@xenon-device-management/xenon 1.7.2 → 1.7.4

package/lib/src/services/token/JwtKeyService.js

@@ -0,0 +1,137 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtKeyService = void 0;
+const typedi_1 = require("typedi");
+const jose = __importStar(require("jose"));
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const KEY_FILE = 'xenon-jwt-private.pem';
+const ISSUER = process.env.XENON_JWT_ISSUER || 'xenon-hub';
+/**
+ * RS256 signing key for hub-issued JWTs (REST/MCP tokens, stream tickets).
+ * Key material lives on disk (0600), never in the database. `kid` is derived
+ * from the public key so it is stable across restarts; rotation = drop a new
+ * PEM in place, old tokens fail verification (acceptable: TTLs are short).
+ */
+let JwtKeyService = class JwtKeyService {
+    constructor() {
+        // Boot degrades gracefully if key material is unavailable (bad perms, full
+        // disk, corrupt PEM): the server still comes up, and only the token routes
+        // fail. sign()/verify() throw a clear error; jwks() serves an empty set.
+        this.initialized = false;
+    }
+    init(keyDir) {
+        return __awaiter(this, void 0, void 0, function* () {
+            fs_1.default.mkdirSync(keyDir, { recursive: true });
+            const keyPath = path_1.default.join(keyDir, KEY_FILE);
+            let pkcs8;
+            if (fs_1.default.existsSync(keyPath)) {
+                pkcs8 = fs_1.default.readFileSync(keyPath, 'utf8');
+            }
+            else {
+                const { privateKey } = yield jose.generateKeyPair('RS256', { extractable: true });
+                pkcs8 = yield jose.exportPKCS8(privateKey);
+                fs_1.default.writeFileSync(keyPath, pkcs8, { mode: 0o600 });
+            }
+            this.privateKey = yield jose.importPKCS8(pkcs8, 'RS256');
+            // Public JWK derived from the private key; strip private fields.
+            const fullJwk = yield jose.exportJWK(this.privateKey);
+            this.publicJwk = { kty: fullJwk.kty, n: fullJwk.n, e: fullJwk.e };
+            this.publicKey = yield jose.importJWK(Object.assign(Object.assign({}, this.publicJwk), { alg: 'RS256' }), 'RS256');
+            this.kid = (0, crypto_1.createHash)('sha256')
+                .update(`${fullJwk.n}.${fullJwk.e}`)
+                .digest('base64url')
+                .slice(0, 16);
+            this.initialized = true;
+        });
+    }
+    sign(claims, opts) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.initialized)
+                throw new Error('JWT key service not initialized');
+            const jwt = new jose.SignJWT(claims)
+                .setProtectedHeader({ alg: 'RS256', kid: this.kid })
+                .setIssuer(ISSUER)
+                .setAudience(opts.audience)
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + opts.ttlSeconds);
+            if (opts.jti)
+                jwt.setJti(opts.jti);
+            return jwt.sign(this.privateKey);
+        });
+    }
+    verify(token, opts) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.initialized)
+                throw new Error('JWT key service not initialized');
+            const { payload } = yield jose.jwtVerify(token, this.publicKey, {
+                issuer: ISSUER,
+                audience: opts.audience,
+                clockTolerance: 60, // spec §7.1: ±60 s skew, mirrors appium-mcp-auth
+            });
+            return payload;
+        });
+    }
+    jwks() {
+        // Empty JWKS when uninitialized — valid JSON, honest about having no keys.
+        if (!this.initialized)
+            return { keys: [] };
+        return { keys: [Object.assign(Object.assign({}, this.publicJwk), { kid: this.kid, use: 'sig', alg: 'RS256' })] };
+    }
+};
+exports.JwtKeyService = JwtKeyService;
+exports.JwtKeyService = JwtKeyService = __decorate([
+    (0, typedi_1.Service)()
+], JwtKeyService);

package/lib/src/services/token/StreamTicketService.js

@@ -0,0 +1,61 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StreamTicketService = void 0;
+const typedi_1 = require("typedi");
+const crypto_1 = require("crypto");
+const JwtKeyService_1 = require("./JwtKeyService");
+const TICKET_TTL_SEC = 60;
+/** Single-use, udid-bound, 60 s tokens for the webview <img> MJPEG path. */
+let StreamTicketService = class StreamTicketService {
+    constructor() {
+        // jti -> expiry epoch-ms. Pruned on each redeem; bounded by 60 s TTL.
+        this.used = new Map();
+    }
+    mint(udid, actorId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return typedi_1.Container.get(JwtKeyService_1.JwtKeyService).sign({ udid, actorId }, { audience: 'xenon-stream', ttlSeconds: TICKET_TTL_SEC, jti: (0, crypto_1.randomUUID)() });
+        });
+    }
+    redeem(ticket, udid) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(ticket, { audience: 'xenon-stream' });
+            if (payload.udid !== udid)
+                throw new Error('ticket udid mismatch');
+            const jti = String(payload.jti);
+            const now = Date.now();
+            for (const [k, exp] of this.used)
+                if (exp < now)
+                    this.used.delete(k);
+            if (this.used.has(jti))
+                throw new Error('ticket already used');
+            // Evict the anti-replay entry only once the JWT itself is genuinely
+            // unverifiable. JwtKeyService.verify() honors clockTolerance:60, so the
+            // token stays acceptable until exp + 60s. Keying eviction off redeem-time
+            // + TTL (mint..mint+60) would drop the jti at mint+60 while verify() still
+            // accepts a replay up to mint+120 — a ~60s single-use bypass. Key off the
+            // token's own exp claim plus the same tolerance so memory outlives it.
+            const evictAt = (typeof payload.exp === 'number' ? payload.exp * 1000 : now + TICKET_TTL_SEC * 1000) + 60000; // token exp + clockTolerance (mirrors JwtKeyService.verify)
+            this.used.set(jti, evictAt);
+            return { actorId: String(payload.actorId) };
+        });
+    }
+};
+exports.StreamTicketService = StreamTicketService;
+exports.StreamTicketService = StreamTicketService = __decorate([
+    (0, typedi_1.Service)()
+], StreamTicketService);

package/lib/test/unit/ArtifactStore.spec.js

@@ -0,0 +1,59 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const ArtifactStore_1 = require("../../src/services/artifacts/ArtifactStore");
+describe('FsArtifactStore', () => {
+    let root;
+    beforeEach(() => {
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-art-'));
+    });
+    afterEach(() => fs_1.default.rmSync(root, { recursive: true, force: true }));
+    it('resolve() is byte-identical to legacy path concatenation', () => {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        const legacy = path_1.default.join(root, '_groups', 'g1', 'composite.mp4');
+        (0, chai_1.expect)(store.resolve('_groups', 'g1', 'composite.mp4')).to.equal(legacy);
+    });
+    it('resolve() stays byte-identical (relative, NOT absolutized) under a relative root', () => {
+        // config.recordingsAssetsPath is overridable via XENON_RECORDINGS_ASSETS_PATH
+        // with no absolute-path validation. Legacy code was path.join, which keeps a
+        // relative root relative; path.resolve would silently absolutize it and flip
+        // every persisted filePath relative→absolute. Byte-identical means path.join.
+        const store = new ArtifactStore_1.FsArtifactStore('rel/root');
+        const legacy = path_1.default.join('rel/root', '_groups', 'g1', 'composite.mp4');
+        (0, chai_1.expect)(store.resolve('_groups', 'g1', 'composite.mp4')).to.equal(legacy);
+    });
+    it('resolve() with no segments returns the root and does not throw', () => {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        (0, chai_1.expect)(store.resolve()).to.equal(root);
+    });
+    it('refuses path traversal outside the root', () => {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        (0, chai_1.expect)(() => store.resolve('..', 'etc', 'passwd')).to.throw(/escapes store root/);
+    });
+    it('ensureDir creates nested directories and returns the absolute path', () => __awaiter(void 0, void 0, void 0, function* () {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        const dir = yield store.ensureDir('_groups', 'g2');
+        (0, chai_1.expect)(fs_1.default.statSync(dir).isDirectory()).to.equal(true);
+    }));
+    it('exists() reflects the filesystem', () => __awaiter(void 0, void 0, void 0, function* () {
+        const store = new ArtifactStore_1.FsArtifactStore(root);
+        (0, chai_1.expect)(yield store.exists('nope.mp4')).to.equal(false);
+        fs_1.default.writeFileSync(path_1.default.join(root, 'yes.mp4'), 'x');
+        (0, chai_1.expect)(yield store.exists('yes.mp4')).to.equal(true);
+    }));
+});

package/lib/test/unit/CapabilitiesRouter.spec.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const capabilities_1 = require("../../src/app/routers/capabilities");
+describe('capabilities payload', () => {
+    it('reports version and the hub feature set', () => {
+        const caps = (0, capabilities_1.buildCapabilities)();
+        (0, chai_1.expect)(caps.version).to.be.a('string').and.not.equal('');
+        (0, chai_1.expect)(caps.features).to.deep.equal({
+            bearerAuth: true,
+            tokenIssuance: true,
+            streamTickets: true,
+            leases: true,
+            eventLog: true,
+            projects: true,
+        });
+    });
+});

package/lib/test/unit/EventLogService.spec.js

@@ -0,0 +1,67 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const EventLogService_1 = require("../../src/services/EventLogService");
+describe('EventLogService', () => {
+    function fakePrisma() {
+        return { eventLog: { create: sinon_1.default.stub().resolves({}), deleteMany: sinon_1.default.stub().resolves({ count: 3 }) } };
+    }
+    it('appendSafe writes type + JSON payload asynchronously', () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = fakePrisma();
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        svc.appendSafe({ type: 'device_blocked', payload: { udid: 'U1' }, teamId: 't1' });
+        yield new Promise((r) => setImmediate(r)); // let the fire-and-forget tick run
+        (0, chai_1.expect)(db.eventLog.create.calledOnce).to.equal(true);
+        const arg = db.eventLog.create.firstCall.args[0].data;
+        (0, chai_1.expect)(arg.type).to.equal('device_blocked');
+        (0, chai_1.expect)(JSON.parse(arg.payload)).to.deep.equal({ udid: 'U1' });
+    }));
+    it('appendSafe never throws even when the DB write fails', () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = fakePrisma();
+        db.eventLog.create.rejects(new Error('disk full'));
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        (0, chai_1.expect)(() => svc.appendSafe({ type: 'x', payload: {} })).to.not.throw();
+        yield new Promise((r) => setImmediate(r));
+    }));
+    it('appendSafe degrades a circular payload to a placeholder instead of crashing', () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = fakePrisma();
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        const c = {};
+        c.self = c;
+        (0, chai_1.expect)(() => svc.appendSafe({ type: 'device_blocked', payload: c })).to.not.throw();
+        yield new Promise((r) => setImmediate(r));
+        (0, chai_1.expect)(db.eventLog.create.calledOnce).to.equal(true);
+        const arg = db.eventLog.create.firstCall.args[0].data;
+        (0, chai_1.expect)(JSON.parse(arg.payload)).to.deep.equal({ _unserializable: true, type: 'device_blocked' });
+    }));
+    it('is a no-op when XENON_EVENT_LOG=off', () => __awaiter(void 0, void 0, void 0, function* () {
+        process.env.XENON_EVENT_LOG = 'off';
+        const db = fakePrisma();
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        svc.appendSafe({ type: 'x', payload: {} });
+        yield new Promise((r) => setImmediate(r));
+        (0, chai_1.expect)(db.eventLog.create.called).to.equal(false);
+        delete process.env.XENON_EVENT_LOG;
+    }));
+    it('prune deletes rows older than retention', () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = fakePrisma();
+        const svc = new EventLogService_1.EventLogService({ client: db });
+        const n = yield svc.prune(30);
+        (0, chai_1.expect)(n).to.equal(3);
+        const where = db.eventLog.deleteMany.firstCall.args[0].where;
+        (0, chai_1.expect)(where.occurredAt.lt).to.be.a('date');
+    }));
+});

package/lib/test/unit/JwtKeyService.spec.js

@@ -0,0 +1,86 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+describe('JwtKeyService', () => {
+    let dir;
+    let svc;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-jwt-'));
+        svc = new JwtKeyService_1.JwtKeyService();
+        yield svc.init(dir);
+    }));
+    afterEach(() => fs_1.default.rmSync(dir, { recursive: true, force: true }));
+    it('generates a private key file with 0600 on first init', () => {
+        const keyPath = path_1.default.join(dir, 'xenon-jwt-private.pem');
+        (0, chai_1.expect)(fs_1.default.existsSync(keyPath)).to.equal(true);
+        const mode = fs_1.default.statSync(keyPath).mode & 0o777;
+        (0, chai_1.expect)(mode).to.equal(0o600);
+    });
+    it('reloads the same key on second init (stable kid)', () => __awaiter(void 0, void 0, void 0, function* () {
+        const kid1 = svc.jwks().keys[0].kid;
+        const svc2 = new JwtKeyService_1.JwtKeyService();
+        yield svc2.init(dir);
+        (0, chai_1.expect)(svc2.jwks().keys[0].kid).to.equal(kid1);
+    }));
+    it('signs and verifies a token round-trip with audience check', () => __awaiter(void 0, void 0, void 0, function* () {
+        const token = yield svc.sign({ sub: 'user-1', scopes: 'devices,read' }, { audience: 'xenon-rest', ttlSeconds: 60 });
+        const payload = yield svc.verify(token, { audience: 'xenon-rest' });
+        (0, chai_1.expect)(payload.sub).to.equal('user-1');
+        (0, chai_1.expect)(payload.scopes).to.equal('devices,read');
+    }));
+    it('rejects wrong audience', () => __awaiter(void 0, void 0, void 0, function* () {
+        const token = yield svc.sign({ sub: 'u' }, { audience: 'xenon-mcp', ttlSeconds: 60 });
+        try {
+            yield svc.verify(token, { audience: 'xenon-rest' });
+            chai_1.expect.fail('should have thrown');
+        }
+        catch (e) {
+            (0, chai_1.expect)(String(e.message)).to.match(/aud/i);
+        }
+    }));
+    it('rejects tokens expired beyond the 60s clock tolerance', () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const token = yield svc.sign({ sub: 'u' }, { audience: 'xenon-rest', ttlSeconds: -120 });
+        try {
+            yield svc.verify(token, { audience: 'xenon-rest' });
+            chai_1.expect.fail('should have thrown');
+        }
+        catch (e) {
+            (0, chai_1.expect)(String((_a = e.code) !== null && _a !== void 0 ? _a : e.message)).to.match(/expired|ERR_JWT_EXPIRED/i);
+        }
+    }));
+    it('degrades gracefully when uninitialized: sign() rejects, jwks() is empty', () => __awaiter(void 0, void 0, void 0, function* () {
+        const fresh = new JwtKeyService_1.JwtKeyService(); // init() never called
+        try {
+            yield fresh.sign({ sub: 'u' }, { audience: 'xenon-rest', ttlSeconds: 60 });
+            chai_1.expect.fail('should have thrown');
+        }
+        catch (e) {
+            (0, chai_1.expect)(String(e.message)).to.match(/not initialized/);
+        }
+        (0, chai_1.expect)(fresh.jwks()).to.deep.equal({ keys: [] });
+    }));
+    it('exposes a JWKS with kid, use=sig, alg=RS256 and no private material', () => {
+        const jwk = svc.jwks().keys[0];
+        (0, chai_1.expect)(jwk.kid).to.be.a('string');
+        (0, chai_1.expect)(jwk.use).to.equal('sig');
+        (0, chai_1.expect)(jwk.alg).to.equal('RS256');
+        (0, chai_1.expect)(jwk.d).to.equal(undefined); // private exponent must never appear
+    });
+});

package/lib/test/unit/ProjectsRouter.spec.js

@@ -0,0 +1,45 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const projects_1 = require("../../src/app/routers/projects");
+describe('projects handlers', () => {
+    function db() {
+        return { project: { findMany: sinon_1.default.stub().resolves([{ id: 'p1', name: 'App A', teamId: 't1' }]), create: sinon_1.default.stub().resolves({ id: 'p2', name: 'New', teamId: null }) } };
+    }
+    it('lists projects scoped to the caller teamIds when narrowed', () => __awaiter(void 0, void 0, void 0, function* () {
+        const client = db();
+        const out = yield (0, projects_1.listProjects)(client, ['t1']);
+        (0, chai_1.expect)(out).to.have.length(1);
+        (0, chai_1.expect)(client.project.findMany.firstCall.args[0].where).to.deep.equal({ OR: [{ teamId: { in: ['t1'] } }, { teamId: null }] });
+    }));
+    it('lists all projects for unscoped (admin) callers', () => __awaiter(void 0, void 0, void 0, function* () {
+        const client = db();
+        yield (0, projects_1.listProjects)(client, undefined);
+        (0, chai_1.expect)(client.project.findMany.firstCall.args[0]).to.deep.equal({});
+    }));
+    it('creates a project with a required name', () => __awaiter(void 0, void 0, void 0, function* () {
+        const client = db();
+        const p = yield (0, projects_1.createProject)(client, { name: 'New' });
+        (0, chai_1.expect)(p.id).to.equal('p2');
+        try {
+            yield (0, projects_1.createProject)(client, { name: '' });
+            chai_1.expect.fail('should throw');
+        }
+        catch (e) {
+            (0, chai_1.expect)(e.message).to.match(/name/);
+        }
+    }));
+});

package/lib/test/unit/StreamTicketService.spec.js

@@ -0,0 +1,95 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const typedi_1 = require("typedi");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const StreamTicketService_1 = require("../../src/services/token/StreamTicketService");
+describe('StreamTicketService', () => {
+    let dir;
+    let svc;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-ticket-'));
+        const keys = new JwtKeyService_1.JwtKeyService();
+        yield keys.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keys);
+        svc = new StreamTicketService_1.StreamTicketService();
+    }));
+    afterEach(() => {
+        typedi_1.Container.reset();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    it('mints and redeems a ticket once for the bound udid', () => __awaiter(void 0, void 0, void 0, function* () {
+        const t = yield svc.mint('UDID-1', 'actor-1');
+        const out = yield svc.redeem(t, 'UDID-1');
+        (0, chai_1.expect)(out.actorId).to.equal('actor-1');
+    }));
+    it('rejects redemption for a different udid', () => __awaiter(void 0, void 0, void 0, function* () {
+        const t = yield svc.mint('UDID-1', 'actor-1');
+        try {
+            yield svc.redeem(t, 'UDID-2');
+            chai_1.expect.fail('should throw');
+        }
+        catch (e) {
+            (0, chai_1.expect)(e.message).to.match(/udid/);
+        }
+    }));
+    it('rejects second redemption (single-use)', () => __awaiter(void 0, void 0, void 0, function* () {
+        const t = yield svc.mint('UDID-1', 'actor-1');
+        yield svc.redeem(t, 'UDID-1');
+        try {
+            yield svc.redeem(t, 'UDID-1');
+            chai_1.expect.fail('should throw');
+        }
+        catch (e) {
+            (0, chai_1.expect)(e.message).to.match(/used/);
+        }
+    }));
+    // Regression for the replay window: JwtKeyService.verify honors
+    // clockTolerance:60, so a 60s ticket stays *verifiable* until mint+120s.
+    // If the anti-replay entry evicts at redeem-time+TTL (mint+60s) instead of
+    // token-exp+tolerance (mint+120s), a replay at ~mint+90s slips through:
+    // verify() still accepts it, the prune loop has already dropped the jti, and
+    // `used.has(jti)` is false → REPLAY ACCEPTED. This test advances the clock
+    // ~90s (past TTL, still within exp+tolerance) and asserts single-use holds.
+    // It fails under redeem-time+TTL eviction and passes under exp+tolerance.
+    it('rejects a replay after TTL but within verify clock tolerance (advanced clock)', () => __awaiter(void 0, void 0, void 0, function* () {
+        const clock = sinon_1.default.useFakeTimers({ now: 0, toFake: ['Date'] });
+        let err;
+        try {
+            const t = yield svc.mint('UDID-1', 'actor-1');
+            yield svc.redeem(t, 'UDID-1'); // legitimate first use at ~t=0
+            clock.tick(90000); // t≈90s: past 60s TTL, still < mint+120s verify window
+            try {
+                yield svc.redeem(t, 'UDID-1');
+            }
+            catch (e) {
+                err = e;
+            }
+        }
+        finally {
+            clock.restore();
+        }
+        // Assert OUTSIDE the try so a wrongly-accepted replay (err === undefined)
+        // fails loudly instead of being swallowed. Note: the failure message here
+        // must NOT contain the word matched below, or a vacuous pass sneaks back in.
+        (0, chai_1.expect)(err, 'replay was accepted — single-use bypassed').to.be.an('error');
+        (0, chai_1.expect)(String(err && err.message)).to.match(/already used/);
+    }));
+});

package/lib/test/unit/TokenEndpoint.spec.js

@@ -0,0 +1,68 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const typedi_1 = require("typedi");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const auth_1 = require("../../src/app/routers/auth");
+describe('POST /auth/token handler (issueToken)', () => {
+    let dir;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-tok-'));
+        const svc = new JwtKeyService_1.JwtKeyService();
+        yield svc.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, svc);
+    }));
+    afterEach(() => {
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+        typedi_1.Container.reset();
+    });
+    const auth = {
+        kind: 'api-key',
+        userId: 'u1',
+        role: 'MEMBER',
+        scopes: 'devices,read',
+        teamId: 't1',
+        rateLimit: 300,
+    };
+    it('mints a xenon-rest token by default with 3600s TTL', () => __awaiter(void 0, void 0, void 0, function* () {
+        const out = yield (0, auth_1.issueToken)(auth, {});
+        (0, chai_1.expect)(out.audience).to.equal('xenon-rest');
+        (0, chai_1.expect)(out.expiresIn).to.equal(3600);
+        const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(out.token, {
+            audience: 'xenon-rest',
+        });
+        (0, chai_1.expect)(payload.sub).to.equal('u1');
+        (0, chai_1.expect)(payload.scopes).to.equal('devices,read');
+        (0, chai_1.expect)(payload.teamId).to.equal('t1');
+    }));
+    it('mints a xenon-mcp token with 86400s TTL', () => __awaiter(void 0, void 0, void 0, function* () {
+        const out = yield (0, auth_1.issueToken)(auth, { audience: 'xenon-mcp' });
+        (0, chai_1.expect)(out.expiresIn).to.equal(86400);
+        yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(out.token, { audience: 'xenon-mcp' });
+    }));
+    it('rejects unknown audiences', () => __awaiter(void 0, void 0, void 0, function* () {
+        try {
+            yield (0, auth_1.issueToken)(auth, { audience: 'xenon-stream' }); // tickets are not minted here
+            chai_1.expect.fail('should have thrown');
+        }
+        catch (e) {
+            (0, chai_1.expect)(e.message).to.match(/audience/);
+        }
+    }));
+});