seamless-cli 0.11.0 → 0.13.0

package/verify/docker-compose.verify.yml

@@ -1,21 +1,28 @@
 # Conformance stack for `seamless verify`.
-# Brings up Postgres + the auth API + the Express adapter from local source
-# (paths supplied by the verify command via env) so the Playwright harness can
-# drive every auth flow. NODE_ENV=test enables the API's external-delivery seam
-# so OTP / magic-link tokens are returned in responses (no real email/SMS).
 #
-# Required env (the `seamless verify` command writes these into .env.verify):
-#   SEAMLESS_API_DIR      absolute path to seamless-auth-api source
-#   SEAMLESS_ADAPTER_DIR  absolute path to the express adapter source
-#   API_SERVICE_TOKEN     shared secret between API and adapter
-#   JWKS_KID              key id the adapter expects (must match the API's active kid)
-#   OWNER_EMAIL           tenant owner; this email gets the admin role at signup
+# Postgres, the auth API built from local source, and two adopter backends that are
+# deliberate twins (Express on 3000, Fastify on 3001) so a failure is attributable to
+# one framework. The web starter is behind the `react` profile, since the api and
+# adapter layers need no browser.
+#
+# Env comes from the `seamless verify` process, not a file:
+#   SEAMLESS_API_DIR    absolute path to the seamless-auth-api source (build context)
+#   SEAMLESS_REACT_DIR  absolute path to the web template to serve (react profile only)
+#   API_SERVICE_TOKEN   shared secret between the API and both adapters
+#   JWKS_KID            key id the adapters expect (must match the API's active kid)
+#   OWNER_EMAIL         tenant owner; this email gets the admin role at signup
+#
+# The adapters are built from ./adapter-app and ./adapter-fastify-app in this repo,
+# so they take no path from the environment.
 
 name: seamless-verify
 
 services:
   postgres:
-    image: postgres:16
+    # Matches POSTGRES_IMAGE in src/core/images.ts, so the harness runs the same
+    # major a fresh scaffold gets. Every run starts with `down -v`, so the volume
+    # is always new and a major bump needs no migration here.
+    image: postgres:18
     environment:
       POSTGRES_USER: seamless
       POSTGRES_PASSWORD: seamless
@@ -27,19 +34,17 @@ services:
       retries: 20
 
   auth-api:
-    # Built with the production Dockerfile (compiles dist/), but run with
-    # NODE_ENV=test so signing keys auto-generate and prod-only env (JWKS keys)
-    # is skipped. validateEnvs.sh gates startup on the env below.
+    # Built with the production Dockerfile (compiles dist/). Its validateEnvs.sh
+    # entrypoint runs the migrations and gates startup on the env below.
     build:
       context: ${SEAMLESS_API_DIR}
       dockerfile: Dockerfile
     ports:
       - '5312:5312'
     environment:
-      # `development` (not `test`): the API's JWKS endpoint only serves the
-      # auto-generated dev public key when NODE_ENV === 'development', even though
-      # signing treats any non-production env as dev. Running as development keeps
-      # JWKS publication working so the adapter/SDKs can verify tokens.
+      # `development`, not `test`: signing treats any non-production env as dev, but
+      # the JWKS endpoint only serves the auto-generated dev public key under
+      # `development`. The adapters and SDKs need that key to verify tokens.
       NODE_ENV: development
       PORT: '5312'
       APP_NAME: Seamless Verify
@@ -51,9 +56,9 @@ services:
       DEFAULT_ROLES: user
       AVAILABLE_ROLES: user,admin
       LOGIN_METHODS: passkey,magic_link,email_otp,phone_otp,oauth
-      # Required system config as of auth-api 0.3.0: the base URL for emailed
-      # magic links. Without it (and with a fresh DB, so system_config isn't seeded)
-      # the server exits at startup. The browser-visible web app runs on 5173.
+      # The base URL for emailed magic links, required at boot: with a fresh DB
+      # there is no seeded system_config row to fall back on, so the server exits
+      # without it. The browser-visible web app runs on 5173.
       FRONTEND_URL: http://localhost:5173
       DB_LOGGING: 'false'
       ACCESS_TOKEN_TTL: 15m
@@ -117,6 +122,32 @@ services:
       timeout: 3s
       retries: 20
 
+  # The same adopter backend on Fastify, so the cookie path is conformance-tested
+  # for both adapters rather than only the one the harness happens to be written
+  # against. Identical env contract and capture transport; only the framework and
+  # the published port differ, which is what makes a failure here attributable.
+  adapter-fastify:
+    build:
+      context: ./adapter-fastify-app
+    ports:
+      - '3001:3001'
+    environment:
+      PORT: '3001'
+      AUTH_SERVER_URL: http://auth-api:5312
+      APP_ORIGIN: http://localhost:3001
+      WEB_ORIGIN: http://localhost:5173
+      API_SERVICE_TOKEN: ${API_SERVICE_TOKEN}
+      COOKIE_SIGNING_KEY: ${API_SERVICE_TOKEN}
+      JWKS_KID: ${JWKS_KID}
+    depends_on:
+      auth-api:
+        condition: service_healthy
+    healthcheck:
+      test: ['CMD', 'curl', '-fsS', 'http://localhost:3001/']
+      interval: 3s
+      timeout: 3s
+      retries: 20
+
   # React starter app (built SPA on nginx), pointed at the adapter so the React
   # SDK's `${apiHost}/auth/*` calls hit the adapter's mount. Browser-visible URL,
   # so API_URL is the host-mapped adapter (localhost:3000), not the compose host.

package/verify/harness/api/loginEnumeration.spec.ts

@@ -0,0 +1,139 @@
+import { expect, test } from '../lib/fixtures';
+import { registerAndVerifyEmail } from '../lib/flows';
+
+// `POST /login` answers the same way for an identifier with an account and one without,
+// and the endpoints that accept the resulting pre-auth token do too. The API has its own
+// unit coverage for this; what only this harness can check is that the guarantee survives
+// a real instance, with real signing keys and the real login policy in place.
+//
+// The specific failures worth catching are the ones where a decoy responder reproduces
+// the success path and forgets a refusal, since that is the shape every regression here
+// has taken so far.
+
+const UNKNOWN = () => `nobody-${Date.now()}-${Math.random().toString(36).slice(2)}@example.com`;
+
+async function startLogin(ctx: Parameters<typeof registerAndVerifyEmail>[0], identifier: string) {
+  const res = await ctx.post('/login', { data: { identifier } });
+  return { status: res.status(), body: await res.json() };
+}
+
+test.describe('login enumeration (api)', () => {
+  test('an unknown identifier is answered in the same shape as a real one', async ({
+    actor,
+  }) => {
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+
+    const real = await startLogin(actor.ctx, actor.email);
+    const unknown = await startLogin(actor.ctx, UNKNOWN());
+
+    expect(unknown.status).toBe(200);
+    expect(unknown.status).toBe(real.status);
+    // `sub` and `token` differ between them exactly as they differ between two real
+    // accounts, so the comparison is over everything else.
+    expect(Object.keys(unknown.body).sort()).toEqual(Object.keys(real.body).sort());
+    expect(unknown.body.identifierType).toBe(real.body.identifierType);
+    expect(unknown.body.ttl).toBe(real.body.ttl);
+    expect(typeof unknown.body.token).toBe('string');
+    // Deliberately not `loginMethods`. That list is filtered by what an account can do,
+    // and a decoy's capabilities are derived per identifier, so any one decoy and any
+    // one account can legitimately differ. What has to hold is the next test.
+  });
+
+  test('a real account\'s method list is one a decoy can also produce', async ({ actor }) => {
+    // The guarantee is not that two given answers match, it is that a given answer does
+    // not identify an account. A decoy that always claimed everything would make any
+    // narrower list proof of existence, so the decoy's passkey and phone are derived per
+    // identifier and a narrow list has to be reachable without an account behind it.
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+    const real = await startLogin(actor.ctx, actor.email);
+    const target = JSON.stringify(real.body.loginMethods);
+
+    const seen = new Set<string>();
+    for (let i = 0; i < 40; i += 1) {
+      const { body } = await startLogin(actor.ctx, UNKNOWN());
+      seen.add(JSON.stringify(body.loginMethods));
+    }
+
+    // Each decoy draws two independent bits, so this account's exact list comes up about
+    // a quarter of the time; over 40 identifiers, missing it entirely is a 1-in-100,000
+    // event rather than a flake worth retrying.
+    expect(seen.has(target), `no decoy offered ${target}; saw ${[...seen].join(' | ')}`).toBe(
+      true,
+    );
+    expect(seen.size).toBeGreaterThan(1);
+  });
+
+  test('the same unknown identifier keeps the same subject', async ({ actor }) => {
+    const identifier = UNKNOWN();
+
+    const first = await startLogin(actor.ctx, identifier);
+    const second = await startLogin(actor.ctx, identifier);
+    const other = await startLogin(actor.ctx, UNKNOWN());
+
+    // A real identifier resolves to the same row every time and to a different one from
+    // anyone else's. A subject that rerolled, or that collided, would be the oracle again
+    // one request later.
+    expect(second.body.sub).toBe(first.body.sub);
+    expect(other.body.sub).not.toBe(first.body.sub);
+    // The offered methods have to be stable for the same reason: a list that changed
+    // between attempts would separate a decoy from an account on its own.
+    expect(second.body.loginMethods).toEqual(first.body.loginMethods);
+  });
+
+  test('an unknown identifier gets an OTP send that reports success and sends nothing', async ({
+    actor,
+  }) => {
+    const { body } = await startLogin(actor.ctx, UNKNOWN());
+
+    const res = await actor.ctx.get('/otp/generate-login-email-otp', {
+      headers: { Authorization: `Bearer ${body.token}` },
+    });
+
+    expect(res.status()).toBe(200);
+    expect((await res.json()).message).toBe('success');
+  });
+
+  test('a decoy OTP verify fails the way a wrong code fails', async ({ actor }) => {
+    const { body } = await startLogin(actor.ctx, UNKNOWN());
+
+    const res = await actor.ctx.post('/otp/verify-login-email-otp', {
+      headers: { Authorization: `Bearer ${body.token}` },
+      data: { verificationToken: 'ZZZZZZ' },
+    });
+
+    expect(res.status()).toBe(401);
+  });
+
+  test('a credential id that cannot exist is refused for real and unknown alike', async ({
+    actor,
+  }) => {
+    // The sharpest oracle this surface had. `/webauthn/login/start` filters the account's
+    // credentials by the requested id and refuses when none survive, so an id no
+    // credential can hold is refused by every real account. A decoy that answered with a
+    // challenge anyway was identifiable in two requests, whatever the policy.
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+
+    const real = await startLogin(actor.ctx, actor.email);
+    const unknown = await startLogin(actor.ctx, UNKNOWN());
+
+    const ask = (token: string) =>
+      actor.ctx.post('/webauthn/login/start', {
+        headers: { Authorization: `Bearer ${token}` },
+        data: { credentialId: 'not-a-real-credential-id' },
+      });
+
+    const realRes = await ask(real.body.token);
+    const unknownRes = await ask(unknown.body.token);
+
+    expect(unknownRes.status()).toBe(realRes.status());
+    expect(await unknownRes.text()).toBe(await realRes.text());
+  });
+
+  test('a malformed identifier is still rejected', async ({ actor }) => {
+    // Not an enumeration signal: it does not depend on whether an account exists, and
+    // answering 200 here would leave a caller with no way to learn it typed nonsense.
+    const { status } = await startLogin(actor.ctx, 'not-an-identifier');
+
+    expect(status).toBe(400);
+  });
+});

package/verify/harness/global-setup.ts

@@ -1,6 +1,6 @@
 import { request as playwrightRequest } from '@playwright/test';
 
-import { ADAPTER_URL, API_URL, MOCK_OIDC_PORT, REACT_URL } from './lib/env';
+import { ADAPTER_URL, API_URL, FASTIFY_ADAPTER_URL, MOCK_OIDC_PORT, REACT_URL } from './lib/env';
 import { startMockOidc } from './mock-oidc';
 
 async function waitForHealth(url: string, name: string, timeoutMs = 120_000): Promise<void> {
@@ -39,6 +39,9 @@ export default async function globalSetup(): Promise<void> {
   if (process.env.SEAMLESS_VERIFY_ADAPTER === '1') {
     await waitForHealth(`${ADAPTER_URL}/`, 'adapter');
   }
+  if (process.env.SEAMLESS_VERIFY_ADAPTER_FASTIFY === '1') {
+    await waitForHealth(`${FASTIFY_ADAPTER_URL}/`, 'adapter-fastify');
+  }
   if (process.env.SEAMLESS_VERIFY_REACT === '1') {
     await waitForHealth(`${REACT_URL}/health`, 'react');
   }

package/verify/harness/lib/client.ts

@@ -24,9 +24,13 @@ export async function newApiActor(prefix = 'verify'): Promise<Actor> {
   return { email: uniqueEmail(prefix), ctx, dispose: () => ctx.dispose() };
 }
 
-// A browser-like actor for the cookie path: a context bound to the adapter that
+// A browser-like actor for the cookie path: a context bound to an adapter that
 // persists cookies across requests (the adapter handles service tokens internally).
-export async function newAdapterActor(prefix = 'verify'): Promise<Actor> {
-  const ctx = await playwrightRequest.newContext({ baseURL: ADAPTER_URL });
+// `baseURL` selects which adapter, so the same specs drive Express and Fastify.
+export async function newAdapterActor(
+  baseURL: string = ADAPTER_URL,
+  prefix = 'verify',
+): Promise<Actor> {
+  const ctx = await playwrightRequest.newContext({ baseURL });
   return { email: uniqueEmail(prefix), ctx, dispose: () => ctx.dispose() };
 }

package/verify/harness/lib/env.ts

@@ -4,6 +4,10 @@ import { randomInt, randomUUID } from 'crypto';
 
 export const API_URL = process.env.SEAMLESS_API_URL ?? 'http://localhost:5312';
 export const ADAPTER_URL = process.env.SEAMLESS_ADAPTER_URL ?? 'http://localhost:3000';
+// The Fastify twin of the adapter, on its own port. The adapter specs run against
+// both, so a regression in one framework is visible on its own row of the matrix.
+export const FASTIFY_ADAPTER_URL =
+  process.env.SEAMLESS_FASTIFY_ADAPTER_URL ?? 'http://localhost:3001';
 export const REACT_URL = process.env.SEAMLESS_REACT_URL ?? 'http://localhost:5173';
 export const MOCK_OIDC_PORT = Number(process.env.SEAMLESS_MOCK_OIDC_PORT ?? 9000);
 

package/verify/harness/lib/fixtures.ts

@@ -1,17 +1,26 @@
 import { test as base } from '@playwright/test';
 
 import { Actor, newAdapterActor, newApiActor } from './client';
+import { ADAPTER_URL } from './env';
+
+// `adapterUrl` is a project option rather than something a spec sets: the adapter
+// suite is written once and each project points it at a different adopter backend
+// (Express, Fastify). A spec cannot tell which one answered, which is the point.
+export interface AdapterOptions {
+  adapterUrl: string;
+}
 
 // `actor` drives the API directly (Bearer + service token); `adapterActor` drives
 // the adopter backend over cookies. Both are auto-created and disposed per test.
-export const test = base.extend<{ actor: Actor; adapterActor: Actor }>({
+export const test = base.extend<AdapterOptions & { actor: Actor; adapterActor: Actor }>({
+  adapterUrl: [ADAPTER_URL, { option: true }],
   actor: async ({}, use) => {
     const actor = await newApiActor();
     await use(actor);
     await actor.dispose();
   },
-  adapterActor: async ({}, use) => {
-    const actor = await newAdapterActor();
+  adapterActor: async ({ adapterUrl }, use) => {
+    const actor = await newAdapterActor(adapterUrl);
     await use(actor);
     await actor.dispose();
   },

package/verify/harness/lib/matrixReporter.ts

@@ -1,12 +1,16 @@
 import type { FullResult, Reporter, TestCase, TestResult } from '@playwright/test/reporter';
 
 // Prints a flow x layer conformance grid at the end of the run. Layer comes from
-// the spec's directory (api/adapter/react); flow from the spec file name, with a
-// few aliases folded together so the same flow lines up across layers.
+// the Playwright project; flow from the spec file name, with a few aliases folded
+// together so the same flow lines up across layers.
 
-const LAYERS = ['api', 'adapter', 'react'] as const;
+const LAYERS = ['api', 'adapter', 'adapter-fastify', 'react'] as const;
 type Layer = (typeof LAYERS)[number];
 
+function isLayer(name: string): name is Layer {
+  return (LAYERS as readonly string[]).includes(name);
+}
+
 const FLOW_ALIASES: Record<string, string> = {
   emailOtpLogin: 'emailOtp',
   registration: 'register',
@@ -29,7 +33,11 @@ export default class MatrixReporter implements Reporter {
   onTestEnd(test: TestCase, result: TestResult): void {
     const match = test.location.file.match(/\/(api|adapter|react)\/([^/]+)\.spec\.[tj]s$/);
     if (!match) return;
-    const layer = match[1] as Layer;
+    // The project name, not the directory: the two adapter projects run the same
+    // specs from ./adapter, so the path cannot tell them apart. Falls back to the
+    // directory for a run driven by something that does not name its projects.
+    const projectName = test.parent.project()?.name ?? '';
+    const layer = isLayer(projectName) ? projectName : (match[1] as Layer);
     const base = match[2];
     const flow = FLOW_ALIASES[base] ?? base;
     // Keyed by test id so the final attempt (after retries) is the one that counts.
@@ -51,11 +59,16 @@ export default class MatrixReporter implements Reporter {
     };
 
     const flowWidth = Math.max('flow'.length, ...flows.map((f) => f.length));
+    // Each column is as wide as its own header, so a long layer name (like
+    // adapter-fastify) widens its column instead of running into the next one.
+    const layerWidth = (layer: Layer) => layer.length + 3;
     const pad = (text: string, width: number) =>
       text + ' '.repeat(Math.max(0, width - text.length));
     const row = (label: string, get: (layer: Layer) => string) =>
-      `  ${pad(label, flowWidth)}   ${LAYERS.map((l) => pad(get(l), 9)).join('')}`;
-    const rule = `  ${'-'.repeat(flowWidth + 3 + LAYERS.length * 9)}`;
+      `  ${pad(label, flowWidth)}   ${LAYERS.map((l) => pad(get(l), layerWidth(l))).join('')}`;
+    const totalWidth =
+      flowWidth + 3 + LAYERS.reduce((sum, l) => sum + layerWidth(l), 0);
+    const rule = `  ${'-'.repeat(totalWidth)}`;
 
     const lines = [
       '',

package/verify/harness/lib/reactFlows.ts

@@ -90,8 +90,6 @@ export async function registerWithPasskey(page: Page, email: string): Promise<vo
     page.getByRole('heading', { name: /Secure Your Account with a Passkey/ }),
   ).toBeVisible();
   await page.getByRole('button', { name: 'Register Passkey' }).click();
-  await page.getByPlaceholder(/MacBook/).fill('Verify Device');
-  await page.getByRole('button', { name: 'Continue' }).click();
 }
 
 /** Sign in an existing user whose passkey is registered (the ceremony auto-runs). */

package/verify/harness/playwright.config.ts

@@ -1,11 +1,12 @@
 import { defineConfig, devices } from '@playwright/test';
 
-import { REACT_URL } from './lib/env';
+import { FASTIFY_ADAPTER_URL, REACT_URL } from './lib/env';
+import type { AdapterOptions } from './lib/fixtures';
 
 // One runner, multiple projects. `api` and `adapter` hit HTTP directly (no
 // browser); `react` drives chromium against the starter SPA. global-setup
 // health-gates the stack before any project runs.
-export default defineConfig({
+export default defineConfig<AdapterOptions>({
   testDir: '.',
   globalSetup: './global-setup.ts',
   timeout: 30_000,
@@ -25,7 +26,15 @@ export default defineConfig({
   // pulling browser specs into a project with no baseURL.
   projects: [
     { name: 'api', testDir: './api' },
+    // Both adapter projects run the same specs from the same directory; only the
+    // adopter backend they point at differs. Adding a framework is a project
+    // entry plus a compose service, not a copy of the suite.
     { name: 'adapter', testDir: './adapter' },
+    {
+      name: 'adapter-fastify',
+      testDir: './adapter',
+      use: { adapterUrl: FASTIFY_ADAPTER_URL },
+    },
     {
       name: 'react',
       testDir: './react',

package/dist/core/jwks.js

@@ -1,19 +0,0 @@
-import { generateKeyPairSync } from "crypto";
-export function generateJWKS() {
-    const { publicKey, privateKey } = generateKeyPairSync("rsa", {
-        modulusLength: 2048,
-        publicKeyEncoding: {
-            type: "spki",
-            format: "pem",
-        },
-        privateKeyEncoding: {
-            type: "pkcs8",
-            format: "pem",
-        },
-    });
-    return {
-        publicKey,
-        privateKey,
-    };
-}
-//# sourceMappingURL=jwks.js.map

package/dist/core/jwks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../src/core/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAE7C,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;QAC3D,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAE;YACjB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,KAAK;SACd;QACD,kBAAkB,EAAE;YAClB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,KAAK;SACd;KACF,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/utils/writeEnv.js

@@ -1,9 +0,0 @@
-import path from "path";
-import fs from "fs";
-export function writeEnv(dir, values) {
-    const env = Object.entries(values)
-        .map(([k, v]) => `${k}=${v}`)
-        .join("\n");
-    fs.writeFileSync(path.join(dir, ".env"), env + "\n");
-}
-//# sourceMappingURL=writeEnv.js.map

package/dist/utils/writeEnv.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"writeEnv.js","sourceRoot":"","sources":["../../src/utils/writeEnv.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,MAA2B;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;AACvD,CAAC"}