create-ailk 0.18.0 → 0.19.0

package/templates/apps/api/src/middleware/__tests__/auth.hub-session-path.test.ts

@@ -5,12 +5,14 @@
  * docs/specs/7894-the-hub-signs-in-its-spec.md D6; AC-4, AC-5, AC-7).
  *
  * A bearer starting `ailk_hst_` is admitted only beside the SAME spoke's key,
- * only while its grant is live and its person verified, and only on the four
- * routes of `HUB_SESSION_ROUTES`. Any other route answers 404 with no handler
- * run (the status `lib/account-config.ts`'s `read()` already loads as "nothing
- * for this caller"), never 403.
+ * only while its grant is live and its person verified, and only on the 18
+ * routes of `HUB_SESSION_ROUTES` (#8220 D1, AC-1). Any other route answers 404
+ * with no handler run (the status `lib/account-config.ts`'s `read()` already
+ * loads as "nothing for this caller"), never 403. Each (person, spoke) is
+ * limited to 60 requests and 10 writes a minute and 30 writes an hour,
+ * charged only after admission (#8220 D2, AC-7).
  *
- * Stub routes stand in for #7877's three member reads, which are unmerged; each
+ * Recording stubs stand in for every admitted and every off-list route; each
  * one records that its handler ran, so "404 with no handler run" is asserted,
  * not assumed.
  *
@@ -34,7 +36,11 @@ import {
 } from "../../__tests__/support/hub-sign-in-fake-db.js";
 import { mintCredential, sha256Hex } from "../../lib/hub-sign-in-store.js";
 import { prisma } from "../../lib/prisma.js";
-import { authPreHandlerPlugin, HUB_SESSION_ROUTES } from "../auth.js";
+import {
+  __resetHubSessionRateBuckets,
+  authPreHandlerPlugin,
+  HUB_SESSION_ROUTES,
+} from "../auth.js";
 
 const db = jest.mocked(prisma);
 
@@ -47,6 +53,55 @@ let spokeA: SeededSpoke;
 let spokeB: SeededSpoke;
 let handlerRuns: string[];
 
+/** D1's 18 strings, in the list's order. */
+const ADMITTED = [
+  "GET /v1/hub-sign-in/me",
+  "GET /v1/member/pieces",
+  "GET /v1/member/messages",
+  "GET /v1/member/messages/:id/file",
+  "GET /v1/member/purchases",
+  "GET /v1/member/appointments",
+  "GET /v1/member/artifacts",
+  "GET /v1/member/artifacts/:pieceId/versions/:version/file",
+  "GET /v1/member/meeting-types",
+  "GET /v1/member/availability",
+  "GET /v1/member/request-form",
+  "GET /v1/member/billing",
+  "POST /v1/member/artifacts/:pieceId/review",
+  "POST /v1/member/bookings",
+  "POST /v1/member/requests",
+  "POST /v1/member/messages",
+  "PATCH /v1/member/profile",
+  "POST /v1/member/deletion-request",
+];
+
+/** Every route the credential must NOT reach, each a recording stub. */
+const OFF_LIST = [
+  "GET /v1/member/other",
+  "GET /v1/member/messages/:id",
+  "GET /v1/waitlist-signups/me",
+  "GET /v1/flow-checkouts/me",
+  "GET /v1/subscription/me",
+  "POST /v1/subscription/portal-session",
+  "GET /v1/auth/tokens",
+  "PATCH /v1/user/profile",
+  "POST /v1/hub-sign-in/codes",
+  // D7's near misses — one method or one segment from an admitted entry.
+  "GET /v1/member/requests",
+  "GET /v1/member/profile",
+  "POST /v1/member/purchases",
+  "DELETE /v1/member/profile",
+  "GET /v1/member/artifacts/:pieceId",
+  "PUT /v1/member/messages",
+];
+
+/** A registered URL with each `:param` filled in. */
+const concrete = (url: string) =>
+  url
+    .replace(":pieceId", "piece_1")
+    .replace(":version", "1")
+    .replace(":id", "lead_1");
+
 /** A live credential for (user, spoke), stored the way the token route stores it. */
 function grant(
   s: SeededSpoke,
@@ -89,22 +144,10 @@ function buildApp(): FastifyInstance {
       };
     };
 
-  // The four admitted routes (the member reads are stubs).
-  server.get("/v1/hub-sign-in/me", echo("me"));
-  server.get("/v1/member/pieces", echo("pieces"));
-  server.get("/v1/member/messages", echo("messages"));
-  server.get("/v1/member/messages/:id/file", echo("file"));
-
-  // Everything else the credential must NOT reach.
-  server.get("/v1/member/other", echo("other"));
-  server.get("/v1/member/messages/:id", echo("message-item"));
-  server.get("/v1/waitlist-signups/me", echo("waitlist-signups"));
-  server.get("/v1/flow-checkouts/me", echo("flow-checkouts"));
-  server.get("/v1/subscription/me", echo("subscription"));
-  server.post("/v1/subscription/portal-session", echo("portal"));
-  server.get("/v1/auth/tokens", echo("tokens"));
-  server.patch("/v1/user/profile", echo("profile"));
-  server.post("/v1/hub-sign-in/codes", echo("codes"));
+  for (const route of [...ADMITTED, ...OFF_LIST]) {
+    const [method, url] = route.split(" ") as [string, string];
+    server.route({ method: method as "GET", url, handler: echo(route) });
+  }
   return server;
 }
 
@@ -112,6 +155,7 @@ beforeEach(async () => {
   jest.resetAllMocks();
   state = installHubSignInFakeDb(db);
   handlerRuns = [];
+  __resetHubSessionRateBuckets();
   user = seedUser(state);
   spokeA = seedSpoke(state, "a.example.com");
   spokeB = seedSpoke(state, "b.example.com");
@@ -124,35 +168,36 @@ afterEach(async () => {
 });
 
 describe("HUB_SESSION_ROUTES", () => {
-  it("is exactly the four reads, by method and registered URL — never a prefix", () => {
-    expect([...HUB_SESSION_ROUTES]).toEqual([
-      "GET /v1/hub-sign-in/me",
-      "GET /v1/member/pieces",
-      "GET /v1/member/messages",
-      "GET /v1/member/messages/:id/file",
-    ]);
+  it("is exactly the 18 entries, by method and registered URL — never a prefix (AC-1)", () => {
+    expect([...HUB_SESSION_ROUTES]).toEqual(ADMITTED);
+    expect(HUB_SESSION_ROUTES.length).toBe(18);
+    for (const route of HUB_SESSION_ROUTES) {
+      expect({
+        route,
+        open: route.endsWith("/") || route.includes("*"),
+      }).toEqual({
+        route,
+        open: false,
+      });
+    }
   });
 });
 
 describe("hub credential — admitted routes", () => {
-  it.each([
-    ["GET", "/v1/hub-sign-in/me", "me"],
-    ["GET", "/v1/member/pieces", "pieces"],
-    ["GET", "/v1/member/messages", "messages"],
-    ["GET", "/v1/member/messages/lead_1/file", "file"],
-  ])(
-    "%s %s is admitted as the credential's person, bound to the spoke",
-    async (method, url, name) => {
+  it.each(ADMITTED)(
+    "%s is admitted as the credential's person, bound to the spoke",
+    async (route) => {
+      const [method, url] = route.split(" ") as [string, string];
       const credential = grant(spokeA);
 
       const res = await app.inject({
         method: method as "GET",
-        url,
+        url: concrete(url),
         headers: headers(credential),
       });
 
       expect(res.statusCode).toBe(200);
-      expect(handlerRuns).toEqual([name]);
+      expect(handlerRuns).toEqual([route]);
       const body = res.json();
       expect(body.userId).toBe(user.id);
       expect(body.hubSession).toEqual({
@@ -194,6 +239,28 @@ describe("hub credential — every other route is 404 with no handler run (AC-7)
     expect(handlerRuns).toEqual([]);
   });
 
+  it.each(
+    OFF_LIST.slice(-6).map((route) => route.split(" ") as [string, string]),
+  )(
+    "the registered near miss %s %s is still the preHandler's 404 (#8220 D7)",
+    async (method, url) => {
+      const credential = grant(spokeA);
+
+      const res = await app.inject({
+        method: method as "GET",
+        url: concrete(url),
+        headers: headers(credential),
+      });
+
+      expect(res.statusCode).toBe(404);
+      expect(res.json()).toEqual({
+        ok: false,
+        error: { code: "not_found", message: "Not found" },
+      });
+      expect(handlerRuns).toEqual([]);
+    },
+  );
+
   it("the list is method-exact: HEAD on an admitted URL is not admitted", async () => {
     const credential = grant(spokeA);
     const res = await app.inject({
@@ -308,3 +375,163 @@ describe("hub credential — it is a bearer and nothing else", () => {
     expect(res.body).not.toContain(credential);
   });
 });
+
+// ─── #8220 D2 — the per-(person, spoke) budget (AC-7) ───────────────────────
+
+describe("hub credential — the per-person budget at each spoke (#8220 D2, AC-7)", () => {
+  const T0 = Date.UTC(2026, 9, 11, 12, 0, 0);
+  let now: number;
+  let clock: jest.SpyInstance<number, []>;
+
+  beforeEach(() => {
+    now = T0;
+    clock = jest.spyOn(Date, "now").mockImplementation(() => now);
+  });
+
+  afterEach(() => {
+    clock.mockRestore();
+  });
+
+  const read = (credential: string, s: SeededSpoke = spokeA) =>
+    app.inject({
+      method: "GET",
+      url: "/v1/member/pieces",
+      headers: headers(credential, s),
+    });
+  const write = (credential: string, s: SeededSpoke = spokeA) =>
+    app.inject({
+      method: "POST",
+      url: "/v1/member/messages",
+      headers: headers(credential, s),
+    });
+
+  async function times(
+    n: number,
+    send: () => ReturnType<typeof read>,
+  ): Promise<number[]> {
+    const statuses: number[] = [];
+    for (let i = 0; i < n; i += 1) statuses.push((await send()).statusCode);
+    return statuses;
+  }
+
+  it("a person's 61st admitted request at one spoke in one minute is 429 with Retry-After and the rate_limited body, no handler run", async () => {
+    const credential = grant(spokeA);
+    expect(new Set(await times(60, () => read(credential)))).toEqual(
+      new Set([200]),
+    );
+    handlerRuns = [];
+    now += 15_000;
+
+    const res = await read(credential);
+
+    expect(res.statusCode).toBe(429);
+    expect(res.headers["retry-after"]).toBe("45");
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "rate_limited", message: "Too many requests" },
+    });
+    expect(handlerRuns).toEqual([]);
+  });
+
+  it("another person at the same spoke, and the same person at another spoke, are admitted in that minute (SEC-8220-4)", async () => {
+    const credential = grant(spokeA);
+    await times(60, () => read(credential));
+    expect((await read(credential)).statusCode).toBe(429);
+
+    const other = seedUser(state);
+    expect((await read(grant(spokeA, { userId: other.id }))).statusCode).toBe(
+      200,
+    );
+    expect((await read(grant(spokeB), spokeB)).statusCode).toBe(200);
+    // The spent bucket opens again when its minute ends.
+    now += 60_000;
+    expect((await read(credential)).statusCode).toBe(200);
+  });
+
+  it("the 11th write in a minute is 429; after it a read is admitted and a 12th write is 429", async () => {
+    const credential = grant(spokeA);
+    expect(new Set(await times(10, () => write(credential)))).toEqual(
+      new Set([200]),
+    );
+
+    const eleventh = await write(credential);
+    expect(eleventh.statusCode).toBe(429);
+    expect(Number(eleventh.headers["retry-after"])).toBeGreaterThanOrEqual(1);
+    expect((await read(credential)).statusCode).toBe(200);
+    expect((await write(credential)).statusCode).toBe(429);
+  });
+
+  it("a refused request is not counted: after 10 admitted and 50 refused writes, a read is admitted", async () => {
+    const credential = grant(spokeA);
+    await times(10, () => write(credential));
+    expect(new Set(await times(50, () => write(credential)))).toEqual(
+      new Set([429]),
+    );
+
+    // A counted refusal would make this the 61st request of the minute.
+    expect((await read(credential)).statusCode).toBe(200);
+  });
+
+  it("writes refused by the minute ceiling do not advance the hourly count; the 31st write in an hour is 429 and a read after it is admitted", async () => {
+    const credential = grant(spokeA, {
+      expiresAt: new Date(T0 + 24 * 3_600_000),
+    });
+    // Minute 0: 10 admitted, 20 refused by the minute ceiling.
+    expect(await times(30, () => write(credential))).toEqual([
+      ...Array<number>(10).fill(200),
+      ...Array<number>(20).fill(429),
+    ]);
+    // Minutes 1 and 2: 10 admitted each — 30 admitted in the hour.
+    now += 60_000;
+    expect(new Set(await times(10, () => write(credential)))).toEqual(
+      new Set([200]),
+    );
+    now += 60_000;
+    expect(new Set(await times(10, () => write(credential)))).toEqual(
+      new Set([200]),
+    );
+
+    // Minute 3: the 31st admitted write would pass the minute's ceiling, but
+    // not the hour's — Retry-After is the hour's end, 57 minutes away.
+    now += 60_000;
+    const thirtyFirst = await write(credential);
+    expect(thirtyFirst.statusCode).toBe(429);
+    expect(thirtyFirst.headers["retry-after"]).toBe(String(57 * 60));
+    expect((await read(credential)).statusCode).toBe(200);
+
+    // The hour ends: writes are admitted again.
+    now = T0 + 60 * 60_000;
+    expect((await write(credential)).statusCode).toBe(200);
+  });
+
+  it("100 off-list or refused-credential requests leave the next admitted request admitted — no bucket before admission", async () => {
+    const credential = grant(spokeA);
+    // 70 off-list requests with the person's own live credential: charged
+    // before the route check, they alone would spend the minute's 60.
+    for (let i = 0; i < 70; i += 1) {
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/subscription/me",
+        headers: headers(credential),
+      });
+      expect(res.statusCode).toBe(404);
+    }
+    for (let i = 0; i < 30; i += 1) {
+      expect((await read(mintCredential())).statusCode).toBe(401);
+    }
+    expect(handlerRuns).toEqual([]);
+
+    expect((await read(credential)).statusCode).toBe(200);
+  });
+
+  it("GET /v1/hub-sign-in/me is an admitted route and is charged like the rest", async () => {
+    const credential = grant(spokeA);
+    await times(60, () => read(credential));
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/hub-sign-in/me",
+      headers: headers(credential),
+    });
+    expect(res.statusCode).toBe(429);
+  });
+});