@openparachute/hub 0.7.4-rc.1 → 0.7.4-rc.10

package/src/__tests__/clients.test.ts

@@ -151,7 +151,10 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
   const hubOrigins = [LOOPBACK, "http://localhost:1939", PUBLIC];
 
   test("expands a loopback-rooted URI onto every other hub origin", () => {
-    const out = expandRedirectUrisForHubOrigins([`${LOOPBACK}/surface/notes/oauth/callback`], hubOrigins);
+    const out = expandRedirectUrisForHubOrigins(
+      [`${LOOPBACK}/surface/notes/oauth/callback`],
+      hubOrigins,
+    );
     // Original is preserved + the public + localhost variants are added.
     expect(out).toContain(`${LOOPBACK}/surface/notes/oauth/callback`);
     expect(out).toContain(`${PUBLIC}/surface/notes/oauth/callback`);
@@ -188,10 +191,7 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
   });
 
   test("single known hub origin → no expansion (submitted set returned as-is)", () => {
-    const out = expandRedirectUrisForHubOrigins(
-      [`${LOOPBACK}/surface/notes/`],
-      [LOOPBACK],
-    );
+    const out = expandRedirectUrisForHubOrigins([`${LOOPBACK}/surface/notes/`], [LOOPBACK]);
     expect(out).toEqual([`${LOOPBACK}/surface/notes/`]);
   });
 
@@ -222,9 +222,9 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
       const r = registerClient(db, { redirectUris: expanded });
       // The public-origin variant now matches exactly at authorize time — the
       // off-localhost sign-in that surface#118 broke.
-      expect(
-        requireRegisteredRedirectUri(r.client, `${PUBLIC}/surface/notes/oauth/callback`),
-      ).toBe(`${PUBLIC}/surface/notes/oauth/callback`);
+      expect(requireRegisteredRedirectUri(r.client, `${PUBLIC}/surface/notes/oauth/callback`)).toBe(
+        `${PUBLIC}/surface/notes/oauth/callback`,
+      );
       // A truly-unregistered URI is still rejected — strict match unchanged.
       expect(() =>
         requireRegisteredRedirectUri(r.client, "https://evil.example/surface/notes/oauth/callback"),
@@ -352,4 +352,24 @@ describe("isValidRedirectUri", () => {
     expect(isValidRedirectUri("/relative")).toBe(false);
     expect(isValidRedirectUri("not a url")).toBe(false);
   });
+  // hub#663: spec-forbidden shapes that the protocol allowlist alone passed.
+  test("rejects userinfo-bearing redirect URIs (hub#663)", () => {
+    expect(isValidRedirectUri("https://x@evil.com/cb")).toBe(false);
+    expect(isValidRedirectUri("https://user:pass@evil.com/cb")).toBe(false);
+    expect(isValidRedirectUri("http://attacker@127.0.0.1:3000/cb")).toBe(false);
+  });
+  test("rejects control chars in the raw input (hub#663)", () => {
+    // Control chars must be caught on the RAW string — URL parsing would
+    // otherwise strip a trailing \r\n and the smuggled value would pass.
+    expect(isValidRedirectUri("https://example.com/cb\r\nSet-Cookie: x")).toBe(false);
+    expect(isValidRedirectUri("https://example.com/\x00cb")).toBe(false);
+    expect(isValidRedirectUri("https://example.com/cb\x7f")).toBe(false);
+  });
+  test("still accepts clean http(s) with ports, paths, and queries (regression guard)", () => {
+    // Legitimate clients (hub modules, self-built surfaces, Notes, Claude DCR)
+    // all register clean URIs — these must keep passing.
+    expect(isValidRedirectUri("https://claude.ai/api/mcp/auth_callback")).toBe(true);
+    expect(isValidRedirectUri("http://localhost:1939/admin/oauth/callback")).toBe(true);
+    expect(isValidRedirectUri("https://my-surface.github.io/cb?x=1")).toBe(true);
+  });
 });

package/src/__tests__/cloudflare-connector-service.test.ts

@@ -258,8 +258,10 @@ describe("installConnectorService — Linux systemd", () => {
       platform: "linux",
       getuid: () => 1000,
       userName: () => "op",
-      // enable-linger FAIL, then daemon-reload OK, enable --now OK.
+      // #528 probe: show-user → Linger=no (off, so we proceed to enable);
+      // then enable-linger FAIL, daemon-reload OK, enable --now OK.
       runResults: [
+        { code: 0, stdout: "Linger=no\n", stderr: "" },
         { code: 1, stdout: "", stderr: "Failed to enable linger" },
         { code: 0, stdout: "", stderr: "" },
         { code: 0, stdout: "", stderr: "" },

package/src/__tests__/hub-server.test.ts

@@ -3,10 +3,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import {
-  _resetBootstrapTokenForTests,
-  generateBootstrapToken,
-} from "../bootstrap-token.ts";
+import { _resetBootstrapTokenForTests, generateBootstrapToken } from "../bootstrap-token.ts";
 import { buildCsrfCookie, generateCsrfToken } from "../csrf.ts";
 import { HUB_SVC, hubPortPath } from "../hub-control.ts";
 import { createDbHolder } from "../hub-db-liveness.ts";
@@ -3715,7 +3712,9 @@ describe("layerOf — classify trust layer from proxy headers + peer (item E / #
   // flipped an empty XFF back to loopback would re-open the Caddy-direct leak.
   test("loopback peer + empty X-Forwarded-For → public (errs safe, not loopback) [#704]", () => {
     expect(layerOf(req("/", { headers: { "X-Forwarded-For": "" } }), "127.0.0.1")).toBe("public");
-    expect(layerOf(req("/", { headers: { "X-Forwarded-For": "   " } }), "127.0.0.1")).toBe("public");
+    expect(layerOf(req("/", { headers: { "X-Forwarded-For": "   " } }), "127.0.0.1")).toBe(
+      "public",
+    );
   });
 
   // The genuine on-box caller (CLI, health probe, init bootstrap-token loopback
@@ -6090,3 +6089,126 @@ describe("GET /admin/setup bootstrap-token probe — loopback-gated (hub#576 + C
     }
   });
 });
+
+// hub#643 (Tier-1): non-script security headers on proxied module/surface
+// text/html pages. The vault content proxy and the generic services-mount
+// proxy both flow through `decorateWithChrome`, so the headers land on both.
+// DELIBERATELY no `script-src` — a strict script-src would white-screen
+// self-built GitHub-hosted surfaces + inline-script module pages (that's the
+// deferred Tier-2). Header-only: non-HTML proxied responses are NOT decorated.
+describe("hubFetch proxied-page security headers (hub#643 Tier-1)", () => {
+  const TIER1_CSP = "frame-ancestors 'self'; object-src 'none'; base-uri 'self'";
+
+  // Live upstream that echoes a fixed content-type + body so the test can
+  // exercise both the text/html (decorated) and JSON (untouched) branches.
+  function startUpstream(contentType: string, body: string): { port: number; stop: () => void } {
+    const server = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      fetch: () => new Response(body, { status: 200, headers: { "content-type": contentType } }),
+    });
+    return { port: server.port as number, stop: () => server.stop(true) };
+  }
+
+  test("decorates a proxied text/html generic-mount page with nosniff + the Tier-1 CSP", async () => {
+    const h = makeHarness();
+    const upstream = startUpstream(
+      "text/html; charset=utf-8",
+      "<html><body><h1>my surface</h1></body></html>",
+    );
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-surface",
+              port: upstream.port,
+              paths: ["/surface"],
+              health: "/surface/health",
+              version: "0.2.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const res = await hubFetch(h.dir, { manifestPath: h.manifestPath })(req("/surface/foo"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toContain("text/html");
+      expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+      const csp = res.headers.get("content-security-policy");
+      expect(csp).toBe(TIER1_CSP);
+      // The critical Tier-1/Tier-2 boundary: NO script-src — self-built
+      // GitHub-hosted surfaces + inline-script module pages must stay
+      // unrestricted. A strict script-src is the deferred Tier-2.
+      expect(csp).not.toContain("script-src");
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+
+  test("decorates a proxied text/html per-vault page (the Notes-PWA path) with the same headers", async () => {
+    const h = makeHarness();
+    const upstream = startUpstream("text/html; charset=utf-8", "<html><body>notes</body></html>");
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              port: upstream.port,
+              paths: ["/vault/default"],
+              health: "/vault/default/health",
+              version: "0.4.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const res = await hubFetch(h.dir, { manifestPath: h.manifestPath })(
+        req("/vault/default/some-page"),
+      );
+      expect(res.status).toBe(200);
+      expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+      expect(res.headers.get("content-security-policy")).toBe(TIER1_CSP);
+      expect(res.headers.get("content-security-policy")).not.toContain("script-src");
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+
+  test("leaves a proxied NON-HTML response (JSON) undecorated", async () => {
+    const h = makeHarness();
+    const upstream = startUpstream("application/json", JSON.stringify({ ok: true }));
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-surface",
+              port: upstream.port,
+              paths: ["/surface"],
+              health: "/surface/health",
+              version: "0.2.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const res = await hubFetch(h.dir, { manifestPath: h.manifestPath })(req("/surface/api/data"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toContain("application/json");
+      // No HTML CSP on a JSON API response (proves the header is gated on
+      // content-type, so a `.js` asset proxied through the same path is also
+      // left alone).
+      expect(res.headers.get("content-security-policy")).toBeNull();
+      expect(res.headers.get("x-content-type-options")).toBeNull();
+      const body = (await res.json()) as { ok: boolean };
+      expect(body.ok).toBe(true);
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+});

package/src/__tests__/init.test.ts

@@ -2218,5 +2218,158 @@ describe("resolveInitChannel (hub#694 bug 2)", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// #478 Part 2 — `parachute init --vault-name <name>` creates the first vault
+// ---------------------------------------------------------------------------
+
+describe("init --vault-name (#478 Part 2)", () => {
+  /** Minimal stub that satisfies every init seam except the ones under test. */
+  function baseOpts(
+    h: Harness,
+    overrides: Parameters<typeof init>[0] = {},
+  ): Parameters<typeof init>[0] {
+    return {
+      configDir: h.configDir,
+      manifestPath: h.manifestPath,
+      log: () => {},
+      alive: () => false,
+      ensureHubVersion: async () => ({
+        outcome: "match" as const,
+        installedVersion: "test",
+        messages: [],
+      }),
+      ensureHub: async () => {
+        writeHubPort(1939, h.configDir);
+        return { pid: 0, port: 1939, started: true };
+      },
+      readExposeStateFn: () => undefined,
+      isTty: false,
+      platform: "linux" as const,
+      installVaultModuleImpl: noopVaultInstall,
+      noBrowser: true,
+      noExposePrompt: true,
+      noWizardPrompt: true,
+      ...overrides,
+    };
+  }
+
+  test("(a) with vaultName set: invokes createFirstVaultImpl with the name", async () => {
+    const h = makeHarness();
+    try {
+      const createCalls: string[] = [];
+      const logs: string[] = [];
+      const code = await init(
+        baseOpts(h, {
+          vaultName: "myvault",
+          log: (l) => logs.push(l),
+          createFirstVaultImpl: async (name) => {
+            createCalls.push(name);
+            return 0;
+          },
+        }),
+      );
+      expect(code).toBe(0);
+      expect(createCalls).toEqual(["myvault"]);
+      expect(logs.join("\n")).toContain('Creating vault "myvault"');
+      expect(logs.join("\n")).toContain('Vault "myvault" created');
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("(b) without vaultName: does NOT invoke createFirstVaultImpl", async () => {
+    const h = makeHarness();
+    try {
+      let createCalled = false;
+      const code = await init(
+        baseOpts(h, {
+          // no vaultName set
+          createFirstVaultImpl: async () => {
+            createCalled = true;
+            return 0;
+          },
+        }),
+      );
+      expect(code).toBe(0);
+      expect(createCalled).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("(c) invalid vault name via the CLI seam: validateVaultName rejects it", () => {
+    // The CLI validates before calling init; test the validator directly
+    // so the unit test doesn't need to drive argv parsing. The validator
+    // is the same one the CLI uses (imported in cli.ts).
+    const { validateVaultName } = require("../vault-name.ts");
+    const result = validateVaultName("My Vault!");
+    expect(result.ok).toBe(false);
+    expect(result.error).toMatch(/lowercase alphanumeric/);
+  });
+
+  test("(d) a seeded services.json vault MODULE row does NOT suppress the create", async () => {
+    // REGRESSION (the rc.7 verification bug): Step 0.5's `install("vault",
+    // { noCreate: true })` seeds a `parachute-vault` services.json row via
+    // `spec.seedEntry` on EVERY fresh install. The OLD Step 1.6 keyed
+    // idempotency off that row, so on the exact fresh-box path this feature
+    // targets it saw the row + silently no-op'd the create — the headline
+    // feature never fired. The row marks "module installed", not "instance
+    // exists". Idempotency must live in `parachute-vault create`'s own exit
+    // (which errors "already exists" on a real re-run), NOT a row precheck.
+    // So: a seeded module row must NOT prevent the create from being attempted.
+    const h = makeHarness();
+    try {
+      // Seed services.json with the module row (as Step 0.5 always does).
+      seedVault(h.manifestPath);
+      const createCalls: string[] = [];
+      const logs: string[] = [];
+      const code = await init(
+        baseOpts(h, {
+          vaultName: "myvault",
+          log: (l) => logs.push(l),
+          createFirstVaultImpl: async (name) => {
+            createCalls.push(name);
+            return 0;
+          },
+        }),
+      );
+      expect(code).toBe(0);
+      // The create WAS attempted despite the seeded module row.
+      expect(createCalls).toEqual(["myvault"]);
+      expect(logs.join("\n")).toContain('Creating vault "myvault"');
+      expect(logs.join("\n")).toContain('Vault "myvault" created');
+      // No "already configured / ignored" no-op message.
+      expect(logs.join("\n")).not.toContain("already configured");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("non-zero exit from create (e.g. vault already exists): warns but init still exits 0", async () => {
+    // A non-zero exit covers both "vault already exists" (a benign re-run, where
+    // `parachute-vault create` errors + exits 1) and a genuine creation failure.
+    // Either way init is non-fatal — the operator can re-run / check status.
+    const h = makeHarness();
+    try {
+      const logs: string[] = [];
+      const code = await init(
+        baseOpts(h, {
+          vaultName: "myvault",
+          log: (l) => logs.push(l),
+          createFirstVaultImpl: async () => 1,
+        }),
+      );
+      // Init is non-fatal on create failure — operator can retry.
+      expect(code).toBe(0);
+      const joined = logs.join("\n");
+      expect(joined).toContain("exited 1");
+      expect(joined).toContain("may already exist, or creation failed");
+      expect(joined).toContain("parachute vault create myvault");
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
 // Type alias used only inside this test file for the heuristic test.
 type ExposeChoice = "none" | "tailnet" | "cloudflare";

package/src/__tests__/managed-unit.test.ts

@@ -398,6 +398,68 @@ describe("installManagedUnit — start:boolean (§7.1)", () => {
     expect(f.calls).toContainEqual(["systemctl", "--user", "daemon-reload"]);
     expect(f.calls.some((c) => c.includes("enable"))).toBe(false);
   });
+
+  // #528: a per-command fake `run` so the linger probe + enable-linger can return
+  // distinct results. Non-linger commands (systemctl daemon-reload / enable) all
+  // succeed; only the linger sequence is scripted via `linger`.
+  function lingerDeps(linger: {
+    probe?: ServiceCommandResult;
+    enable?: ServiceCommandResult;
+  }): FakeDepsState {
+    const ok: ServiceCommandResult = { code: 0, stdout: "", stderr: "" };
+    return fakeDeps({
+      platform: "linux",
+      getuid: () => 1000,
+      userName: () => "op",
+      run: ((cmd: readonly string[]) => {
+        // `calls` is recorded by the default run; here we record into a closure
+        // list returned alongside via the returned FakeDepsState — but fakeDeps
+        // only records in its OWN default run. So push into a shared array.
+        recorded.push([...cmd]);
+        if (cmd[0] === "loginctl" && cmd[1] === "show-user") return linger.probe ?? ok;
+        if (cmd[0] === "loginctl" && cmd[1] === "enable-linger") return linger.enable ?? ok;
+        return ok;
+      }) as ManagedUnitDeps["run"],
+    });
+  }
+  // Shared recorder for the per-command run above (fakeDeps's own `calls` array
+  // isn't populated when we override `run`).
+  let recorded: string[][] = [];
+
+  test("#528: linger ALREADY on → no enable attempt, no warning (false-alarm fix)", () => {
+    recorded = [];
+    const f = lingerDeps({ probe: { code: 0, stdout: "Linger=yes\n", stderr: "" } });
+    const result = installManagedUnit({
+      unit: hubUnit(f.deps),
+      deps: f.deps,
+      messages: HUB_MESSAGES,
+      start: false,
+    });
+    // Probed current state...
+    expect(recorded).toContainEqual(["loginctl", "show-user", "op", "--property=Linger"]);
+    // ...and because it's already on, did NOT try to enable it.
+    expect(recorded.some((c) => c[0] === "loginctl" && c[1] === "enable-linger")).toBe(false);
+    // ...and emitted NO scary linger warning.
+    expect(result.messages).not.toContain(HUB_MESSAGES.lingerWarning);
+  });
+
+  test("#528: linger OFF + enable-linger fails → warning surfaces", () => {
+    recorded = [];
+    const f = lingerDeps({
+      probe: { code: 0, stdout: "Linger=no\n", stderr: "" },
+      enable: { code: 1, stdout: "", stderr: "operation not permitted" },
+    });
+    const result = installManagedUnit({
+      unit: hubUnit(f.deps),
+      deps: f.deps,
+      messages: HUB_MESSAGES,
+      start: false,
+    });
+    // Off → did attempt to enable...
+    expect(recorded).toContainEqual(["loginctl", "enable-linger", "op"]);
+    // ...and the genuine failure warns.
+    expect(result.messages).toContain(HUB_MESSAGES.lingerWarning);
+  });
 });
 
 // ---------------------------------------------------------------------------