@openparachute/hub 0.7.3-rc.4 → 0.7.3-rc.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.3-rc.4",
+  "version": "0.7.3-rc.6",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/api-vault-caps.test.ts

@@ -0,0 +1,232 @@
+/**
+ * Tests for `/api/vault-caps*` (B5 admin visibility / D-slice).
+ * Covers:
+ *
+ *   - Auth boundary: GET + PUT require a bearer carrying `parachute:host:admin`.
+ *   - GET joins services.json vault names with persisted caps (uncapped =
+ *     null cap_bytes), ordered by name.
+ *   - PUT sets/updates a cap (upsert), validates positive cap, refuses a
+ *     vault not registered in services.json (400 vault_not_found).
+ *   - 405 on wrong methods.
+ */
+import type { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { handleListVaultCaps, handleSetVaultCap } from "../api-vault-caps.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { signAccessToken } from "../jwt-sign.ts";
+import { createUser } from "../users.ts";
+import { getVaultCapBytes, setVaultCap } from "../vault-caps.ts";
+
+const ISSUER = "https://hub.test";
+const HOST_ADMIN_SCOPE = "parachute:host:admin";
+
+interface Harness {
+  db: Database;
+  manifestPath: string;
+  cleanup: () => void;
+}
+
+function manifestWithVaults(...names: string[]): string {
+  const paths = names.map((n) => `/vault/${n}`);
+  return JSON.stringify({
+    services: [
+      { name: "parachute-vault", port: 4101, paths, health: "/health", version: "0.0.0-test" },
+    ],
+  });
+}
+
+function makeHarness(servicesJson?: string): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "phub-api-vault-caps-"));
+  const db = openHubDb(hubDbPath(dir));
+  const manifestPath = join(dir, "services.json");
+  writeFileSync(manifestPath, servicesJson ?? manifestWithVaults("beta", "personal"));
+  return {
+    db,
+    manifestPath,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+let harness: Harness;
+beforeEach(() => {
+  harness = makeHarness();
+});
+afterEach(() => {
+  harness.cleanup();
+});
+
+async function makeAdminBearer(scopes = [HOST_ADMIN_SCOPE]): Promise<string> {
+  const user = await createUser(harness.db, "operator", "any-password", {
+    allowMulti: true,
+    passwordChanged: true,
+  });
+  const minted = await signAccessToken(harness.db, {
+    sub: user.id,
+    scopes,
+    audience: "hub",
+    clientId: "parachute-hub-spa",
+    issuer: ISSUER,
+    ttlSeconds: 600,
+  });
+  return minted.token;
+}
+
+function req(path: string, init: RequestInit = {}): Request {
+  return new Request(`${ISSUER}${path}`, init);
+}
+
+function withBearer(path: string, bearer: string, init: RequestInit = {}): Request {
+  const headers = new Headers(init.headers ?? {});
+  headers.set("authorization", `Bearer ${bearer}`);
+  return new Request(`${ISSUER}${path}`, { ...init, headers });
+}
+
+function deps() {
+  return { db: harness.db, issuer: ISSUER, manifestPath: harness.manifestPath };
+}
+
+describe("handleListVaultCaps", () => {
+  test("401 with no Authorization header", async () => {
+    const res = await handleListVaultCaps(req("/api/vault-caps"), deps());
+    expect(res.status).toBe(401);
+  });
+
+  test("403 when bearer lacks parachute:host:admin", async () => {
+    const bearer = await makeAdminBearer(["other:scope"]);
+    const res = await handleListVaultCaps(withBearer("/api/vault-caps", bearer), deps());
+    expect(res.status).toBe(403);
+  });
+
+  test("405 on POST", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleListVaultCaps(
+      withBearer("/api/vault-caps", bearer, { method: "POST" }),
+      deps(),
+    );
+    expect(res.status).toBe(405);
+  });
+
+  test("joins services.json vaults with caps, uncapped = null cap_bytes", async () => {
+    const bearer = await makeAdminBearer();
+    // Only "beta" has a persisted cap; "personal" stays uncapped.
+    setVaultCap(harness.db, "beta", 1024 * 1024 * 1024);
+    const res = await handleListVaultCaps(withBearer("/api/vault-caps", bearer), deps());
+    expect(res.status).toBe(200);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    const body = (await res.json()) as {
+      vault_caps: Array<{ vault_name: string; cap_bytes: number | null }>;
+    };
+    // Both vaults present, ordered by name (beta, personal).
+    expect(body.vault_caps.map((c) => c.vault_name)).toEqual(["beta", "personal"]);
+    const beta = body.vault_caps.find((c) => c.vault_name === "beta");
+    const personal = body.vault_caps.find((c) => c.vault_name === "personal");
+    expect(beta?.cap_bytes).toBe(1024 * 1024 * 1024);
+    expect(personal?.cap_bytes).toBeNull();
+  });
+});
+
+describe("handleSetVaultCap", () => {
+  test("401 with no Authorization header", async () => {
+    const res = await handleSetVaultCap(
+      req("/api/vault-caps/beta", {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(401);
+  });
+
+  test("403 when bearer lacks parachute:host:admin", async () => {
+    const bearer = await makeAdminBearer(["other:scope"]);
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(403);
+  });
+
+  test("400 on a fractional (non-integer) cap", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1.5 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+  });
+
+  test("405 on GET", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(withBearer("/api/vault-caps/beta", bearer), "beta", deps());
+    expect(res.status).toBe(405);
+  });
+
+  test("sets a cap on a registered vault and persists it (upsert)", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 2 * 1024 * 1024 * 1024 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { vault_cap: { cap_bytes: number } };
+    expect(body.vault_cap.cap_bytes).toBe(2 * 1024 * 1024 * 1024);
+    expect(getVaultCapBytes(harness.db, "beta")).toBe(2 * 1024 * 1024 * 1024);
+  });
+
+  test("400 vault_not_found for a vault not in services.json", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/ghost", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "ghost",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("vault_not_found");
+    // Nothing persisted for the rejected name.
+    expect(getVaultCapBytes(harness.db, "ghost")).toBeNull();
+  });
+
+  test("400 on non-positive cap", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 0 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("invalid_request");
+  });
+});

package/src/__tests__/oauth-handlers.test.ts

@@ -3,7 +3,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { handleAdminLoginTotpPost } from "../admin-handlers.ts";
+import { handleAdminLoginPost, handleAdminLoginTotpPost } from "../admin-handlers.ts";
 import { approveClient, getClient, registerClient } from "../clients.ts";
 import { CSRF_COOKIE_NAME } from "../csrf.ts";
 import { findGrant, recordGrant } from "../grants.ts";
@@ -1391,6 +1391,7 @@ describe("handleAuthorizePost — vault picker", () => {
 
 describe("handleAuthorizePost — login submit", () => {
   test("sets session cookie and redirects to GET on valid credentials", async () => {
+    resetRateLimit();
     const { db, cleanup } = await makeDb();
     try {
       await createUser(db, "owner", "hunter2");
@@ -1428,6 +1429,7 @@ describe("handleAuthorizePost — login submit", () => {
   });
 
   test("rejects bad password with 401, no cookie", async () => {
+    resetRateLimit();
     const { db, cleanup } = await makeDb();
     try {
       await createUser(db, "owner", "hunter2");
@@ -1461,6 +1463,125 @@ describe("handleAuthorizePost — login submit", () => {
   });
 });
 
+// --- Shared per-account login bucket across BOTH password doors -------------
+//
+// The shared-egress-IP fix re-keyed the login floor to (ip,username) AND wired
+// the same `loginRateLimiter` instance into the previously-ungated
+// `/oauth/authorize` password door. Both doors must share ONE per-account
+// bucket, so an attacker can't get 5 tries at `/login` PLUS another 5 at
+// `/oauth/authorize` for the same (ip,username).
+describe("login floor is shared across /login and /oauth/authorize (same per-account bucket)", () => {
+  const ATTACK_IP = "203.0.113.200";
+
+  function adminLoginReq(username: string, password: string): Request {
+    const body = new URLSearchParams({
+      __csrf: TEST_CSRF,
+      username,
+      password,
+      next: "/admin/vaults",
+    });
+    return new Request("http://hub.test/login", {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        cookie: CSRF_COOKIE,
+        "cf-connecting-ip": ATTACK_IP,
+      },
+      body,
+    });
+  }
+
+  function oauthLoginReq(
+    username: string,
+    password: string,
+    clientId: string,
+    challenge: string,
+  ): Request {
+    const body = new URLSearchParams({
+      __action: "login",
+      __csrf: TEST_CSRF,
+      username,
+      password,
+      client_id: clientId,
+      redirect_uri: "https://app.example/cb",
+      response_type: "code",
+      scope: "vault:read",
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    return new Request(`${ISSUER}/oauth/authorize`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        cookie: CSRF_COOKIE,
+        "cf-connecting-ip": ATTACK_IP,
+      },
+      body,
+    });
+  }
+
+  // (e) 5 at /login + 1 at /oauth/authorize for the same (ip,username) → the
+  // 6th (the /oauth/authorize attempt) is denied regardless of which door it
+  // came through.
+  test("(e) 5 /login attempts then 1 /oauth/authorize attempt → the 6th door is 429", async () => {
+    const { db, cleanup } = await makeDb();
+    resetRateLimit();
+    try {
+      await createUser(db, "owner", "hunter2", { passwordChanged: true });
+      const reg = registerClient(db, { redirectUris: ["https://app.example/cb"] });
+      const { challenge } = makePkce();
+
+      // Burn the full 5-slot floor at the /login door (wrong password → 401).
+      for (let i = 0; i < 5; i++) {
+        const r = await handleAdminLoginPost(db, adminLoginReq("owner", "wrong"));
+        expect(r.status).toBe(401);
+      }
+      // 6th attempt — at the OTHER door (/oauth/authorize). Must be denied
+      // because both doors share ONE (ip,username) bucket.
+      const denied = await handleAuthorizePost(
+        db,
+        oauthLoginReq("owner", "hunter2", reg.client.clientId, challenge),
+        { issuer: ISSUER },
+      );
+      expect(denied.status).toBe(429);
+      expect(denied.headers.get("retry-after")).not.toBeNull();
+      // No session minted even though the password was correct — the floor
+      // fired before the credential check.
+      expect(cookieValueFrom(denied, "parachute_hub_session")).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("the shared bucket is per-account: a DIFFERENT username at /oauth/authorize is unaffected", async () => {
+    const { db, cleanup } = await makeDb();
+    resetRateLimit();
+    try {
+      await createUser(db, "alice", "alice-pw", { passwordChanged: true });
+      await createUser(db, "bob", "bob-pw", { passwordChanged: true, allowMulti: true });
+      const reg = registerClient(db, { redirectUris: ["https://app.example/cb"] });
+      const { challenge } = makePkce();
+
+      // Exhaust alice's floor at /login.
+      for (let i = 0; i < 5; i++) {
+        await handleAdminLoginPost(db, adminLoginReq("alice", "wrong"));
+      }
+      expect((await handleAdminLoginPost(db, adminLoginReq("alice", "wrong"))).status).toBe(429);
+
+      // bob (same IP, different username) still signs in at /oauth/authorize.
+      const bobRes = await handleAuthorizePost(
+        db,
+        oauthLoginReq("bob", "bob-pw", reg.client.clientId, challenge),
+        { issuer: ISSUER },
+      );
+      expect(bobRes.status).toBe(302);
+      expect(bobRes.headers.get("location")).toContain("/oauth/authorize?");
+    } finally {
+      cleanup();
+    }
+  });
+});
+
 // --- OAuth-path TOTP gate (hub#473 P0 bypass regression) -------------------
 //
 // The OAuth login POST (`__action=login`) is the more-common sign-in path

package/src/__tests__/rate-limit.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, test } from "bun:test";
 import {
+  AUTH_IP_CEILING_MAX_ATTEMPTS,
   CHANGE_PASSWORD_MAX_ATTEMPTS,
   CHANGE_PASSWORD_WINDOW_MS,
   MAX_ATTEMPTS,
@@ -7,9 +8,12 @@ import {
   UNKNOWN_IP_SENTINEL,
   WINDOW_MS,
   __resetForTests,
+  authIpCeilingRateLimiter,
   changePasswordRateLimiter,
   checkAndRecord,
   clientIpFromRequest,
+  compositeKey,
+  loginRateLimiter,
 } from "../rate-limit.ts";
 
 afterEach(() => {
@@ -302,3 +306,85 @@ describe("changePasswordRateLimiter — tighter floor for /account/change-passwo
     expect(changePasswordRateLimiter.checkAndRecord("user-a", now).allowed).toBe(true);
   });
 });
+
+// The shared-egress-IP fix: the per-account FLOOR is now keyed by
+// `compositeKey(ip, identity)` so a room of users behind ONE NAT'd /
+// Cloudflare egress IP doesn't pool into one 5-slot bucket. A coarse per-IP
+// CEILING (60/15min) backstops username-rotation across the floors.
+describe("compositeKey + shared-egress-IP login floor", () => {
+  test("normalizes identity: trims + lowercases so casing/whitespace share a bucket", () => {
+    expect(compositeKey("1.2.3.4", "Alice")).toBe("1.2.3.4|alice");
+    expect(compositeKey("1.2.3.4", "  ALICE  ")).toBe("1.2.3.4|alice");
+    // Case-flip evasion is closed: 'Alice' and 'alice' resolve to one key.
+    expect(compositeKey("1.2.3.4", "Alice")).toBe(compositeKey("1.2.3.4", "alice"));
+  });
+
+  // (a) REGRESSION: two distinct usernames from the SAME ip each get a full
+  // independent 5/15min floor (the shared-wifi bug). Before the fix both would
+  // have pooled into one per-IP bucket and the second user's 1st attempt would
+  // have been the 6th overall → 429.
+  test("(a) two usernames from the same IP each get an independent 5/15min floor", () => {
+    const ip = "203.0.113.7";
+    const now = new Date("2026-06-25T12:00:00Z");
+    // Alice exhausts her floor.
+    for (let i = 0; i < MAX_ATTEMPTS; i++) {
+      expect(loginRateLimiter.checkAndRecord(compositeKey(ip, "alice"), now).allowed).toBe(true);
+    }
+    expect(loginRateLimiter.checkAndRecord(compositeKey(ip, "alice"), now).allowed).toBe(false);
+    // Bob (same IP, different username) still has a fresh full floor.
+    for (let i = 0; i < MAX_ATTEMPTS; i++) {
+      expect(loginRateLimiter.checkAndRecord(compositeKey(ip, "bob"), now).allowed).toBe(true);
+    }
+    expect(loginRateLimiter.checkAndRecord(compositeKey(ip, "bob"), now).allowed).toBe(false);
+  });
+
+  // (b) a single (ip,username) still denies on the 6th attempt.
+  test("(b) a single (ip,username) still denies on the 6th attempt", () => {
+    const ip = "203.0.113.7";
+    const now = new Date("2026-06-25T12:00:00Z");
+    for (let i = 0; i < MAX_ATTEMPTS; i++) {
+      expect(loginRateLimiter.checkAndRecord(compositeKey(ip, "alice"), now).allowed).toBe(true);
+    }
+    const denied = loginRateLimiter.checkAndRecord(compositeKey(ip, "alice"), now);
+    expect(denied.allowed).toBe(false);
+    expect(denied.retryAfterSeconds).toBe(WINDOW_MS / 1000);
+  });
+
+  // (c) the per-IP ceiling denies on the 61st attempt from one IP even across
+  // rotated usernames (each username's own floor never trips because each only
+  // sees one attempt, but the coarse ceiling caps total per-IP volume).
+  test("(c) per-IP ceiling denies the 61st attempt across rotated usernames", () => {
+    const ip = "203.0.113.7";
+    const now = new Date("2026-06-25T12:00:00Z");
+    for (let i = 0; i < AUTH_IP_CEILING_MAX_ATTEMPTS; i++) {
+      // Rotate a fresh username every attempt so no per-account floor ever fills.
+      expect(loginRateLimiter.checkAndRecord(compositeKey(ip, `u${i}`), now).allowed).toBe(true);
+      expect(authIpCeilingRateLimiter.checkAndRecord(ip, now).allowed).toBe(true);
+    }
+    // 61st attempt: a brand-new username (floor is fresh) but the ceiling is full.
+    expect(loginRateLimiter.checkAndRecord(compositeKey(ip, "u60"), now).allowed).toBe(true);
+    const ceilingDenied = authIpCeilingRateLimiter.checkAndRecord(ip, now);
+    expect(ceilingDenied.allowed).toBe(false);
+    expect(ceilingDenied.retryAfterSeconds).toBe(WINDOW_MS / 1000);
+  });
+
+  test("the ceiling is per-IP: a different IP is unaffected by another's full ceiling", () => {
+    const now = new Date("2026-06-25T12:00:00Z");
+    for (let i = 0; i < AUTH_IP_CEILING_MAX_ATTEMPTS; i++) {
+      authIpCeilingRateLimiter.checkAndRecord("203.0.113.7", now);
+    }
+    expect(authIpCeilingRateLimiter.checkAndRecord("203.0.113.7", now).allowed).toBe(false);
+    expect(authIpCeilingRateLimiter.checkAndRecord("198.51.100.99", now).allowed).toBe(true);
+  });
+
+  test("ceiling matches the signup precedent (60) and `__resetForTests` clears it", () => {
+    expect(AUTH_IP_CEILING_MAX_ATTEMPTS).toBe(60);
+    const now = new Date("2026-06-25T12:00:00Z");
+    for (let i = 0; i < AUTH_IP_CEILING_MAX_ATTEMPTS; i++) {
+      authIpCeilingRateLimiter.checkAndRecord("203.0.113.7", now);
+    }
+    expect(authIpCeilingRateLimiter.checkAndRecord("203.0.113.7", now).allowed).toBe(false);
+    __resetForTests();
+    expect(authIpCeilingRateLimiter.checkAndRecord("203.0.113.7", now).allowed).toBe(true);
+  });
+});

package/src/__tests__/two-factor-flow.test.ts

@@ -332,6 +332,100 @@ describe("login two-step (TOTP) — hub#473", () => {
     expect(denied.status).toBe(429);
     expect(denied.headers.get("retry-after")).not.toBeNull();
   });
+
+  // Fallback path: when the pending login can't be resolved (bad/expired
+  // token), the floor keys by IP ALONE — NOT the (rotating) pendingToken.
+  // Proven here by sending a DIFFERENT bogus pending cookie on every attempt
+  // from one IP: if the floor keyed by the token each would get a fresh bucket
+  // and never 429; keying by IP, the 6th still trips.
+  test("2FA floor with unresolvable pending tokens keys by IP, not the token", async () => {
+    const buildReq = (bogusToken: string) => {
+      const tf = formBody({ [CSRF_FIELD_NAME]: TEST_CSRF, code: "000000", next: "/admin/vaults" });
+      return new Request("http://hub.test/login/2fa", {
+        method: "POST",
+        headers: {
+          ...tf.headers,
+          cookie: `${CSRF_COOKIE}; ${PENDING_LOGIN_COOKIE_NAME}=${bogusToken}`,
+          "cf-connecting-ip": "203.0.113.77",
+        },
+        body: tf.body,
+      });
+    };
+    for (let i = 0; i < 5; i++) {
+      // A unique bogus token per attempt → never resolves to a pending login.
+      const r = await handleAdminLoginTotpPost(harness.db, buildReq(`bogus-${i}`));
+      expect(r.status).toBe(401); // no pending login → 401, counts toward the IP floor
+    }
+    const denied = await handleAdminLoginTotpPost(harness.db, buildReq("bogus-final"));
+    expect(denied.status).toBe(429);
+    expect(denied.headers.get("retry-after")).not.toBeNull();
+  });
+
+  // (d) The 2FA floor is keyed by (ip,userId), NOT the rotating pendingToken.
+  // Re-POSTing /login mints a FRESH pendingToken for the SAME user — that must
+  // NOT reset the per-account TOTP floor (otherwise an attacker grinds TOTP
+  // forever by re-doing the password step between every 5 code attempts).
+  test("(d) re-POSTing /login (new pendingToken) does NOT reset the per-account TOTP floor", async () => {
+    const u = await createUser(harness.db, "owner", "owner-password-123", {
+      passwordChanged: true,
+    });
+    await persistEnrollment(harness.db, u.id, generateTotpSecret("owner").secret);
+    const ATTACK_IP = "203.0.113.66";
+
+    const passwordPost = async (): Promise<string> => {
+      const pw = formBody({
+        [CSRF_FIELD_NAME]: TEST_CSRF,
+        username: "owner",
+        password: "owner-password-123",
+        next: "/admin/vaults",
+      });
+      const res = await handleAdminLoginPost(
+        harness.db,
+        new Request("http://hub.test/login", {
+          method: "POST",
+          headers: { ...pw.headers, cookie: CSRF_COOKIE, "cf-connecting-ip": ATTACK_IP },
+          body: pw.body,
+        }),
+      );
+      const token = cookieFrom(res, PENDING_LOGIN_COOKIE_NAME);
+      expect(token).toBeTruthy();
+      return token!;
+    };
+
+    const wrongTotp = (pendingToken: string): Request => {
+      const tf = formBody({ [CSRF_FIELD_NAME]: TEST_CSRF, code: "000000", next: "/admin/vaults" });
+      return new Request("http://hub.test/login/2fa", {
+        method: "POST",
+        headers: {
+          ...tf.headers,
+          cookie: `${CSRF_COOKIE}; ${PENDING_LOGIN_COOKIE_NAME}=${pendingToken}`,
+          "cf-connecting-ip": ATTACK_IP,
+        },
+        body: tf.body,
+      });
+    };
+
+    // First password step → pendingToken1.
+    const token1 = await passwordPost();
+    // 4 wrong TOTP attempts against pendingToken1 (all 401, all count toward
+    // the (ip,userId) bucket).
+    for (let i = 0; i < 4; i++) {
+      expect((await handleAdminLoginTotpPost(harness.db, wrongTotp(token1))).status).toBe(401);
+    }
+
+    // Re-do the password step → a BRAND-NEW pendingToken2 (same userId).
+    const token2 = await passwordPost();
+    expect(token2).not.toBe(token1);
+
+    // 5th wrong TOTP — under pendingToken2 but the SAME (ip,userId) bucket →
+    // still the 5th attempt → allowed (401), not reset to fresh.
+    expect((await handleAdminLoginTotpPost(harness.db, wrongTotp(token2))).status).toBe(401);
+    // 6th wrong TOTP → floor full → 429. If the floor were keyed by the
+    // pendingToken, token2 would have a fresh bucket and this would be a 401.
+    const denied = await handleAdminLoginTotpPost(harness.db, wrongTotp(token2));
+    expect(denied.status).toBe(429);
+    expect(denied.headers.get("retry-after")).not.toBeNull();
+  });
 });
 
 describe("/account/2fa handlers — hub#473", () => {