aaronrene / knowtation public
companion-token-custody-unit.test.mjs
167 lines 8.3 KB
Raw
sha256:65ccb454656ea5acdea0a10e559b78bcde1eb6ff753ecc2911bc99d1c3d7cadd feat(calendar): enforce agent context tiers in retrieval AP… Human minor ⚠ breaking 1 day ago
1 /**
2 * Tier 1 — UNIT: token-custody functions in isolation over an injected in-memory keychain.
3 * Reference: docs/COMPANION-APP-PHASE-3-OAUTH-PKCE.md (custody/rotation rules).
4 */
5 import { describe, it } from 'node:test';
6 import assert from 'node:assert/strict';
7 import {
8 KEYCHAIN_ACCOUNTS,
9 buildSessionMeta,
10 createTokenCustody,
11 } from '../lib/companion-token-custody.mjs';
12 import { makeSyncKeychain } from './helpers/companion-keychain-fake.mjs';
13
14 describe('buildSessionMeta', () => {
15 it('computes expiresAt and refreshExpiresAt from the clock', () => {
16 const meta = buildSessionMeta(
17 { expiresIn: 3600, refreshToken: 'r', scope: 'vault:read', tokenType: 'Bearer' },
18 { now: 1_000_000, refreshTtlMs: 86_400_000, issuer: 'https://knowtation.store' },
19 );
20 assert.equal(meta.expiresAt, 1_000_000 + 3600 * 1000);
21 assert.equal(meta.refreshExpiresAt, 1_000_000 + 86_400_000);
22 assert.equal(meta.scope, 'vault:read');
23 assert.equal(meta.issuer, 'https://knowtation.store');
24 });
25 it('leaves refreshExpiresAt null without a refresh token or TTL', () => {
26 assert.equal(buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 0 }).refreshExpiresAt, null);
27 assert.equal(buildSessionMeta({ expiresIn: 60, refreshToken: 'r', scope: null, tokenType: 'Bearer' }, { now: 0 }).refreshExpiresAt, null);
28 });
29 it('throws on a bad clock or bad expiresIn (no secret in message)', () => {
30 assert.throws(() => buildSessionMeta({ expiresIn: 60 }, { now: NaN }));
31 assert.throws(() => buildSessionMeta({ expiresIn: 0 }, { now: 0 }));
32 });
33 });
34
35 describe('createTokenCustody — adapter contract', () => {
36 it('throws if the adapter is missing a method', () => {
37 assert.throws(() => createTokenCustody({ get() {}, set() {} }), /\{ get, set, delete \}/);
38 assert.throws(() => createTokenCustody(null), /adapter/);
39 });
40 });
41
42 describe('storeSession / loadSession', () => {
43 it('round-trips a full session through the keychain', async () => {
44 const kc = makeSyncKeychain();
45 const custody = createTokenCustody(kc);
46 const meta = buildSessionMeta({ expiresIn: 3600, refreshToken: 'refresh-1', scope: 'vault:read vault:write', tokenType: 'Bearer' }, { now: 1000, refreshTtlMs: 1_000_000 });
47 await custody.storeSession({ accessToken: 'jwt-1', refreshToken: 'refresh-1', meta });
48
49 const loaded = await custody.loadSession();
50 assert.equal(loaded.accessToken, 'jwt-1');
51 assert.equal(loaded.refreshToken, 'refresh-1');
52 assert.equal(loaded.expiresAt, 1000 + 3600 * 1000);
53 assert.equal(loaded.scope, 'vault:read vault:write');
54 });
55
56 it('persists each secret under its own keychain account', async () => {
57 const kc = makeSyncKeychain();
58 const custody = createTokenCustody(kc);
59 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: 'r', scope: null, tokenType: 'Bearer' }, { now: 0 });
60 await custody.storeSession({ accessToken: 'jwt', refreshToken: 'r', meta });
61 assert.equal(kc._store.get(KEYCHAIN_ACCOUNTS.ACCESS_TOKEN), 'jwt');
62 assert.equal(kc._store.get(KEYCHAIN_ACCOUNTS.REFRESH_TOKEN), 'r');
63 assert.ok(kc._store.has(KEYCHAIN_ACCOUNTS.SESSION_META));
64 });
65
66 it('storing without a refresh token clears any stale one', async () => {
67 const kc = makeSyncKeychain();
68 const custody = createTokenCustody(kc);
69 kc._store.set(KEYCHAIN_ACCOUNTS.REFRESH_TOKEN, 'stale');
70 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 0 });
71 await custody.storeSession({ accessToken: 'jwt', meta });
72 assert.equal(kc._store.has(KEYCHAIN_ACCOUNTS.REFRESH_TOKEN), false);
73 });
74
75 it('throws on an empty access token', async () => {
76 const custody = createTokenCustody(makeSyncKeychain());
77 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 0 });
78 await assert.rejects(() => custody.storeSession({ accessToken: '', meta }), /accessToken/);
79 });
80 });
81
82 describe('loadSession — fail-closed', () => {
83 it('returns null when there is no session', async () => {
84 assert.equal(await createTokenCustody(makeSyncKeychain()).loadSession(), null);
85 });
86 it('returns null when metadata is missing or corrupt', async () => {
87 const kc = makeSyncKeychain();
88 kc._store.set(KEYCHAIN_ACCOUNTS.ACCESS_TOKEN, 'jwt');
89 const custody = createTokenCustody(kc);
90 assert.equal(await custody.loadSession(), null); // no meta
91 kc._store.set(KEYCHAIN_ACCOUNTS.SESSION_META, '{not json');
92 assert.equal(await custody.loadSession(), null); // corrupt meta
93 });
94 });
95
96 describe('clearSession', () => {
97 it('removes all OAuth secrets and is idempotent', async () => {
98 const kc = makeSyncKeychain();
99 const custody = createTokenCustody(kc);
100 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: 'r', scope: null, tokenType: 'Bearer' }, { now: 0 });
101 await custody.storeSession({ accessToken: 'jwt', refreshToken: 'r', meta });
102 await custody.clearSession();
103 assert.equal(await custody.loadSession(), null);
104 await custody.clearSession(); // idempotent
105 assert.equal(kc._store.has(KEYCHAIN_ACCOUNTS.ACCESS_TOKEN), false);
106 });
107 });
108
109 describe('updateAccessToken — refresh rotation', () => {
110 it('replaces the access token and rotates the refresh token', async () => {
111 const kc = makeSyncKeychain();
112 const custody = createTokenCustody(kc);
113 const meta1 = buildSessionMeta({ expiresIn: 60, refreshToken: 'r1', scope: null, tokenType: 'Bearer' }, { now: 0 });
114 await custody.storeSession({ accessToken: 'jwt1', refreshToken: 'r1', meta: meta1 });
115 const meta2 = buildSessionMeta({ expiresIn: 60, refreshToken: 'r2', scope: null, tokenType: 'Bearer' }, { now: 1000 });
116 await custody.updateAccessToken({ accessToken: 'jwt2', refreshToken: 'r2', meta: meta2 });
117 const loaded = await custody.loadSession();
118 assert.equal(loaded.accessToken, 'jwt2');
119 assert.equal(loaded.refreshToken, 'r2');
120 });
121 it('keeps the existing refresh token when none is supplied', async () => {
122 const kc = makeSyncKeychain();
123 const custody = createTokenCustody(kc);
124 const meta1 = buildSessionMeta({ expiresIn: 60, refreshToken: 'r1', scope: null, tokenType: 'Bearer' }, { now: 0 });
125 await custody.storeSession({ accessToken: 'jwt1', refreshToken: 'r1', meta: meta1 });
126 const meta2 = buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 1000 });
127 await custody.updateAccessToken({ accessToken: 'jwt2', meta: meta2 });
128 assert.equal((await custody.loadSession()).refreshToken, 'r1');
129 });
130 });
131
132 describe('loopback token custody (Phase 2 per-session token)', () => {
133 it('stores, reads, rotates, and clears the loopback token independently of the session', async () => {
134 const kc = makeSyncKeychain();
135 const custody = createTokenCustody(kc);
136 assert.equal(await custody.getLoopbackToken(), null);
137 await custody.storeLoopbackToken('lb-1');
138 assert.equal(await custody.getLoopbackToken(), 'lb-1');
139 await custody.rotateLoopbackToken('lb-2');
140 assert.equal(await custody.getLoopbackToken(), 'lb-2');
141 await custody.clearLoopbackToken();
142 assert.equal(await custody.getLoopbackToken(), null);
143 });
144 it('clearSession does NOT remove the loopback token', async () => {
145 const kc = makeSyncKeychain();
146 const custody = createTokenCustody(kc);
147 await custody.storeLoopbackToken('lb-1');
148 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 0 });
149 await custody.storeSession({ accessToken: 'jwt', meta });
150 await custody.clearSession();
151 assert.equal(await custody.getLoopbackToken(), 'lb-1');
152 });
153 });
154
155 describe('decide', () => {
156 it('returns reauth when there is no session', async () => {
157 assert.equal(await createTokenCustody(makeSyncKeychain()).decide({ now: 0 }), 'reauth');
158 });
159 it('reflects decideTokenRefresh against stored expiry', async () => {
160 const kc = makeSyncKeychain();
161 const custody = createTokenCustody(kc);
162 const meta = buildSessionMeta({ expiresIn: 3600, refreshToken: 'r', scope: null, tokenType: 'Bearer' }, { now: 0, refreshTtlMs: 10_000_000 });
163 await custody.storeSession({ accessToken: 'jwt', refreshToken: 'r', meta });
164 assert.equal(await custody.decide({ now: 0, skewMs: 1000 }), 'valid');
165 assert.equal(await custody.decide({ now: meta.expiresAt + 1, skewMs: 1000 }), 'refresh');
166 });
167 });
File History 2 commits
sha256:65ccb454656ea5acdea0a10e559b78bcde1eb6ff753ecc2911bc99d1c3d7cadd feat(calendar): enforce agent context tiers in retrieval AP… Human minor ⚠ 1 day ago
sha256:9103f98c89257ed2b01c237cea895dabb3e85ea337dccb1161c175e4422355b6 docs: accept Calendar Events v0 spec with Phase 0 security … Human 1 day ago