@xenon-device-management/xenon 1.7.2 → 1.7.3

package/lib/test/unit/ArtifactStore.spec.js

@@ -0,0 +1,59 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const ArtifactStore_1 = require("../../src/services/artifacts/ArtifactStore");
+describe('FsArtifactStore', () => {
+    let root;
+    beforeEach(() => {
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-art-'));
+    });
+    afterEach(() => fs_1.default.rmSync(root, { recursive: true, force: true }));
+    it('resolve() is byte-identical to legacy path concatenation', () => {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        const legacy = path_1.default.join(root, '_groups', 'g1', 'composite.mp4');
+        (0, chai_1.expect)(store.resolve('_groups', 'g1', 'composite.mp4')).to.equal(legacy);
+    });
+    it('resolve() stays byte-identical (relative, NOT absolutized) under a relative root', () => {
+        // config.recordingsAssetsPath is overridable via XENON_RECORDINGS_ASSETS_PATH
+        // with no absolute-path validation. Legacy code was path.join, which keeps a
+        // relative root relative; path.resolve would silently absolutize it and flip
+        // every persisted filePath relative→absolute. Byte-identical means path.join.
+        const store = new ArtifactStore_1.FsArtifactStore('rel/root');
+        const legacy = path_1.default.join('rel/root', '_groups', 'g1', 'composite.mp4');
+        (0, chai_1.expect)(store.resolve('_groups', 'g1', 'composite.mp4')).to.equal(legacy);
+    });
+    it('resolve() with no segments returns the root and does not throw', () => {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        (0, chai_1.expect)(store.resolve()).to.equal(root);
+    });
+    it('refuses path traversal outside the root', () => {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        (0, chai_1.expect)(() => store.resolve('..', 'etc', 'passwd')).to.throw(/escapes store root/);
+    });
+    it('ensureDir creates nested directories and returns the absolute path', () => __awaiter(void 0, void 0, void 0, function* () {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        const dir = yield store.ensureDir('_groups', 'g2');
+        (0, chai_1.expect)(fs_1.default.statSync(dir).isDirectory()).to.equal(true);
+    }));
+    it('exists() reflects the filesystem', () => __awaiter(void 0, void 0, void 0, function* () {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        (0, chai_1.expect)(yield store.exists('nope.mp4')).to.equal(false);
+        fs_1.default.writeFileSync(path_1.default.join(root, 'yes.mp4'), 'x');
+        (0, chai_1.expect)(yield store.exists('yes.mp4')).to.equal(true);
+    }));
+});

package/lib/test/unit/CapabilitiesRouter.spec.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const capabilities_1 = require("../../src/app/routers/capabilities");
+describe('capabilities payload', () => {
+    it('reports version and the hub feature set', () => {
+        const caps = (0, capabilities_1.buildCapabilities)();
+        (0, chai_1.expect)(caps.version).to.be.a('string').and.not.equal('');
+        (0, chai_1.expect)(caps.features).to.deep.equal({
+            bearerAuth: true,
+            tokenIssuance: true,
+            streamTickets: true,
+            leases: true,
+            eventLog: true,
+            projects: true,
+        });
+    });
+});

package/lib/test/unit/EventLogService.spec.js

@@ -0,0 +1,67 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const EventLogService_1 = require("../../src/services/EventLogService");
+describe('EventLogService', () => {
+    function fakePrisma() {
+        return { eventLog: { create: sinon_1.default.stub().resolves({}), deleteMany: sinon_1.default.stub().resolves({ count: 3 }) } };
+    }
+    it('appendSafe writes type + JSON payload asynchronously', () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = fakePrisma();
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        svc.appendSafe({ type: 'device_blocked', payload: { udid: 'U1' }, teamId: 't1' });
+        yield new Promise((r) => setImmediate(r)); // let the fire-and-forget tick run
+        (0, chai_1.expect)(db.eventLog.create.calledOnce).to.equal(true);
+        const arg = db.eventLog.create.firstCall.args[0].data;
+        (0, chai_1.expect)(arg.type).to.equal('device_blocked');
+        (0, chai_1.expect)(JSON.parse(arg.payload)).to.deep.equal({ udid: 'U1' });
+    }));
+    it('appendSafe never throws even when the DB write fails', () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = fakePrisma();
+        db.eventLog.create.rejects(new Error('disk full'));
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        (0, chai_1.expect)(() => svc.appendSafe({ type: 'x', payload: {} })).to.not.throw();
+        yield new Promise((r) => setImmediate(r));
+    }));
+    it('appendSafe degrades a circular payload to a placeholder instead of crashing', () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = fakePrisma();
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        const c = {};
+        c.self = c;
+        (0, chai_1.expect)(() => svc.appendSafe({ type: 'device_blocked', payload: c })).to.not.throw();
+        yield new Promise((r) => setImmediate(r));
+        (0, chai_1.expect)(db.eventLog.create.calledOnce).to.equal(true);
+        const arg = db.eventLog.create.firstCall.args[0].data;
+        (0, chai_1.expect)(JSON.parse(arg.payload)).to.deep.equal({ _unserializable: true, type: 'device_blocked' });
+    }));
+    it('is a no-op when XENON_EVENT_LOG=off', () => __awaiter(void 0, void 0, void 0, function* () {
+        process.env.XENON_EVENT_LOG = 'off';
+        const db = fakePrisma();
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        svc.appendSafe({ type: 'x', payload: {} });
+        yield new Promise((r) => setImmediate(r));
+        (0, chai_1.expect)(db.eventLog.create.called).to.equal(false);
+        delete process.env.XENON_EVENT_LOG;
+    }));
+    it('prune deletes rows older than retention', () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = fakePrisma();
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        const n = yield svc.prune(30);
+        (0, chai_1.expect)(n).to.equal(3);
+        const where = db.eventLog.deleteMany.firstCall.args[0].where;
+        (0, chai_1.expect)(where.occurredAt.lt).to.be.a('date');
+    }));
+});

package/lib/test/unit/JwtKeyService.spec.js

@@ -0,0 +1,86 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+describe('JwtKeyService', () => {
+    let dir;
+    let svc;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-jwt-'));
+        svc = new JwtKeyService_1.JwtKeyService();
+        yield svc.init(dir);
+    }));
+    afterEach(() => fs_1.default.rmSync(dir, { recursive: true, force: true }));
+    it('generates a private key file with 0600 on first init', () => {
+        const keyPath = path_1.default.join(dir, 'xenon-jwt-private.pem');
+        (0, chai_1.expect)(fs_1.default.existsSync(keyPath)).to.equal(true);
+        const mode = fs_1.default.statSync(keyPath).mode & 0o777;
+        (0, chai_1.expect)(mode).to.equal(0o600);
+    });
+    it('reloads the same key on second init (stable kid)', () => __awaiter(void 0, void 0, void 0, function* () {
+        const kid1 = svc.jwks().keys[0].kid;
+        const svc2 = new JwtKeyService_1.JwtKeyService();
+        yield svc2.init(dir);
+        (0, chai_1.expect)(svc2.jwks().keys[0].kid).to.equal(kid1);
+    }));
+    it('signs and verifies a token round-trip with audience check', () => __awaiter(void 0, void 0, void 0, function* () {
+        const token = yield svc.sign({ sub: 'user-1', scopes: 'devices,read' }, { audience: 'xenon-rest', ttlSeconds: 60 });
+        const payload = yield svc.verify(token, { audience: 'xenon-rest' });
+        (0, chai_1.expect)(payload.sub).to.equal('user-1');
+        (0, chai_1.expect)(payload.scopes).to.equal('devices,read');
+    }));
+    it('rejects wrong audience', () => __awaiter(void 0, void 0, void 0, function* () {
+        const token = yield svc.sign({ sub: 'u' }, { audience: 'xenon-mcp', ttlSeconds: 60 });
+        try {
+            yield svc.verify(token, { audience: 'xenon-rest' });
+            chai_1.expect.fail('should have thrown');
+        }
+        catch (e) {
+            (0, chai_1.expect)(String(e.message)).to.match(/aud/i);
+        }
+    }));
+    it('rejects tokens expired beyond the 60s clock tolerance', () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const token = yield svc.sign({ sub: 'u' }, { audience: 'xenon-rest', ttlSeconds: -120 });
+        try {
+            yield svc.verify(token, { audience: 'xenon-rest' });
+            chai_1.expect.fail('should have thrown');
+        }
+        catch (e) {
+            (0, chai_1.expect)(String((_a = e.code) !== null && _a !== void 0 ? _a : e.message)).to.match(/expired|ERR_JWT_EXPIRED/i);
+        }
+    }));
+    it('degrades gracefully when uninitialized: sign() rejects, jwks() is empty', () => __awaiter(void 0, void 0, void 0, function* () {
+        const fresh = new JwtKeyService_1.JwtKeyService(); // init() never called
+        try {
+            yield fresh.sign({ sub: 'u' }, { audience: 'xenon-rest', ttlSeconds: 60 });
+            chai_1.expect.fail('should have thrown');
+        }
+        catch (e) {
+            (0, chai_1.expect)(String(e.message)).to.match(/not initialized/);
+        }
+        (0, chai_1.expect)(fresh.jwks()).to.deep.equal({ keys: [] });
+    }));
+    it('exposes a JWKS with kid, use=sig, alg=RS256 and no private material', () => {
+        const jwk = svc.jwks().keys[0];
+        (0, chai_1.expect)(jwk.kid).to.be.a('string');
+        (0, chai_1.expect)(jwk.use).to.equal('sig');
+        (0, chai_1.expect)(jwk.alg).to.equal('RS256');
+        (0, chai_1.expect)(jwk.d).to.equal(undefined); // private exponent must never appear
+    });
+});

package/lib/test/unit/ProjectsRouter.spec.js

@@ -0,0 +1,45 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const projects_1 = require("../../src/app/routers/projects");
+describe('projects handlers', () => {
+    function db() {
+        return { project: { findMany: sinon_1.default.stub().resolves([{ id: 'p1', name: 'App A', teamId: 't1' }]), create: sinon_1.default.stub().resolves({ id: 'p2', name: 'New', teamId: null }) } };
+    }
+    it('lists projects scoped to the caller teamIds when narrowed', () => __awaiter(void 0, void 0, void 0, function* () {
+        const client = db();
+        const out = yield (0, projects_1.listProjects)(client, ['t1']);
+        (0, chai_1.expect)(out).to.have.length(1);
+        (0, chai_1.expect)(client.project.findMany.firstCall.args[0].where).to.deep.equal({ OR: [{ teamId: { in: ['t1'] } }, { teamId: null }] });
+    }));
+    it('lists all projects for unscoped (admin) callers', () => __awaiter(void 0, void 0, void 0, function* () {
+        const client = db();
+        yield (0, projects_1.listProjects)(client, undefined);
+        (0, chai_1.expect)(client.project.findMany.firstCall.args[0]).to.deep.equal({});
+    }));
+    it('creates a project with a required name', () => __awaiter(void 0, void 0, void 0, function* () {
+        const client = db();
+        const p = yield (0, projects_1.createProject)(client, { name: 'New' });
+        (0, chai_1.expect)(p.id).to.equal('p2');
+        try {
+            yield (0, projects_1.createProject)(client, { name: '' });
+            chai_1.expect.fail('should throw');
+        }
+        catch (e) {
+            (0, chai_1.expect)(e.message).to.match(/name/);
+        }
+    }));
+});

package/lib/test/unit/StreamTicketService.spec.js

@@ -0,0 +1,95 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const typedi_1 = require("typedi");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const StreamTicketService_1 = require("../../src/services/token/StreamTicketService");
+describe('StreamTicketService', () => {
+    let dir;
+    let svc;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-ticket-'));
+        const keys = new JwtKeyService_1.JwtKeyService();
+        yield keys.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keys);
+        svc = new StreamTicketService_1.StreamTicketService();
+    }));
+    afterEach(() => {
+        typedi_1.Container.reset();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    it('mints and redeems a ticket once for the bound udid', () => __awaiter(void 0, void 0, void 0, function* () {
+        const t = yield svc.mint('UDID-1', 'actor-1');
+        const out = yield svc.redeem(t, 'UDID-1');
+        (0, chai_1.expect)(out.actorId).to.equal('actor-1');
+    }));
+    it('rejects redemption for a different udid', () => __awaiter(void 0, void 0, void 0, function* () {
+        const t = yield svc.mint('UDID-1', 'actor-1');
+        try {
+            yield svc.redeem(t, 'UDID-2');
+            chai_1.expect.fail('should throw');
+        }
+        catch (e) {
+            (0, chai_1.expect)(e.message).to.match(/udid/);
+        }
+    }));
+    it('rejects second redemption (single-use)', () => __awaiter(void 0, void 0, void 0, function* () {
+        const t = yield svc.mint('UDID-1', 'actor-1');
+        yield svc.redeem(t, 'UDID-1');
+        try {
+            yield svc.redeem(t, 'UDID-1');
+            chai_1.expect.fail('should throw');
+        }
+        catch (e) {
+            (0, chai_1.expect)(e.message).to.match(/used/);
+        }
+    }));
+    // Regression for the replay window: JwtKeyService.verify honors
+    // clockTolerance:60, so a 60s ticket stays *verifiable* until mint+120s.
+    // If the anti-replay entry evicts at redeem-time+TTL (mint+60s) instead of
+    // token-exp+tolerance (mint+120s), a replay at ~mint+90s slips through:
+    // verify() still accepts it, the prune loop has already dropped the jti, and
+    // `used.has(jti)` is false → REPLAY ACCEPTED. This test advances the clock
+    // ~90s (past TTL, still within exp+tolerance) and asserts single-use holds.
+    // It fails under redeem-time+TTL eviction and passes under exp+tolerance.
+    it('rejects a replay after TTL but within verify clock tolerance (advanced clock)', () => __awaiter(void 0, void 0, void 0, function* () {
+        const clock = sinon_1.default.useFakeTimers({ now: 0, toFake: ['Date'] });
+        let err;
+        try {
+            const t = yield svc.mint('UDID-1', 'actor-1');
+            yield svc.redeem(t, 'UDID-1'); // legitimate first use at ~t=0
+            clock.tick(90000); // t≈90s: past 60s TTL, still < mint+120s verify window
+            try {
+                yield svc.redeem(t, 'UDID-1');
+            }
+            catch (e) {
+                err = e;
+            }
+        }
+        finally {
+            clock.restore();
+        }
+        // Assert OUTSIDE the try so a wrongly-accepted replay (err === undefined)
+        // fails loudly instead of being swallowed. Note: the failure message here
+        // must NOT contain the word matched below, or a vacuous pass sneaks back in.
+        (0, chai_1.expect)(err, 'replay was accepted — single-use bypassed').to.be.an('error');
+        (0, chai_1.expect)(String(err && err.message)).to.match(/already used/);
+    }));
+});

package/lib/test/unit/TokenEndpoint.spec.js

@@ -0,0 +1,68 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const typedi_1 = require("typedi");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const auth_1 = require("../../src/app/routers/auth");
+describe('POST /auth/token handler (issueToken)', () => {
+    let dir;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-tok-'));
+        const svc = new JwtKeyService_1.JwtKeyService();
+        yield svc.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, svc);
+    }));
+    afterEach(() => {
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+        typedi_1.Container.reset();
+    });
+    const auth = {
+        kind: 'api-key',
+        userId: 'u1',
+        role: 'MEMBER',
+        scopes: 'devices,read',
+        teamId: 't1',
+        rateLimit: 300,
+    };
+    it('mints a xenon-rest token by default with 3600s TTL', () => __awaiter(void 0, void 0, void 0, function* () {
+        const out = yield (0, auth_1.issueToken)(auth, {});
+        (0, chai_1.expect)(out.audience).to.equal('xenon-rest');
+        (0, chai_1.expect)(out.expiresIn).to.equal(3600);
+        const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(out.token, {
+            audience: 'xenon-rest',
+        });
+        (0, chai_1.expect)(payload.sub).to.equal('u1');
+        (0, chai_1.expect)(payload.scopes).to.equal('devices,read');
+        (0, chai_1.expect)(payload.teamId).to.equal('t1');
+    }));
+    it('mints a xenon-mcp token with 86400s TTL', () => __awaiter(void 0, void 0, void 0, function* () {
+        const out = yield (0, auth_1.issueToken)(auth, { audience: 'xenon-mcp' });
+        (0, chai_1.expect)(out.expiresIn).to.equal(86400);
+        yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(out.token, { audience: 'xenon-mcp' });
+    }));
+    it('rejects unknown audiences', () => __awaiter(void 0, void 0, void 0, function* () {
+        try {
+            yield (0, auth_1.issueToken)(auth, { audience: 'xenon-stream' }); // tickets are not minted here
+            chai_1.expect.fail('should have thrown');
+        }
+        catch (e) {
+            (0, chai_1.expect)(e.message).to.match(/audience/);
+        }
+    }));
+});

package/lib/test/unit/authMiddleware.bearer.spec.js

@@ -0,0 +1,102 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const UserService_1 = require("../../src/services/UserService");
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const UserSessionService_1 = require("../../src/services/UserSessionService");
+const prisma_1 = require("../../src/prisma");
+function fakeRes() {
+    const res = { statusCode: 200 };
+    res.status = (c) => { res.statusCode = c; return res; };
+    res.json = (b) => { res.body = b; return res; };
+    res.cookie = () => res;
+    return res;
+}
+describe('authMiddleware — Bearer branch', () => {
+    let dir;
+    let keySvc;
+    const user = { id: 'u1', role: 'MEMBER', status: 'ACTIVE' };
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-bearer-'));
+        keySvc = new JwtKeyService_1.JwtKeyService();
+        yield keySvc.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keySvc);
+        typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().resolves(user) });
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, { verifyPair: sinon_1.default.stub().resolves(null), verify: sinon_1.default.stub().resolves(null) });
+        typedi_1.Container.set(UserSessionService_1.UserSessionService, { resolve: sinon_1.default.stub().resolves(null) });
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([{ teamId: 't1' }]);
+    }));
+    afterEach(() => {
+        sinon_1.default.restore();
+        typedi_1.Container.reset();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    it('accepts a valid xenon-rest Bearer token and sets req.auth', () => __awaiter(void 0, void 0, void 0, function* () {
+        const token = yield keySvc.sign({ sub: 'u1', role: 'MEMBER', scopes: 'devices,read', teamId: 't1' }, { audience: 'xenon-rest', ttlSeconds: 60 });
+        const req = { headers: { authorization: `Bearer ${token}` }, query: {} };
+        const res = fakeRes();
+        const next = sinon_1.default.spy();
+        yield (0, authMiddleware_1.authMiddleware)(req, res, next);
+        (0, chai_1.expect)(next.calledOnce).to.equal(true);
+        (0, chai_1.expect)(req.auth.kind).to.equal('bearer');
+        (0, chai_1.expect)(req.auth.userId).to.equal('u1');
+        (0, chai_1.expect)(req.auth.scopes).to.equal('devices,read');
+    }));
+    it('rejects an xenon-mcp-audience token on the REST surface', () => __awaiter(void 0, void 0, void 0, function* () {
+        const token = yield keySvc.sign({ sub: 'u1' }, { audience: 'xenon-mcp', ttlSeconds: 60 });
+        const req = { headers: { authorization: `Bearer ${token}` }, query: {} };
+        const res = fakeRes();
+        yield (0, authMiddleware_1.authMiddleware)(req, res, sinon_1.default.spy());
+        (0, chai_1.expect)(res.statusCode).to.equal(401);
+    }));
+    it('rejects a token for a disabled user (live revocation)', () => __awaiter(void 0, void 0, void 0, function* () {
+        typedi_1.Container.get(UserService_1.UserService).findById.resolves(Object.assign(Object.assign({}, user), { status: 'DISABLED' }));
+        const token = yield keySvc.sign({ sub: 'u1' }, { audience: 'xenon-rest', ttlSeconds: 60 });
+        const req = { headers: { authorization: `Bearer ${token}` }, query: {} };
+        const res = fakeRes();
+        yield (0, authMiddleware_1.authMiddleware)(req, res, sinon_1.default.spy());
+        (0, chai_1.expect)(res.statusCode).to.equal(401);
+    }));
+    // ---- regression pins: old inputs behave exactly as before ----
+    it('REGRESSION: no credentials → 401 unauthenticated (unchanged)', () => __awaiter(void 0, void 0, void 0, function* () {
+        const req = { headers: {}, query: {} };
+        const res = fakeRes();
+        yield (0, authMiddleware_1.authMiddleware)(req, res, sinon_1.default.spy());
+        (0, chai_1.expect)(res.statusCode).to.equal(401);
+        (0, chai_1.expect)(res.body).to.deep.equal({ error: 'unauthenticated' });
+    }));
+    it('REGRESSION: header pair still takes priority over a Bearer header', () => __awaiter(void 0, void 0, void 0, function* () {
+        const row = { id: 'k1', userId: 'u1', scopes: 'admin', rateLimit: 100, teamId: null };
+        typedi_1.Container.get(ApiKeyService_1.ApiKeyService).verifyPair.resolves(row);
+        const token = yield keySvc.sign({ sub: 'other' }, { audience: 'xenon-rest', ttlSeconds: 60 });
+        const req = {
+            headers: { 'x-xenon-access-key': 'ak', 'x-xenon-token': 'tk', authorization: `Bearer ${token}` },
+            query: {},
+        };
+        const res = fakeRes();
+        const next = sinon_1.default.spy();
+        yield (0, authMiddleware_1.authMiddleware)(req, res, next);
+        (0, chai_1.expect)(next.calledOnce).to.equal(true);
+        (0, chai_1.expect)(req.auth.kind).to.equal('api-key'); // pair wins, Bearer never evaluated
+    }));
+});