aaronrene / knowtation public
agent-credentials-security.test.mjs
136 lines 5.2 KB
Raw
sha256:e4c529f14a0bb908c1caaaeb3f95f3623a1a82e636e7e3722ca2cd3dc9821263 security: npm audit fix pre-bridge 2026-07-29 Human 39 days ago
1 /**
2 * Phase C — security: mint gates, no admin, propose≠approve, browser refresh rejected,
3 * offline-lock, allowlist never elevates agent_access.
4 */
5
6 import { describe, it } from 'node:test';
7 import assert from 'node:assert/strict';
8 import fs from 'node:fs/promises';
9 import os from 'node:os';
10 import path from 'node:path';
11 import http from 'node:http';
12 import jwt from 'jsonwebtoken';
13 import express from 'express';
14 import { createAgentCredentialRouter } from '../hub/gateway/agent-credential-routes.mjs';
15 import {
16 mayApplyAdminAllowlistOverride,
17 subFromVerifiedPayload,
18 roleFromVerifiedAccessPayload,
19 } from '../hub/gateway/access-token-authz.mjs';
20 import { roleEligibleForPersonalSelfApply } from '../lib/hub-proposal-personal-self-apply.mjs';
21 import { normalizeScopes, agentScopesPermitMethod } from '../hub/lib/agent-credential-core.mjs';
22
23 const SECRET = 'phase-c-security-test-secret-32byte!!';
24
25 describe('Phase C security — agent credentials', () => {
26 it('rejects admin scopes at normalize', () => {
27 assert.throws(() => normalizeScopes(['admin']), (e) => e.code === 'AGENT_SCOPE_FORBIDDEN');
28 assert.throws(() => normalizeScopes(['vault:admin']), (e) => e.code === 'AGENT_SCOPE_FORBIDDEN');
29 });
30
31 it('mayApplyAdminAllowlistOverride is false for agent_access', () => {
32 assert.equal(mayApplyAdminAllowlistOverride({ type: 'agent_access', sub: 'google:1' }), false);
33 const role = roleFromVerifiedAccessPayload(
34 { type: 'agent_access', sub: 'google:1', scopes: ['propose', 'vault:read'] },
35 () => 'admin'
36 );
37 assert.equal(role.role, 'member');
38 assert.equal(role.isAgentAccess, true);
39 });
40
41 it('propose cannot approve paths', () => {
42 const scopes = ['propose', 'vault:read'];
43 assert.equal(agentScopesPermitMethod(scopes, 'POST', '/api/v1/proposals/x/approve'), false);
44 assert.equal(agentScopesPermitMethod(scopes, 'POST', '/api/v1/proposals/x/discard'), false);
45 });
46
47 it('self-apply refuses agent_access tokenType', () => {
48 assert.equal(
49 roleEligibleForPersonalSelfApply('member', { tokenType: 'agent_access', humanActor: true }),
50 false
51 );
52 });
53
54 it('browser refresh-shaped token rejected by exchange; mcp cannot mint', async () => {
55 const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'kt-agent-sec-'));
56 process.env.KNOWTATION_GATEWAY_DATA_DIR = dir;
57 const app = express();
58 const { router } = createAgentCredentialRouter({
59 sessionSecret: SECRET,
60 getSessionSub: (req) => {
61 try {
62 return jwt.verify(req.headers.authorization.slice(7), SECRET).sub;
63 } catch {
64 return null;
65 }
66 },
67 getSessionPayload: (req) => {
68 try {
69 return jwt.verify(req.headers.authorization.slice(7), SECRET);
70 } catch {
71 return null;
72 }
73 },
74 grantedScopes: () => ['vault:read', 'vault:write'],
75 });
76 app.use('/api/v1/auth/agent', router);
77 const server = http.createServer(app);
78 await new Promise((r) => server.listen(0, r));
79 const base = `http://127.0.0.1:${server.address().port}`;
80 try {
81 const bad = await fetch(`${base}/api/v1/auth/agent/token`, {
82 method: 'POST',
83 headers: { 'Content-Type': 'application/json' },
84 body: JSON.stringify({ credential: 'notprefix.secretvalue' }),
85 });
86 assert.equal(bad.status, 401);
87
88 const mcpTok = jwt.sign(
89 { sub: 'google:1', type: 'mcp_access', scopes: ['vault:write'] },
90 SECRET,
91 { expiresIn: '1h' }
92 );
93 const mint = await fetch(`${base}/api/v1/auth/agent/credentials`, {
94 method: 'POST',
95 headers: { Authorization: `Bearer ${mcpTok}`, 'Content-Type': 'application/json' },
96 body: JSON.stringify({ name: 'x', vault_ids: ['default'] }),
97 });
98 assert.equal(mint.status, 403);
99
100 const offlineApp = express();
101 const { router: offlineRouter } = createAgentCredentialRouter({
102 sessionSecret: SECRET,
103 getSessionSub: () => 'google:1',
104 getSessionPayload: () => ({ type: 'session', sub: 'google:1' }),
105 grantedScopes: () => ['vault:read'],
106 offlineLockedActive: true,
107 });
108 offlineApp.use('/api/v1/auth/agent', offlineRouter);
109 const s2 = http.createServer(offlineApp);
110 await new Promise((r) => s2.listen(0, r));
111 const b2 = `http://127.0.0.1:${s2.address().port}`;
112 const ol = await fetch(`${b2}/api/v1/auth/agent/credentials`, {
113 method: 'POST',
114 headers: { Authorization: 'Bearer x', 'Content-Type': 'application/json' },
115 body: JSON.stringify({ name: 'x', vault_ids: ['default'] }),
116 });
117 assert.equal(ol.status, 503);
118 const olBody = await ol.json();
119 assert.equal(olBody.code, 'AGENT_CREDENTIALS_UNSUPPORTED_OFFLINE_LOCKED');
120 await new Promise((r) => s2.close(r));
121
122 // Regression: pre-Phase-C style payload without typ/aud must not authorize propose.
123 assert.equal(
124 subFromVerifiedPayload(
125 { sub: 'google:1', type: 'agent_access', scopes: ['propose', 'vault:read'] },
126 { method: 'POST', path: '/api/v1/proposals' }
127 ),
128 null
129 );
130 } finally {
131 await new Promise((r) => server.close(r));
132 delete process.env.KNOWTATION_GATEWAY_DATA_DIR;
133 await fs.rm(dir, { recursive: true, force: true });
134 }
135 });
136 });
File History 1 commit
sha256:e4c529f14a0bb908c1caaaeb3f95f3623a1a82e636e7e3722ca2cd3dc9821263 security: npm audit fix pre-bridge 2026-07-29 Human 39 days ago