tapimo 0.15.0 → 0.18.0

package/src/apps/management/routes/api-keys.ts

@@ -7,6 +7,7 @@ import * as ApiKey from '../../../ApiKey.js'
 import * as ApiKeys from '../../../ApiKeys.js'
 import type * as App from '../../../App.js'
 import * as Db from '../../../db/Db.js'
+import * as RoutesPolicies from '../../../db/tables/routesPolicies.js'
 import * as Auth from '../../../internal/Auth.js'
 import * as Billing from '../Billing.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
@@ -84,7 +85,7 @@ export namespace schema {
           .array(z.string().check(z.minLength(1)))
           .check(
             z.describe(
-              "Granted scopes. '*' and non-self-serve scopes appear only on keys minted by the super admin.",
+              "Granted scopes. '*' requires the super admin; a CLI can derive Routes writes from a provisioned project key.",
             ),
             z.meta({ examples: [['data:read']] }),
           ),
@@ -205,6 +206,14 @@ export namespace schema {
             z.describe('Unique scopes to grant.'),
             z.meta({ examples: [['data:read']] }),
           ),
+        sourceKeyId: z.optional(
+          z
+            .string()
+            .check(
+              z.describe('Approved project key to derive a scoped CLI credential from.'),
+              z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+            ),
+        ),
       })
       .check(z.describe('Fields for minting an API key.')),
     'CreateApiKeyRequest',
@@ -384,6 +393,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
         if (!kv) return notEnabled(c)
         const createdBy = mintedBy(c)
         if (!createdBy) return ManagementError.sessionRequired(c)
+        const principal = Auth.getPrincipal(c)
 
         const body = c.req.valid('json')
 
@@ -395,7 +405,23 @@ export function apiKeys(options: apiKeys.Options = {}) {
           })
 
         // Session issuers are limited to the finite self-serve catalog, so uniqueness bounds the vector without a new policy cap.
-        if (!canIssue(c, body.scopes))
+        const source =
+          body.sourceKeyId && principal?.type === 'session' && principal.cli
+            ? await ApiKeys.get(kv.store, body.sourceKeyId, { scopeCatalog: c.get('scopeCatalog') })
+            : undefined
+        if (
+          body.sourceKeyId &&
+          (!source ||
+            source.orgId !== Auth.org(c).id ||
+            source.projectId !== Auth.project(c).id ||
+            source.environment !== body.environment)
+        )
+          return Response.error(c, {
+            code: 'scope_not_issuable',
+            message: 'Select an approved API key from this project and environment.',
+            status: 403,
+          })
+        if (!canIssue(c, body.scopes, source ?? undefined))
           return Response.error(c, {
             code: 'scope_not_issuable',
             message: 'The requested scopes are not issuable.',
@@ -416,14 +442,27 @@ export function apiKeys(options: apiKeys.Options = {}) {
             {
               createdBy,
               environment: body.environment,
-              ...(body.allowedIps === undefined ? {} : { allowedIps: body.allowedIps }),
+              ...(principal?.type === 'session' && principal.cli
+                ? { expiresAt: principal.cli.expiresAt }
+                : {}),
+              ...(!source && body.allowedIps !== undefined ? { allowedIps: body.allowedIps } : {}),
               ...(billingActive === undefined ? {} : { billingActive }),
               ...(body.name === undefined ? {} : { name: body.name }),
               orgId,
               projectId: Auth.project(c).id,
               scopes: body.scopes,
             },
-            { scopeCatalog: c.get('scopeCatalog') },
+            {
+              ...(source
+                ? {
+                    policySourceApiKeyId: source.id,
+                    sourceScopes: body.scopes.filter(
+                      (scope) => !Scope.selfServeFrom(c.get('scopeCatalog')).includes(scope),
+                    ),
+                  }
+                : {}),
+              scopeCatalog: c.get('scopeCatalog'),
+            },
           )
           return c.json(
             Response.validated(schema.createApiKey.Response, { ...serializeKey(record), token }),
@@ -432,6 +471,12 @@ export function apiKeys(options: apiKeys.Options = {}) {
         } catch (cause) {
           if (cause instanceof ApiKeys.OwnerDeletedError) return Auth.ensureProjectError(c)
           if (cause instanceof ApiKeys.LiveKeyLimitError) return keyLimitReached(c)
+          if (cause instanceof RoutesPolicies.InvalidScopeError)
+            return Response.error(c, {
+              code: 'scope_not_issuable',
+              message: 'The approved source key is no longer available.',
+              status: 403,
+            })
           return Response.upstream(c, cause)
         }
       },
@@ -637,6 +682,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
             })
           return await rotate(c, kv.store, source, createdBy)
         } catch (cause) {
+          if (cause instanceof RoutesPolicies.InvalidScopeError) return keyNotFound(c)
           if (cause instanceof ApiKeys.OwnerDeletedError) return Auth.ensureOrgError(c)
           if (cause instanceof ApiKeys.LiveKeyLimitError) return keyLimitReached(c)
           return Response.upstream(c, cause)
@@ -848,6 +894,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
             })
           return await rotate(c, kv.store, source, createdBy)
         } catch (cause) {
+          if (cause instanceof RoutesPolicies.InvalidScopeError) return keyNotFound(c)
           if (cause instanceof ApiKeys.OwnerDeletedError) return Auth.ensureProjectError(c)
           if (cause instanceof ApiKeys.LiveKeyLimitError) return keyLimitReached(c)
           return Response.upstream(c, cause)
@@ -967,14 +1014,27 @@ function mintedBy(c: Context<App.Environment>) {
 }
 
 /** Checks whether the caller may grant every requested scope. */
-function canIssue(c: Context<App.Environment>, scopes: readonly Scope.Id[]) {
+function canIssue(
+  c: Context<App.Environment>,
+  scopes: readonly Scope.Id[],
+  source?: ApiKeys.Record,
+) {
   const principal = Auth.getPrincipal(c)
   if (principal?.type === 'super_admin') return true
   if (principal?.type === 'session') {
     const selfServe = Scope.selfServeFrom(c.get('scopeCatalog'))
     return (
-      scopes.every((scope) => selfServe.includes(scope)) &&
-      (!scopes.includes('management:write') || Auth.membership(c)?.role === 'owner')
+      scopes.every(
+        (scope) =>
+          selfServe.includes(scope) ||
+          (principal.cli &&
+            source &&
+            scope === 'routes:write' &&
+            (source.scopes.includes(scope) || source.scopes.includes(Scope.wildcard))),
+      ) &&
+      (!principal.cli || scopes.every((scope) => principal.cli!.scopes.includes(scope))) &&
+      ((!scopes.includes('management:write') && !scopes.includes('routes:write')) ||
+        Auth.membership(c)?.role === 'owner')
     )
   }
   return false
@@ -986,8 +1046,11 @@ function canRotate(c: Context<App.Environment>, scopes: readonly Scope.Id[]) {
   if (principal?.type === 'super_admin') return true
   if (principal?.type !== 'session') return false
   return (
-    (!scopes.includes('management:write') && !scopes.includes(Scope.wildcard)) ||
-    Auth.membership(c)?.role === 'owner'
+    (!principal.cli || scopes.every((scope) => principal.cli!.scopes.includes(scope))) &&
+    ((!scopes.includes('management:write') &&
+      !scopes.includes('routes:write') &&
+      !scopes.includes(Scope.wildcard)) ||
+      Auth.membership(c)?.role === 'owner')
   )
 }
 
@@ -998,6 +1061,8 @@ async function rotate(
   source: ApiKeys.Record,
   createdBy: string,
 ) {
+  const principal = Auth.getPrincipal(c)
+  const expiresAt = principal?.type === 'session' ? principal.cli?.expiresAt : undefined
   const billingActive =
     source.environment === 'sandbox'
       ? await Billing.active(Db.get(c.get('db')), source.orgId, 'sandbox')
@@ -1013,11 +1078,20 @@ async function rotate(
       ...(source.projectId === undefined ? {} : { projectId: source.projectId }),
       scopes: [...new Set(source.scopes)],
       ...(billingActive === undefined ? {} : { billingActive }),
-      ...(source.expiresAt === undefined ? {} : { expiresAt: source.expiresAt }),
+      ...(expiresAt || source.expiresAt
+        ? {
+            expiresAt: [expiresAt, source.expiresAt]
+              .filter(Boolean)
+              .sort((a, b) => Date.parse(a!) - Date.parse(b!))[0]!,
+          }
+        : {}),
       ...(source.name === undefined ? {} : { name: source.name }),
       ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
     },
-    { scopeCatalog: c.get('scopeCatalog') },
+    {
+      policySourceApiKeyId: source.id,
+      scopeCatalog: c.get('scopeCatalog'),
+    },
   )
   return c.json(
     Response.validated(schema.rotateApiKey.Response, { ...serializeKey(record), token }),

package/src/apps/management/routes/billing.test.ts

@@ -1636,16 +1636,18 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (metering)', () => {
     const finalize = async (input: { feeAmount: string; orgId: string; seed: string }) => {
       const row = await SponsoredTransactions.upsert(db, { ...meterable(input.orgId), signPayload: `0x${input.seed.repeat(32)}` }) // prettier-ignore
       await SponsoredTransactions.finalize(db, row.id, { feeAmount: input.feeAmount, finalizedAt: new Date().toISOString() }) // prettier-ignore
+      return row
     }
     await finalize({ feeAmount: '100000', orgId: 'org_1', seed: '41' })
     await finalize({ feeAmount: '250000', orgId: 'org_1', seed: '42' })
-    // A deleted org's row marks without a meter event; a pending row waits.
-    await finalize({ feeAmount: '900000', orgId: 'org_ghost', seed: '43' })
+    // A missing customer's liability stays unreported for retry; a pending row waits.
+    const ghost = await finalize({ feeAmount: '900000', orgId: 'org_ghost', seed: '43' })
     await SponsoredTransactions.upsert(db, { ...meterable('org_1'), signPayload: `0x${'44'.repeat(32)}` }) // prettier-ignore
 
     const reporter = core_Billing.createReporter({ db, stripe })
-    expect(await reporter.tick()).toStrictEqual({ failed: 0, reported: 2, skipped: 1 })
-    expect(await reporter.tick()).toStrictEqual({ failed: 0, reported: 0, skipped: 0 })
+    expect(await reporter.tick()).toStrictEqual({ failed: 1, reported: 2, skipped: 0 })
+    expect(await reporter.tick()).toStrictEqual({ failed: 1, reported: 0, skipped: 0 })
+    expect((await SponsoredTransactions.get(db, ghost.id))?.meterReportedAt).toBeNull()
   })
 
   test('the metered invoice preview matches reported spend', { timeout: 240_000 }, async () => {
@@ -1689,6 +1691,68 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (metering)', () => {
     expect(line?.amount).toBe(35)
   })
 
+  test.each(['request-first', 'sponsorship-first'] as const)(
+    'request backlog reaches the invoice when the %s reporter provisions meters',
+    { timeout: 240_000 },
+    async (ordering) => {
+      const db = TestApp.database()
+      const stripe = TestStripe.client()
+      const orgId = `org_${nanoid(10)}`
+      const customer = await stripe.customers.create({
+        metadata: { orgId },
+        name: `Test Org ${nanoid(10)}`,
+      })
+      TestStripe.track(customer.id)
+      await StripeCustomers.create(db, { orgId, stripeCustomerId: customer.id })
+      const bucket = new Date(Date.now() - 2 * 60 * 60 * 1_000)
+      bucket.setUTCMinutes(0, 0, 0)
+      const bucketStart = bucket.toISOString()
+      const reportRequests = () =>
+        core_Billing
+          .createRequestUsageReporter({
+            db,
+            readCounts: async () => [{ bucketStart, count: 100, orgId }],
+            stripe,
+          })
+          .tick()
+      const reportSponsorship = async () => {
+        const seed = ordering === 'request-first' ? '61' : '62'
+        const row = await SponsoredTransactions.upsert(db, {
+          ...meterable(orgId),
+          signPayload: `0x${seed.repeat(32)}`,
+        })
+        await SponsoredTransactions.finalize(db, row.id, {
+          feeAmount: '100000',
+          finalizedAt: new Date().toISOString(),
+        })
+        return core_Billing.createReporter({ db, stripe }).tick()
+      }
+
+      if (ordering === 'request-first') {
+        expect(await reportRequests()).toStrictEqual({ failed: 0, reported: 1, skipped: 0 })
+        expect(await reportSponsorship()).toStrictEqual({ failed: 0, reported: 1, skipped: 0 })
+      } else {
+        expect(await reportSponsorship()).toStrictEqual({ failed: 0, reported: 1, skipped: 0 })
+        expect(await reportRequests()).toStrictEqual({ failed: 0, reported: 1, skipped: 0 })
+      }
+
+      const { priceId } = await core_Billing.ensureFixtures(stripe, 'apiRequests')
+      const [subscription] = (
+        await stripe.subscriptions.list({ customer: customer.id, limit: 1, price: priceId })
+      ).data
+      let line: { amount: number; quantity: number | null } | undefined
+      await until(async () => {
+        const preview = await stripe.invoices.createPreview({
+          customer: customer.id,
+          subscription: subscription!.id,
+        })
+        line = preview.lines.data.find((item) => item.pricing?.price_details?.price === priceId)
+        return line?.quantity === 100
+      }, 180_000)
+      expect(line).toMatchObject({ amount: 1, quantity: 100 })
+    },
+  )
+
   test.each(['past_due', 'canceled'] as const)(
     'a failed metered invoice blocks a %s subscription until payment',
     { timeout: 600_000 },

package/src/apps/management/routes/cli.test.ts

@@ -0,0 +1,370 @@
+import { testClient } from 'hono/testing'
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as CliAuth from '../../../internal/CliAuth.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+// RFC 7636 appendix B test vector.
+const codeVerifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'
+const codeChallenge = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'
+
+function createApp(options: { consoleUrl?: string | undefined } = {}) {
+  const app = TestApp.create({ ...options, session: { wallet: { origin } } })
+  return { app, client: testClient(app) }
+}
+
+function as(cookie: string) {
+  return { headers: { cookie } } as const
+}
+
+function bearer(token: string) {
+  return { headers: { authorization: `Bearer ${token}` } } as const
+}
+
+/** Signs in a fresh scripted account through SIWE, returning its console cookie and user id. */
+async function session({ app, client }: ReturnType<typeof createApp>) {
+  const { cookie } = await TestApp.signIn(app, privateKeyToAccount(generatePrivateKey()))
+  if (!cookie) throw new Error('Sign-in did not establish a session')
+  const me = await client.v1.me.$get(undefined, as(cookie))
+  if (me.status !== 200) throw new Error(`Failed to resolve session user: ${me.status}`)
+  return { cookie, userId: (await me.json()).id }
+}
+
+async function start({ client }: ReturnType<typeof createApp>) {
+  const response = await client.v1.cli.authorizations.$post({
+    json: { codeChallenge, device: 'build-box', name: 'tempo api 0.1.0' },
+  })
+  if (response.status !== 200) throw new Error(`Failed to start sign-in: ${response.status}`)
+  return response.json()
+}
+
+async function exchange({ client }: ReturnType<typeof createApp>, code: string) {
+  return client.v1.cli.authorizations[':code{[A-Za-z -]+}'].token.$post({
+    json: { codeVerifier },
+    param: { code },
+  })
+}
+
+/** Runs the whole sign-in flow and returns the CLI token plus the approving user. */
+async function signInCli(context: ReturnType<typeof createApp>) {
+  const user = await session(context)
+  const { code } = await start(context)
+  const approve = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+    { json: {}, param: { code } },
+    as(user.cookie),
+  )
+  expect(approve.status).toBe(200)
+  const response = await exchange(context, code)
+  const body = await response.json()
+  if (!('status' in body) || body.status !== 'approved') throw new Error('Sign-in was not approved')
+  return { token: body.token, user }
+}
+
+describe('POST /v1/cli/authorizations', () => {
+  test('starts a sign-in with a console verification URL', async () => {
+    const response = await createApp().client.v1.cli.authorizations.$post({
+      json: { codeChallenge },
+    })
+    if (response.status !== 200) throw new Error(`Failed to start sign-in: ${response.status}`)
+    const { code, expiresAt, ...body } = await response.json()
+    expect(code).toMatch(/^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$/)
+    expect(Date.parse(expiresAt)).toBeGreaterThan(Date.now())
+    expect(body).toEqual({
+      interval: CliAuth.pollInterval,
+      verificationUrl: `https://console.tempo.xyz/cli?code=${code}`,
+    })
+  })
+
+  test('links to the configured console', async () => {
+    const response = await createApp({
+      consoleUrl: 'https://console.example.test/',
+    }).client.v1.cli.authorizations.$post({ json: { codeChallenge } })
+    if (response.status !== 200) throw new Error(`Failed to start sign-in: ${response.status}`)
+    const { code, verificationUrl } = await response.json()
+    expect(verificationUrl).toBe(`https://console.example.test/cli?code=${code}`)
+  })
+
+  test('rejects a malformed code challenge', async () => {
+    const response = await createApp().client.v1.cli.authorizations.$post({
+      json: { codeChallenge: 'too-short' },
+    })
+    expect(response.status).toBe(400)
+  })
+
+  test('stays out of the OpenAPI document', async () => {
+    const spec = await (await createApp().app.request('/openapi.json')).json()
+    expect(Object.keys(spec.paths).filter((path) => path.startsWith('/v1/cli'))).toEqual([])
+  })
+})
+
+describe('GET /v1/cli/authorizations/:code', () => {
+  test('shows the pending request to a console session', async () => {
+    const context = createApp()
+    const { cookie } = await session(context)
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].$get(
+      // Codes are case- and separator-insensitive, as users may retype them.
+      { param: { code: code.toLowerCase().replace('-', '') } },
+      as(cookie),
+    )
+    if (response.status !== 200) throw new Error(`Failed to read sign-in: ${response.status}`)
+    const { createdAt, expiresAt, ...body } = await response.json()
+    expect(Date.parse(expiresAt) - Date.parse(createdAt)).toBe(CliAuth.authorizationTtl)
+    expect(body).toEqual({
+      client: { device: 'build-box', name: 'tempo api 0.1.0' },
+      code,
+      scopes: CliAuth.defaultScopes,
+      status: 'pending',
+    })
+  })
+
+  test('requires a session', async () => {
+    const context = createApp()
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].$get({
+      param: { code },
+    })
+    expect(response.status).toBe(401)
+  })
+
+  test('reports unknown and malformed codes as not found', async () => {
+    const context = createApp()
+    const { cookie } = await session(context)
+    for (const code of ['BCDF-GHJK', 'ABCD-EFGH']) {
+      const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].$get(
+        { param: { code } },
+        as(cookie),
+      )
+      expect(response.status).toBe(404)
+      expect(await response.json()).toMatchObject({
+        error: { code: 'cli_authorization_not_found' },
+      })
+    }
+  })
+})
+
+describe('POST /v1/cli/authorizations/:code/token', () => {
+  test('reports pending until a console session approves', async () => {
+    const context = createApp()
+    const { code } = await start(context)
+    const response = await exchange(context, code)
+    expect(response.status).toBe(200)
+    expect(response.headers.get('cache-control')).toBe('no-store')
+    expect(await response.json()).toEqual({ status: 'pending' })
+  })
+
+  test('issues a single-use CLI session token that acts as the approving user', async () => {
+    const context = createApp()
+    const { token, user } = await signInCli(context)
+    expect(CliAuth.isToken(token)).toBe(true)
+
+    const me = await context.client.v1.me.$get(undefined, bearer(token))
+    expect(me.status).toBe(200)
+    if (me.status !== 200) throw new Error('unreachable')
+    expect((await me.json()).id).toBe(user.userId)
+  })
+
+  test('reports denial once, then forgets the code', async () => {
+    const context = createApp()
+    const { cookie } = await session(context)
+    const { code } = await start(context)
+    const deny = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].deny.$post(
+      { param: { code } },
+      as(cookie),
+    )
+    expect(deny.status).toBe(200)
+    expect(await deny.json()).toEqual({ code, status: 'denied' })
+    expect(await (await exchange(context, code)).json()).toEqual({ status: 'denied' })
+    expect((await exchange(context, code)).status).toBe(404)
+  })
+
+  test('hides the code from callers without the verifier', async () => {
+    const context = createApp()
+    const { cookie } = await session(context)
+    const { code } = await start(context)
+    await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+      { json: {}, param: { code } },
+      as(cookie),
+    )
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].token.$post({
+      json: { codeVerifier: 'x'.repeat(43) },
+      param: { code },
+    })
+    expect(response.status).toBe(404)
+    // The verifier holder can still redeem.
+    expect((await (await exchange(context, code)).json()) as unknown).toMatchObject({
+      status: 'approved',
+    })
+  })
+})
+
+describe('POST /v1/cli/authorizations/:code/approve', () => {
+  test.each([
+    { body: undefined, contentType: undefined },
+    { body: undefined, contentType: 'application/json' },
+    { body: '', contentType: 'application/json' },
+    { body: '{}', contentType: 'application/json' },
+  ])(
+    'uses default scopes for a legacy approval $body $contentType',
+    async ({ body, contentType }) => {
+      const context = createApp()
+      const user = await session(context)
+      const { code } = await start(context)
+      const response = await context.app.request(`/v1/cli/authorizations/${code}/approve`, {
+        ...(body === undefined ? {} : { body }),
+        headers: {
+          ...(contentType === undefined ? {} : { 'content-type': contentType }),
+          cookie: user.cookie,
+        },
+        method: 'POST',
+      })
+      expect(response.status).toBe(200)
+      expect(await (await exchange(context, code)).json()).toMatchObject({
+        scopes: CliAuth.defaultScopes,
+        status: 'approved',
+      })
+    },
+  )
+
+  test.each(['{', 'null', '{"scopes":null}'])(
+    'still rejects invalid nonempty JSON %j',
+    async (body) => {
+      const context = createApp()
+      const user = await session(context)
+      const { code } = await start(context)
+      const response = await context.app.request(`/v1/cli/authorizations/${code}/approve`, {
+        body,
+        headers: { 'content-type': 'application/json', cookie: user.cookie },
+        method: 'POST',
+      })
+      expect(response.status).toBe(400)
+      expect(await (await exchange(context, code)).json()).toEqual({ status: 'pending' })
+    },
+  )
+
+  test('persists selected API scopes through token exchange', async () => {
+    const context = createApp()
+    const user = await session(context)
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+      { json: { scopes: ['routes:read'] }, param: { code } },
+      as(user.cookie),
+    )
+    expect(response.status).toBe(200)
+    const token = await exchange(context, code)
+    expect(await token.json()).toMatchObject({ scopes: ['routes:read'], status: 'approved' })
+  })
+
+  test.each([
+    { scopes: ['*'] },
+    { scopes: ['unknown:write'] },
+    { scopes: ['routes:read', 'routes:read'] },
+  ])('rejects unsupported or duplicated scopes $scopes', async ({ scopes }) => {
+    const context = createApp()
+    const user = await session(context)
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+      { json: { scopes }, param: { code } },
+      as(user.cookie),
+    )
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+  })
+
+  test('conflicts once another user decided the request', async () => {
+    const context = createApp()
+    const first = await session(context)
+    const second = await session(context)
+    const { code } = await start(context)
+    const approve = context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve
+    expect((await approve.$post({ json: {}, param: { code } }, as(first.cookie))).status).toBe(200)
+    // Repeating the approval is a no-op for the same user.
+    expect((await approve.$post({ json: {}, param: { code } }, as(first.cookie))).status).toBe(200)
+    const conflict = await approve.$post({ json: {}, param: { code } }, as(second.cookie))
+    expect(conflict.status).toBe(409)
+    expect(await conflict.json()).toMatchObject({ error: { code: 'cli_authorization_decided' } })
+  })
+
+  test('refuses CLI sessions so a CLI token cannot mint more CLI sessions', async () => {
+    const context = createApp()
+    const { token } = await signInCli(context)
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+      { json: {}, param: { code } },
+      bearer(token),
+    )
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({
+      error: { code: 'forbidden', message: 'Approve CLI sign-ins from the console' },
+    })
+  })
+})
+
+describe('CLI session tokens', () => {
+  test('manage organizations, projects, and API keys', async () => {
+    const context = createApp()
+    const { token } = await signInCli(context)
+    const org = await context.client.v1.orgs.$post({ json: { name: 'Acme' } }, bearer(token))
+    expect(org.status).toBe(200)
+    if (org.status !== 200) throw new Error('unreachable')
+    const { id: orgId } = await org.json()
+
+    const project = await context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects.$post(
+      { json: { name: 'Checkout' }, param: { orgId } },
+      bearer(token),
+    )
+    expect(project.status).toBe(200)
+    if (project.status !== 200) throw new Error('unreachable')
+    const { id: projectId } = await project.json()
+
+    const key = await context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
+      ':projectId{prj_[A-Za-z0-9_-]+}'
+    ]['api-keys'].$post(
+      { json: { name: 'CLI', scopes: ['data:read'] }, param: { orgId, projectId } },
+      bearer(token),
+    )
+    expect(key.status).toBe(200)
+    if (key.status !== 200) throw new Error('unreachable')
+    const { createdAt, id, token: apiKey, tokenLast4, ...record } = await key.json()
+    expect(apiKey).toMatch(/^tempo:sk:[a-f0-9]{48}$/)
+    expect(id).toMatch(/^key_/)
+    expect(tokenLast4).toBe(apiKey.slice(-4))
+    expect(Date.parse(createdAt)).not.toBeNaN()
+    expect(record).toMatchObject({ environment: 'production', name: 'CLI', scopes: ['data:read'] })
+  })
+
+  test('are refused on routes without a session lane', async () => {
+    const context = createApp()
+    const { token } = await signInCli(context)
+    const response = await context.app.request('/v1/tokenlist', bearer(token))
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({
+      error: { code: 'forbidden', message: 'CLI sessions cannot call this route. Use an API key.' },
+    })
+  })
+
+  test('report unknown tokens as an invalid session', async () => {
+    const response = await createApp().client.v1.me.$get(undefined, bearer(CliAuth.generateToken()))
+    expect(response.status).toBe(401)
+    expect(await response.json()).toMatchObject({
+      error: {
+        code: 'session_invalid',
+        message: 'CLI session is invalid or expired. Sign in again.',
+      },
+    })
+  })
+
+  test('are revoked by logout', async () => {
+    const context = createApp()
+    const { token } = await signInCli(context)
+    const logout = await context.app.request('/v1/auth/logout', {
+      ...bearer(token),
+      method: 'POST',
+    })
+    expect(logout.status).toBe(204)
+    expect((await context.client.v1.me.$get(undefined, bearer(token))).status).toBe(401)
+  })
+})