@oxy.so/core 1.18.1 → 3.0.0

package/src/server/__tests__/cors.socket.test.ts

@@ -1,225 +0,0 @@
-/**
- * `createOxyCors` over a REAL socket, plus the two halves of the opaque-origin
- * guard.
- *
- * `cors.test.ts` drives the middleware with a fake `Request`/`Response` pair,
- * which is fine for header bookkeeping but cannot answer the question this
- * suite exists for: what a client actually receives. These tests start an
- * Express app on an ephemeral port and read the response headers off the wire.
- *
- * `node:http` rather than `fetch`: `Origin` is a forbidden header name for
- * `fetch`, so the request under test has to be built by hand.
- */
-
-import http from 'node:http';
-import type { AddressInfo } from 'node:net';
-import express from 'express';
-import { configureLogger, resetLoggerConfig } from '../../logger';
-import type { LogEntry } from '../../logger';
-import { createOxyCors, matchesAllowedOrigin, normalizeAppOrigins } from '../cors';
-import type { OxyCorsOptions } from '../cors';
-
-interface CorsResponse {
-  status: number;
-  allowOrigin: string | undefined;
-  allowCredentials: string | undefined;
-}
-
-/** Start an Express app carrying `createOxyCors(options)` on an ephemeral port. */
-async function startServer(options: OxyCorsOptions): Promise<http.Server> {
-  const app = express();
-  app.use(createOxyCors(options));
-  app.get('/catalogue', (_req, res) => {
-    res.json({ ok: true });
-  });
-  const server = http.createServer(app);
-  await new Promise<void>((resolve) => {
-    server.listen(0, '127.0.0.1', resolve);
-  });
-  return server;
-}
-
-async function stopServer(server: http.Server): Promise<void> {
-  await new Promise<void>((resolve, reject) => {
-    server.close((error) => (error ? reject(error) : resolve()));
-  });
-}
-
-/** Issue a real request carrying `Origin` and read the CORS headers back. */
-function requestWithOrigin(
-  server: http.Server,
-  method: 'GET' | 'OPTIONS',
-  origin: string,
-): Promise<CorsResponse> {
-  const { port } = server.address() as AddressInfo;
-  return new Promise((resolve, reject) => {
-    const req = http.request(
-      {
-        host: '127.0.0.1',
-        port,
-        method,
-        path: '/catalogue',
-        headers: { Origin: origin, 'Access-Control-Request-Method': 'GET' },
-      },
-      (res) => {
-        res.resume();
-        res.on('end', () => {
-          resolve({
-            status: res.statusCode ?? 0,
-            allowOrigin: res.headers['access-control-allow-origin'],
-            allowCredentials: res.headers['access-control-allow-credentials'],
-          });
-        });
-        res.on('error', reject);
-      },
-    );
-    req.on('error', reject);
-    req.end();
-  });
-}
-
-/**
- * The exact shape that was live: one custom-scheme entry alongside ordinary
- * ones. Every origin below normalizes to the opaque origin, so before the fix
- * the `exp://` entry admitted all of them.
- */
-const CONFIGURED_WITH_OPAQUE_ENTRY = ['https://app.example.com', 'exp://localhost:8150'];
-const OTHER_OPAQUE_SCHEME_ORIGINS = [
-  'vscode-webview://abc123',
-  'capacitor://localhost',
-  'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-  'file://',
-];
-
-describe('createOxyCors over a real socket', () => {
-  let server: http.Server;
-
-  beforeAll(async () => {
-    // The dropped entry logs at error level by design; that log is asserted in
-    // the configure-side suite below. Swallow it here so this suite's output
-    // carries only its own failures.
-    configureLogger({ sink: () => undefined });
-    server = await startServer({ appOrigins: CONFIGURED_WITH_OPAQUE_ENTRY });
-    resetLoggerConfig();
-  });
-
-  afterAll(async () => {
-    await stopServer(server);
-  });
-
-  it('POSITIVE CONTROL: a configured https origin gets its headers over the wire', async () => {
-    for (const method of ['GET', 'OPTIONS'] as const) {
-      const res = await requestWithOrigin(server, method, 'https://app.example.com');
-      expect(res.allowOrigin).toBe('https://app.example.com');
-      expect(res.allowCredentials).toBe('true');
-    }
-  });
-
-  it('POSITIVE CONTROL: the built-in Oxy apex family still gets its headers', async () => {
-    const res = await requestWithOrigin(server, 'GET', 'https://auth.oxy.so');
-    expect(res.allowOrigin).toBe('https://auth.oxy.so');
-    expect(res.allowCredentials).toBe('true');
-  });
-
-  it('a custom-scheme origin is NOT admitted by a custom-scheme allowlist entry', async () => {
-    for (const origin of OTHER_OPAQUE_SCHEME_ORIGINS) {
-      for (const method of ['GET', 'OPTIONS'] as const) {
-        const res = await requestWithOrigin(server, method, origin);
-        expect(res.allowOrigin).toBeUndefined();
-        expect(res.allowCredentials).toBeUndefined();
-      }
-    }
-  });
-
-  it('the opaque-origin entry does not admit even ITSELF', async () => {
-    const res = await requestWithOrigin(server, 'GET', 'exp://localhost:8150');
-    expect(res.allowOrigin).toBeUndefined();
-    expect(res.allowCredentials).toBeUndefined();
-  });
-
-  it('NEGATIVE CONTROL: a literal `Origin: null` is refused, as it always was', async () => {
-    const res = await requestWithOrigin(server, 'GET', 'null');
-    expect(res.allowOrigin).toBeUndefined();
-    expect(res.allowCredentials).toBeUndefined();
-  });
-
-  it('NEGATIVE CONTROL: an unrelated https origin is refused', async () => {
-    const res = await requestWithOrigin(server, 'GET', 'https://evil.example.com');
-    expect(res.allowOrigin).toBeUndefined();
-    expect(res.allowCredentials).toBeUndefined();
-  });
-});
-
-/**
- * The CONFIGURE-SIDE half. Its behavioural effect is masked by the match-side
- * half — with both in place, deleting this one changes no response — so what
- * this suite asserts is the observable the drop-rather-than-throw decision
- * rests on: the entry is named in an error log, and nothing else stops.
- */
-describe('normalizeAppOrigins (configure side)', () => {
-  let entries: LogEntry[];
-
-  beforeEach(() => {
-    entries = [];
-    configureLogger({ sink: (entry) => entries.push(entry) });
-  });
-
-  afterEach(() => {
-    resetLoggerConfig();
-  });
-
-  it('drops an opaque-origin entry from the set and names it in an error log', () => {
-    const explicit = normalizeAppOrigins(CONFIGURED_WITH_OPAQUE_ENTRY);
-
-    expect([...explicit]).toEqual(['https://app.example.com']);
-    expect(explicit.has('null')).toBe(false);
-
-    const dropped = entries.filter((entry) => entry.level === 'error');
-    expect(dropped).toHaveLength(1);
-    expect(dropped[0]?.context?.entry).toBe('exp://localhost:8150');
-    expect(dropped[0]?.message).toContain('no origin to match against');
-  });
-
-  it('drops an entry that is not a URL at all, separately named', () => {
-    const explicit = normalizeAppOrigins(['not a url', 'https://app.example.com']);
-
-    expect([...explicit]).toEqual(['https://app.example.com']);
-    const dropped = entries.filter((entry) => entry.level === 'error');
-    expect(dropped).toHaveLength(1);
-    expect(dropped[0]?.context?.entry).toBe('not a url');
-    expect(dropped[0]?.message).toContain('not a URL');
-  });
-
-  it('VACUITY FLOOR: a wholly valid list is dropped from silently', () => {
-    const explicit = normalizeAppOrigins(['https://app.example.com', 'http://localhost:3000']);
-
-    expect([...explicit].sort()).toEqual(['http://localhost:3000', 'https://app.example.com']);
-    expect(entries.filter((entry) => entry.level === 'error')).toHaveLength(0);
-  });
-});
-
-/**
- * The MATCH-SIDE half, driven with the hostile precondition the configure side
- * prevents: a set that already contains the opaque origin. This is the only
- * way to observe this half — through `createOxyCors` it is unreachable, so a
- * test there would measure `normalizeAppOrigins` and report on this.
- */
-describe('matchesAllowedOrigin (match side)', () => {
-  const poisoned: ReadonlySet<string> = new Set(['null', 'https://app.example.com']);
-
-  it('refuses every opaque-scheme origin even against a set containing "null"', () => {
-    for (const origin of [...OTHER_OPAQUE_SCHEME_ORIGINS, 'exp://localhost:8150']) {
-      expect(matchesAllowedOrigin(poisoned, origin)).toBe(false);
-    }
-  });
-
-  it('POSITIVE CONTROL: the same poisoned set still matches its real entry', () => {
-    expect(matchesAllowedOrigin(poisoned, 'https://app.example.com')).toBe(true);
-    expect(matchesAllowedOrigin(poisoned, 'https://auth.oxy.so')).toBe(true);
-    expect(matchesAllowedOrigin(poisoned, 'https://evil.example.com')).toBe(false);
-  });
-
-  it('NEGATIVE CONTROL: a literal `null` never reaches the set lookup either', () => {
-    expect(matchesAllowedOrigin(poisoned, 'null')).toBe(false);
-  });
-});

package/src/server/__tests__/cors.test.ts

@@ -1,158 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { createOxyCors } from '../cors';
-
-interface FakeResponse extends Response {
-  __headers: Record<string, string>;
-  __statusSent: number | null;
-}
-
-function makeRequest(method: string, origin?: string, acrHeaders?: string): Request {
-  const headers: Record<string, string> = {};
-  if (origin !== undefined) headers.origin = origin;
-  if (acrHeaders !== undefined) headers['access-control-request-headers'] = acrHeaders;
-  return { method, headers } as unknown as Request;
-}
-
-function makeResponse(): FakeResponse {
-  const res = {
-    __headers: {},
-    __statusSent: null,
-  } as FakeResponse;
-  res.setHeader = jest.fn((name: string, value: string | number | readonly string[]) => {
-    res.__headers[name] = String(value);
-    return res;
-  }) as unknown as Response['setHeader'];
-  res.sendStatus = jest.fn((code: number) => {
-    res.__statusSent = code;
-    return res;
-  }) as unknown as Response['sendStatus'];
-  return res;
-}
-
-function makeNext(): NextFunction & jest.Mock {
-  return jest.fn() as unknown as NextFunction & jest.Mock;
-}
-
-describe('@oxy.so/core/server createOxyCors', () => {
-  it('allows the HTTPS Oxy apex family (apex + one-level subdomains) and echoes the exact origin', () => {
-    const mw = createOxyCors();
-    for (const origin of [
-      'https://oxy.so',
-      'https://auth.oxy.so',
-      'https://api.oxy.so',
-      'https://accounts.oxy.so',
-      'https://console.oxy.so',
-      'https://inbox.oxy.so',
-    ]) {
-      const req = makeRequest('GET', origin);
-      const res = makeResponse();
-      const next = makeNext();
-      mw(req, res, next);
-      expect(res.__headers['Access-Control-Allow-Origin']).toBe(origin);
-      expect(res.__headers['Access-Control-Allow-Credentials']).toBe('true');
-      expect(res.__headers.Vary).toBe('Origin');
-      expect(next).toHaveBeenCalledTimes(1);
-    }
-  });
-
-  it('allows explicit appOrigins', () => {
-    const mw = createOxyCors({ appOrigins: ['https://app.example.com', 'http://localhost:3000'] });
-    for (const origin of ['https://app.example.com', 'http://localhost:3000']) {
-      const req = makeRequest('GET', origin);
-      const res = makeResponse();
-      const next = makeNext();
-      mw(req, res, next);
-      expect(res.__headers['Access-Control-Allow-Origin']).toBe(origin);
-      expect(next).toHaveBeenCalledTimes(1);
-    }
-  });
-
-  it('DENIES other origins — never reflects them, never wildcards', () => {
-    const mw = createOxyCors({ appOrigins: ['https://app.example.com'] });
-    for (const origin of [
-      'https://evil.com',
-      'https://oxy.so.evil.com', // suffix attack
-      'https://notoxy.so', // different apex
-      'https://example.com',
-      'http://oxy.so',
-      'http://auth.oxy.so',
-      'https://deep.attacker-controlled.oxy.so',
-      'https://api.oxy.so:8443',
-    ]) {
-      const req = makeRequest('GET', origin);
-      const res = makeResponse();
-      const next = makeNext();
-      mw(req, res, next);
-      expect(res.__headers['Access-Control-Allow-Origin']).toBeUndefined();
-      expect(res.__headers['Access-Control-Allow-Origin']).not.toBe('*');
-      expect(res.__headers['Access-Control-Allow-Origin']).not.toBe(origin);
-      // request still passes to the app; the browser enforces the missing ACAO.
-      expect(next).toHaveBeenCalledTimes(1);
-    }
-  });
-
-  it('NEVER emits wildcard ACAO together with credentials', () => {
-    const mw = createOxyCors({ allowCredentials: true });
-    // Even an allowed origin gets the exact origin, never '*'.
-    const req = makeRequest('GET', 'https://auth.oxy.so');
-    const res = makeResponse();
-    mw(req, res, makeNext());
-    expect(res.__headers['Access-Control-Allow-Origin']).toBe('https://auth.oxy.so');
-    expect(res.__headers['Access-Control-Allow-Origin']).not.toBe('*');
-    expect(res.__headers['Access-Control-Allow-Credentials']).toBe('true');
-  });
-
-  it('answers preflight (OPTIONS) for an allowed origin with 204 + method/header allows', () => {
-    const mw = createOxyCors({ appOrigins: ['https://app.example.com'] });
-    const req = makeRequest('OPTIONS', 'https://app.example.com', 'content-type, authorization');
-    const res = makeResponse();
-    const next = makeNext();
-    mw(req, res, next);
-    expect(res.__headers['Access-Control-Allow-Origin']).toBe('https://app.example.com');
-    expect(res.__headers['Access-Control-Allow-Methods']).toContain('GET');
-    expect(res.__headers['Access-Control-Allow-Headers']).toBe('content-type, authorization');
-    expect(res.__headers['Access-Control-Max-Age']).toBeDefined();
-    expect(res.__statusSent).toBe(204);
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('includes anonymous activity metadata in the default preflight headers', () => {
-    const mw = createOxyCors({ appOrigins: ['https://app.example.com'] });
-    const req = makeRequest('OPTIONS', 'https://app.example.com');
-    const res = makeResponse();
-    mw(req, res, makeNext());
-
-    expect(res.__headers['Access-Control-Allow-Headers']).toContain('X-Oxy-Edge-Region');
-    expect(res.__headers['Access-Control-Allow-Headers']).toContain('X-Oxy-Activity-Id');
-  });
-
-  it('answers preflight for a DENIED origin with 204 and NO CORS headers', () => {
-    const mw = createOxyCors();
-    const req = makeRequest('OPTIONS', 'https://evil.com');
-    const res = makeResponse();
-    const next = makeNext();
-    mw(req, res, next);
-    expect(res.__headers['Access-Control-Allow-Origin']).toBeUndefined();
-    expect(res.__statusSent).toBe(204);
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('passes through same-origin / non-browser requests (no Origin header) without ACAO', () => {
-    const mw = createOxyCors();
-    const req = makeRequest('GET');
-    const res = makeResponse();
-    const next = makeNext();
-    mw(req, res, next);
-    expect(res.__headers['Access-Control-Allow-Origin']).toBeUndefined();
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-
-  it('can disable credentials and still never wildcards', () => {
-    const mw = createOxyCors({ allowCredentials: false });
-    const req = makeRequest('GET', 'https://api.oxy.so');
-    const res = makeResponse();
-    mw(req, res, makeNext());
-    expect(res.__headers['Access-Control-Allow-Origin']).toBe('https://api.oxy.so');
-    expect(res.__headers['Access-Control-Allow-Credentials']).toBeUndefined();
-  });
-});

package/src/server/__tests__/rateLimit.test.ts

@@ -1,257 +0,0 @@
-import type { NextFunction, Request, RequestHandler, Response } from 'express';
-import type { OxyServices } from '../../OxyServices';
-
-const rateLimitMock = jest.fn();
-
-jest.mock('express-rate-limit', () => ({
-  __esModule: true,
-  default: (...args: unknown[]) => rateLimitMock(...args),
-}));
-
-import { createOxyRateLimit } from '../rateLimit';
-
-interface CapturedRateLimitOptions {
-  max: (req: Request) => number;
-  keyGenerator: (req: Request) => string;
-  skip: (req: Request) => boolean;
-}
-
-interface RateLimitTestRequest extends Request {
-  userId?: string | null;
-  user?: { id?: string; _id?: string } | null;
-  sessionId?: string | null;
-  serviceApp?: { appId?: string } | null;
-  serviceActingAs?: { userId?: string } | null;
-  observedMax?: number;
-  observedKey?: string;
-}
-
-const HEX24 = /^[0-9a-f]{24}$/;
-
-function makeOxy(authHandler: RequestHandler): OxyServices {
-  return {
-    auth: jest.fn(() => authHandler),
-  } as unknown as OxyServices;
-}
-
-function makeRequest(overrides: Partial<RateLimitTestRequest> = {}): RateLimitTestRequest {
-  const ip = overrides.ip ?? '203.0.113.9';
-  return {
-    method: 'GET',
-    path: '/api/test',
-    ip,
-    socket: { remoteAddress: ip },
-    ...overrides,
-  } as RateLimitTestRequest;
-}
-
-/** Run the anonymous limiter for a bare IP and return the store key it produced. */
-function keyForIp(ip: string): string {
-  const oxy = makeOxy((_req: Request, _res: Response, next: NextFunction) => next());
-  const req = makeRequest({ ip });
-  createOxyRateLimit(oxy)(req, {} as Response, jest.fn());
-  if (typeof req.observedKey !== 'string') {
-    throw new Error('key generator did not run');
-  }
-  return req.observedKey;
-}
-
-describe('@oxy.so/core/server rate limiter', () => {
-  const originalEnv = {
-    IP_HASH_SALT: process.env.IP_HASH_SALT,
-    DEVICE_ID_SALT: process.env.DEVICE_ID_SALT,
-  };
-
-  beforeEach(() => {
-    // Isolate salt resolution from any ambient env so key assertions are deterministic.
-    delete process.env.IP_HASH_SALT;
-    delete process.env.DEVICE_ID_SALT;
-    rateLimitMock.mockImplementation((options: CapturedRateLimitOptions) => {
-      return (req: RateLimitTestRequest, _res: Response, next: NextFunction) => {
-        req.observedMax = options.max(req);
-        req.observedKey = options.keyGenerator(req);
-        next();
-      };
-    });
-  });
-
-  afterEach(() => {
-    jest.clearAllMocks();
-    if (originalEnv.IP_HASH_SALT === undefined) delete process.env.IP_HASH_SALT;
-    else process.env.IP_HASH_SALT = originalEnv.IP_HASH_SALT;
-    if (originalEnv.DEVICE_ID_SALT === undefined) delete process.env.DEVICE_ID_SALT;
-    else process.env.DEVICE_ID_SALT = originalEnv.DEVICE_ID_SALT;
-  });
-
-  it('does not trust locally decoded non-session JWT identities for quota or bucket keys', () => {
-    const oxy = makeOxy((req: RateLimitTestRequest, _res: Response, next: NextFunction) => {
-      req.userId = 'attacker-controlled-user';
-      req.user = { id: 'attacker-controlled-user' };
-      next();
-    });
-    const req = makeRequest();
-    const next = jest.fn();
-
-    createOxyRateLimit(oxy, { authenticatedMax: 5000, anonymousMax: 600 })(
-      req,
-      {} as Response,
-      next,
-    );
-
-    expect(req.observedMax).toBe(600);
-    // Anonymous callers are bucketed by a hashed key, NEVER the raw IP.
-    expect(req.observedKey).toMatch(HEX24);
-    expect(req.observedKey).not.toContain('203.0.113.9');
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-
-  it('uses authenticated quota and per-user keys for server-validated sessions', () => {
-    const oxy = makeOxy((req: RateLimitTestRequest, _res: Response, next: NextFunction) => {
-      req.userId = 'validated-user';
-      req.user = { id: 'validated-user' };
-      req.sessionId = 'validated-session';
-      next();
-    });
-    const req = makeRequest();
-
-    createOxyRateLimit(oxy, { authenticatedMax: 5000, anonymousMax: 600 })(
-      req,
-      {} as Response,
-      jest.fn(),
-    );
-
-    expect(req.observedMax).toBe(5000);
-    // Authenticated identities are keyed by the user id verbatim — NOT hashed.
-    expect(req.observedKey).toBe('user:validated-user');
-  });
-
-  it('does not clobber an identity a preceding middleware already resolved', () => {
-    // The limiter mutates the SHARED `req`, so the unconditional
-    // `req.userId = null` that `oxy.auth({ optional: true })` writes for every
-    // request it cannot authenticate is not merely a bucketing detail — it
-    // erases the identity for every handler downstream of the limiter too.
-    // The resolver must therefore skip entirely when a user is already present.
-    // This handler stands in for that erasure.
-    const clobberingAuth = jest.fn(
-      (req: RateLimitTestRequest, _res: Response, next: NextFunction) => {
-        req.userId = null;
-        req.user = null;
-        req.sessionId = null;
-        next();
-      },
-    );
-    const oxy = makeOxy(clobberingAuth as unknown as RequestHandler);
-    const req = makeRequest({
-      userId: 'resolved-by-the-app',
-      user: { id: 'resolved-by-the-app' },
-      sessionId: 'app-session',
-    });
-
-    createOxyRateLimit(oxy)(req, {} as Response, jest.fn());
-
-    expect(req.userId).toBe('resolved-by-the-app');
-    expect(req.user).toEqual({ id: 'resolved-by-the-app' });
-    expect(req.sessionId).toBe('app-session');
-    expect(req.observedKey).toBe('user:resolved-by-the-app');
-    expect(clobberingAuth).not.toHaveBeenCalled();
-  });
-
-  it('still resolves the session when no identity is present yet', () => {
-    const authHandler = jest.fn((req: RateLimitTestRequest, _res: Response, next: NextFunction) => {
-      req.userId = 'resolved-by-oxy';
-      req.user = { id: 'resolved-by-oxy' };
-      req.sessionId = 'oxy-session';
-      next();
-    });
-    const oxy = makeOxy(authHandler as unknown as RequestHandler);
-    const req = makeRequest();
-
-    createOxyRateLimit(oxy)(req, {} as Response, jest.fn());
-
-    expect(authHandler).toHaveBeenCalledTimes(1);
-    expect(req.observedKey).toBe('user:resolved-by-oxy');
-  });
-
-  it('continues through the anonymous limiter if optional auth returns an error', () => {
-    const oxy = makeOxy((_req: Request, _res: Response, next: NextFunction) => {
-      next(new Error('token rejected'));
-    });
-    const req = makeRequest();
-    const next = jest.fn();
-
-    createOxyRateLimit(oxy, { authenticatedMax: 5000, anonymousMax: 600 })(
-      req,
-      {} as Response,
-      next,
-    );
-
-    expect(req.observedMax).toBe(600);
-    expect(req.observedKey).toMatch(HEX24);
-    expect(req.observedKey).not.toContain('203.0.113.9');
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-
-  describe('anonymous key hashing', () => {
-    it('produces a deterministic 24-hex key that never contains the raw IP', () => {
-      const first = keyForIp('203.0.113.9');
-      const second = keyForIp('203.0.113.9');
-
-      expect(first).toMatch(HEX24);
-      expect(first).toBe(second);
-      expect(first).not.toContain('203.0.113.9');
-    });
-
-    it('produces different keys for different IPv4 addresses', () => {
-      expect(keyForIp('203.0.113.9')).not.toBe(keyForIp('198.51.100.7'));
-    });
-
-    it('buckets IPv6 addresses in the same /56 to the same key', () => {
-      // 2001:db8:abcd:ee11 and 2001:db8:abcd:eeff share the /56 prefix (top byte of
-      // the 4th hextet is 0xee for both); the differing bits are host bits.
-      const a = keyForIp('2001:db8:abcd:ee11::1');
-      const b = keyForIp('2001:db8:abcd:eeff::9999');
-
-      expect(a).toMatch(HEX24);
-      expect(a).toBe(b);
-    });
-
-    it('produces different keys for IPv6 addresses in different /56 prefixes', () => {
-      const sameFiftySix = keyForIp('2001:db8:abcd:ee11::1');
-      const otherFiftySix = keyForIp('2001:db8:abcd:ff11::1');
-
-      expect(sameFiftySix).not.toBe(otherFiftySix);
-    });
-
-    it('salts the hash with IP_HASH_SALT so keys are not portable across salts', () => {
-      const unsalted = keyForIp('203.0.113.9');
-
-      process.env.IP_HASH_SALT = 'salt-a';
-      const saltedA = keyForIp('203.0.113.9');
-
-      process.env.IP_HASH_SALT = 'salt-b';
-      const saltedB = keyForIp('203.0.113.9');
-
-      expect(saltedA).toMatch(HEX24);
-      expect(saltedA).not.toBe(unsalted);
-      expect(saltedB).not.toBe(saltedA);
-    });
-
-    it('prefers IP_HASH_SALT over DEVICE_ID_SALT', () => {
-      process.env.DEVICE_ID_SALT = 'device-salt';
-      const deviceOnly = keyForIp('203.0.113.9');
-
-      process.env.IP_HASH_SALT = 'ip-salt';
-      const ipPreferred = keyForIp('203.0.113.9');
-
-      expect(ipPreferred).not.toBe(deviceOnly);
-    });
-
-    it('falls back to the literal "unknown" key when no IP is resolvable', () => {
-      const oxy = makeOxy((_req: Request, _res: Response, next: NextFunction) => next());
-      const req = makeRequest({ ip: undefined, socket: {} as Request['socket'] });
-      createOxyRateLimit(oxy)(req, {} as Response, jest.fn());
-
-      expect(req.observedKey).toBe('unknown');
-    });
-  });
-});