@openparachute/hub 0.7.4-rc.9 → 0.7.4

package/src/__tests__/hub-command.test.ts

@@ -12,9 +12,9 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { hub, hubSetOrigin, rewriteCaddyfileHost } from "../commands/hub.ts";
+import { hub, hubSetOrigin, hubSetRootRedirect, rewriteCaddyfileHost } from "../commands/hub.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
-import { getHubOrigin } from "../hub-settings.ts";
+import { getHubOrigin, getRootRedirect } from "../hub-settings.ts";
 import type { CommandResult } from "../tailscale/run.ts";
 
 describe("parachute hub set-origin", () => {
@@ -431,3 +431,70 @@ describe("parachute hub set-origin — Caddy automation", () => {
     expect(log.join("\n")).toContain("already points at old.example.com");
   });
 });
+
+describe("parachute hub set-root-redirect", () => {
+  let dir: string;
+  let log: string[];
+  const collect = (line: string) => log.push(line);
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-set-root-redirect-"));
+    log = [];
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  /** Open the configDir's hub.db and read the persisted root_redirect. */
+  function persisted(): string | null {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      return getRootRedirect(db);
+    } finally {
+      db.close();
+    }
+  }
+
+  test("persists a safe same-origin path to hub_settings.root_redirect", async () => {
+    const code = await hubSetRootRedirect(["/surface/reading-room"], {
+      configDir: dir,
+      log: collect,
+    });
+    expect(code).toBe(0);
+    expect(persisted()).toBe("/surface/reading-room");
+  });
+
+  test("--clear deletes the row", async () => {
+    await hubSetRootRedirect(["/surface/x"], { configDir: dir, log: collect });
+    const code = await hubSetRootRedirect(["--clear"], { configDir: dir, log: collect });
+    expect(code).toBe(0);
+    expect(persisted()).toBeNull();
+  });
+
+  test("rejects an open-redirect path without writing", async () => {
+    for (const bad of ["//evil.com", "https://evil.com", "/\\evil.com", "/"]) {
+      const code = await hubSetRootRedirect([bad], { configDir: dir, log: collect });
+      expect(code).toBe(1);
+      expect(persisted()).toBeNull();
+    }
+  });
+
+  test("rejects a path with no leading slash without writing", async () => {
+    const code = await hubSetRootRedirect(["surface/x"], { configDir: dir, log: collect });
+    expect(code).toBe(1);
+    expect(persisted()).toBeNull();
+  });
+
+  test("usage error (exit 1) when no path + no --clear", async () => {
+    const code = await hubSetRootRedirect([], { configDir: dir, log: collect });
+    expect(code).toBe(1);
+    expect(persisted()).toBeNull();
+  });
+
+  test("routed through the `hub` dispatcher", async () => {
+    const code = await hub(["set-root-redirect", "/surface/via-dispatcher"], {
+      configDir: dir,
+      log: collect,
+    });
+    expect(code).toBe(0);
+    expect(persisted()).toBe("/surface/via-dispatcher");
+  });
+});

package/src/__tests__/hub-settings.test.ts

@@ -12,8 +12,10 @@ import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
   DEFAULT_MODULE_INSTALL_CHANNEL,
+  DEFAULT_ROOT_REDIRECT,
   FIRST_CLIENT_AUTO_APPROVE_WINDOW_MS,
   MODULE_INSTALL_CHANNELS,
+  PARACHUTE_HUB_ROOT_REDIRECT_ENV,
   PARACHUTE_INSTALL_CHANNEL_ENV,
   PARACHUTE_MODULE_CHANNEL_ENV,
   SETUP_EXPOSE_MODES,
@@ -21,15 +23,20 @@ import {
   deleteSetting,
   getHubOrigin,
   getModuleInstallChannel,
+  getRootRedirect,
   getSetting,
   isFirstClientAutoApproveWindowOpen,
   isModuleInstallChannel,
   isNotesRedirectDisabled,
+  isSafeRedirectPath,
   isSetupExposeMode,
   openFirstClientAutoApproveWindow,
+  resolveRootRedirect,
+  resolveRootRedirectDetailed,
   setHubOrigin,
   setModuleInstallChannel,
   setNotesRedirectDisabled,
+  setRootRedirect,
   setSetting,
 } from "../hub-settings.ts";
 
@@ -613,3 +620,184 @@ describe("hub-settings — notes_redirect_disabled (parachute-app §16)", () =>
     }
   });
 });
+
+describe("hub-settings — isSafeRedirectPath (open-redirect guard)", () => {
+  test("accepts plain same-origin relative paths", () => {
+    expect(isSafeRedirectPath("/admin")).toBe(true);
+    expect(isSafeRedirectPath("/surface/reading-room")).toBe(true);
+    expect(isSafeRedirectPath("/vault/default/")).toBe(true);
+    // Query + fragment stay same-origin → allowed.
+    expect(isSafeRedirectPath("/surface/x?view=reading#top")).toBe(true);
+    // Deep paths with hyphens/dots/underscores (regression: a botched
+    // whitespace regex once rejected `-`).
+    expect(isSafeRedirectPath("/a-b_c.d/e")).toBe(true);
+  });
+
+  test("rejects protocol-relative + backslash authority tricks", () => {
+    expect(isSafeRedirectPath("//evil.com")).toBe(false);
+    expect(isSafeRedirectPath("//evil.com/path")).toBe(false);
+    expect(isSafeRedirectPath("/\\evil.com")).toBe(false);
+    expect(isSafeRedirectPath("/\\\\evil.com")).toBe(false);
+  });
+
+  test("rejects absolute URLs + scheme payloads", () => {
+    expect(isSafeRedirectPath("https://evil.com")).toBe(false);
+    expect(isSafeRedirectPath("http://evil.com/x")).toBe(false);
+    // biome-ignore lint/suspicious/noExplicitAny: testing the runtime guard with a hostile string
+    expect(isSafeRedirectPath("javascript:alert(1)" as any)).toBe(false);
+    expect(isSafeRedirectPath("data:text/html,<script>1</script>")).toBe(false);
+  });
+
+  test("rejects values missing a leading slash", () => {
+    expect(isSafeRedirectPath("admin")).toBe(false);
+    expect(isSafeRedirectPath("evil.com")).toBe(false);
+    expect(isSafeRedirectPath("")).toBe(false);
+  });
+
+  test("rejects pathname-`/` targets (would 302-loop the bare-`/` route)", () => {
+    expect(isSafeRedirectPath("/")).toBe(false);
+    expect(isSafeRedirectPath("/?next=x")).toBe(false);
+    expect(isSafeRedirectPath("/#frag")).toBe(false);
+  });
+
+  test("rejects whitespace + control chars (header-injection / normalization)", () => {
+    expect(isSafeRedirectPath("/admin\r\nSet-Cookie: x=1")).toBe(false);
+    expect(isSafeRedirectPath("/ad min")).toBe(false);
+    expect(isSafeRedirectPath("/admin\t")).toBe(false);
+    expect(isSafeRedirectPath("/\tadmin")).toBe(false);
+    expect(isSafeRedirectPath("/admin ")).toBe(false);
+    // U+2028 line separator (stripped by some parsers) — built via charCode so
+    // the source file carries no irregular-whitespace literal.
+    expect(isSafeRedirectPath(`/admin${String.fromCharCode(0x2028)}x`)).toBe(false);
+  });
+
+  test("rejects non-string inputs", () => {
+    // biome-ignore lint/suspicious/noExplicitAny: exercising the runtime type guard
+    expect(isSafeRedirectPath(null as any)).toBe(false);
+    // biome-ignore lint/suspicious/noExplicitAny: exercising the runtime type guard
+    expect(isSafeRedirectPath(undefined as any)).toBe(false);
+    // biome-ignore lint/suspicious/noExplicitAny: exercising the runtime type guard
+    expect(isSafeRedirectPath(42 as any)).toBe(false);
+    // biome-ignore lint/suspicious/noExplicitAny: exercising the runtime type guard
+    expect(isSafeRedirectPath({} as any)).toBe(false);
+  });
+});
+
+describe("hub-settings — root_redirect storage + resolution", () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-settings-root-redirect-"));
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  // An empty env so the resolver's env layer is deterministic (the host's real
+  // PARACHUTE_HUB_ROOT_REDIRECT, if any, must not leak in).
+  const noEnv: NodeJS.ProcessEnv = {};
+  const silent = () => {};
+
+  test("getRootRedirect round-trips via setRootRedirect", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      expect(getRootRedirect(db)).toBeNull();
+      setRootRedirect(db, "/surface/reading-room");
+      expect(getRootRedirect(db)).toBe("/surface/reading-room");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("setRootRedirect(null) / empty clears the row", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setRootRedirect(db, "/surface/x");
+      setRootRedirect(db, null);
+      expect(getRootRedirect(db)).toBeNull();
+      setRootRedirect(db, "/surface/x");
+      setRootRedirect(db, "");
+      expect(getRootRedirect(db)).toBeNull();
+    } finally {
+      db.close();
+    }
+  });
+
+  test("resolves to /admin default when neither DB nor env is set", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      expect(resolveRootRedirect(db, { env: noEnv })).toBe(DEFAULT_ROOT_REDIRECT);
+      expect(resolveRootRedirectDetailed(db, { env: noEnv })).toEqual({
+        value: "/admin",
+        source: "default",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("env override applies when no DB row", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "/surface/from-env" };
+      expect(resolveRootRedirectDetailed(db, { env })).toEqual({
+        value: "/surface/from-env",
+        source: "env",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("DB row overrides env (DB is tier-1)", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setRootRedirect(db, "/surface/from-db");
+      const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "/surface/from-env" };
+      expect(resolveRootRedirectDetailed(db, { env })).toEqual({
+        value: "/surface/from-db",
+        source: "db",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("an unsafe DB row is ignored → falls through to env", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      // Simulate a hand-edited sqlite row that bypassed write-side validation.
+      setSetting(db, "root_redirect", "//evil.com");
+      const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "/surface/from-env" };
+      expect(resolveRootRedirect(db, { env, warn: silent })).toBe("/surface/from-env");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("an unsafe DB row with no env → falls all the way back to /admin", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setSetting(db, "root_redirect", "https://evil.com");
+      expect(resolveRootRedirect(db, { env: noEnv, warn: silent })).toBe("/admin");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("an unsafe env value is ignored → falls back to /admin", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "//evil.com" };
+      expect(resolveRootRedirectDetailed(db, { env, warn: silent })).toEqual({
+        value: "/admin",
+        source: "default",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("a null db (no state) resolves from env / default only", () => {
+    expect(resolveRootRedirect(null, { env: noEnv })).toBe("/admin");
+    const env = { [PARACHUTE_HUB_ROOT_REDIRECT_ENV]: "/surface/from-env" };
+    expect(resolveRootRedirect(null, { env })).toBe("/surface/from-env");
+  });
+});

package/src/__tests__/jwt-sign.test.ts

@@ -370,6 +370,33 @@ describe("validateAccessToken", () => {
     }
   });
 
+  test("expectedIssuer accepts a SET — iss in the set validates, outside rejects", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const { token } = await signAccessToken(db, {
+        sub: "u",
+        scopes: ["s"],
+        audience: "operator",
+        clientId: "c",
+        issuer: "https://tunnel.example",
+      });
+      // In-set (≠ first element) validates — additive membership on iss.
+      const { payload } = await validateAccessToken(db, token, [
+        "http://127.0.0.1:1939",
+        "https://tunnel.example",
+      ]);
+      expect(payload.iss).toBe("https://tunnel.example");
+      // Outside the set rejects.
+      await expect(
+        validateAccessToken(db, token, ["http://127.0.0.1:1939", "https://other.example"]),
+      ).rejects.toThrow();
+      // A single-element set that doesn't match also rejects (no widening).
+      await expect(validateAccessToken(db, token, ["http://127.0.0.1:1939"])).rejects.toThrow();
+    } finally {
+      cleanup();
+    }
+  });
+
   test("verifies a token signed by a recently-retired key (rotation tolerance)", async () => {
     const { db, cleanup } = makeDb();
     try {

package/src/__tests__/oauth-handlers.test.ts

@@ -119,7 +119,9 @@ describe("authorizationServerMetadata", () => {
     expect(scopesSupported).toContain("vault:read");
     expect(scopesSupported).toContain("vault:admin");
     expect(scopesSupported).toContain("scribe:transcribe"); // scribe is in the fixture manifest
-    expect(scopesSupported).toContain("hub:admin");
+    // hub:admin + scribe:admin are operator-only (non-requestable) — never advertised (2026-06-30)
+    expect(scopesSupported).not.toContain("hub:admin");
+    expect(scopesSupported).not.toContain("scribe:admin");
     // agent isn't in the fixture manifest → its scopes aren't advertised
     // (hub#…: optional-module scopes only surface when the module is installed).
     expect(scopesSupported).not.toContain("agent:send");
@@ -169,9 +171,10 @@ describe("authorizationServerMetadata", () => {
     // First-party still advertised — no regression
     expect(scopesSupported).toContain("vault:read");
     expect(scopesSupported).toContain("vault:admin");
-    expect(scopesSupported).toContain("hub:admin");
-    // NON_REQUESTABLE filter still applies even when the scope is declared
+    // NON_REQUESTABLE filter applies even when the scope is declared:
+    // host-* AND the service-admin scopes (hub:admin/scribe:admin) are filtered.
     expect(scopesSupported).not.toContain("parachute:host:admin");
+    expect(scopesSupported).not.toContain("hub:admin");
   });
 
   test("advertises an optional module's scopes only when it's installed", async () => {
@@ -209,7 +212,8 @@ describe("authorizationServerMetadata", () => {
     // core scopes survive
     expect(scopes).toContain("vault:read");
     expect(scopes).toContain("vault:admin");
-    expect(scopes).toContain("hub:admin");
+    // hub:admin is operator-only (non-requestable) — never advertised
+    expect(scopes).not.toContain("hub:admin");
     // uninstalled optional-module scopes are dropped
     expect(scopes).not.toContain("scribe:transcribe");
     expect(scopes).not.toContain("scribe:admin");
@@ -241,6 +245,10 @@ describe("authorizationServerMetadata", () => {
     });
     const scopes2 = ((await res2.json()) as Record<string, unknown>).scopes_supported as string[];
     expect(scopes2).toContain("scribe:transcribe");
+    // scribe:admin stays dropped EVEN WITH scribe installed — proving it's the
+    // requestability gate (non-requestable, 2026-06-30) doing the work here, not
+    // the optional-module-not-installed gate that drops scribe:transcribe above.
+    expect(scopes2).not.toContain("scribe:admin");
     expect(scopes2).not.toContain("agent:send"); // agent still not installed
   });
 });
@@ -353,6 +361,88 @@ describe("handleAuthorizeGet", () => {
     }
   });
 
+  // hub#314 — same-hub vs external trust marker reaches the rendered consent
+  // screen via `client.sameHub`. An unnamed `vault:read` request from a
+  // same-hub client falls through to consent (the auto-approve gate requires
+  // `!hasUnnamedVault`), so we can assert the marker on the GET render.
+  test("renders the EXTERNAL trust marker for a third-party DCR client", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: user.id });
+      // registerClient defaults sameHub:false → external (third-party DCR).
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        clientName: "ThirdPartyApp",
+      });
+      const { challenge } = makePkce();
+      const req = new Request(
+        authorizeUrl({
+          client_id: reg.client.clientId,
+          redirect_uri: "https://app.example/cb",
+          response_type: "code",
+          code_challenge: challenge,
+          code_challenge_method: "S256",
+          scope: "vault:read",
+        }),
+        {
+          headers: {
+            cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000))}`,
+          },
+        },
+      );
+      const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      // Element form — the `.badge-trust-*` CSS class names are always in the
+      // inlined <style>; the rendered ELEMENT only appears when the marker fires.
+      expect(html).toContain('class="badge badge-trust-external"');
+      expect(html).toContain("third-party app that registered itself");
+      expect(html).not.toContain('class="badge badge-trust-same-hub"');
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("renders the FIRST-PARTY trust marker for a same-hub client", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: user.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        clientName: "FirstPartyApp",
+        sameHub: true,
+      });
+      const { challenge } = makePkce();
+      const req = new Request(
+        authorizeUrl({
+          client_id: reg.client.clientId,
+          redirect_uri: "https://app.example/cb",
+          response_type: "code",
+          code_challenge: challenge,
+          code_challenge_method: "S256",
+          // Unnamed vault verb → bypasses the same-hub auto-approve gate
+          // (`!hasUnnamedVault`) and falls through to the consent render.
+          scope: "vault:read",
+        }),
+        {
+          headers: {
+            cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000))}`,
+          },
+        },
+      );
+      const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      expect(html).toContain('class="badge badge-trust-same-hub"');
+      expect(html).toContain("Registered through this hub");
+      expect(html).not.toContain('class="badge badge-trust-external"');
+    } finally {
+      cleanup();
+    }
+  });
+
   test("rejects unknown client_id with 400", async () => {
     const { db, cleanup } = await makeDb();
     try {
@@ -7284,12 +7374,12 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
     }
   });
 
-  test("authorize: same_hub=true + admin scope → consent screen (high-power sanity gate)", async () => {
-    // hub:admin is requestable via DCR (only `parachute:host:admin` and
-    // per-vault `vault:*:admin` are non-requestable). For same-hub
-    // clients we DO still show consent on admin scopes — the operator
-    // who registered the client may not want to grant their own session
-    // hub-wide admin access without an explicit click.
+  test("authorize: same_hub=true + hub:admin → invalid_scope (operator-only, even for same-hub) (2026-06-30)", async () => {
+    // hub:admin is now non-requestable via /oauth/authorize (a vault MCP
+    // connector pointed at the hub-level AS would otherwise be offered
+    // hub-wide admin). Even a trusted same-hub client with an owner session
+    // is rejected with invalid_scope — fails closed before consent. The
+    // legit hub-admin paths are operator-bearer/session, not authorize-flow.
     const { db, cleanup } = await makeDb();
     try {
       const user = await createUser(db, "owner", "pw");
@@ -7308,24 +7398,24 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
           scope: "hub:admin",
           code_challenge: challenge,
           code_challenge_method: "S256",
+          state: "abc",
         }),
         { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
       );
       const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
-      // Consent rendered, not silent-approve.
-      expect(res.status).toBe(200);
-      expect(res.headers.get("content-type")).toContain("text/html");
-      const html = await res.text();
-      expect(html).toContain("hub:admin");
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("hub:admin");
     } finally {
       cleanup();
     }
   });
 
-  test("authorize: same_hub=true + mixed admin+non-admin → consent screen (any admin scope shows consent)", async () => {
-    // Defensive: a request asking for `vault:default:read hub:admin` must
-    // NOT silent-approve on the strength of the non-admin scope. Any
-    // admin scope present forces consent.
+  test("authorize: same_hub=true + mixed vault + hub:admin → invalid_scope (a non-requestable scope rejects the whole request) (2026-06-30)", async () => {
+    // A request mixing a requestable scope with hub:admin must NOT slip the
+    // non-requestable scope through on the strength of the others — the whole
+    // request is rejected with invalid_scope (same as parachute:host:admin).
     const { db, cleanup } = await makeDb();
     try {
       const user = await createUser(db, "owner", "pw");
@@ -7344,12 +7434,52 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
           scope: "vault:default:read hub:admin",
           code_challenge: challenge,
           code_challenge_method: "S256",
+          state: "abc",
         }),
         { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
       );
       const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
-      expect(res.status).toBe(200);
-      expect(res.headers.get("content-type")).toContain("text/html");
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("hub:admin");
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("authorize: explicit scribe:admin → invalid_scope (service-admin, operator-only) (2026-06-30)", async () => {
+    // Symmetry with hub:admin: the other service-admin scope is non-requestable
+    // too. Scribe's admin UI gets scribe:admin via the cookie-gated
+    // /admin/module-token/scribe path, never /oauth/authorize — so rejecting it
+    // here breaks no first-party path.
+    const { db, cleanup } = await makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: user.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+        sameHub: true,
+      });
+      const { challenge } = makePkce();
+      const req = new Request(
+        authorizeUrl({
+          client_id: reg.client.clientId,
+          redirect_uri: "https://app.example/cb",
+          response_type: "code",
+          scope: "scribe:admin",
+          code_challenge: challenge,
+          code_challenge_method: "S256",
+          state: "abc",
+        }),
+        { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
+      );
+      const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("scribe:admin");
     } finally {
       cleanup();
     }
@@ -10142,6 +10272,62 @@ describe("hub#689 — owner-on-own-vault verb selector + widening", () => {
     }
   });
 
+  // GET render (hub#703, folded into hub#314): a user with MIXED authority —
+  // admin on vault A (role=write → holds admin) but only read on vault B
+  // (direct INSERT role=read) — does NOT see the selector. The user could pick
+  // either vault, but doesn't own (hold admin on) EVERY pickable vault, so the
+  // `userHoldsAdminOnPickable` predicate (`assignedVaults.every(v => verbs
+  // includes "admin")`) fails on vault B and the selector is suppressed. The
+  // suppression logic already ships + is correct (oauth-handlers.ts ~2963 +
+  // ~1226); this test closes the coverage gap with no code change.
+  test("selector NOT rendered for a mixed-authority user (admin on A, read-only on B)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      await createUser(db, "owner", "pw");
+      const mixed = await createUser(db, "mixed", "pw", { allowMulti: true });
+      // Vault A ("work"): role=write → vaultVerbsForRole maps to [read,write,
+      // admin], so the user holds admin on A. (setUserVaults hardcodes write.)
+      setUserVaults(db, mixed.id, ["work"]);
+      // Vault B ("other"): direct INSERT role=read → holds read only, NOT admin.
+      // setUserVaults DELETEs first, so this INSERT must come after it to keep A.
+      db.prepare(
+        "INSERT INTO user_vaults (user_id, vault_name, role, created_at) VALUES (?, ?, 'read', ?)",
+      ).run(mixed.id, "other", new Date().toISOString());
+      const session = createSession(db, { userId: mixed.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { challenge } = makePkce();
+      const res = handleAuthorizeGet(
+        db,
+        new Request(
+          authorizeUrl({
+            client_id: reg.client.clientId,
+            redirect_uri: "https://app.example/cb",
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            scope: "vault:read",
+          }),
+          { headers: { cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, TTL_S)}` } },
+        ),
+        selDeps,
+      );
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      // Suppressed: the `.every(v => verbs includes "admin")` check fails on B.
+      expect(html).not.toContain("Access level");
+      expect(html).not.toContain('name="verb_select"');
+      // Sanity: the multi-vault picker DID render (two assigned vaults), so the
+      // suppression is specifically the verb selector, not the whole flow.
+      expect(html).toContain('name="vault_pick" value="work"');
+      expect(html).toContain('name="vault_pick" value="other"');
+    } finally {
+      cleanup();
+    }
+  });
+
   // GET render: a non-owner (non-admin with ZERO assigned vaults) does NOT
   // see the selector — they can't authorize a vault scope at all.
   test("selector NOT rendered for a non-owner (zero-vault non-admin)", async () => {