fix(auth): tighten bridge claim protocol

backend/test/windows-auth-storage.test.ts

@@ -1,10 +1,63 @@
+import { appendFileSync, chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { EventEmitter } from "node:events";
 import { PassThrough } from "node:stream";
-import { describe, expect, test, vi } from "vitest";
+import { afterEach, describe, expect, test, vi } from "vitest";
 import { createWindowsAuthStorageBridge } from "../src/auth/windows-auth-storage.js";
 
 const root = "C:\\ProgramData\\ThothII\\auth";
 const filename = "a".repeat(64) + ".json";
+const realChildFixture = fileURLToPath(new URL("./fixtures/windows-auth-storage-real-child.mjs", import.meta.url));
+const fixtureRoots: string[] = [];
+
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+
+async function waitForMarker(marker: string, expected: string): Promise<void> {
+  const deadline = Date.now() + 3_000;
+  while (Date.now() < deadline) {
+    if (existsSync(marker) && readFileSync(marker, "utf8").includes(expected)) return;
+    await new Promise<void>((resolve) => setTimeout(resolve, 10));
+  }
+  throw new Error(`real helper marker did not contain ${expected}`);
+}
+
+function realChildBridge(mode: "timeout" | "stdout" | "stderr" | "stdin") {
+  const directory = mkdtempSync(join(tmpdir(), "thothii-auth-bridge-child-"));
+  fixtureRoots.push(directory);
+  const marker = join(directory, "marker.txt");
+  const launcher = join(directory, "tht.exe");
+  writeFileSync(launcher, `#!/bin/sh\nexec ${shellQuote(process.execPath)} ${shellQuote(realChildFixture)} ${shellQuote(mode)} ${shellQuote(marker)} "$@"\n`, { mode: 0o700 });
+  chmodSync(launcher, 0o700);
+  return {
+    marker,
+    bridge: createWindowsAuthStorageBridge({
+      thtExecutable: "C:\\tht.exe",
+      spawnChild: (_executable, args, options) => spawn(launcher, [...args], options),
+      ...(mode === "stdin" ? {
+        beforeInputForTest: async () => {
+          await waitForMarker(marker, "stdin-closed");
+          appendFileSync(marker, "before-input\n");
+        },
+      } : {}),
+    } as never),
+  };
+}
+
+afterEach(() => {
+  for (const directory of fixtureRoots.splice(0)) {
+    const marker = join(directory, "marker.txt");
+    try {
+      const pid = Number(/^started:(\d+)$/m.exec(readFileSync(marker, "utf8"))?.[1]);
+      if (Number.isSafeInteger(pid) && pid > 0) process.kill(pid, "SIGKILL");
+    } catch { /* the test-owned child already exited or did not start */ }
+    rmSync(directory, { recursive: true, force: true });
+  }
+});
 
 class FakeBridgeChild extends EventEmitter {
   readonly stdin = new PassThrough();
@@ -110,6 +163,52 @@ describe("Windows auth-storage bridge", () => {
     ]);
   });
 
+  test("parses the Go helper's required empty entries array", async () => {
+    const bridge = createWindowsAuthStorageBridge({
+      thtExecutable: "C:\\tht.exe",
+      invoke: async () => ({
+        code: 0,
+        stdout: Buffer.from('{"version":1,"ok":true,"entries":[]}\n'),
+        stderr: Buffer.alloc(0),
+      }),
+    });
+
+    await expect(bridge.list(root, "sessions")).resolves.toEqual([]);
+  });
+
+  test("allows only canonical OIDC claim removal and rejects claims elsewhere", async () => {
+    const claim = `${"b".repeat(64)}.claim`;
+    const invoke = vi.fn(async () => ({
+      code: 0,
+      stdout: Buffer.from('{"version":1,"ok":true,"removed":true}\n'),
+      stderr: Buffer.alloc(0),
+    }));
+    const bridge = createWindowsAuthStorageBridge({ thtExecutable: "C:\\tht.exe", invoke });
+
+    await expect(bridge.remove(root, "oidc", claim)).resolves.toBe(true);
+    await expect(bridge.remove(root, "sessions", claim)).rejects.toThrow("auth_session_store_invalid");
+    await expect(bridge.read(root, "oidc", claim)).rejects.toThrow("auth_session_store_invalid");
+    await expect(bridge.create(root, "oidc", claim, Buffer.from("record"))).rejects.toThrow("auth_session_store_invalid");
+    await expect(bridge.replace(root, "oidc", claim, Buffer.from("record"))).rejects.toThrow("auth_session_store_invalid");
+    await expect(bridge.remove(root, "oidc", `../${claim}`)).rejects.toThrow("auth_session_store_invalid");
+    await expect(bridge.remove(root, "oidc", `${claim}.bak`)).rejects.toThrow("auth_session_store_invalid");
+    expect(invoke).toHaveBeenCalledTimes(1);
+  });
+
+  test("rejects OIDC claim entries returned for a sessions list", async () => {
+    const claim = `${"c".repeat(64)}.claim`;
+    const bridge = createWindowsAuthStorageBridge({
+      thtExecutable: "C:\\tht.exe",
+      invoke: async () => ({
+        code: 0,
+        stdout: Buffer.from(`{"version":1,"ok":true,"entries":[{"name":"${claim}","modifiedUnixMs":1}]}\n`),
+        stderr: Buffer.alloc(0),
+      }),
+    });
+
+    await expect(bridge.list(root, "sessions")).rejects.toThrow("auth_session_store_invalid");
+  });
+
   test("aborts a stdin-closed looping helper on timeout and waits for close", async () => {
     vi.useFakeTimers();
     const child = new FakeBridgeChild();
@@ -189,4 +288,17 @@ describe("Windows auth-storage bridge", () => {
 
     await expect(bridge.list(root, "sessions")).rejects.toThrow("auth_session_store_invalid");
   });
+
+  test.each(["timeout", "stdout", "stderr", "stdin"] as const)("kills a real %s helper process through the production spawn path", async (mode) => {
+    const { bridge, marker } = realChildBridge(mode);
+    const startedAt = Date.now();
+    const pending = bridge.list(root, "sessions");
+    const outcome = pending.then(() => undefined, (error: unknown) => error);
+    await waitForMarker(marker, "started");
+    if (mode === "stdin") await waitForMarker(marker, "before-input");
+
+    await expect(outcome).resolves.toMatchObject({ message: "auth_session_store_invalid" });
+    await waitForMarker(marker, "terminated");
+    if (mode === "stdin") expect(Date.now() - startedAt).toBeLessThan(2_000);
+  }, 10_000);
 });