@owlmeans/server-auth-token 0.1.18-rc.8 → 0.1.18

package/tests/guard.spec.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from 'bun:test'
 import { AuthroizationType } from '@owlmeans/auth'
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
 import type { GuardService } from '@owlmeans/entrypoint'
-import { hashAccessToken } from '../src/hash.js'
+import { tokenHashHelper } from '../src/hash.js'
 import {
   makeTestContext, request, response, seedProfile, seedToken, TEST_ENTITY, TEST_PREFIX, TEST_PROFILE
 } from './context.js'
@@ -12,7 +12,7 @@ const TOKEN = `${TEST_PREFIX}averylongrandomsecretvalue`
 const armed = async (opts = {}) => {
   const context = await makeTestContext(opts)
   await seedProfile(context)
-  await seedToken(context, hashAccessToken(TOKEN))
+  await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN))
 
   return { context, guard: context.service<GuardService>(GUARD_AUTH_TOKEN) }
 }
@@ -60,7 +60,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   test('a token can never outrank its profile', async () => {
     const context = await makeTestContext()
     await seedProfile(context, { scopes: ['project:read'] })
-    await seedToken(context, hashAccessToken(TOKEN), { scopes: ['*', 'project:write'] })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { scopes: ['*', 'project:write'] })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
     const res = response()
 
@@ -71,7 +71,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   test('refuses a revoked token', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken(TOKEN), { revokedAt: new Date() })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { revokedAt: new Date() })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -80,7 +80,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   test('refuses an expired token', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken(TOKEN), { expiresAt: new Date(Date.now() - 1000) })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { expiresAt: new Date(Date.now() - 1000) })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -94,7 +94,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
 
   test('refuses when the profile behind it is gone — revoking a person revokes their tokens', async () => {
     const context = await makeTestContext()
-    await seedToken(context, hashAccessToken(TOKEN))
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN))
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -103,7 +103,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   test('refuses when the profile has expired', async () => {
     const context = await makeTestContext()
     await seedProfile(context, { expiresAt: new Date(Date.now() - 1000) })
-    await seedToken(context, hashAccessToken(TOKEN))
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN))
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -116,13 +116,57 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   })
 })
 
+describe('@owlmeans/server-auth-token — audience admission', () => {
+  test('a token with no audience is admitted by a guard that opted into resource checking', async () => {
+    const { guard } = await armed({ resources: ['https://api.example.com'] })
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+
+  test('a token scoped to a resource is refused by a guard for a different one', async () => {
+    const context = await makeTestContext({ resources: ['https://api.example.com'] })
+    await seedProfile(context)
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
+  })
+
+  test('a token scoped to a resource is admitted by a guard configured for it', async () => {
+    const context = await makeTestContext({ resources: ['https://api.example.com/mcp', 'https://api.example.com'] })
+    await seedProfile(context)
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+
+  test('a guard that never opted in ignores audience entirely — full backward compatibility', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+
+  test('a function `resources` option is resolved with the live context, not cached from registration', async () => {
+    const context = await makeTestContext({ resources: () => ['https://api.example.com'] })
+    await seedProfile(context)
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { audience: ['https://api.example.com'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+})
+
 describe('@owlmeans/server-auth-token — the hash at rest', () => {
   test('the stored value is not the token', () => {
-    const hash = hashAccessToken(TOKEN)
+    const hash = tokenHashHelper.hashAccessToken(TOKEN)
 
     expect(hash).not.toBe(TOKEN)
     expect(hash).toMatch(/^[0-9a-f]{64}$/)
-    expect(hashAccessToken(TOKEN)).toBe(hash)
-    expect(hashAccessToken(`${TOKEN}x`)).not.toBe(hash)
+    expect(tokenHashHelper.hashAccessToken(TOKEN)).toBe(hash)
+    expect(tokenHashHelper.hashAccessToken(`${TOKEN}x`)).not.toBe(hash)
   })
 })

package/tests/handlers.spec.ts

@@ -7,7 +7,8 @@ import {
   listAccessTokens as bindListAccessTokens,
   revokeAccessToken as bindRevokeAccessToken,
 } from '../src/handlers/index.js'
-import { hashAccessToken } from '../src/hash.js'
+import { tokenHashHelper } from '../src/hash.js'
+import { accessTokenIssuerOf } from '../src/handlers/index.js'
 import { makeTestContext, seedProfile, seedToken, TEST_ENTITY, TEST_PREFIX, TEST_PROFILE, TEST_USER } from './context.js'
 
 /**
@@ -26,6 +27,7 @@ const protocols = makeAuthTokenEntrypoints()
 const listAccessTokens = bindListAccessTokens(protocols.list)
 const createAccessToken = bindCreateAccessToken(protocols.create)
 const revokeAccessToken = bindRevokeAccessToken(protocols.revoke)
+const revokeByToken = bindRevokeAccessToken(protocols.revoke, { allowAccessTokens: true })
 
 const session = (patch: Record<string, unknown> = {}): any => ({
   headers: {}, params: {}, query: {}, body: {},
@@ -57,7 +59,7 @@ describe('@owlmeans/server-auth-token — minting', () => {
     // The view a caller sees carries no hash at all.
     expect((issued.record as unknown as AccessTokenRecord).hash).toBeUndefined()
 
-    const stored = await context.resource<any>(AUTH_TOKEN_RESOURCE).load({ hash: hashAccessToken(issued.token) })
+    const stored = await context.resource<any>(AUTH_TOKEN_RESOURCE).load({ hash: tokenHashHelper.hashAccessToken(issued.token) })
     expect(stored).not.toBeNull()
     expect(stored.hash).not.toBe(issued.token)
   })
@@ -104,14 +106,38 @@ describe('@owlmeans/server-auth-token — minting', () => {
   })
 })
 
+describe('@owlmeans/server-auth-token — issueAccessToken (the OAuth server\'s entry point)', () => {
+  test('stores the audience it was given, and omits the field when there is none', async () => {
+    const context = await makeTestContext()
+    const subject = { entityId: TEST_ENTITY, profileId: TEST_PROFILE, userId: TEST_USER, role: AuthRole.User, scopes: ['*'] }
+
+    const withAudience = await accessTokenIssuerOf(context).issueAccessToken(subject, { name: 'mcp', audience: ['https://api.example.com/mcp'] })
+    expect(withAudience.record.audience).toEqual(['https://api.example.com/mcp'])
+
+    const withoutAudience = await accessTokenIssuerOf(context).issueAccessToken(subject, { name: 'hand-minted' })
+    expect(withoutAudience.record.audience).toBeUndefined()
+  })
+
+  test('still narrows scopes and clamps the TTL the same way the HTTP handler does', async () => {
+    const context = await makeTestContext()
+    const subject = { entityId: TEST_ENTITY, profileId: TEST_PROFILE, userId: TEST_USER, role: AuthRole.User, scopes: ['projects:read'] }
+
+    await expect(accessTokenIssuerOf(context).issueAccessToken(subject, { name: 'x', scopes: ['projects:write'] })).rejects.toThrow()
+
+    const issued = await accessTokenIssuerOf(context).issueAccessToken(subject, { name: 'x', expiresIn: 60 * 60 * 24 * 400 })
+    const ttlMs = new Date(issued.record.expiresAt!).getTime() - Date.now()
+    expect(ttlMs).toBeLessThanOrEqual(366 * 24 * 60 * 60 * 1000)
+  })
+})
+
 describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('a list shows the caller\'s own tokens and never a hash', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken('tst_one'), { id: 'one', name: 'one' })
-    await seedToken(context, hashAccessToken('tst_two'), { id: 'two', name: 'two' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_one'), { id: 'one', name: 'one' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_two'), { id: 'two', name: 'two' })
     // Somebody else's token, in the same store.
-    await seedToken(context, hashAccessToken('tst_other'), {
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_other'), {
       id: 'other', name: 'other', profileId: 'someone-else',
     })
 
@@ -124,7 +150,7 @@ describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('revoking marks the record and is idempotent', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken('tst_one'), { id: 'one' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_one'), { id: 'one' })
 
     await invoke(revokeAccessToken, context, { ...session(), params: { id: 'one' } })
     const first = await context.resource<any>(AUTH_TOKEN_RESOURCE).load('one')
@@ -139,7 +165,7 @@ describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('another profile\'s token answers exactly as an unknown id does', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken('tst_other'), { id: 'other', profileId: 'someone-else' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_other'), { id: 'other', profileId: 'someone-else' })
 
     await expect(
       invoke(revokeAccessToken, context, { ...session(), params: { id: 'other' } })
@@ -152,11 +178,33 @@ describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('a token may never revoke a token', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken('tst_one'), { id: 'one' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_one'), { id: 'one' })
 
     await expect(invoke(
       revokeAccessToken, context,
       { ...session({ type: AuthroizationType.AuthToken }), params: { id: 'one' } }
     )).rejects.toThrow()
   })
+
+  test('allowAccessTokens lets a token revoke its own person\'s token — and nothing more', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_one'), { id: 'one' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_other'), { id: 'other', profileId: 'someone-else' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_elsewhere'), { id: 'elsewhere', entityId: 'entity-2' })
+    const byToken = session({ type: AuthroizationType.AuthToken })
+
+    expect(await invoke(revokeByToken, context, { ...byToken, params: { id: 'one' } })).toEqual({ id: 'one' })
+    expect((await context.resource<any>(AUTH_TOKEN_RESOURCE).load('one')).revokedAt).toBeDefined()
+
+    // Another person's token, another organization's, and an unknown id answer alike — untouched.
+    for (const id of ['other', 'elsewhere', 'nonexistent']) {
+      await expect(invoke(revokeByToken, context, { ...byToken, params: { id } })).rejects.toThrow()
+    }
+    expect((await context.resource<any>(AUTH_TOKEN_RESOURCE).load('other')).revokedAt).toBeUndefined()
+    expect((await context.resource<any>(AUTH_TOKEN_RESOURCE).load('elsewhere')).revokedAt).toBeUndefined()
+
+    // The option widens only the credential: minting is refused to a token exactly as before.
+    await expect(invoke(createAccessToken, context, { ...byToken, body: { name: 'minted' } })).rejects.toThrow()
+  })
 })