@openparachute/hub 0.7.6 → 0.7.7-rc.12

package/src/__tests__/account-session.test.ts

@@ -0,0 +1,252 @@
+import type { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ACCOUNT_ERROR_CODES, checkAccountSessionResponse } from "@openparachute/door-contract";
+import { handleAccountSession } from "../account-session.ts";
+import { CSRF_COOKIE_NAME, buildCsrfCookie, generateCsrfToken, parseCsrfCookie } from "../csrf.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import {
+  SESSION_COOKIE_NAME,
+  SESSION_SLIDE_THRESHOLD_MS,
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  createSession,
+  findSession,
+} from "../sessions.ts";
+import { createUser } from "../users.ts";
+
+/**
+ * Tests for `GET /account/session` — the same-origin boot oracle (hub-parity
+ * P1, the twin of cloud's `account-session.ts`). Covers:
+ *   - both branches' body shape (signed-out / signed-in).
+ *   - CSRF minted when absent, reused (no re-Set-Cookie) when present — on
+ *     BOTH branches (the G2 anonymous-CSRF invariant).
+ *   - a deleted-user session row falls back to signed-out.
+ *   - the bounded slide: an old-but-live session rolls + re-issues the
+ *     cookie; a fresh session does neither.
+ *   - 405 on non-GET, `cache-control: no-store`, no CORS headers.
+ *   - drift: `checkAccountSessionResponse` reports zero issues against the
+ *     live handler on both branches.
+ */
+const ISSUER = "https://hub.test";
+
+interface Harness {
+  db: Database;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "phub-account-session-"));
+  const db = openHubDb(hubDbPath(dir));
+  return {
+    db,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+let harness: Harness;
+beforeEach(() => {
+  harness = makeHarness();
+});
+afterEach(() => {
+  harness.cleanup();
+});
+
+function getReq(cookie?: string, method = "GET"): Request {
+  return new Request(`${ISSUER}/account/session`, {
+    method,
+    ...(cookie ? { headers: { cookie } } : {}),
+  });
+}
+
+function sessionCookiePair(sid: string): string {
+  return buildSessionCookie(sid, Math.floor(SESSION_TTL_MS / 1000));
+}
+
+describe("handleAccountSession — signed-out branch", () => {
+  test("no cookie at all → {signed_in:false, csrf} + CSRF Set-Cookie minted", async () => {
+    const res = handleAccountSession(getReq(), { db: harness.db });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { signed_in: boolean; csrf: string };
+    expect(body.signed_in).toBe(false);
+    expect(typeof body.csrf).toBe("string");
+    expect(body.csrf.length).toBeGreaterThan(0);
+
+    const setCookie = res.headers.getSetCookie();
+    const csrfSet = setCookie.find((c) => c.includes(CSRF_COOKIE_NAME));
+    expect(csrfSet).toBeDefined();
+    expect(parseCsrfCookie(csrfSet ?? null)).toBe(body.csrf);
+  });
+
+  test("reuses an existing CSRF cookie without re-minting (no Set-Cookie)", async () => {
+    const existing = generateCsrfToken();
+    const cookie = buildCsrfCookie(existing).split(";")[0] ?? "";
+    const res = handleAccountSession(getReq(cookie), { db: harness.db });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { signed_in: boolean; csrf: string };
+    expect(body.signed_in).toBe(false);
+    expect(body.csrf).toBe(existing);
+    expect(res.headers.get("set-cookie")).toBeNull();
+  });
+
+  test("a session cookie naming a deleted user → signed-out", async () => {
+    // The on-disk FK normally guards against a session outliving its user, so
+    // forge the orphaned row directly with `PRAGMA foreign_keys=OFF` (the
+    // `api-account.test.ts` precedent) — simulating a delete-user-via-SQL-shell
+    // race, not something reachable through the app's own APIs.
+    const sessionId = "test-orphaned-session-id-base64url";
+    harness.db.exec("PRAGMA foreign_keys = OFF");
+    try {
+      harness.db
+        .prepare("INSERT INTO sessions (id, user_id, expires_at, created_at) VALUES (?, ?, ?, ?)")
+        .run(
+          sessionId,
+          "nonexistent-user-uuid",
+          new Date(Date.now() + SESSION_TTL_MS).toISOString(),
+          new Date().toISOString(),
+        );
+    } finally {
+      harness.db.exec("PRAGMA foreign_keys = ON");
+    }
+    const cookie = sessionCookiePair(sessionId);
+    const res = handleAccountSession(getReq(cookie), { db: harness.db });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { signed_in: boolean };
+    expect(body.signed_in).toBe(false);
+  });
+
+  test("drift: checkAccountSessionResponse reports zero issues (signed-out)", async () => {
+    const res = handleAccountSession(getReq(), { db: harness.db });
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(checkAccountSessionResponse(body, { signedIn: false })).toEqual([]);
+  });
+});
+
+describe("handleAccountSession — signed-in branch", () => {
+  test("username always present; no email when the user row has none", async () => {
+    const user = await createUser(harness.db, "operator", "pw", { passwordChanged: true });
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.signed_in).toBe(true);
+    expect(body.username).toBe("operator");
+    expect(body.email).toBeUndefined();
+    expect(body.account_created_at).toBe(user.createdAt);
+    expect(body.password_change_required).toBeUndefined();
+  });
+
+  test("email present when the user row has one", async () => {
+    const user = await createUser(harness.db, "withmail", "pw", {
+      passwordChanged: true,
+      email: "friend@example.com",
+    });
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.email).toBe("friend@example.com");
+    expect(body.username).toBe("withmail");
+  });
+
+  test("password_change_required:true for a not-yet-rotated (passwordChanged:false) user", async () => {
+    // createUser defaults passwordChanged to false — the admin-created-user
+    // posture (force-redirect on first sign-in).
+    const user = await createUser(harness.db, "temp", "pw");
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.signed_in).toBe(true);
+    expect(body.password_change_required).toBe(true);
+  });
+
+  test("mints CSRF when absent even on the signed-in branch", async () => {
+    const user = await createUser(harness.db, "operator2", "pw", { passwordChanged: true });
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    const body = (await res.json()) as { csrf: string };
+    expect(typeof body.csrf).toBe("string");
+    expect(body.csrf.length).toBeGreaterThan(0);
+    const setCookie = res.headers.getSetCookie();
+    expect(setCookie.some((c) => c.includes(CSRF_COOKIE_NAME))).toBe(true);
+  });
+
+  test("drift: checkAccountSessionResponse reports zero issues (signed-in)", async () => {
+    const user = await createUser(harness.db, "driftcheck", "pw", { passwordChanged: true });
+    const session = createSession(harness.db, { userId: user.id });
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(checkAccountSessionResponse(body, { signedIn: true })).toEqual([]);
+  });
+});
+
+describe("handleAccountSession — bounded slide", () => {
+  test("an old-but-live session (within the slide threshold of expiry) rolls + re-issues the cookie", async () => {
+    const user = await createUser(harness.db, "slider", "pw", { passwordChanged: true });
+    const t0 = new Date();
+    // Created far enough in the past that remaining life < TTL - threshold.
+    const createdAt = new Date(
+      t0.getTime() - (SESSION_TTL_MS - SESSION_SLIDE_THRESHOLD_MS + 60_000),
+    );
+    const session = createSession(harness.db, { userId: user.id, now: () => createdAt });
+    const originalExpiry = new Date(session.expiresAt).getTime();
+
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    expect(res.status).toBe(200);
+    const setCookie = res.headers.getSetCookie();
+    const sessionSet = setCookie.find((c) => c.includes(SESSION_COOKIE_NAME));
+    expect(sessionSet).toBeDefined();
+    expect(sessionSet).toContain("HttpOnly");
+    expect(sessionSet).toContain("SameSite=Lax");
+
+    const found = findSession(harness.db, session.id);
+    expect(new Date(found?.expiresAt ?? 0).getTime()).toBeGreaterThan(originalExpiry);
+  });
+
+  test("a fresh session does NOT slide — no session Set-Cookie, no DB write", async () => {
+    const user = await createUser(harness.db, "fresh", "pw", { passwordChanged: true });
+    const session = createSession(harness.db, { userId: user.id });
+    const originalExpiry = session.expiresAt;
+
+    const res = handleAccountSession(getReq(sessionCookiePair(session.id)), { db: harness.db });
+    expect(res.status).toBe(200);
+    const setCookie = res.headers.getSetCookie();
+    expect(setCookie.some((c) => c.includes(SESSION_COOKIE_NAME))).toBe(false);
+
+    const found = findSession(harness.db, session.id);
+    expect(found?.expiresAt).toBe(originalExpiry);
+  });
+});
+
+describe("handleAccountSession — method + headers", () => {
+  test("405 on POST", async () => {
+    const res = handleAccountSession(getReq(undefined, "POST"), { db: harness.db });
+    expect(res.status).toBe(405);
+    expect(res.headers.get("allow")).toBe("GET");
+    // H1.3 — pin the CURRENT shape: resource-level failures on /account/*
+    // emit {error, message} (door-contract account-contract.ts:244-246). This
+    // is account-session.ts's own `methodNotAllowed`, distinct from
+    // account-token.ts's {error, error_description} 405 (see H1.1/H1.3 PR
+    // notes — a decisions-needed inconsistency, not fixed here).
+    const body = (await res.json()) as { error: string; message: string };
+    expect(body).toEqual({ error: "method_not_allowed", message: "use GET" });
+    expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
+  });
+
+  test("cache-control: no-store on the 200 path", async () => {
+    const res = handleAccountSession(getReq(), { db: harness.db });
+    expect(res.headers.get("cache-control")).toBe("no-store");
+  });
+
+  test("no access-control-allow-origin (same-origin only, no CORS)", async () => {
+    const req = new Request(`${ISSUER}/account/session`, {
+      headers: { origin: "https://evil.example" },
+    });
+    const res = handleAccountSession(req, { db: harness.db });
+    expect(res.headers.get("access-control-allow-origin")).toBeNull();
+  });
+});

package/src/__tests__/account-token.test.ts

@@ -0,0 +1,316 @@
+/**
+ * Tests for `POST /account/token` — the cookie→account-bearer mint (Parachute
+ * App campaign, Phase 2 H1). Covers:
+ *   - 405 on a non-POST method.
+ *   - 401 when no admin session cookie is present (unauthenticated → refused).
+ *   - 401 when the cookie names a deleted session.
+ *   - 403 csrf_failed when the double-submit CSRF token is missing / mismatched.
+ *   - 403 not_admin when a signed-in non-first-admin (friend) hits the endpoint.
+ *   - 200 mint carrying the superset {account:self:admin, parachute:host:admin,
+ *     parachute:host:auth}, aud="account", validating against the hub's keys.
+ *   - scope-guard admin ⊇ read: account:self:read is inherited by the minted
+ *     account:self:admin (the RS-side check the `/account/*` validator runs).
+ *   - the superset actually unlocks a host-admin-gated endpoint (requireScope
+ *     accepts parachute:host:admin even though aud="account" — SCOPE-b).
+ *   - sliding session renewal on the success path.
+ */
+import type { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ACCOUNT_ERROR_CODES, checkAccountTokenMintResponse } from "@openparachute/door-contract";
+// The `/account/*` validator (H2 / cloud) hand-rolls its scope check via
+// scope-guard's hasScope — hub never imports scope-guard at runtime (the
+// issuer/validator boundary), but the test asserts the RS-side inheritance
+// the account grammar must satisfy. Same relative import as account-setup.test.
+import { hasScope } from "../../packages/scope-guard/src/scope.ts";
+import {
+  ACCOUNT_TOKEN_AUDIENCE,
+  ACCOUNT_TOKEN_TTL_SECONDS,
+  handleAccountToken,
+} from "../account-token.ts";
+import { requireScope } from "../admin-auth.ts";
+import { CSRF_FIELD_NAME, buildCsrfCookie, generateCsrfToken } from "../csrf.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { validateAccessToken } from "../jwt-sign.ts";
+import { ACCOUNT_SELF_ADMIN_SCOPE, ACCOUNT_SELF_READ_SCOPE } from "../scope-explanations.ts";
+import {
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  createSession,
+  deleteSession,
+  findSession,
+} from "../sessions.ts";
+import { rotateSigningKey } from "../signing-keys.ts";
+import { createUser } from "../users.ts";
+
+const ISSUER = "https://hub.test";
+
+interface Harness {
+  db: Database;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "phub-account-token-"));
+  const db = openHubDb(hubDbPath(dir));
+  return {
+    db,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+let harness: Harness;
+beforeEach(() => {
+  harness = makeHarness();
+});
+afterEach(() => {
+  harness.cleanup();
+});
+
+/**
+ * Build a first-admin session + a matching CSRF token pair. Returns the cookie
+ * header (session + csrf) and the CSRF token to place in the JSON body — the
+ * double-submit both halves must agree on.
+ */
+async function withAdminSession(): Promise<{
+  cookie: string;
+  csrf: string;
+  userId: string;
+}> {
+  const user = await createUser(harness.db, "operator", "operator-passphrase");
+  const session = createSession(harness.db, { userId: user.id });
+  const csrf = generateCsrfToken();
+  const cookie = [
+    buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000)).split(";")[0],
+    buildCsrfCookie(csrf).split(";")[0],
+  ].join("; ");
+  return { cookie, csrf, userId: user.id };
+}
+
+/** Seed an admin + a second non-admin friend; return the friend's cookie/csrf. */
+async function withFriendSession(): Promise<{ cookie: string; csrf: string }> {
+  await createUser(harness.db, "admin", "admin-passphrase");
+  const friend = await createUser(harness.db, "alice", "alice-passphrase", { allowMulti: true });
+  const session = createSession(harness.db, { userId: friend.id });
+  const csrf = generateCsrfToken();
+  const cookie = [
+    buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000)).split(";")[0],
+    buildCsrfCookie(csrf).split(";")[0],
+  ].join("; ");
+  return { cookie, csrf };
+}
+
+function postReq(cookie: string, body: Record<string, unknown>): Request {
+  return new Request(`${ISSUER}/account/token`, {
+    method: "POST",
+    headers: { cookie, "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("handleAccountToken", () => {
+  test("405 on GET", async () => {
+    const { cookie } = await withAdminSession();
+    const req = new Request(`${ISSUER}/account/token`, { headers: { cookie } });
+    const res = await handleAccountToken(req, { db: harness.db, issuer: ISSUER });
+    expect(res.status).toBe(405);
+    // H1.3 — pin the CURRENT shape: account-token.ts emits {error,
+    // error_description} uniformly (its own local `jsonError`), including for
+    // this 405 — DIFFERENT from account-session.ts's 405, which emits {error,
+    // message} (see that file's test). A decisions-needed inconsistency
+    // across /account/*, not fixed here.
+    const body = (await res.json()) as { error: string; error_description: string };
+    expect(body).toEqual({ error: "method_not_allowed", error_description: "use POST" });
+    expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
+  });
+
+  test("401 when no session cookie is present (unauthenticated → refused)", async () => {
+    // No session AND no CSRF: the session gate fires first, so the refusal is a
+    // clean 401 rather than a CSRF 403.
+    const req = postReq("", { [CSRF_FIELD_NAME]: "anything" });
+    const res = await handleAccountToken(req, { db: harness.db, issuer: ISSUER });
+    expect(res.status).toBe(401);
+    const body = (await res.json()) as { error: string; error_description: string };
+    expect(body.error).toBe("unauthenticated");
+    // H1.3 — pin the CURRENT shape: auth-gate failures on /account/* emit
+    // {error, error_description} (door-contract account-contract.ts:244-246).
+    expect(typeof body.error_description).toBe("string");
+    expect(body.error_description.length).toBeGreaterThan(0);
+    expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
+  });
+
+  test("401 when the cookie names a deleted session", async () => {
+    const { cookie, csrf } = await withAdminSession();
+    const sid = cookie.match(/parachute_hub_session=([^;]+)/)?.[1] ?? "";
+    deleteSession(harness.db, sid);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(401);
+  });
+
+  test("403 csrf_failed when the CSRF token is absent from the body", async () => {
+    const { cookie } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, {}), { db: harness.db, issuer: ISSUER });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: string; error_description: string };
+    expect(body.error).toBe("csrf_failed");
+    // H1.3 — pin the {error, error_description} shape + ACCOUNT_ERROR_CODES membership.
+    expect(typeof body.error_description).toBe("string");
+    expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
+  });
+
+  test("403 csrf_failed when the body token doesn't match the cookie token", async () => {
+    const { cookie } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    // A well-formed but wrong token (never the cookie's value).
+    const res = await handleAccountToken(
+      postReq(cookie, { [CSRF_FIELD_NAME]: generateCsrfToken() }),
+      { db: harness.db, issuer: ISSUER },
+    );
+    expect(res.status).toBe(403);
+    expect(((await res.json()) as { error: string }).error).toBe("csrf_failed");
+  });
+
+  test("403 not_admin when a signed-in friend (non-first-admin) mints", async () => {
+    // Privesc closure: a valid friend session + valid CSRF must still be
+    // refused — the account superset carries host:admin + host:auth, which a
+    // non-admin must never hold. The gate keys off first-admin (account ≡ box).
+    const { cookie, csrf } = await withFriendSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: string; error_description: string };
+    expect(body.error).toBe("not_admin");
+    expect(body.error_description).toContain("/account/");
+    // H1.3 — DECISIONS-NEEDED (cataloged, not fixed here): "not_admin" is a
+    // real emitted /account/* error code but is NOT a member of door-contract's
+    // ACCOUNT_ERROR_CODES union — a gap in the shared vocabulary. See the PR
+    // body's decisions-needed section rather than asserting membership here.
+  });
+
+  test("200 mints the account superset with aud=account, validating against the hub keys", async () => {
+    const { cookie, csrf, userId } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+
+    const body = (await res.json()) as {
+      token: string;
+      expires_at: string;
+      scopes: string[];
+      aud: string;
+    };
+    // The superset (SCOPE-b): account scope + the host superset.
+    expect(body.scopes).toEqual([
+      "account:self:admin",
+      "parachute:host:admin",
+      "parachute:host:auth",
+    ]);
+    expect(body.aud).toBe(ACCOUNT_TOKEN_AUDIENCE);
+    // H1.2 — door-contract conformance against the live `POST /account/token`
+    // success body (V1.4/C1.4 twin coverage, hub half).
+    expect(checkAccountTokenMintResponse(body)).toEqual([]);
+
+    // TTL is roughly the 10-min window.
+    const skew = new Date(body.expires_at).getTime() - Date.now();
+    expect(skew).toBeGreaterThan((ACCOUNT_TOKEN_TTL_SECONDS - 30) * 1000);
+    expect(skew).toBeLessThan((ACCOUNT_TOKEN_TTL_SECONDS + 30) * 1000);
+
+    // JWT verifies against the hub's own signing key + issuer, and carries the
+    // explicit account audience (SCOPE-a).
+    const validated = await validateAccessToken(harness.db, body.token, ISSUER);
+    expect(validated.payload.sub).toBe(userId);
+    expect(validated.payload.iss).toBe(ISSUER);
+    expect(validated.payload.aud).toBe(ACCOUNT_TOKEN_AUDIENCE);
+    const scopes = ((validated.payload as { scope?: string }).scope ?? "").split(/\s+/);
+    expect(scopes).toContain("account:self:admin");
+    expect(scopes).toContain("parachute:host:admin");
+    expect(scopes).toContain("parachute:host:auth");
+  });
+
+  test("scope-guard: account:self:read is inherited by the minted account:self:admin", async () => {
+    // The `/account/*` validator (H2 / cloud) hand-rolls admin ⊇ read via
+    // scope-guard. The minted token carries account:self:admin; a read-gated
+    // account endpoint must accept it, an admin-gated one too, and neither a
+    // different account id nor an unrelated resource must match.
+    const { cookie, csrf } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    const { scopes } = (await res.json()) as { scopes: string[] };
+
+    expect(hasScope(scopes, ACCOUNT_SELF_ADMIN_SCOPE)).toBe(true);
+    expect(hasScope(scopes, ACCOUNT_SELF_READ_SCOPE)).toBe(true); // admin ⊇ read
+    // A different account id must NOT be satisfied (name-pinned inheritance).
+    expect(hasScope(scopes, "account:other:read")).toBe(false);
+    // account:self:admin must never satisfy a vault scope.
+    expect(hasScope(scopes, "vault:self:read")).toBe(false);
+  });
+
+  test("the minted superset unlocks a host-admin-gated endpoint (SCOPE-b, aud not pinned)", async () => {
+    // requireScope validates signature + iss + the scope claim but does NOT pin
+    // aud, so the aud="account" token is accepted on the host-scoped surfaces
+    // (POST /vaults, /api/auth/*) it wraps — no existing gate needs rewiring.
+    const { cookie, csrf } = await withAdminSession();
+    rotateSigningKey(harness.db);
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    const { token } = (await res.json()) as { token: string };
+
+    const bearerReq = new Request(`${ISSUER}/vaults`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+    });
+    const ctx = await requireScope(harness.db, bearerReq, "parachute:host:admin", ISSUER);
+    expect(ctx.scopes).toContain("account:self:admin");
+    expect(ctx.audience).toBe(ACCOUNT_TOKEN_AUDIENCE);
+  });
+
+  test("200 slides the session expiry forward and re-issues the cookie", async () => {
+    const user = await createUser(harness.db, "operator", "operator-passphrase");
+    const twelveHoursAgo = new Date(Date.now() - 12 * 60 * 60 * 1000);
+    const session = createSession(harness.db, { userId: user.id, now: () => twelveHoursAgo });
+    const originalExpiry = new Date(session.expiresAt).getTime();
+    const csrf = generateCsrfToken();
+    const cookie = [
+      buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000)).split(";")[0],
+      buildCsrfCookie(csrf).split(";")[0],
+    ].join("; ");
+    rotateSigningKey(harness.db);
+
+    const res = await handleAccountToken(postReq(cookie, { [CSRF_FIELD_NAME]: csrf }), {
+      db: harness.db,
+      issuer: ISSUER,
+    });
+    expect(res.status).toBe(200);
+
+    const setCookie = res.headers.get("set-cookie") ?? "";
+    expect(setCookie).toContain("parachute_hub_session=");
+    expect(setCookie).toContain("HttpOnly");
+    expect(setCookie).toContain("Secure"); // ISSUER is https
+    expect(setCookie).toContain("SameSite=Lax");
+    expect(setCookie.toLowerCase()).not.toContain("domain=");
+
+    const found = findSession(harness.db, session.id);
+    expect(new Date(found?.expiresAt ?? 0).getTime()).toBeGreaterThan(originalExpiry);
+  });
+});

package/src/__tests__/admin-connections-credentials.test.ts

@@ -556,6 +556,26 @@ describe("credential connection — renewal (proof of possession)", () => {
     expect(rec.provisioned.mintedJtis).toEqual([out.credential.jti!]);
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const { fetchImpl, calls } = mockFetch({ "POST /api/credential": () => ok({ ok: true }) });
+    const deps = credDeps(fetchImpl, modulesOf(SURFACE_MANIFEST));
+    const cred = await provision(deps, calls);
+
+    const res = await handleConnections(
+      new Request(`http://127.0.0.1/admin/connections/${cred.connection_id}/renew`, {
+        method: "POST",
+        headers: { authorization: `bearer ${cred.token}` },
+      }),
+      `/${cred.connection_id}/renew`,
+      deps,
+    );
+    expect(res.status).toBe(200);
+    const out = (await res.json()) as { ok: boolean; credential: DeliveredCredential };
+    expect(out.ok).toBe(true);
+    expect(out.credential.op).toBe("renewed");
+  });
+
   test("renewed credential can renew again (the chain extends)", async () => {
     const { fetchImpl, calls } = mockFetch({ "POST /api/credential": () => ok({ ok: true }) });
     const deps = credDeps(fetchImpl, modulesOf(SURFACE_MANIFEST));
@@ -941,6 +961,27 @@ describe("credential connection — claim/reconcile (surface#113)", () => {
     ]);
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("claim: mixed-case bearer scheme (BeArEr) authenticates identically to canonical Bearer", async () => {
+    const { fetchImpl } = mockFetch({});
+    const deps = credDeps(fetchImpl, modulesOf(SURFACE_MANIFEST));
+    const direct = await mintDirectDelivered({ vault: "default", verb: "read", tags: ["boulder"] });
+
+    const claim = await handleConnections(
+      new Request(`http://127.0.0.1/admin/connections/${CLAIM_ID}/claim`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `BeArEr ${direct.token}` },
+        body: JSON.stringify(SURFACE_CLAIM),
+      }),
+      `/${CLAIM_ID}/claim`,
+      deps,
+    );
+    expect(claim.status).toBe(202);
+    const claimBody = (await claim.json()) as { ok: boolean; status: string };
+    expect(claimBody.ok).toBe(true);
+    expect(claimBody.status).toBe("pending");
+  });
+
   test("the live docs shape: an UNTAGGED write credential is claimable verbatim (create's write-requires-tags guards NEW grants; the operator's approve sanctions the existing shape)", async () => {
     const { fetchImpl } = mockFetch({});
     const deps = credDeps(fetchImpl, modulesOf(SURFACE_MANIFEST));

package/src/__tests__/admin-handlers.test.ts

@@ -603,4 +603,29 @@ describe("handleAdminLogoutPost (#113)", () => {
     expect(res.headers.get("location")).toBe("/login");
     expect(res.headers.get("set-cookie") ?? "").toContain("parachute_hub_session=;");
   });
+
+  // App-wire pin (hub-parity P1, §8-M4): the app's `logout()` posts form-
+  // encoded, not JSON (`parachute-app/src/lib/account/client.ts:246-258`:
+  // `content-type: application/x-www-form-urlencoded`, body
+  // `new URLSearchParams({ __csrf: csrf }).toString()`, credentials included).
+  // No hub code changed for this — the existing formData()-based handler
+  // already accepts exactly this shape; this test freezes the byte-shape so a
+  // future refactor of the handler can't silently drop form-body support out
+  // from under the app.
+  test("app-wire pin — form-encoded body matching client.ts's exact logout() shape", async () => {
+    const cookie = await cookieForUser(harness.db, "appuser", "pw");
+    const sid = cookie.match(/parachute_hub_session=([^;]+)/)?.[1] ?? "";
+    const req = new Request("http://hub.test/logout", {
+      method: "POST",
+      headers: {
+        cookie,
+        "content-type": "application/x-www-form-urlencoded",
+      },
+      body: new URLSearchParams({ [CSRF_FIELD_NAME]: TEST_CSRF }).toString(),
+    });
+    const res = await handleAdminLogoutPost(harness.db, req);
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toBe("/login");
+    expect(findSession(harness.db, sid)).toBeNull();
+  });
 });