@openparachute/hub 0.7.4-rc.8 → 0.7.4

package/src/__tests__/hub-command.test.ts

@@ -12,9 +12,9 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { hub, hubSetOrigin, rewriteCaddyfileHost } from "../commands/hub.ts";
+import { hub, hubSetOrigin, hubSetRootRedirect, rewriteCaddyfileHost } from "../commands/hub.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
-import { getHubOrigin } from "../hub-settings.ts";
+import { getHubOrigin, getRootRedirect } from "../hub-settings.ts";
 import type { CommandResult } from "../tailscale/run.ts";
 
 describe("parachute hub set-origin", () => {
@@ -431,3 +431,70 @@ describe("parachute hub set-origin — Caddy automation", () => {
     expect(log.join("\n")).toContain("already points at old.example.com");
   });
 });
+
+describe("parachute hub set-root-redirect", () => {
+  let dir: string;
+  let log: string[];
+  const collect = (line: string) => log.push(line);
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-set-root-redirect-"));
+    log = [];
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  /** Open the configDir's hub.db and read the persisted root_redirect. */
+  function persisted(): string | null {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      return getRootRedirect(db);
+    } finally {
+      db.close();
+    }
+  }
+
+  test("persists a safe same-origin path to hub_settings.root_redirect", async () => {
+    const code = await hubSetRootRedirect(["/surface/reading-room"], {
+      configDir: dir,
+      log: collect,
+    });
+    expect(code).toBe(0);
+    expect(persisted()).toBe("/surface/reading-room");
+  });
+
+  test("--clear deletes the row", async () => {
+    await hubSetRootRedirect(["/surface/x"], { configDir: dir, log: collect });
+    const code = await hubSetRootRedirect(["--clear"], { configDir: dir, log: collect });
+    expect(code).toBe(0);
+    expect(persisted()).toBeNull();
+  });
+
+  test("rejects an open-redirect path without writing", async () => {
+    for (const bad of ["//evil.com", "https://evil.com", "/\\evil.com", "/"]) {
+      const code = await hubSetRootRedirect([bad], { configDir: dir, log: collect });
+      expect(code).toBe(1);
+      expect(persisted()).toBeNull();
+    }
+  });
+
+  test("rejects a path with no leading slash without writing", async () => {
+    const code = await hubSetRootRedirect(["surface/x"], { configDir: dir, log: collect });
+    expect(code).toBe(1);
+    expect(persisted()).toBeNull();
+  });
+
+  test("usage error (exit 1) when no path + no --clear", async () => {
+    const code = await hubSetRootRedirect([], { configDir: dir, log: collect });
+    expect(code).toBe(1);
+    expect(persisted()).toBeNull();
+  });
+
+  test("routed through the `hub` dispatcher", async () => {
+    const code = await hub(["set-root-redirect", "/surface/via-dispatcher"], {
+      configDir: dir,
+      log: collect,
+    });
+    expect(code).toBe(0);
+    expect(persisted()).toBe("/surface/via-dispatcher");
+  });
+});

package/src/__tests__/hub-settings.test.ts

@@ -12,8 +12,10 @@ import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
   DEFAULT_MODULE_INSTALL_CHANNEL,
+  DEFAULT_ROOT_REDIRECT,
   FIRST_CLIENT_AUTO_APPROVE_WINDOW_MS,
   MODULE_INSTALL_CHANNELS,
+  PARACHUTE_HUB_ROOT_REDIRECT_ENV,
   PARACHUTE_INSTALL_CHANNEL_ENV,
   PARACHUTE_MODULE_CHANNEL_ENV,
   SETUP_EXPOSE_MODES,
@@ -21,15 +23,20 @@ import {
   deleteSetting,
   getHubOrigin,
   getModuleInstallChannel,
+  getRootRedirect,
   getSetting,
   isFirstClientAutoApproveWindowOpen,
   isModuleInstallChannel,
   isNotesRedirectDisabled,
+  isSafeRedirectPath,
   isSetupExposeMode,
   openFirstClientAutoApproveWindow,
+  resolveRootRedirect,
+  resolveRootRedirectDetailed,
   setHubOrigin,
   setModuleInstallChannel,
   setNotesRedirectDisabled,
+  setRootRedirect,
   setSetting,
 } from "../hub-settings.ts";
 
@@ -613,3 +620,184 @@ describe("hub-settings — notes_redirect_disabled (parachute-app §16)", () =>
     }
   });
 });
+
+describe("hub-settings — isSafeRedirectPath (open-redirect guard)", () => {
+  test("accepts plain same-origin relative paths", () => {
+    expect(isSafeRedirectPath("/admin")).toBe(true);
+    expect(isSafeRedirectPath("/surface/reading-room")).toBe(true);
+    expect(isSafeRedirectPath("/vault/default/")).toBe(true);
+    // Query + fragment stay same-origin → allowed.
+    expect(isSafeRedirectPath("/surface/x?view=reading#top")).toBe(true);
+    // Deep paths with hyphens/dots/underscores (regression: a botched
+    // whitespace regex once rejected `-`).
+    expect(isSafeRedirectPath("/a-b_c.d/e")).toBe(true);
+  });
+
+  test("rejects protocol-relative + backslash authority tricks", () => {
+    expect(isSafeRedirectPath("//evil.com")).toBe(false);
+    expect(isSafeRedirectPath("//evil.com/path")).toBe(false);
+    expect(isSafeRedirectPath("/\\evil.com")).toBe(false);
+    expect(isSafeRedirectPath("/\\\\evil.com")).toBe(false);
+  });
+
+  test("rejects absolute URLs + scheme payloads", () => {
+    expect(isSafeRedirectPath("https://evil.com")).toBe(false);
+    expect(isSafeRedirectPath("http://evil.com/x")).toBe(false);
+    // biome-ignore lint/suspicious/noExplicitAny: testing the runtime guard with a hostile string
+    expect(isSafeRedirectPath("javascript:alert(1)" as any)).toBe(false);
+    expect(isSafeRedirectPath("data:text/html,<script>1</script>")).toBe(false);
+  });
+
+  test("rejects values missing a leading slash", () => {
+    expect(isSafeRedirectPath("admin")).toBe(false);
+    expect(isSafeRedirectPath("evil.com")).toBe(false);
+    expect(isSafeRedirectPath("")).toBe(false);
+  });
+
+  test("rejects pathname-`/` targets (would 302-loop the bare-`/` route)", () => {
+    expect(isSafeRedirectPath("/")).toBe(false);
+    expect(isSafeRedirectPath("/?next=x")).toBe(false);
+    expect(isSafeRedirectPath("/#frag")).toBe(false);
+  });
+
+  test("rejects whitespace + control chars (header-injection / normalization)", () => {
+    expect(isSafeRedirectPath("/admin\r\nSet-Cookie: x=1")).toBe(false);
+    expect(isSafeRedirectPath("/ad min")).toBe(false);
+    expect(isSafeRedirectPath("/admin\t")).toBe(false);
+    expect(isSafeRedirectPath("/\tadmin")).toBe(false);
+    expect(isSafeRedirectPath("/admin ")).toBe(false);
+    // U+2028 line separator (stripped by some parsers) — built via charCode so
+    // the source file carries no irregular-whitespace literal.
+    expect(isSafeRedirectPath(`/admin${String.fromCharCode(0x2028)}x`)).toBe(false);
+  });
+
+  test("rejects non-string inputs", () => {
+    // biome-ignore lint/suspicious/noExplicitAny: exercising the runtime type guard
+    expect(isSafeRedirectPath(null as any)).toBe(false);
+    // biome-ignore lint/suspicious/noExplicitAny: exercising the runtime type guard
+    expect(isSafeRedirectPath(undefined as any)).toBe(false);
+    // biome-ignore lint/suspicious/noExplicitAny: exercising the runtime type guard
+    expect(isSafeRedirectPath(42 as any)).toBe(false);
+    // biome-ignore lint/suspicious/noExplicitAny: exercising the runtime type guard
+    expect(isSafeRedirectPath({} as any)).toBe(false);
+  });
+});
+
+describe("hub-settings — root_redirect storage + resolution", () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-settings-root-redirect-"));
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  // An empty env so the resolver's env layer is deterministic (the host's real
+  // PARACHUTE_HUB_ROOT_REDIRECT, if any, must not leak in).
+  const noEnv: NodeJS.ProcessEnv = {};
+  const silent = () => {};
+
+  test("getRootRedirect round-trips via setRootRedirect", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      expect(getRootRedirect(db)).toBeNull();
+      setRootRedirect(db, "/surface/reading-room");
+      expect(getRootRedirect(db)).toBe("/surface/reading-room");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("setRootRedirect(null) / empty clears the row", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setRootRedirect(db, "/surface/x");
+      setRootRedirect(db, null);
+      expect(getRootRedirect(db)).toBeNull();
+      setRootRedirect(db, "/surface/x");
+      setRootRedirect(db, "");
+      expect(getRootRedirect(db)).toBeNull();
+    } finally {
+      db.close();
+    }
+  });
+
+  test("resolves to /admin default when neither DB nor env is set", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      expect(resolveRootRedirect(db, { env: noEnv })).toBe(DEFAULT_ROOT_REDIRECT);
+      expect(resolveRootRedirectDetailed(db, { env: noEnv })).toEqual({
+        value: "/admin",
+        source: "default",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("env override applies when no DB row", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "/surface/from-env" };
+      expect(resolveRootRedirectDetailed(db, { env })).toEqual({
+        value: "/surface/from-env",
+        source: "env",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("DB row overrides env (DB is tier-1)", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setRootRedirect(db, "/surface/from-db");
+      const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "/surface/from-env" };
+      expect(resolveRootRedirectDetailed(db, { env })).toEqual({
+        value: "/surface/from-db",
+        source: "db",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("an unsafe DB row is ignored → falls through to env", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      // Simulate a hand-edited sqlite row that bypassed write-side validation.
+      setSetting(db, "root_redirect", "//evil.com");
+      const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "/surface/from-env" };
+      expect(resolveRootRedirect(db, { env, warn: silent })).toBe("/surface/from-env");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("an unsafe DB row with no env → falls all the way back to /admin", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setSetting(db, "root_redirect", "https://evil.com");
+      expect(resolveRootRedirect(db, { env: noEnv, warn: silent })).toBe("/admin");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("an unsafe env value is ignored → falls back to /admin", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "//evil.com" };
+      expect(resolveRootRedirectDetailed(db, { env, warn: silent })).toEqual({
+        value: "/admin",
+        source: "default",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("a null db (no state) resolves from env / default only", () => {
+    expect(resolveRootRedirect(null, { env: noEnv })).toBe("/admin");
+    const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "/surface/from-env" };
+    expect(resolveRootRedirect(null, { env })).toBe("/surface/from-env");
+  });
+});

package/src/__tests__/jwt-sign.test.ts

@@ -370,6 +370,33 @@ describe("validateAccessToken", () => {
     }
   });
 
+  test("expectedIssuer accepts a SET — iss in the set validates, outside rejects", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const { token } = await signAccessToken(db, {
+        sub: "u",
+        scopes: ["s"],
+        audience: "operator",
+        clientId: "c",
+        issuer: "https://tunnel.example",
+      });
+      // In-set (≠ first element) validates — additive membership on iss.
+      const { payload } = await validateAccessToken(db, token, [
+        "http://127.0.0.1:1939",
+        "https://tunnel.example",
+      ]);
+      expect(payload.iss).toBe("https://tunnel.example");
+      // Outside the set rejects.
+      await expect(
+        validateAccessToken(db, token, ["http://127.0.0.1:1939", "https://other.example"]),
+      ).rejects.toThrow();
+      // A single-element set that doesn't match also rejects (no widening).
+      await expect(validateAccessToken(db, token, ["http://127.0.0.1:1939"])).rejects.toThrow();
+    } finally {
+      cleanup();
+    }
+  });
+
   test("verifies a token signed by a recently-retired key (rotation tolerance)", async () => {
     const { db, cleanup } = makeDb();
     try {