@openparachute/hub 0.7.4-rc.2 → 0.7.4-rc.21

package/src/__tests__/clients.test.ts

@@ -2,18 +2,24 @@ import { describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { issueAuthCode } from "../auth-codes.ts";
 import {
   InvalidRedirectUriError,
   approveClient,
+  deleteClient,
   expandRedirectUrisForHubOrigins,
+  findReapableClients,
   getClient,
   isValidRedirectUri,
   listClientsByStatus,
+  reapClient,
   registerClient,
   requireRegisteredRedirectUri,
   verifyClientSecret,
 } from "../clients.ts";
+import { findGrant, recordGrant } from "../grants.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { createUser } from "../users.ts";
 
 function makeDb() {
   const configDir = mkdtempSync(join(tmpdir(), "phub-clients-"));
@@ -151,7 +157,10 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
   const hubOrigins = [LOOPBACK, "http://localhost:1939", PUBLIC];
 
   test("expands a loopback-rooted URI onto every other hub origin", () => {
-    const out = expandRedirectUrisForHubOrigins([`${LOOPBACK}/surface/notes/oauth/callback`], hubOrigins);
+    const out = expandRedirectUrisForHubOrigins(
+      [`${LOOPBACK}/surface/notes/oauth/callback`],
+      hubOrigins,
+    );
     // Original is preserved + the public + localhost variants are added.
     expect(out).toContain(`${LOOPBACK}/surface/notes/oauth/callback`);
     expect(out).toContain(`${PUBLIC}/surface/notes/oauth/callback`);
@@ -188,10 +197,7 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
   });
 
   test("single known hub origin → no expansion (submitted set returned as-is)", () => {
-    const out = expandRedirectUrisForHubOrigins(
-      [`${LOOPBACK}/surface/notes/`],
-      [LOOPBACK],
-    );
+    const out = expandRedirectUrisForHubOrigins([`${LOOPBACK}/surface/notes/`], [LOOPBACK]);
     expect(out).toEqual([`${LOOPBACK}/surface/notes/`]);
   });
 
@@ -222,9 +228,9 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
       const r = registerClient(db, { redirectUris: expanded });
       // The public-origin variant now matches exactly at authorize time — the
       // off-localhost sign-in that surface#118 broke.
-      expect(
-        requireRegisteredRedirectUri(r.client, `${PUBLIC}/surface/notes/oauth/callback`),
-      ).toBe(`${PUBLIC}/surface/notes/oauth/callback`);
+      expect(requireRegisteredRedirectUri(r.client, `${PUBLIC}/surface/notes/oauth/callback`)).toBe(
+        `${PUBLIC}/surface/notes/oauth/callback`,
+      );
       // A truly-unregistered URI is still rejected — strict match unchanged.
       expect(() =>
         requireRegisteredRedirectUri(r.client, "https://evil.example/surface/notes/oauth/callback"),
@@ -341,6 +347,298 @@ describe("approval gate (#74)", () => {
   });
 });
 
+describe("deleteClient cascade (hub#640 RFC 7592 deregistration)", () => {
+  test("returns false for an unknown client_id (nothing to delete)", () => {
+    const { db, cleanup } = makeDb();
+    try {
+      expect(deleteClient(db, "no-such-client")).toBe(false);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("deletes the client row and reports true", () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const r = registerClient(db, { redirectUris: ["https://app.example/cb"] });
+      expect(getClient(db, r.client.clientId)).not.toBeNull();
+      expect(deleteClient(db, r.client.clientId)).toBe(true);
+      expect(getClient(db, r.client.clientId)).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("cascades dependent grants + auth_codes (FK ON, no ON DELETE CASCADE)", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const r = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        scopes: ["vault:work:read"],
+      });
+      const clientId = r.client.clientId;
+
+      // Plant a live grant + auth_code that reference the client. Without the
+      // cascade, the bare DELETE FROM clients would throw a FK violation while
+      // these rows exist (PRAGMA foreign_keys = ON).
+      recordGrant(db, user.id, clientId, ["vault:work:read"]);
+      const ac = issueAuthCode(db, {
+        clientId,
+        userId: user.id,
+        redirectUri: "https://app.example/cb",
+        scopes: ["vault:work:read"],
+        codeChallenge: "x".repeat(43),
+        codeChallengeMethod: "S256",
+      });
+      // Sanity: the dependents are present before the delete.
+      expect(findGrant(db, user.id, clientId)).not.toBeNull();
+      expect(db.query("SELECT code FROM auth_codes WHERE code = ?").get(ac.code)).not.toBeNull();
+
+      // Delete cascades — no FK throw, true returned.
+      expect(deleteClient(db, clientId)).toBe(true);
+
+      // Client + both dependents are gone.
+      expect(getClient(db, clientId)).toBeNull();
+      expect(findGrant(db, user.id, clientId)).toBeNull();
+      expect(db.query("SELECT code FROM auth_codes WHERE code = ?").get(ac.code)).toBeNull();
+      // The user row is untouched — only client-keyed rows cascade.
+      expect(db.query("SELECT id FROM users WHERE id = ?").get(user.id)).not.toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("transactional: deleting one client leaves a sibling client's grants intact", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const keep = registerClient(db, { redirectUris: ["https://keep.example/cb"] });
+      const drop = registerClient(db, { redirectUris: ["https://drop.example/cb"] });
+      recordGrant(db, user.id, keep.client.clientId, ["vault:work:read"]);
+      recordGrant(db, user.id, drop.client.clientId, ["vault:work:read"]);
+
+      expect(deleteClient(db, drop.client.clientId)).toBe(true);
+
+      // The kept client + its grant survive; only the dropped client's
+      // grant cascaded.
+      expect(getClient(db, keep.client.clientId)).not.toBeNull();
+      expect(findGrant(db, user.id, keep.client.clientId)).not.toBeNull();
+      expect(getClient(db, drop.client.clientId)).toBeNull();
+      expect(findGrant(db, user.id, drop.client.clientId)).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+});
+
+describe("findReapableClients / reapClient — the GC safety gate (hub#640)", () => {
+  const DAY_MS = 24 * 60 * 60 * 1000;
+  // A fixed "now" so age math is deterministic. All planted clients register
+  // 60 days before this unless a test overrides.
+  const NOW = new Date("2026-06-27T00:00:00Z");
+  const now = () => NOW;
+  const OLD = new Date(NOW.getTime() - 60 * DAY_MS); // 60d old → past 30d floor
+  const oldNow = () => OLD;
+
+  /** Plant a `tokens` row with precise expiry/revocation for a client. */
+  function plantToken(
+    db: ReturnType<typeof openHubDb>,
+    opts: {
+      clientId: string;
+      userId: string;
+      jti: string;
+      expiresAt: string;
+      revokedAt?: string | null;
+    },
+  ): void {
+    db.prepare(
+      `INSERT INTO tokens
+       (jti, user_id, client_id, scopes, refresh_token_hash, family_id,
+        expires_at, revoked_at, created_at, created_via, subject)
+       VALUES (?, ?, ?, '', NULL, NULL, ?, ?, ?, 'oauth_refresh', NULL)`,
+    ).run(
+      opts.jti,
+      opts.userId,
+      opts.clientId,
+      opts.expiresAt,
+      opts.revokedAt ?? null,
+      OLD.toISOString(),
+    );
+  }
+
+  test("a genuinely-dead old client IS reaped (no grants, only expired/revoked tokens, no live codes)", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const dead = registerClient(db, { redirectUris: ["https://dead.example/cb"], now: oldNow });
+      const id = dead.client.clientId;
+      // An expired token + a revoked token — both dead.
+      plantToken(db, {
+        clientId: id,
+        userId: user.id,
+        jti: "jti-expired",
+        expiresAt: new Date(NOW.getTime() - DAY_MS).toISOString(),
+      });
+      plantToken(db, {
+        clientId: id,
+        userId: user.id,
+        jti: "jti-revoked",
+        expiresAt: new Date(NOW.getTime() + DAY_MS).toISOString(), // unexpired...
+        revokedAt: new Date(NOW.getTime() - DAY_MS).toISOString(), // ...but revoked → dead
+      });
+
+      const reapable = findReapableClients(db, { now });
+      expect(reapable.map((c) => c.clientId)).toEqual([id]);
+      expect(reapable[0]?.ageDays).toBe(60);
+
+      // reapClient removes the client AND its dead token rows.
+      expect(reapClient(db, id)).toBe(true);
+      expect(getClient(db, id)).toBeNull();
+      expect(db.query("SELECT jti FROM tokens WHERE client_id = ?").all(id)).toEqual([]);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("a client WITH a live grant is NEVER reaped, even when old", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const c = registerClient(db, { redirectUris: ["https://granted.example/cb"], now: oldNow });
+      recordGrant(db, user.id, c.client.clientId, ["vault:work:read"]);
+      const reapable = findReapableClients(db, { now });
+      expect(reapable.map((x) => x.clientId)).not.toContain(c.client.clientId);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("a client with a live (unexpired, unrevoked) token is NEVER reaped, even when old", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const c = registerClient(db, { redirectUris: ["https://live.example/cb"], now: oldNow });
+      plantToken(db, {
+        clientId: c.client.clientId,
+        userId: user.id,
+        jti: "jti-live",
+        expiresAt: new Date(NOW.getTime() + 7 * DAY_MS).toISOString(),
+        revokedAt: null,
+      });
+      const reapable = findReapableClients(db, { now });
+      expect(reapable.map((x) => x.clientId)).not.toContain(c.client.clientId);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("a client with an unexpired auth_code is NEVER reaped (in-flight OAuth)", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const c = registerClient(db, { redirectUris: ["https://inflight.example/cb"], now: oldNow });
+      // issueAuthCode mints a code expiring AUTH_CODE_TTL after `now` → unexpired.
+      issueAuthCode(db, {
+        clientId: c.client.clientId,
+        userId: user.id,
+        redirectUri: "https://inflight.example/cb",
+        scopes: ["vault:work:read"],
+        codeChallenge: "x".repeat(43),
+        codeChallengeMethod: "S256",
+        now,
+      });
+      const reapable = findReapableClients(db, { now });
+      expect(reapable.map((x) => x.clientId)).not.toContain(c.client.clientId);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("a freshly-registered client is NEVER reaped, even with zero grants/tokens/codes", () => {
+    const { db, cleanup } = makeDb();
+    try {
+      // Registered 5 days ago — inside the default 30d floor.
+      const fresh = registerClient(db, {
+        redirectUris: ["https://fresh.example/cb"],
+        now: () => new Date(NOW.getTime() - 5 * DAY_MS),
+      });
+      const reapable = findReapableClients(db, { now });
+      expect(reapable.map((x) => x.clientId)).not.toContain(fresh.client.clientId);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("an expired auth_code does NOT protect a client (only LIVE codes do)", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const c = registerClient(db, { redirectUris: ["https://stale.example/cb"], now: oldNow });
+      // Code issued 60d ago → long expired.
+      issueAuthCode(db, {
+        clientId: c.client.clientId,
+        userId: user.id,
+        redirectUri: "https://stale.example/cb",
+        scopes: ["vault:work:read"],
+        codeChallenge: "x".repeat(43),
+        codeChallengeMethod: "S256",
+        now: oldNow,
+      });
+      const reapable = findReapableClients(db, { now });
+      expect(reapable.map((x) => x.clientId)).toContain(c.client.clientId);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("--older-than threshold is honored (a 20d-old client falls under a 10d floor but not 30d)", () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const c = registerClient(db, {
+        redirectUris: ["https://midage.example/cb"],
+        now: () => new Date(NOW.getTime() - 20 * DAY_MS),
+      });
+      // Default 30d floor → not yet reapable.
+      expect(findReapableClients(db, { now }).map((x) => x.clientId)).not.toContain(
+        c.client.clientId,
+      );
+      // 10d floor → now reapable.
+      expect(
+        findReapableClients(db, { now, olderThanMs: 10 * DAY_MS }).map((x) => x.clientId),
+      ).toContain(c.client.clientId);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("reapClient on a still-protected client deletes nothing the gate excluded (callers pass only gated ids)", async () => {
+    // Belt-and-suspenders: reapClient itself doesn't re-check the gate (the
+    // caller is contractually responsible). This asserts the realistic flow —
+    // a live client is simply NOT in the findReapableClients output, so the
+    // apply loop never calls reapClient on it.
+    const { db, cleanup } = makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const live = registerClient(db, { redirectUris: ["https://keep.example/cb"], now: oldNow });
+      recordGrant(db, user.id, live.client.clientId, ["vault:work:read"]);
+      const dead = registerClient(db, { redirectUris: ["https://gone.example/cb"], now: oldNow });
+
+      const reapable = findReapableClients(db, { now });
+      const ids = reapable.map((x) => x.clientId);
+      expect(ids).toEqual([dead.client.clientId]);
+      for (const c of reapable) reapClient(db, c.clientId);
+
+      // Live client + its grant survive; only the dead one is gone.
+      expect(getClient(db, live.client.clientId)).not.toBeNull();
+      expect(findGrant(db, user.id, live.client.clientId)).not.toBeNull();
+      expect(getClient(db, dead.client.clientId)).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+});
+
 describe("isValidRedirectUri", () => {
   test("accepts http and https", () => {
     expect(isValidRedirectUri("http://localhost:3000/cb")).toBe(true);
@@ -352,4 +650,24 @@ describe("isValidRedirectUri", () => {
     expect(isValidRedirectUri("/relative")).toBe(false);
     expect(isValidRedirectUri("not a url")).toBe(false);
   });
+  // hub#663: spec-forbidden shapes that the protocol allowlist alone passed.
+  test("rejects userinfo-bearing redirect URIs (hub#663)", () => {
+    expect(isValidRedirectUri("https://x@evil.com/cb")).toBe(false);
+    expect(isValidRedirectUri("https://user:pass@evil.com/cb")).toBe(false);
+    expect(isValidRedirectUri("http://attacker@127.0.0.1:3000/cb")).toBe(false);
+  });
+  test("rejects control chars in the raw input (hub#663)", () => {
+    // Control chars must be caught on the RAW string — URL parsing would
+    // otherwise strip a trailing \r\n and the smuggled value would pass.
+    expect(isValidRedirectUri("https://example.com/cb\r\nSet-Cookie: x")).toBe(false);
+    expect(isValidRedirectUri("https://example.com/\x00cb")).toBe(false);
+    expect(isValidRedirectUri("https://example.com/cb\x7f")).toBe(false);
+  });
+  test("still accepts clean http(s) with ports, paths, and queries (regression guard)", () => {
+    // Legitimate clients (hub modules, self-built surfaces, Notes, Claude DCR)
+    // all register clean URIs — these must keep passing.
+    expect(isValidRedirectUri("https://claude.ai/api/mcp/auth_callback")).toBe(true);
+    expect(isValidRedirectUri("http://localhost:1939/admin/oauth/callback")).toBe(true);
+    expect(isValidRedirectUri("https://my-surface.github.io/cb?x=1")).toBe(true);
+  });
 });

package/src/__tests__/cloudflare-connector-service.test.ts

@@ -258,8 +258,10 @@ describe("installConnectorService — Linux systemd", () => {
       platform: "linux",
       getuid: () => 1000,
       userName: () => "op",
-      // enable-linger FAIL, then daemon-reload OK, enable --now OK.
+      // #528 probe: show-user → Linger=no (off, so we proceed to enable);
+      // then enable-linger FAIL, daemon-reload OK, enable --now OK.
       runResults: [
+        { code: 0, stdout: "Linger=no\n", stderr: "" },
         { code: 1, stdout: "", stderr: "Failed to enable linger" },
         { code: 0, stdout: "", stderr: "" },
         { code: 0, stdout: "", stderr: "" },

package/src/__tests__/cors.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { getClient, registerClient } from "../clients.ts";
 import {
   CORS_PREFLIGHT_HEADERS,
   CORS_RESPONSE_HEADERS,
@@ -11,7 +12,9 @@ import {
 } from "../cors.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { hubFetch } from "../hub-server.ts";
+import { signAccessToken } from "../jwt-sign.ts";
 import { writeManifest } from "../services-manifest.ts";
+import { createUser } from "../users.ts";
 
 const GITCOIN_BRAIN_ORIGIN = "https://unforced-dev.github.io";
 const EXAMPLE_ORIGIN = "https://example.com";
@@ -51,10 +54,12 @@ describe("cors helper module", () => {
     expect(CORS_RESPONSE_HEADERS["access-control-expose-headers"]).toContain("WWW-Authenticate");
   });
 
-  test("CORS_PREFLIGHT_HEADERS announces GET + POST + OPTIONS and standard request headers", () => {
+  test("CORS_PREFLIGHT_HEADERS announces GET + POST + DELETE + OPTIONS and standard request headers", () => {
     const methods = CORS_PREFLIGHT_HEADERS["access-control-allow-methods"] ?? "";
     expect(methods).toContain("GET");
     expect(methods).toContain("POST");
+    // DELETE for RFC 7592 client deregistration (hub#640).
+    expect(methods).toContain("DELETE");
     expect(methods).toContain("OPTIONS");
     const headers = CORS_PREFLIGHT_HEADERS["access-control-allow-headers"] ?? "";
     expect(headers).toContain("Authorization");
@@ -585,3 +590,135 @@ describe("hubFetch CORS scope discipline — out-of-scope routes stay same-origi
     }
   });
 });
+
+// hub#640 — confirm the TOP-LEVEL DELETE /oauth/clients/<id> route is wired
+// into the real dispatch (not just the handler in isolation). This is the
+// load-bearing "right prefix" check: the surface remove-flow fires DELETE at
+// exactly this path, and before this route the hub 404'd it. Goes through
+// hubFetch so the dispatch order + the path-prefix branch are exercised.
+describe("hub#640 DELETE /oauth/clients/<id> dispatch (RFC 7592)", () => {
+  async function operatorBearer(db: ReturnType<typeof openHubDb>): Promise<string> {
+    const user = await createUser(db, "owner", "pw");
+    const minted = await signAccessToken(db, {
+      sub: user.id,
+      scopes: ["parachute:host:admin"],
+      audience: "hub",
+      clientId: "parachute-hub-spa",
+      issuer: ISSUER,
+      ttlSeconds: 600,
+    });
+    return minted.token;
+  }
+
+  test("204 + row gone with a valid operator Bearer (the surface remove-flow path)", async () => {
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [] }, h.manifestPath);
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        const bearer = await operatorBearer(db);
+        const id = registerClient(db, {
+          redirectUris: ["https://app.example/cb"],
+          clientName: "Notes",
+        }).client.clientId;
+
+        const res = await hubFetch(h.dir, {
+          getDb: () => db,
+          issuer: ISSUER,
+          manifestPath: h.manifestPath,
+        })(
+          new Request(`${ISSUER}/oauth/clients/${encodeURIComponent(id)}`, {
+            method: "DELETE",
+            headers: { authorization: `Bearer ${bearer}` },
+          }),
+        );
+        expect(res.status).toBe(204);
+        expect(getClient(db, id)).toBeNull();
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("401 without a Bearer — the route is auth-gated, not open", async () => {
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [] }, h.manifestPath);
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        const id = registerClient(db, {
+          redirectUris: ["https://app.example/cb"],
+        }).client.clientId;
+        const res = await hubFetch(h.dir, {
+          getDb: () => db,
+          issuer: ISSUER,
+          manifestPath: h.manifestPath,
+        })(
+          new Request(`${ISSUER}/oauth/clients/${encodeURIComponent(id)}`, {
+            method: "DELETE",
+          }),
+        );
+        expect(res.status).toBe(401);
+        // Row survives an unauthenticated DELETE.
+        expect(getClient(db, id)).not.toBeNull();
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("404 for an absent client_id through dispatch (matches surface 'not_found')", async () => {
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [] }, h.manifestPath);
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        const bearer = await operatorBearer(db);
+        const res = await hubFetch(h.dir, {
+          getDb: () => db,
+          issuer: ISSUER,
+          manifestPath: h.manifestPath,
+        })(
+          new Request(`${ISSUER}/oauth/clients/no-such-client`, {
+            method: "DELETE",
+            headers: { authorization: `Bearer ${bearer}` },
+          }),
+        );
+        expect(res.status).toBe(404);
+        // The surface keys off a JSON 404 → hubDeleteStatus "not_found".
+        const body = (await res.json()) as Record<string, unknown>;
+        expect(body.error).toBe("not_found");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("OPTIONS preflight on the DELETE path advertises DELETE in Allow-Methods", async () => {
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [] }, h.manifestPath);
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        const res = await hubFetch(h.dir, {
+          getDb: () => db,
+          issuer: ISSUER,
+          manifestPath: h.manifestPath,
+        })(preflight("/oauth/clients/some-id", EXAMPLE_ORIGIN));
+        expect(res.status).toBe(204);
+        expect(res.headers.get("access-control-allow-methods")).toContain("DELETE");
+        expect(res.headers.get("access-control-allow-origin")).toBe(EXAMPLE_ORIGIN);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+});