@siduri-x/api 1.0.1 → 1.0.4

package/src/auth.test.ts

@@ -1,6 +1,6 @@
-import { resolveIdentity } from './auth';
+import { resolveIdentity, requireAuth } from './auth';
 
-describe('Auth Identity Resolution', () => {
+describe('Auth Identity Resolution (Single-Owner External Boundary)', () => {
   const originalEnv = process.env;
 
   beforeEach(() => {
@@ -12,46 +12,79 @@ describe('Auth Identity Resolution', () => {
     process.env = originalEnv;
   });
 
-  const mockReq = (token?: string) => ({
+  const mockReq = (token?: string, ip: string = '192.168.1.50') => ({
     headers: {
-      authorization: token ? `Bearer ${token}` : undefined
-    }
+      authorization: token ? `Bearer ${token}` : undefined,
+    },
+    ip,
+    socket: { remoteAddress: ip },
   } as any);
 
-  test('resolves explicit owner token', () => {
-    process.env.OWNER_TOKEN = 'owner-secret';
-    process.env.OPERATOR_TOKEN = 'operator-secret';
+  test('authenticates external request when token matches configured AUTH_TOKEN', () => {
+    process.env.AUTH_TOKEN = 'secret-auth-key';
     process.env.NODE_ENV = 'production';
 
-    const ownerId = resolveIdentity(mockReq('owner-secret'));
-    expect(ownerId.role).toBe('OWNER');
+    const identity = resolveIdentity(mockReq('secret-auth-key'));
+    expect(identity.authenticated).toBe(true);
+    expect(identity.source).toBe('external');
   });
 
-  test('resolves explicit operator token', () => {
+  test('authenticates external request when token matches legacy OWNER_TOKEN', () => {
     process.env.OWNER_TOKEN = 'owner-secret';
-    process.env.OPERATOR_TOKEN = 'operator-secret';
     process.env.NODE_ENV = 'production';
 
-    const opId = resolveIdentity(mockReq('operator-secret'));
-    expect(opId.role).toBe('OPERATOR');
+    const identity = resolveIdentity(mockReq('owner-secret'));
+    expect(identity.authenticated).toBe(true);
+    expect(identity.source).toBe('external');
   });
 
-  test('defaults to viewer when no token is present in production', () => {
+  test('rejects external request when token is missing in production with configured token', () => {
+    process.env.AUTH_TOKEN = 'secret-auth-key';
     process.env.NODE_ENV = 'production';
-    const viewerId = resolveIdentity(mockReq());
-    expect(viewerId.role).toBe('VIEWER');
+
+    const identity = resolveIdentity(mockReq());
+    expect(identity.authenticated).toBe(false);
   });
 
-  test('defaults to viewer for invalid token in production', () => {
+  test('rejects external request for invalid token in production', () => {
+    process.env.AUTH_TOKEN = 'secret-auth-key';
     process.env.NODE_ENV = 'production';
-    const invalidId = resolveIdentity(mockReq('invalid-token'));
-    expect(invalidId.role).toBe('VIEWER');
+
+    const identity = resolveIdentity(mockReq('invalid-token'));
+    expect(identity.authenticated).toBe(false);
   });
 
-  test('resolves development fallback role', () => {
+  test('authenticates local loopback request in development mode', () => {
     process.env.NODE_ENV = 'development';
     process.env.DEV_LOCAL_AUTH_ROLE = 'OWNER';
-    const devId = resolveIdentity(mockReq());
-    expect(devId.role).toBe('OWNER');
+    process.env.AUTH_TOKEN = 'secret-key';
+
+    const devIdentity = resolveIdentity(mockReq(undefined, '127.0.0.1'));
+    expect(devIdentity.authenticated).toBe(true);
+    expect(devIdentity.source).toBe('local');
+  });
+
+  test('requireAuth middleware accepts authenticated request and rejects unauthenticated with 401', () => {
+    process.env.AUTH_TOKEN = 'secret-key';
+    process.env.NODE_ENV = 'production';
+
+    const nextFn = jest.fn();
+    const resUnauthorized = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+    } as any;
+
+    // Unauthorized call
+    requireAuth(mockReq('wrong-token'), resUnauthorized, nextFn);
+    expect(resUnauthorized.status).toHaveBeenCalledWith(401);
+    expect(nextFn).not.toHaveBeenCalled();
+
+    // Authorized call
+    const resAuthorized = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+    } as any;
+    requireAuth(mockReq('secret-key'), resAuthorized, nextFn);
+    expect(nextFn).toHaveBeenCalled();
   });
 });

package/src/auth.ts

@@ -1,49 +1,101 @@
 import { Request, Response, NextFunction } from 'express';
 
-export type Role = 'OWNER' | 'OPERATOR' | 'VIEWER';
+export type Role = 'OWNER' | 'OPERATOR' | 'VIEWER' | 'user' | string;
 
 export interface Identity {
-  role: Role;
+  authenticated: boolean;
+  source: 'local' | 'external';
+  actorId?: string;
+  role?: Role;
+  [key: string]: unknown;
 }
 
+/**
+ * Checks whether an incoming request originates from the local machine loopback interface.
+ */
+export function isLocalRequest(req: Request): boolean {
+  const ip = req.ip || req.socket?.remoteAddress || '';
+  return (
+    ip === '127.0.0.1' ||
+    ip === '::1' ||
+    ip === '::ffff:127.0.0.1' ||
+    ip.endsWith('127.0.0.1') ||
+    ip === 'localhost'
+  );
+}
+
+/**
+ * Resolves request identity according to the single-owner external machine boundary security model.
+ * 
+ * - Security is enforced at the external machine boundary, NOT internally.
+ * - External network requests require a matching token (AUTH_TOKEN / OWNER_TOKEN).
+ * - There are no internal viewer/operator/owner role privileges inside the machine.
+ */
 export function resolveIdentity(req: Request): Identity {
-  const authHeader = req.headers.authorization;
+  const authHeader = req.headers?.authorization;
   const token = authHeader?.startsWith('Bearer ') ? authHeader.split(' ')[1] : undefined;
+  const ownerToken = process.env.AUTH_TOKEN || process.env.API_TOKEN || process.env.OWNER_TOKEN;
+  const operatorToken = process.env.OPERATOR_TOKEN;
+  const configuredToken = ownerToken || operatorToken;
+
+  const local = isLocalRequest(req);
 
   // 1. Explicit token matches
-  if (process.env.OWNER_TOKEN && token === process.env.OWNER_TOKEN) {
-    return { role: 'OWNER' };
+  if (ownerToken && token === ownerToken) {
+    return { authenticated: true, source: local ? 'local' : 'external', role: 'OWNER' };
   }
-  if (process.env.OPERATOR_TOKEN && token === process.env.OPERATOR_TOKEN) {
-    return { role: 'OPERATOR' };
+  if (operatorToken && token === operatorToken) {
+    return { authenticated: true, source: local ? 'local' : 'external', role: 'OPERATOR' };
   }
 
-  // 2. Development fallback
+  // 2. Dev local auth role fallback
   const isDev = process.env.NODE_ENV !== 'production';
   if (isDev && process.env.DEV_LOCAL_AUTH_ROLE) {
     const fallbackRole = process.env.DEV_LOCAL_AUTH_ROLE.toUpperCase() as Role;
-    if (['OWNER', 'OPERATOR', 'VIEWER'].includes(fallbackRole)) {
-      return { role: fallbackRole };
-    }
+    return {
+      authenticated: fallbackRole === 'OWNER' || fallbackRole === 'OPERATOR',
+      source: 'local',
+      role: fallbackRole,
+    };
+  }
+
+  // 3. Default unauthenticated / visitor
+  return { authenticated: false, source: local ? 'local' : 'external', role: 'VIEWER' };
+}
+
+/**
+ * External boundary authentication middleware.
+ * Verifies that requests crossing the external boundary are authorized.
+ */
+export function requireAuth(req: Request, res: Response, next: NextFunction) {
+  const identity = resolveIdentity(req);
+  (req as any).identity = identity;
+
+  if (!identity.authenticated) {
+    return res.status(401).json({ error: 'Unauthorized: missing or invalid authentication token' });
   }
+  next();
+}
 
-  // Default
-  return { role: 'VIEWER' };
+/**
+ * Attaches the resolved machine identity to the request.
+ */
+export function attachIdentity(req: Request, res: Response, next: NextFunction) {
+  (req as any).identity = resolveIdentity(req);
+  next();
 }
 
-export function requireRole(allowedRoles: Role[]) {
+/**
+ * Compatibility alias: in single-owner model, all authenticated callers have full access.
+ */
+export function requireRole(allowedRoles?: Role[]) {
   return (req: Request, res: Response, next: NextFunction) => {
     const identity = resolveIdentity(req);
     (req as any).identity = identity;
-    
-    if (!allowedRoles.includes(identity.role)) {
-      return res.status(403).json({ error: `Forbidden: requires one of ${allowedRoles.join(', ')}` });
+
+    if (!identity.authenticated) {
+      return res.status(403).json({ error: `Forbidden: requires one of ${(allowedRoles || []).join(', ')}` });
     }
     next();
   };
 }
-
-export function attachIdentity(req: Request, res: Response, next: NextFunction) {
-  (req as any).identity = resolveIdentity(req);
-  next();
-}

package/src/context-mapper.test.ts

@@ -1,116 +1,56 @@
 import { mapRequestContext } from './context-mapper';
 
-describe('API Request Context Mapper (P2 & T1-01 to T1-10)', () => {
-  // T1-01: Anonymous public chat, no audience
-  test('T1-01: Anonymous public chat with no audience resolves to configured public audience and no subject', () => {
+describe('API Request Context Mapper (Single-Owner, Single-Machine)', () => {
+  test('Local chat request maps to valid RequestContext with local user defaults', () => {
     const input = {
       companionId: 'companion-a',
-      context: {
-        actor: {
-          actorId: 'anonymous-session-a',
-          sessionId: 'session-a',
-          authorizationRole: 'viewer',
-          capabilities: ['chat:public'],
-          authenticated: false,
-        },
-        conversation: {
-          channel: 'public',
-          correlationId: 'corr-public-a',
-        },
-      },
-      message: 'Hello.',
-      history: [],
+      message: 'Hello world',
+      correlationId: 'corr-local-1',
     };
 
-    const result = mapRequestContext(input, {
-      endpointPolicy: 'public',
-      defaultPublicAudience: 'audience-public',
-    });
+    const result = mapRequestContext(input);
 
     expect(result.accepted).toBe(true);
     expect(result.context?.companionId).toBe('companion-a');
-    expect(result.context?.conversation.channel).toBe('public');
-    expect(result.context?.conversation.audienceId).toBe('audience-public');
-    expect(result.context?.subject).toBeUndefined();
-    expect(result.diagnostics).toContain('audience_defaulted_by_public_policy');
-  });
-
-  // T1-02: OWNER public chat
-  test('T1-02: OWNER public chat maps authorization metadata only with no relationship or private routing', () => {
-    const input = {
-      id: 'companion-a',
-      role: 'OWNER',
-      correlationId: 'corr-owner-public',
-      message: 'Public broadcast message',
-    };
-
-    const result = mapRequestContext(input, { endpointPolicy: 'public' });
-    expect(result.accepted).toBe(true);
-    expect(result.context?.actor.authorizationRole).toBe('administrator');
-    expect(result.context?.conversation.channel).toBe('public');
-    expect(result.context?.conversation.audienceId).toBe('audience-public');
+    expect(result.context?.actor.actorId).toBe('local-user');
+    expect(result.context?.actor.authenticated).toBe(true);
+    expect(result.context?.conversation.correlationId).toBe('corr-local-1');
+    expect(result.context?.source).toBe('local');
     expect(result.context?.subject).toBeUndefined();
-    expect(result.diagnostics).toContain('legacy_role_mapped_to_authorization');
   });
 
-  // T1-03: Private chat without capability
-  test('T1-03: Private chat without capability is rejected before organ invocation', () => {
+  test('Accepts structured context envelope', () => {
     const input = {
       companionId: 'companion-a',
       context: {
         actor: {
-          actorId: 'actor-a',
-          sessionId: 'session-a',
-          authorizationRole: 'viewer',
-          capabilities: ['chat:public'], // Missing 'chat:private'
+          actorId: 'user-main',
+          sessionId: 'session-main',
           authenticated: true,
+          capabilities: ['chat', 'system'],
         },
         conversation: {
-          channel: 'private',
-          audienceId: 'audience-private-a',
-          correlationId: 'corr-private-a',
+          correlationId: 'corr-structured-1',
         },
       },
-      message: 'Show private data',
-    };
-
-    const result = mapRequestContext(input, { endpointPolicy: 'private' });
-    expect(result.accepted).toBe(false);
-    expect(result.error?.code).toBe('UNAUTHORIZED_CHANNEL_OR_CAPABILITY');
-    expect(result.error?.fields).toContain('actor.capabilities');
-  });
-
-  // T1-04: Operator request without operator context
-  test('T1-04: Operator request without operator context is rejected with diagnostic', () => {
-    const input = {
-      id: 'companion-a',
-      role: 'OPERATOR',
-      correlationId: 'corr-op-missing',
+      message: 'Hello structured context',
     };
 
-    const result = mapRequestContext(input, { endpointPolicy: 'operator' });
-    expect(result.accepted).toBe(false);
-    expect(result.error?.code).toBe('MISSING_CONTEXT');
-    expect(result.error?.fields).toEqual(
-      expect.arrayContaining(['conversation.channel', 'conversation.audienceId', 'actor.capabilities'])
-    );
+    const result = mapRequestContext(input);
+    expect(result.accepted).toBe(true);
+    expect(result.context?.actor.actorId).toBe('user-main');
+    expect(result.context?.conversation.correlationId).toBe('corr-structured-1');
   });
 
-  // T1-05: Global primary_user input
-  test('T1-05: Global primary_user input is rejected/quarantined at mapper', () => {
+  test('Rejects global primary_user subject', () => {
     const input = {
       companionId: 'companion-a',
       context: {
         actor: {
-          actorId: 'actor-a',
+          actorId: 'user-a',
           sessionId: 'session-a',
-          authorizationRole: 'viewer',
-          capabilities: ['chat:public'],
-          authenticated: true,
         },
         conversation: {
-          channel: 'public',
-          audienceId: 'audience-public',
           correlationId: 'corr-primary-user',
         },
         subject: {
@@ -126,47 +66,15 @@ describe('API Request Context Mapper (P2 & T1-01 to T1-10)', () => {
     expect(result.error?.field).toBe('subject.subjectId');
   });
 
-  // T1-06: MASTER_PRIVATE in public mode
-  test('T1-06: MASTER_PRIVATE in public mode is rejected with no fallback', () => {
-    const input = {
-      companionId: 'companion-a',
-      context: {
-        actor: {
-          actorId: 'actor-a',
-          sessionId: 'session-a',
-          authorizationRole: 'viewer',
-          capabilities: ['chat:public'],
-          authenticated: false,
-        },
-        conversation: {
-          channel: 'public',
-          audienceId: 'MASTER_PRIVATE',
-          correlationId: 'corr-master-private',
-        },
-      },
-    };
-
-    const result = mapRequestContext(input, { endpointPolicy: 'public' });
-    expect(result.accepted).toBe(false);
-    expect(result.error?.code).toBe('LEGACY_PERSONAL_AUDIENCE');
-    expect(result.error?.field).toBe('audienceId');
-  });
-
-  // T1-07: Missing actor on explicit teaching
-  test('T1-07: Missing actor on explicit teaching produces no durable profile and pending/anonymous context only', () => {
+  test('Rejects missing actor on structured context', () => {
     const input = {
       companionId: 'companion-a',
       context: {
         actor: {
           actorId: '',
           sessionId: 'session-a',
-          authorizationRole: 'viewer',
-          capabilities: ['chat:public'],
-          authenticated: false,
         },
         conversation: {
-          channel: 'public',
-          audienceId: 'audience-public',
           correlationId: 'corr-teach-no-actor',
         },
       },
@@ -178,18 +86,13 @@ describe('API Request Context Mapper (P2 & T1-01 to T1-10)', () => {
     expect(result.error?.fields).toContain('actor.actorId');
   });
 
-  // T1-08: Two companion IDs, same actor remain isolated
-  test('T1-08: Two companion IDs with same actor remain isolated under context mapper', () => {
+  test('Two companion IDs with same actor remain isolated under context mapper', () => {
     const actor = {
-      actorId: 'actor-a',
+      actorId: 'user-a',
       sessionId: 'session-a',
-      authorizationRole: 'viewer' as const,
-      capabilities: ['chat:public'],
       authenticated: true,
     };
     const conv = {
-      channel: 'public' as const,
-      audienceId: 'audience-public',
       correlationId: 'corr-iso-1',
     };
 
@@ -205,21 +108,27 @@ describe('API Request Context Mapper (P2 & T1-01 to T1-10)', () => {
     expect(resB.context?.companionId).toBe('companion-b');
   });
 
-  // T1-09: Missing correlation ID
-  test('T1-09: Missing correlation ID is rejected before stateful operation', () => {
+  test('Rejects missing companionId', () => {
+    const input = {
+      message: 'No companion id',
+      correlationId: 'corr-no-comp',
+    };
+
+    const result = mapRequestContext(input);
+    expect(result.accepted).toBe(false);
+    expect(result.error?.code).toBe('MISSING_CONTEXT');
+    expect(result.error?.fields).toContain('companionId');
+  });
+
+  test('Rejects missing correlation ID when generateCorrelationId is not set', () => {
     const input = {
       companionId: 'companion-a',
       context: {
         actor: {
-          actorId: 'actor-a',
+          actorId: 'user-a',
           sessionId: 'session-a',
-          authorizationRole: 'viewer',
-          capabilities: ['chat:public'],
-          authenticated: true,
         },
         conversation: {
-          channel: 'public',
-          audienceId: 'audience-public',
           correlationId: '',
         },
       },
@@ -231,28 +140,14 @@ describe('API Request Context Mapper (P2 & T1-01 to T1-10)', () => {
     expect(result.error?.fields).toContain('conversation.correlationId');
   });
 
-  // T1-10: Ambiguous legacy request
-  test('T1-10: Ambiguous legacy request emits structured diagnostic and rejects ambiguous mapping', () => {
+  test('Generates correlationId when generateCorrelationId option is true', () => {
     const input = {
       companionId: 'companion-a',
-      role: 'VIEWER',
-      context: {
-        actor: {
-          actorId: 'actor-a',
-          sessionId: 'session-a',
-          authorizationRole: 'viewer',
-          capabilities: ['chat:public'],
-          authenticated: true,
-        },
-        // Role supplied at top level without channel or audience
-      },
+      generateCorrelationId: true,
     };
 
     const result = mapRequestContext(input);
-    expect(result.accepted).toBe(false);
-    expect(result.error?.code).toBe('AMBIGUOUS_CONTEXT');
-    expect(result.error?.conflicts).toEqual(
-      expect.arrayContaining(['role_does_not_select_audience', 'role_does_not_select_subject'])
-    );
+    expect(result.accepted).toBe(true);
+    expect(result.context?.conversation.correlationId).toMatch(/^corr-/);
   });
 });