@openparachute/hub 0.7.6-rc.4 → 0.7.7-rc.3

package/src/__tests__/account-token.test.ts

@@ -0,0 +1,292 @@
+/**
+ * Tests for `POST /account/token` — the cookie→account-bearer mint (Parachute
+ * App campaign, Phase 2 H1). Covers:
+ *   - 405 on a non-POST method.
+ *   - 401 when no admin session cookie is present (unauthenticated → refused).
+ *   - 401 when the cookie names a deleted session.
+ *   - 403 csrf_failed when the double-submit CSRF token is missing / mismatched.
+ *   - 403 not_admin when a signed-in non-first-admin (friend) hits the endpoint.
+ *   - 200 mint carrying the superset {account:self:admin, parachute:host:admin,
+ *     parachute:host:auth}, aud="account", validating against the hub's keys.
+ *   - scope-guard admin ⊇ read: account:self:read is inherited by the minted
+ *     account:self:admin (the RS-side check the `/account/*` validator runs).
+ *   - the superset actually unlocks a host-admin-gated endpoint (requireScope
+ *     accepts parachute:host:admin even though aud="account" — SCOPE-b).
+ *   - sliding session renewal on the success path.
+ */
+import type { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+// The `/account/*` validator (H2 / cloud) hand-rolls its scope check via
+// scope-guard's hasScope — hub never imports scope-guard at runtime (the
+// issuer/validator boundary), but the test asserts the RS-side inheritance
+// the account grammar must satisfy. Same relative import as account-setup.test.
+import { hasScope } from "../../packages/scope-guard/src/scope.ts";
+import {
+  ACCOUNT_TOKEN_AUDIENCE,
+  ACCOUNT_TOKEN_TTL_SECONDS,
+  handleAccountToken,
+} from "../account-token.ts";
+import { requireScope } from "../admin-auth.ts";
+import { CSRF_FIELD_NAME, buildCsrfCookie, generateCsrfToken } from "../csrf.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { validateAccessToken } from "../jwt-sign.ts";
+import { ACCOUNT_SELF_ADMIN_SCOPE, ACCOUNT_SELF_READ_SCOPE } from "../scope-explanations.ts";
+import {
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  createSession,
+  deleteSession,
+  findSession,
+} from "../sessions.ts";
+import { rotateSigningKey } from "../signing-keys.ts";
+import { createUser } from "../users.ts";
+
+const ISSUER = "https://hub.test";
+
+interface Harness {
+  db: Database;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "phub-account-token-"));
+  const db = openHubDb(hubDbPath(dir));
+  return {
+    db,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+let harness: Harness;
+beforeEach(() => {
+  harness = makeHarness();
+});
+afterEach(() => {
+  harness.cleanup();
+});
+
+/**
+ * Build a first-admin session + a matching CSRF token pair. Returns the cookie
+ * header (session + csrf) and the CSRF token to place in the JSON body — the
+ * double-submit both halves must agree on.
+ */
+async function withAdminSession(): Promise<{
+  cookie: string;
+  csrf: string;
+  userId: string;
+}> {
+  const user = await createUser(harness.db, "operator", "operator-passphrase");
+  const session = createSession(harness.db, { userId: user.id });
+  const csrf = generateCsrfToken();
+  const cookie = [
+    buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000)).split(";")[0],
+    buildCsrfCookie(csrf).split(";")[0],
+  ].join("; ");
+  return { cookie, csrf, userId: user.id };
+}
+
+/** Seed an admin + a second non-admin friend; return the friend's cookie/csrf. */
+async function withFriendSession(): Promise<{ cookie: string; csrf: string }> {
+  await createUser(harness.db, "admin", "admin-passphrase");
+  const friend = await createUser(harness.db, "alice", "alice-passphrase", { allowMulti: true });
+  const session = createSession(harness.db, { userId: friend.id });
+  const csrf = generateCsrfToken();
+  const cookie = [
+    buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000)).split(";")[0],
+    buildCsrfCookie(csrf).split(";")[0],
+  ].join("; ");
+  return { cookie, csrf };
+}
+
+function postReq(cookie: string, body: Record<string, unknown>): Request {
+  return new Request(`${ISSUER}/account/token`, {
+    method: "POST",
+    headers: { cookie, "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("handleAccountToken", () => {
+  test("405 on GET", async () => {
+    const { cookie } = await withAdminSession();
+    const req = new Request(`${ISSUER}/account/token`, { headers: { cookie } });
+    const res = await handleAccountToken(req, { db: harness.db, issuer: ISSUER });
+    expect(res.status).toBe(405);
+  });
+
+  test("401 when no session cookie is present (unauthenticated → refused)", async () => {
+    // No session AND no CSRF: the session gate fires first, so the refusal is a
+    // clean 401 rather than a CSRF 403.
+    const req = postReq("", { [CSRF_FIELD_NAME]: "anything" });
+    const res = await handleAccountToken(req, { db: harness.db, issuer: ISSUER });
+    expect(res.status).toBe(401);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("unauthenticated");
+  });
+
+  test("401 when the cookie names a deleted session", async () => {
+    const { cookie, csrf } = await withAdminSession();
+    const sid = cookie.match(/parachute_hub_session=([^;]+)/)?.[1] ?? "";
+    deleteSession(harness.db, sid);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(401);
+  });
+
+  test("403 csrf_failed when the CSRF token is absent from the body", async () => {
+    const { cookie } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, {}), { db: harness.db, issuer: ISSUER });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("csrf_failed");
+  });
+
+  test("403 csrf_failed when the body token doesn't match the cookie token", async () => {
+    const { cookie } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    // A well-formed but wrong token (never the cookie's value).
+    const res = await handleAccountToken(
+      postReq(cookie, { [CSRF_FIELD_NAME]: generateCsrfToken() }),
+      { db: harness.db, issuer: ISSUER },
+    );
+    expect(res.status).toBe(403);
+    expect(((await res.json()) as { error: string }).error).toBe("csrf_failed");
+  });
+
+  test("403 not_admin when a signed-in friend (non-first-admin) mints", async () => {
+    // Privesc closure: a valid friend session + valid CSRF must still be
+    // refused — the account superset carries host:admin + host:auth, which a
+    // non-admin must never hold. The gate keys off first-admin (account ≡ box).
+    const { cookie, csrf } = await withFriendSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: string; error_description: string };
+    expect(body.error).toBe("not_admin");
+    expect(body.error_description).toContain("/account/");
+  });
+
+  test("200 mints the account superset with aud=account, validating against the hub keys", async () => {
+    const { cookie, csrf, userId } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+
+    const body = (await res.json()) as {
+      token: string;
+      expires_at: string;
+      scopes: string[];
+      aud: string;
+    };
+    // The superset (SCOPE-b): account scope + the host superset.
+    expect(body.scopes).toEqual([
+      "account:self:admin",
+      "parachute:host:admin",
+      "parachute:host:auth",
+    ]);
+    expect(body.aud).toBe(ACCOUNT_TOKEN_AUDIENCE);
+
+    // TTL is roughly the 10-min window.
+    const skew = new Date(body.expires_at).getTime() - Date.now();
+    expect(skew).toBeGreaterThan((ACCOUNT_TOKEN_TTL_SECONDS - 30) * 1000);
+    expect(skew).toBeLessThan((ACCOUNT_TOKEN_TTL_SECONDS + 30) * 1000);
+
+    // JWT verifies against the hub's own signing key + issuer, and carries the
+    // explicit account audience (SCOPE-a).
+    const validated = await validateAccessToken(harness.db, body.token, ISSUER);
+    expect(validated.payload.sub).toBe(userId);
+    expect(validated.payload.iss).toBe(ISSUER);
+    expect(validated.payload.aud).toBe(ACCOUNT_TOKEN_AUDIENCE);
+    const scopes = ((validated.payload as { scope?: string }).scope ?? "").split(/\s+/);
+    expect(scopes).toContain("account:self:admin");
+    expect(scopes).toContain("parachute:host:admin");
+    expect(scopes).toContain("parachute:host:auth");
+  });
+
+  test("scope-guard: account:self:read is inherited by the minted account:self:admin", async () => {
+    // The `/account/*` validator (H2 / cloud) hand-rolls admin ⊇ read via
+    // scope-guard. The minted token carries account:self:admin; a read-gated
+    // account endpoint must accept it, an admin-gated one too, and neither a
+    // different account id nor an unrelated resource must match.
+    const { cookie, csrf } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    const { scopes } = (await res.json()) as { scopes: string[] };
+
+    expect(hasScope(scopes, ACCOUNT_SELF_ADMIN_SCOPE)).toBe(true);
+    expect(hasScope(scopes, ACCOUNT_SELF_READ_SCOPE)).toBe(true); // admin ⊇ read
+    // A different account id must NOT be satisfied (name-pinned inheritance).
+    expect(hasScope(scopes, "account:other:read")).toBe(false);
+    // account:self:admin must never satisfy a vault scope.
+    expect(hasScope(scopes, "vault:self:read")).toBe(false);
+  });
+
+  test("the minted superset unlocks a host-admin-gated endpoint (SCOPE-b, aud not pinned)", async () => {
+    // requireScope validates signature + iss + the scope claim but does NOT pin
+    // aud, so the aud="account" token is accepted on the host-scoped surfaces
+    // (POST /vaults, /api/auth/*) it wraps — no existing gate needs rewiring.
+    const { cookie, csrf } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    const { token } = (await res.json()) as { token: string };
+
+    const bearerReq = new Request(`${ISSUER}/vaults`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+    });
+    const ctx = await requireScope(harness.db, bearerReq, "parachute:host:admin", ISSUER);
+    expect(ctx.scopes).toContain("account:self:admin");
+    expect(ctx.audience).toBe(ACCOUNT_TOKEN_AUDIENCE);
+  });
+
+  test("200 slides the session expiry forward and re-issues the cookie", async () => {
+    const user = await createUser(harness.db, "operator", "operator-passphrase");
+    const twelveHoursAgo = new Date(Date.now() - 12 * 60 * 60 * 1000);
+    const session = createSession(harness.db, { userId: user.id, now: () => twelveHoursAgo });
+    const originalExpiry = new Date(session.expiresAt).getTime();
+    const csrf = generateCsrfToken();
+    const cookie = [
+      buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000)).split(";")[0],
+      buildCsrfCookie(csrf).split(";")[0],
+    ].join("; ");
+    rotateSigningKey(harness.db);
+
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(200);
+
+    const setCookie = res.headers.get("set-cookie") ?? "";
+    expect(setCookie).toContain("parachute_hub_session=");
+    expect(setCookie).toContain("HttpOnly");
+    expect(setCookie).toContain("Secure"); // ISSUER is https
+    expect(setCookie).toContain("SameSite=Lax");
+    expect(setCookie.toLowerCase()).not.toContain("domain=");
+
+    const found = findSession(harness.db, session.id);
+    expect(new Date(found?.expiresAt ?? 0).getTime()).toBeGreaterThan(originalExpiry);
+  });
+});

package/src/__tests__/door-contract-parity.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, test } from "bun:test";
+import {
+  ACCESS_TOKEN_TTL_SECONDS as CONTRACT_ACCESS_TTL,
+  ACCOUNT_SELF_ADMIN_SCOPE as CONTRACT_ACCOUNT_ADMIN,
+  ACCOUNT_SELF_READ_SCOPE as CONTRACT_ACCOUNT_READ,
+  REFRESH_GRACE_MS as CONTRACT_REFRESH_GRACE,
+  REFRESH_TOKEN_TTL_MS as CONTRACT_REFRESH_TTL,
+  hasAccountScope,
+} from "@openparachute/door-contract";
+import { ACCESS_TOKEN_TTL_SECONDS, REFRESH_GRACE_MS, REFRESH_TOKEN_TTL_MS } from "../jwt-sign.ts";
+import { ACCOUNT_SELF_ADMIN_SCOPE, ACCOUNT_SELF_READ_SCOPE } from "../scope-explanations.ts";
+
+/**
+ * Drift detector for the shared door contract (Cloud+Hub shared-core campaign,
+ * parachute-cloud#116, Phase A). The hub's issuer constants + account-scope
+ * strings are duplicated in `@openparachute/door-contract` (the hosted cloud
+ * door duplicates them too). These assertions bind the hub's LIVE runtime values
+ * to the shared canon — no runtime code path is changed by this test, but any
+ * future divergence between the hub's issuer and the shared contract fails here,
+ * forcing the change through the shared package (and thus the cloud twin).
+ *
+ * When the hub adopts the contract at runtime (Phase B — `jwt-sign.ts` imports
+ * these constants instead of re-declaring them), these become identity checks;
+ * until then they are the guardrail.
+ */
+describe("door-contract parity — token constants", () => {
+  test("the hub's issuer TTL/grace equal the shared contract", () => {
+    expect(ACCESS_TOKEN_TTL_SECONDS).toBe(CONTRACT_ACCESS_TTL);
+    expect(REFRESH_TOKEN_TTL_MS).toBe(CONTRACT_REFRESH_TTL);
+    expect(REFRESH_GRACE_MS).toBe(CONTRACT_REFRESH_GRACE);
+  });
+});
+
+describe("door-contract parity — account scopes", () => {
+  test("the hub's account scope strings equal the shared contract", () => {
+    expect(ACCOUNT_SELF_ADMIN_SCOPE).toBe(CONTRACT_ACCOUNT_ADMIN);
+    expect(ACCOUNT_SELF_READ_SCOPE).toBe(CONTRACT_ACCOUNT_READ);
+  });
+
+  test("the shared checker agrees with the hub's admin⊇read intent", () => {
+    // The hub's `/account/*` gate treats `account:self:admin` as satisfying a
+    // read requirement (scope-explanations.ts). The shared checker must too.
+    expect(hasAccountScope([ACCOUNT_SELF_ADMIN_SCOPE], "self", "read")).toBe(true);
+    expect(hasAccountScope([ACCOUNT_SELF_READ_SCOPE], "self", "admin")).toBe(false);
+  });
+});

package/src/__tests__/scope-explanations.test.ts

@@ -22,6 +22,9 @@ describe("SCOPE_EXPLANATIONS", () => {
       "agent:send",
       "hub:admin",
       "parachute:host:admin",
+      // Account scopes (Parachute App campaign, Phase 2).
+      "account:self:admin",
+      "account:self:read",
     ];
     for (const s of expected) {
       expect(SCOPE_EXPLANATIONS[s]).toBeDefined();
@@ -156,6 +159,14 @@ describe("NON_REQUESTABLE_SCOPES (#96)", () => {
     expect(NON_REQUESTABLE_SCOPES.has("scribe:admin")).toBe(true);
   });
 
+  test("contains the account scopes (App campaign Phase 2 — cookie-minted only)", () => {
+    // account:self:{admin,read} are minted exclusively by POST /account/token
+    // (cookie→bearer), never via /oauth/authorize — a third-party app pointed at
+    // the hub AS must not be able to consent its way to account authority.
+    expect(NON_REQUESTABLE_SCOPES.has("account:self:admin")).toBe(true);
+    expect(NON_REQUESTABLE_SCOPES.has("account:self:read")).toBe(true);
+  });
+
   test("every non-requestable scope is a known first-party scope", () => {
     for (const s of NON_REQUESTABLE_SCOPES) {
       expect(FIRST_PARTY_SCOPES).toContain(s);
@@ -195,6 +206,17 @@ describe("isRequestableScope", () => {
     expect(isRequestableScope("vault:my-techne_2:admin")).toBe(true);
   });
 
+  test("account scopes are non-requestable (cookie-minted only, App campaign)", () => {
+    expect(isRequestableScope("account:self:admin")).toBe(false);
+    expect(isRequestableScope("account:self:read")).toBe(false);
+    // explainScope resolves them (direct SCOPE_EXPLANATIONS keys) with the
+    // right levels, so scopeIsAdmin recognizes the admin form.
+    expect(explainScope("account:self:admin")?.level).toBe("admin");
+    expect(explainScope("account:self:read")?.level).toBe("read");
+    expect(scopeIsAdmin("account:self:admin")).toBe(true);
+    expect(scopeIsAdmin("account:self:read")).toBe(false);
+  });
+
   test("host-level operator scopes stay non-requestable", () => {
     // The asymmetry the single-consent change preserved: per-vault admin is
     // now requestable (capped at mint), but host-wide operator authority is