aaronrene / knowtation public
companion-token-custody-unit.test.mjs
169 lines 8.5 KB
Raw
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700 feat(companion): add production macOS distribution path Human minor ⚠ breaking 25 days ago
1 /**
2 * Tier 1 — UNIT: token-custody functions in isolation over an injected in-memory keychain.
3 * Reference: docs/COMPANION-APP-PHASE-3-OAUTH-PKCE.md (custody/rotation rules).
4 */
5 import { describe, it } from 'node:test';
6 import assert from 'node:assert/strict';
7 import {
8 KEYCHAIN_ACCOUNTS,
9 buildSessionMeta,
10 createTokenCustody,
11 } from '../lib/companion-token-custody.mjs';
12 import { makeSyncKeychain } from './helpers/companion-keychain-fake.mjs';
13
14 describe('buildSessionMeta', () => {
15 it('computes expiresAt and refreshExpiresAt from the clock', () => {
16 const meta = buildSessionMeta(
17 { expiresIn: 3600, refreshToken: 'r', scope: 'vault:read', tokenType: 'Bearer' },
18 { now: 1_000_000, refreshTtlMs: 86_400_000, issuer: 'https://knowtation.store', clientId: 'native-client' },
19 );
20 assert.equal(meta.expiresAt, 1_000_000 + 3600 * 1000);
21 assert.equal(meta.refreshExpiresAt, 1_000_000 + 86_400_000);
22 assert.equal(meta.scope, 'vault:read');
23 assert.equal(meta.issuer, 'https://knowtation.store');
24 assert.equal(meta.clientId, 'native-client');
25 });
26 it('leaves refreshExpiresAt null without a refresh token or TTL', () => {
27 assert.equal(buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 0 }).refreshExpiresAt, null);
28 assert.equal(buildSessionMeta({ expiresIn: 60, refreshToken: 'r', scope: null, tokenType: 'Bearer' }, { now: 0 }).refreshExpiresAt, null);
29 });
30 it('throws on a bad clock or bad expiresIn (no secret in message)', () => {
31 assert.throws(() => buildSessionMeta({ expiresIn: 60 }, { now: NaN }));
32 assert.throws(() => buildSessionMeta({ expiresIn: 0 }, { now: 0 }));
33 });
34 });
35
36 describe('createTokenCustody — adapter contract', () => {
37 it('throws if the adapter is missing a method', () => {
38 assert.throws(() => createTokenCustody({ get() {}, set() {} }), /\{ get, set, delete \}/);
39 assert.throws(() => createTokenCustody(null), /adapter/);
40 });
41 });
42
43 describe('storeSession / loadSession', () => {
44 it('round-trips a full session through the keychain', async () => {
45 const kc = makeSyncKeychain();
46 const custody = createTokenCustody(kc);
47 const meta = buildSessionMeta({ expiresIn: 3600, refreshToken: 'refresh-1', scope: 'vault:read vault:write', tokenType: 'Bearer' }, { now: 1000, refreshTtlMs: 1_000_000, clientId: 'native-client' });
48 await custody.storeSession({ accessToken: 'jwt-1', refreshToken: 'refresh-1', meta });
49
50 const loaded = await custody.loadSession();
51 assert.equal(loaded.accessToken, 'jwt-1');
52 assert.equal(loaded.refreshToken, 'refresh-1');
53 assert.equal(loaded.expiresAt, 1000 + 3600 * 1000);
54 assert.equal(loaded.scope, 'vault:read vault:write');
55 assert.equal(loaded.clientId, 'native-client');
56 });
57
58 it('persists each secret under its own keychain account', async () => {
59 const kc = makeSyncKeychain();
60 const custody = createTokenCustody(kc);
61 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: 'r', scope: null, tokenType: 'Bearer' }, { now: 0 });
62 await custody.storeSession({ accessToken: 'jwt', refreshToken: 'r', meta });
63 assert.equal(kc._store.get(KEYCHAIN_ACCOUNTS.ACCESS_TOKEN), 'jwt');
64 assert.equal(kc._store.get(KEYCHAIN_ACCOUNTS.REFRESH_TOKEN), 'r');
65 assert.ok(kc._store.has(KEYCHAIN_ACCOUNTS.SESSION_META));
66 });
67
68 it('storing without a refresh token clears any stale one', async () => {
69 const kc = makeSyncKeychain();
70 const custody = createTokenCustody(kc);
71 kc._store.set(KEYCHAIN_ACCOUNTS.REFRESH_TOKEN, 'stale');
72 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 0 });
73 await custody.storeSession({ accessToken: 'jwt', meta });
74 assert.equal(kc._store.has(KEYCHAIN_ACCOUNTS.REFRESH_TOKEN), false);
75 });
76
77 it('throws on an empty access token', async () => {
78 const custody = createTokenCustody(makeSyncKeychain());
79 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 0 });
80 await assert.rejects(() => custody.storeSession({ accessToken: '', meta }), /accessToken/);
81 });
82 });
83
84 describe('loadSession — fail-closed', () => {
85 it('returns null when there is no session', async () => {
86 assert.equal(await createTokenCustody(makeSyncKeychain()).loadSession(), null);
87 });
88 it('returns null when metadata is missing or corrupt', async () => {
89 const kc = makeSyncKeychain();
90 kc._store.set(KEYCHAIN_ACCOUNTS.ACCESS_TOKEN, 'jwt');
91 const custody = createTokenCustody(kc);
92 assert.equal(await custody.loadSession(), null); // no meta
93 kc._store.set(KEYCHAIN_ACCOUNTS.SESSION_META, '{not json');
94 assert.equal(await custody.loadSession(), null); // corrupt meta
95 });
96 });
97
98 describe('clearSession', () => {
99 it('removes all OAuth secrets and is idempotent', async () => {
100 const kc = makeSyncKeychain();
101 const custody = createTokenCustody(kc);
102 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: 'r', scope: null, tokenType: 'Bearer' }, { now: 0 });
103 await custody.storeSession({ accessToken: 'jwt', refreshToken: 'r', meta });
104 await custody.clearSession();
105 assert.equal(await custody.loadSession(), null);
106 await custody.clearSession(); // idempotent
107 assert.equal(kc._store.has(KEYCHAIN_ACCOUNTS.ACCESS_TOKEN), false);
108 });
109 });
110
111 describe('updateAccessToken — refresh rotation', () => {
112 it('replaces the access token and rotates the refresh token', async () => {
113 const kc = makeSyncKeychain();
114 const custody = createTokenCustody(kc);
115 const meta1 = buildSessionMeta({ expiresIn: 60, refreshToken: 'r1', scope: null, tokenType: 'Bearer' }, { now: 0 });
116 await custody.storeSession({ accessToken: 'jwt1', refreshToken: 'r1', meta: meta1 });
117 const meta2 = buildSessionMeta({ expiresIn: 60, refreshToken: 'r2', scope: null, tokenType: 'Bearer' }, { now: 1000 });
118 await custody.updateAccessToken({ accessToken: 'jwt2', refreshToken: 'r2', meta: meta2 });
119 const loaded = await custody.loadSession();
120 assert.equal(loaded.accessToken, 'jwt2');
121 assert.equal(loaded.refreshToken, 'r2');
122 });
123 it('keeps the existing refresh token when none is supplied', async () => {
124 const kc = makeSyncKeychain();
125 const custody = createTokenCustody(kc);
126 const meta1 = buildSessionMeta({ expiresIn: 60, refreshToken: 'r1', scope: null, tokenType: 'Bearer' }, { now: 0 });
127 await custody.storeSession({ accessToken: 'jwt1', refreshToken: 'r1', meta: meta1 });
128 const meta2 = buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 1000 });
129 await custody.updateAccessToken({ accessToken: 'jwt2', meta: meta2 });
130 assert.equal((await custody.loadSession()).refreshToken, 'r1');
131 });
132 });
133
134 describe('loopback token custody (Phase 2 per-session token)', () => {
135 it('stores, reads, rotates, and clears the loopback token independently of the session', async () => {
136 const kc = makeSyncKeychain();
137 const custody = createTokenCustody(kc);
138 assert.equal(await custody.getLoopbackToken(), null);
139 await custody.storeLoopbackToken('lb-1');
140 assert.equal(await custody.getLoopbackToken(), 'lb-1');
141 await custody.rotateLoopbackToken('lb-2');
142 assert.equal(await custody.getLoopbackToken(), 'lb-2');
143 await custody.clearLoopbackToken();
144 assert.equal(await custody.getLoopbackToken(), null);
145 });
146 it('clearSession does NOT remove the loopback token', async () => {
147 const kc = makeSyncKeychain();
148 const custody = createTokenCustody(kc);
149 await custody.storeLoopbackToken('lb-1');
150 const meta = buildSessionMeta({ expiresIn: 60, refreshToken: null, scope: null, tokenType: 'Bearer' }, { now: 0 });
151 await custody.storeSession({ accessToken: 'jwt', meta });
152 await custody.clearSession();
153 assert.equal(await custody.getLoopbackToken(), 'lb-1');
154 });
155 });
156
157 describe('decide', () => {
158 it('returns reauth when there is no session', async () => {
159 assert.equal(await createTokenCustody(makeSyncKeychain()).decide({ now: 0 }), 'reauth');
160 });
161 it('reflects decideTokenRefresh against stored expiry', async () => {
162 const kc = makeSyncKeychain();
163 const custody = createTokenCustody(kc);
164 const meta = buildSessionMeta({ expiresIn: 3600, refreshToken: 'r', scope: null, tokenType: 'Bearer' }, { now: 0, refreshTtlMs: 10_000_000 });
165 await custody.storeSession({ accessToken: 'jwt', refreshToken: 'r', meta });
166 assert.equal(await custody.decide({ now: 0, skewMs: 1000 }), 'valid');
167 assert.equal(await custody.decide({ now: meta.expiresAt + 1, skewMs: 1000 }), 'refresh');
168 });
169 });
File History 1 commit
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700 feat(companion): add production macOS distribution path Human minor ⚠ 25 days ago