crewly 1.20.194 → 1.20.196

package/dist/backend/backend/src/middleware/caller-identity.middleware.js

@@ -0,0 +1,481 @@
+/**
+ * Caller identity (#999, specs/2026-10-03-owner-auth.md).
+ *
+ * Decides who made an `/api` request from the credentials it carries — never
+ * from a header it left out:
+ *
+ * | kind          | credential                                                    |
+ * |---------------|---------------------------------------------------------------|
+ * | `agent`       | a valid agent badge, or (migration window) `X-Agent-Session`  |
+ * | `relay-owner` | the in-memory relay credential (phone / portal over the relay) |
+ * | `cloud`       | the in-memory cloud credential (Cloud-forwarded Slack)        |
+ * | `owner`       | the owner session cookie (+ CSRF on writes) or the API token  |
+ * | `anonymous`   | nothing of the above — never the owner                        |
+ *
+ * Any sign of an agent wins over an owner credential. The owner API token
+ * presented from THIS machine is checked against the process tree: a client
+ * process that belongs to an agent is that agent, not the owner.
+ *
+ * The answer is kept per request in a WeakMap (a client cannot set it) and
+ * read through {@link getCallerIdentity}, {@link isOwnerCaller} and
+ * {@link rejectNonOwner}.
+ *
+ * @module middleware/caller-identity
+ */
+import { OWNER_AUTH_CONSTANTS, API_SECURITY_CONSTANTS } from '../constants.js';
+import { ownerSessionCookieName, verifyAgentBadge, verifyCsrfToken, verifyInternalCredential, verifyOwnerSession, } from '../services/core/owner-auth.service.js';
+import { createHash } from 'crypto';
+import { getApiTokenFingerprint, verifyApiToken } from '../services/core/api-token.service.js';
+import { PeerProcessService, isHostAddress } from '../services/core/peer-process.service.js';
+import { LoggerService } from '../services/core/logger.service.js';
+import { extractPresentedTokenWithSource, parseCookieHeader } from './api-token.middleware.js';
+import { getAgentOriginCorrection } from './agent-origin-correction.js';
+const logger = LoggerService.getInstance().createComponentLogger('CallerIdentity');
+/**
+ * Exhaustiveness guard: a new verdict kind must be handled explicitly.
+ *
+ * @param value - The unhandled value
+ * @throws Always
+ */
+function assertNever(value) {
+    throw new Error(`Unhandled peer verdict: ${JSON.stringify(value)}`);
+}
+/** Sentinel: the answer depends on which local process sent the request. */
+const NEEDS_PEER = Symbol('needs-peer');
+const identities = new WeakMap();
+/**
+ * First value of a header.
+ *
+ * @param req - Request
+ * @param name - Lower-case header name
+ * @returns Trimmed value or undefined
+ */
+function header(req, name) {
+    const raw = (req.headers ?? {})[name];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+}
+/**
+ * The `X-Agent-Session` (or legacy alias) a request carries.
+ *
+ * @param req - Request
+ * @returns Session or undefined
+ */
+function rawSessionHeader(req) {
+    return header(req, API_SECURITY_CONSTANTS.AGENT_SESSION_HEADER) ?? header(req, API_SECURITY_CONSTANTS.AGENT_SESSION_HEADER_LEGACY);
+}
+/**
+ * Whether the method changes state.
+ *
+ * @param req - Request
+ * @returns True for POST/PUT/PATCH/DELETE (and for an unknown method — fail safe)
+ */
+function isWrite(req) {
+    const method = (req.method ?? 'POST').toUpperCase();
+    return OWNER_AUTH_CONSTANTS.MUTATING_METHODS.includes(method);
+}
+/**
+ * The owner session a request's cookies carry, if any verifies. Every
+ * `crewly_owner_*` cookie is tried: the port suffix only keeps instances on
+ * one host from overwriting each other, and a cookie from another instance
+ * was signed with another secret and simply does not verify.
+ *
+ * @param req - Request
+ * @returns The session, or null
+ */
+export function readOwnerSession(req) {
+    const cookies = parseCookieHeader(typeof req.headers?.cookie === 'string' ? req.headers.cookie : undefined);
+    const preferred = ownerSessionCookieName(req.socket?.localPort);
+    const names = [preferred, ...Object.keys(cookies).filter((n) => n !== preferred && n.startsWith(OWNER_AUTH_CONSTANTS.OWNER_SESSION_COOKIE_PREFIX))];
+    for (const name of names) {
+        const session = verifyOwnerSession(cookies[name]);
+        if (session)
+            return session;
+    }
+    return null;
+}
+/**
+ * Classify a request. Returns {@link NEEDS_PEER} when the only credential is
+ * the owner API token from this machine and no peer verdict was given.
+ *
+ * @param req - Request
+ * @param peer - Verdict on the local client process, when known
+ * @returns The identity, or NEEDS_PEER
+ */
+function classify(req, peer) {
+    const headerSession = rawSessionHeader(req);
+    const badgeRaw = header(req, OWNER_AUTH_CONSTANTS.AGENT_BADGE_HEADER);
+    const badgeSession = verifyAgentBadge(badgeRaw);
+    // 1. A valid badge: always that agent — unless the process tree proved the
+    //    shell belongs to another agent PTY (a runtime leaked the environment).
+    if (badgeSession) {
+        const correction = getAgentOriginCorrection(req);
+        const session = correction && correction.claimed === badgeSession ? correction.actual : badgeSession;
+        return { kind: 'agent', via: 'agent-badge', session, ...(session !== badgeSession ? { note: `process tree overrode badge ${badgeSession}` } : {}) };
+    }
+    // 2. Any X-Agent-Session: an agent (migration window). Never the owner.
+    if (headerSession) {
+        return { kind: 'agent', via: 'legacy-header', session: headerSession, ...(badgeRaw ? { note: 'invalid agent badge' } : {}) };
+    }
+    // An invalid badge with no session header is not anybody we know.
+    if (badgeRaw)
+        return { kind: 'anonymous', via: 'none', note: 'invalid agent badge' };
+    // 3. The in-process forwarders.
+    const internal = verifyInternalCredential(header(req, OWNER_AUTH_CONSTANTS.INTERNAL_HEADER));
+    if (internal === 'relay')
+        return { kind: 'relay-owner', via: 'relay' };
+    if (internal === 'cloud')
+        return { kind: 'cloud', via: 'cloud' };
+    // 4. The dashboard's session (CSRF on writes).
+    let note;
+    const ownerSession = readOwnerSession(req);
+    if (ownerSession) {
+        if (!isWrite(req) || verifyCsrfToken(ownerSession.id, header(req, OWNER_AUTH_CONSTANTS.CSRF_HEADER))) {
+            return { kind: 'owner', via: 'owner-session', ownerSessionId: ownerSession.id };
+        }
+        note = 'owner session without a valid CSRF token on a write';
+    }
+    // 5. The owner API token.
+    const presented = extractPresentedTokenWithSource(req);
+    if (presented && verifyApiToken(presented.token)) {
+        if (presented.source === 'cookie' && isWrite(req)) {
+            return { kind: 'anonymous', via: 'none', note: 'API token only in a cookie on a write' };
+        }
+        if (!peer) {
+            const address = req.socket?.remoteAddress ?? '';
+            // An empty address is a socket the sender already closed, not a remote
+            // caller: never the owner on that basis (#1010 review).
+            if (address && !isHostAddress(address))
+                return { kind: 'owner', via: 'api-token' };
+            return NEEDS_PEER;
+        }
+        switch (peer.kind) {
+            case 'agent':
+                return {
+                    kind: 'agent',
+                    via: 'process-tree',
+                    ...(peer.session ? { session: peer.session } : {}),
+                    note: `agent process (${peer.signal}) presented the owner API token`,
+                };
+            case 'gone':
+                // The lookup ran and the sender was not there (it exited first — an
+                // agent can write over a raw socket and quit). Fail closed.
+                return { kind: 'anonymous', via: 'none', note: `owner token from a vanished local process: ${peer.reason}` };
+            case 'unknown':
+                // The lookup could not run (tool missing, timeout): fail open.
+                return { kind: 'owner', via: 'api-token', note: `process check skipped: ${peer.reason}` };
+            case 'remote':
+            case 'self':
+            case 'not-agent':
+                return { kind: 'owner', via: 'api-token' };
+            default:
+                return assertNever(peer);
+        }
+    }
+    return { kind: 'anonymous', via: 'none', ...(note ? { note } : {}) };
+}
+/**
+ * Classify without a process lookup. A local API-token caller is anonymous
+ * here (it needs {@link callerIdentityMiddleware}'s process check to be the
+ * owner); everything else is decided exactly as the middleware would.
+ *
+ * @param req - Request
+ * @returns The identity
+ */
+export function classifyCallerSync(req) {
+    const result = classify(req);
+    return result === NEEDS_PEER ? { kind: 'anonymous', via: 'none', note: 'local API token needs the process check' } : result;
+}
+/**
+ * Classify with the process check for a local API-token caller.
+ *
+ * @param req - Request
+ * @param peers - Process classifier
+ * @returns The identity
+ */
+export async function classifyCaller(req, peers) {
+    const first = classify(req);
+    if (first !== NEEDS_PEER)
+        return first;
+    const verdict = await peers.classify(req.socket ?? null);
+    const second = classify(req, verdict);
+    return second === NEEDS_PEER ? { kind: 'anonymous', via: 'none' } : second;
+}
+/**
+ * Store a request's identity (the middleware; tests).
+ *
+ * @param req - Request
+ * @param identity - Identity
+ */
+export function setCallerIdentity(req, identity) {
+    identities.set(req, identity);
+}
+/**
+ * The identity of a request's caller: what the middleware decided, or a
+ * synchronous classification for a request it did not see (unit tests that
+ * mount a router alone).
+ *
+ * @param req - Request
+ * @returns The identity
+ */
+export function getCallerIdentity(req) {
+    return identities.get(req) ?? classifyCallerSync(req);
+}
+/**
+ * Whether the caller holds an owner credential: the dashboard session, the
+ * owner API token, or the phone / portal relay.
+ *
+ * @param req - Request
+ * @returns True for the owner
+ */
+export function isOwnerCaller(req) {
+    const { kind } = getCallerIdentity(req);
+    return kind === 'owner' || kind === 'relay-owner';
+}
+/**
+ * The agent session of the caller, when it is an agent.
+ *
+ * @param req - Request
+ * @returns Session or undefined
+ */
+export function callerAgentSession(req) {
+    const id = getCallerIdentity(req);
+    return id.kind === 'agent' ? id.session : undefined;
+}
+/** The 401 body for a caller with no owner credential. */
+export const OWNER_AUTH_REQUIRED_BODY = Object.freeze({
+    success: false,
+    error: OWNER_AUTH_CONSTANTS.ERRORS.OWNER_AUTH_REQUIRED,
+    code: OWNER_AUTH_CONSTANTS.ERRORS.OWNER_AUTH_REQUIRED,
+    message: 'This action needs the owner: use the dashboard on this machine, the phone app, or the API token (`crewly token`).',
+});
+/**
+ * Whether a request comes from a browser that holds no valid owner session:
+ * a dashboard tab opened before the upgrade (its bundle never asks for a
+ * session), or one whose session ended with a backend restart.
+ *
+ * @param req - Request
+ * @returns True for a browser request without a session
+ */
+export function isBrowserWithoutSession(req) {
+    const h = req.headers ?? {};
+    const browser = Boolean(h['sec-fetch-site'] || h['sec-fetch-mode'] || h.origin || h.referer || /Mozilla\//.test(String(h['user-agent'] ?? '')));
+    return browser && !readOwnerSession(req);
+}
+/**
+ * The 401 body for a caller with no owner credential. A browser without a
+ * session gets the plain instruction in `error` — what an old dashboard tab
+ * shows the owner — and every body carries `code: owner_auth_required`,
+ * which the new dashboard reacts to by refreshing its session and retrying.
+ *
+ * @param req - Request (optional)
+ * @returns Response body
+ */
+export function ownerAuthRequiredBody(req) {
+    if (req && isBrowserWithoutSession(req)) {
+        return {
+            success: false,
+            error: OWNER_AUTH_CONSTANTS.RELOAD_MESSAGE,
+            code: OWNER_AUTH_CONSTANTS.ERRORS.OWNER_AUTH_REQUIRED,
+            reload: true,
+            message: OWNER_AUTH_CONSTANTS.RELOAD_MESSAGE,
+        };
+    }
+    return { ...OWNER_AUTH_REQUIRED_BODY };
+}
+/**
+ * Thrown by handlers that map errors to responses themselves (decisions,
+ * project tickets): carries the owner-auth 401 body.
+ */
+export class OwnerAuthRequiredError extends Error {
+    body;
+    status = 401;
+    /**
+     * @param body - The 401 body ({@link ownerAuthRequiredBody})
+     */
+    constructor(body) {
+        super(String(body.error));
+        this.body = body;
+    }
+}
+/**
+ * Answer 401 owner_auth_required. No `WWW-Authenticate: Crewly-Token`: the
+ * dashboard refreshes its session instead of prompting for the API token.
+ *
+ * @param res - Response
+ * @param req - Request, so a browser without a session is told to reload
+ */
+export function sendOwnerAuthRequired(res, req) {
+    res.status(401).json(ownerAuthRequiredBody(req));
+}
+/**
+ * Refuse a caller that is not the owner. Agents get `agentBody` (403, the
+ * route's own wording); everyone else without an owner credential gets 401.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param agentBody - 403 body for an agent
+ * @returns True when refused (response written)
+ *
+ * @example
+ * ```ts
+ * if (rejectNonOwner(req, res, { success: false, error: 'Only the owner can dismiss a ticket' })) return;
+ * ```
+ */
+export function rejectNonOwner(req, res, agentBody = { success: false, error: OWNER_AUTH_CONSTANTS.ERRORS.OWNER_ONLY, message: 'Only the owner can do this.' }) {
+    const id = getCallerIdentity(req);
+    if (id.kind === 'owner' || id.kind === 'relay-owner')
+        return false;
+    if (id.kind === 'agent') {
+        res.status(403).json(agentBody);
+        return true;
+    }
+    sendOwnerAuthRequired(res, req);
+    return true;
+}
+/**
+ * Express middleware form of {@link rejectNonOwner}.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param next - Next
+ */
+export const requireOwner = (req, res, next) => {
+    if (rejectNonOwner(req, res))
+        return;
+    next();
+};
+/**
+ * Owner-only decisions with an audit fingerprint (OKR approve/reject, signal
+ * digest items). Agents get 403 `owner_approval_required`; a caller with no
+ * owner credential gets 401. Before #999 this required the raw API token
+ * even from loopback, so the local dashboard could not use it; the owner
+ * session now counts too.
+ *
+ * On success `res.locals.ownerTokenFingerprint` names the credential for the
+ * audit trail: 8 hex of sha256(API token), `session-<8 hex>` for a dashboard
+ * session, or `relay`.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param next - Next
+ */
+export const requireOwnerToken = (req, res, next) => {
+    const id = getCallerIdentity(req);
+    if (id.kind === 'agent') {
+        res.status(403).json({
+            success: false,
+            error: API_SECURITY_CONSTANTS.ERRORS.OWNER_APPROVAL_REQUIRED,
+            hint: 'This decision must be made by the owner from the dashboard or with the API token, not by an agent session.',
+        });
+        return;
+    }
+    if (id.kind !== 'owner' && id.kind !== 'relay-owner') {
+        sendOwnerAuthRequired(res, req);
+        return;
+    }
+    if (id.via === 'api-token') {
+        res.locals.ownerTokenFingerprint = getApiTokenFingerprint(extractPresentedTokenWithSource(req)?.token);
+    }
+    else if (id.via === 'owner-session' && id.ownerSessionId) {
+        res.locals.ownerTokenFingerprint = `session-${createHash('sha256').update(id.ownerSessionId).digest('hex').slice(0, 8)}`;
+    }
+    else {
+        res.locals.ownerTokenFingerprint = id.via;
+    }
+    next();
+};
+/**
+ * {@link requireOwner} with the route's own 403 wording for agents.
+ *
+ * @param agentBody - 403 body for an agent
+ * @returns Express middleware
+ */
+export function ownerOnly(agentBody) {
+    return (req, res, next) => {
+        if (rejectNonOwner(req, res, agentBody))
+            return;
+        next();
+    };
+}
+const lastWarned = new Map();
+/**
+ * Warn at most once per LEGACY_WARN_THROTTLE_MS per key.
+ *
+ * @param key - Throttle key
+ * @param message - Message
+ * @param meta - Fields
+ */
+function warnThrottled(key, message, meta) {
+    const now = Date.now();
+    const last = lastWarned.get(key);
+    if (last !== undefined && now - last < OWNER_AUTH_CONSTANTS.LEGACY_WARN_THROTTLE_MS)
+        return;
+    if (lastWarned.size > 1000)
+        lastWarned.clear();
+    lastWarned.set(key, now);
+    logger.warn(message, meta);
+}
+/**
+ * Point `X-Agent-Session` at the identified agent, so code that reads the
+ * header sees the authenticated identity. Never adds the header: a call
+ * that left it out on purpose (`remote-browser --no-bind`) keeps it out.
+ *
+ * @param req - Request (headers mutated)
+ * @param identity - Its identity
+ */
+function normaliseSessionHeader(req, identity) {
+    if (identity.kind !== 'agent' || !identity.session)
+        return;
+    for (const name of [API_SECURITY_CONSTANTS.AGENT_SESSION_HEADER, API_SECURITY_CONSTANTS.AGENT_SESSION_HEADER_LEGACY]) {
+        const current = header(req, name);
+        if (current !== undefined && current !== identity.session)
+            req.headers[name] = identity.session;
+    }
+}
+/**
+ * Build the `/api` middleware.
+ *
+ * @param peers - Process classifier. The server passes one that knows the
+ *   live agent PTYs (`liveSessionPids` from the agent-origin middleware), so
+ *   the terminal check and session names work; without it only the
+ *   ancestry and environment checks run.
+ * @returns Express middleware
+ */
+export function createCallerIdentityMiddleware(peers = new PeerProcessService()) {
+    return (req, _res, next) => {
+        classifyCaller(req, peers)
+            .then((identity) => {
+            identities.set(req, identity);
+            normaliseSessionHeader(req, identity);
+            if (identity.via === 'legacy-header') {
+                warnThrottled(`legacy:${identity.session}`, 'Agent call without an agent badge — accepted as that agent for this release only. Restart the agent so it gets CREWLY_AGENT_BADGE.', {
+                    session: identity.session,
+                    path: req.path,
+                });
+            }
+            else if (identity.via === 'process-tree') {
+                warnThrottled(`tree:${identity.session ?? '?'}`, 'An agent process presented the owner API token — treated as that agent, not the owner.', {
+                    session: identity.session,
+                    path: req.path,
+                });
+            }
+            else if (identity.note?.startsWith('process check skipped')) {
+                warnThrottled('peer-unknown', 'Could not tell which local process sent an owner-token request — accepted as the owner (fail open).', {
+                    reason: identity.note,
+                    path: req.path,
+                });
+            }
+            next();
+        })
+            .catch((error) => {
+            // Classification never throws in practice; if it does, the request is anonymous.
+            identities.set(req, { kind: 'anonymous', via: 'none', note: 'classification failed' });
+            logger.warn('Caller classification failed — treating the request as anonymous', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            next();
+        });
+    };
+}
+//# sourceMappingURL=caller-identity.middleware.js.map

package/dist/backend/backend/src/middleware/caller-identity.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-identity.middleware.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/caller-identity.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAoB,MAAM,0CAA0C,CAAC;AAC/G,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;AAkCnF;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AAExC,MAAM,UAAU,GAAG,IAAI,OAAO,EAA0B,CAAC;AAEzD;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,GAAwB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAwB;IAChD,OAAO,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,2BAA2B,CAAC,CAAC;AACrI,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,GAAwB;IACvC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAwB;IACvD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5G,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACpJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAwB,EAAE,IAAkB;IAC5D,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACrG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,+BAA+B,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC;IACD,wEAAwE;IACxE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/H,CAAC;IACD,kEAAkE;IAClE,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IAErF,gCAAgC;IAChC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACvE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAEjE,+CAA+C;IAC/C,IAAI,IAAwB,CAAC;IAC7B,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,GAAG,qDAAqD,CAAC;IAC/D,CAAC;IAED,0BAA0B;IAC1B,MAAM,SAAS,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;YAChD,uEAAuE;YACvE,wDAAwD;YACxD,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;YACnF,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,OAAO;gBACV,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,cAAc;oBACnB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,IAAI,EAAE,kBAAkB,IAAI,CAAC,MAAM,iCAAiC;iBACrE,CAAC;YACJ,KAAK,MAAM;gBACT,oEAAoE;gBACpE,4DAA4D;gBAC5D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/G,KAAK,SAAS;gBACZ,+DAA+D;gBAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,0BAA0B,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5F,KAAK,QAAQ,CAAC;YACd,KAAK,MAAM,CAAC;YACZ,KAAK,WAAW;gBACd,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;YAC7C;gBACE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAwB;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,yCAAyC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAwB,EAAE,KAAyB;IACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,QAAwB;IACrE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAwB;IACxD,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAwB;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,aAAa,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAwB;IACzD,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,mBAAmB;IACtD,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,mBAAmB;IACrD,OAAO,EAAE,mHAAmH;CAC7H,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CACrB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CACvH,CAAC;IACF,OAAO,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAyB;IAC7D,IAAI,GAAG,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,oBAAoB,CAAC,cAAc;YAC1C,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,mBAAmB;YACrD,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,oBAAoB,CAAC,cAAc;SAC7C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,wBAAwB,EAAE,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAM1B;IALZ,MAAM,GAAG,GAAG,CAAC;IAEtB;;OAEG;IACH,YAAqB,IAA6B;QAChD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QADP,SAAI,GAAJ,IAAI,CAAyB;IAElD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAa,EAAE,GAAyB;IAC5E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,GAAa,EACb,YAAqC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAE9I,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;IACpG,IAAI,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO;IACrC,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;IACzG,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,uBAAuB;YAC5D,IAAI,EAAE,4GAA4G;SACnH,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACrD,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAC3B,GAAG,CAAC,MAAM,CAAC,qBAAqB,GAAG,sBAAsB,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,EAAE,CAAC,GAAG,KAAK,eAAe,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,qBAAqB,GAAG,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3H,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,CAAC,GAAG,CAAC;IAC5C,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,SAAkC;IAC1D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,IAAI,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC;YAAE,OAAO;QAChD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,IAA6B;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,oBAAoB,CAAC,uBAAuB;QAAE,OAAO;IAC5F,IAAI,UAAU,CAAC,IAAI,GAAG,IAAI;QAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IAC/C,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,GAAY,EAAE,QAAwB;IACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO;IAC3D,KAAK,MAAM,IAAI,IAAI,CAAC,sBAAsB,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACrH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;YAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAA4B,IAAI,kBAAkB,EAAE;IACjG,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;QAChE,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC;aACvB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjB,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9B,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;gBACrC,aAAa,CAAC,UAAU,QAAQ,CAAC,OAAO,EAAE,EAAE,oIAAoI,EAAE;oBAChL,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,IAAI,EAAE,GAAG,CAAC,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,cAAc,EAAE,CAAC;gBAC3C,aAAa,CAAC,QAAQ,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,wFAAwF,EAAE;oBACzI,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,IAAI,EAAE,GAAG,CAAC,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC9D,aAAa,CAAC,cAAc,EAAE,qGAAqG,EAAE;oBACnI,MAAM,EAAE,QAAQ,CAAC,IAAI;oBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,iFAAiF;YACjF,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACvF,MAAM,CAAC,IAAI,CAAC,kEAAkE,EAAE;gBAC9E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/middleware/caller-identity.testing.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Test helpers for caller identity (#999).
+ *
+ * Controller tests exercise business logic with a router mounted on its own,
+ * without the server's middleware stack. These helpers give such a request
+ * the identity a real one would have:
+ * - {@link ownerAuthHeaders}: a valid owner session cookie + CSRF header;
+ * - {@link agentAuthHeaders}: an agent badge + `X-Agent-Session`;
+ * - {@link relayAuthHeaders}: the relay credential;
+ * - {@link callerIdentityForTests}: the real classifier, with the process
+ *   lookup answering "not an agent" (supertest connects over loopback, and
+ *   its client process is the test runner itself);
+ * - {@link ownerUnlessAgentForTests}: middleware that marks every request
+ *   carrying no agent sign and no other credential as the owner — the shape
+ *   of a dashboard request — so a suite about, say, ticket review does not
+ *   have to repeat the session headers on every call. The authorization
+ *   rules themselves are tested without it (caller-identity tests and
+ *   owner-routes.integration.test.ts).
+ *
+ * @module middleware/caller-identity.testing
+ */
+import type { NextFunction, Request, RequestHandler, Response } from 'express';
+/**
+ * Headers of a dashboard request: owner session cookie + CSRF token.
+ *
+ * @returns Header map for supertest `.set()` or a mock request
+ */
+export declare function ownerAuthHeaders(): Record<string, string>;
+/**
+ * Headers of a skill call by an agent.
+ *
+ * @param session - Agent session name
+ * @returns Header map
+ */
+export declare function agentAuthHeaders(session: string): Record<string, string>;
+/**
+ * Headers of a phone / portal call over the relay.
+ *
+ * @returns Header map
+ */
+export declare function relayAuthHeaders(): Record<string, string>;
+/**
+ * Mark a (mock) request as the owner's.
+ *
+ * @param req - Request object
+ * @returns The same request
+ */
+export declare function markOwner<T extends object>(req: T): T;
+/**
+ * Test middleware: a request with no identity of its own is the owner's
+ * (send `X-Test-Anonymous: 1` to opt out); anything else is classified as
+ * the server would.
+ *
+ * @param req - Request
+ * @param _res - Response
+ * @param next - Next
+ */
+export declare function ownerUnlessAgentForTests(req: Request, _res: Response, next: NextFunction): void;
+/**
+ * The real caller-identity middleware for a test app. The local process
+ * lookup is replaced by "this caller is not an agent's process", so the
+ * owner API token presented over supertest's loopback counts as the owner.
+ *
+ * @returns Express middleware
+ */
+export declare function callerIdentityForTests(): RequestHandler;
+//# sourceMappingURL=caller-identity.testing.d.ts.map

package/dist/backend/backend/src/middleware/caller-identity.testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-identity.testing.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/caller-identity.testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAM/E;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzD;AAKD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAGrD;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAG/F;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CAEvD"}