tapimo 0.15.0 → 0.18.0

package/src/internal/Auth.test.ts

@@ -1,6 +1,6 @@
 import { serve } from '@hono/node-server'
 import * as Accounts from 'accounts/server'
-import { Hono, type Context } from 'hono'
+import { Hono, Context } from 'hono'
 import { requestId } from 'hono/request-id'
 import { exportJWK, generateKeyPair } from 'jose'
 import { Challenge, Receipt, Store as MppStore } from 'mppx'
@@ -13,8 +13,10 @@ import { Actions, Transaction } from 'viem/tempo'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 import * as App from '../App.js'
 import * as ApiKey from '../ApiKey.js'
+import * as ApiKeys from '../ApiKeys.js'
 import * as Management from '../apps/management/App.js'
 import type * as Db from '../db/Db.js'
+import * as AuthAccounts from '../db/tables/authAccounts.js'
 import * as Memberships from '../db/tables/memberships.js'
 import * as Organizations from '../db/tables/organizations.js'
 import * as Projects from '../db/tables/projects.js'
@@ -22,6 +24,7 @@ import * as Users from '../db/tables/users.js'
 import * as Auth from './Auth.js'
 import * as Log from './Log.js'
 import * as Scope from '../Scope.js'
+import * as Timeout from './Timeout.js'
 import * as Viem from './Viem.js'
 import * as TestApp from '../../test/App.js'
 import { createClient as createMppClient } from '../../test/Mppx.js'
@@ -39,6 +42,87 @@ const key = {
 
 const token = 'secret_test_key'
 
+describe('cachedResolve', () => {
+  test.each(['positive', 'negative'] as const)(
+    'resolves an independent miss after a caller times out and caches the %s result',
+    async (result) => {
+      const store = Store.memory()
+      const { record, token: apiKey } = await ApiKeys.mint(store, { scopes: ['data:read'] })
+      if (result === 'negative') await ApiKeys.revoke(store, record.id)
+      const slow = new Context(new Request('https://api.example/slow'))
+      const fast = new Context(new Request('https://api.example/fast'))
+      let started = 0
+      let completed = 0
+      vi.useFakeTimers()
+      const cache = Auth.cachedResolve(async (c, apiKey) => {
+        started++
+        // Only the timer controls latency; storage and key resolution use their real implementations.
+        await new Promise((resolve) => setTimeout(resolve, c === slow ? 90_000 : 0))
+        const value = await ApiKeys.resolve(store, apiKey)
+        completed++
+        return value
+      }, {})
+
+      const pending = cache.resolve(slow, apiKey)
+      try {
+        await Promise.all([
+          expect(
+            Timeout.run(() => pending, { timeout: 60_000 }),
+          ).rejects.toThrowErrorMatchingInlineSnapshot(`[TimeoutError: Timed out after 60000ms.]`),
+          vi.advanceTimersByTimeAsync(60_000),
+        ])
+        expect(completed).toMatchInlineSnapshot(`0`)
+
+        const expected = result === 'positive' ? record.id : null
+        await Promise.all([
+          expect(
+            Timeout.run(() => cache.resolve(fast, apiKey), { timeout: 1_000 }).then(
+              (value) => value?.id ?? null,
+            ),
+          ).resolves.toBe(expected),
+          vi.advanceTimersByTimeAsync(1_000),
+        ])
+        expect(started).toMatchInlineSnapshot(`2`)
+        expect(completed).toMatchInlineSnapshot(`1`)
+
+        const third = await cache.resolve(fast, apiKey)
+        expect(third?.id ?? null).toBe(expected)
+        expect(started).toMatchInlineSnapshot(`2`)
+      } finally {
+        // Settle the original operation so the test leaves no pending work behind.
+        await vi.advanceTimersByTimeAsync(90_000)
+        await pending
+        vi.useRealTimers()
+      }
+    },
+  )
+
+  test('expires completed positive and negative results with their respective TTLs', async () => {
+    const store = Store.memory()
+    const { record, token: apiKey } = await ApiKeys.mint(store, { scopes: ['data:read'] })
+    const persisted = (await store.get(ApiKey.keyFor(apiKey)))!
+    vi.useFakeTimers()
+    const cache = Auth.cachedResolve((_c, apiKey) => ApiKeys.resolve(store, apiKey), {})
+    const context = new Context(new Request('https://api.example'))
+
+    try {
+      expect((await cache.resolve(context, apiKey))?.id).toBe(record.id)
+      // Revocation fences the id permanently, so drop only the record to restore it later.
+      await store.delete(ApiKey.keyFor(apiKey))
+      expect((await cache.resolve(context, apiKey))?.id).toBe(record.id)
+      await vi.advanceTimersByTimeAsync(60_000)
+      expect(await cache.resolve(context, apiKey)).toMatchInlineSnapshot(`null`)
+
+      await store.put(ApiKey.keyFor(apiKey), persisted)
+      expect(await cache.resolve(context, apiKey)).toMatchInlineSnapshot(`null`)
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect((await cache.resolve(context, apiKey))?.id).toBe(record.id)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
+
 describe('require', () => {
   describe('apiKey', () => {
     test('accepts API key from tempo-api-key', async () => {
@@ -75,6 +159,36 @@ describe('require', () => {
       `)
     })
 
+    test('isolates an explicit endpoint bucket from the shared scope quota', async () => {
+      const app = createScopedApp({
+        routes: [
+          {
+            path: '/other',
+            policy: {
+              apiKey: { rateLimit: { limit: 1, period: 'minute' }, scopes: ['data:read'] },
+            },
+          },
+          {
+            path: '/protected',
+            policy: {
+              apiKey: {
+                bucket: 'protected',
+                rateLimit: { limit: 1, period: 'minute' },
+                scopes: ['data:read'],
+              },
+            },
+          },
+        ],
+      })
+      const options = { headers: { 'tempo-api-key': token } }
+
+      const other = await app.request('/other', options)
+      const protected_ = await app.request('/protected', options)
+      const overflow = await app.request('/protected', options)
+
+      expect([other.status, protected_.status, overflow.status]).toEqual([200, 200, 429])
+    })
+
     test('does not parse payment authorization as bearer fallback', async () => {
       const app = createApp()
       const response = await app.request('/protected', {
@@ -258,7 +372,7 @@ describe('require', () => {
 
     test('rejects missing scope', async () => {
       const app = createApp({
-        policy: { apiKey: { scopes: ['webhooks:write'] } },
+        policy: { apiKey: { scopes: ['routes:write'] } },
       })
       const response = await app.request('/protected', {
         headers: { 'tempo-api-key': token },
@@ -270,7 +384,26 @@ describe('require', () => {
         {
           "error": {
             "code": "api_key_forbidden",
-            "message": "API key missing required scope",
+            "message": "API key is missing required permissions: routes:write. Use an API key with these scopes.",
+          },
+        }
+      `)
+    })
+
+    test('lists only missing scopes when multiple permissions are required', async () => {
+      const app = createApp({
+        policy: { apiKey: { scopes: ['data:read', 'routes:write', 'webhooks:write'] } },
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`403`)
+      expect(await response.json()).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": "api_key_forbidden",
+            "message": "API key is missing required permissions: routes:write, webhooks:write. Use an API key with these scopes.",
           },
         }
       `)
@@ -938,6 +1071,8 @@ describe('require', () => {
       expect(consume).toHaveBeenCalledWith({
         key: 'mpp:public:2001:db8:abcd:12',
         limit: { limit: 100, period: 'minute' },
+        principal: 'mpp:public:2001:db8:abcd:12',
+        waitUntil: undefined,
       })
     })
 
@@ -965,6 +1100,8 @@ describe('require', () => {
       expect(consume).toHaveBeenCalledWith({
         key: 'mpp:public:anonymous',
         limit: { limit: 100, period: 'minute' },
+        principal: 'mpp:public:anonymous',
+        waitUntil: undefined,
       })
     })
 
@@ -991,6 +1128,8 @@ describe('require', () => {
       expect(consume).toHaveBeenCalledWith({
         key: 'mpp:public:2001:db8:abcd:12',
         limit: { limit: 100, period: 'minute' },
+        principal: 'mpp:public:2001:db8:abcd:12',
+        waitUntil: undefined,
       })
     })
 
@@ -1021,6 +1160,8 @@ describe('require', () => {
       expect(consume).toHaveBeenCalledWith({
         key: 'mpp:api_key:key_test',
         limit: { limit: 100, period: 'minute' },
+        principal: 'mpp:api_key:key_test',
+        waitUntil: undefined,
       })
     })
 
@@ -1041,6 +1182,42 @@ describe('require', () => {
       expect(response.headers.get('RateLimit-Limit')).toBe('25')
     })
 
+    test('isolates an explicit endpoint bucket from unrelated paid requests', async () => {
+      const auth = {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        mpp: createMppHandler(),
+        rateLimit: RateLimit.memory(),
+      } satisfies Auth.Context
+      const app = createScopedApp({
+        auth,
+        routes: [
+          {
+            path: '/other',
+            policy: {
+              mpp: { rateLimit: { limit: 1, period: 'minute' }, session: { amount: '1' } },
+            },
+          },
+          {
+            path: '/protected',
+            policy: {
+              mpp: {
+                bucket: 'protected',
+                rateLimit: { limit: 1, period: 'minute' },
+                session: { amount: '1' },
+              },
+            },
+          },
+        ],
+      })
+      const options = { headers: { authorization: 'Payment paid' } }
+
+      const other = await app.request('/other', options)
+      const protected_ = await app.request('/protected', options)
+      const overflow = await app.request('/protected', options)
+
+      expect([other.status, protected_.status, overflow.status]).toEqual([200, 200, 429])
+    })
+
     test('route paid-request limit overrides the global limit', async () => {
       const app = createApp({
         auth: {
@@ -1648,6 +1825,32 @@ describe('require', () => {
       `)
     })
 
+    test('isolates an explicit endpoint bucket from unrelated public requests', async () => {
+      const app = createScopedApp({
+        routes: [
+          {
+            path: '/other',
+            policy: { public: { rateLimit: { limit: 1, period: 'minute' } } },
+          },
+          {
+            path: '/protected',
+            policy: {
+              public: {
+                bucket: 'protected',
+                rateLimit: { limit: 1, period: 'minute' },
+              },
+            },
+          },
+        ],
+      })
+
+      const other = await app.request('/other')
+      const protected_ = await app.request('/protected')
+      const overflow = await app.request('/protected')
+
+      expect([other.status, protected_.status, overflow.status]).toEqual([200, 200, 429])
+    })
+
     test('returns rate-limit error without payment context', async () => {
       const app = createApp({
         auth: {
@@ -2781,6 +2984,8 @@ describe('email OTP', () => {
         json({ email: 'Developer@Example.com', type: 'sign-in' }),
       )
       expect(sent.status).toBe(200)
+      expect(sent.headers.get('tempo-terms-url')).toBe('https://console.tempo.xyz/legal/terms')
+      expect(sent.headers.get('tempo-privacy-url')).toBe('https://tempo.xyz/privacy-policy/')
       expect(await sent.json()).toEqual({ success: true })
       expect(messages).toHaveLength(1)
       const otp = messages[0]!.text.match(/\b\d{6}\b/)?.[0]
@@ -2806,6 +3011,7 @@ describe('email OTP', () => {
 
       const existing = await Users.getByEmail(db, 'developer@example.com')
       expect(existing).toBeDefined()
+      expect(existing?.termsSharedAt).toEqual(expect.any(String))
 
       const setCookie = verified.headers.get('set-cookie')
       expect(setCookie).toContain('tempo_auth.session_token=')
@@ -2920,18 +3126,36 @@ describe('email OTP', () => {
   })
 
   test('handles SIWE routes under an application path', async () => {
+    const db = TestApp.database()
     const app = TestApp.create({
+      db,
       path: '/api',
       session: { secret, wallet: { origin } },
     })
     const account = privateKeyToAccount(generatePrivateKey())
 
-    const { verifyResponse } = await TestApp.signIn(
-      { request: (path, init) => app.request(`/api${path}`, init) },
-      account,
-    )
+    try {
+      const user = await Users.upsertByAddress(db, { address: account.address })
+      await db.kysely
+        .updateTable('users')
+        .set({ termsSharedAt: null })
+        .where('id', '=', user.id)
+        .execute()
+      const { verifyResponse } = await TestApp.signIn(
+        { request: (path, init) => app.request(`/api${path}`, init) },
+        account,
+      )
 
-    expect(verifyResponse.status).toBe(200)
+      expect(verifyResponse.status).toBe(200)
+      expect(verifyResponse.headers.get('tempo-terms-url')).toBe(
+        'https://console.tempo.xyz/legal/terms',
+      )
+      expect(await Users.get(db, user.id)).toMatchObject({
+        termsSharedAt: expect.any(String),
+      })
+    } finally {
+      await db.close()
+    }
   })
 
   test('returns the canonical error envelope when the SIWE store fails', async () => {
@@ -3552,6 +3776,98 @@ describe('one-time session tokens', () => {
   })
 })
 
+describe.each(['identity', 'siwe'] as const)('%s session binding', (mode) => {
+  test('rejects email reassignment without rebinding to the new owner', async () => {
+    const { account, app, close, cookie, db, user } = await walletSession(mode)
+    try {
+      await Users.setEmail(db, user.id, 'changed@example.com')
+      const replacement = await Users.upsertByAddress(db, { address: Tempo.accounts[9].address })
+      await Users.setEmail(db, replacement.id, 'developer@example.com')
+      const org = await Organizations.create(db, { name: 'Replacement organization' })
+      await Memberships.create(db, { orgId: org.id, role: 'owner', userId: replacement.id })
+
+      for (const path of ['/v1/me', '/v1/orgs', `/v1/orgs/${org.id}`])
+        expect((await app.request(path, { headers: { cookie } })).status).toBe(401)
+      expect(await AuthAccounts.getWalletUserId(db, account.address)).toBe(user.id)
+      expect((await Users.get(db, user.id))?.email).toBe('changed@example.com')
+      expect((await Users.get(db, replacement.id))?.email).toBe('developer@example.com')
+    } finally {
+      await close()
+    }
+  })
+
+  test('rejects a session after its wallet is linked to another user', async () => {
+    const { account, app, close, cookie, db, user } = await walletSession(mode)
+    try {
+      const replacement = await Users.upsertByAddress(db, { address: Tempo.accounts[9].address })
+      await AuthAccounts.setWalletUser(db, { address: account.address, userId: replacement.id })
+
+      expect((await app.request('/v1/me', { headers: { cookie } })).status).toBe(401)
+      expect(await AuthAccounts.getWalletUserId(db, account.address)).toBe(replacement.id)
+      expect((await Users.get(db, user.id))?.email).toBe('developer@example.com')
+    } finally {
+      await close()
+    }
+  })
+
+  test('rejects legacy sessions without an immutable user binding', async () => {
+    const { app, close, cookie, store } = await walletSession(mode)
+    try {
+      const token = cookie.slice(cookie.indexOf('=') + 1)
+      const key = `${mode === 'identity' ? 'identity' : 'auth'}:session:${token}`
+      const payload = JSON.parse((await store.get(key))!)
+      delete payload.userId
+      await store.put(key, JSON.stringify(payload))
+
+      expect((await app.request('/v1/me', { headers: { cookie } })).status).toBe(401)
+    } finally {
+      await close()
+    }
+  })
+
+  test.each([false, true])(
+    'blocks old owner invitations after removal with changed email %s',
+    async (changedEmail) => {
+      const { app, close, cookie, db, user } = await walletSession(mode)
+      try {
+        const owner = await TestApp.signIn(app, Tempo.accounts[8])
+        expect(owner.verifyResponse.status).toBe(200)
+        const created = await app.request('/v1/orgs', {
+          ...json({ name: 'Protected organization' }),
+          headers: { 'content-type': 'application/json', cookie: owner.cookie! },
+        })
+        expect(created.status).toBe(200)
+        const org = (await created.json()) as { id: string }
+        await Memberships.create(db, { orgId: org.id, role: 'member', userId: user.id })
+        const invited = await app.request(`/v1/orgs/${org.id}/invitations`, {
+          ...json({ email: 'developer@example.com', role: 'owner' }),
+          headers: { 'content-type': 'application/json', cookie: owner.cookie! },
+        })
+        expect(invited.status).toBe(200)
+        const invitation = (await invited.json()) as { id: string }
+        if (changedEmail) await Users.setEmail(db, user.id, 'changed@example.com')
+        const removed = await app.request(`/v1/orgs/${org.id}/members/${user.id}`, {
+          headers: { cookie: owner.cookie! },
+          method: 'DELETE',
+        })
+        expect(removed.status).toBe(200)
+
+        const accepted = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+          headers: { cookie },
+          method: 'POST',
+        })
+        expect(accepted.status).toBe(changedEmail ? 401 : 404)
+        expect(await Memberships.get(db, org.id, user.id)).toBeUndefined()
+        expect((await app.request(`/v1/orgs/${org.id}`, { headers: { cookie } })).status).toBe(
+          changedEmail ? 401 : 404,
+        )
+      } finally {
+        await close()
+      }
+    },
+  )
+})
+
 describe('identity sign-in', () => {
   test('rejects cross-site form bodies', async () => {
     const app = TestApp.create({
@@ -3762,11 +4078,20 @@ describe('identity sign-in', () => {
         email: 'developer@example.com',
         messages,
       })
+      const emailUser = await Users.getByEmail(db, 'developer@example.com')
+      await db.kysely
+        .updateTable('users')
+        .set({ termsSharedAt: null })
+        .where('id', '=', emailUser!.id)
+        .execute()
       const identity = await app.request(
         `${origin}/v1/auth/identity`,
         json({ idToken: await issuer.mint({ address: account.address, audience: origin }) }),
       )
       const identityCookie = identity.headers.get('set-cookie')?.split(';', 1)[0]
+      expect(await Users.get(db, emailUser!.id)).toMatchObject({
+        termsSharedAt: expect.any(String),
+      })
       const me = await app.request(`${origin}/v1/me`, {
         headers: { cookie: `${emailCookie}; ${identityCookie}` },
       })
@@ -3846,6 +4171,53 @@ function expectSessionsCleared(response: globalThis.Response) {
   )
 }
 
+async function walletSession(mode: 'identity' | 'siwe') {
+  const account = Tempo.accounts[7]
+  const db = TestApp.database()
+  const issuer = await createIdentityIssuer({ email: 'developer@example.com' })
+  const store = Store.memory()
+  const app = TestApp.create({
+    db,
+    kv: { store },
+    session: {
+      identity: { audience: origin, issuer: issuer.url },
+      secret,
+      wallet: { issuer: issuer.url, origin },
+    },
+  })
+  const response =
+    mode === 'identity'
+      ? await app.request(
+          `${origin}/v1/auth/identity`,
+          json({ idToken: await issuer.mint({ address: account.address, audience: origin }) }),
+        )
+      : (
+          await TestApp.signIn(app, account, {
+            idToken: ({ nonce }) =>
+              issuer.mint({ address: account.address, audience: origin, nonce }),
+          })
+        ).verifyResponse
+  expect(response.status).toBe(200)
+  const cookie = response.headers.get('set-cookie')!.split(';', 1)[0]!
+  const user = await Users.getByAddress(db, account.address)
+  expect(user).toBeDefined()
+  const me = await app.request('/v1/me', { headers: { cookie } })
+  expect(me.status).toBe(200)
+  expect(await me.json()).toMatchObject({ email: 'developer@example.com', id: user!.id })
+  return {
+    account,
+    app,
+    close: async () => {
+      await issuer.close()
+      await db.close()
+    },
+    cookie,
+    db,
+    store,
+    user: user!,
+  }
+}
+
 /** Local Wallet-style OIDC issuer for identity verification tests. */
 async function createIdentityIssuer(options: createIdentityIssuer.Options) {
   const { privateKey, publicKey } = await generateKeyPair('EdDSA', { extractable: true })
@@ -3872,6 +4244,7 @@ async function createIdentityIssuer(options: createIdentityIssuer.Options) {
         new Request(`${url}/token`, {
           body: JSON.stringify({
             audience: parameters.audience,
+            ...(parameters.nonce ? { nonce: parameters.nonce } : {}),
             subject: parameters.address,
           }),
           headers: { 'content-type': 'application/json' },
@@ -3891,6 +4264,8 @@ declare namespace createIdentityIssuer {
     address: string
     /** Origin used as the token audience. */
     audience: string
+    /** SIWE challenge nonce bound into the identity token. */
+    nonce?: string | undefined
   }
 
   type Options = {