auramaxx 0.0.20 → 0.1.0

package/src/server/tests/lib/network.test.ts

@@ -1,280 +0,0 @@
-/**
- * Tests for SSRF protection utilities in server/lib/network.ts
- *
- * Tests:
- * - isPrivateIp — IPv4 private ranges, IPv6 private ranges, public IPs
- * - resolveAndValidateHost — DNS mocking, private IP blocking
- * - validateExternalUrl — protocol, allowedHosts, DNS-based blocking
- * - sanitizePathSegment — path traversal rejection
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-
-// Mock dns before importing network module
-vi.mock('dns', () => ({
-  default: {
-    promises: {
-      lookup: vi.fn(),
-    },
-  },
-  promises: {
-    lookup: vi.fn(),
-  },
-}));
-
-import dns from 'dns';
-import { isPrivateIp, resolveAndValidateHost, validateExternalUrl, sanitizePathSegment } from '../../lib/network';
-
-describe('Network SSRF Utilities', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  describe('isPrivateIp()', () => {
-    describe('IPv4 private ranges', () => {
-      it('should block 127.0.0.0/8 (loopback)', () => {
-        expect(isPrivateIp('127.0.0.1')).toBe(true);
-        expect(isPrivateIp('127.255.255.255')).toBe(true);
-      });
-
-      it('should block 10.0.0.0/8', () => {
-        expect(isPrivateIp('10.0.0.1')).toBe(true);
-        expect(isPrivateIp('10.255.255.255')).toBe(true);
-      });
-
-      it('should block 172.16.0.0/12', () => {
-        expect(isPrivateIp('172.16.0.1')).toBe(true);
-        expect(isPrivateIp('172.31.255.255')).toBe(true);
-      });
-
-      it('should not block 172.15.x.x or 172.32.x.x', () => {
-        expect(isPrivateIp('172.15.0.1')).toBe(false);
-        expect(isPrivateIp('172.32.0.1')).toBe(false);
-      });
-
-      it('should block 192.168.0.0/16', () => {
-        expect(isPrivateIp('192.168.1.1')).toBe(true);
-        expect(isPrivateIp('192.168.0.1')).toBe(true);
-      });
-
-      it('should block 169.254.0.0/16 (link-local / metadata)', () => {
-        expect(isPrivateIp('169.254.169.254')).toBe(true);
-        expect(isPrivateIp('169.254.0.1')).toBe(true);
-      });
-
-      it('should block 0.0.0.0/8', () => {
-        expect(isPrivateIp('0.0.0.0')).toBe(true);
-        expect(isPrivateIp('0.0.0.1')).toBe(true);
-      });
-    });
-
-    describe('IPv4 public IPs', () => {
-      it('should allow 8.8.8.8', () => {
-        expect(isPrivateIp('8.8.8.8')).toBe(false);
-      });
-
-      it('should allow 1.1.1.1', () => {
-        expect(isPrivateIp('1.1.1.1')).toBe(false);
-      });
-
-      it('should allow 104.16.132.229', () => {
-        expect(isPrivateIp('104.16.132.229')).toBe(false);
-      });
-    });
-
-    describe('IPv6 private ranges', () => {
-      it('should block ::1 (loopback)', () => {
-        expect(isPrivateIp('::1')).toBe(true);
-      });
-
-      it('should block ::ffff:127.0.0.1 (IPv4-mapped loopback)', () => {
-        expect(isPrivateIp('::ffff:127.0.0.1')).toBe(true);
-      });
-
-      it('should block ::ffff:169.254.169.254 (IPv4-mapped metadata)', () => {
-        expect(isPrivateIp('::ffff:169.254.169.254')).toBe(true);
-      });
-
-      it('should block ::ffff:10.0.0.1 (IPv4-mapped private)', () => {
-        expect(isPrivateIp('::ffff:10.0.0.1')).toBe(true);
-      });
-
-      it('should block fe80::1 (link-local)', () => {
-        expect(isPrivateIp('fe80::1')).toBe(true);
-      });
-
-      it('should block fd00::1 (unique local)', () => {
-        expect(isPrivateIp('fd00::1')).toBe(true);
-      });
-
-      it('should block fc00::1 (unique local)', () => {
-        expect(isPrivateIp('fc00::1')).toBe(true);
-      });
-    });
-
-    describe('IPv6 public IPs', () => {
-      it('should allow 2001:4860:4860::8888 (Google DNS)', () => {
-        expect(isPrivateIp('2001:4860:4860::8888')).toBe(false);
-      });
-    });
-
-    describe('edge cases', () => {
-      it('should return false for non-IP strings', () => {
-        expect(isPrivateIp('not-an-ip')).toBe(false);
-      });
-
-      it('should return false for empty string', () => {
-        expect(isPrivateIp('')).toBe(false);
-      });
-    });
-  });
-
-  describe('resolveAndValidateHost()', () => {
-    it('should block hostname resolving to private IP', async () => {
-      vi.mocked(dns.promises.lookup).mockResolvedValue({ address: '127.0.0.1', family: 4 });
-
-      await expect(resolveAndValidateHost('evil.com')).rejects.toThrow(
-        'resolves to private IP 127.0.0.1',
-      );
-    });
-
-    it('should allow hostname resolving to public IP', async () => {
-      vi.mocked(dns.promises.lookup).mockResolvedValue({ address: '93.184.216.34', family: 4 });
-
-      await expect(resolveAndValidateHost('example.com')).resolves.toBeUndefined();
-    });
-
-    it('should block hostname resolving to 169.254.169.254 (metadata)', async () => {
-      vi.mocked(dns.promises.lookup).mockResolvedValue({ address: '169.254.169.254', family: 4 });
-
-      await expect(resolveAndValidateHost('metadata.evil.com')).rejects.toThrow('private IP');
-    });
-
-    it('should block raw private IPv4 address without DNS lookup', async () => {
-      await expect(resolveAndValidateHost('127.0.0.1')).rejects.toThrow('private/reserved IP');
-      expect(dns.promises.lookup).not.toHaveBeenCalled();
-    });
-
-    it('should allow raw public IPv4 address without DNS lookup', async () => {
-      await expect(resolveAndValidateHost('8.8.8.8')).resolves.toBeUndefined();
-      expect(dns.promises.lookup).not.toHaveBeenCalled();
-    });
-
-    it('should handle DNS lookup failure', async () => {
-      vi.mocked(dns.promises.lookup).mockRejectedValue(new Error('ENOTFOUND'));
-
-      await expect(resolveAndValidateHost('nonexistent.invalid')).rejects.toThrow('DNS lookup failed');
-    });
-  });
-
-  describe('validateExternalUrl()', () => {
-    beforeEach(() => {
-      // Default: DNS resolves to public IP
-      vi.mocked(dns.promises.lookup).mockResolvedValue({ address: '93.184.216.34', family: 4 });
-    });
-
-    describe('protocol validation', () => {
-      it('should reject file:// protocol', async () => {
-        await expect(validateExternalUrl('file:///etc/passwd')).rejects.toThrow('not allowed');
-      });
-
-      it('should reject ftp:// protocol', async () => {
-        await expect(validateExternalUrl('ftp://files.example.com/data')).rejects.toThrow('not allowed');
-      });
-
-      it('should reject gopher:// protocol', async () => {
-        await expect(validateExternalUrl('gopher://example.com')).rejects.toThrow('not allowed');
-      });
-
-      it('should allow http:// protocol', async () => {
-        await expect(validateExternalUrl('http://example.com')).resolves.toBeUndefined();
-      });
-
-      it('should allow https:// protocol', async () => {
-        await expect(validateExternalUrl('https://example.com')).resolves.toBeUndefined();
-      });
-    });
-
-    describe('allowedHosts enforcement', () => {
-      it('should block unlisted host', async () => {
-        await expect(
-          validateExternalUrl('https://evil.com/api', ['api.example.com']),
-        ).rejects.toThrow('not in the allowed hosts list');
-      });
-
-      it('should allow listed host', async () => {
-        await expect(
-          validateExternalUrl('https://api.example.com/v1/data', ['api.example.com']),
-        ).resolves.toBeUndefined();
-      });
-
-      it('should skip allowedHosts check when list is empty', async () => {
-        await expect(
-          validateExternalUrl('https://any-host.com/data', []),
-        ).resolves.toBeUndefined();
-      });
-
-      it('should skip allowedHosts check when not provided', async () => {
-        await expect(
-          validateExternalUrl('https://any-host.com/data'),
-        ).resolves.toBeUndefined();
-      });
-    });
-
-    describe('DNS-based SSRF blocking', () => {
-      it('should block URL whose hostname resolves to private IP', async () => {
-        vi.mocked(dns.promises.lookup).mockResolvedValue({ address: '10.0.0.1', family: 4 });
-
-        await expect(validateExternalUrl('https://evil.com/api')).rejects.toThrow('private IP');
-      });
-
-      it('should allow URL whose hostname resolves to public IP', async () => {
-        vi.mocked(dns.promises.lookup).mockResolvedValue({ address: '93.184.216.34', family: 4 });
-
-        await expect(validateExternalUrl('https://example.com')).resolves.toBeUndefined();
-      });
-    });
-
-    describe('invalid URLs', () => {
-      it('should reject malformed URL', async () => {
-        await expect(validateExternalUrl('not-a-url')).rejects.toThrow('Invalid URL');
-      });
-    });
-  });
-
-  describe('sanitizePathSegment()', () => {
-    it('should reject segments with ../', () => {
-      expect(() => sanitizePathSegment('../etc/passwd')).toThrow('forbidden characters');
-    });
-
-    it('should reject segments with ..', () => {
-      expect(() => sanitizePathSegment('foo..bar')).toThrow('forbidden characters');
-    });
-
-    it('should reject segments with /', () => {
-      expect(() => sanitizePathSegment('foo/bar')).toThrow('forbidden characters');
-    });
-
-    it('should reject segments with backslash', () => {
-      expect(() => sanitizePathSegment('foo\\bar')).toThrow('forbidden characters');
-    });
-
-    it('should allow normal app IDs', () => {
-      expect(sanitizePathSegment('my-app')).toBe('my-app');
-      expect(sanitizePathSegment('strategy_123')).toBe('strategy_123');
-      expect(sanitizePathSegment('tic-tac-toe')).toBe('tic-tac-toe');
-    });
-
-    it('should allow IDs with dots (not ..)', () => {
-      expect(sanitizePathSegment('v1.2.3')).toBe('v1.2.3');
-    });
-
-    it('should return the segment unchanged', () => {
-      const id = 'my-strategy';
-      expect(sanitizePathSegment(id)).toBe(id);
-    });
-  });
-});

package/src/server/tests/lib/oauth2-refresh.test.ts

@@ -1,140 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { isTokenExpired, refreshAccessToken, OAUTH2_DEFAULT_EXCLUDE_FIELDS } from '../../lib/oauth2-refresh';
-import { CredentialFile } from '../../types';
-
-function makeOAuth2Credential(expiresAt: number | string | null | undefined): CredentialFile {
-  return {
-    id: 'cred-test1234',
-    agentId: 'agent-1',
-    type: 'oauth2',
-    name: 'Test OAuth2',
-    meta: {
-      token_endpoint: 'https://oauth.example.com/token',
-      scopes: 'read write',
-      expires_at: expiresAt,
-      auth_method: 'client_secret_post',
-    },
-    encrypted: { ciphertext: '', iv: '', salt: '', mac: '' },
-    createdAt: '2026-01-01T00:00:00Z',
-    updatedAt: '2026-01-01T00:00:00Z',
-  };
-}
-
-describe('isTokenExpired', () => {
-  it('returns true when expires_at is null', () => {
-    expect(isTokenExpired(makeOAuth2Credential(null))).toBe(true);
-  });
-
-  it('returns true when token is expired', () => {
-    const pastTimestamp = Math.floor(Date.now() / 1000) - 3600;
-    expect(isTokenExpired(makeOAuth2Credential(pastTimestamp))).toBe(true);
-  });
-
-  it('returns true when token expires within 60s buffer', () => {
-    const nearFuture = Math.floor(Date.now() / 1000) + 30;
-    expect(isTokenExpired(makeOAuth2Credential(nearFuture))).toBe(true);
-  });
-
-  it('returns true when expires_at is an invalid string', () => {
-    expect(isTokenExpired(makeOAuth2Credential('invalid-timestamp'))).toBe(true);
-  });
-
-  it('returns false when token is still valid', () => {
-    const futureTimestamp = Math.floor(Date.now() / 1000) + 3600;
-    expect(isTokenExpired(makeOAuth2Credential(futureTimestamp))).toBe(false);
-  });
-});
-
-describe('refreshAccessToken', () => {
-  beforeEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('sends correct request with client_secret_post', async () => {
-    const mockResponse = {
-      ok: true,
-      json: async () => ({
-        access_token: 'new-access-token',
-        refresh_token: 'new-refresh-token',
-        expires_in: 3600,
-        token_type: 'Bearer',
-      }),
-    };
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(mockResponse as Response);
-
-    const result = await refreshAccessToken(
-      'https://oauth.example.com/token',
-      'old-refresh-token',
-      'client-123',
-      'secret-456',
-      'client_secret_post',
-    );
-
-    expect(result.accessToken).toBe('new-access-token');
-    expect(result.refreshToken).toBe('new-refresh-token');
-    expect(result.expiresIn).toBe(3600);
-
-    const [url, opts] = (globalThis.fetch as ReturnType<typeof vi.fn>).mock.calls[0];
-    expect(url).toBe('https://oauth.example.com/token');
-    expect(opts.method).toBe('POST');
-    const body = opts.body as string;
-    expect(body).toContain('grant_type=refresh_token');
-    expect(body).toContain('client_id=client-123');
-    expect(body).toContain('client_secret=secret-456');
-  });
-
-  it('sends Basic auth with client_secret_basic', async () => {
-    const mockResponse = {
-      ok: true,
-      json: async () => ({ access_token: 'new-token' }),
-    };
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(mockResponse as Response);
-
-    await refreshAccessToken(
-      'https://oauth.example.com/token',
-      'refresh',
-      'client-id',
-      'client-secret',
-      'client_secret_basic',
-    );
-
-    const [, opts] = (globalThis.fetch as ReturnType<typeof vi.fn>).mock.calls[0];
-    const expected = Buffer.from('client-id:client-secret').toString('base64');
-    expect(opts.headers['Authorization']).toBe(`Basic ${expected}`);
-    expect(opts.body).not.toContain('client_id');
-  });
-
-  it('throws on non-OK response', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
-      ok: false,
-      status: 400,
-      text: async () => '{"error":"invalid_grant"}',
-    } as Response);
-
-    await expect(
-      refreshAccessToken('https://oauth.example.com/token', 'bad', 'c', 's'),
-    ).rejects.toThrow('OAuth2 refresh token revoked (400)');
-  });
-
-  it('treats invalid_grant JSON errors case-insensitively as revoked', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
-      ok: false,
-      status: 400,
-      text: async () => '{"error":"INVALID_GRANT"}',
-    } as Response);
-
-    await expect(
-      refreshAccessToken('https://oauth.example.com/token', 'bad', 'c', 's'),
-    ).rejects.toThrow('OAuth2 refresh token revoked (400)');
-  });
-});
-
-describe('OAUTH2_DEFAULT_EXCLUDE_FIELDS', () => {
-  it('excludes refresh_token, client_secret, client_id, token_endpoint', () => {
-    expect(OAUTH2_DEFAULT_EXCLUDE_FIELDS).toContain('refresh_token');
-    expect(OAUTH2_DEFAULT_EXCLUDE_FIELDS).toContain('client_secret');
-    expect(OAUTH2_DEFAULT_EXCLUDE_FIELDS).toContain('client_id');
-    expect(OAUTH2_DEFAULT_EXCLUDE_FIELDS).toContain('token_endpoint');
-    expect(OAUTH2_DEFAULT_EXCLUDE_FIELDS).not.toContain('access_token');
-  });
-});

package/src/server/tests/lib/passkey-credential.test.ts

@@ -1,153 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-vi.mock('../../lib/config', () => ({
-  DATA_PATHS: { credentials: '/tmp/test-creds' },
-}));
-
-vi.mock('../../lib/credential-agent', () => ({
-  getCredentialAgentKey: () => Buffer.from('a'.repeat(32)),
-}));
-
-vi.mock('../../lib/encrypt', () => ({
-  encryptWithSeed: (data: string, _key: Buffer) => ({
-    iv: 'test-iv',
-    data: Buffer.from(data).toString('base64'),
-    tag: 'test-tag',
-  }),
-  decryptWithSeed: (enc: any, _key: Buffer) => Buffer.from(enc.data, 'base64').toString(),
-}));
-
-vi.mock('fs', () => {
-  const store = new Map<string, string>();
-  return {
-    default: {
-      existsSync: (p: string) => store.has(p),
-      readFileSync: (p: string) => store.get(p)!,
-      writeFileSync: (p: string, data: string) => store.set(p, data),
-      mkdirSync: () => {},
-      readdirSync: (dir: string) => {
-        const files: string[] = [];
-        for (const key of store.keys()) {
-          if (key.startsWith(dir)) files.push(key.split('/').pop()!);
-        }
-        return files;
-      },
-      unlinkSync: (p: string) => store.delete(p),
-    },
-  };
-});
-
-import {
-  registerPasskey,
-  authenticatePasskey,
-  matchPasskeys,
-  _resetPasskeyCredentialChallengeStoreForTests,
-} from '../../lib/passkey-credential';
-
-function clientData(type: 'webauthn.create' | 'webauthn.get', challenge: string, origin: string): string {
-  return Buffer.from(JSON.stringify({ type, challenge, origin, crossOrigin: false })).toString('base64url');
-}
-
-describe('passkey-credential', () => {
-  beforeEach(() => {
-    _resetPasskeyCredentialChallengeStoreForTests();
-  });
-
-  it('registers a passkey and returns valid attestation data', () => {
-    const challenge = 'challenge-create-1';
-    const result = registerPasskey({
-      agentId: 'primary',
-      rpId: 'example.com',
-      rpName: 'Example',
-      userName: 'user@example.com',
-      displayName: 'Test User',
-      userHandle: 'dXNlcjEyMw',
-      challenge,
-      origin: 'https://example.com',
-      clientDataJSON: clientData('webauthn.create', challenge, 'https://example.com'),
-    });
-
-    expect(result.credentialId).toBeTruthy();
-    expect(result.attestationObject).toBeTruthy();
-    expect(result.publicKey).toBeTruthy();
-    expect(result.transports).toEqual(['internal']);
-    expect(result.auraCredentialId).toMatch(/^cred-/);
-  });
-
-  it('authenticates with a registered passkey', () => {
-    const regChallenge = 'reg-challenge';
-    const reg = registerPasskey({
-      agentId: 'primary',
-      rpId: 'test.com',
-      rpName: 'Test',
-      userName: 'alice',
-      displayName: 'Alice',
-      userHandle: 'YWxpY2U',
-      challenge: regChallenge,
-      origin: 'https://test.com',
-      clientDataJSON: clientData('webauthn.create', regChallenge, 'https://test.com'),
-    });
-
-    const authChallenge = 'auth-challenge';
-    const auth = authenticatePasskey({
-      auraCredentialId: reg.auraCredentialId,
-      rpId: 'test.com',
-      challenge: authChallenge,
-      origin: 'https://test.com',
-      clientDataJSON: clientData('webauthn.get', authChallenge, 'https://test.com'),
-    });
-
-    expect(auth.credentialId).toBe(reg.credentialId);
-    expect(auth.authenticatorData).toBeTruthy();
-    expect(auth.signature).toBeTruthy();
-    expect(auth.userHandle).toBe('YWxpY2U');
-  });
-
-  it('rejects challenge replay', () => {
-    const challenge = 'replay-challenge';
-    registerPasskey({
-      agentId: 'primary',
-      rpId: 'example.com',
-      userHandle: 'Ym9i',
-      challenge,
-      origin: 'https://example.com',
-      clientDataJSON: clientData('webauthn.create', challenge, 'https://example.com'),
-    });
-
-    expect(() => registerPasskey({
-      agentId: 'primary',
-      rpId: 'example.com',
-      userHandle: 'Ym9i',
-      challenge,
-      origin: 'https://example.com',
-      clientDataJSON: clientData('webauthn.create', challenge, 'https://example.com'),
-    })).toThrow('replay');
-  });
-
-  it('rejects authentication with wrong rpId', () => {
-    const regChallenge = 'reg-rpid';
-    const reg = registerPasskey({
-      agentId: 'primary',
-      rpId: 'correct.com',
-      userName: 'bob',
-      userHandle: 'Ym9i',
-      challenge: regChallenge,
-      origin: 'https://correct.com',
-      clientDataJSON: clientData('webauthn.create', regChallenge, 'https://correct.com'),
-    });
-
-    const authChallenge = 'auth-rpid';
-    expect(() => authenticatePasskey({
-      auraCredentialId: reg.auraCredentialId,
-      rpId: 'wrong.com',
-      challenge: authChallenge,
-      origin: 'https://wrong.com',
-      clientDataJSON: clientData('webauthn.get', authChallenge, 'https://wrong.com'),
-    })).toThrow('rpId mismatch');
-  });
-
-  it('matchPasskeys returns empty for unknown rpId', () => {
-    const matches = matchPasskeys('unknown-domain.com');
-    expect(matches).toEqual([]);
-  });
-});