repoburg 1.3.217 → 1.3.218

package/daemon/dist/agentPane.js

@@ -108,17 +108,22 @@ function createPaneDelegate(pane) {
         pane.routing(req, res);
     };
 }
-/**
- * Single upgrade router for the daemon's HTTP server.
- *
- * `/ws` goes to the embedded agent-pane app (when present); everything else —
- * e.g. the platform frontend's auth WebSocket — goes to the daemon wss.
- */
-function createUpgradeRouter(pane, daemonWss) {
+function createUpgradeRouter(pane, daemonWss, guard) {
     return (req, socket, head) => {
         const url = req.url || '';
-        if (pane && url.startsWith('/ws')) {
+        const guardedUpgrade = () => {
             pane.handleWsUpgrade(req, socket, head);
+        };
+        const reject = () => {
+            socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+            socket.destroy();
+        };
+        if (pane && url.startsWith('/ws')) {
+            if (!guard) {
+                guardedUpgrade();
+                return;
+            }
+            void guard(req).then((allowed) => (allowed ? guardedUpgrade() : reject()));
             return;
         }
         daemonWss.handleUpgrade(req, socket, head, (ws) => {

package/daemon/dist/auth/authManager.js

@@ -131,6 +131,15 @@ class AuthManager {
             throw new Error('Could not save access token.');
         }
     }
+    /** Raw device JWT for outbound calls to the account server. */
+    async readToken() {
+        try {
+            return await fs_extra_1.default.readFile(TOKEN_PATH, 'utf-8');
+        }
+        catch {
+            return null;
+        }
+    }
     async logout() {
         try {
             await fs_extra_1.default.remove(TOKEN_PATH);

package/daemon/dist/index.js

@@ -9,11 +9,15 @@ const http_1 = __importDefault(require("http"));
 const ws_1 = require("ws");
 const cors_1 = __importDefault(require("cors"));
 const serviceManager_1 = require("./serviceManager");
+const corsOrigin_1 = require("./middleware/corsOrigin");
 const services_1 = __importDefault(require("./api/services"));
 const auth_1 = __importDefault(require("./api/auth"));
 const registry_1 = __importDefault(require("./api/registry"));
 const mcp_gateway_1 = require("./mcp-gateway");
 const agentPane_1 = require("./agentPane");
+const routes_1 = require("./remote/routes");
+const checkRemoteAuth_1 = require("./middleware/checkRemoteAuth");
+const staticServing_1 = require("./staticServing");
 const PORT = 9998;
 async function main() {
     await serviceManager_1.serviceManager.connect();
@@ -27,15 +31,24 @@ async function main() {
     const server = http_1.default.createServer(app);
     // Daemon wss in noServer mode — the shared upgrade router dispatches below.
     const wss = new ws_1.WebSocketServer({ noServer: true });
+    // Spec: allowlist only — local tooling (vite, daemon-desktop) and
+    // *.repoburg.com tunnel hostnames. The previous origin:'*' with
+    // credentials:true was an open API surface.
     app.use((0, cors_1.default)({
-        origin: '*', // Allow all
+        origin: corsOrigin_1.corsOrigin,
         methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
         credentials: true,
     }));
+    // CF Access guard for the embedded pane: when the machine has a tunnel and
+    // Access is configured, /api/* traffic must carry a valid Access JWT.
+    app.use('/api', checkRemoteAuth_1.checkRemoteAuth);
     // Embedded agent-pane API. MUST precede express.json() — Fastify parses its
     // own request bodies; the stream can only be consumed once.
     app.all('/api/*', (0, agentPane_1.createPaneDelegate)(pane));
     app.use(express_1.default.json());
+    // Tunnel lifecycle API — local-only; the CF ingress edge blocks /remote/*
+    // for tunnel traffic (see account-server CloudflareService.setIngress).
+    app.use('/remote', (0, routes_1.createRemoteRouter)());
     // API Routers
     app.use('/services', services_1.default);
     app.use('/auth', (0, auth_1.default)(wss));
@@ -57,15 +70,29 @@ async function main() {
     app.get('/health', (req, res) => {
         res.status(200).json({ status: 'ok' });
     });
+    // Pane frontend SPA — mounted LAST so API routes (including /health) are
+    // never shadowed. A machine's own origin serves the pane and the API on
+    // one origin.
+    const paneFrontendRouter = (0, staticServing_1.createPaneFrontendRouter)((0, staticServing_1.resolvePaneFrontendDist)(__dirname));
+    if (paneFrontendRouter) {
+        app.use(paneFrontendRouter);
+        console.log(`[pane] serving frontend from ${(0, staticServing_1.resolvePaneFrontendDist)(__dirname)}`);
+    }
+    else {
+        console.warn(`[pane] frontend dist not found at ${(0, staticServing_1.resolvePaneFrontendDist)(__dirname)} — SPA not served`);
+    }
     wss.on('connection', (ws) => {
         console.log('Client connected to daemon WebSocket');
         ws.on('close', () => console.log('Client disconnected from daemon WebSocket'));
         ws.on('error', (error) => console.error('WebSocket error:', error));
     });
-    // Single upgrade router: '/ws' -> embedded agent-pane, everything else -> daemon wss.
-    server.on('upgrade', (0, agentPane_1.createUpgradeRouter)(pane, wss));
-    server.listen(PORT, () => {
-        console.log(`Repoburg Platform Daemon listening on http://localhost:${PORT}`);
+    // Single upgrade router: '/ws' -> embedded agent-pane (guarded by CF Access
+    // when configured), everything else -> daemon wss.
+    server.on('upgrade', (0, agentPane_1.createUpgradeRouter)(pane, wss, checkRemoteAuth_1.checkRemoteWsAuth));
+    // Spec: loopback binding only — remote access is exclusively via the
+    // cloudflared tunnel; the daemon must never listen on public interfaces.
+    server.listen(PORT, '127.0.0.1', () => {
+        console.log(`Repoburg Platform Daemon listening on http://127.0.0.1:${PORT}`);
         console.log(`MCP Gateway available at http://localhost:${PORT}/mcp`);
     });
     // Clean up MCP gateway sessions and the embedded agent-pane on shutdown.

package/daemon/dist/middleware/checkRemoteAuth.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkRemoteAuth = checkRemoteAuth;
+exports.checkRemoteWsAuth = checkRemoteWsAuth;
+const tunnel_state_1 = require("../remote/tunnel-state");
+const access_jwt_1 = require("../remote/access-jwt");
+/**
+ * Guard for daemon endpoints that must not be reachable by anonymous tunnel
+ * traffic once CF Access is configured.
+ *
+ * Only requests that ARRIVED THROUGH THE TUNNEL (Host = the machine's
+ * <mahlas>.repoburg.com hostname) need the Access JWT. Requests with a
+ * local Host header — the local pane at localhost:9998 and the public
+ * pane host agent.repoburg.com calling into the visitor's own daemon —
+ * pass through: the loopback binding is the boundary there, and remote
+ * clients cannot forge the Host through the CF edge (routing is by
+ * hostname/SNI).
+ */
+function isLocalHostHeader(host) {
+    if (!host)
+        return true; // no Host header = non-HTTP client tooling
+    return host.startsWith('localhost') || host.startsWith('127.0.0.1') || host.startsWith('0.0.0.0');
+}
+async function checkRemoteAuth(req, res, next) {
+    const state = (0, tunnel_state_1.loadTunnelState)();
+    const config = state?.accessTeamDomain && state.accessAud
+        ? { teamDomain: state.accessTeamDomain, aud: state.accessAud }
+        : null;
+    if (!config || !state || isLocalHostHeader(req.headers.host)) {
+        // No Access configured, or local usage — loopback binding is the boundary.
+        next();
+        return;
+    }
+    // Fail closed: Access is configured but the owner email was never pinned
+    // (state from before email pinging). Re-provision the machine.
+    if (!state.ownerEmail) {
+        res.status(401).json({ error: 'Tunnel owner email is missing — re-provision this machine.' });
+        return;
+    }
+    const assertion = req.headers['cf-access-jwt-assertion'];
+    if (typeof assertion !== 'string') {
+        res.status(401).json({ error: 'Cloudflare Access authentication required.' });
+        return;
+    }
+    try {
+        await (0, access_jwt_1.verifyAccessJwt)(assertion, config, { ownerEmail: state.ownerEmail });
+        next();
+    }
+    catch {
+        res.status(401).json({ error: 'Invalid or expired Cloudflare Access token.' });
+    }
+}
+/** Same guard for WebSocket upgrades: false = reject and destroy the socket. */
+async function checkRemoteWsAuth(req) {
+    const state = (0, tunnel_state_1.loadTunnelState)();
+    if (!state?.accessTeamDomain || !state.accessAud)
+        return true; // no Access configured
+    if (isLocalHostHeader(req.headers.host))
+        return true; // local usage
+    if (!state.ownerEmail)
+        return false; // fail closed: no pinned owner email
+    const assertion = req.headers['cf-access-jwt-assertion'];
+    if (typeof assertion !== 'string')
+        return false;
+    try {
+        await (0, access_jwt_1.verifyAccessJwt)(assertion, { teamDomain: state.accessTeamDomain, aud: state.accessAud }, { ownerEmail: state.ownerEmail });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/daemon/dist/middleware/checkRemoteAuth.spec.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const checkRemoteAuth_1 = require("./checkRemoteAuth");
+const tunnel_state_1 = require("../remote/tunnel-state");
+const access_jwt_1 = require("../remote/access-jwt");
+jest.mock('../remote/tunnel-state');
+jest.mock('../remote/access-jwt');
+const mockedLoad = tunnel_state_1.loadTunnelState;
+const mockedVerify = access_jwt_1.verifyAccessJwt;
+/** Requests THROUGH THE TUNNEL carry the machine hostname as Host. */
+const TUNNEL_HOST = 'zztest.repoburg.com:443';
+/** Fully provisioned state (Access + pinned owner email). */
+const PINNED_STATE = {
+    accessTeamDomain: 'team.cloudflareaccess.com',
+    accessAud: 'aud-tag',
+    ownerEmail: 'owner@repoburg.com',
+};
+const makeRes = () => {
+    const res = { status: jest.fn(), json: jest.fn() };
+    res.status.mockReturnValue(res);
+    return res;
+};
+const makeReq = (headers) => ({ headers });
+beforeEach(() => {
+    mockedLoad.mockReset().mockReturnValue(null);
+    mockedVerify.mockReset().mockResolvedValue(undefined);
+});
+describe('checkRemoteAuth (HTTP)', () => {
+    it('passes through when no tunnel state exists (local usage)', async () => {
+        const next = jest.fn();
+        await (0, checkRemoteAuth_1.checkRemoteAuth)(makeReq({ host: 'localhost:9998' }), makeRes(), next);
+        expect(next).toHaveBeenCalled();
+    });
+    it('passes through when Access is not configured yet', async () => {
+        mockedLoad.mockReturnValue({ accessTeamDomain: undefined, accessAud: undefined });
+        const next = jest.fn();
+        await (0, checkRemoteAuth_1.checkRemoteAuth)(makeReq({ host: TUNNEL_HOST }), makeRes(), next);
+        expect(next).toHaveBeenCalled();
+    });
+    it('passes local requests even when Access is configured (local pane + agent.repoburg.com FE)', async () => {
+        mockedLoad.mockReturnValue(PINNED_STATE);
+        for (const host of ['localhost:9998', '127.0.0.1:9998', '0.0.0.0:9998']) {
+            const next = jest.fn();
+            await (0, checkRemoteAuth_1.checkRemoteAuth)(makeReq({ host }), makeRes(), next);
+            expect(next).toHaveBeenCalledWith();
+        }
+        expect(mockedVerify).not.toHaveBeenCalled();
+    });
+    it('requires an Access assertion for tunnel-host requests when configured', async () => {
+        mockedLoad.mockReturnValue(PINNED_STATE);
+        const res = makeRes();
+        const next = jest.fn();
+        await (0, checkRemoteAuth_1.checkRemoteAuth)(makeReq({ host: TUNNEL_HOST }), res, next);
+        expect(res.status).toHaveBeenCalledWith(401);
+        expect(next).not.toHaveBeenCalled();
+    });
+    it('FAILS CLOSED when Access is configured but no owner email is pinned (pre-pinning state)', async () => {
+        mockedLoad.mockReturnValue({ accessTeamDomain: 'team.cloudflareaccess.com', accessAud: 'aud-tag' });
+        const res = makeRes();
+        const next = jest.fn();
+        await (0, checkRemoteAuth_1.checkRemoteAuth)(makeReq({ host: TUNNEL_HOST, 'cf-access-jwt-assertion': 'jwt' }), res, next);
+        expect(res.status).toHaveBeenCalledWith(401);
+        expect(mockedVerify).not.toHaveBeenCalled();
+        expect(next).not.toHaveBeenCalled();
+    });
+    it('accepts a valid Access JWT and pins the owner email', async () => {
+        mockedLoad.mockReturnValue(PINNED_STATE);
+        const next = jest.fn();
+        await (0, checkRemoteAuth_1.checkRemoteAuth)(makeReq({ host: TUNNEL_HOST, 'cf-access-jwt-assertion': 'jwt' }), makeRes(), next);
+        expect(mockedVerify).toHaveBeenCalledWith('jwt', { teamDomain: 'team.cloudflareaccess.com', aud: 'aud-tag' }, { ownerEmail: 'owner@repoburg.com' });
+        expect(next).toHaveBeenCalled();
+    });
+    it('rejects a valid-signature JWT for the WRONG email with 401 (email pinning)', async () => {
+        mockedLoad.mockReturnValue(PINNED_STATE);
+        // Simulates a policy edited by a compromised account-server: CF signed
+        // the token, but common_name is the attacker's email.
+        mockedVerify.mockRejectedValue(new Error('Access token email does not match the machine owner'));
+        const res = makeRes();
+        const next = jest.fn();
+        await (0, checkRemoteAuth_1.checkRemoteAuth)(makeReq({ host: TUNNEL_HOST, 'cf-access-jwt-assertion': 'jwt' }), res, next);
+        expect(res.status).toHaveBeenCalledWith(401);
+        expect(next).not.toHaveBeenCalled();
+    });
+    it('rejects an invalid Access JWT with 401', async () => {
+        mockedLoad.mockReturnValue(PINNED_STATE);
+        mockedVerify.mockRejectedValue(new Error('bad token'));
+        const res = makeRes();
+        const next = jest.fn();
+        await (0, checkRemoteAuth_1.checkRemoteAuth)(makeReq({ host: TUNNEL_HOST, 'cf-access-jwt-assertion': 'jwt' }), res, next);
+        expect(res.status).toHaveBeenCalledWith(401);
+        expect(next).not.toHaveBeenCalled();
+    });
+});
+describe('checkRemoteWsAuth (WebSocket upgrade)', () => {
+    it('allows everything when Access is not configured', async () => {
+        mockedLoad.mockReturnValue(null);
+        await expect((0, checkRemoteAuth_1.checkRemoteWsAuth)(makeReq({ host: 'localhost:9998' }))).resolves.toBe(true);
+    });
+    it('allows local upgrades even when configured', async () => {
+        mockedLoad.mockReturnValue(PINNED_STATE);
+        await expect((0, checkRemoteAuth_1.checkRemoteWsAuth)(makeReq({ host: 'localhost:9998' }))).resolves.toBe(true);
+        expect(mockedVerify).not.toHaveBeenCalled();
+    });
+    it('denies tunnel-host upgrades without an assertion when configured', async () => {
+        mockedLoad.mockReturnValue(PINNED_STATE);
+        await expect((0, checkRemoteAuth_1.checkRemoteWsAuth)(makeReq({ host: TUNNEL_HOST }))).resolves.toBe(false);
+    });
+    it('fails closed when configured without a pinned owner email', async () => {
+        mockedLoad.mockReturnValue({ accessTeamDomain: 'team.cloudflareaccess.com', accessAud: 'aud' });
+        await expect((0, checkRemoteAuth_1.checkRemoteWsAuth)(makeReq({ host: TUNNEL_HOST }))).resolves.toBe(false);
+    });
+    it('allows tunnel-host upgrades with a valid assertion and pins the owner email', async () => {
+        mockedLoad.mockReturnValue(PINNED_STATE);
+        await expect((0, checkRemoteAuth_1.checkRemoteWsAuth)(makeReq({ host: TUNNEL_HOST, 'cf-access-jwt-assertion': 'jwt' }))).resolves.toBe(true);
+        expect(mockedVerify).toHaveBeenCalledWith('jwt', { teamDomain: 'team.cloudflareaccess.com', aud: 'aud-tag' }, { ownerEmail: 'owner@repoburg.com' });
+    });
+});

package/daemon/dist/middleware/corsOrigin.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.corsOrigin = corsOrigin;
+exports.setExtraOriginsForTest = setExtraOriginsForTest;
+/**
+ * CORS origin allowlist for the daemon.
+ *
+ * Spec: the daemon serves the embedded agent-pane to local tooling
+ * (vite dev servers, daemon-desktop) and, once a tunnel is provisioned, to
+ * `*.repoburg.com` machine hostnames. Everything else is rejected — the
+ * previous `origin: '*'` with `credentials: true` is an open API surface.
+ *
+ * Allowed:
+ *  - no Origin header (same-origin / non-browser clients such as curl)
+ *  - http://localhost:<any> and http://127.0.0.1:<any>
+ *  - https://<anything>.repoburg.com (tunnel machine hostnames)
+ *  - extra origins from REPOBURG_ALLOWED_ORIGINS (comma-separated)
+ */
+const REPORG_HOSTNAME_SUFFIX = '.repoburg.com';
+const extraOrigins = (process.env.REPOBURG_ALLOWED_ORIGINS ?? '')
+    .split(',')
+    .map((value) => value.trim())
+    .filter(Boolean);
+function isLocalOrigin(origin) {
+    return (origin.protocol === 'http:' &&
+        (origin.hostname === 'localhost' || origin.hostname === '127.0.0.1'));
+}
+function isTunnelOrigin(origin) {
+    return origin.protocol === 'https:' && origin.hostname.endsWith(REPORG_HOSTNAME_SUFFIX);
+}
+/** CORS origin callback. `false` = do not emit CORS headers for this origin. */
+function corsOrigin(origin, callback) {
+    // Same-origin requests and non-browser clients send no Origin header.
+    if (origin === undefined) {
+        callback(null, true);
+        return;
+    }
+    let parsed;
+    try {
+        parsed = new URL(origin);
+    }
+    catch {
+        callback(null, false);
+        return;
+    }
+    const allowed = isLocalOrigin(parsed) || isTunnelOrigin(parsed) || extraOrigins.includes(origin);
+    callback(null, allowed);
+}
+/** Exposed for tests. */
+function setExtraOriginsForTest(origins) {
+    extraOrigins.length = 0;
+    extraOrigins.push(...origins);
+}

package/daemon/dist/middleware/corsOrigin.spec.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const corsOrigin_1 = require("./corsOrigin");
+function evaluate(origin) {
+    let result = false;
+    (0, corsOrigin_1.corsOrigin)(origin, (err, allow) => {
+        if (err)
+            throw err;
+        result = !!allow;
+    });
+    return result;
+}
+describe('corsOrigin', () => {
+    afterEach(() => (0, corsOrigin_1.setExtraOriginsForTest)([]));
+    it('allows requests without an Origin header (same-origin / curl)', () => {
+        expect(evaluate(undefined)).toBe(true);
+    });
+    it('allows localhost and 127.0.0.1 on any port', () => {
+        expect(evaluate('http://localhost:3000')).toBe(true);
+        expect(evaluate('http://localhost:9998')).toBe(true);
+        expect(evaluate('http://127.0.0.1:5173')).toBe(true);
+    });
+    it('allows tunnel machine hostnames under repoburg.com (https only)', () => {
+        expect(evaluate('https://workstation.repoburg.com')).toBe(true);
+        expect(evaluate('https://a-b.repoburg.com')).toBe(true);
+    });
+    it('rejects unknown origins', () => {
+        expect(evaluate('https://evil.example.com')).toBe(false);
+        expect(evaluate('http://evil.com')).toBe(false);
+    });
+    it('rejects repoburg.com hostnames over http (tunnels are https)', () => {
+        expect(evaluate('http://workstation.repoburg.com')).toBe(false);
+    });
+    it('rejects lookalike suffixes', () => {
+        expect(evaluate('https://workstation.repoburg.com.evil.com')).toBe(false);
+        expect(evaluate('https://evilrepoburg.com')).toBe(false);
+    });
+    it('rejects malformed origins', () => {
+        expect(evaluate('not a url')).toBe(false);
+    });
+    it('allows extra origins configured via env list', () => {
+        (0, corsOrigin_1.setExtraOriginsForTest)(['https://staging.example.com']);
+        expect(evaluate('https://staging.example.com')).toBe(true);
+        expect(evaluate('https://other.example.com')).toBe(false);
+    });
+});

package/daemon/dist/remote/access-jwt.js

@@ -0,0 +1,67 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.teamJwks = teamJwks;
+exports.verifyAccessJwt = verifyAccessJwt;
+/**
+ * CF Access JWT verification for requests arriving through the tunnel.
+ *
+ * Spec: when the machine has a tunnel AND Cloudflare Access is configured
+ * (team domain + application AUD stored in remote.json), every /api/* and
+ * /ws request must carry a valid `Cf-Access-Jwt-Assertion` header signed by
+ * the team's Cloudflare Zero Trust org. Without Access configured, the
+ * loopback binding remains the security boundary (tunnel traffic is
+ * Edge-protected by the user's Access policy once set up).
+ */
+const jose = __importStar(require("jose"));
+/** Build (and cache) the JWKS for a team's public Access signing keys. */
+function teamJwks(teamDomain) {
+    const url = new URL(`https://${teamDomain}/cdn-cgi/access/certs`);
+    return jose.createRemoteJWKSet(url);
+}
+/** Verify a Cloudflare Access JWT against the team's keys. */
+async function verifyAccessJwt(assertion, config, options = {}) {
+    const jwks = options.jwks ?? teamJwks(config.teamDomain);
+    const { payload } = await jose.jwtVerify(assertion, jwks, {
+        issuer: `https://${config.teamDomain}`,
+        audience: config.aud,
+    });
+    // CF Access JWTs carry the identity email in `email`; older docs/flows used
+    // `common_name`. Accept either so pinning matches real edge-issued tokens.
+    const identity = payload.common_name ?? payload.email;
+    if (options.ownerEmail && identity !== options.ownerEmail) {
+        throw new Error(`Access token email does not match the machine owner (${identity} !== ${options.ownerEmail}).`);
+    }
+}

package/daemon/dist/remote/access-jwt.spec.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const access_jwt_1 = require("./access-jwt");
+const jose = __importStar(require("jose"));
+/**
+ * Real-crypto tests: sign actual Access-style JWTs with an injected HMAC key
+ * and verify the email-pinning logic on top of signature/iss/aud checks.
+ */
+const SECRET = new TextEncoder().encode('test-secret-for-specs-only');
+const CONFIG = { teamDomain: 'team.cloudflareaccess.com', aud: 'aud-tag' };
+const jwks = (async () => SECRET);
+async function makeAssertion(claims) {
+    return new jose.SignJWT(claims)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuer('https://team.cloudflareaccess.com')
+        .setAudience('aud-tag')
+        .setExpirationTime('2h')
+        .sign(SECRET);
+}
+describe('verifyAccessJwt', () => {
+    it('accepts a valid token signed by the team', async () => {
+        const assertion = await makeAssertion({ common_name: 'owner@repoburg.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks })).resolves.toBeUndefined();
+    });
+    it('accepts any identity when no owner email is pinned (optional check)', async () => {
+        const assertion = await makeAssertion({ common_name: 'someone-else@evil.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks })).resolves.toBeUndefined();
+    });
+    it('rejects a wrong-email token when the owner email is pinned', async () => {
+        const assertion = await makeAssertion({ common_name: 'hacker@evil.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).rejects.toThrow(/does not match the machine owner/);
+    });
+    it('accepts the pinned owner email', async () => {
+        const assertion = await makeAssertion({ common_name: 'owner@repoburg.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).resolves.toBeUndefined();
+    });
+    it('matches the pinned owner email via the email claim (real CF Access format)', async () => {
+        // Live-verified 2026-09: CF Access JWTs carry `email`, NOT `common_name`.
+        const assertion = await makeAssertion({ email: 'owner@repoburg.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).resolves.toBeUndefined();
+    });
+    it('rejects a wrong email claim when the owner email is pinned', async () => {
+        const assertion = await makeAssertion({ email: 'hacker@evil.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).rejects.toThrow(/does not match the machine owner/);
+    });
+    it('rejects a token with neither email nor common_name when pinned', async () => {
+        const assertion = await makeAssertion({ sub: '99dd1943-5978-589e-9dd0-884f0c79e926' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).rejects.toThrow(/does not match the machine owner/);
+    });
+    it('rejects tokens with a wrong issuer or audience', async () => {
+        const wrongIss = await new jose.SignJWT({ common_name: 'owner@repoburg.com' })
+            .setProtectedHeader({ alg: 'HS256' })
+            .setIssuer('https://other-team.cloudflareaccess.com')
+            .setAudience('aud-tag')
+            .setExpirationTime('2h')
+            .sign(SECRET);
+        await expect((0, access_jwt_1.verifyAccessJwt)(wrongIss, CONFIG, { jwks })).rejects.toThrow();
+        const wrongAud = await makeAssertion({ common_name: 'owner@repoburg.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(wrongAud, { teamDomain: 'team.cloudflareaccess.com', aud: 'other-aud' }, { jwks })).rejects.toThrow();
+    });
+});