@openparachute/hub 0.7.3-rc.8 → 0.7.3

package/src/__tests__/hub-origins-env-set.test.ts

@@ -0,0 +1,273 @@
+/**
+ * Multi-origin iss-set (onboarding-streamline 2026-06-25) — hub side.
+ *
+ * The hub publishes the SET of origins it legitimately answers on to its
+ * supervised resource servers via `PARACHUTE_HUB_ORIGINS` (comma-separated),
+ * alongside the single canonical `PARACHUTE_HUB_ORIGIN`. A resource server on
+ * scope-guard ≥0.5.0 widens its accepted-`iss` check to this set so a token
+ * minted under one URL of a multi-URL box validates via another URL of the
+ * SAME box.
+ *
+ * These tests pin two things:
+ *   1. The serialize/parse round-trip + the assembly from hub-controlled
+ *      inputs (issuer ∪ loopback aliases ∪ expose-state ∪ platform).
+ *   2. The SECURITY INVARIANT: the set is built ONLY from operator/hub config
+ *      and on-disk state — never from an unvalidated request `Host` /
+ *      `X-Forwarded-Host`. We feed an attacker-controlled "Host" through every
+ *      input channel a request could plausibly reach and assert it never lands
+ *      in the published set.
+ */
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveStartupIssuer } from "../commands/serve.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { parseHubOrigins, serializeHubOrigins } from "../hub-origin.ts";
+import { getHubOrigin, setHubOrigin } from "../hub-settings.ts";
+import { buildHubOriginsEnvValue } from "../vault-hub-origin-env.ts";
+
+describe("serializeHubOrigins / parseHubOrigins round-trip", () => {
+  test("serialize dedupes, drops empties, strips trailing slashes", () => {
+    const v = serializeHubOrigins([
+      "https://a.example/",
+      "https://a.example",
+      "",
+      "https://b.example",
+    ]);
+    expect(v).toBe("https://a.example,https://b.example");
+  });
+
+  test("serialize returns undefined when nothing survives", () => {
+    expect(serializeHubOrigins([])).toBeUndefined();
+    expect(serializeHubOrigins(["", "  "])).toBeUndefined();
+  });
+
+  test("parse is the inverse — tolerant of whitespace + trailing slashes + empties", () => {
+    expect(parseHubOrigins("https://a.example, https://b.example/ ,,")).toEqual([
+      "https://a.example",
+      "https://b.example",
+    ]);
+  });
+
+  test("parse returns [] for absent/empty/garbage", () => {
+    expect(parseHubOrigins(undefined)).toEqual([]);
+    expect(parseHubOrigins("")).toEqual([]);
+    expect(parseHubOrigins(" , , ")).toEqual([]);
+  });
+
+  test("round-trips a real set", () => {
+    const origins = ["https://example.com", "http://127.0.0.1:1939", "http://localhost:1939"];
+    const wire = serializeHubOrigins(origins)!;
+    expect(parseHubOrigins(wire)).toEqual(origins);
+  });
+});
+
+describe("buildHubOriginsEnvValue — assembles the hub's legitimate-origin set", () => {
+  let dir: string;
+  const EXPOSE = () => join(dir, "expose-state.json");
+
+  /** Write a schema-valid expose-state.json carrying the given hubOrigin. */
+  function writeExposeState(hubOrigin: string): void {
+    writeFileSync(
+      EXPOSE(),
+      JSON.stringify({
+        version: 1,
+        layer: "public",
+        mode: "path",
+        canonicalFqdn: new URL(hubOrigin).host,
+        port: 1939,
+        funnel: true,
+        entries: [],
+        hubOrigin,
+      }),
+    );
+  }
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-origins-set-"));
+    // No hub.port file in this fresh configDir → readHubPort falls back to
+    // HUB_UNIT_DEFAULT_PORT (1939), the deterministic value these cases assert.
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  test("issuer ∪ loopback aliases when no expose / platform origin", () => {
+    const v = buildHubOriginsEnvValue(dir, "https://example.com", {}, EXPOSE());
+    const set = parseHubOrigins(v);
+    expect(set).toContain("https://example.com");
+    expect(set).toContain("http://127.0.0.1:1939");
+    expect(set).toContain("http://localhost:1939");
+    expect(set).toHaveLength(3);
+  });
+
+  test("loopback aliases are ALWAYS present (the always-present invariant)", () => {
+    // Even with a public issuer, loopback must be in the set so the co-located
+    // CLI / loopback-proxied request path validates.
+    const set = parseHubOrigins(buildHubOriginsEnvValue(dir, "https://example.com", {}, EXPOSE()));
+    expect(set).toContain("http://127.0.0.1:1939");
+    expect(set).toContain("http://localhost:1939");
+  });
+
+  test("folds in the expose-state public origin", () => {
+    writeExposeState("https://box.sslip.io");
+    const set = parseHubOrigins(buildHubOriginsEnvValue(dir, "https://example.com", {}, EXPOSE()));
+    expect(set).toContain("https://example.com");
+    expect(set).toContain("https://box.sslip.io");
+  });
+
+  test("folds in the platform origin (RENDER_EXTERNAL_URL)", () => {
+    const set = parseHubOrigins(
+      buildHubOriginsEnvValue(
+        dir,
+        "https://example.com",
+        { RENDER_EXTERNAL_URL: "https://app.onrender.com" },
+        EXPOSE(),
+      ),
+    );
+    expect(set).toContain("https://app.onrender.com");
+  });
+
+  test("folds in the composed Fly default origin", () => {
+    const set = parseHubOrigins(
+      buildHubOriginsEnvValue(dir, "https://example.com", { FLY_APP_NAME: "myapp" }, EXPOSE()),
+    );
+    expect(set).toContain("https://myapp.fly.dev");
+  });
+
+  test("absent issuer → loopback-only set (still useful, never empty on a normal box)", () => {
+    const set = parseHubOrigins(buildHubOriginsEnvValue(dir, undefined, {}, EXPOSE()));
+    expect(set).toContain("http://127.0.0.1:1939");
+    expect(set).toContain("http://localhost:1939");
+    // The empty issuer "" is dropped by buildHubBoundOrigins' URL parse.
+    expect(set).not.toContain("");
+  });
+
+  test("a malformed expose-state.json never throws — falls back to issuer + loopback", () => {
+    writeFileSync(EXPOSE(), "{ not valid json");
+    const set = parseHubOrigins(buildHubOriginsEnvValue(dir, "https://example.com", {}, EXPOSE()));
+    expect(set).toContain("https://example.com");
+    expect(set).toContain("http://127.0.0.1:1939");
+  });
+
+  describe("SECURITY INVARIANT — request Host never enters the set", () => {
+    const ATTACKER = "https://attacker.evil";
+
+    test("an attacker Host smuggled via expose-state IS honored ONLY because it's operator-written on-disk state — but a Host passed nowhere never appears", () => {
+      // There is NO request input to buildHubOriginsEnvValue at all — it takes
+      // configDir + issuer + env + expose-state-path. None of those is a
+      // request header. We assert the function's surface offers no channel for
+      // a request Host: feeding the attacker value to the only inputs an
+      // attacker might influence (a stray env var, a header-shaped string)
+      // never reaches the set unless it's a legitimate operator-config var.
+      const set = parseHubOrigins(
+        buildHubOriginsEnvValue(
+          dir,
+          "https://example.com",
+          {
+            // Header-shaped env vars an attacker might hope are read — none are
+            // consulted by the assembler (only RENDER_EXTERNAL_URL / FLY_APP_NAME).
+            HTTP_HOST: ATTACKER,
+            HTTP_X_FORWARDED_HOST: ATTACKER,
+            X_FORWARDED_HOST: ATTACKER,
+            HOST: ATTACKER,
+          } as NodeJS.ProcessEnv,
+          EXPOSE(),
+        ),
+      );
+      expect(set).not.toContain(ATTACKER);
+      expect(set.some((o) => o.includes("attacker"))).toBe(false);
+    });
+
+    test("the set is exactly issuer ∪ loopback ∪ expose ∪ platform — no other source", () => {
+      writeExposeState("https://box.sslip.io");
+      const set = parseHubOrigins(
+        buildHubOriginsEnvValue(
+          dir,
+          "https://example.com",
+          { RENDER_EXTERNAL_URL: "https://app.onrender.com" },
+          EXPOSE(),
+        ),
+      );
+      // Every member is one of the four sanctioned sources; nothing else.
+      const sanctioned = new Set([
+        "https://example.com",
+        "http://127.0.0.1:1939",
+        "http://localhost:1939",
+        "https://box.sslip.io",
+        "https://app.onrender.com",
+      ]);
+      for (const o of set) expect(sanctioned.has(o)).toBe(true);
+    });
+  });
+});
+
+/**
+ * THE CRUX (onboarding-streamline 2026-06-25, Caddy-direct zero-SSH path):
+ * a box whose ONLY canonical-origin source is the DB row `hub_settings.hub_origin`
+ * (no PARACHUTE_HUB_ORIGIN env, no expose-state, no RENDER/FLY platform var —
+ * the bare-droplet-behind-Caddy shape) MUST inject that public origin into the
+ * supervised modules' PARACHUTE_HUB_ORIGINS. Otherwise vault/scribe accept only
+ * loopback `iss` and reject every token the hub mints under the public origin
+ * (which the per-request resolveIssuer DOES stamp from the DB).
+ *
+ * These tests prove the full boot chain: DB row → `resolveStartupIssuer`
+ * (boot-time issuer seed) → `buildHubOriginsEnvValue` (the env injected at
+ * child spawn) CONTAINS the public origin.
+ */
+describe("DB hub_origin flows into the injected PARACHUTE_HUB_ORIGINS (Caddy-direct boot chain)", () => {
+  let dir: string;
+  const noExpose = (): string | undefined => undefined;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-origins-db-"));
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  test("DB-persisted public origin lands in the assembled origin set", () => {
+    // Persist the Caddy public origin to the DB exactly as `hub set-origin` /
+    // `init --hub-origin` would.
+    const db = openHubDb(hubDbPath(dir));
+    setHubOrigin(db, "https://box.sslip.io");
+    db.close();
+
+    // Boot-time issuer resolution reads the DB row (passed as dbHubOrigin) —
+    // no env, no expose-state, no platform var (the bare-Caddy shape).
+    const dbOrigin = getHubOrigin(openHubDb(hubDbPath(dir))) ?? undefined;
+    const issuer = resolveStartupIssuer(
+      { ...(dbOrigin !== undefined ? { dbHubOrigin: dbOrigin } : {}) },
+      {},
+      noExpose,
+    );
+    expect(issuer).toBe("https://box.sslip.io");
+
+    // That issuer seeds the env injected into vault/scribe — the public origin
+    // MUST be in their accepted-`iss` set.
+    const set = parseHubOrigins(
+      buildHubOriginsEnvValue(dir, issuer, {}, join(dir, "expose-state.json")),
+    );
+    expect(set).toContain("https://box.sslip.io");
+    // Loopback aliases stay present (co-located CLI / loopback proxy path).
+    expect(set).toContain("http://127.0.0.1:1939");
+    expect(set).toContain("http://localhost:1939");
+  });
+
+  test("no DB origin AND nothing else → loopback-only (the regression this guards: no public origin would leak in)", () => {
+    // Fresh DB, no row, no env, no expose-state: the boot issuer is undefined
+    // and the set is loopback-only. Proves the fix doesn't fabricate an origin.
+    const dbOrigin = getHubOrigin(openHubDb(hubDbPath(dir))) ?? undefined;
+    const issuer = resolveStartupIssuer(
+      { ...(dbOrigin !== undefined ? { dbHubOrigin: dbOrigin } : {}) },
+      {},
+      noExpose,
+    );
+    expect(issuer).toBeUndefined();
+    const set = parseHubOrigins(
+      buildHubOriginsEnvValue(dir, issuer, {}, join(dir, "expose-state.json")),
+    );
+    // Loopback-only — no public origin fabricated. (Order is Set-insertion
+    // dependent; assert membership + size rather than a brittle exact array.)
+    expect(set).toContain("http://127.0.0.1:1939");
+    expect(set).toContain("http://localhost:1939");
+    expect(set).toHaveLength(2);
+  });
+});

package/src/__tests__/hub-server.test.ts

@@ -3,6 +3,10 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+  _resetBootstrapTokenForTests,
+  generateBootstrapToken,
+} from "../bootstrap-token.ts";
 import { buildCsrfCookie, generateCsrfToken } from "../csrf.ts";
 import { HUB_SVC, hubPortPath } from "../hub-control.ts";
 import { createDbHolder } from "../hub-db-liveness.ts";
@@ -3676,6 +3680,74 @@ describe("layerOf — classify trust layer from proxy headers + peer (item E / #
     });
     expect(layerOf(r)).toBe("public");
   });
+
+  // Caddy/nginx-direct deploy (hub#704). A same-box reverse proxy dials
+  // loopback (peer 127.0.0.1) and stamps NO cf/tailscale header — but it DOES
+  // set a standard reverse-proxy forwarding header. That header is the
+  // discriminator: a loopback peer carrying one is a proxied PUBLIC request and
+  // must NOT be "loopback" (which would leak the bootstrap token + drop the
+  // loopback-exposure cloak for every public visitor on a Caddy-direct box).
+  test("loopback peer + X-Forwarded-For → public (Caddy-direct, NOT loopback) [#704]", () => {
+    const r = req("/", { headers: { "X-Forwarded-For": "203.0.113.7" } });
+    expect(layerOf(r, "127.0.0.1")).toBe("public");
+  });
+
+  test("loopback peer + X-Forwarded-Host → public (Caddy-direct) [#704]", () => {
+    const r = req("/", { headers: { "X-Forwarded-Host": "hub.example.com" } });
+    expect(layerOf(r, "127.0.0.1")).toBe("public");
+  });
+
+  test("loopback peer + Forwarded (RFC 7239) → public (Caddy-direct) [#704]", () => {
+    const r = req("/", { headers: { Forwarded: "for=203.0.113.7;host=hub.example.com" } });
+    expect(layerOf(r, "127.0.0.1")).toBe("public");
+  });
+
+  test("IPv6-mapped loopback peer + X-Forwarded-For → public (Caddy-direct) [#704]", () => {
+    const r = req("/", { headers: { "X-Forwarded-For": "203.0.113.7" } });
+    expect(layerOf(r, "::ffff:127.0.0.1")).toBe("public");
+  });
+
+  // Security edge: an EMPTY / whitespace-only forwarding header (a misconfigured
+  // or stripped-but-present proxy header) must still err toward "public", never
+  // back to "loopback". `layerOf` uses a presence check (`!== null`), not a
+  // trim — keep it that way: the safe direction for a trust classifier is to
+  // DOWNGRADE on ambiguity. A future "tidy up with .trim()" refactor that
+  // flipped an empty XFF back to loopback would re-open the Caddy-direct leak.
+  test("loopback peer + empty X-Forwarded-For → public (errs safe, not loopback) [#704]", () => {
+    expect(layerOf(req("/", { headers: { "X-Forwarded-For": "" } }), "127.0.0.1")).toBe("public");
+    expect(layerOf(req("/", { headers: { "X-Forwarded-For": "   " } }), "127.0.0.1")).toBe("public");
+  });
+
+  // The genuine on-box caller (CLI, health probe, init bootstrap-token loopback
+  // probe `curl 127.0.0.1/admin/setup`, hub self-requests) sets NO forwarding
+  // header and MUST stay loopback. This is the not-broken half of the fix.
+  test("loopback peer + NO forwarding header → loopback (genuine on-box caller) [#704]", () => {
+    expect(layerOf(req("/"), "127.0.0.1")).toBe("loopback");
+    expect(layerOf(req("/"), "::1")).toBe("loopback");
+  });
+
+  // No spoof vector: forwarding headers can only DOWNGRADE a loopback caller.
+  // A NON-loopback peer is already "public" regardless of headers, so adding
+  // X-Forwarded-* never upgrades a network peer to a more-trusted layer.
+  test("non-loopback peer + X-Forwarded-For → public (no upgrade; spoof-proof) [#704]", () => {
+    const r = req("/", { headers: { "X-Forwarded-For": "127.0.0.1" } });
+    expect(layerOf(r, "203.0.113.7")).toBe("public");
+  });
+
+  // CF/TS header checks run FIRST — a Caddy-style forwarding header alongside a
+  // cf/tailscale header doesn't change those (still public/tailnet). Order
+  // preserved.
+  test("CF-Ray + X-Forwarded-For from loopback peer → public (CF check wins, order preserved)", () => {
+    const r = req("/", { headers: { "CF-Ray": "abc123-DEN", "X-Forwarded-For": "203.0.113.7" } });
+    expect(layerOf(r, "127.0.0.1")).toBe("public");
+  });
+
+  test("Tailscale-User-Login + X-Forwarded-For from loopback peer → tailnet (TS check wins)", () => {
+    const r = req("/", {
+      headers: { "Tailscale-User-Login": "alice@example.com", "X-Forwarded-For": "100.64.0.1" },
+    });
+    expect(layerOf(r, "127.0.0.1")).toBe("tailnet");
+  });
 });
 
 describe("hubFetch publicExposure layer-gate (proxyToService)", () => {
@@ -3823,6 +3895,74 @@ describe("hubFetch publicExposure layer-gate (proxyToService)", () => {
     }
   });
 
+  // hub#704 — Caddy/nginx-direct. A same-box reverse proxy dials loopback
+  // (peer 127.0.0.1) and stamps NO cf/tailscale header, but DOES set
+  // X-Forwarded-For. That request is a PUBLIC visitor proxied to the box and
+  // must hit the loopback-exposure cloak (404) — otherwise a Caddy-direct box
+  // leaks every loopback-only service/vault to the network.
+  test("publicExposure: loopback + X-Forwarded-For + loopback peer → 404 (Caddy-direct cloak fires) [#704]", async () => {
+    const h = makeHarness();
+    const upstream = startUpstream("loopback-only");
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "loopback-only",
+              port: upstream.port,
+              paths: ["/loopback-only"],
+              health: "/loopback-only/health",
+              version: "0.1.0",
+              publicExposure: "loopback",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const fetcher = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      // Caddy: peer is 127.0.0.1 (reverse_proxy 127.0.0.1:1939) but the request
+      // carries X-Forwarded-For for the real public client.
+      const r = req("/loopback-only/health", { headers: { "X-Forwarded-For": "203.0.113.7" } });
+      const res = await fetcher(r, fakeServer("127.0.0.1"));
+      expect(res.status).toBe(404);
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+
+  // The not-broken half: a header-less loopback peer (genuine on-box caller)
+  // still reaches the loopback-only service through the cloak.
+  test("publicExposure: loopback + NO forwarding header + loopback peer → reaches upstream [#704]", async () => {
+    const h = makeHarness();
+    const upstream = startUpstream("loopback-only");
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "loopback-only",
+              port: upstream.port,
+              paths: ["/loopback-only"],
+              health: "/loopback-only/health",
+              version: "0.1.0",
+              publicExposure: "loopback",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const fetcher = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await fetcher(req("/loopback-only/health"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { tag: string };
+      expect(body.tag).toBe("loopback-only");
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+
   test("publicExposure: allowed + tailnet header → reaches upstream (no gate)", async () => {
     const h = makeHarness();
     const upstream = startUpstream("allowed");
@@ -5850,3 +5990,103 @@ describe("resolveClientIp (H2)", () => {
     expect(resolveClientIp(r, null)).toBeNull();
   });
 });
+
+describe("GET /admin/setup bootstrap-token probe — loopback-gated (hub#576 + Caddy-direct #704)", () => {
+  // The hub#576 token probe: a LOOPBACK caller (the on-box operator's own
+  // shell / `parachute init`) reading GET /admin/setup with Accept:
+  // application/json gets the actual bootstrap token in the JSON envelope; a
+  // public/tailnet caller does not. The hub derives requestIsLoopback from
+  // `layerOf(req, peerAddr) === "loopback"` (hub-server.ts ~2296), so the
+  // Caddy-direct fix (#704) flows straight through: a same-box reverse proxy
+  // carrying X-Forwarded-For now classifies "public" and the token is withheld
+  // even though the peer is 127.0.0.1.
+
+  // Fake Bun Server handle (mirrors the cloak suite) so the fetch fn resolves
+  // the peer address. The on-box operator connects from 127.0.0.1; Caddy
+  // reverse_proxy also dials 127.0.0.1 but stamps X-Forwarded-For.
+  const fakeServer = (address: string) => ({ requestIP: () => ({ address }) });
+
+  test("loopback peer + NO forwarding header → bootstrapToken present (on-box operator) [#576]", async () => {
+    const h = makeHarness();
+    _resetBootstrapTokenForTests();
+    const token = generateBootstrapToken();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        // No admin row → wizard mode → GET /admin/setup JSON probe is live.
+        const res = await hubFetch(h.dir, { getDb: () => db })(
+          req("/admin/setup", { headers: { accept: "application/json" } }),
+          fakeServer("127.0.0.1"),
+        );
+        expect(res.status).toBe(200);
+        const body = (await res.json()) as {
+          requireBootstrapToken?: boolean;
+          bootstrapToken?: string;
+        };
+        expect(body.requireBootstrapToken).toBe(true);
+        expect(body.bootstrapToken).toBe(token);
+      } finally {
+        db.close();
+      }
+    } finally {
+      _resetBootstrapTokenForTests();
+      h.cleanup();
+    }
+  });
+
+  test("loopback peer + X-Forwarded-For → bootstrapToken WITHHELD (Caddy-direct public visitor) [#704]", async () => {
+    const h = makeHarness();
+    _resetBootstrapTokenForTests();
+    generateBootstrapToken();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        // Caddy: peer 127.0.0.1, but the request carries the public client's
+        // X-Forwarded-For. Pre-fix this leaked the token to any public visitor.
+        const res = await hubFetch(h.dir, { getDb: () => db })(
+          req("/admin/setup", {
+            headers: { accept: "application/json", "x-forwarded-for": "203.0.113.7" },
+          }),
+          fakeServer("127.0.0.1"),
+        );
+        expect(res.status).toBe(200);
+        const body = (await res.json()) as {
+          requireBootstrapToken?: boolean;
+          bootstrapToken?: string;
+        };
+        // The gate still SAYS a token is required (so the form renders the
+        // field) — it just doesn't hand the value to the public caller.
+        expect(body.requireBootstrapToken).toBe(true);
+        expect(body.bootstrapToken).toBeUndefined();
+      } finally {
+        db.close();
+      }
+    } finally {
+      _resetBootstrapTokenForTests();
+      h.cleanup();
+    }
+  });
+
+  test("non-loopback peer → bootstrapToken WITHHELD (direct public/tailnet)", async () => {
+    const h = makeHarness();
+    _resetBootstrapTokenForTests();
+    generateBootstrapToken();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        const res = await hubFetch(h.dir, { getDb: () => db })(
+          req("/admin/setup", { headers: { accept: "application/json" } }),
+          fakeServer("203.0.113.9"),
+        );
+        expect(res.status).toBe(200);
+        const body = (await res.json()) as { bootstrapToken?: string };
+        expect(body.bootstrapToken).toBeUndefined();
+      } finally {
+        db.close();
+      }
+    } finally {
+      _resetBootstrapTokenForTests();
+      h.cleanup();
+    }
+  });
+});