toiljs 0.0.116 → 0.0.118

package/test/devserver-email.test.ts

@@ -1,306 +0,0 @@
-/**
- * The dev / self-host email pipeline (src/devserver/email): wire parse,
- * recipient validation, in-process caps (dedup + per-recipient + per-min/day
- * budget), config resolution (toil.config + TOIL_EMAIL_* env), the Resend
- * transport, and the NodeEmailService prepare/deliver split. Mirrors the edge
- * (toil-backend host/email.rs, mailer.rs, email_budget.rs).
- */
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import { EmailCaps } from '../src/devserver/email/caps.js';
-import { resolveEmailConfig, type ResolvedEmailConfig } from '../src/devserver/email/config.js';
-import {
-    NodeEmailService,
-    __sentEmails,
-    __clearSentEmails,
-    resetEmailService,
-} from '../src/devserver/email/index.js';
-import { sendResend } from '../src/devserver/email/providers.js';
-import { EmailStatus } from '../src/devserver/email/status.js';
-import { validFrom, validRecipient } from '../src/devserver/email/validate.js';
-import { parseEmailBlob } from '../src/devserver/email/wire.js';
-import { buildHostImports, freshDispatchState, type MemoryRef } from '../src/devserver/runtime/host.js';
-
-/** Encode an `email_send` blob exactly like the guest (`server/globals/email.ts`). */
-function encodeBlob(to: string, subject: string, purpose: string, body: string, html: string): Buffer {
-    const e = (s: string): Buffer => Buffer.from(s, 'utf8');
-    const [t, s, p, b, h] = [e(to), e(subject), e(purpose), e(body), e(html)];
-    const head = Buffer.alloc(14);
-    head.writeUInt16LE(t.length, 0);
-    head.writeUInt16LE(s.length, 2);
-    head.writeUInt16LE(p.length, 4);
-    head.writeUInt32LE(b.length, 6);
-    head.writeUInt32LE(h.length, 10);
-    return Buffer.concat([head, t, s, p, b, h]);
-}
-
-const reserved = (o: Record<string, string>): Map<string, string> => new Map(Object.entries(o));
-
-describe('validate', () => {
-    it('accepts plain addresses, rejects injection / multiple / malformed', () => {
-        expect(validRecipient('user@example.com')).toBe(true);
-        expect(validRecipient('a.b+tag@sub.example.co')).toBe(true);
-        for (const bad of [
-            'a@b.com\r\nBcc: evil@x.com',
-            'a@b.com\nDATA',
-            'a@b.com\0',
-            'a@b.com,c@d.com',
-            'a@b.com;c@d.com',
-            'a@b.com c@d.com',
-            '<a@b.com>',
-            '"a"@b.com',
-            '',
-            'nobody',
-            'a@b@c.com',
-            '@b.com',
-            'a@bcom',
-            'a@.com',
-            'a@b.',
-        ]) {
-            expect(validRecipient(bad), bad).toBe(false);
-        }
-    });
-
-    it('validFrom is lenient but rejects header injection', () => {
-        expect(validFrom('me@example.com')).toBe(true);
-        expect(validFrom('a@b.com\r\nBcc: x')).toBe(false);
-        expect(validFrom('no-at-sign')).toBe(false);
-    });
-});
-
-describe('wire parse', () => {
-    it('round-trips a well-formed blob', () => {
-        const raw = encodeBlob('a@b.com', 'Hi', 'verify', '123456', '<b>x</b>');
-        const p = parseEmailBlob(raw);
-        expect(p).toEqual({ to: 'a@b.com', subject: 'Hi', purpose: 'verify', body: '123456', html: '<b>x</b>' });
-    });
-
-    it('rejects truncated / trailing-garbage / non-UTF8', () => {
-        expect(parseEmailBlob(Buffer.alloc(4))).toBeNull(); // shorter than header
-        const raw = encodeBlob('a@b.com', 's', 'p', 'body', '');
-        expect(parseEmailBlob(raw.subarray(0, raw.length - 1))).toBeNull(); // truncated payload
-        expect(parseEmailBlob(Buffer.concat([raw, Buffer.from([0xff])]))).toBeNull(); // trailing garbage
-        const bad = Buffer.from(raw);
-        bad[bad.length - 1] = 0xff; // corrupt last body byte -> invalid UTF-8
-        expect(parseEmailBlob(bad)).toBeNull();
-    });
-});
-
-describe('caps', () => {
-    it('dedup collapses an identical (recipient, purpose) within the window', () => {
-        const c = new EmailCaps();
-        expect(c.isDuplicate('a@b.com', 'verify', 0)).toBe(false); // first
-        expect(c.isDuplicate('a@b.com', 'verify', 1_000)).toBe(true); // repeat in window
-        expect(c.isDuplicate('a@b.com', 'reset', 1_000)).toBe(false); // different purpose
-        expect(c.isDuplicate('a@b.com', 'verify', 31_000)).toBe(false); // after the 30s window
-    });
-
-    it('per-recipient hourly cap holds then resets', () => {
-        const c = new EmailCaps();
-        expect(c.recipientOk('x@y.com', 2, 0)).toBe(true);
-        expect(c.recipientOk('x@y.com', 2, 10)).toBe(true);
-        expect(c.recipientOk('x@y.com', 2, 20)).toBe(false); // third over the cap
-        expect(c.recipientOk('z@y.com', 2, 20)).toBe(true); // a different recipient is independent
-        expect(c.recipientOk('x@y.com', 2, 3_600_001)).toBe(true); // next hour resets
-    });
-
-    it('per-minute and per-day budgets both gate, 0 = unlimited', () => {
-        const c = new EmailCaps();
-        expect(c.budgetOk(2, 0, 0)).toBe(true);
-        expect(c.budgetOk(2, 0, 0)).toBe(true);
-        expect(c.budgetOk(2, 0, 0)).toBe(false); // minute cap (2) exhausted at the same instant
-        // A separate budget instance with only a day cap.
-        const d = new EmailCaps();
-        expect(d.budgetOk(0, 1, 0)).toBe(true);
-        expect(d.budgetOk(0, 1, 0)).toBe(false); // day cap (1) exhausted
-        // Unlimited (0/0) never blocks.
-        const u = new EmailCaps();
-        for (let i = 0; i < 100; i++) expect(u.budgetOk(0, 0, i)).toBe(true);
-    });
-});
-
-describe('config resolution', () => {
-    it('is unconfigured (silent) with no config + no env', () => {
-        expect(resolveEmailConfig(null, reserved({}))).toEqual({ config: null, warning: null });
-    });
-
-    it('merges toil.config + env, api key from env, env wins', () => {
-        const { config } = resolveEmailConfig(
-            { provider: 'resend', from: 'cfg@x.com', maxPerMin: 10 },
-            reserved({ TOIL_EMAIL_API_KEY: 're_k', TOIL_EMAIL_FROM: 'env@x.com' }),
-        );
-        expect(config).toMatchObject({ provider: 'resend', from: 'env@x.com', apiKey: 're_k', maxPerMin: 10 });
-    });
-
-    it('gmail resolves to smtp with defaults', () => {
-        const { config } = resolveEmailConfig(
-            { provider: 'gmail', from: 'me@gmail.com' },
-            reserved({ TOIL_EMAIL_API_KEY: 'app-pw' }),
-        );
-        expect(config).toMatchObject({ provider: 'smtp', smtp: { host: 'smtp.gmail.com', port: 587, user: 'me@gmail.com' } });
-    });
-
-    it('warns (off) on partial/invalid config', () => {
-        // from but no api key
-        expect(resolveEmailConfig({ from: 'a@b.com' }, reserved({})).warning).toMatch(/API_KEY/);
-        // bad from
-        expect(resolveEmailConfig({ from: 'no-at' }, reserved({ TOIL_EMAIL_API_KEY: 'k' })).warning).toMatch(/from/);
-        // smtp without host
-        expect(
-            resolveEmailConfig({ provider: 'smtp', from: 'a@b.com' }, reserved({ TOIL_EMAIL_API_KEY: 'k' })).warning,
-        ).toMatch(/SMTP_HOST/);
-        // unknown provider
-        expect(
-            resolveEmailConfig({ from: 'a@b.com' }, reserved({ TOIL_EMAIL_API_KEY: 'k', TOIL_EMAIL_PROVIDER: 'mailgun' }))
-                .warning,
-        ).toMatch(/unknown/);
-        // gmail still needs an app password
-        expect(
-            resolveEmailConfig({ provider: 'gmail', from: 'me@gmail.com' }, reserved({})).warning,
-        ).toMatch(/gmail/);
-    });
-
-    it('plain SMTP needs NO api key (a local / auth-less relay)', () => {
-        const { config, warning } = resolveEmailConfig(
-            { provider: 'smtp', from: 'dev@dacely.local' },
-            reserved({ TOIL_EMAIL_SMTP_HOST: '127.0.0.1' }),
-        );
-        expect(warning).toBeNull();
-        expect(config).toMatchObject({
-            provider: 'smtp',
-            from: 'dev@dacely.local',
-            apiKey: '', // no credential -> the send path omits SMTP auth
-            smtp: { host: '127.0.0.1', port: 587 },
-        });
-    });
-
-    it('TOIL_EMAIL_ENABLED=false disables silently', () => {
-        expect(
-            resolveEmailConfig({ provider: 'resend', from: 'a@b.com' }, reserved({ TOIL_EMAIL_API_KEY: 'k', TOIL_EMAIL_ENABLED: 'false' })),
-        ).toEqual({ config: null, warning: null });
-    });
-});
-
-describe('Resend transport', () => {
-    afterEach(() => vi.unstubAllGlobals());
-
-    const cfg: ResolvedEmailConfig = {
-        provider: 'resend',
-        from: 'noreply@x.com',
-        apiKey: 're_secret',
-        maxPerMin: 0,
-        maxPerDay: 0,
-        maxPerRecipientPerHour: 0,
-    };
-
-    it('2xx -> Sent, with the right payload + Bearer auth', async () => {
-        const fetchMock = vi.fn(async () => new Response(null, { status: 200 }));
-        vi.stubGlobal('fetch', fetchMock);
-        const status = await sendResend(cfg, { from: cfg.from, to: 'a@b.com', subject: 'Hi', body: 'text', html: '<b>h</b>' });
-        expect(status).toBe(EmailStatus.Sent);
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-        const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-        expect((init.headers as Record<string, string>).authorization).toBe('Bearer re_secret');
-        expect(JSON.parse(init.body as string)).toEqual({ from: 'noreply@x.com', to: ['a@b.com'], subject: 'Hi', text: 'text', html: '<b>h</b>' });
-    });
-
-    it('4xx -> ProviderError, no retry', async () => {
-        const fetchMock = vi.fn(async () => new Response(null, { status: 422 }));
-        vi.stubGlobal('fetch', fetchMock);
-        const status = await sendResend(cfg, { from: cfg.from, to: 'a@b.com', subject: 's', body: 'b', html: '' });
-        expect(status).toBe(EmailStatus.ProviderError);
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-    });
-});
-
-describe('NodeEmailService pipeline', () => {
-    afterEach(() => vi.unstubAllGlobals());
-
-    const base: ResolvedEmailConfig = {
-        provider: 'resend',
-        from: 'noreply@x.com',
-        apiKey: 're_secret',
-        maxPerMin: 0,
-        maxPerDay: 0,
-        maxPerRecipientPerHour: 0,
-    };
-
-    it('prepare returns terminal statuses and a parsed message to deliver', () => {
-        const svc = new NodeEmailService(base);
-        // Bad recipient.
-        expect(svc.prepare(encodeBlob('not-an-email', 's', 'p', 'b', ''), 0).status).toBe(EmailStatus.BadRecipient);
-        // Valid -> Sent + parsed.
-        const ok = svc.prepare(encodeBlob('a@b.com', 's', 'verify', 'b', ''), 0);
-        expect(ok.status).toBe(EmailStatus.Sent);
-        expect(ok.parsed?.to).toBe('a@b.com');
-        // Identical (to, purpose) again -> Deduped.
-        expect(svc.prepare(encodeBlob('a@b.com', 's', 'verify', 'b', ''), 1_000).status).toBe(EmailStatus.Deduped);
-    });
-
-    it('enforces the per-minute budget', () => {
-        const svc = new NodeEmailService({ ...base, maxPerMin: 2 });
-        // Distinct recipients so dedup/recipient caps don't fire first.
-        expect(svc.prepare(encodeBlob('a@x.com', 's', 'p', 'b', ''), 0).status).toBe(EmailStatus.Sent);
-        expect(svc.prepare(encodeBlob('b@x.com', 's', 'p', 'b', ''), 0).status).toBe(EmailStatus.Sent);
-        expect(svc.prepare(encodeBlob('c@x.com', 's', 'p', 'b', ''), 0).status).toBe(EmailStatus.Budget);
-    });
-
-    it('enforces the per-recipient hourly cap', () => {
-        const svc = new NodeEmailService({ ...base, maxPerRecipientPerHour: 2 });
-        // Same recipient, distinct purposes so dedup doesn't fire.
-        expect(svc.prepare(encodeBlob('a@x.com', 's', 'p1', 'b', ''), 0).status).toBe(EmailStatus.Sent);
-        expect(svc.prepare(encodeBlob('a@x.com', 's', 'p2', 'b', ''), 0).status).toBe(EmailStatus.Sent);
-        expect(svc.prepare(encodeBlob('a@x.com', 's', 'p3', 'b', ''), 0).status).toBe(EmailStatus.RecipientCapped);
-    });
-
-    it('deliver actually sends via the provider', async () => {
-        const fetchMock = vi.fn(async () => new Response(null, { status: 200 }));
-        vi.stubGlobal('fetch', fetchMock);
-        const svc = new NodeEmailService(base);
-        const { parsed } = svc.prepare(encodeBlob('a@b.com', 's', 'p', 'b', ''), 0);
-        expect(parsed).not.toBeNull();
-        expect(await svc.deliver(parsed!)).toBe(EmailStatus.Sent);
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-    });
-});
-
-describe('host imports: email_send_detached (the anti-enumeration fire-and-forget path)', () => {
-    afterEach(() => {
-        resetEmailService();
-        __clearSentEmails();
-    });
-
-    /** Build a dev host import table over a fresh wasm memory holding `blob` at offset 0. */
-    function wireHost(blob: Buffer): {
-        env: Record<string, (...a: number[]) => number>;
-        len: number;
-    } {
-        const memory = new WebAssembly.Memory({ initial: 1 });
-        Buffer.from(memory.buffer).set(blob, 0);
-        const ref: MemoryRef = { memory };
-        const imports = buildHostImports(ref, freshDispatchState());
-        return { env: imports.env as Record<string, (...a: number[]) => number>, len: blob.length };
-    }
-
-    it('is registered and returns a queue-accept status immediately (no provider round-trip)', () => {
-        resetEmailService(); // unconfigured: log-only stub, still constant-time
-        __clearSentEmails();
-        const { env, len } = wireHost(encodeBlob('someone@x.com', 'Subj', 'verify', 'tok', '<b>x</b>'));
-        // The detached import exists (mirrors the edge's env.email_send_detached).
-        expect(typeof env.email_send_detached).toBe('function');
-        // It returns synchronously with a queue-accept status (Sent == accepted/queued).
-        expect(env.email_send_detached(0, len)).toBe(EmailStatus.Sent);
-    });
-
-    it('feeds the __sentEmails capture seam so confirm/reset tests still find the token', () => {
-        resetEmailService();
-        __clearSentEmails();
-        const link = 'https://app.example.com/reset#token=deadbeef';
-        const { env, len } = wireHost(encodeBlob('user@x.com', 'Reset', 'reset', link, ''));
-        env.email_send_detached(0, len);
-        const captured = __sentEmails.find((e) => e.to === 'user@x.com');
-        expect(captured).toBeTruthy();
-        expect(captured!.purpose).toBe('reset');
-        expect(captured!.text).toContain('token=deadbeef'); // the emailed token survives to the seam
-    });
-});

package/test/devserver-pqauth.test.ts

@@ -1,93 +0,0 @@
-/**
- * Dev-server post-quantum auth host mocks: the ML-KEM-768 decapsulation and the
- * RFC 9497 OPRF evaluation must be byte-identical to the production Rust edge
- * (`toil-backend` fips203 / `voprf` crate). The OPRF mock is asserted against the
- * same RFC 9497 Appendix A.1.1 vector the edge test uses — if both match the RFC,
- * the noble client interops with both servers. (Account/challenge persistence is
- * ToilDB now, exercised end-to-end in `pqauth-e2e.test.ts`.)
- */
-import { describe, expect, it } from 'vitest';
-
-import { ml_kem768 } from '@dacely/noble-post-quantum/ml-kem.js';
-
-import { buildCryptoImports, freshCryptoState } from '../src/devserver/runtime/crypto.js';
-
-type Ref = { memory: WebAssembly.Memory | null };
-
-function freshMem(pages = 4): Ref {
-    return { memory: new WebAssembly.Memory({ initial: pages }) };
-}
-function buf(ref: Ref): Buffer {
-    return Buffer.from(ref.memory!.buffer);
-}
-function put(ref: Ref, ptr: number, bytes: Uint8Array): void {
-    buf(ref).set(bytes, ptr);
-}
-const h2b = (h: string): Uint8Array => Uint8Array.from(Buffer.from(h, 'hex'));
-const b2h = (u: Uint8Array): string => Buffer.from(u).toString('hex');
-
-describe('crypto.mlkem_decapsulate dev mock', () => {
-    it('recovers the shared secret a noble client encapsulated (wiring round-trip)', () => {
-        const ref = freshMem();
-        const imports = buildCryptoImports(ref, freshCryptoState());
-        const decap = imports['crypto.mlkem_decapsulate'];
-
-        const seed = new Uint8Array(64).fill(9);
-        const { publicKey, secretKey } = ml_kem768.keygen(seed);
-        const { cipherText, sharedSecret } = ml_kem768.encapsulate(publicKey);
-
-        const ctPtr = 0;
-        const skPtr = 4096;
-        const outPtr = 16384;
-        put(ref, ctPtr, cipherText); // 1088
-        put(ref, skPtr, secretKey); // 2400
-
-        const rc = decap(ctPtr, cipherText.length, skPtr, secretKey.length, outPtr);
-        expect(rc).toBe(0);
-        const got = buf(ref).subarray(outPtr, outPtr + 32);
-        expect(b2h(got)).toBe(b2h(sharedSecret));
-    });
-
-    it('rejects wrong sizes with -4', () => {
-        const ref = freshMem();
-        const decap = buildCryptoImports(ref, freshCryptoState())['crypto.mlkem_decapsulate'];
-        expect(decap(0, 1087, 4096, 2400, 16384)).toBe(-4);
-        expect(decap(0, 1088, 4096, 2399, 16384)).toBe(-4);
-    });
-});
-
-describe('crypto.voprf_evaluate dev mock (RFC 9497 A.1.1, ristretto255-SHA512)', () => {
-    // The interop gate: matching the RFC means the dev mock == the edge ==
-    // anything else RFC 9497-conformant (the noble client).
-    const SEED = 'a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3';
-    const KEY_INFO = '74657374206b6579'; // "test key"
-    const BLINDED = '609a0ae68c15a3cf6903766461307e5c8bb2f95e7e6550e1ffa2dc99e412803c';
-    const EVALUATED = '7ec6578ae5120958eb2db1745758ff379e77cb64fe77b0b2d8cc917ea0869c7e';
-
-    it('matches the RFC evaluated element', () => {
-        const ref = freshMem();
-        const evaluate = buildCryptoImports(ref, freshCryptoState())['crypto.voprf_evaluate'];
-
-        const seed = h2b(SEED);
-        const info = h2b(KEY_INFO);
-        const blinded = h2b(BLINDED);
-        const seedPtr = 0;
-        const infoPtr = 256;
-        const blindedPtr = 512;
-        const outPtr = 1024;
-        put(ref, seedPtr, seed);
-        put(ref, infoPtr, info);
-        put(ref, blindedPtr, blinded);
-
-        const rc = evaluate(seedPtr, seed.length, infoPtr, info.length, blindedPtr, blinded.length, outPtr);
-        expect(rc).toBe(0);
-        const got = buf(ref).subarray(outPtr, outPtr + 32);
-        expect(b2h(got)).toBe(EVALUATED);
-    });
-
-    it('rejects a bad blinded-element length with -4', () => {
-        const ref = freshMem();
-        const evaluate = buildCryptoImports(ref, freshCryptoState())['crypto.voprf_evaluate'];
-        expect(evaluate(0, 32, 256, 8, 512, 31, 1024)).toBe(-4);
-    });
-});

package/test/devserver-secrets.test.ts

@@ -1,63 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import {
-    buildHostImports,
-    freshDispatchState,
-    type MemoryRef,
-} from '../src/devserver/runtime/host.js';
-
-/**
- * The dev host warns (once) when the guest reads a framework auth secret that is unset, since the
- * wasm then falls back to a PUBLISHED dev key (see `server/globals/auth.ts`). This is the visible
- * counterpart to the silent fallback: without it, a server running on the dev host would sign
- * sessions under a forgeable key with no signal. The repo root has no `.env.secrets`, so every
- * lookup below is absent.
- */
-function setup() {
-    const memory = new WebAssembly.Memory({ initial: 1 });
-    const ref: MemoryRef = { memory };
-    const env = buildHostImports(ref, freshDispatchState()).env as Record<
-        string,
-        (...a: number[]) => number
-    >;
-    const buf = Buffer.from(memory.buffer);
-    return { env, buf };
-}
-
-/** Writes `key` at offset 0 and runs `env_get_secure`, returning its status code. */
-function getSecure(env: Record<string, (...a: number[]) => number>, buf: Buffer, key: string): number {
-    const b = Buffer.from(key, 'utf8');
-    b.copy(buf, 0);
-    return env.env_get_secure(0, b.length, 256, 256);
-}
-
-afterEach(() => {
-    vi.restoreAllMocks();
-});
-
-describe('dev host secret fallback warning', () => {
-    it('warns once that an unset AUTH_SESSION_SECRET falls back to a published key', () => {
-        const write = vi.spyOn(process.stdout, 'write').mockReturnValue(true);
-        const { env, buf } = setup();
-
-        expect(getSecure(env, buf, 'AUTH_SESSION_SECRET')).toBe(-2); // ABSENT
-        // Repeated reads (a fresh wasm instance per request hits this every time) warn only once.
-        expect(getSecure(env, buf, 'AUTH_SESSION_SECRET')).toBe(-2);
-
-        const warnings = write.mock.calls
-            .map((c) => String(c[0]))
-            .filter((s) => s.includes('AUTH_SESSION_SECRET'));
-        expect(warnings).toHaveLength(1);
-        expect(warnings[0]).toContain('forge');
-        expect(warnings[0]).toContain('deployed node');
-    });
-
-    it('does not warn for an ordinary (non-framework) absent secret', () => {
-        const write = vi.spyOn(process.stdout, 'write').mockReturnValue(true);
-        const { env, buf } = setup();
-
-        expect(getSecure(env, buf, 'STRIPE_KEY')).toBe(-2); // ABSENT, no published default
-        const warned = write.mock.calls.some((c) => String(c[0]).includes('STRIPE_KEY'));
-        expect(warned).toBe(false);
-    });
-});