Request("http://localhost:1939/admin/setup");
+    const result = ensureCsrfToken(req);
+    expect(result.setCookie).not.toContain("Secure");
+    // The rest of the cookie shape stays intact — only Secure flips.
+    expect(result.setCookie).toContain("HttpOnly");
+    expect(result.setCookie).toContain("SameSite=Lax");
+  });
+
+  test("sets Secure when http:// request carries X-Forwarded-Proto: https", () => {
+    const req = new Request("http://hub.internal/admin/setup", {
+      headers: { "x-forwarded-proto": "https" },
+    });
+    const result = ensureCsrfToken(req);
+    expect(result.setCookie).toContain("Secure");
+  });
 });
 
 describe("verifyCsrfToken", () => {

package/src/__tests__/expose-2fa-warning.test.ts

@@ -81,7 +81,7 @@ describe("printPublic2FAWarning", () => {
     expect(fired).toBe(true);
     const joined = logs.join("\n");
     expect(joined).toContain("2FA is not enrolled");
-    expect(joined).toContain("https://vault.example.com/admin/login");
+    expect(joined).toContain("https://vault.example.com/login");
     expect(joined).toContain("parachute auth 2fa enroll");
   });
 
@@ -111,15 +111,13 @@ describe("printPublic2FAWarning", () => {
     expect(logs.some((l) => l.includes("2FA is not enrolled"))).toBe(true);
   });
 
-  test("embeds the supplied publicUrl into the /admin/login pointer", () => {
+  test("embeds the supplied publicUrl into the /login pointer", () => {
     const logs: string[] = [];
     printPublic2FAWarning({
       status: status({ hasTotp: false }),
       log: (l) => logs.push(l),
       publicUrl: "https://parachute.taildf9ce2.ts.net",
     });
-    expect(logs.some((l) => l.includes("https://parachute.taildf9ce2.ts.net/admin/login"))).toBe(
-      true,
-    );
+    expect(logs.some((l) => l.includes("https://parachute.taildf9ce2.ts.net/login"))).toBe(true);
   });
 });

package/src/__tests__/expose-cloudflare.test.ts

@@ -557,7 +557,7 @@ describe("exposeCloudflareUp", () => {
         expect(code).toBe(0);
         const joined = logs.join("\n");
         expect(joined).toContain("2FA is not enrolled");
-        expect(joined).toContain("https://vault.example.com/admin/login");
+        expect(joined).toContain("https://vault.example.com/login");
         expect(joined).toContain("parachute auth 2fa enroll");
       } finally {
         env.cleanup();

package/src/__tests__/expose.test.ts

@@ -963,8 +963,8 @@ describe("expose public up", () => {
       const joined = logs.join("\n");
       expect(joined).toContain("2FA is not enrolled");
       expect(joined).toContain("parachute auth 2fa enroll");
-      // /admin/login pointer uses the canonical https://<fqdn> origin.
-      expect(joined).toContain("https://parachute.taildf9ce2.ts.net/admin/login");
+      // /login pointer uses the canonical https://<fqdn> origin.
+      expect(joined).toContain("https://parachute.taildf9ce2.ts.net/login");
     } finally {
       h.cleanup();
     }