capauth 0.3.10__tar.gz → 0.3.12__tar.gz

{capauth-0.3.10 → capauth-0.3.12}/CHANGELOG.md

@@ -6,6 +6,13 @@ All notable changes to `capauth` are documented here. The format is based on
 
 ## [Unreleased]
 
+- Raise operator proof absolute and idle ceilings to 24 hours while keeping
+  access capabilities bounded to five minutes (card `4af0ae7f`).
+
+- Normalize control-plane authorization decisions to the actual reconstructed
+  token lifetime before exact owner-policy evaluation, while retaining the raw
+  signed decision for replay and currentness receipts (card `9b0c6dce`).
+
 - Fail closed when a subject has no capability-ceiling assignment. Add explicit
   `service` and `connector` ceiling roles over the existing five-class fqid
   grammar, with external dispatch structurally forbidden to generic services.

{capauth-0.3.10/src/capauth.egg-info → capauth-0.3.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capauth
-Version: 0.3.10
+Version: 0.3.12
 Summary: Capability-based Authentication — decentralized, PGP-based identity and authorization
 Author-email: smilinTux <admin@smilintux.org>
 License: GPL-3.0-or-later

{capauth-0.3.10 → capauth-0.3.12}/phone-signer/app.js

@@ -19,6 +19,28 @@ import { chunkPayload, parseKeyFrame, KeyFrameCollector } from "./lib/keyqr.js";
 const openpgp = globalThis.openpgp;
 const STORE_KEY = "capauth_bunker_envelope";
 const FP_KEY = "capauth_bunker_fp";
+const RETURN_KEY = "capauth_bunker_return";
+
+function safeSetupReturn() {
+  const raw = sessionStorage.getItem(RETURN_KEY) || "";
+  sessionStorage.removeItem(RETURN_KEY);
+  if (!raw || raw.length > 2048 || /[\u0000-\u001F\u007F]/.test(raw)) return "";
+  try {
+    const target = new URL(raw, location.origin);
+    if (
+      target.origin !== location.origin ||
+      target.username ||
+      target.password ||
+      target.hash ||
+      target.pathname !== "/oidc/authorize"
+    ) {
+      return "";
+    }
+    return target.pathname + target.search;
+  } catch {
+    return "";
+  }
+}
 
 const session = {
   armoredKey: null, // decrypted (from vault) armored key, in-memory only
@@ -117,6 +139,8 @@ async function storeKey() {
     $("vault-pass-confirm").value = "";
     setStatus($("key-status"), "Identity saved in this browser. Continue to passkey setup.", "ok");
     renderKeyState();
+    const returnTo = safeSetupReturn();
+    if (returnTo) location.assign(returnTo);
   } catch (err) {
     setStatus($("key-status"), "Could not read/store key: " + err.message, "err");
   }
@@ -145,14 +169,44 @@ async function unlockKey() {
   }
 }
 
-function forgetKey() {
+function clearLocalIdentity(message) {
   localStorage.removeItem(STORE_KEY);
   localStorage.removeItem(FP_KEY);
   session.armoredKey = null;
   session.signingKey = null;
   session.fingerprint = "";
   renderKeyState();
-  setStatus($("key-status"), "Key forgotten.", "");
+  setStatus($("key-status"), message, "");
+}
+
+function forgetKey() {
+  if (!confirm("Remove this encrypted identity from this browser? Make sure you have another protected copy first.")) return;
+  clearLocalIdentity("Identity removed from this browser.");
+}
+
+function replaceKey() {
+  if (!confirm("Replace this browser's encrypted identity? Make sure you have another protected copy first.")) return;
+  clearLocalIdentity("Choose the identity file you want to use on this browser.");
+}
+
+function downloadEncryptedBackup() {
+  const envelope = localStorage.getItem(STORE_KEY);
+  const fingerprint = localStorage.getItem(FP_KEY);
+  if (!envelope || !fingerprint) return setStatus($("key-status"), "No local identity is available to back up.", "err");
+  try {
+    const parsed = JSON.parse(envelope);
+    if (!isEncryptedEnvelope(parsed)) throw new Error("invalid encrypted vault");
+    const payload = JSON.stringify({ version: 1, fingerprint, encryptedEnvelope: parsed }, null, 2);
+    const url = URL.createObjectURL(new Blob([payload], { type: "application/json" }));
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = `capauth-${fingerprint.slice(-8).toLowerCase()}-encrypted-backup.json`;
+    link.click();
+    URL.revokeObjectURL(url);
+    setStatus($("key-status"), "Encrypted backup downloaded. Store it somewhere protected.", "ok");
+  } catch (err) {
+    setStatus($("key-status"), "Could not create the encrypted backup: " + err.message, "err");
+  }
 }
 
 function renderKeyState() {
@@ -170,7 +224,7 @@ function renderKeyState() {
   } else {
     $("key-import").classList.remove("hidden");
     $("key-unlock").classList.add("hidden");
-    setStatus($("key-status"), "Setup needed: choose your existing identity file.");
+    setStatus($("key-status"), "Setup needed: choose your existing identity or encrypted backup file.");
   }
 }
 
@@ -179,8 +233,23 @@ async function loadKeyFile() {
   if (!file) return;
   try {
     const armored = await file.text();
+    if (file.name.toLowerCase().endsWith(".json")) {
+      const backup = JSON.parse(armored);
+      const fp = String(backup.fingerprint || "").trim().toUpperCase();
+      if (backup.version !== 1 || ![40, 64].includes(fp.length) || !/^[0-9A-F]+$/.test(fp)) {
+        throw new Error("This is not a valid CapAuth encrypted backup.");
+      }
+      if (!isEncryptedEnvelope(backup.encryptedEnvelope)) throw new Error("The encrypted vault is invalid.");
+      localStorage.setItem(STORE_KEY, JSON.stringify(backup.encryptedEnvelope));
+      localStorage.setItem(FP_KEY, fp);
+      setStatus($("key-status"), "Encrypted identity restored. Use its browser vault passphrase to sign in.", "ok");
+      renderKeyState();
+      const returnTo = safeSetupReturn();
+      if (returnTo) location.assign(returnTo);
+      return;
+    }
     if (!armored.includes("BEGIN PGP PRIVATE KEY BLOCK")) {
-      throw new Error("This is not an armored PGP private key file.");
+      throw new Error("Choose an armored PGP private key or CapAuth encrypted backup.");
     }
     $("priv-key").value = armored;
     setStatus($("key-status"), "Identity file loaded. Complete the two passphrase fields below.", "ok");
@@ -498,6 +567,8 @@ $("btn-store").onclick = storeKey;
 $("key-file").onchange = loadKeyFile;
 $("btn-unlock").onclick = unlockKey;
 $("btn-forget").onclick = forgetKey;
+$("btn-replace").onclick = replaceKey;
+$("btn-backup").onclick = downloadEncryptedBackup;
 $("btn-pair").onclick = connect;
 $("btn-push").onclick = enablePush;
 $("btn-scan").onclick = startScan;

{capauth-0.3.10 → capauth-0.3.12}/phone-signer/index.html

@@ -94,6 +94,8 @@
       max-height:140px; overflow:auto; margin-top:6px;
     }
     .warn { color:#f59e0b; font-size:11px; margin-top:8px; }
+    .management { border-top:1px solid rgba(124,58,237,.25); margin-top:16px; padding-top:12px; }
+    .management summary { cursor:pointer; color:var(--accent2); font-size:12px; font-weight:600; }
   </style>
 </head>
 <body>
@@ -107,9 +109,9 @@
     <h2>1. Load your existing identity</h2>
     <div id="key-status" class="status">Checking this browser...</div>
     <div id="key-import">
-      <label for="key-file">Choose your armored PGP private key file</label>
-      <input id="key-file" type="file" accept=".asc,.pgp,.gpg,text/plain" />
-      <div class="hint">Example: <code>jarvis-private.asc</code>. The file is read only in this browser and is never uploaded.</div>
+      <label for="key-file">Choose your identity file</label>
+      <input id="key-file" type="file" accept=".asc,.pgp,.gpg,.json,text/plain,application/json" />
+      <div class="hint">Use an armored PGP private key such as <code>jarvis-private.asc</code>, or a CapAuth encrypted backup. The file is read only in this browser and is never uploaded.</div>
       <details class="hint">
         <summary>Advanced: paste an armored key instead</summary>
         <label for="priv-key">Armored PGP private key</label>
@@ -150,11 +152,17 @@
       <input id="unlock-pass" type="password" autocomplete="current-password" />
       <div class="row">
         <button id="btn-unlock">Unlock</button>
-        <button id="btn-forget" class="secondary">Forget key</button>
       </div>
       <button id="btn-push" class="secondary">🔔 Enable background approvals</button>
       <div id="push-status" class="hint">Get a notification to approve sign-ins even when this page is closed.</div>
       </details>
+      <details class="management" id="device-management">
+        <summary>Manage identity on this device</summary>
+        <p class="hint">Download an encrypted browser-vault backup, replace this browser's identity, or remove its local copy. CapAuth never exports an unencrypted private key here.</p>
+        <button id="btn-backup" class="secondary">Download encrypted backup</button>
+        <button id="btn-replace" class="secondary">Replace identity</button>
+        <button id="btn-forget" class="danger">Remove from this browser</button>
+      </details>
     </div>
   </section>
 

{capauth-0.3.10 → capauth-0.3.12}/src/capauth/control_plane_authorizer.py

@@ -641,12 +641,12 @@ class ControlPlaneDecisionAuthorizer:
         if not issued_at <= now < expires_at:
             return closed(_result(DecisionState.DENY, DecisionCode.EXPIRED))
 
-        first = self._owner_decision(binding, capauth)
+        effective_capauth = capauth.model_copy(update={"scope": binding.capability_scope()})
+        first = self._owner_decision(binding, effective_capauth)
         if first is None:
             return closed(
                 _result(DecisionState.UNAVAILABLE, DecisionCode.OWNER_POLICY_UNAVAILABLE)
             )
-        effective_capauth = capauth.model_copy(update={"scope": binding.capability_scope()})
         first_joined = join_policy_decisions(binding, effective_capauth, first)
         if not first_joined.allow:
             return closed(_result(first_joined.state, first_joined.code))
@@ -670,14 +670,14 @@ class ControlPlaneDecisionAuthorizer:
             return closed(_capauth_denial(exc.decision.reason))
         except Exception:
             return closed(_result(DecisionState.UNAVAILABLE, DecisionCode.CAPAUTH_UNAVAILABLE))
-        second = self._owner_decision(binding, capauth)
+        effective_capauth = capauth.model_copy(update={"scope": binding.capability_scope()})
+        second = self._owner_decision(binding, effective_capauth)
         if second is None:
             return closed(
                 _result(DecisionState.UNAVAILABLE, DecisionCode.OWNER_POLICY_UNAVAILABLE)
             )
         if first != second:
             return closed(_result(DecisionState.DENY, DecisionCode.BINDING_MISMATCH))
-        effective_capauth = capauth.model_copy(update={"scope": binding.capability_scope()})
         joined = join_policy_decisions(binding, effective_capauth, second)
         if not joined.allow:
             return closed(_result(joined.state, joined.code))
@@ -689,7 +689,7 @@ class ControlPlaneDecisionAuthorizer:
             context = SanitizedControlPlaneDecisionV1(
                 binding=binding,
                 boundary=invocation.boundary,
-                capauth_decision=capauth,
+                capauth_decision=effective_capauth,
                 joined_decision=joined,
                 authenticated_identity_ref=_identity_ref(binding, capauth),
                 issued_at=issued_at,

{capauth-0.3.10 → capauth-0.3.12}/src/capauth/control_plane_session.py

@@ -38,8 +38,8 @@ from .control_plane_authorizer import (
 from .delegated import CapabilityScope, PresentedCapability, Principal, parse_presented_token
 
 UTC = timezone.utc
-MAX_SESSION_TTL = timedelta(hours=8)
-MAX_SESSION_IDLE = timedelta(minutes=30)
+MAX_SESSION_TTL = timedelta(hours=24)
+MAX_SESSION_IDLE = timedelta(hours=24)
 _OPS = {entry.capability: entry.operation.value for entry in CAPABILITY_MATRIX if entry.capability}
 _REQUEST_FACTORY = object()
 _VERIFIER_FACTORY = object()

{capauth-0.3.10 → capauth-0.3.12}/src/capauth/rotation.py

@@ -70,9 +70,7 @@ class RotationPlan:
             if not isinstance(item, dict):
                 raise RotationError(f"custody_bundles[{index}] must be an object")
             bundle = local(item.get("path"), f"custody_bundles[{index}].path")
-            checksum = local(
-                item.get("checksum_path"), f"custody_bundles[{index}].checksum_path"
-            )
+            checksum = local(item.get("checksum_path"), f"custody_bundles[{index}].checksum_path")
             bundles.append((bundle, checksum))
 
         operator = str(raw.get("operator") or "").strip()
@@ -269,9 +267,13 @@ def rotate_passphrase(
         else:
             absent_before.add(checksum)
         try:
-            bundle_plaintexts.append(pgpy.PGPMessage.from_blob(data).decrypt(old_passphrase).message)
+            bundle_plaintexts.append(
+                pgpy.PGPMessage.from_blob(data).decrypt(old_passphrase).message
+            )
         except Exception as exc:
-            raise RotationError(f"old passphrase could not decrypt custody bundle: {bundle}") from exc
+            raise RotationError(
+                f"old passphrase could not decrypt custody bundle: {bundle}"
+            ) from exc
 
     rotated_key = _rewrap_key(key, old_passphrase, new_passphrase)
     fingerprint = _validate_new_key(rotated_key, public_bytes, new_passphrase)
@@ -312,7 +314,10 @@ def rotate_passphrase(
         for path, data in replacements.items():
             _atomic_write(path, data)
             changed.append(path)
-        if _validate_new_key(plan.private_key.read_bytes(), public_bytes, new_passphrase) != fingerprint:
+        if (
+            _validate_new_key(plan.private_key.read_bytes(), public_bytes, new_passphrase)
+            != fingerprint
+        ):
             raise RotationError("installed key fingerprint changed unexpectedly")
         for bundle, checksum in plan.custody_bundles:
             installed = bundle.read_bytes()
@@ -345,7 +350,10 @@ def rollback_rotation(journal_path: Path, *, approved: bool = False) -> tuple[st
         journal = json.loads(journal_path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError) as exc:
         raise RotationError(f"invalid rollback journal: {exc}") from exc
-    if not isinstance(journal, dict) or journal.get("schema") != "capauth-passphrase-rotation-rollback-v1":
+    if (
+        not isinstance(journal, dict)
+        or journal.get("schema") != "capauth-passphrase-rotation-rollback-v1"
+    ):
         raise RotationError("unsupported rollback journal")
     items = journal.get("items")
     if not isinstance(items, list) or not items:

{capauth-0.3.10 → capauth-0.3.12}/src/capauth/service/oidc/provider.py

@@ -177,14 +177,20 @@ _LOGIN_PAGE = """<!DOCTYPE html>
                     color:#e2e8f0;padding:.6rem .8rem;font-size:.88rem;margin-bottom:1rem;
                     font-family:monospace}}
     textarea{{min-height:130px;resize:vertical}}
-    button{{width:100%;background:#7C3AED;color:#fff;border:none;border-radius:8px;
-            padding:.8rem;font-size:1rem;cursor:pointer;font-weight:600}}
+    button{{width:100%;background:#7C3AED;color:#fff;border:none;border-radius:10px;
+            padding:.85rem;font-size:1rem;cursor:pointer;font-weight:650}}
     button:hover{{background:#6d28d9}}
     .nonce-box{{background:#0f0f1a;border:1px solid #334155;border-radius:8px;padding:.7rem;
                 margin-bottom:.5rem;font-family:monospace;font-size:.78rem;color:#00e5ff;
                 white-space:pre-wrap;word-break:break-all}}
     .copy{{width:auto;padding:.45rem .7rem;font-size:.78rem;background:#334155;margin-bottom:1rem}}
     .err{{color:#f87171;font-size:.85rem;margin-top:.6rem;display:none}}
+    .browser-auth{{background:#111827;border:1px solid #334155;border-radius:12px;padding:1rem;margin:1rem 0}}
+    .browser-auth button+button{{margin-top:.6rem}}
+    .method-label{{color:#c4b5fd;font-size:.72rem;font-weight:700;letter-spacing:.06em;text-transform:uppercase;margin-bottom:.65rem}}
+    .secondary-action{{background:#334155}}
+    details{{margin-top:1rem}}
+    summary{{cursor:pointer;color:#a78bfa;font-weight:600}}
     code{{color:#a78bfa}}
   </style>
 </head>
@@ -194,15 +200,18 @@ _LOGIN_PAGE = """<!DOCTYPE html>
   <p class="sub">Authenticate to <strong>{client_name}</strong> with your PGP key.
      No password. Use a passkey if you already added one.</p>
 
-  <button id="pk-btn" onclick="passkeyLogin()" style="background:#0e7490">Sign in with a passkey</button>
-  <p class="sub" style="font-size:.74rem;margin:.4rem 0 1rem">Recommended after one PGP-proven enrollment. Passkey login then needs no fingerprint or pasted signature.
-    <a href="{base_url}/oidc/passkey/enroll" style="color:#a78bfa">Add a passkey</a>
-  </p>
-
-  <div style="display:flex;align-items:center;gap:.6rem;margin:0 0 1rem;color:#475569;font-size:.74rem">
-    <span style="flex:1;height:1px;background:#334155"></span>PGP FALLBACK<span style="flex:1;height:1px;background:#334155"></span>
+  <div class="browser-auth">
+    <div class="method-label" id="primary-label">Best option for this browser</div>
+    <button id="pk-btn" onclick="passkeyLogin()" style="background:#0e7490">Continue with a passkey</button>
+    <button id="ld-btn" onclick="capauthLocalSign()" style="background:#10b981">Continue with local identity</button>
+    <button id="setup-btn" onclick="setupBrowser()" style="background:#7C3AED">Set up this browser</button>
+    <p class="sub" id="browser-status" style="font-size:.74rem;margin:.6rem 0 0">Checking this browser for your encrypted identity.</p>
+    <a href="{base_url}/oidc/passkey/enroll" id="add-passkey" style="display:block;color:#a78bfa;font-size:.76rem;margin-top:.7rem">Add a passkey to this browser</a>
   </div>
 
+  <details id="manual-pgp">
+  <summary>Other sign-in and recovery options</summary>
+  <p class="sub" style="font-size:.74rem;margin:.6rem 0">The text below is the message to sign. It is not a signature. Paste only a fresh ASCII-armored PGP signature into the signature box.</p>
   <div class="step">1 — Your PGP fingerprint</div>
   <label for="fp">Fingerprint (40- or 64-hex chars)</label>
   <input id="fp" type="text" maxlength="64" placeholder="ABCDEF0123..." autocomplete="off"/>
@@ -218,12 +227,7 @@ _LOGIN_PAGE = """<!DOCTYPE html>
   <p class="sub">This fingerprint must already have an approved CapAuth enrollment.</p>
 
   <button onclick="submitSig()">Verify &amp; Continue</button>
-  <div class="err" id="err"></div>
 
-  <div style="display:flex;align-items:center;gap:.6rem;margin:1.1rem 0 .2rem;color:#475569;font-size:.74rem">
-    <span style="flex:1;height:1px;background:#334155"></span>OR<span style="flex:1;height:1px;background:#334155"></span>
-  </div>
-  <button id="ld-btn" onclick="capauthLocalSign()" style="background:#10b981;margin-top:.5rem">Sign on this device (key in your bunker)</button>
   <button id="ph-btn" onclick="capauthPhoneLogin()" style="background:#7C3AED;margin-top:.5rem">Sign from another device (QR)</button>
   <div id="pq" style="display:none;margin-top:1rem;text-align:center">
     <img id="pq-img" alt="pairing QR" style="width:200px;height:200px;background:#fff;border-radius:10px"/>
@@ -235,6 +239,8 @@ _LOGIN_PAGE = """<!DOCTYPE html>
     Manual GPG: copy the complete message, then use <code>gpg --armor --sign</code> for an inline signed message
     or <code>gpg --armor --detach-sign</code> for a detached signature. The browser extension can sign automatically.
   </p>
+  </details>
+  <div class="err" id="err"></div>
 </div>
 
 <script src="{base_url}/oidc/passkey.js?v=15"></script>
@@ -245,6 +251,34 @@ const BASE = "{base_url}";
 const REQUEST_ID = "{request_id}";
 window._capauthBase = BASE; window._capauthReqId = REQUEST_ID; window._capauthCh = null;
 
+function setupBrowser(){{
+  const target=window.location.pathname+window.location.search;
+  if(target.length>2048||/[\\u0000-\\u001F\\u007F]/.test(target)||window.location.pathname!=="/oidc/authorize"){{
+    return setErr("This sign-in address cannot be carried into browser setup. Start again from the application.");
+  }}
+  sessionStorage.setItem("capauth_bunker_return",target);
+  sessionStorage.setItem("capauth_bunker_auto_sign","1");
+  window.location.assign(BASE+"/bunker/?mode=setup");
+}}
+
+function refreshBrowserAuth(){{
+  const fp=(localStorage.getItem("capauth_bunker_fp")||"").trim().toUpperCase().replace(/\\s/g,"");
+  const ready=[40,64].includes(fp.length)&&/^[0-9A-F]+$/.test(fp)&&Boolean(localStorage.getItem("capauth_bunker_envelope"));
+  const status=document.getElementById("browser-status");
+  const setup=document.getElementById("setup-btn");
+  const local=document.getElementById("ld-btn");
+  if(ready){{
+    status.textContent="Local identity "+fp.slice(0,8)+"..."+fp.slice(-8)+" is ready. Its encrypted key stays in this browser.";
+    setup.hidden=true;
+    local.hidden=false;
+  }}else{{
+    status.textContent="No local identity was found. Load your existing identity once, then CapAuth returns here to sign a fresh challenge.";
+    setup.hidden=false;
+    local.hidden=true;
+  }}
+}}
+refreshBrowserAuth();
+
 async function passkeyLogin(){{
   document.getElementById("err").style.display="none";
   if(!window.capauthWebAuthn || !window.capauthWebAuthn.available()){{
@@ -569,6 +603,16 @@ import { decryptPrivateKey, isEncryptedEnvelope } from "/bunker/lib/keyvault.js"
       window.location.href = d.redirect_to;
     } catch (e) { err("Phone sign-in: " + e.message); status(""); }
   };
+
+  // The one-time Bunker setup can return to a fresh OIDC authorization page
+  // and immediately continue the local signing flow. The marker is removed
+  // before prompting so cancel or failure never creates a reload loop.
+  if (window._capauthReqId && sessionStorage.getItem("capauth_bunker_auto_sign") === "1") {
+    sessionStorage.removeItem("capauth_bunker_auto_sign");
+    const fp = (localStorage.getItem("capauth_bunker_fp") || "").toUpperCase();
+    const raw = localStorage.getItem("capauth_bunker_envelope");
+    if ([40, 64].includes(fp.length) && raw) setTimeout(window.capauthLocalSign, 0);
+  }
 })();
 """
 

{capauth-0.3.10 → capauth-0.3.12/src/capauth.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capauth
-Version: 0.3.10
+Version: 0.3.12
 Summary: Capability-based Authentication — decentralized, PGP-based identity and authorization
 Author-email: smilinTux <admin@smilintux.org>
 License: GPL-3.0-or-later

{capauth-0.3.10 → capauth-0.3.12}/tests/test_control_plane_authorizer.py

@@ -672,13 +672,21 @@ def test_signed_expiry_constraint_is_an_upper_ceiling() -> None:
     rig = Rig()
     rig.binding = rig.binding.model_copy(update={"expires_at": NOW + timedelta(seconds=61)})
 
-    result = _allow(rig, bearer=rig.bearer(ttl_seconds=60))
+    class ExactScopeOwner:
+        def decide(self, binding, capauth_decision):
+            return (
+                _owner(binding) if capauth_decision.scope == binding.capability_scope() else None
+            )
+
+    result = _allow(
+        rig,
+        bearer=rig.bearer(ttl_seconds=60),
+        owner=ExactScopeOwner(),
+    )
 
     assert result.context.expires_at == NOW + timedelta(seconds=60)
     assert result.context.binding.expires_at == result.context.expires_at
-    assert result.context.capauth_decision.scope.constraints == (
-        rig.binding.capability_scope().constraints
-    )
+    assert result.context.capauth_decision.scope == result.context.binding.capability_scope()
     assert result.context.joined_decision.scope == result.context.binding.capability_scope()
 
 

{capauth-0.3.10 → capauth-0.3.12}/tests/test_control_plane_session.py

@@ -102,7 +102,9 @@ class InjectedIssuer:
 
 
 class OwnerPolicy:
-    def decide(self, binding, _capauth_decision):
+    def decide(self, binding, capauth_decision):
+        if capauth_decision.scope != binding.capability_scope():
+            return None
         return OwnerPolicyDecision(
             state=DecisionState.ALLOW,
             revision=binding.owner_policy_revision,
@@ -160,6 +162,30 @@ def new_session(manager, *, device=DEVICE):
     return material.take()
 
 
+def test_operator_session_accepts_24_hour_absolute_and_idle_lifetime():
+    manager = OperatorSessionManager(
+        backend=InMemoryOperatorSessionBackendForTests(),
+        current_revisions=lambda _: REV,
+        enabled=True,
+        clock=Clock(),
+    )
+
+    cookie, csrf = manager.create(
+        principal=P,
+        acting_principal=A,
+        device_fingerprint=DEVICE,
+        capability_ceiling=frozenset({"skdashboard.read"}),
+        purpose="reporting",
+        allowed_origin=ORIGIN,
+        revisions=REV,
+        ttl_seconds=24 * 60 * 60,
+        idle_seconds=24 * 60 * 60,
+    ).take()
+
+    assert cookie
+    assert csrf
+
+
 def make_rig(
     backend=None,
     *,

{capauth-0.3.10 → capauth-0.3.12}/tests/test_oidc_idp.py

@@ -261,8 +261,8 @@ def test_login_page_documents_exact_signing_contract(oidc_app):
     )
 
     assert resp.status_code == 200
-    assert ">Sign in with a passkey<" in resp.text
-    assert "Recommended after one PGP-proven enrollment" in resp.text
+    assert ">Continue with a passkey<" in resp.text
+    assert "Best option for this browser" in resp.text
     assert 'currentPayload=["CAPAUTH_NONCE_V1", "nonce="+ch.nonce' in resp.text
     assert '"client_nonce="+ch.client_nonce_echo' in resp.text
     assert '"timestamp="+ch.timestamp' in resp.text
@@ -271,7 +271,15 @@ def test_login_page_documents_exact_signing_contract(oidc_app):
     assert "gpg --armor --sign" in resp.text
     assert "gpg --armor --detach-sign" in resp.text
     assert "capauth sign --nonce" not in resp.text
-    assert "Sign on this device (key in your bunker)" in resp.text
+    assert "Continue with local identity" in resp.text
+    assert "Set up this browser" in resp.text
+    assert "Other sign-in and recovery options" in resp.text
+    assert "local.hidden=true" in resp.text
+    assert '<details id="manual-pgp">' in resp.text
+    assert "The text below is the message to sign. It is not a signature." in resp.text
+    assert 'window.location.pathname!=="/oidc/authorize"' in resp.text
+    assert 'sessionStorage.setItem("capauth_bunker_return",target)' in resp.text
+    assert 'sessionStorage.setItem("capauth_bunker_auto_sign","1")' in resp.text
     assert "Sign from another device (QR)" in resp.text
 
 

capauth-0.3.12/tests/test_passkey_enrollment_ux.py

@@ -0,0 +1,44 @@
+"""Focused source checks for the guided passkey enrollment workflow."""
+
+from pathlib import Path
+
+ROOT = Path(__file__).parents[1]
+
+
+def test_bunker_guides_browser_identity_setup() -> None:
+    """The linked setup path stays short and allows a bounded login return."""
+    page = (ROOT / "phone-signer" / "index.html").read_text()
+    assert "Load your existing identity" in page
+    assert "Choose your identity file" in page
+    assert "CapAuth encrypted backup" in page
+    assert "jarvis-private.asc" in page
+    assert "Enter the browser vault passphrase again" in page
+    assert "Continue to passkey setup" in page
+    assert "Advanced: unlock for remote signing" in page
+    assert "Manage identity on this device" in page
+    assert "Download encrypted backup" in page
+    assert "Replace identity" in page
+    assert "Remove from this browser" in page
+    assert "never exports an unencrypted private key" in page
+
+    controller = (ROOT / "phone-signer" / "app.js").read_text()
+    assert 'new URLSearchParams(location.search).get("mode") === "setup"' in controller
+    assert '$("pair-card").classList.add("hidden")' in controller
+    assert '$("continue-passkey").classList.remove("hidden")' in controller
+    assert "vaultPass !== vaultConfirm" in controller
+    assert 'const RETURN_KEY = "capauth_bunker_return"' in controller
+    assert "target.origin !== location.origin" in controller
+    assert 'target.pathname !== "/oidc/authorize"' in controller
+    assert "raw.length > 2048" in controller
+    assert "/[\\u0000-\\u001F\\u007F]/" in controller
+    assert "target.username" in controller
+    assert "target.password" in controller
+    assert "target.hash" in controller
+    assert "location.assign(returnTo)" in controller
+    assert "isEncryptedEnvelope(parsed)" in controller
+    assert "encryptedEnvelope: parsed" in controller
+    assert "backup.version !== 1" in controller
+    assert "isEncryptedEnvelope(backup.encryptedEnvelope)" in controller
+    assert "Encrypted identity restored" in controller
+    assert 'confirm("Remove this encrypted identity from this browser?' in controller
+    assert "confirm(\"Replace this browser's encrypted identity?" in controller

{capauth-0.3.10 → capauth-0.3.12}/tests/test_rotation.py

@@ -50,9 +50,7 @@ def _fixture(tmp_path: Path) -> tuple[RotationPlan, dict[Path, bytes]]:
                 "private_key": str(private),
                 "public_key": str(public),
                 "credential_consumers": [str(consumer)],
-                "custody_bundles": [
-                    {"path": str(bundle), "checksum_path": str(checksum)}
-                ],
+                "custody_bundles": [{"path": str(bundle), "checksum_path": str(checksum)}],
                 "rollback_root": str(tmp_path / "rollback"),
                 "proton_pass_entry": "test entry",
             }

capauth-0.3.10/tests/test_passkey_enrollment_ux.py

@@ -1,24 +0,0 @@
-"""Focused source checks for the guided passkey enrollment workflow."""
-
-from pathlib import Path
-
-ROOT = Path(__file__).parents[1]
-
-
-def test_bunker_guides_browser_identity_setup() -> None:
-    """The linked setup path stays short and returns to passkey enrollment."""
-    page = (ROOT / "phone-signer" / "index.html").read_text()
-    assert "Load your existing identity" in page
-    assert "Choose your armored PGP private key file" in page
-    assert "jarvis-private.asc" in page
-    assert "Enter the browser vault passphrase again" in page
-    assert "Continue to passkey setup" in page
-    assert "Advanced: unlock for remote signing" in page
-
-    controller = (ROOT / "phone-signer" / "app.js").read_text()
-    assert 'new URLSearchParams(location.search).get("mode") === "setup"' in controller
-    assert '$("pair-card").classList.add("hidden")' in controller
-    assert '$("continue-passkey").classList.remove("hidden")' in controller
-    assert "vaultPass !== vaultConfirm" in controller
-    assert "requestedNext" not in controller
-    assert "safeNext" not in controller