aaronrene / knowtation public
phase8-p1b-bootstrap-replay.test.mjs
58 lines 2.0 KB
Raw
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ breaking 11 days ago
1 /**
2 * Phase 8 P1b — security tier: bootstrap token replay (§9).
3 */
4
5 import { describe, test, before, after } from 'node:test';
6 import assert from 'node:assert/strict';
7 import fs from 'fs';
8 import {
9 makeTempDataDir,
10 TEST_PASSPHRASE,
11 } from '../helpers/phase8-p1b-local-auth-harness.mjs';
12 import {
13 generateSetupToken,
14 consumeSetupToken,
15 resetBootstrapRateLimitForTests,
16 bootstrapPath,
17 } from '../../hub/lib/local-auth-bootstrap.mjs';
18
19 describe('phase8-p1b bootstrap replay (security)', () => {
20 /** @type {{ dataDir: string, cleanup: () => void }} */
21 let tmp;
22
23 before(async () => {
24 tmp = await makeTempDataDir();
25 resetBootstrapRateLimitForTests();
26 });
27
28 after(() => tmp.cleanup());
29
30 test('setup token replay returns BOOTSTRAP_TOKEN_CONSUMED', async () => {
31 const { token } = generateSetupToken(tmp.dataDir, 'admin', '15m');
32 const first = await consumeSetupToken(tmp.dataDir, token, 'admin', TEST_PASSPHRASE, {
33 ip: '127.0.0.1',
34 });
35 assert.equal(first.ok, true);
36 assert.equal(fs.existsSync(bootstrapPath(tmp.dataDir)), false);
37
38 resetBootstrapRateLimitForTests();
39 const second = await consumeSetupToken(tmp.dataDir, token, 'admin', TEST_PASSPHRASE, {
40 ip: '127.0.0.1',
41 });
42 assert.equal(second.ok, false);
43 assert.equal(second.code, 'BOOTSTRAP_TOKEN_CONSUMED');
44 });
45
46 test('expired token rejected', async () => {
47 const dir = (await makeTempDataDir()).dataDir;
48 const { token } = generateSetupToken(dir, 'admin', '1m');
49 const rec = JSON.parse(fs.readFileSync(bootstrapPath(dir), 'utf8'));
50 rec.expiresAt = new Date(Date.now() - 1000).toISOString();
51 fs.writeFileSync(bootstrapPath(dir), JSON.stringify(rec));
52 resetBootstrapRateLimitForTests();
53 const result = await consumeSetupToken(dir, token, 'admin', TEST_PASSPHRASE, { ip: '127.0.0.1' });
54 assert.equal(result.ok, false);
55 assert.equal(result.code, 'BOOTSTRAP_TOKEN_EXPIRED');
56 fs.rmSync(dir, { recursive: true, force: true });
57 });
58 });
File History 1 commit
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ 11 days ago