@openparachute/hub 0.7.4-rc.8 → 0.7.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.4-rc.8",
+  "version": "0.7.4",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/admin-auth.test.ts

@@ -172,6 +172,134 @@ describe("requireScope", () => {
   });
 });
 
+describe("requireScope multi-origin issuer set (hub#516 parity)", () => {
+  // The hub answers on several legitimate origins after `parachute hub
+  // set-origin` / `expose` (loopback ∪ tunnel ∪ public). A credential minted
+  // under a still-valid prior origin must keep validating at admin-auth even
+  // when the per-request canonical issuer is now a different member of the set.
+  const LOOPBACK = "http://127.0.0.1:1939";
+  const TUNNEL = "https://brain.gitcoin.co";
+  const FOREIGN = "https://evil.example.com";
+
+  test("accepts a token whose iss is in the set but ≠ the per-request canonical", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        // Token minted under the TUNNEL origin (e.g. before `set-origin`)…
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: TUNNEL });
+        // …presented to admin-auth where the canonical per-request issuer is now
+        // LOOPBACK, but the bound-origin set still includes TUNNEL.
+        const ctx = await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+          LOOPBACK,
+          TUNNEL,
+        ]);
+        expect(ctx.sub).toBe("user-test");
+        expect(ctx.scopes).toContain("parachute:host:admin");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("rejects 401 when iss is OUTSIDE the set", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: FOREIGN });
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+            LOOPBACK,
+            TUNNEL,
+          ]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("rejects 401 on signature failure regardless of the set (signature-first)", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        // A hub-signed token, then rotate keys + retire so the original kid no
+        // longer verifies — the JWKS signature gate must fire before any iss
+        // membership check, so an in-set iss can't rescue an unverifiable token.
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth("Bearer not-a-real-jwt"), "parachute:host:admin", [
+            LOOPBACK,
+            TUNNEL,
+          ]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("single-string back-compat: in-set iss as a lone string still validates", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: ISSUER });
+        // A single-element set behaves exactly like the prior single-string form.
+        const ctx = await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+          ISSUER,
+        ]);
+        expect(ctx.sub).toBe("user-test");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("single-element set rejects a non-matching iss (no accidental widening)", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: TUNNEL });
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [ISSUER]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
 describe("adminAuthErrorResponse", () => {
   test("403 → insufficient_scope with WWW-Authenticate", async () => {
     const res = adminAuthErrorResponse(new AdminAuthError(403, "needs admin"));

package/src/__tests__/admin-clients.test.ts

@@ -12,8 +12,9 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { handleApproveClient, handleGetClient } from "../admin-clients.ts";
+import { handleApproveClient, handleDeleteClient, handleGetClient } from "../admin-clients.ts";
 import { approveClient, getClient, registerClient } from "../clients.ts";
+import { findGrant, recordGrant } from "../grants.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { signAccessToken } from "../jwt-sign.ts";
 import { createUser } from "../users.ts";
@@ -83,6 +84,23 @@ function approveReq(clientId: string, bearer?: string, method = "POST"): Request
   return new Request(`${ISSUER}/api/oauth/clients/${encodeURIComponent(clientId)}/approve`, init);
 }
 
+// DELETE hits the TOP-LEVEL /oauth/clients/<id> prefix (the path the surface
+// remove-flow calls), not the /api/... admin prefix the GET/approve use.
+function deleteReq(clientId: string, bearer?: string, method = "DELETE"): Request {
+  const init: RequestInit = { method };
+  if (bearer) init.headers = { authorization: `Bearer ${bearer}` };
+  return new Request(`${ISSUER}/oauth/clients/${encodeURIComponent(clientId)}`, init);
+}
+
+function regApproved(name?: string): string {
+  const r = registerClient(harness.db, {
+    redirectUris: ["https://app.example/cb"],
+    scopes: ["vault:work:read"],
+    ...(name !== undefined ? { clientName: name } : {}),
+  });
+  return r.client.clientId;
+}
+
 describe("handleGetClient", () => {
   test("401 without Bearer", async () => {
     const id = regPending("App");
@@ -460,3 +478,87 @@ describe("handleApproveClient", () => {
     });
   });
 });
+
+// hub#640 — RFC 7592 client deregistration. The surface fires DELETE on the
+// top-level /oauth/clients/<id> path; the handler is operator-bearer-gated,
+// returns 204 on delete (cascading grants + auth_codes), 404 when absent.
+describe("handleDeleteClient", () => {
+  test("401 without Bearer (row survives)", async () => {
+    const id = regApproved("App");
+    const res = await handleDeleteClient(deleteReq(id), id, {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(401);
+    expect(getClient(harness.db, id)).not.toBeNull();
+  });
+
+  test("403 with the wrong scope (row survives)", async () => {
+    const { bearer } = await makeOperatorBearer(["parachute:host:auth"]);
+    const id = regApproved("App");
+    const res = await handleDeleteClient(deleteReq(id, bearer), id, {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(403);
+    expect(getClient(harness.db, id)).not.toBeNull();
+  });
+
+  test("204 on an existing client + cascade gone + audit line", async () => {
+    const { bearer, userId } = await makeOperatorBearer();
+    const id = regApproved("Notes");
+    // Plant a grant so the cascade has something to remove.
+    recordGrant(harness.db, userId, id, ["vault:work:read"]);
+    expect(findGrant(harness.db, userId, id)).not.toBeNull();
+
+    const logs: string[] = [];
+    const originalLog = console.log;
+    console.log = (...args: unknown[]) => {
+      logs.push(args.map(String).join(" "));
+    };
+    let res: Response;
+    try {
+      res = await handleDeleteClient(deleteReq(id, bearer), id, {
+        db: harness.db,
+        issuer: ISSUER,
+      });
+    } finally {
+      console.log = originalLog;
+    }
+    expect(res.status).toBe(204);
+    // 204 carries no body.
+    expect(await res.text()).toBe("");
+    // Client + its grant are gone.
+    expect(getClient(harness.db, id)).toBeNull();
+    expect(findGrant(harness.db, userId, id)).toBeNull();
+
+    const line = logs.find((l) => l.startsWith("client deleted:"));
+    expect(line).toBeDefined();
+    expect(line).toContain(`client_id=${id}`);
+    expect(line).toContain("client_name=Notes");
+    expect(line).toContain(`remover_sub=${userId}`);
+  });
+
+  test("404 on an absent client_id", async () => {
+    const { bearer } = await makeOperatorBearer();
+    const res = await handleDeleteClient(deleteReq("nope", bearer), "nope", {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.error).toBe("not_found");
+  });
+
+  test("405 on a non-DELETE method", async () => {
+    const { bearer } = await makeOperatorBearer();
+    const id = regApproved();
+    const res = await handleDeleteClient(deleteReq(id, bearer, "GET"), id, {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(405);
+    // Row untouched.
+    expect(getClient(harness.db, id)).not.toBeNull();
+  });
+});

package/src/__tests__/admin-handlers.test.ts

@@ -8,6 +8,7 @@ import {
   handleAdminLoginPost,
   handleAdminLogoutPost,
 } from "../admin-handlers.ts";
+import { _resetUnlockStateForTest, requireUnlocked, setPin } from "../admin-lock.ts";
 import { CSRF_COOKIE_NAME, CSRF_FIELD_NAME } from "../csrf.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { __resetForTests as resetRateLimit } from "../rate-limit.ts";
@@ -169,6 +170,33 @@ describe("handleAdminLoginPost", () => {
     expect(res.headers.get("set-cookie") ?? "").toContain("parachute_hub_session=");
   });
 
+  test("Fix B: a fresh login with a PIN configured records an unlock (no immediate lock)", async () => {
+    // The admin-lock PIN guards the idle/grabbed tab — NOT the instant after a
+    // full login. The operator just proved their password; re-gating on the PIN
+    // the moment after is pure friction. A freshly-minted session must land
+    // within an unlock window so the SPA doesn't show the lock screen.
+    _resetUnlockStateForTest();
+    await createUser(harness.db, "admin", "pw", { passwordChanged: true });
+    await setPin(harness.db, "4827"); // lock feature ON
+    const { body, headers } = formBody({
+      [CSRF_FIELD_NAME]: TEST_CSRF,
+      username: "admin",
+      password: "pw",
+      next: "/admin/permissions",
+    });
+    const req = new Request("http://hub.test/admin/login", {
+      method: "POST",
+      headers: { ...headers, cookie: CSRF_COOKIE },
+      body,
+    });
+    const res = await handleAdminLoginPost(harness.db, req);
+    expect(res.status).toBe(302);
+    const sid = (res.headers.get("set-cookie") ?? "").match(/parachute_hub_session=([^;]+)/)?.[1];
+    expect(sid?.length).toBeTruthy();
+    // The just-minted session is unlocked — recordLoginUnlock ran during login.
+    expect(requireUnlocked(harness.db, sid ?? "").ok).toBe(true);
+  });
+
   test("ignores an absolute-URL next= from the form", async () => {
     await createUser(harness.db, "admin", "pw", { passwordChanged: true });
     const { body, headers } = formBody({

package/src/__tests__/admin-host-admin-token.test.ts

@@ -18,7 +18,13 @@ import { HOST_ADMIN_TOKEN_TTL_SECONDS, handleHostAdminToken } from "../admin-hos
 import { handleApiTokens } from "../api-tokens.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { validateAccessToken } from "../jwt-sign.ts";
-import { SESSION_TTL_MS, buildSessionCookie, createSession, deleteSession } from "../sessions.ts";
+import {
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  createSession,
+  deleteSession,
+  findSession,
+} from "../sessions.ts";
 import { rotateSigningKey } from "../signing-keys.ts";
 import { createUser } from "../users.ts";
 
@@ -186,6 +192,57 @@ describe("handleHostAdminToken", () => {
     expect(validated.payload.sub).toBe(adminId);
   });
 
+  // Sliding session renewal (Fix A) — a successful mint pushes the session's
+  // expiry forward and re-issues the cookie, so an active operator (the SPA
+  // re-mints ~every 10 min) isn't hard-logged-out at the 24h mark. The cookie
+  // must keep the EXACT attributes creation uses — not broadened.
+  test("200 renews the session cookie (HttpOnly/Secure/SameSite/host-only) and slides expiry", async () => {
+    const user = await createUser(harness.db, "operator", "hunter2");
+    // Create the session 12h in the past so the forward slide is observable.
+    const twelveHoursAgo = new Date(Date.now() - 12 * 60 * 60 * 1000);
+    const session = createSession(harness.db, { userId: user.id, now: () => twelveHoursAgo });
+    const originalExpiry = new Date(session.expiresAt).getTime();
+    const cookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000));
+    rotateSigningKey(harness.db);
+
+    const res = await handleHostAdminToken(
+      new Request(`${ISSUER}/admin/host-admin-token`, { headers: { cookie } }),
+      { db: harness.db, issuer: ISSUER },
+    );
+    expect(res.status).toBe(200);
+
+    const setCookie = res.headers.get("set-cookie") ?? "";
+    expect(setCookie).toContain("parachute_hub_session=");
+    expect(setCookie).toContain("HttpOnly");
+    expect(setCookie).toContain("Secure"); // ISSUER is https → Secure kept
+    expect(setCookie).toContain("SameSite=Lax");
+    expect(setCookie).toContain("Path=/");
+    expect(setCookie).not.toContain("Path=/oauth");
+    // Host-only: the renewed cookie must NOT add a Domain (no broadening).
+    expect(setCookie.toLowerCase()).not.toContain("domain=");
+
+    // The session's expiry slid forward (touchSession ran on the success path).
+    const found = findSession(harness.db, session.id);
+    expect(new Date(found?.expiresAt ?? 0).getTime()).toBeGreaterThan(originalExpiry);
+  });
+
+  test("renewed cookie omits Secure over plain HTTP (protocol-correct, not broadened)", async () => {
+    const { cookie } = await withSession();
+    rotateSigningKey(harness.db);
+    // HTTP origin → isHttpsRequest false → no Secure, so the browser keeps the
+    // cookie on http://localhost:1939 — mirrors how the session cookie is minted.
+    const res = await handleHostAdminToken(
+      new Request("http://hub.test/admin/host-admin-token", { headers: { cookie } }),
+      { db: harness.db, issuer: ISSUER },
+    );
+    expect(res.status).toBe(200);
+    const setCookie = res.headers.get("set-cookie") ?? "";
+    expect(setCookie).toContain("parachute_hub_session=");
+    expect(setCookie).not.toContain("Secure");
+    expect(setCookie).toContain("HttpOnly");
+    expect(setCookie).toContain("SameSite=Lax");
+  });
+
   // Regression for the end-to-end bug that motivated adding `:host:auth`
   // here: the SPA's session-bearer was rejected by `/api/auth/tokens` (and
   // its peers) because it carried `:host:admin` only. This test mints

package/src/__tests__/admin-lock.test.ts

@@ -30,6 +30,7 @@ import {
   getIdleSeconds,
   isLockConfigured,
   isSessionUnlocked,
+  recordLoginUnlock,
   recordUnlock,
   refreshActivity,
   requireUnlocked,
@@ -212,6 +213,31 @@ describe("requireUnlocked gate", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// recordLoginUnlock (Fix B) — unlock at the auth boundary so a fresh login
+// doesn't immediately hit the PIN lock screen.
+// ---------------------------------------------------------------------------
+
+describe("recordLoginUnlock", () => {
+  test("opens an unlock window when a PIN is configured", async () => {
+    await setPin(harness.db, "4827");
+    // A fresh session with a PIN set but no unlock is locked.
+    expect(requireUnlocked(harness.db, "sid-login").ok).toBe(false);
+    recordLoginUnlock(harness.db, "sid-login");
+    // After login → the freshly-authenticated session is unlocked.
+    expect(requireUnlocked(harness.db, "sid-login").ok).toBe(true);
+    expect(isSessionUnlocked("sid-login")).toBe(true);
+  });
+
+  test("no-op when the lock feature is OFF (no PIN) — records nothing", () => {
+    // Feature off → requireUnlocked is always ok anyway; the helper must not
+    // record a spurious window (meaningless, and would grow the map).
+    recordLoginUnlock(harness.db, "sid-no-pin");
+    expect(isSessionUnlocked("sid-no-pin")).toBe(false);
+    expect(requireUnlocked(harness.db, "sid-no-pin").ok).toBe(true);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // The cascade: a locked session refuses ALL four admin-token mints.
 // ---------------------------------------------------------------------------
@@ -527,7 +553,13 @@ describe("admin-lock management API", () => {
     const r2 = await handleAdminLock(lockReq("/heartbeat", cookie, {}), "/heartbeat", {
       db: harness.db,
     });
-    expect(((await r2.json()) as { locked: boolean }).locked).toBe(false);
+    const body2 = (await r2.json()) as { locked: boolean; idle_seconds?: number };
+    expect(body2.locked).toBe(false);
+    // The heartbeat MUST carry idle_seconds — the client re-anchors its local
+    // idle timer from it on every heartbeat. Omitting it poisoned the timer
+    // (undefined → NaN → instant re-lock). Regression guard for the PIN
+    // re-prompt loop.
+    expect(body2.idle_seconds).toBe(getIdleSeconds(harness.db));
   });
 
   test("unlock brute-force limiter: 6th attempt is 429", async () => {

package/src/__tests__/admin-vaults.test.ts

@@ -940,27 +940,70 @@ describe("DELETE /vaults/<name> — gates", () => {
     }
   });
 
-  test("409 last_vault on the only remaining vault (CLI never runs)", async () => {
+  test("#678: deleting the LAST vault cascades + deletes (no 409), with a last_vault warning", async () => {
     const h = makeHarness();
     try {
       const db = openHubDb(hubDbPath(h.dir));
       try {
         rotateSigningKey(db);
-        writeVaults(h.manifestPath, ["default"]);
+        // Only one vault on the hub — the previously-refused last-vault case.
+        writeVaults(h.manifestPath, ["solo"]);
+
+        // Seed identity artifacts naming the soon-to-be-deleted last vault.
+        registryRow(db, "jti-solo", ["vault:solo:write"]);
+        const carol = await createUser(db, "carol", "carol-passphrase-123");
+        const client = registerClient(db, { redirectUris: ["https://d.example/cb"] }).client
+          .clientId;
+        recordGrant(db, carol.id, client, ["vault:solo:admin"]);
+        setUserVaults(db, carol.id, ["solo"]);
+
         const runner = stubRun();
         const res = await callDelete({
-          name: "default",
+          name: "solo",
           db,
           manifestPath: h.manifestPath,
           connectionsStorePath: join(h.dir, "connections.json"),
           runCommand: runner.run,
         });
-        expect(res.status).toBe(409);
-        const out = (await res.json()) as { error: string; error_description: string };
-        expect(out.error).toBe("last_vault");
-        // Guidance names the CLI escape hatch + the resurrection reason.
-        expect(out.error_description).toContain("parachute-vault remove");
-        expect(runner.calls.length).toBe(0);
+
+        // No 409 — the delete completes.
+        expect(res.status).toBe(200);
+        const out = (await res.json()) as {
+          ok: boolean;
+          cascade: {
+            tokens_revoked: number;
+            grants_dropped: number;
+            user_vaults_removed: number;
+            vault_removed: boolean;
+          };
+          warnings?: { step: string; detail: string }[];
+        };
+        expect(out.ok).toBe(true);
+
+        // The cascade ran for the last vault: tokens/grants/assignments gone.
+        expect(out.cascade.tokens_revoked).toBe(1);
+        expect(findTokenRowByJti(db, "jti-solo")?.revokedAt).not.toBeNull();
+        expect(out.cascade.grants_dropped).toBe(1);
+        expect(findGrant(db, carol.id, client)).toBeNull();
+        expect(out.cascade.user_vaults_removed).toBe(1);
+        expect(
+          db
+            .query<{ vault_name: string }, [string]>(
+              "SELECT vault_name FROM user_vaults WHERE user_id = ?",
+            )
+            .all(carol.id),
+        ).toEqual([]);
+
+        // The underlying vault remove ran (the cascade no longer skips it).
+        expect(runner.calls).toContainEqual(["parachute-vault", "remove", "solo", "--yes"]);
+        expect(out.cascade.vault_removed).toBe(true);
+
+        // A last_vault heads-up warning is surfaced (name-agnostic — does not
+        // assume "default"); the auto_create:false marker prevents resurrection.
+        const lastVaultWarning = out.warnings?.find((w) => w.step === "last_vault");
+        expect(lastVaultWarning).toBeDefined();
+        expect(lastVaultWarning?.detail).toContain("auto_create: false");
+        expect(lastVaultWarning?.detail).not.toContain('"default"');
       } finally {
         db.close();
       }