tapimo 0.15.1 → 0.18.0

package/src/apps/management/routes/cli.test.ts

@@ -0,0 +1,370 @@
+import { testClient } from 'hono/testing'
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as CliAuth from '../../../internal/CliAuth.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+// RFC 7636 appendix B test vector.
+const codeVerifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'
+const codeChallenge = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'
+
+function createApp(options: { consoleUrl?: string | undefined } = {}) {
+  const app = TestApp.create({ ...options, session: { wallet: { origin } } })
+  return { app, client: testClient(app) }
+}
+
+function as(cookie: string) {
+  return { headers: { cookie } } as const
+}
+
+function bearer(token: string) {
+  return { headers: { authorization: `Bearer ${token}` } } as const
+}
+
+/** Signs in a fresh scripted account through SIWE, returning its console cookie and user id. */
+async function session({ app, client }: ReturnType<typeof createApp>) {
+  const { cookie } = await TestApp.signIn(app, privateKeyToAccount(generatePrivateKey()))
+  if (!cookie) throw new Error('Sign-in did not establish a session')
+  const me = await client.v1.me.$get(undefined, as(cookie))
+  if (me.status !== 200) throw new Error(`Failed to resolve session user: ${me.status}`)
+  return { cookie, userId: (await me.json()).id }
+}
+
+async function start({ client }: ReturnType<typeof createApp>) {
+  const response = await client.v1.cli.authorizations.$post({
+    json: { codeChallenge, device: 'build-box', name: 'tempo api 0.1.0' },
+  })
+  if (response.status !== 200) throw new Error(`Failed to start sign-in: ${response.status}`)
+  return response.json()
+}
+
+async function exchange({ client }: ReturnType<typeof createApp>, code: string) {
+  return client.v1.cli.authorizations[':code{[A-Za-z -]+}'].token.$post({
+    json: { codeVerifier },
+    param: { code },
+  })
+}
+
+/** Runs the whole sign-in flow and returns the CLI token plus the approving user. */
+async function signInCli(context: ReturnType<typeof createApp>) {
+  const user = await session(context)
+  const { code } = await start(context)
+  const approve = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+    { json: {}, param: { code } },
+    as(user.cookie),
+  )
+  expect(approve.status).toBe(200)
+  const response = await exchange(context, code)
+  const body = await response.json()
+  if (!('status' in body) || body.status !== 'approved') throw new Error('Sign-in was not approved')
+  return { token: body.token, user }
+}
+
+describe('POST /v1/cli/authorizations', () => {
+  test('starts a sign-in with a console verification URL', async () => {
+    const response = await createApp().client.v1.cli.authorizations.$post({
+      json: { codeChallenge },
+    })
+    if (response.status !== 200) throw new Error(`Failed to start sign-in: ${response.status}`)
+    const { code, expiresAt, ...body } = await response.json()
+    expect(code).toMatch(/^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$/)
+    expect(Date.parse(expiresAt)).toBeGreaterThan(Date.now())
+    expect(body).toEqual({
+      interval: CliAuth.pollInterval,
+      verificationUrl: `https://console.tempo.xyz/cli?code=${code}`,
+    })
+  })
+
+  test('links to the configured console', async () => {
+    const response = await createApp({
+      consoleUrl: 'https://console.example.test/',
+    }).client.v1.cli.authorizations.$post({ json: { codeChallenge } })
+    if (response.status !== 200) throw new Error(`Failed to start sign-in: ${response.status}`)
+    const { code, verificationUrl } = await response.json()
+    expect(verificationUrl).toBe(`https://console.example.test/cli?code=${code}`)
+  })
+
+  test('rejects a malformed code challenge', async () => {
+    const response = await createApp().client.v1.cli.authorizations.$post({
+      json: { codeChallenge: 'too-short' },
+    })
+    expect(response.status).toBe(400)
+  })
+
+  test('stays out of the OpenAPI document', async () => {
+    const spec = await (await createApp().app.request('/openapi.json')).json()
+    expect(Object.keys(spec.paths).filter((path) => path.startsWith('/v1/cli'))).toEqual([])
+  })
+})
+
+describe('GET /v1/cli/authorizations/:code', () => {
+  test('shows the pending request to a console session', async () => {
+    const context = createApp()
+    const { cookie } = await session(context)
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].$get(
+      // Codes are case- and separator-insensitive, as users may retype them.
+      { param: { code: code.toLowerCase().replace('-', '') } },
+      as(cookie),
+    )
+    if (response.status !== 200) throw new Error(`Failed to read sign-in: ${response.status}`)
+    const { createdAt, expiresAt, ...body } = await response.json()
+    expect(Date.parse(expiresAt) - Date.parse(createdAt)).toBe(CliAuth.authorizationTtl)
+    expect(body).toEqual({
+      client: { device: 'build-box', name: 'tempo api 0.1.0' },
+      code,
+      scopes: CliAuth.defaultScopes,
+      status: 'pending',
+    })
+  })
+
+  test('requires a session', async () => {
+    const context = createApp()
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].$get({
+      param: { code },
+    })
+    expect(response.status).toBe(401)
+  })
+
+  test('reports unknown and malformed codes as not found', async () => {
+    const context = createApp()
+    const { cookie } = await session(context)
+    for (const code of ['BCDF-GHJK', 'ABCD-EFGH']) {
+      const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].$get(
+        { param: { code } },
+        as(cookie),
+      )
+      expect(response.status).toBe(404)
+      expect(await response.json()).toMatchObject({
+        error: { code: 'cli_authorization_not_found' },
+      })
+    }
+  })
+})
+
+describe('POST /v1/cli/authorizations/:code/token', () => {
+  test('reports pending until a console session approves', async () => {
+    const context = createApp()
+    const { code } = await start(context)
+    const response = await exchange(context, code)
+    expect(response.status).toBe(200)
+    expect(response.headers.get('cache-control')).toBe('no-store')
+    expect(await response.json()).toEqual({ status: 'pending' })
+  })
+
+  test('issues a single-use CLI session token that acts as the approving user', async () => {
+    const context = createApp()
+    const { token, user } = await signInCli(context)
+    expect(CliAuth.isToken(token)).toBe(true)
+
+    const me = await context.client.v1.me.$get(undefined, bearer(token))
+    expect(me.status).toBe(200)
+    if (me.status !== 200) throw new Error('unreachable')
+    expect((await me.json()).id).toBe(user.userId)
+  })
+
+  test('reports denial once, then forgets the code', async () => {
+    const context = createApp()
+    const { cookie } = await session(context)
+    const { code } = await start(context)
+    const deny = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].deny.$post(
+      { param: { code } },
+      as(cookie),
+    )
+    expect(deny.status).toBe(200)
+    expect(await deny.json()).toEqual({ code, status: 'denied' })
+    expect(await (await exchange(context, code)).json()).toEqual({ status: 'denied' })
+    expect((await exchange(context, code)).status).toBe(404)
+  })
+
+  test('hides the code from callers without the verifier', async () => {
+    const context = createApp()
+    const { cookie } = await session(context)
+    const { code } = await start(context)
+    await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+      { json: {}, param: { code } },
+      as(cookie),
+    )
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].token.$post({
+      json: { codeVerifier: 'x'.repeat(43) },
+      param: { code },
+    })
+    expect(response.status).toBe(404)
+    // The verifier holder can still redeem.
+    expect((await (await exchange(context, code)).json()) as unknown).toMatchObject({
+      status: 'approved',
+    })
+  })
+})
+
+describe('POST /v1/cli/authorizations/:code/approve', () => {
+  test.each([
+    { body: undefined, contentType: undefined },
+    { body: undefined, contentType: 'application/json' },
+    { body: '', contentType: 'application/json' },
+    { body: '{}', contentType: 'application/json' },
+  ])(
+    'uses default scopes for a legacy approval $body $contentType',
+    async ({ body, contentType }) => {
+      const context = createApp()
+      const user = await session(context)
+      const { code } = await start(context)
+      const response = await context.app.request(`/v1/cli/authorizations/${code}/approve`, {
+        ...(body === undefined ? {} : { body }),
+        headers: {
+          ...(contentType === undefined ? {} : { 'content-type': contentType }),
+          cookie: user.cookie,
+        },
+        method: 'POST',
+      })
+      expect(response.status).toBe(200)
+      expect(await (await exchange(context, code)).json()).toMatchObject({
+        scopes: CliAuth.defaultScopes,
+        status: 'approved',
+      })
+    },
+  )
+
+  test.each(['{', 'null', '{"scopes":null}'])(
+    'still rejects invalid nonempty JSON %j',
+    async (body) => {
+      const context = createApp()
+      const user = await session(context)
+      const { code } = await start(context)
+      const response = await context.app.request(`/v1/cli/authorizations/${code}/approve`, {
+        body,
+        headers: { 'content-type': 'application/json', cookie: user.cookie },
+        method: 'POST',
+      })
+      expect(response.status).toBe(400)
+      expect(await (await exchange(context, code)).json()).toEqual({ status: 'pending' })
+    },
+  )
+
+  test('persists selected API scopes through token exchange', async () => {
+    const context = createApp()
+    const user = await session(context)
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+      { json: { scopes: ['routes:read'] }, param: { code } },
+      as(user.cookie),
+    )
+    expect(response.status).toBe(200)
+    const token = await exchange(context, code)
+    expect(await token.json()).toMatchObject({ scopes: ['routes:read'], status: 'approved' })
+  })
+
+  test.each([
+    { scopes: ['*'] },
+    { scopes: ['unknown:write'] },
+    { scopes: ['routes:read', 'routes:read'] },
+  ])('rejects unsupported or duplicated scopes $scopes', async ({ scopes }) => {
+    const context = createApp()
+    const user = await session(context)
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+      { json: { scopes }, param: { code } },
+      as(user.cookie),
+    )
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+  })
+
+  test('conflicts once another user decided the request', async () => {
+    const context = createApp()
+    const first = await session(context)
+    const second = await session(context)
+    const { code } = await start(context)
+    const approve = context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve
+    expect((await approve.$post({ json: {}, param: { code } }, as(first.cookie))).status).toBe(200)
+    // Repeating the approval is a no-op for the same user.
+    expect((await approve.$post({ json: {}, param: { code } }, as(first.cookie))).status).toBe(200)
+    const conflict = await approve.$post({ json: {}, param: { code } }, as(second.cookie))
+    expect(conflict.status).toBe(409)
+    expect(await conflict.json()).toMatchObject({ error: { code: 'cli_authorization_decided' } })
+  })
+
+  test('refuses CLI sessions so a CLI token cannot mint more CLI sessions', async () => {
+    const context = createApp()
+    const { token } = await signInCli(context)
+    const { code } = await start(context)
+    const response = await context.client.v1.cli.authorizations[':code{[A-Za-z -]+}'].approve.$post(
+      { json: {}, param: { code } },
+      bearer(token),
+    )
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({
+      error: { code: 'forbidden', message: 'Approve CLI sign-ins from the console' },
+    })
+  })
+})
+
+describe('CLI session tokens', () => {
+  test('manage organizations, projects, and API keys', async () => {
+    const context = createApp()
+    const { token } = await signInCli(context)
+    const org = await context.client.v1.orgs.$post({ json: { name: 'Acme' } }, bearer(token))
+    expect(org.status).toBe(200)
+    if (org.status !== 200) throw new Error('unreachable')
+    const { id: orgId } = await org.json()
+
+    const project = await context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects.$post(
+      { json: { name: 'Checkout' }, param: { orgId } },
+      bearer(token),
+    )
+    expect(project.status).toBe(200)
+    if (project.status !== 200) throw new Error('unreachable')
+    const { id: projectId } = await project.json()
+
+    const key = await context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
+      ':projectId{prj_[A-Za-z0-9_-]+}'
+    ]['api-keys'].$post(
+      { json: { name: 'CLI', scopes: ['data:read'] }, param: { orgId, projectId } },
+      bearer(token),
+    )
+    expect(key.status).toBe(200)
+    if (key.status !== 200) throw new Error('unreachable')
+    const { createdAt, id, token: apiKey, tokenLast4, ...record } = await key.json()
+    expect(apiKey).toMatch(/^tempo:sk:[a-f0-9]{48}$/)
+    expect(id).toMatch(/^key_/)
+    expect(tokenLast4).toBe(apiKey.slice(-4))
+    expect(Date.parse(createdAt)).not.toBeNaN()
+    expect(record).toMatchObject({ environment: 'production', name: 'CLI', scopes: ['data:read'] })
+  })
+
+  test('are refused on routes without a session lane', async () => {
+    const context = createApp()
+    const { token } = await signInCli(context)
+    const response = await context.app.request('/v1/tokenlist', bearer(token))
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({
+      error: { code: 'forbidden', message: 'CLI sessions cannot call this route. Use an API key.' },
+    })
+  })
+
+  test('report unknown tokens as an invalid session', async () => {
+    const response = await createApp().client.v1.me.$get(undefined, bearer(CliAuth.generateToken()))
+    expect(response.status).toBe(401)
+    expect(await response.json()).toMatchObject({
+      error: {
+        code: 'session_invalid',
+        message: 'CLI session is invalid or expired. Sign in again.',
+      },
+    })
+  })
+
+  test('are revoked by logout', async () => {
+    const context = createApp()
+    const { token } = await signInCli(context)
+    const logout = await context.app.request('/v1/auth/logout', {
+      ...bearer(token),
+      method: 'POST',
+    })
+    expect(logout.status).toBe(204)
+    expect((await context.client.v1.me.$get(undefined, bearer(token))).status).toBe(401)
+  })
+})