claude-multiacc 2.0.42 → 2.0.44

package/tests/test_claude_token_identity.py

@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+"""Organization binding uses fake tokens and a loopback Messages endpoint only."""
+
+from __future__ import annotations
+
+from concurrent.futures import ThreadPoolExecutor
+from functools import partial
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import threading
+import unittest
+from unittest.mock import patch
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "lib"))
+import claude_token_identity as identity
+
+ORG = "11111111-2222-4333-8444-555555555555"
+OTHER = "99999999-8888-4777-8666-555555555555"
+TOKEN = "sk-ant-oat01-sandbox-token-a"
+SECOND = "sk-ant-oat01-sandbox-token-b"
+EMAIL = "sandbox@example.invalid"
+NOW = 1790292600
+
+
+class IdentityHandler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        state = self.server.state
+        size = int(self.headers.get("Content-Length", 0))
+        state["requests"].append({"path": self.path, "body": self.rfile.read(size).decode(),
+                                  "headers": dict(self.headers), "method": self.command})
+        code, org = state["code"], state.get("org")
+        if state.get("serialize_test"):
+            if len(state["requests"]) == 1:
+                state["first_seen"].set()
+                state["second_seen"].wait(0.2)
+                code, org = 429, OTHER
+            else:
+                state["second_seen"].set()
+                state["allow_second"].wait(2)
+                code, org = 200, None
+        self.send_response(code)
+        if org is not None:
+            self.send_header("anthropic-organization-id", org)
+        if state.get("location"):
+            self.send_header("Location", state["location"])
+        self.send_header("Content-Length", "0")
+        self.end_headers()
+
+    do_GET = do_POST
+
+    def log_message(self, _format, *_args):
+        pass
+
+
+class TokenIdentityTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="multiacc-token-identity-")
+        self.account = Path(self.temp.name) / "acct-01"
+        self.account.mkdir()
+        (self.account / "server.token").write_text(TOKEN)
+        self.manifest = self.account.parent / "accounts.json"
+        self.manifest.write_text(json.dumps({"accounts": [{"id": "acct-01", "email": EMAIL}]}))
+        self.config = self.account / ".claude.json"
+        self.config.write_text(json.dumps({"oauthAccount": {"organizationUuid": ORG, "emailAddress": EMAIL}}))
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), IdentityHandler)
+        self.server.state = {"code": 200, "org": ORG, "requests": []}
+        self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
+        self.thread.start()
+        self.url = f"http://127.0.0.1:{self.server.server_port}/v1/messages?beta=true"
+        self.check = partial(identity.check_identity, self.account, endpoint=self.url, version="2.1.282")
+        self.env = patch.dict(os.environ, {"HOME": self.temp.name, "PATH": os.defpath}, clear=True)
+        self.env.start()
+
+    def tearDown(self):
+        self.env.stop()
+        self.server.shutdown()
+        self.server.server_close()
+        self.thread.join(timeout=5)
+        self.temp.cleanup()
+
+    def test_match_is_bound_and_legacy_auth_receipt_cannot_skip_probe(self):
+        (self.account / ".server-token-verified").write_text(hashlib.sha256(TOKEN.encode()).hexdigest())
+        result = self.check(now=NOW)
+        self.assertEqual(result["state"], "match")
+        self.assertFalse(result["cached"])
+        self.assertEqual(identity.cached_identity(self.account, now=NOW)["state"], "match")
+        self.assertTrue(self.check(now=NOW + 86400)["cached"])
+        requests = self.server.state["requests"]
+        self.assertEqual(len(requests), 1)
+        request = requests[0]
+        self.assertEqual(request["path"], "/v1/messages?beta=true")
+        self.assertEqual(json.loads(request["body"]), {
+            "model": identity.MODEL, "max_tokens": 1, "messages": [{"role": "user", "content": "quota"}]})
+        self.assertLess(len(request["body"]), 256)
+        headers = {k.lower(): v for k, v in request["headers"].items()}
+        self.assertEqual(headers["authorization"], "Bearer " + TOKEN)
+        self.assertIn("oauth-2025-04-20", headers["anthropic-beta"])
+        self.assertEqual(headers["user-agent"], "claude-cli/2.1.282 (external, cli, client-app/claude-multiacc)")
+        receipt = self.account / identity.RECEIPT
+        self.assertEqual(receipt.stat().st_mode & 0o777, 0o600)
+        self.assertNotIn(TOKEN, receipt.read_text())
+        self.assertNotIn(ORG, json.dumps(result))
+        self.assertEqual(json.loads(receipt.read_text())["expected_org"], ORG)
+
+    def test_quota_rejection_identifies_mismatch_and_persists(self):
+        self.config.write_text(json.dumps({"oauthAccount": {"organizationUuid": ORG, "emailAddress": EMAIL},
+                                           "projects": {"sandbox": {"history": "x" * 32768}}}))
+        self.assertGreater(self.config.stat().st_size, 16384)
+        self.server.state.update(code=429, org=OTHER)
+        with patch.object(identity.os, "replace", side_effect=PermissionError):
+            result = self.check(now=NOW, model="claude-opus-4-6")
+        self.assertEqual(result["state"], "mismatch")
+        self.assertFalse((self.account / identity.RECEIPT).exists())
+        headers = {k.lower(): v for k, v in self.server.state["requests"][0]["headers"].items()}
+        self.assertIn("claude-code-20250219", headers["anthropic-beta"])
+        with patch.object(identity.os, "open", side_effect=PermissionError):
+            self.assertEqual(self.check(now=NOW)["state"], "mismatch")
+        self.assertFalse((self.account / identity.RECEIPT).exists())
+        result = self.check(now=NOW)
+        self.assertEqual(result["state"], "mismatch")
+        self.assertEqual(result["http_status"], 429)
+        self.server.state.update(code=200, org=ORG)
+        self.assertEqual(self.check(now=NOW + 365 * 86400)["state"], "mismatch")
+        self.assertEqual(len(self.server.state["requests"]), 3)
+        stored = json.loads((self.account / identity.RECEIPT).read_text())
+        self.assertEqual(stored["actual_org"], OTHER)
+        self.assertNotIn(OTHER, json.dumps(result))
+        self.config.write_text("{}")
+        candidate = self.check(expected_email=EMAIL, persist=False, now=NOW)
+        self.assertEqual(candidate["state"], "mismatch")
+        self.assertTrue(candidate["cached"])
+        conflict = self.check(expected_email="different@example.invalid", persist=False, now=NOW)
+        self.assertEqual((conflict["state"], conflict["reason"]), ("mismatch", "profile_manifest_mismatch"))
+        self.assertEqual(len(self.server.state["requests"]), 3)
+
+    def test_token_and_expected_organization_changes_invalidate_cache(self):
+        self.assertEqual(self.check(now=NOW)["state"], "match")
+        receipt_before = (self.account / identity.RECEIPT).read_bytes()
+        self.server.state["org"] = OTHER
+        self.assertEqual(self.check(SECOND, now=NOW, persist=False)["state"], "mismatch")
+        self.assertEqual((self.account / identity.RECEIPT).read_bytes(), receipt_before)
+        self.assertEqual(identity.cached_identity(self.account, now=NOW)["state"], "match")
+        self.server.state["org"] = ORG
+        (self.account / "server.token").write_text(SECOND)
+        self.assertFalse(self.check(now=NOW + 1)["cached"])
+        self.config.write_text(json.dumps({"oauthAccount": {"organizationUuid": OTHER}}))
+        self.assertEqual(self.check(now=NOW + 2)["state"], "mismatch")
+        self.config.write_text(json.dumps({"oauthAccount": {"organizationUuid": ORG.upper()}}))
+        self.assertEqual(self.check(now=NOW + 3)["state"], "match")
+        self.assertEqual(len(self.server.state["requests"]), 5)
+        stored = json.loads((self.account / identity.RECEIPT).read_text())
+        self.assertEqual(stored["token_digest"], hashlib.sha256(SECOND.encode()).hexdigest())
+        self.config.write_text("{}")
+        self.assertEqual(identity.cached_identity(self.account, now=NOW + 4)["state"], "match")
+        self.assertTrue(self.check(now=NOW + 4)["cached"])
+        self.manifest.write_text(json.dumps({"accounts": [{"id": "acct-01", "email": "changed@example.invalid"}]}))
+        self.assertEqual(identity.cached_identity(self.account, now=NOW + 5)["state"], "unknown")
+        moved = self.account.parent / "acct-02"
+        self.account.rename(moved)
+        self.manifest.write_text(json.dumps({"accounts": [{"id": "acct-02", "email": EMAIL}]}))
+        self.assertEqual(identity.cached_identity(moved, now=NOW + 6)["state"], "unknown")
+        self.assertEqual(len(self.server.state["requests"]), 5)
+
+    def test_unknown_and_auth_failures_back_off_then_retry(self):
+        for code, org, reason in [(200, None, "missing_organization"), (401, None, "auth_failed"),
+                                  (403, None, "auth_failed"), (429, "bad-id", "missing_organization")]:
+            with self.subTest(code=code, org=org):
+                (self.account / identity.RECEIPT).unlink(missing_ok=True)
+                self.server.state.update(code=code, org=org)
+                result = self.check(now=NOW)
+                self.assertEqual((result["state"], result["reason"]), ("unknown", reason))
+                count = len(self.server.state["requests"])
+                self.server.state.update(code=200, org=ORG)
+                self.assertTrue(self.check(now=NOW + 59)["cached"])
+                self.assertEqual(len(self.server.state["requests"]), count)
+                self.assertEqual(self.check(now=NOW + 60)["state"], "match")
+        (self.account / identity.RECEIPT).unlink()
+        with patch.object(identity.urllib.request.OpenerDirector, "open", side_effect=TimeoutError) as opened:
+            result = self.check(now=NOW)
+        self.assertEqual((result["state"], result["reason"]), ("unknown", "request_failed"))
+        self.assertEqual(opened.call_count, 1)
+        self.assertEqual(opened.call_args.kwargs["timeout"], 10)
+        (self.account / identity.RECEIPT).unlink()
+        self.server.state.update(serialize_test=True, requests=[], first_seen=threading.Event(),
+                                 second_seen=threading.Event(), allow_second=threading.Event())
+        with ThreadPoolExecutor(max_workers=2) as executor:
+            first = executor.submit(self.check, now=NOW)
+            self.assertTrue(self.server.state["first_seen"].wait(2))
+            second = executor.submit(self.check, now=NOW)
+            first_result = first.result(timeout=3)
+            self.server.state["allow_second"].set()
+            second_result = second.result(timeout=3)
+        self.assertEqual([first_result["state"], second_result["state"]], ["mismatch", "mismatch"])
+        self.assertEqual(len(self.server.state["requests"]), 1)
+        self.assertEqual(identity.cached_identity(self.account, now=NOW)["state"], "mismatch")
+
+    def test_redirects_never_forward_the_token(self):
+        for url in ("https://example.invalid/v1/messages", "http://[invalid"):
+            (self.account / identity.RECEIPT).unlink(missing_ok=True)
+            result = identity.check_identity(self.account, endpoint=url, now=NOW)
+            self.assertEqual((result["state"], result["reason"]), ("unknown", "invalid_endpoint"))
+        self.assertEqual(len(self.server.state["requests"]), 0)
+        for code in (301, 302, 303, 307, 308):
+            with self.subTest(code=code):
+                (self.account / identity.RECEIPT).unlink(missing_ok=True)
+                self.server.state.update(code=code, org=OTHER, location=self.url + "&redirected=1")
+                count = len(self.server.state["requests"])
+                result = self.check(now=NOW)
+                self.assertEqual((result["state"], result["reason"]), ("unknown", "redirect"))
+                self.assertEqual(len(self.server.state["requests"]), count + 1)
+
+    def test_cli_exact_stdin_and_missing_config_are_safe(self):
+        env = dict(os.environ, CLAUDE_MULTIACC_TOKEN_IDENTITY_URL=self.url,
+                   CLAUDE_MULTIACC_CLI_VERSION="2.1.282")
+        done = subprocess.run([sys.executable, str(REPO / "lib/claude_token_identity.py"),
+                               "check", str(self.account), "--token-stdin"],
+                              input=SECOND, text=True, capture_output=True, env=env, timeout=15)
+        self.assertEqual(done.returncode, 0, done.stderr)
+        result = json.loads(done.stdout)
+        self.assertEqual(result["state"], "match")
+        self.assertEqual(result["token_digest"], hashlib.sha256(SECOND.encode()).hexdigest())
+        self.assertNotIn(SECOND, done.stdout + done.stderr)
+        self.assertNotIn(ORG, done.stdout + done.stderr)
+        self.assertEqual(self.server.state["requests"][0]["headers"]["Authorization"], "Bearer " + SECOND)
+        cached = subprocess.run([sys.executable, str(REPO / "lib/claude_token_identity.py"),
+                                 "cached", str(self.account), "--token-stdin", "--format", "state"],
+                                input=SECOND, text=True, capture_output=True, env=env, timeout=15)
+        self.assertEqual(cached.stdout, "match\n")
+        for document in ("not-json", "[]", "{}"):
+            self.config.write_text(document)
+            self.assertEqual(self.check(now=NOW)["reason"], "missing_expected_organization")
+        self.assertEqual(len(self.server.state["requests"]), 1)
+        self.config.write_text(json.dumps({"oauthAccount": {
+            "organizationUuid": ORG, "emailAddress": "different@example.invalid"}}))
+        conflict = identity.cached_identity(self.account)
+        self.assertEqual((conflict["state"], conflict["reason"]), ("mismatch", "profile_manifest_mismatch"))
+        self.assertEqual(self.check()["state"], "mismatch")
+        self.assertEqual(len(self.server.state["requests"]), 1)
+        self.manifest.write_text('{"accounts": []}')
+        candidate = subprocess.run([sys.executable, str(REPO / "lib/claude_token_identity.py"),
+                                    "check", str(self.account), "--token-stdin", "--no-store",
+                                    "--expected-email", EMAIL, "--format", "state"],
+                                   input=SECOND, text=True, capture_output=True, env=env, timeout=15)
+        self.assertEqual(candidate.stdout, "mismatch\n")
+        self.config.write_text(json.dumps({"oauthAccount": {"organizationUuid": ORG}}))
+        result = self.check(expected_email=EMAIL, persist=False)
+        self.assertEqual((result["state"], result["reason"]), ("unknown", "missing_profile_email"))
+        self.assertEqual(len(self.server.state["requests"]), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()