@stjoseph/prumo 0.2.0 → 0.3.0

package/templates/api/test/infra/http/controllers/auth.controller.spec.ts

@@ -0,0 +1,201 @@
+import { testEnv, testOrm } from '@test/support/setup'
+import type { FastifyInstance, LightMyRequestResponse } from 'fastify'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { createContainer } from '@/infra/di'
+import { buildApp } from '@/infra/http/app'
+
+const ORIGIN = 'http://localhost:5173'
+const BEARER = { 'x-auth-transport': 'bearer' }
+
+let app: FastifyInstance
+
+const account = () => ({
+  name: 'Ana',
+  email: `${crypto.randomUUID()}@example.com`,
+  password: 'correct-horse-battery',
+})
+
+function cookiesOf(response: LightMyRequestResponse): Record<string, string> {
+  return Object.fromEntries(response.cookies.map((cookie) => [cookie.name, cookie.value]))
+}
+
+function setCookie(response: LightMyRequestResponse, name: string) {
+  return response.cookies.find((cookie) => cookie.name === name)
+}
+
+beforeEach(async () => {
+  app = await buildApp(createContainer({ env: testEnv(), orm: testOrm() }))
+})
+
+afterEach(async () => {
+  await app.close()
+})
+
+describe('auth controller, on the web', () => {
+  it('signs up into httpOnly cookies, the refresh one sent only to its route', async () => {
+    const response = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers: { origin: ORIGIN },
+      payload: account(),
+    })
+
+    expect(response.statusCode).toBe(201)
+    expect(response.body).toBe('')
+    expect(setCookie(response, 'access_token')).toMatchObject({
+      httpOnly: true,
+      sameSite: 'Lax',
+      path: '/',
+    })
+    expect(setCookie(response, 'refresh_token')).toMatchObject({
+      httpOnly: true,
+      path: '/api/auth/refresh',
+    })
+  })
+
+  it('reads the session from the cookie, refreshes it, and signs out', async () => {
+    const signUp = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers: { origin: ORIGIN },
+      payload: account(),
+    })
+    const { access_token, refresh_token } = cookiesOf(signUp)
+
+    const session = await app.inject({
+      url: '/api/auth/session',
+      headers: { cookie: `access_token=${access_token}` },
+    })
+    expect(session.json()).toMatchObject({ user: { id: expect.any(String) } })
+
+    const refreshed = await app.inject({
+      method: 'POST',
+      url: '/api/auth/refresh',
+      headers: { cookie: `refresh_token=${refresh_token}`, origin: ORIGIN },
+    })
+    expect(refreshed.statusCode).toBe(204)
+    expect(cookiesOf(refreshed).refresh_token).not.toBe(refresh_token)
+
+    const signOut = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-out',
+      headers: { cookie: `access_token=${cookiesOf(refreshed).access_token}`, origin: ORIGIN },
+    })
+    expect(signOut.statusCode).toBe(204)
+
+    const afterSignOut = await app.inject({
+      method: 'POST',
+      url: '/api/auth/refresh',
+      headers: { cookie: `refresh_token=${cookiesOf(refreshed).refresh_token}`, origin: ORIGIN },
+    })
+    expect(afterSignOut.statusCode).toBe(401)
+  })
+
+  it('refuses a request that leans on a cookie from another origin, or from none', async () => {
+    const signUp = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers: { origin: ORIGIN },
+      payload: account(),
+    })
+    const cookie = `access_token=${cookiesOf(signUp).access_token}`
+
+    for (const headers of [{ cookie, origin: 'https://evil.example' }, { cookie }]) {
+      const response = await app.inject({ method: 'POST', url: '/api/auth/sign-out', headers })
+
+      expect(response.statusCode).toBe(403)
+      expect(response.headers['content-type']).toContain('application/problem+json')
+    }
+  })
+})
+
+describe('auth controller, for a native client', () => {
+  it('hands the tokens over in the body, and accepts them as a bearer', async () => {
+    const signUp = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers: BEARER,
+      payload: account(),
+    })
+    const tokens = signUp.json()
+
+    expect(signUp.statusCode).toBe(201)
+    expect(signUp.cookies).toEqual([])
+    expect(tokens).toEqual({
+      accessToken: expect.any(String),
+      refreshToken: expect.any(String),
+      expiresIn: 900,
+    })
+
+    const session = await app.inject({
+      url: '/api/auth/session',
+      headers: { authorization: `Bearer ${tokens.accessToken}` },
+    })
+    expect(session.statusCode).toBe(200)
+
+    const refreshed = await app.inject({
+      method: 'POST',
+      url: '/api/auth/refresh',
+      headers: BEARER,
+      payload: { refreshToken: tokens.refreshToken },
+    })
+    expect(refreshed.statusCode).toBe(200)
+    expect(refreshed.json().refreshToken).not.toBe(tokens.refreshToken)
+  })
+})
+
+describe('auth controller, refusing', () => {
+  it('answers a wrong password with 401 and a taken email with 409, as problem+json', async () => {
+    const ana = account()
+    await app.inject({ method: 'POST', url: '/api/auth/sign-up', headers: BEARER, payload: ana })
+
+    const wrong = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-in',
+      headers: BEARER,
+      payload: { email: ana.email, password: 'wrong-password' },
+    })
+    const taken = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers: BEARER,
+      payload: ana,
+    })
+
+    expect(wrong.statusCode).toBe(401)
+    expect(wrong.json()).toMatchObject({ detail: 'Invalid email or password' })
+    expect(taken.statusCode).toBe(409)
+    expect(taken.headers['content-type']).toContain('application/problem+json')
+  })
+
+  it('names the fields a sign-up gets wrong', async () => {
+    const response = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers: BEARER,
+      payload: { name: '', email: 'not-an-email', password: 'short' },
+    })
+
+    expect(response.statusCode).toBe(400)
+    expect(Object.keys(response.json().errors).sort()).toEqual(['email', 'name', 'password'])
+  })
+
+  it('slows down repeated sign-in attempts from one address', async () => {
+    const attempt = () =>
+      app.inject({
+        method: 'POST',
+        url: '/api/auth/sign-in',
+        headers: BEARER,
+        payload: { email: 'nobody@example.com', password: 'whatever' },
+      })
+
+    for (let i = 0; i < 10; i += 1) {
+      expect((await attempt()).statusCode).toBe(401)
+    }
+
+    const limited = await attempt()
+
+    expect(limited.statusCode).toBe(429)
+    expect(limited.headers['content-type']).toContain('application/problem+json')
+  })
+})

package/templates/api/test/infra/http/controllers/mcp.controller.spec.ts

@@ -4,11 +4,14 @@ import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/cli
 import { testEnv, testOrm } from '@test/support/setup'
 import type { FastifyInstance } from 'fastify'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { mcpResource } from '@/infra/auth/auth.factory'
+import { InvalidClientError } from '@/domain/oauth/errors/invalid-client.error'
+import { CLIENT_METADATA, type ClientMetadata } from '@/domain/oauth/ports/client-metadata.port'
 import { createContainer } from '@/infra/di'
 import { buildApp } from '@/infra/http/app'
+import { mcpResource } from '@/infra/mcp/mcp.server'
 
 const ORIGIN = 'http://localhost:5173'
+const CLIENT_ID = 'https://client.example.com/oauth/client.json'
 // A web client needs an https redirect off loopback; the test never follows it.
 const REDIRECT = 'https://client.example.com/callback'
 
@@ -24,11 +27,25 @@ function freePort(): Promise<number> {
   })
 }
 
-// requireMcpAuth fetches the JWKS from BETTER_AUTH_URL, so the application listens for real.
+// Stands in for the HTTPS fetch of the client's metadata document, which the adapter's own test covers.
+const clients = {
+  async read(clientId: string): Promise<ClientMetadata> {
+    if (clientId !== CLIENT_ID) {
+      throw new InvalidClientError('Unknown client')
+    }
+
+    return { clientId, clientName: 'Example Client', redirectUris: [REDIRECT] }
+  },
+}
+
+// The SDK's client reaches the MCP route over real HTTP, so the application listens.
 beforeEach(async () => {
   const port = await freePort()
-  env = { ...testEnv(), BETTER_AUTH_URL: `http://127.0.0.1:${port}` }
-  app = await buildApp(createContainer({ env, orm: testOrm() }))
+  env = { ...testEnv(), API_URL: `http://127.0.0.1:${port}` }
+  const container = createContainer({ env, orm: testOrm() })
+
+  container.register(CLIENT_METADATA, { useValue: clients })
+  app = await buildApp(container)
   await app.listen({ port, host: '127.0.0.1' })
 })
 
@@ -39,7 +56,7 @@ afterEach(async () => {
 async function signUp(): Promise<string> {
   const response = await app.inject({
     method: 'POST',
-    url: '/api/auth/sign-up/email',
+    url: '/api/auth/sign-up',
     headers: { origin: ORIGIN },
     payload: {
       name: 'Ana',
@@ -47,63 +64,78 @@ async function signUp(): Promise<string> {
       password: 'correct-horse-battery',
     },
   })
-  const cookies = [response.headers['set-cookie']].flat().filter((c) => c !== undefined)
 
-  return cookies.map((cookie) => cookie.split(';')[0]).join('; ')
+  return response.cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join('; ')
 }
 
-// The path an MCP client takes: register, authorize with PKCE, consent, exchange the code.
-async function accessToken(cookie: string): Promise<string> {
-  const client = await app.inject({
-    method: 'POST',
-    url: '/api/auth/oauth2/create-client',
-    headers: { cookie, origin: ORIGIN },
-    payload: { redirect_uris: [REDIRECT], token_endpoint_auth_method: 'none' },
-  })
-  const clientId = client.json().client_id as string
+function pkce() {
   const verifier = randomBytes(32).toString('base64url')
-  const query = new URLSearchParams({
+
+  return { verifier, challenge: createHash('sha256').update(verifier).digest('base64url') }
+}
+
+function authorizeUrl(
+  overrides: Record<string, string | undefined> = {},
+  challenge = pkce().challenge,
+) {
+  const params = {
     response_type: 'code',
-    client_id: clientId,
+    client_id: CLIENT_ID,
     redirect_uri: REDIRECT,
-    scope: 'openid',
-    state: 'state',
-    code_challenge: createHash('sha256').update(verifier).digest('base64url'),
+    state: 'xyz',
+    code_challenge: challenge,
     code_challenge_method: 'S256',
     resource: mcpResource(env),
+    ...overrides,
+  }
+  const query = new URLSearchParams(
+    Object.entries(params).filter((entry): entry is [string, string] => entry[1] !== undefined),
+  )
+
+  return `/api/oauth/authorize?${query}`
+}
+
+function token(form: Record<string, string>) {
+  return app.inject({
+    method: 'POST',
+    url: '/api/oauth/token',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    payload: new URLSearchParams(form).toString(),
   })
-  const authorize = await app.inject({
-    url: `/api/auth/oauth2/authorize?${query}`,
-    headers: { cookie },
-  })
-  const consentPage = new URL(authorize.headers.location as string)
-  const consent = await app.inject({
+}
+
+// The path an MCP client takes: authorize with PKCE, the user consents on the web, the code becomes tokens.
+async function authorize(cookie: string, accept = true) {
+  const { verifier, challenge } = pkce()
+  const started = await app.inject({ url: authorizeUrl({}, challenge) })
+  const consent = new URL(started.headers.location as string)
+  const id = consent.searchParams.get('request') ?? ''
+  const view = await app.inject({ url: `/api/oauth/authorizations/${id}`, headers: { cookie } })
+  const decision = await app.inject({
     method: 'POST',
-    url: '/api/auth/oauth2/consent',
+    url: `/api/oauth/authorizations/${id}/decision`,
     headers: { cookie, origin: ORIGIN },
-    payload: { accept: true, oauth_query: consentPage.search.slice(1) },
+    payload: { accept },
   })
-  const redirect = new URL(consent.json().url ?? consent.json().redirect_uri)
-  const token = await app.inject({
-    method: 'POST',
-    url: '/api/auth/oauth2/token',
-    headers: { 'content-type': 'application/x-www-form-urlencoded' },
-    payload: new URLSearchParams({
-      grant_type: 'authorization_code',
-      code: redirect.searchParams.get('code') ?? '',
-      redirect_uri: REDIRECT,
-      client_id: clientId,
-      code_verifier: verifier,
-      resource: mcpResource(env),
-    }).toString(),
+
+  return { started, consent, view, redirect: new URL(decision.json().redirectTo), verifier }
+}
+
+async function tokens(cookie: string) {
+  const { redirect, verifier } = await authorize(cookie)
+  const response = await token({
+    grant_type: 'authorization_code',
+    code: redirect.searchParams.get('code') ?? '',
+    redirect_uri: REDIRECT,
+    client_id: CLIENT_ID,
+    code_verifier: verifier,
+    resource: mcpResource(env),
   })
 
-  return token.json().access_token as string
+  return { response, code: redirect.searchParams.get('code') ?? '', verifier }
 }
 
-// The SDK's own client, speaking the real protocol over HTTP.
-async function connect(token: string): Promise<Client> {
-  // The server rejects 2025-era traffic, as Better Auth's MCP profile asks.
+async function connect(accessToken: string): Promise<Client> {
   const client = new Client(
     { name: 'test', version: '1.0.0' },
     { versionNegotiation: { mode: { pin: '2026-07-28' } } },
@@ -111,25 +143,95 @@ async function connect(token: string): Promise<Client> {
 
   await client.connect(
     new StreamableHTTPClientTransport(new URL(mcpResource(env)), {
-      requestInit: { headers: { authorization: `Bearer ${token}` } },
+      requestInit: { headers: { authorization: `Bearer ${accessToken}` } },
     }),
   )
   return client
 }
 
-describe('mcp controller', () => {
-  it('tells an MCP client where to authorize', async () => {
-    const metadata = await app.inject({ url: '/.well-known/oauth-protected-resource' })
+describe('discovery', () => {
+  it('tells an MCP client where to authorize, from the 401 to the server metadata', async () => {
     const refused = await app.inject({ method: 'POST', url: '/api/mcp', payload: {} })
+    const challenge = refused.headers['www-authenticate'] as string
+    const metadataUrl = /resource_metadata="([^"]+)"/.exec(challenge)?.[1] ?? ''
+    const resource = await app.inject({ url: new URL(metadataUrl).pathname })
+    const server = await app.inject({ url: '/.well-known/oauth-authorization-server' })
 
-    expect(metadata.json()).toMatchObject({ resource: mcpResource(env) })
     expect(refused.statusCode).toBe(401)
-    expect(refused.headers['www-authenticate']).toContain('resource_metadata=')
+    expect(resource.json()).toMatchObject({
+      resource: mcpResource(env),
+      authorization_servers: [env.API_URL],
+    })
+    expect(server.json()).toMatchObject({
+      issuer: env.API_URL,
+      code_challenge_methods_supported: ['S256'],
+      client_id_metadata_document_supported: true,
+      authorization_response_iss_parameter_supported: true,
+    })
   })
+})
+
+describe('authorization', () => {
+  it('sends the browser to consent, shows who asks and where the code goes, and returns it with iss', async () => {
+    const { started, consent, view, redirect } = await authorize(await signUp())
 
+    expect(started.statusCode).toBe(302)
+    expect(`${consent.origin}${consent.pathname}`).toBe(`${ORIGIN}/consent`)
+    expect(view.json()).toEqual({
+      clientId: CLIENT_ID,
+      clientName: 'Example Client',
+      clientHost: 'client.example.com',
+      redirectHost: 'client.example.com',
+      redirectsToThisDevice: false,
+    })
+    expect(`${redirect.origin}${redirect.pathname}`).toBe(REDIRECT)
+    expect(redirect.searchParams.get('state')).toBe('xyz')
+    expect(redirect.searchParams.get('iss')).toBe(env.API_URL)
+    expect(redirect.searchParams.get('code')).not.toBeNull()
+  })
+
+  it('answers a denial with access_denied', async () => {
+    const { redirect } = await authorize(await signUp(), false)
+
+    expect(redirect.searchParams.get('error')).toBe('access_denied')
+    expect(redirect.searchParams.get('code')).toBeNull()
+  })
+
+  it('never redirects for an unknown client or an unregistered redirect URI', async () => {
+    for (const overrides of [
+      { client_id: 'https://evil.example.com/client.json' },
+      { redirect_uri: 'https://evil.example.com/callback' },
+    ]) {
+      const response = await app.inject({ url: authorizeUrl(overrides) })
+
+      expect(response.statusCode).toBe(422)
+      expect(response.headers.location).toBeUndefined()
+    }
+  })
+
+  it('sends a known client its error: no PKCE, plain PKCE, another resource', async () => {
+    for (const [overrides, error] of [
+      [{ code_challenge_method: undefined }, 'invalid_request'],
+      [{ code_challenge_method: 'plain' }, 'invalid_request'],
+      [{ resource: 'https://elsewhere.example.com/mcp' }, 'invalid_target'],
+    ] as const) {
+      const response = await app.inject({ url: authorizeUrl(overrides) })
+      const location = new URL(response.headers.location as string)
+
+      expect(location.searchParams.get('error')).toBe(error)
+      expect(location.searchParams.get('state')).toBe('xyz')
+      expect(location.searchParams.get('iss')).toBe(env.API_URL)
+    }
+  })
+})
+
+describe('token', () => {
   it('runs a tool for the user who authorized the client, with public fields only', async () => {
-    const client = await connect(await accessToken(await signUp()))
+    const { response } = await tokens(await signUp())
+    const client = await connect(response.json().access_token)
     const result = await client.callTool({ name: 'get_profile', arguments: {} })
+
+    expect(response.headers['cache-control']).toBe('no-store')
     expect(Object.keys(result.structuredContent ?? {}).sort()).toEqual(
       ['createdAt', 'displayName', 'id', 'locale', 'timezone', 'updatedAt', 'userId'].sort(),
     )
@@ -139,7 +241,8 @@ describe('mcp controller', () => {
   })
 
   it('changes the profile through a tool', async () => {
-    const client = await connect(await accessToken(await signUp()))
+    const { response } = await tokens(await signUp())
+    const client = await connect(response.json().access_token)
     const result = await client.callTool({
       name: 'update_profile',
       arguments: { timezone: 'America/Sao_Paulo' },
@@ -149,4 +252,79 @@ describe('mcp controller', () => {
 
     await client.close()
   })
+
+  it('refuses a wrong verifier, and a code spent twice ends what the first use obtained', async () => {
+    const cookie = await signUp()
+    const { redirect } = await authorize(cookie)
+    const wrong = await token({
+      grant_type: 'authorization_code',
+      code: redirect.searchParams.get('code') ?? '',
+      redirect_uri: REDIRECT,
+      client_id: CLIENT_ID,
+      code_verifier: pkce().verifier,
+    })
+
+    expect(wrong.statusCode).toBe(400)
+    expect(wrong.json().error).toBe('invalid_grant')
+
+    const { response, code, verifier } = await tokens(cookie)
+    const replay = await token({
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: REDIRECT,
+      client_id: CLIENT_ID,
+      code_verifier: verifier,
+    })
+    const refresh = await token({
+      grant_type: 'refresh_token',
+      refresh_token: response.json().refresh_token,
+      client_id: CLIENT_ID,
+    })
+
+    expect(replay.json().error).toBe('invalid_grant')
+    expect(refresh.json().error).toBe('invalid_grant')
+  })
+
+  it('rotates the refresh token, and only for the client it was issued to', async () => {
+    const { response } = await tokens(await signUp())
+    const refreshToken = response.json().refresh_token
+    const otherClient = await token({
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: 'https://other.example.com/client.json',
+    })
+    const rotated = await token({
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: CLIENT_ID,
+    })
+
+    expect(otherClient.json().error).toBe('invalid_grant')
+    expect(rotated.statusCode).toBe(200)
+    expect(rotated.json().refresh_token).not.toBe(refreshToken)
+  })
+
+  it('keeps the MCP token and the application’s tokens apart', async () => {
+    const cookie = await signUp()
+    const { response } = await tokens(cookie)
+    const access = cookie
+      .split('; ')
+      .find((pair) => pair.startsWith('access_token='))
+      ?.slice(13)
+
+    const mcpTokenOnApi = await app.inject({
+      url: '/api/v1/users/me',
+      headers: { authorization: `Bearer ${response.json().access_token}` },
+    })
+    const apiTokenOnMcp = await app.inject({
+      method: 'POST',
+      url: '/api/mcp',
+      headers: { authorization: `Bearer ${access}` },
+      payload: {},
+    })
+
+    expect(mcpTokenOnApi.statusCode).toBe(401)
+    expect(apiTokenOnMcp.statusCode).toBe(401)
+    expect(apiTokenOnMcp.headers['www-authenticate']).toContain('error="invalid_token"')
+  })
 })

package/templates/api/test/infra/http/controllers/users.controller.spec.ts

@@ -11,7 +11,7 @@ let app: FastifyInstance
 async function signUp(): Promise<string[]> {
   const response = await app.inject({
     method: 'POST',
-    url: '/api/auth/sign-up/email',
+    url: '/api/auth/sign-up',
     headers: { origin: ORIGIN },
     payload: {
       name: 'Ana',
@@ -20,7 +20,7 @@ async function signUp(): Promise<string[]> {
     },
   })
 
-  expect(response.statusCode).toBe(200)
+  expect(response.statusCode).toBe(201)
 
   const cookies = response.headers['set-cookie']
   return Array.isArray(cookies) ? cookies : [cookies ?? '']
@@ -94,7 +94,7 @@ describe('users controller', () => {
       headers: { cookie, origin: ORIGIN },
     })
 
-    expect(response.statusCode).toBe(200)
+    expect(response.statusCode).toBe(204)
   })
 
   it('answers an unknown route with 404, not 401', async () => {

package/templates/api/test/infra/oauth/crypto-authorization-codes.adapter.spec.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest'
+import { CryptoAuthorizationCodes } from '@/infra/oauth/crypto-authorization-codes.adapter'
+
+describe('CryptoAuthorizationCodes', () => {
+  // The example in RFC 7636, Appendix B.
+  it('matches the RFC’s own S256 example, and nothing else', () => {
+    const codes = new CryptoAuthorizationCodes()
+    const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'
+
+    expect(codes.matchesChallenge(verifier, 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM')).toBe(
+      true,
+    )
+    expect(codes.matchesChallenge(verifier, verifier)).toBe(false)
+    expect(
+      codes.matchesChallenge(`${verifier}x`, 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'),
+    ).toBe(false)
+  })
+})

package/templates/api/test/infra/oauth/https-client-metadata.adapter.spec.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from 'vitest'
+import { InvalidClientError } from '@/domain/oauth/errors/invalid-client.error'
+import { HttpsClientMetadata, isPrivateAddress } from '@/infra/oauth/https-client-metadata.adapter'
+
+describe('HttpsClientMetadata', () => {
+  it('refuses a client_id that is not a canonical https URL with a path', async () => {
+    const source = new HttpsClientMetadata()
+
+    for (const clientId of [
+      'not a url',
+      'http://client.example.com/client.json',
+      'https://client.example.com',
+      'https://client.example.com/',
+      'https://client.example.com/client.json?x=1',
+      'https://client.example.com/client.json#top',
+      'https://user:pass@client.example.com/client.json',
+      'https://client.example.com/a/../client.json',
+      'https://CLIENT.example.com/client.json',
+    ]) {
+      await expect(source.read(clientId), clientId).rejects.toBeInstanceOf(InvalidClientError)
+    }
+  })
+
+  it('refuses to fetch from this machine or its network, whatever the name says', async () => {
+    const source = new HttpsClientMetadata()
+
+    for (const clientId of [
+      'https://localhost/client.json',
+      'https://127.0.0.1/client.json',
+      'https://10.0.0.1/client.json',
+      'https://[::1]/client.json',
+    ]) {
+      await expect(source.read(clientId), clientId).rejects.toThrow(
+        /private address|could not be read/,
+      )
+    }
+  })
+
+  it('knows the private, loopback, link-local and mapped ranges from public ones', () => {
+    for (const address of [
+      '127.0.0.1',
+      '10.1.2.3',
+      '172.16.0.1',
+      '192.168.1.1',
+      '169.254.169.254',
+      '::1',
+      'fe80::1',
+      'fd00::1',
+      '::ffff:127.0.0.1',
+    ]) {
+      expect(isPrivateAddress(address), address).toBe(true)
+    }
+
+    for (const address of ['8.8.8.8', '1.1.1.1', '2606:4700:4700::1111']) {
+      expect(isPrivateAddress(address), address).toBe(false)
+    }
+  })
+})