@openparachute/hub 0.7.4-rc.2 → 0.7.4-rc.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.4-rc.2",
+  "version": "0.7.4-rc.21",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {
@@ -11,15 +11,8 @@
   "bin": {
     "parachute": "src/cli.ts"
   },
-  "workspaces": [
-    "packages/*"
-  ],
-  "files": [
-    "src",
-    "web/ui/dist",
-    "README.md",
-    "LICENSE"
-  ],
+  "workspaces": ["packages/*"],
+  "files": ["src", "web/ui/dist", "README.md", "LICENSE"],
   "repository": {
     "type": "git",
     "url": "https://github.com/ParachuteComputer/parachute-hub.git"
@@ -47,7 +40,7 @@
   },
   "dependencies": {
     "@node-rs/argon2": "^2.0.2",
-    "@openparachute/depcheck": "0.1.0",
+    "@openparachute/depcheck": "0.1.1",
     "jose": "^6.2.2",
     "otpauth": "^9.5.0",
     "qrcode": "^1.5.4"

package/src/__tests__/admin-auth.test.ts

@@ -172,6 +172,134 @@ describe("requireScope", () => {
   });
 });
 
+describe("requireScope multi-origin issuer set (hub#516 parity)", () => {
+  // The hub answers on several legitimate origins after `parachute hub
+  // set-origin` / `expose` (loopback ∪ tunnel ∪ public). A credential minted
+  // under a still-valid prior origin must keep validating at admin-auth even
+  // when the per-request canonical issuer is now a different member of the set.
+  const LOOPBACK = "http://127.0.0.1:1939";
+  const TUNNEL = "https://brain.gitcoin.co";
+  const FOREIGN = "https://evil.example.com";
+
+  test("accepts a token whose iss is in the set but ≠ the per-request canonical", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        // Token minted under the TUNNEL origin (e.g. before `set-origin`)…
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: TUNNEL });
+        // …presented to admin-auth where the canonical per-request issuer is now
+        // LOOPBACK, but the bound-origin set still includes TUNNEL.
+        const ctx = await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+          LOOPBACK,
+          TUNNEL,
+        ]);
+        expect(ctx.sub).toBe("user-test");
+        expect(ctx.scopes).toContain("parachute:host:admin");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("rejects 401 when iss is OUTSIDE the set", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: FOREIGN });
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+            LOOPBACK,
+            TUNNEL,
+          ]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("rejects 401 on signature failure regardless of the set (signature-first)", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        // A hub-signed token, then rotate keys + retire so the original kid no
+        // longer verifies — the JWKS signature gate must fire before any iss
+        // membership check, so an in-set iss can't rescue an unverifiable token.
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth("Bearer not-a-real-jwt"), "parachute:host:admin", [
+            LOOPBACK,
+            TUNNEL,
+          ]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("single-string back-compat: in-set iss as a lone string still validates", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: ISSUER });
+        // A single-element set behaves exactly like the prior single-string form.
+        const ctx = await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+          ISSUER,
+        ]);
+        expect(ctx.sub).toBe("user-test");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("single-element set rejects a non-matching iss (no accidental widening)", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: TUNNEL });
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [ISSUER]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
 describe("adminAuthErrorResponse", () => {
   test("403 → insufficient_scope with WWW-Authenticate", async () => {
     const res = adminAuthErrorResponse(new AdminAuthError(403, "needs admin"));

package/src/__tests__/admin-clients.test.ts

@@ -12,8 +12,9 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { handleApproveClient, handleGetClient } from "../admin-clients.ts";
+import { handleApproveClient, handleDeleteClient, handleGetClient } from "../admin-clients.ts";
 import { approveClient, getClient, registerClient } from "../clients.ts";
+import { findGrant, recordGrant } from "../grants.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { signAccessToken } from "../jwt-sign.ts";
 import { createUser } from "../users.ts";
@@ -83,6 +84,23 @@ function approveReq(clientId: string, bearer?: string, method = "POST"): Request
   return new Request(`${ISSUER}/api/oauth/clients/${encodeURIComponent(clientId)}/approve`, init);
 }
 
+// DELETE hits the TOP-LEVEL /oauth/clients/<id> prefix (the path the surface
+// remove-flow calls), not the /api/... admin prefix the GET/approve use.
+function deleteReq(clientId: string, bearer?: string, method = "DELETE"): Request {
+  const init: RequestInit = { method };
+  if (bearer) init.headers = { authorization: `Bearer ${bearer}` };
+  return new Request(`${ISSUER}/oauth/clients/${encodeURIComponent(clientId)}`, init);
+}
+
+function regApproved(name?: string): string {
+  const r = registerClient(harness.db, {
+    redirectUris: ["https://app.example/cb"],
+    scopes: ["vault:work:read"],
+    ...(name !== undefined ? { clientName: name } : {}),
+  });
+  return r.client.clientId;
+}
+
 describe("handleGetClient", () => {
   test("401 without Bearer", async () => {
     const id = regPending("App");
@@ -460,3 +478,87 @@ describe("handleApproveClient", () => {
     });
   });
 });
+
+// hub#640 — RFC 7592 client deregistration. The surface fires DELETE on the
+// top-level /oauth/clients/<id> path; the handler is operator-bearer-gated,
+// returns 204 on delete (cascading grants + auth_codes), 404 when absent.
+describe("handleDeleteClient", () => {
+  test("401 without Bearer (row survives)", async () => {
+    const id = regApproved("App");
+    const res = await handleDeleteClient(deleteReq(id), id, {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(401);
+    expect(getClient(harness.db, id)).not.toBeNull();
+  });
+
+  test("403 with the wrong scope (row survives)", async () => {
+    const { bearer } = await makeOperatorBearer(["parachute:host:auth"]);
+    const id = regApproved("App");
+    const res = await handleDeleteClient(deleteReq(id, bearer), id, {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(403);
+    expect(getClient(harness.db, id)).not.toBeNull();
+  });
+
+  test("204 on an existing client + cascade gone + audit line", async () => {
+    const { bearer, userId } = await makeOperatorBearer();
+    const id = regApproved("Notes");
+    // Plant a grant so the cascade has something to remove.
+    recordGrant(harness.db, userId, id, ["vault:work:read"]);
+    expect(findGrant(harness.db, userId, id)).not.toBeNull();
+
+    const logs: string[] = [];
+    const originalLog = console.log;
+    console.log = (...args: unknown[]) => {
+      logs.push(args.map(String).join(" "));
+    };
+    let res: Response;
+    try {
+      res = await handleDeleteClient(deleteReq(id, bearer), id, {
+        db: harness.db,
+        issuer: ISSUER,
+      });
+    } finally {
+      console.log = originalLog;
+    }
+    expect(res.status).toBe(204);
+    // 204 carries no body.
+    expect(await res.text()).toBe("");
+    // Client + its grant are gone.
+    expect(getClient(harness.db, id)).toBeNull();
+    expect(findGrant(harness.db, userId, id)).toBeNull();
+
+    const line = logs.find((l) => l.startsWith("client deleted:"));
+    expect(line).toBeDefined();
+    expect(line).toContain(`client_id=${id}`);
+    expect(line).toContain("client_name=Notes");
+    expect(line).toContain(`remover_sub=${userId}`);
+  });
+
+  test("404 on an absent client_id", async () => {
+    const { bearer } = await makeOperatorBearer();
+    const res = await handleDeleteClient(deleteReq("nope", bearer), "nope", {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.error).toBe("not_found");
+  });
+
+  test("405 on a non-DELETE method", async () => {
+    const { bearer } = await makeOperatorBearer();
+    const id = regApproved();
+    const res = await handleDeleteClient(deleteReq(id, bearer, "GET"), id, {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(405);
+    // Row untouched.
+    expect(getClient(harness.db, id)).not.toBeNull();
+  });
+});

package/src/__tests__/admin-lock.test.ts

@@ -527,7 +527,13 @@ describe("admin-lock management API", () => {
     const r2 = await handleAdminLock(lockReq("/heartbeat", cookie, {}), "/heartbeat", {
       db: harness.db,
     });
-    expect(((await r2.json()) as { locked: boolean }).locked).toBe(false);
+    const body2 = (await r2.json()) as { locked: boolean; idle_seconds?: number };
+    expect(body2.locked).toBe(false);
+    // The heartbeat MUST carry idle_seconds — the client re-anchors its local
+    // idle timer from it on every heartbeat. Omitting it poisoned the timer
+    // (undefined → NaN → instant re-lock). Regression guard for the PIN
+    // re-prompt loop.
+    expect(body2.idle_seconds).toBe(getIdleSeconds(harness.db));
   });
 
   test("unlock brute-force limiter: 6th attempt is 429", async () => {

package/src/__tests__/admin-vaults.test.ts

@@ -2,7 +2,13 @@ import { describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { HOST_ADMIN_SCOPE, type RunResult, handleCreateVault } from "../admin-vaults.ts";
+import {
+  HOST_ADMIN_SCOPE,
+  type RunResult,
+  handleCreateVault,
+  listVaultInstanceNames,
+  provisionVault,
+} from "../admin-vaults.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { signAccessToken } from "../jwt-sign.ts";
 import { upsertService, writeManifest } from "../services-manifest.ts";
@@ -934,27 +940,70 @@ describe("DELETE /vaults/<name> — gates", () => {
     }
   });
 
-  test("409 last_vault on the only remaining vault (CLI never runs)", async () => {
+  test("#678: deleting the LAST vault cascades + deletes (no 409), with a last_vault warning", async () => {
     const h = makeHarness();
     try {
       const db = openHubDb(hubDbPath(h.dir));
       try {
         rotateSigningKey(db);
-        writeVaults(h.manifestPath, ["default"]);
+        // Only one vault on the hub — the previously-refused last-vault case.
+        writeVaults(h.manifestPath, ["solo"]);
+
+        // Seed identity artifacts naming the soon-to-be-deleted last vault.
+        registryRow(db, "jti-solo", ["vault:solo:write"]);
+        const carol = await createUser(db, "carol", "carol-passphrase-123");
+        const client = registerClient(db, { redirectUris: ["https://d.example/cb"] }).client
+          .clientId;
+        recordGrant(db, carol.id, client, ["vault:solo:admin"]);
+        setUserVaults(db, carol.id, ["solo"]);
+
         const runner = stubRun();
         const res = await callDelete({
-          name: "default",
+          name: "solo",
           db,
           manifestPath: h.manifestPath,
           connectionsStorePath: join(h.dir, "connections.json"),
           runCommand: runner.run,
         });
-        expect(res.status).toBe(409);
-        const out = (await res.json()) as { error: string; error_description: string };
-        expect(out.error).toBe("last_vault");
-        // Guidance names the CLI escape hatch + the resurrection reason.
-        expect(out.error_description).toContain("parachute-vault remove");
-        expect(runner.calls.length).toBe(0);
+
+        // No 409 — the delete completes.
+        expect(res.status).toBe(200);
+        const out = (await res.json()) as {
+          ok: boolean;
+          cascade: {
+            tokens_revoked: number;
+            grants_dropped: number;
+            user_vaults_removed: number;
+            vault_removed: boolean;
+          };
+          warnings?: { step: string; detail: string }[];
+        };
+        expect(out.ok).toBe(true);
+
+        // The cascade ran for the last vault: tokens/grants/assignments gone.
+        expect(out.cascade.tokens_revoked).toBe(1);
+        expect(findTokenRowByJti(db, "jti-solo")?.revokedAt).not.toBeNull();
+        expect(out.cascade.grants_dropped).toBe(1);
+        expect(findGrant(db, carol.id, client)).toBeNull();
+        expect(out.cascade.user_vaults_removed).toBe(1);
+        expect(
+          db
+            .query<{ vault_name: string }, [string]>(
+              "SELECT vault_name FROM user_vaults WHERE user_id = ?",
+            )
+            .all(carol.id),
+        ).toEqual([]);
+
+        // The underlying vault remove ran (the cascade no longer skips it).
+        expect(runner.calls).toContainEqual(["parachute-vault", "remove", "solo", "--yes"]);
+        expect(out.cascade.vault_removed).toBe(true);
+
+        // A last_vault heads-up warning is surfaced (name-agnostic — does not
+        // assume "default"); the auto_create:false marker prevents resurrection.
+        const lastVaultWarning = out.warnings?.find((w) => w.step === "last_vault");
+        expect(lastVaultWarning).toBeDefined();
+        expect(lastVaultWarning?.detail).toContain("auto_create: false");
+        expect(lastVaultWarning?.detail).not.toContain('"default"');
       } finally {
         db.close();
       }
@@ -1304,3 +1353,160 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
     }
   });
 });
+
+// ===========================================================================
+// #478 — empty-paths vault rows must not resolve to phantom "default"
+// ===========================================================================
+
+describe("#478 — empty-paths vault row tolerance", () => {
+  test("findExistingVault: empty-paths vault row does NOT match 'default'", () => {
+    // A vault module registered in services.json with paths:[] is "installed
+    // but no servable vault instance". Hub must skip it — never synthesize a
+    // phantom "default" — so provisionVault can proceed to a real create.
+    const h = makeHarness();
+    try {
+      // Write a services.json with a parachute-vault entry carrying paths:[].
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              port: 1940,
+              paths: [],
+              health: "/health",
+              version: "0.5.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      // Calling provisionVault("default") internally calls findExistingVault.
+      // We verify the behaviour indirectly via listVaultInstanceNames (exported
+      // for this test) and via provisionVault's created:true path below.
+      const names = listVaultInstanceNames(h.manifestPath);
+      expect(names.has("default")).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("listVaultInstanceNames: empty-paths vault row is omitted from the Set", () => {
+    const h = makeHarness();
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              port: 1940,
+              paths: [],
+              health: "/health",
+              version: "0.5.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const names = listVaultInstanceNames(h.manifestPath);
+      expect(names.size).toBe(0);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("provisionVault: empty-paths row → created:true (proceeds to orchestrate, not false 'already exists')", async () => {
+    // Core regression test for #478: before the fix, an empty-paths row
+    // resolved to phantom "default" → findExistingVault returned non-null →
+    // provisionVault short-circuited to created:false with "already exists".
+    // After the fix: findExistingVault returns null → orchestrate runs →
+    // created:true.
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        // Seed an empty-paths vault row (what vault's self-register emits at
+        // zero vaults, per the #478 contract).
+        writeManifest(
+          {
+            services: [
+              {
+                name: "parachute-vault",
+                port: 1940,
+                paths: [],
+                health: "/health",
+                version: "0.5.0",
+              },
+            ],
+          },
+          h.manifestPath,
+        );
+
+        const calls: Array<readonly string[]> = [];
+        const runCommand = async (cmd: readonly string[]): Promise<RunResult> => {
+          calls.push(cmd);
+          // Simulate vault CLI writing the real path into services.json after
+          // a successful create. Because vault IS already registered (paths:[]),
+          // orchestrate picks the `parachute-vault create --json` branch and
+          // expects JSON stdout.
+          upsertService(
+            {
+              name: "parachute-vault",
+              port: 1940,
+              paths: ["/vault/default"],
+              health: "/health",
+              version: "0.5.0",
+            },
+            h.manifestPath,
+          );
+          return { exitCode: 0, stdout: vaultCreateJson("default"), stderr: "" };
+        };
+
+        const result = await provisionVault("default", {
+          issuer: ISSUER,
+          manifestPath: h.manifestPath,
+          runCommand,
+        });
+
+        // Must have proceeded to orchestrate and returned created:true.
+        expect(result.ok).toBe(true);
+        if (!result.ok) return; // narrow for TS
+        expect(result.created).toBe(true);
+        // The orchestration command ran (not short-circuited).
+        expect(calls.length).toBeGreaterThan(0);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("listVaultInstanceNames: real paths still enumerate correctly (empty-paths does not break them)", () => {
+    // Sanity: mixing an empty-paths row with a real-paths row — the real
+    // paths are still found, the empty one is still skipped.
+    const h = makeHarness();
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              port: 1940,
+              paths: ["/vault/default", "/vault/work"],
+              health: "/health",
+              version: "0.5.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const names = listVaultInstanceNames(h.manifestPath);
+      expect(names.has("default")).toBe(true);
+      expect(names.has("work")).toBe(true);
+      expect(names.size).toBe(2);
+    } finally {
+      h.cleanup();
+    }
+  });
+});