create-ailk 0.14.0 → 0.16.0

package/templates/apps/api/src/routes/auth/__tests__/hub-sign-in.test.ts

@@ -0,0 +1,483 @@
+/**
+ * @file hub-sign-in.test.ts
+ *
+ * The four hub-sign-in routes through a real Fastify instance, wired as
+ * `server.ts` wires them (#7894, spec
+ * docs/specs/7894-the-hub-signs-in-its-spec.md D5, D6; AC-4, AC-5):
+ * `codes` and `me` behind the auth preHandler, `token` and `revoke` in their
+ * own scope without one.
+ *
+ * The REAL preHandler, routes, service and store run over an in-memory stand-in
+ * for the Prisma delegates (`__tests__/support/hub-sign-in-fake-db.ts`).
+ *
+ * External dependency boundary mocked:
+ *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../../lib/prisma.js");
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+import {
+  installHubSignInFakeDb,
+  pkcePair,
+  seedSpoke,
+  seedUser,
+  type FakeHubDb,
+  type FakeUser,
+  type SeededSpoke,
+} from "../../../__tests__/support/hub-sign-in-fake-db.js";
+import { hashAgentKey, mintAgentKey } from "../../../lib/agent-store.js";
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { __resetHubSignInBuckets } from "../../../services/hub-sign-in.js";
+import {
+  hubSignInClientRoutes,
+  hubSignInSessionRoutes,
+} from "../hub-sign-in.js";
+
+const db = jest.mocked(prisma);
+
+const HUB = "https://hub.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+const COOKIE_TOKEN = "cookie_pat";
+
+let state: FakeHubDb;
+let app: FastifyInstance;
+let user: FakeUser;
+let spoke: SeededSpoke;
+
+function buildApp(): FastifyInstance {
+  const server = Fastify();
+  server.register(async (authScope) => {
+    await authScope.register(authPreHandlerPlugin, { trustedOrigins: [HUB] });
+    await authScope.register(hubSignInSessionRoutes);
+  });
+  server.register(hubSignInClientRoutes);
+  return server;
+}
+
+beforeEach(async () => {
+  jest.resetAllMocks();
+  state = installHubSignInFakeDb(db);
+  __resetHubSignInBuckets();
+
+  user = seedUser(state);
+  spoke = seedSpoke(state);
+
+  // The Better Auth session the cookie path resolves.
+  (db.session.findUnique as jest.Mock).mockImplementation(
+    async ({ where }: { where: { token: string } }) =>
+      where.token === COOKIE_TOKEN
+        ? {
+            id: "sess_1",
+            userId: user.id,
+            expiresAt: FUTURE,
+            activeOrganizationId: null,
+            activeWorkspaceId: null,
+          }
+        : null,
+  );
+
+  app = buildApp();
+  await app.ready();
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+const cookieHeaders = () => ({
+  cookie: `better-auth.session_token=${COOKIE_TOKEN}`,
+  origin: HUB,
+});
+
+async function postCode(
+  headers: Record<string, string>,
+  overrides: Record<string, unknown> = {},
+  challenge = pkcePair().challenge,
+) {
+  return app.inject({
+    method: "POST",
+    url: "/v1/hub-sign-in/codes",
+    headers,
+    payload: {
+      clientId: spoke.client.clientId,
+      redirectUri: spoke.redirectUri,
+      codeChallenge: challenge,
+      ...overrides,
+    },
+  });
+}
+
+async function postToken(
+  s: SeededSpoke,
+  body: Record<string, unknown>,
+  headers: Record<string, string> = {},
+) {
+  return app.inject({
+    method: "POST",
+    url: "/v1/hub-sign-in/token",
+    headers: { authorization: s.basic, "x-ailk-spoke-key": s.key, ...headers },
+    payload: { redirectUri: s.redirectUri, ...body },
+  });
+}
+
+/** The whole sign-in, over HTTP: cookie → code → token. */
+async function signIn(s: SeededSpoke = spoke): Promise<string> {
+  const { verifier, challenge } = pkcePair();
+  const minted = await app.inject({
+    method: "POST",
+    url: "/v1/hub-sign-in/codes",
+    headers: cookieHeaders(),
+    payload: {
+      clientId: s.client.clientId,
+      redirectUri: s.redirectUri,
+      codeChallenge: challenge,
+    },
+  });
+  expect(minted.statusCode).toBe(201);
+  const { code } = minted.json().data as { code: string };
+  const exchanged = await postToken(s, { code, codeVerifier: verifier });
+  expect(exchanged.statusCode).toBe(200);
+  return (exchanged.json().data as { accessToken: string }).accessToken;
+}
+
+describe("POST /v1/hub-sign-in/codes", () => {
+  it("a cookie session mints a code: 201, the envelope, no-store, no cookie", async () => {
+    const res = await postCode(cookieHeaders());
+
+    expect(res.statusCode).toBe(201);
+    expect(res.headers["cache-control"]).toBe("no-store");
+    expect(res.headers["set-cookie"]).toBeUndefined();
+    expect(res.json()).toEqual({
+      ok: true,
+      data: {
+        code: expect.stringMatching(/^[A-Za-z0-9_-]{43}$/),
+        redirectUri: spoke.redirectUri,
+      },
+    });
+    expect(state.verifications).toHaveLength(1);
+  });
+
+  it("is 401 with no credential at all, and 401 for a cookie write with no Origin", async () => {
+    expect((await postCode({})).statusCode).toBe(401);
+    expect(
+      (await postCode({ cookie: cookieHeaders().cookie })).statusCode,
+    ).toBe(401);
+    expect(state.verifications).toHaveLength(0);
+  });
+
+  it("AC-5: refuses a personal ApiToken (403), an agent key (403) and a hub credential (404) — and writes no code", async () => {
+    // A personal API token: authenticated, but no cookie session.
+    (db.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok_1",
+      userId: user.id,
+      expiresAt: null,
+      revokedAt: null,
+    });
+    (db.apiToken.update as jest.Mock).mockResolvedValue({});
+    const apiToken = await postCode({ authorization: "Bearer tok_live_abc" });
+    expect(apiToken.statusCode).toBe(403);
+    expect(apiToken.json()).toEqual({
+      ok: false,
+      error: { code: "forbidden", message: "Forbidden" },
+    });
+
+    // An agent key: refused at the preHandler on any route outside a tenant guard.
+    const agentKey = mintAgentKey();
+    (db.agent.findUnique as jest.Mock).mockImplementation(
+      async ({ where }: { where: { credentialHash: string } }) =>
+        where.credentialHash === hashAgentKey(agentKey)
+          ? {
+              id: "agent_00000000-0000-7000-8000-0000000000c1",
+              workspaceId: "wksp_00000000-0000-7000-8000-0000000000a1",
+              organizationId: "org_00000000-0000-7000-8000-000000000aaa",
+              permissionLevel: "member",
+              enabled: true,
+              keyIssuedToMembershipId:
+                "member_00000000-0000-7000-8000-0000000000f1",
+              lastActiveAt: null,
+              responsible: {
+                id: "member_00000000-0000-7000-8000-0000000000f2",
+                userId: user.id,
+              },
+            }
+          : null,
+    );
+    (db.agent.update as jest.Mock).mockResolvedValue({});
+    const agent = await postCode({ authorization: `Bearer ${agentKey}` });
+    expect(agent.statusCode).toBe(403);
+
+    // A hub credential: this route is not on its list.
+    const credential = await signIn();
+    state.verifications.length = 0;
+    const hub = await postCode({
+      authorization: `Bearer ${credential}`,
+      "x-ailk-spoke-key": spoke.key,
+    });
+    expect(hub.statusCode).toBe(404);
+
+    expect(state.verifications).toHaveLength(0);
+  });
+
+  it("maps the service's refusals: unregistered callback 400, unverified email 403, bad body 400", async () => {
+    const callback = await postCode(cookieHeaders(), {
+      redirectUri: "https://attacker.example.com/api/hub-session/callback",
+    });
+    expect(callback.statusCode).toBe(400);
+    expect(callback.json().error.code).toBe("invalid_redirect_uri");
+
+    const body = await postCode(cookieHeaders(), { codeChallenge: "short" });
+    expect(body.statusCode).toBe(400);
+    expect(body.json().error.code).toBe("invalid_request");
+
+    user.emailVerified = false;
+    const unverified = await postCode(cookieHeaders());
+    expect(unverified.statusCode).toBe(403);
+    expect(unverified.json().error.code).toBe("email_unverified");
+    expect(state.verifications).toHaveLength(0);
+  });
+
+  it("answers 429 with Retry-After past the per-user budget", async () => {
+    let last = await postCode(cookieHeaders());
+    for (let i = 0; i < 30; i += 1) last = await postCode(cookieHeaders());
+    expect(last.statusCode).toBe(429);
+    expect(Number(last.headers["retry-after"])).toBeGreaterThan(0);
+    expect(last.json().error.code).toBe("rate_limited");
+  });
+});
+
+describe("AC-4: one cookie session, two spokes", () => {
+  it("signs the same person in to both: two grants, one userId, different clients — and each credential works only with its own spoke's key", async () => {
+    const other = seedSpoke(state, "other.example.com");
+
+    const credentialA = await signIn(spoke);
+    const credentialB = await signIn(other);
+
+    expect(state.authorizations).toHaveLength(2);
+    expect(new Set(state.authorizations.map((g) => g.userId))).toEqual(
+      new Set([user.id]),
+    );
+    expect(new Set(state.authorizations.map((g) => g.clientId)).size).toBe(2);
+
+    const me = (credential: string, s: SeededSpoke) =>
+      app.inject({
+        method: "GET",
+        url: "/v1/hub-sign-in/me",
+        headers: { authorization: `Bearer ${credential}`, "x-ailk-spoke-key": s.key },
+      });
+    expect((await me(credentialA, spoke)).statusCode).toBe(200);
+    expect((await me(credentialB, other)).statusCode).toBe(200);
+    // A's credential with B's key (and the reverse) is refused at the preHandler.
+    expect((await me(credentialA, other)).statusCode).toBe(401);
+    expect((await me(credentialB, spoke)).statusCode).toBe(401);
+  });
+});
+
+describe("POST /v1/hub-sign-in/token", () => {
+  it("exchanges a code: 200, the envelope, no-store, and NEVER a Set-Cookie or a Session", async () => {
+    const { verifier, challenge } = pkcePair();
+    const minted = await postCode(cookieHeaders(), {}, challenge);
+    const { code } = minted.json().data as { code: string };
+
+    const res = await postToken(spoke, { code, codeVerifier: verifier });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.headers["set-cookie"]).toBeUndefined();
+    expect(res.headers["cache-control"]).toBe("no-store");
+    expect(res.json().data).toMatchObject({
+      accessToken: expect.stringMatching(/^ailk_hst_/),
+      tokenType: "Bearer",
+      expiresIn: 86400,
+      user: { id: user.id, email: user.email, emailVerified: true },
+    });
+    expect(db.session.create).not.toHaveBeenCalled();
+    expect(state.sessionCalls).not.toContain("create");
+  });
+
+  it("every refusal is the envelope with the right status and no Set-Cookie", async () => {
+    const { verifier, challenge } = pkcePair();
+    const minted = await postCode(cookieHeaders(), {}, challenge);
+    const { code } = minted.json().data as { code: string };
+
+    const noKey = await app.inject({
+      method: "POST",
+      url: "/v1/hub-sign-in/token",
+      headers: { authorization: spoke.basic },
+      payload: { code, redirectUri: spoke.redirectUri, codeVerifier: verifier },
+    });
+    expect(noKey.statusCode).toBe(401);
+    expect(noKey.json()).toEqual({
+      ok: false,
+      error: {
+        code: "invalid_client",
+        message: "Client authentication failed",
+      },
+    });
+
+    const wrongVerifier = await postToken(spoke, {
+      code,
+      codeVerifier: pkcePair().verifier,
+    });
+    expect(wrongVerifier.statusCode).toBe(400);
+    expect(wrongVerifier.json().error.code).toBe("invalid_grant");
+
+    const malformed = await postToken(spoke, {
+      code: "short",
+      codeVerifier: "v",
+    });
+    expect(malformed.statusCode).toBe(400);
+    expect(malformed.json().error.code).toBe("invalid_request");
+
+    for (const res of [noKey, wrongVerifier, malformed]) {
+      expect(res.headers["set-cookie"]).toBeUndefined();
+    }
+    expect(state.authorizations).toHaveLength(0);
+  });
+
+  it("is reachable without any person's session (it sits outside the auth scope)", async () => {
+    const res = await postToken(spoke, {
+      code: "x".repeat(43),
+      codeVerifier: pkcePair().verifier,
+    });
+    // 400 invalid_grant — not the preHandler's 401.
+    expect(res.statusCode).toBe(400);
+    expect(res.json().error.code).toBe("invalid_grant");
+  });
+});
+
+describe("POST /v1/hub-sign-in/revoke", () => {
+  it("revokes a credential, which the preHandler then refuses", async () => {
+    const credential = await signIn();
+    const me = () =>
+      app.inject({
+        method: "GET",
+        url: "/v1/hub-sign-in/me",
+        headers: {
+          authorization: `Bearer ${credential}`,
+          "x-ailk-spoke-key": spoke.key,
+        },
+      });
+    expect((await me()).statusCode).toBe(200);
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/hub-sign-in/revoke",
+      headers: { authorization: spoke.basic, "x-ailk-spoke-key": spoke.key },
+      payload: { accessToken: credential },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: { revoked: true } });
+    expect((await me()).statusCode).toBe(401);
+  });
+
+  it("is 401 invalid_client without the spoke key", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/hub-sign-in/revoke",
+      headers: { authorization: spoke.basic },
+      payload: { code: "x".repeat(43) },
+    });
+    expect(res.statusCode).toBe(401);
+  });
+});
+
+describe("GET /v1/hub-sign-in/me", () => {
+  it("answers the credential's person, with a null customer id when no Person of the spoke's workspace is theirs", async () => {
+    const credential = await signIn();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/hub-sign-in/me",
+      headers: {
+        authorization: `Bearer ${credential}`,
+        "x-ailk-spoke-key": spoke.key,
+      },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.headers["cache-control"]).toBe("no-store");
+    expect(res.json()).toEqual({
+      ok: true,
+      data: {
+        user: {
+          id: user.id,
+          name: user.name,
+          email: user.email,
+          emailVerified: true,
+          createdAt: user.createdAt.toISOString(),
+        },
+        billingCustomerId: null,
+      },
+    });
+  });
+
+  it("vouches for the customer id of the Person in the credential's OWN spoke workspace (#7961, D13)", async () => {
+    const other = seedSpoke(state, "other.example.com");
+    const people = [
+      { id: "person_a", workspaceId: spoke.spoke.workspaceId, email: user.email, userId: user.id, billingCustomerId: "cus_a" },
+      { id: "person_b", workspaceId: other.spoke.workspaceId, email: user.email, userId: user.id, billingCustomerId: "cus_b" },
+    ];
+    db.person.findFirst.mockImplementation((async ({
+      where,
+    }: {
+      where: Record<string, unknown>;
+    }) =>
+      people.find((row) =>
+        Object.entries(where).every(
+          ([key, value]) => row[key as keyof (typeof people)[number]] === value,
+        ),
+      ) ?? null) as never);
+
+    for (const [s, expected] of [
+      [spoke, "cus_a"],
+      [other, "cus_b"],
+    ] as const) {
+      const credential = await signIn(s);
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/hub-sign-in/me",
+        headers: {
+          authorization: `Bearer ${credential}`,
+          "x-ailk-spoke-key": s.key,
+        },
+      });
+      expect(res.statusCode).toBe(200);
+      expect(res.json().data.billingCustomerId).toBe(expected);
+    }
+  });
+
+  it("is 404 for a cookie session — only the hub credential reaches it", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/hub-sign-in/me",
+      headers: cookieHeaders(),
+    });
+    expect(res.statusCode).toBe(404);
+  });
+
+  it("is 401 with the credential but no spoke key, or with another spoke's key", async () => {
+    const credential = await signIn();
+    const other = seedSpoke(state, "other.example.com");
+
+    const noKey = await app.inject({
+      method: "GET",
+      url: "/v1/hub-sign-in/me",
+      headers: { authorization: `Bearer ${credential}` },
+    });
+    expect(noKey.statusCode).toBe(401);
+
+    const wrongKey = await app.inject({
+      method: "GET",
+      url: "/v1/hub-sign-in/me",
+      headers: {
+        authorization: `Bearer ${credential}`,
+        "x-ailk-spoke-key": other.key,
+      },
+    });
+    expect(wrongKey.statusCode).toBe(401);
+  });
+});

package/templates/apps/api/src/routes/auth/hub-sign-in.ts

@@ -0,0 +1,201 @@
+/**
+ * The hub signs in its spokes — four routes (#7894, spec
+ * docs/specs/7894-the-hub-signs-in-its-spec.md D5, D6).
+ *
+ *   POST /v1/hub-sign-in/codes   — a cookie session mints a single-use code
+ *   POST /v1/hub-sign-in/token   — the client trades a code for a credential
+ *   POST /v1/hub-sign-in/revoke  — the client ends a credential / burns a code
+ *   GET  /v1/hub-sign-in/me      — the credential's person, read live, and the
+ *                                  customer id the hub vouches for (D13)
+ *
+ * Two registrations, because two different callers reach them:
+ *
+ *   - `hubSignInSessionRoutes` (`codes`, `me`) go in `server.ts`'s `authScope`:
+ *     `request.userId` is set by the auth preHandler before either handler
+ *     runs. `codes` answers only a cookie session (`request.sessionTenant` is
+ *     the cookie-only signal): an `ApiToken` is 403 here, an agent key is 403
+ *     at the preHandler, and a hub credential is 404 there — none of them
+ *     reaches a code write. `me` answers only the hub credential
+ *     (`request.hubSession` is set by that one branch); any other caller is 404.
+ *   - `hubSignInClientRoutes` (`token`, `revoke`) go in their OWN scope outside
+ *     `authScope`: the caller is a spoke's server, authenticated by its client
+ *     secret and its spoke key, not by a person's session. The scope carries
+ *     the per-IP limiter; the per-client bucket lives in the service, keyed on
+ *     the VERIFIED client.
+ *
+ * Envelope per apps/api/CLAUDE.md: `{ ok: true, data }` /
+ * `{ ok: false, error: { code, message } }`, real HTTP status codes. Every
+ * success body is re-validated against its own `.strict()` contract before it
+ * leaves the process. Credentials and codes are never logged and every body
+ * that carries one is `Cache-Control: no-store`. No route here writes a
+ * `Session` row or sets a cookie.
+ *
+ * API↔MCP parity: a credential exchange between a site and its hub is not an
+ * agent-facing call — no MCP twin for any of the four (the same footing as
+ * `/v1/auth/tokens`; recorded in apps/api/CLAUDE.md).
+ */
+import { logger } from "@working-theory/observability";
+import {
+  hubSignInCodeResponseSchema,
+  hubSignInMeResponseSchema,
+  hubSignInRevokeResponseSchema,
+  hubSignInTokenResponseSchema,
+} from "@working-theory/validation";
+import type { FastifyPluginAsync, FastifyReply, FastifyRequest } from "fastify";
+import type { ZodType } from "zod";
+
+import {
+  createCode,
+  exchange,
+  readMe,
+  revoke,
+  type Result,
+} from "../../services/hub-sign-in.js";
+
+/** These bodies are a few hundred bytes; bound them well below the default. */
+const BODY_LIMIT_BYTES = 4_096;
+
+const SPOKE_KEY_HEADER = "x-ailk-spoke-key";
+
+function error(
+  reply: FastifyReply,
+  status: number,
+  code: string,
+  message: string,
+): FastifyReply {
+  return reply.status(status).send({ ok: false, error: { code, message } });
+}
+
+function notFound(reply: FastifyReply): FastifyReply {
+  return error(reply, 404, "not_found", "Not found");
+}
+
+/** A single string header value, or `undefined` for an absent or repeated one. */
+function singleHeader(
+  request: FastifyRequest,
+  name: string,
+): string | undefined {
+  const value = request.headers[name];
+  return typeof value === "string" ? value : undefined;
+}
+
+/** Send a service result: its refusal, or its value re-validated against `schema`. */
+function respond<T>(
+  reply: FastifyReply,
+  result: Result<T>,
+  schema: ZodType<T>,
+  route: string,
+  successStatus: number,
+): FastifyReply {
+  if (!result.ok) {
+    const { status, code, message, retryAfter } = result.error;
+    if (retryAfter !== undefined)
+      reply.header("Retry-After", String(retryAfter));
+    return error(reply, status, code, message);
+  }
+  const parsed = schema.safeParse(result.value);
+  if (!parsed.success) {
+    // Issues only — never the value, which may carry a code or a credential.
+    logger.error(
+      { route, issues: parsed.error.issues.map((i) => i.path.join(".")) },
+      "[hub-sign-in] response failed its own contract schema",
+    );
+    return error(
+      reply,
+      500,
+      "internal_error",
+      "Response failed contract validation",
+    );
+  }
+  return reply
+    .status(successStatus)
+    .header("Cache-Control", "no-store")
+    .header("Pragma", "no-cache")
+    .send({ ok: true, data: parsed.data });
+}
+
+/** `codes` and `me` — registered in `server.ts`'s `authScope`. */
+export const hubSignInSessionRoutes: FastifyPluginAsync = async (fastify) => {
+  fastify.post(
+    "/v1/hub-sign-in/codes",
+    { bodyLimit: BODY_LIMIT_BYTES },
+    async (request, reply) => {
+      const userId = request.userId;
+      if (!userId) {
+        return error(reply, 401, "unauthorized", "Authentication required");
+      }
+      // A cookie session only. A personal ApiToken reaches here with a userId
+      // and no sessionTenant; it must mint nothing (D5).
+      if (!request.sessionTenant) {
+        return error(reply, 403, "forbidden", "Forbidden");
+      }
+      const result = await createCode({ userId, body: request.body });
+      return respond(
+        reply,
+        result,
+        hubSignInCodeResponseSchema,
+        "hub-sign-in/codes",
+        201,
+      );
+    },
+  );
+
+  fastify.get("/v1/hub-sign-in/me", async (request, reply) => {
+    // Reachable only by the hub credential: `hubSession` is set by that one
+    // preHandler branch and by nothing else.
+    if (!request.hubSession || !request.userId) return notFound(reply);
+    const result = await readMe(
+      request.userId,
+      request.hubSession.workspaceId,
+      request.log,
+    );
+    return respond(
+      reply,
+      result,
+      hubSignInMeResponseSchema,
+      "hub-sign-in/me",
+      200,
+    );
+  });
+};
+
+/** `token` and `revoke` — registered in their own rate-limited scope. */
+export const hubSignInClientRoutes: FastifyPluginAsync = async (fastify) => {
+  fastify.post(
+    "/v1/hub-sign-in/token",
+    { bodyLimit: BODY_LIMIT_BYTES },
+    async (request, reply) => {
+      const result = await exchange({
+        authorization: singleHeader(request, "authorization"),
+        spokeKey: singleHeader(request, SPOKE_KEY_HEADER),
+        body: request.body,
+      });
+      return respond(
+        reply,
+        result,
+        hubSignInTokenResponseSchema,
+        "hub-sign-in/token",
+        200,
+      );
+    },
+  );
+
+  fastify.post(
+    "/v1/hub-sign-in/revoke",
+    { bodyLimit: BODY_LIMIT_BYTES },
+    async (request, reply) => {
+      const result = await revoke({
+        authorization: singleHeader(request, "authorization"),
+        spokeKey: singleHeader(request, SPOKE_KEY_HEADER),
+        body: request.body,
+      });
+      return respond(
+        reply,
+        result,
+        hubSignInRevokeResponseSchema,
+        "hub-sign-in/revoke",
+        200,
+      );
+    },
+  );
+};