tapimo 0.1.0 → 0.3.0

package/src/internal/Auth.test.ts

@@ -175,6 +175,7 @@ describe('require', () => {
       expect(entries[0]?.errorCode).toMatchInlineSnapshot(`"api_key_forbidden"`)
       expect(entries[0]?.principal).toMatchInlineSnapshot(`
         {
+          "billingActive": false,
           "environment": "production",
           "id": "key_test",
           "orgId": "org_test",
@@ -267,10 +268,247 @@ describe('require', () => {
     })
   })
 
+  describe('session', () => {
+    const sessionPrincipal = {
+      id: 'usr_test',
+      identity: { provider: 'wallet', subject: '0x0000000000000000000000000000000000000001' },
+      type: 'session',
+    } as const satisfies Auth.SessionPrincipal
+
+    /** Harness with the session capability installed on the auth context. */
+    function createSessionApp(
+      options: {
+        policy?: Auth.require.Policy | undefined
+        resolve?: Auth.Session['resolve'] | undefined
+      } = {},
+    ) {
+      const auth = {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        rateLimit: RateLimit.memory(),
+        ...(options.resolve ? { session: { resolve: options.resolve } } : {}),
+      }
+      const app = new Hono<Auth.Environment>()
+      app.use('*', async (c, next) => {
+        c.set('auth', auth)
+        await next()
+      })
+      app.use('/protected', Auth.require(options.policy ?? { session: true }))
+      app.get('/protected', (c) => c.json(serializePrincipal(Auth.getPrincipal(c))))
+      return app
+    }
+
+    test('resolves cookie sessions for session-lane routes', async () => {
+      const app = createSessionApp({ resolve: async () => sessionPrincipal })
+      const response = await app.request('/protected')
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "usr_test",
+          "type": "session",
+        }
+      `)
+    })
+
+    test('falls through to the session lane on invalid bearer tokens', async () => {
+      const app = createSessionApp({ resolve: async () => sessionPrincipal })
+      const response = await app.request('/protected', {
+        headers: { authorization: 'Bearer not-an-api-key' },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('rejects anonymous requests without a session', async () => {
+      const app = createSessionApp({ resolve: async () => null })
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('stays closed without the app session capability', async () => {
+      const app = createSessionApp()
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('valid API keys win over sessions', async () => {
+      const app = createSessionApp({
+        policy: { apiKey: { scopes: ['data:read'] }, session: true },
+        resolve: async () => sessionPrincipal,
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "key_test",
+          "orgId": "org_test",
+          "type": "api_key",
+        }
+      `)
+    })
+
+    test('is not consulted on lane-less routes', async () => {
+      const app = createSessionApp({
+        policy: {},
+        resolve: async () => sessionPrincipal,
+      })
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+  })
+
+  describe('superAdmin', () => {
+    const secret = 'tempo:sk:a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0'
+
+    /** Auth context with the super admin secret configured alongside the test key. */
+    function withSuperAdmin(): Auth.Context {
+      return {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        rateLimit: RateLimit.memory(),
+        superAdmin: { tokenHash: ApiKey.hash(secret) },
+      }
+    }
+
+    test('resolves the super admin secret before key lookup', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "actor": "super_admin",
+          "id": "super_admin",
+          "type": "super_admin",
+        }
+      `)
+    })
+
+    test('accepts the super admin secret as a bearer token', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { authorization: `Bearer ${secret}` },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('bypasses scope checks', async () => {
+      const app = createApp({
+        auth: withSuperAdmin(),
+        policy: { apiKey: { scopes: [Scope.wildcard] } },
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('non-matching tokens fall through to key lookup', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "key_test",
+          "orgId": "org_test",
+          "type": "api_key",
+        }
+      `)
+    })
+
+    test('is disabled when unconfigured', async () => {
+      const app = createApp()
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": "api_key_invalid",
+            "message": "Invalid API key",
+          },
+        }
+      `)
+    })
+
+    test('is the only principal for lane-less routes', async () => {
+      const app = createApp({ auth: withSuperAdmin(), policy: {} })
+
+      const superAdmin = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      expect(superAdmin.status).toMatchInlineSnapshot(`200`)
+
+      const keyed = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await keyed.json()
+      expect(keyed.status).toMatchInlineSnapshot(`403`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": "forbidden",
+            "message": "API key not permitted for this route",
+          },
+        }
+      `)
+
+      const anonymous = await app.request('/protected')
+      expect(anonymous.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('logs the principal actor, never the secret', async () => {
+      const entries: Log.Entry[] = []
+      const app = createApp({
+        auth: withSuperAdmin(),
+        logger: (entry) => {
+          entries.push(entry)
+        },
+      })
+      await app.request('/protected', { headers: { 'tempo-api-key': secret } })
+
+      expect(entries[0]?.principal).toMatchInlineSnapshot(`
+        {
+          "actor": "super_admin",
+          "id": "super_admin",
+          "type": "super_admin",
+        }
+      `)
+      expect(JSON.stringify(entries)).not.toContain(secret)
+    })
+  })
+
   describe('environment', () => {
     const sandboxToken = 'secret_sandbox'
 
-    function createChainApp(options: { public?: boolean } = {}) {
+    function createChainApp(
+      options: {
+        public?: boolean
+        publicRateLimit?: RateLimit.Limit
+        rateLimit?: RateLimit.Store
+        sandboxBillingActive?: boolean
+        mpp?: Auth.Context['mpp']
+      } = {},
+    ) {
       const auth: Auth.Context = {
         apiKey: {
           resolve: TestApp.resolver({
@@ -282,27 +520,33 @@ describe('require', () => {
                 orgId: 'org_test',
                 scopes: [Scope.wildcard],
                 token: sandboxToken,
+                ...(options.sandboxBillingActive === undefined
+                  ? {}
+                  : { billingActive: options.sandboxBillingActive }),
               },
             ],
           }),
         },
-        rateLimit: RateLimit.memory(),
+        rateLimit: options.rateLimit ?? RateLimit.memory(),
+        ...(options.publicRateLimit ? { publicRateLimit: options.publicRateLimit } : {}),
+        ...(options.mpp ? { mpp: options.mpp } : {}),
       }
       const policy: Auth.require.Policy = {
         apiKey: { scopes: [Scope.wildcard] },
         ...(options.public === false ? {} : { public: { rateLimit: { perMinute: 60 } } }),
+        ...(options.mpp ? { mpp: { charge: { amount: '1' } } } : {}),
       }
       const app = new Hono<Auth.Environment>()
       app.use('*', async (c, next) => {
         c.set('auth', auth)
-        // Mirror the app default so sandbox steering toward testnet is observable.
+        // Mirror the app default (mainnet) so the effective chain is observable.
         c.set('chainId' as never, Viem.defaultChainId as never)
         await next()
       })
       app.use('/protected', Auth.require(policy))
       app.get('/protected', (c) => {
         // Mirror how real handlers resolve the effective chain: explicit query
-        // wins, else the context default (which auth may steer to testnet).
+        // wins, else the context default. Auth no longer steers this value.
         const raw = c.req.query('chainId')
         const chainId = raw ? Number(raw) : ((c.get('chainId' as never) as number | null) ?? null)
         return c.json({ chainId, principal: Auth.getPrincipal(c)?.type ?? null })
@@ -310,45 +554,39 @@ describe('require', () => {
       return app
     }
 
-    test('falls through to the public policy for a sandbox key on explicit mainnet', async () => {
+    test('rejects a sandbox key on explicit mainnet', async () => {
       const app = createChainApp()
       const response = await app.request('/protected?chainId=4217', {
         headers: { 'tempo-api-key': sandboxToken },
       })
-      expect(response.status).toMatchInlineSnapshot(`200`)
-      // Treated as anonymous (public) rather than rejected; chain stays mainnet.
+      expect(response.status).toMatchInlineSnapshot(`403`)
       expect(await response.json()).toMatchInlineSnapshot(`
         {
-          "chainId": 4217,
-          "principal": "public",
+          "error": {
+            "code": "api_key_forbidden",
+            "message": "Sandbox API keys only support testnet. Pass a testnet \`chainId\`.",
+          },
         }
       `)
     })
 
-    test('falls through to the public policy for a sandbox key on the mainnet alias', async () => {
+    test('rejects a sandbox key on the mainnet alias', async () => {
       const app = createChainApp()
       const response = await app.request('/protected?chainId=mainnet', {
         headers: { 'tempo-api-key': sandboxToken },
       })
-      expect(response.status).toMatchInlineSnapshot(`200`)
-      expect((await response.json()).principal).toMatchInlineSnapshot(`"public"`)
+      expect(response.status).toMatchInlineSnapshot(`403`)
+      expect((await response.json()).error.code).toMatchInlineSnapshot(`"api_key_forbidden"`)
     })
 
-    test('a sandbox key on mainnet with no public lane is rejected as missing', async () => {
+    test('rejects a sandbox key on explicit mainnet even with no public lane', async () => {
       const app = createChainApp({ public: false })
       const response = await app.request('/protected?chainId=4217', {
         headers: { 'tempo-api-key': sandboxToken },
       })
-      // With no public lane, the public policy closes to "missing API key".
-      expect(response.status).toMatchInlineSnapshot(`401`)
-      expect(await response.json()).toMatchInlineSnapshot(`
-        {
-          "error": {
-            "code": "api_key_missing",
-            "message": "Missing API key",
-          },
-        }
-      `)
+      // A resolved-but-forbidden key is a 403, not anonymous fall-through.
+      expect(response.status).toMatchInlineSnapshot(`403`)
+      expect((await response.json()).error.code).toMatchInlineSnapshot(`"api_key_forbidden"`)
     })
 
     test('uses a sandbox key on an explicit non-mainnet chain', async () => {
@@ -365,15 +603,17 @@ describe('require', () => {
       `)
     })
 
-    test('defaults a sandbox key with no chain to testnet', async () => {
+    test('authenticates a sandbox key with no query chain without steering', async () => {
       const app = createChainApp()
       const response = await app.request('/protected', {
         headers: { 'tempo-api-key': sandboxToken },
       })
+      // Auth no longer mutates `chainId`; the mainnet default is left for the
+      // data group's own sandbox chain guard to reject.
       expect(response.status).toMatchInlineSnapshot(`200`)
       expect(await response.json()).toMatchInlineSnapshot(`
         {
-          "chainId": 42431,
+          "chainId": 4217,
           "principal": "api_key",
         }
       `)
@@ -392,6 +632,85 @@ describe('require', () => {
         }
       `)
     })
+
+    test('throttles a sandbox key to the public quota when billing is inactive', async () => {
+      const app = createChainApp({
+        public: true, // policy.public.rateLimit is { perMinute: 60 }
+        sandboxBillingActive: false,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      expect(response.status).toBe(200)
+      // The public ceiling (60), not the API-key default (100).
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"60"`)
+    })
+
+    test('grants a sandbox key the full API-key quota when billing is active', async () => {
+      const app = createChainApp({
+        public: true,
+        sandboxBillingActive: true,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      expect(response.status).toBe(200)
+      // The API-key default (100), not the public ceiling (60).
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"100"`)
+    })
+
+    test('throttles a sandbox key to the public quota when billing is unknown', async () => {
+      // A sandbox key minted before billing was ever active carries no
+      // `billingActive` flag; it falls back to the public quota.
+      const app = createChainApp({ public: true })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      expect(response.status).toBe(200)
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"60"`)
+    })
+
+    test('throttles to the configured public default on API-key-only routes', async () => {
+      const app = createChainApp({
+        public: false, // no per-route public lane
+        publicRateLimit: { perMinute: 7 },
+        sandboxBillingActive: false,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      expect(response.status).toBe(200)
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"7"`)
+    })
+
+    test('returns 429 (never a payment challenge) for a throttled sandbox key over quota', async () => {
+      const app = createChainApp({
+        mpp: createMppServer(),
+        rateLimit: overQuota(),
+        sandboxBillingActive: false,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      // A throttled sandbox key must activate billing, not pay per request, so
+      // the over-quota response is a plain 429 rather than a 402 MPP challenge.
+      expect(response.status).toMatchInlineSnapshot(`429`)
+      expect((await response.json()).error.code).toMatchInlineSnapshot(`"rate_limit_exceeded"`)
+    })
+
+    test('ignores a payment credential for a throttled sandbox key under quota', async () => {
+      const app = createChainApp({
+        mpp: createMppServer(),
+        sandboxBillingActive: false,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken, authorization: 'Payment paid' },
+      })
+      // The payment lane can't buy past the throttle; the request runs on the
+      // public quota instead of being charged.
+      expect(response.status).toBe(200)
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"60"`)
+    })
   })
 
   describe('mpp', () => {
@@ -613,6 +932,144 @@ describe('require', () => {
         error.mockRestore()
       }
     })
+
+    test('fails open (at warn) when the rate-limit store stalls past the timeout', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      vi.useFakeTimers()
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            // A hot Durable Object under a storage-latency blip never returns;
+            // the consume must not block the request indefinitely.
+            rateLimit: { consume: () => new Promise<never>(() => {}) },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const pending = app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+        // Advance past the 300ms consume timeout so it fails open.
+        await vi.advanceTimersByTimeAsync(300)
+        const response = await pending
+        const body = await response.json()
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(body).toMatchInlineSnapshot(`
+          {
+            "id": "203.0.113.10",
+            "type": "public",
+          }
+        `)
+        // A timeout is an expected degradation: warn, never error.
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        vi.useRealTimers()
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
+
+    test('fails open (at warn) when the rate-limit Durable Object is overloaded', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            rateLimit: {
+              async consume() {
+                throw Object.assign(
+                  new Error('Durable Object is overloaded. Requests queued for too long.'),
+                  { overloaded: true },
+                )
+              },
+            },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const response = await app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+        const body = await response.json()
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(body).toMatchInlineSnapshot(`
+          {
+            "id": "203.0.113.10",
+            "type": "public",
+          }
+        `)
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
+
+    test('fails open (at warn) when the rate-limit Durable Object errors retryably', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            rateLimit: {
+              async consume() {
+                // A transient transport fault whose single retry also failed.
+                throw Object.assign(new Error('Network connection lost.'), { retryable: true })
+              },
+            },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const response = await app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
+
+    test('fails open (at warn) on a redacted Durable Object internal error', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            rateLimit: {
+              async consume() {
+                throw new Error(`internal error; reference = ${'ab12'.repeat(6)}`)
+              },
+            },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const response = await app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
   })
 
   describe('rateLimit per-scope', () => {
@@ -805,6 +1262,7 @@ describe('require', () => {
       expect(response.headers.get('ratelimit-limit')).toMatchInlineSnapshot(`"1"`)
       expect(entries[0]?.principal).toMatchInlineSnapshot(`
         {
+          "billingActive": false,
           "environment": "production",
           "id": "key_test",
           "orgId": "org_test",
@@ -948,6 +1406,14 @@ function serializePrincipal(principal: Auth.Principal | null) {
       type: principal.type,
     }
 
+  if (principal.type === 'super_admin')
+    return {
+      actor: principal.actor,
+      id: principal.id,
+      ...payment,
+      type: principal.type,
+    }
+
   return {
     id: principal.id,
     ...payment,