aaronrene / knowtation public
agent-credentials-data-integrity.test.mjs
56 lines 2.1 KB
Raw
sha256:e4c529f14a0bb908c1caaaeb3f95f3623a1a82e636e7e3722ca2cd3dc9821263 security: npm audit fix pre-bridge 2026-07-29 Human 40 days ago
1 /**
2 * Phase C — data-integrity: secret never persisted; list omits credential; namespace separate.
3 */
4
5 import { describe, it } from 'node:test';
6 import assert from 'node:assert/strict';
7 import fs from 'node:fs/promises';
8 import os from 'node:os';
9 import path from 'node:path';
10 import { createAgentCredentialStore } from '../hub/gateway/agent-credential-store.mjs';
11 import { mintCredential, listCredentialsForSub } from '../hub/lib/agent-credential-core.mjs';
12
13 describe('Phase C data-integrity — agent credentials', () => {
14 it('persisted JSON never contains raw secret; list has no credential field', async () => {
15 const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'kt-agent-di-'));
16 process.env.KNOWTATION_GATEWAY_DATA_DIR = dir;
17 try {
18 const store = createAgentCredentialStore();
19 const minted = await store.mint({
20 sub: 'google:1',
21 name: 'di',
22 vault_ids: ['default'],
23 scopes: ['propose', 'vault:read'],
24 });
25 const file = path.join(dir, 'hosted_agent_credentials.json');
26 const raw = await fs.readFile(file, 'utf8');
27 assert.ok(!raw.includes(minted.credential));
28 const secretPart = minted.credential.split('.')[1];
29 assert.ok(secretPart);
30 assert.ok(!raw.includes(secretPart));
31 assert.ok(raw.includes('token_hash'));
32 assert.ok(raw.includes('"credentials"'));
33 assert.ok(!raw.includes('refresh-tokens'));
34
35 const list = await store.list('google:1');
36 assert.equal(list[0].credential, undefined);
37 assert.equal(list[0].token_hash, undefined);
38 } finally {
39 delete process.env.KNOWTATION_GATEWAY_DATA_DIR;
40 await fs.rm(dir, { recursive: true, force: true });
41 }
42 });
43
44 it('listCredentialsForSub never exposes hashes', () => {
45 const { records, id } = mintCredential({}, {
46 sub: 'google:1',
47 name: 'x',
48 vault_ids: ['default'],
49 scopes: ['propose', 'vault:read'],
50 });
51 const list = listCredentialsForSub(records, 'google:1');
52 assert.equal(list[0].id, id);
53 assert.equal(list[0].token_hash, undefined);
54 assert.equal(list[0].lookup_id, undefined);
55 });
56 });
File History 1 commit
sha256:e4c529f14a0bb908c1caaaeb3f95f3623a1a82e636e7e3722ca2cd3dc9821263 security: npm audit fix pre-bridge 2026-07-29 Human 40 days ago