|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +// [ADR-0090 D10 rule 5, #28367] The identity mount's request-scoped view of |
| 4 | +// the delegating user. Pinned here at the seam (the mount middleware and the |
| 5 | +// session-lookup plugin); end to end through better-auth in |
| 6 | +// `packages/qa/dogfood/test/mcp-oauth-api-action-forward.dogfood.test.ts`. |
| 7 | + |
| 8 | +import { describe, it, expect, vi } from 'vitest'; |
| 9 | +import { FORWARD_CREDENTIAL_HEADER, withForwardCredential } from '@objectstack/rest'; |
| 10 | +import { |
| 11 | + agentForwardIdentityViewPlugin, |
| 12 | + agentForwardPerformedBy, |
| 13 | + serveAgentForwardAtIdentityMount, |
| 14 | +} from './agent-forward-identity-view.js'; |
| 15 | +import { authSystemWriteContext } from './auth-actor-attribution.js'; |
| 16 | + |
| 17 | +const AGENT = { userId: 'u_mia', clientId: 'agent-client-1', scopes: ['actions:execute', 'data:write'], organizationId: 'org_alpha' }; |
| 18 | +const URL_ = 'http://localhost/api/v1/auth/update-user'; |
| 19 | +const bind = { method: 'POST', path: '/api/v1/auth/update-user', run: { objectName: 'sys_user', actionName: 'update_my_profile' }, agent: AGENT }; |
| 20 | + |
| 21 | +/** A Hono-shaped context: `c.req.raw` and a writable `c.res`. */ |
| 22 | +const honoCtx = (headers: Record<string, string>) => ({ |
| 23 | + req: { raw: new Request(URL_, { method: 'POST', headers, body: JSON.stringify({ name: 'x' }) }) }, |
| 24 | + res: undefined as Response | undefined, |
| 25 | +}); |
| 26 | + |
| 27 | +/** The plugin's wrapped adapter over an inner one that knows one user and no session. */ |
| 28 | +const wrappedAdapter = (user: Record<string, unknown> | null = { id: 'u_mia', email: 'mia@example.com', banned: false }) => { |
| 29 | + const inner = { |
| 30 | + findOne: vi.fn(async (args: any) => (args.model === 'user' ? user : null)), |
| 31 | + create: vi.fn(), |
| 32 | + }; |
| 33 | + const out: any = agentForwardIdentityViewPlugin().init({ adapter: inner, sessionConfig: { expiresIn: 604800 } }); |
| 34 | + return { inner, adapter: out.context.adapter }; |
| 35 | +}; |
| 36 | + |
| 37 | +describe('[ADR-0090 D10 rule 5] the identity mount: a forward credential becomes a request-scoped view of the delegating user', () => { |
| 38 | + it('a redeemed credential: better-auth reads one opaque bearer and none of the caller\'s identity headers; its lookup answers the delegating user in the consent\'s organization', async () => { |
| 39 | + const { adapter, inner } = wrappedAdapter(); |
| 40 | + let seen: { authorization: string | null; cookie: string | null; forward: string | null; apiKey: string | null } | undefined; |
| 41 | + let session: any; |
| 42 | + let performedBy: unknown; |
| 43 | + let writeCtx: unknown; |
| 44 | + |
| 45 | + await withForwardCredential(bind, async (handle) => { |
| 46 | + const c = honoCtx({ [FORWARD_CREDENTIAL_HEADER]: handle, cookie: 'better-auth.session_token=ambient', 'x-api-key': 'osk_x' }); |
| 47 | + await serveAgentForwardAtIdentityMount(c, async () => { |
| 48 | + const h = c.req.raw.headers; |
| 49 | + seen = { authorization: h.get('authorization'), cookie: h.get('cookie'), forward: h.get(FORWARD_CREDENTIAL_HEADER), apiKey: h.get('x-api-key') }; |
| 50 | + const token = String(seen.authorization).replace(/^Bearer /, ''); |
| 51 | + session = await adapter.findOne({ model: 'session', where: [{ field: 'token', value: token }], join: { user: true } }); |
| 52 | + performedBy = agentForwardPerformedBy(); |
| 53 | + writeCtx = await authSystemWriteContext(); |
| 54 | + c.res = new Response('{}', { headers: { 'set-cookie': 'better-auth.session_token=minted', 'set-auth-token': 'minted', 'content-type': 'application/json' } }); |
| 55 | + }); |
| 56 | + // Nothing that carries a credential leaves the mount for an agent caller. |
| 57 | + expect(c.res!.headers.get('set-cookie')).toBeNull(); |
| 58 | + expect(c.res!.headers.get('set-auth-token')).toBeNull(); |
| 59 | + expect(c.res!.headers.get('content-type')).toBe('application/json'); |
| 60 | + }); |
| 61 | + |
| 62 | + expect(seen!.authorization).toMatch(/^Bearer [A-Za-z0-9_-]{32}$/); |
| 63 | + expect(seen!.cookie).toBeNull(); |
| 64 | + expect(seen!.apiKey).toBeNull(); |
| 65 | + expect(seen!.forward).toBeNull(); |
| 66 | + expect(session).toMatchObject({ userId: 'u_mia', activeOrganizationId: 'org_alpha', user: { id: 'u_mia' } }); |
| 67 | + expect(session.expiresAt.getTime()).toBeGreaterThan(Date.now()); |
| 68 | + // No session of record: the view never wrote one. |
| 69 | + expect(inner.create).not.toHaveBeenCalled(); |
| 70 | + expect(performedBy).toEqual({ clientId: 'agent-client-1' }); |
| 71 | + expect(writeCtx).toMatchObject({ isSystem: true, performedBy: { clientId: 'agent-client-1' } }); |
| 72 | + }); |
| 73 | + |
| 74 | + it('the view\'s bearer is no session anywhere else: outside the request\'s own chain the lookup passes through and finds nothing', async () => { |
| 75 | + const { adapter, inner } = wrappedAdapter(); |
| 76 | + let token = ''; |
| 77 | + await withForwardCredential(bind, async (handle) => { |
| 78 | + const c = honoCtx({ [FORWARD_CREDENTIAL_HEADER]: handle }); |
| 79 | + await serveAgentForwardAtIdentityMount(c, async () => { |
| 80 | + token = String(c.req.raw.headers.get('authorization')).replace(/^Bearer /, ''); |
| 81 | + }); |
| 82 | + }); |
| 83 | + expect(await adapter.findOne({ model: 'session', where: [{ field: 'token', value: token }], join: { user: true } })).toBeNull(); |
| 84 | + expect(inner.findOne).toHaveBeenCalledWith(expect.objectContaining({ model: 'session' })); |
| 85 | + expect(agentForwardPerformedBy()).toBeUndefined(); |
| 86 | + }); |
| 87 | + |
| 88 | + it('a banned or missing delegating user has no view', async () => { |
| 89 | + for (const user of [{ id: 'u_mia', banned: true, banExpires: null }, null]) { |
| 90 | + const { adapter } = wrappedAdapter(user); |
| 91 | + await withForwardCredential(bind, async (handle) => { |
| 92 | + const c = honoCtx({ [FORWARD_CREDENTIAL_HEADER]: handle }); |
| 93 | + await serveAgentForwardAtIdentityMount(c, async () => { |
| 94 | + const token = String(c.req.raw.headers.get('authorization')).replace(/^Bearer /, ''); |
| 95 | + expect(await adapter.findOne({ model: 'session', where: [{ field: 'token', value: token }], join: { user: true } })).toBeNull(); |
| 96 | + }); |
| 97 | + }); |
| 98 | + } |
| 99 | + }); |
| 100 | + |
| 101 | + it('a credential that does not redeem (from outside, or for another route) is dropped and the request resolves on its other headers alone', async () => { |
| 102 | + const outside = honoCtx({ [FORWARD_CREDENTIAL_HEADER]: 'A'.repeat(43), cookie: 'c=1' }); |
| 103 | + await serveAgentForwardAtIdentityMount(outside, async () => { |
| 104 | + expect(outside.req.raw.headers.get(FORWARD_CREDENTIAL_HEADER)).toBeNull(); |
| 105 | + expect(outside.req.raw.headers.get('authorization')).toBeNull(); |
| 106 | + expect(outside.req.raw.headers.get('cookie')).toBe('c=1'); |
| 107 | + expect(agentForwardPerformedBy()).toBeUndefined(); |
| 108 | + }); |
| 109 | + |
| 110 | + await withForwardCredential({ ...bind, path: '/api/v1/auth/admin/ban-user' }, async (handle) => { |
| 111 | + const c = honoCtx({ [FORWARD_CREDENTIAL_HEADER]: handle }); |
| 112 | + await serveAgentForwardAtIdentityMount(c, async () => { |
| 113 | + expect(c.req.raw.headers.get('authorization')).toBeNull(); |
| 114 | + expect(agentForwardPerformedBy()).toBeUndefined(); |
| 115 | + }); |
| 116 | + }); |
| 117 | + }); |
| 118 | + |
| 119 | + it('no credential presented: the request passes through untouched', async () => { |
| 120 | + const c = honoCtx({ authorization: 'Bearer person_session' }); |
| 121 | + const before = c.req.raw; |
| 122 | + await serveAgentForwardAtIdentityMount(c, async () => undefined); |
| 123 | + expect(c.req.raw).toBe(before); |
| 124 | + }); |
| 125 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments