@tuturuuu/utils 0.29.1 → 0.30.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.30.0](https://github.com/tutur3u/platform/compare/utils-v0.29.1...utils-v0.30.0) (2026-09-25)
+
+
+### Features
+
+* **auth:** enforce required account MFA lifecycle ([e08f27d](https://github.com/tutur3u/platform/commit/e08f27dbc082f7d9c951bb0792357638f3dcfb0a)) ([#5448](https://github.com/tutur3u/platform/issues/5448)) ([d7a5ed4](https://github.com/tutur3u/platform/commit/d7a5ed453963e619bd1dc3bd8c8a18c5e027317c))
+* **parley:** add private multiplayer training and shared AI Hub billing ([#5505](https://github.com/tutur3u/platform/issues/5505)) ([038e05c](https://github.com/tutur3u/platform/commit/038e05c69a0e4a080f62d6441ae4dd2b15721dba))
+* **parley:** share Meet runtime and integrate private training with AI Hub billing ([66d40e2](https://github.com/tutur3u/platform/commit/66d40e23a8110bd43be652e1181205cf50e506ab))
+
 ## [0.29.1](https://github.com/tutur3u/platform/compare/utils-v0.29.0...utils-v0.29.1) (2026-09-23)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.29.1",
+  "version": "0.30.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.31.3",
     "@tuturuuu/google": "0.1.1",
     "@tuturuuu/icons": "0.1.1",
-    "@tuturuuu/internal-api": "0.40.0",
+    "@tuturuuu/internal-api": "0.41.0",
     "@tuturuuu/supabase": "0.5.2",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.4",
@@ -45,7 +45,7 @@
     "zod": "^4.6.2"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.31.0",
+    "@tuturuuu/types": "0.32.0",
     "@tuturuuu/typescript-config": "0.1.2",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.5.1",

package/src/__tests__/ai-temp-auth.test.ts

@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 const mocks = vi.hoisted(() => ({
   getRedis: vi.fn(),
+  assurance: vi.fn(),
   redis: {
     decr: vi.fn(),
     del: vi.fn(),
@@ -13,6 +14,10 @@ const mocks = vi.hoisted(() => ({
   },
 }));
 
+vi.mock('../required-mfa-app-session', () => ({
+  isRequiredMfaProofAllowed: (...args: unknown[]) => mocks.assurance(...args),
+}));
+
 vi.mock('../upstash-rest.js', () => ({
   getUpstashRestRedisClient: () => mocks.getRedis(),
 }));
@@ -20,6 +25,7 @@ vi.mock('../upstash-rest.js', () => ({
 describe('ai temp auth', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mocks.assurance.mockResolvedValue(true);
     mocks.getRedis.mockResolvedValue(mocks.redis);
     mocks.redis.get.mockResolvedValue('0');
     mocks.redis.set.mockResolvedValue('OK');
@@ -29,6 +35,31 @@ describe('ai temp auth', () => {
     mocks.redis.del.mockResolvedValue(1);
   });
 
+  it('uses normal session auth instead of cached tokens for required accounts', async () => {
+    const { mintAiTempAuthToken } = await import('../ai-temp-auth.js');
+    mocks.assurance.mockResolvedValue(false);
+    expect(await mintAiTempAuthToken({ user: { id: 'required' } })).toBeNull();
+    expect(mocks.redis.set).not.toHaveBeenCalled();
+  });
+
+  it('invalidates an existing cached identity immediately after policy changes', async () => {
+    const { mintAiTempAuthToken, validateAiTempAuthRequest } = await import(
+      '../ai-temp-auth.js'
+    );
+    const minted = await mintAiTempAuthToken({ user: { id: 'actor' } });
+    const payload = mocks.redis.set.mock.calls[0]![1];
+    mocks.redis.get.mockImplementation(async (key: string) =>
+      key.startsWith('ai:temp-auth:token:') ? payload : '0'
+    );
+    mocks.assurance.mockResolvedValue(false);
+    const request = { headers: new Headers() };
+    const { AI_TEMP_AUTH_HEADER } = await import('../ai-temp-auth.js');
+    request.headers.set(AI_TEMP_AUTH_HEADER, minted!.token);
+    expect(await validateAiTempAuthRequest(request)).toEqual({
+      status: 'revoked',
+    });
+  });
+
   it('mints a 60-second token and stores only its digest in Redis', async () => {
     const { mintAiTempAuthToken } = await import('../ai-temp-auth.js');
 
@@ -159,6 +190,7 @@ describe('ai temp auth', () => {
 describe('ai credit snapshots', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mocks.assurance.mockResolvedValue(true);
     mocks.getRedis.mockResolvedValue(mocks.redis);
     mocks.redis.get.mockResolvedValue(null);
     mocks.redis.set.mockResolvedValue('OK');

package/src/__tests__/api-proxy-guard.test.ts

@@ -1,3 +1,7 @@
+vi.mock('../required-mfa-runtime', () => ({
+  enforceRequiredMfaRequest: async () => null,
+}));
+
 import { NextRequest } from 'next/server';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
@@ -134,7 +138,6 @@ describe('guardApiProxyRequest', () => {
       }),
       { prefixBase: 'proxy:test:api' }
     );
-
     expect(response?.status).toBe(413);
     expect(mocks.extractIp).not.toHaveBeenCalled();
   });
@@ -147,13 +150,11 @@ describe('guardApiProxyRequest', () => {
       { 'content-type': 'application/json' },
       JSON.stringify({ value: 'x'.repeat(1024 * 1024) })
     );
-
     expect(request.headers.get('content-length')).toBeNull();
 
     const response = await guardApiProxyRequest(request, {
       prefixBase: 'proxy:test:api',
     });
-
     expect(response?.status).toBe(413);
     expect(mocks.extractIp).not.toHaveBeenCalled();
     expect(mocks.validateEmoji).not.toHaveBeenCalled();
@@ -172,7 +173,6 @@ describe('guardApiProxyRequest', () => {
         skipContentValidation: true,
       }
     );
-
     expect(response).toBeNull();
     expect(mocks.validateEmoji).not.toHaveBeenCalled();
 
@@ -207,7 +207,6 @@ describe('guardApiProxyRequest', () => {
         prefixBase: 'proxy:test:api',
       }
     );
-
     expect(response?.status).toBe(429);
     expect(response?.headers.get('X-Proxy-Block-Reason')).toBe(
       'ip-already-blocked'

package/src/__tests__/app-url.test.ts

@@ -287,6 +287,7 @@ describe('Portless app origin registry', () => {
       '*.tuturuuu.localhost',
     ]);
     expect(Object.values(TUTURUUU_PORTLESS_APP_ORIGINS)).toEqual([
+      'https://parley.tuturuuu.localhost',
       'https://ai.tuturuuu.localhost',
       'https://apps.tuturuuu.localhost',
       'https://calendar.tuturuuu.localhost',

package/src/__tests__/required-mfa-api-session.test.ts

@@ -0,0 +1,75 @@
+// @vitest-environment node
+import { NextRequest, NextResponse } from 'next/server';
+import { beforeEach, expect, it, vi } from 'vitest';
+import { guardBrowserApiSession } from '../required-mfa-api-session';
+
+const update = vi.hoisted(() => vi.fn());
+vi.mock('@tuturuuu/supabase/next/proxy', () => ({ updateSession: update }));
+beforeEach(() => {
+  update.mockReset();
+});
+it('checks refreshed cookies and propagates rotation on a policy rejection', async () => {
+  const request = new NextRequest('https://example.com/api/v1/users/me', {
+    headers: { cookie: 'sb-project-auth-token=old' },
+  });
+  update.mockImplementation(async (req: NextRequest) => {
+    req.cookies.set('sb-project-auth-token', 'new');
+    const res = NextResponse.next();
+    res.cookies.set('sb-project-auth-token', 'new');
+    return { res, claims: { sub: 'actor' } };
+  });
+  const response = await guardBrowserApiSession(request, async () => {
+    expect(request.cookies.get('sb-project-auth-token')?.value).toBe('new');
+    return NextResponse.json({ code: 'MFA_REQUIRED' }, { status: 403 });
+  });
+  expect(response.status).toBe(403);
+  expect(response.headers.get('set-cookie')).toContain(
+    'sb-project-auth-token=new'
+  );
+});
+it.each([
+  '/api/auth/refresh-app-session',
+  '/api/v1/auth/cross-app-session/refresh',
+])('does not recursively refresh the handoff handler %s', async (path) => {
+  const request = new NextRequest(`https://example.com${path}`, {
+    headers: { cookie: 'sb-project-auth-token=old' },
+  });
+  expect((await guardBrowserApiSession(request, async () => null)).status).toBe(
+    200
+  );
+  expect(update).not.toHaveBeenCalled();
+});
+it('never replaces explicit bearer credentials with ambient browser cookies', async () => {
+  const request = new NextRequest('https://example.com/api/v1/users/me', {
+    headers: {
+      authorization: 'Bearer explicit',
+      cookie: 'sb-project-auth-token=old',
+    },
+  });
+  await guardBrowserApiSession(request, async () => null);
+  expect(update).not.toHaveBeenCalled();
+});
+
+it('removes superseded app credentials from the actual forwarded provider request', async () => {
+  const request = new NextRequest('https://example.com/api/v1/users/me', {
+    headers: {
+      cookie:
+        'sb-project-auth-token=provider; tuturuuu_app_session=stale-app; tuturuuu_web_app_session=other-user',
+    },
+  });
+  update.mockResolvedValue({
+    res: NextResponse.next(),
+    claims: { sub: 'provider-user' },
+  });
+  const response = await guardBrowserApiSession(request, async () => {
+    expect(request.cookies.has('tuturuuu_app_session')).toBe(false);
+    expect(request.cookies.has('tuturuuu_web_app_session')).toBe(false);
+    return null;
+  });
+  expect(response.headers.get('x-middleware-request-cookie')).toContain(
+    'sb-project-auth-token=provider'
+  );
+  expect(response.headers.get('x-middleware-request-cookie')).not.toContain(
+    'tuturuuu_'
+  );
+});

package/src/__tests__/required-mfa-browser.test.ts

@@ -0,0 +1,73 @@
+import type { TypedSupabaseClient } from '@tuturuuu/supabase/types';
+import { beforeEach, expect, it, vi } from 'vitest';
+import { requiresAccountMfa } from '../required-mfa-browser';
+
+const rpc = vi.fn();
+const assurance = vi.fn();
+const client = {
+  auth: {
+    getUser: async () => ({
+      data: {
+        user: {
+          id: 'actor',
+          app_metadata: {
+            tuturuuu_required_mfa: { required: true, verifiedAfter: 100 },
+          },
+        },
+      },
+      error: null,
+    }),
+    getClaims: async () => ({
+      data: { claims: { sub: 'actor', aal: 'aal1', session_id: 'session' } },
+      error: null,
+    }),
+    mfa: { getAuthenticatorAssuranceLevel: assurance },
+  },
+  rpc,
+} as unknown as TypedSupabaseClient;
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+it('keeps a mobile-approved browser on its completed sign-in flow', async () => {
+  rpc.mockResolvedValue({ data: true, error: null });
+  expect(await requiresAccountMfa(client, { acceptMobileApproval: true })).toBe(
+    false
+  );
+  expect(rpc).toHaveBeenCalledWith('account_required_mfa_satisfied');
+  expect(assurance).not.toHaveBeenCalled();
+});
+it.each([
+  { data: false, error: null },
+  { data: null, error: { code: '42501' } },
+])(
+  'requires a new challenge after mobile proof expiry or reset',
+  async (result) => {
+    rpc.mockResolvedValue(result);
+    expect(
+      await requiresAccountMfa(client, { acceptMobileApproval: true })
+    ).toBe(true);
+  }
+);
+it('does not let a mobile proof approve another device challenge', async () => {
+  expect(await requiresAccountMfa(client)).toBe(true);
+  expect(rpc).not.toHaveBeenCalled();
+});
+
+it('a cached AAL2 claim still requires current database factor lineage', async () => {
+  const claims = vi.spyOn(client.auth, 'getClaims').mockResolvedValue({
+    data: {
+      claims: {
+        sub: 'actor',
+        aal: 'aal2',
+        session_id: 'session',
+        amr: [{ method: 'totp', timestamp: 101 }],
+      },
+    },
+    error: null,
+  } as never);
+  rpc.mockResolvedValue({ data: false, error: null });
+  expect(await requiresAccountMfa(client)).toBe(true);
+  rpc.mockResolvedValue({ data: true, error: null });
+  expect(await requiresAccountMfa(client)).toBe(false);
+  claims.mockRestore();
+});

package/src/__tests__/required-mfa-lineage.test.ts

@@ -0,0 +1,40 @@
+import type { TypedSupabaseClient } from '@tuturuuu/supabase/types';
+import { expect, it, vi } from 'vitest';
+import { bindCurrentMfaFactor } from '../required-mfa-lineage';
+
+const proof = {
+  sessionId: 'session',
+  verifiedAt: 104,
+  primaryVerifiedAt: 103,
+  factorId: 'removed-factor',
+};
+it('rejects late verification whose original factor was deleted', async () => {
+  const rpc = vi.fn().mockResolvedValue({ data: null, error: null });
+  expect(
+    await bindCurrentMfaFactor(
+      { rpc } as unknown as TypedSupabaseClient,
+      'actor',
+      proof
+    )
+  ).toBeNull();
+});
+it('a newly enrolled factor cannot revive an old signed proof', async () => {
+  const rpc = vi.fn().mockResolvedValue({ data: 'new-factor', error: null });
+  expect(
+    await bindCurrentMfaFactor(
+      { rpc } as unknown as TypedSupabaseClient,
+      'actor',
+      proof
+    )
+  ).toBeNull();
+});
+it('binds a provider-verified session once, then retains its exact factor id', async () => {
+  const rpc = vi.fn().mockResolvedValue({ data: 'new-factor', error: null });
+  const admin = { rpc } as unknown as TypedSupabaseClient;
+  const raw = { sessionId: 'session', verifiedAt: 104, primaryVerifiedAt: 103 };
+  expect(await bindCurrentMfaFactor(admin, 'actor', raw)).toBeNull();
+  expect(await bindCurrentMfaFactor(admin, 'actor', raw, true)).toEqual({
+    ...raw,
+    factorId: 'new-factor',
+  });
+});

package/src/__tests__/required-mfa-proxy.test.ts

@@ -0,0 +1,105 @@
+// @vitest-environment node
+import { NextRequest } from 'next/server';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { AccountAssuranceDependencies } from '../required-mfa-request';
+
+const check = vi.hoisted(() => vi.fn());
+vi.mock('../required-mfa-request', () => ({ checkRequiredAccountMfa: check }));
+
+import {
+  guardRequiredAccountMfa,
+  isAccountAssuranceRecoveryPath,
+} from '../required-mfa-proxy';
+
+const dependencies = {} as AccountAssuranceDependencies;
+function request(
+  path = '/api/v1/workspaces',
+  headers: HeadersInit = { authorization: 'Bearer eyJtest' }
+) {
+  return new NextRequest(`https://tuturuuu.com${path}`, { headers });
+}
+
+beforeEach(() => {
+  check.mockReset();
+  check.mockResolvedValue({ status: 'allowed', userId: 'actor' });
+});
+
+describe('required MFA proxy responses', () => {
+  it('leaves anonymous requests to route authentication', async () => {
+    expect(
+      await guardRequiredAccountMfa(
+        request('/api/v1/public', {}),
+        dependencies,
+        { userId: 'actor' }
+      )
+    ).toBeNull();
+    expect(check).not.toHaveBeenCalled();
+  });
+  it.each([
+    ['authorization', 'Bearer eyJtest'],
+    ['authorization', 'Bearer ttr_app_test'],
+    ['cookie', 'sb-project-auth-token.0=token'],
+    ['cookie', 'tuturuuu_web_app_session=token'],
+    ['cookie', 'tuturuuu_app_session=token'],
+  ])('checks interactive credential %s', async (name, value) => {
+    expect(
+      await guardRequiredAccountMfa(
+        request(undefined, { [name]: value }),
+        dependencies,
+        { userId: 'actor' }
+      )
+    ).toBeNull();
+    expect(check).toHaveBeenCalledOnce();
+  });
+  it.each([
+    ['required', 403, 'MFA_REQUIRED'],
+    ['invalid', 401, 'UNAUTHENTICATED'],
+    ['unavailable', 503, 'AUTH_UNAVAILABLE'],
+  ])(
+    'returns a bounded no-store response for %s',
+    async (status, httpStatus, code) => {
+      check.mockResolvedValue({ status, userId: 'private-actor-id' });
+      const result = await guardRequiredAccountMfa(request(), dependencies, {
+        userId: 'actor',
+      });
+      expect(result?.status).toBe(httpStatus);
+      expect(result?.headers.get('Cache-Control')).toBe('no-store');
+      const body = await result!.json();
+      expect(body.code).toBe(code);
+      expect(JSON.stringify(body)).not.toContain('private-actor-id');
+    }
+  );
+  it.each([
+    '/api/auth/verify-app-token',
+    '/api/auth/refresh-app-session',
+    '/api/v1/auth/cross-app-token/verify',
+    '/api/v1/auth/cross-app-session/refresh',
+    '/api/cli/auth/refresh',
+    '/api/v1/auth/mfa/devices',
+    '/api/v1/auth/mfa/mobile/challenges',
+    '/api/v1/auth/mfa/mobile/approvals',
+    '/api/v1/auth/mfa/mobile/challenges/00000000-0000-4000-8000-000000000001',
+    '/api/v1/auth/mfa/mobile/challenges/00000000-0000-4000-8000-000000000001/approve',
+    '/api/v1/auth/accounts/logout',
+    '/api/v1/auth/accounts/logout-all',
+  ])('allows assurance establishment/recovery route %s', async (path) => {
+    expect(
+      await guardRequiredAccountMfa(request(path), dependencies, {
+        userId: 'actor',
+      })
+    ).toBeNull();
+    expect(check).not.toHaveBeenCalled();
+  });
+  it.each([
+    '/api/auth/refresh-app-session/anything',
+    '/api/v1/auth/cross-app-session/refresh/anything',
+    '/api/v1/auth/mfa/devices/anything',
+    '/api/v1/auth/mfa/mobile/challenges/invalid',
+    '/api/v1/auth/mfa/mobile/challenges/00000000-0000-4000-8000-000000000001/approve/anything',
+    '/api/v1/infrastructure/internal-accounts',
+    '/api/v1/users/me',
+    '/api/v1/workspaces',
+  ])('does not exempt protected or unknown route %s', (path) => {
+    expect(isAccountAssuranceRecoveryPath(path)).toBe(false);
+  });
+});