@powerhousedao/switchboard 6.2.3-dev.25 → 6.2.3-dev.27

package/test/attachments/url-signer.test.ts

@@ -0,0 +1,105 @@
+import type { AttachmentHash } from "@powerhousedao/reactor";
+import { describe, expect, it } from "vitest";
+import {
+  ATTACHMENT_URL_SIGNING_SECRET_ENV,
+  AttachmentUrlSigner,
+  resolveAttachmentUrlSigning,
+} from "../../src/attachments/url-signer.js";
+
+const HASH = "a".repeat(64) as AttachmentHash;
+const OTHER_HASH = "b".repeat(64) as AttachmentHash;
+const SECRET = "k".repeat(32);
+
+function signed(now: number, ttl = 300) {
+  const signer = new AttachmentUrlSigner(SECRET, () => now);
+  const { query, expiresAtUtc } = signer.sign(HASH, "doc-1", ttl);
+  const params = new URLSearchParams(query);
+  return {
+    signer,
+    expiresAtUtc,
+    documentId: params.get("documentId")!,
+    expires: params.get("expires")!,
+    signature: params.get("signature")!,
+  };
+}
+
+describe("AttachmentUrlSigner", () => {
+  const NOW = Date.parse("2026-09-24T00:00:00.000Z");
+
+  it("verifies what it signed until the expiry", () => {
+    const { signer, expiresAtUtc, documentId, expires, signature } =
+      signed(NOW);
+
+    expect(documentId).toBe("doc-1");
+    expect(expiresAtUtc).toBe(new Date(NOW + 300_000).toISOString());
+    expect(signer.verify(HASH, documentId, expires, signature)).toBe(true);
+  });
+
+  it("refuses at and after the expiry", () => {
+    const { expires, signature } = signed(NOW);
+    const at = new AttachmentUrlSigner(SECRET, () => NOW + 300_000);
+
+    expect(at.verify(HASH, "doc-1", expires, signature)).toBe(false);
+  });
+
+  it("refuses a different hash, document, expiry or secret", () => {
+    const { signer, expires, signature } = signed(NOW);
+
+    expect(signer.verify(OTHER_HASH, "doc-1", expires, signature)).toBe(false);
+    expect(signer.verify(HASH, "doc-2", expires, signature)).toBe(false);
+    expect(
+      signer.verify(HASH, "doc-1", String(Number(expires) + 1), signature),
+    ).toBe(false);
+    expect(
+      new AttachmentUrlSigner("x".repeat(32), () => NOW).verify(
+        HASH,
+        "doc-1",
+        expires,
+        signature,
+      ),
+    ).toBe(false);
+  });
+
+  it("refuses malformed expiry and signature values", () => {
+    const { signer, expires, signature } = signed(NOW);
+
+    expect(signer.verify(HASH, "doc-1", `${expires}.0`, signature)).toBe(false);
+    expect(signer.verify(HASH, "doc-1", expires, `${signature}=`)).toBe(false);
+    expect(signer.verify(HASH, "doc-1", expires, "")).toBe(false);
+  });
+});
+
+describe("resolveAttachmentUrlSigning", () => {
+  it("uses a configured secret", () => {
+    const signing = resolveAttachmentUrlSigning({
+      [ATTACHMENT_URL_SIGNING_SECRET_ENV]: SECRET,
+      NODE_ENV: "production",
+    });
+    expect(signing.status).toBe("configured");
+  });
+
+  it("fails closed in production when unset", () => {
+    expect(resolveAttachmentUrlSigning({ NODE_ENV: "production" })).toEqual({
+      status: "unconfigured",
+    });
+  });
+
+  it.each([undefined, "development", "test"])(
+    "uses a per-process secret when unset and NODE_ENV is %s",
+    (nodeEnv) => {
+      const signing = resolveAttachmentUrlSigning({ NODE_ENV: nodeEnv });
+      expect(signing.status).toBe("ephemeral");
+    },
+  );
+
+  it.each(["short", ` ${"k".repeat(32)}`, ""])(
+    "refuses to boot on an unusable secret %j",
+    (secret) => {
+      expect(() =>
+        resolveAttachmentUrlSigning({
+          [ATTACHMENT_URL_SIGNING_SECRET_ENV]: secret,
+        }),
+      ).toThrow(ATTACHMENT_URL_SIGNING_SECRET_ENV);
+    },
+  );
+});

package/test/workflow/harness.ts

@@ -97,7 +97,7 @@ export async function startWebhookHost(
   // constructing it would test a path no consumer can take.
   const { adapter } = await createHttpAdapter("express");
   adapter.setupMiddleware({});
-  const server = await adapter.listen(0);
+  const server = await adapter.listen(0, undefined, "127.0.0.1");
   const { port } = server.address() as { port: number };
   const url = `http://127.0.0.1:${port}`;
 

package/test/workflow-read-gate.test.ts

@@ -0,0 +1,145 @@
+import {
+  ReactorBuilder,
+  ReactorClientBuilder,
+  type InProcessReactorClientModule,
+} from "@powerhousedao/reactor";
+import { AuthorizationPolicy, type Context } from "@powerhousedao/reactor-api";
+import {
+  initializeAuth,
+  withSignaturePolicy,
+  type DocumentModelModule,
+} from "@powerhousedao/shared/document-model";
+import type { ILogger } from "document-model";
+import { documentModelDocumentModelModule } from "document-model";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { composeWorkflowRuntime } from "../src/workflow-runtime.mjs";
+
+const READER = "0xreader";
+const OUTSIDER = "0xoutsider";
+
+// The host's legacy layer under OPEN admits everyone, anonymous included.
+const openAuthorization = {
+  config: {
+    admins: [],
+    defaultProtection: false,
+    policy: AuthorizationPolicy.OPEN,
+  },
+  isSupremeAdmin: () => true,
+  canRead: () => Promise.resolve(true),
+  canWrite: () => Promise.resolve(true),
+};
+
+const logger = {
+  verbose: vi.fn(),
+  debug: vi.fn(),
+  info: vi.fn(),
+  warn: vi.fn(),
+  error: vi.fn(),
+  child: () => logger,
+} as unknown as ILogger;
+
+const contextFor = (address?: string) =>
+  ({ headers: {}, db: {}, user: address ? { address } : undefined }) as Context;
+
+describe("the workflow runtime's read check", () => {
+  let module: InProcessReactorClientModule | undefined;
+
+  afterEach(() => {
+    module?.reactor.kill();
+    module = undefined;
+  });
+
+  async function hostDeps() {
+    module = await new ReactorClientBuilder()
+      .withReactorBuilder(
+        new ReactorBuilder()
+          .withDocumentModelSources([
+            documentModelDocumentModelModule as unknown as DocumentModelModule,
+          ])
+          .withExecutorConfig({
+            featureFlags: { documentDecisions: true, authEnforcement: true },
+          }),
+      )
+      .buildModule();
+    const client = module.client;
+    const id = "wf-policed";
+    await client.create(
+      withSignaturePolicy(
+        documentModelDocumentModelModule.utils.createDocument(),
+        "legacy",
+        { id },
+      ),
+    );
+    await client.execute(id, "main", [
+      initializeAuth({
+        version: 1,
+        grants: [
+          {
+            id: "g-read",
+            description: "the reader reads the domain",
+            effect: "allow",
+            principal: { address: READER },
+            capability: { can: "read", scope: "global" },
+          },
+          {
+            id: "g-admin",
+            description: "administration stays reachable",
+            effect: "allow",
+            principal: { anyone: true },
+            capability: { can: "execute", scope: "auth" },
+          },
+        ],
+      }),
+    ]);
+
+    const createWorkflowRuntime = vi.fn((_deps: Record<string, unknown>) => ({
+      shutdown: vi.fn(),
+    }));
+    await composeWorkflowRuntime({
+      reactorClient: client,
+      relationalDb: {} as never,
+      attachments: {} as never,
+      authorizationService: openAuthorization as never,
+      logger,
+      load: () =>
+        Promise.resolve({
+          WORKFLOW_PACKAGE_NAME: "@powerhousedao/workflow",
+          setPieceRegistryUrl: vi.fn(),
+          createWorkflowRuntime,
+        } as never),
+    });
+    const [deps] = createWorkflowRuntime.mock.calls[0]!;
+    return {
+      id,
+      deps: deps as {
+        assertCanRead: (id: string, caller: object) => Promise<unknown>;
+        subjectOf: (caller: object) => unknown;
+      },
+    };
+  }
+
+  it("refuses under OPEN a document the caller is not served", async () => {
+    const { id, deps } = await hostDeps();
+
+    await expect(deps.assertCanRead(id, contextFor())).rejects.toThrow();
+    await expect(
+      deps.assertCanRead(id, contextFor(OUTSIDER)),
+    ).rejects.toThrow();
+    await expect(
+      deps.assertCanRead(id, contextFor(READER)),
+    ).resolves.toBeUndefined();
+  });
+
+  it("reads a caller as its own subject, anonymous as the empty one", async () => {
+    const { deps } = await hostDeps();
+
+    expect(deps.subjectOf(contextFor(READER))).toEqual({
+      address: READER,
+      key: undefined,
+    });
+    expect(deps.subjectOf(contextFor())).toEqual({
+      address: undefined,
+      key: undefined,
+    });
+  });
+});