ThothII/backend/test/auth-diagnostic-command.test.ts

import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterEach, expect, test, vi } from "vitest";
import type { AuthDiagnoser, AuthDiagnostics } from "../src/auth/diagnostics.js";
import {
  configuredSecretValues,
  createConfiguredAuthDiagnoser,
  runConfiguredDiagnosticCommand,
  runDiagnosticCommand,
} from "../src/auth/diagnostic-command.js";
import type { AppConfig } from "../src/config.js";
import type { LoadedAuthConfig } from "../src/auth/types.js";

const roots: string[] = [];
afterEach(() => { for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true }); });

function secretBundle(contents: string): string {
  const root = mkdtempSync(join(tmpdir(), "thothii-diagnostic-command-"));
  roots.push(root);
  const file = join(root, "secrets");
  writeFileSync(file, contents, { mode: 0o600 });
  chmodSync(file, 0o600);
  return file;
}

function configuredOidc(groups: readonly string[]): AuthDiagnoser {
  const loaded: LoadedAuthConfig = {
    revision: "a".repeat(64),
    sourcePath: "/safe/auth.yaml",
    value: {
      version: 1,
      mode: "oidc",
      publicUrl: "https://thothii.example.test",
      session: { regularTtlSeconds: 1, regularIdleSeconds: 1, rememberTtlSeconds: 1, rememberIdleSeconds: 1, oidcTtlSeconds: 1 },
      oidc: {
        issuer: "https://issuer.example.test", clientId: "thothii",
        clientSecretRef: "THT_OIDC_CLIENT_SECRET", scopes: ["openid"], groupsClaim: "groups",
      },
      groupCatalog: {
        driver: "authentik", baseUrl: "https://authentik.example.test",
        apiTokenRef: "THT_AUTHENTIK_API_TOKEN",
      },
      authorization: { groupRoles: { "Thoth Users": ["user"], "Thoth Administrators": ["admin"] } },
    },
  };
  const config = {
    authMode: "oidc",
    authStateRoot: "/safe/auth-state",
    authentication: { current: () => loaded },
    secretsFile: secretBundle("THT_OIDC_CLIENT_SECRET=oidc-secret\nTHT_AUTHENTIK_API_TOKEN=catalog-secret\n"),
    secretFiles: {},
  } as AppConfig;
  return createConfiguredAuthDiagnoser(config, {
    sessionRootValidator: async () => undefined,
    groupCatalog: () => ({ verifyConfiguredGroups: async () => [] }),
    oidcProtocol: () => ({
      diagnose: async () => undefined,
      authorizationUrl: async () => new URL("https://issuer.example.test/authorize"),
      callback: async () => { throw new Error("not used"); },
      verifyDeviceFlow: async () => ({
        issuer: "https://issuer.example.test", subject: "subject", groups,
        tokenExpiresAt: new Date(Date.now() + 60_000),
      }),
    }),
  } as any);
}

const failure: AuthDiagnostics = {
  ready: false,
  mode: "oidc",
  checks: [{
    level: "error",
    code: "oidc_mapped_group_missing",
    field: "Thoth Administrators",
    message: "A configured authorization group does not exist: command-secret-sentinel.",
  }],
};

test("writes one redacted JSON diagnostic report and uses a failing diagnostic exit status", async () => {
  const stdout: string[] = [];
  const stderr: string[] = [];
  const diagnoser: AuthDiagnoser = { inspect: vi.fn(async () => failure) };

  const exitCode = await runDiagnosticCommand(["--json"], {
    diagnoser,
    secretValues: ["command-secret-sentinel"],
    stdout: (line) => stdout.push(line),
    stderr: (line) => stderr.push(line),
  });

  expect(exitCode).toBe(1);
  expect(diagnoser.inspect).toHaveBeenCalledWith({ live: true });
  expect(stderr).toEqual([]);
  expect(stdout).toHaveLength(1);
  expect(JSON.parse(stdout[0])).toEqual({
    ...failure,
    checks: [{
      ...failure.checks[0],
      message: "A configured authorization group does not exist: [REDACTED].",
    }],
  });
  expect(stdout.join("\n")).not.toContain("command-secret-sentinel");
});

test("delegates an interactive diagnostic to OIDC and keeps its device prompt on stderr", async () => {
  const stdout: string[] = [];
  const stderr: string[] = [];
  const ready: AuthDiagnostics = {
    ready: true,
    mode: "oidc",
    checks: [{ level: "info", code: "auth_ready", message: "Authentication is ready." }],
  };
  const diagnoser: AuthDiagnoser = {
    inspect: vi.fn(async (options) => {
      options.presentDeviceCode?.("https://issuer.example.test/device", "ABCD-EFGH");
      return ready;
    }),
  };

  const exitCode = await runDiagnosticCommand(["--json", "--interactive"], {
    diagnoser,
    stdout: (line) => stdout.push(line),
    stderr: (line) => stderr.push(line),
  });

  expect(exitCode).toBe(0);
  expect(diagnoser.inspect).toHaveBeenCalledWith(expect.objectContaining({ live: true, interactive: true }));
  expect(stderr).toEqual(["Open https://issuer.example.test/device and enter code ABCD-EFGH"]);
  expect(JSON.parse(stdout.join(""))).toEqual(ready);
});

test("fails a direct-group identity that maps to zero Thoth roles without exposing provider groups", async () => {
  const unmapped = "Unmapped Provider Group SECRET-SENTINEL";
  const report = await configuredOidc([unmapped]).inspect({
    live: true,
    interactive: true,
    presentDeviceCode: () => undefined,
  });

  expect(report).toEqual({
    ready: false,
    mode: "oidc",
    checks: [{
      level: "error",
      code: "oidc_groups_claim_invalid",
      message: "The OIDC device-flow identity could not be validated.",
    }],
  });
  expect(JSON.stringify(report)).not.toContain(unmapped);
});

test("accepts a direct-group identity with at least one exact configured role mapping", async () => {
  const report = await configuredOidc(["Thoth Users", "Unmapped Provider Group"]).inspect({
    live: true,
    interactive: true,
    presentDeviceCode: () => undefined,
  });

  expect(report).toMatchObject({ ready: true, checks: [{ code: "auth_ready" }] });
  expect(JSON.stringify(report)).not.toContain("Unmapped Provider Group");
});

test("redacts every parsed mounted secret before writing an interactive prompt", async () => {
  const modelSecret = "model-secret-SENTINEL";
  const deviceCode = "DEVICE-CODE-SENTINEL";
  const legacyVectorSecret = "legacy-vector-secret-SENTINEL";
  const config = {
    secretsFile: secretBundle([
      `THT_MODEL_API_KEY=${modelSecret}`,
      `THT_DWH_API_KEY=${deviceCode}`,
      "THT_OIDC_CLIENT_SECRET=oidc-secret",
      "THT_AUTHENTIK_API_TOKEN=catalog-secret",
      "",
    ].join("\n")),
    secretFiles: { THT_VEC_API_KEY_SECRET_FILE: secretBundle(legacyVectorSecret) },
  } as AppConfig;
  const secrets = configuredSecretValues(config);
  const stdout: string[] = [];
  const stderr: string[] = [];

  await runDiagnosticCommand(["--json", "--interactive"], {
    diagnoser: {
      inspect: async (request) => {
        request.presentDeviceCode?.(
          `https://issuer.example.test/device/${modelSecret}?legacy=${legacyVectorSecret}`,
          deviceCode,
        );
        return { ready: true, mode: "oidc", checks: [{ level: "info", code: "auth_ready", message: "Authentication is ready." }] };
      },
    },
    secretValues: secrets,
    stdout: (line) => stdout.push(line),
    stderr: (line) => stderr.push(line),
  });

  expect(secrets).toEqual(expect.arrayContaining([
    modelSecret, deviceCode, legacyVectorSecret, "oidc-secret", "catalog-secret",
  ]));
  expect(stdout.join("") + stderr.join("")).not.toContain(modelSecret);
  expect(stdout.join("") + stderr.join("")).not.toContain(deviceCode);
  expect(stdout.join("") + stderr.join("")).not.toContain(legacyVectorSecret);
});

test("includes every nested Pi authentication scalar in the direct-command redaction corpus", () => {
  const piApiKey = "pi-api-key-SENTINEL";
  const piAccessToken = "pi-access-token-SENTINEL";
  const piAuthFile = secretBundle(JSON.stringify({
    providers: {
      anthropic: {
        key: piApiKey,
        oauth: { access: piAccessToken, expires: 1_800_000_000 },
      },
    },
  }));
  const config = {
    secretsFile: secretBundle("THT_MODEL_API_KEY=model-secret\n"),
    secretFiles: {},
    piAuthFile,
  } as AppConfig;

  expect(configuredSecretValues(config)).toEqual(expect.arrayContaining([
    "model-secret", piApiKey, piAccessToken,
  ]));
});

test("fails closed when any declared direct-command secret source cannot be loaded", () => {
  const root = mkdtempSync(join(tmpdir(), "thothii-diagnostic-command-missing-"));
  roots.push(root);
  const config = {
    secretsFile: secretBundle("THT_MODEL_API_KEY=model-secret\n"),
    secretFiles: {},
    piAuthFile: join(root, "missing-pi-auth.json"),
  } as AppConfig;

  expect(() => configuredSecretValues(config)).toThrow("diagnostic secret corpus is unavailable");
});

test("suppresses interactive prompt forwarding when the production secret preflight is incomplete", async () => {
  const root = mkdtempSync(join(tmpdir(), "thothii-diagnostic-command-preflight-"));
  roots.push(root);
  const stdout: string[] = [];
  const stderr: string[] = [];

  const exitCode = await runConfiguredDiagnosticCommand(
    ["--json", "--interactive"],
    { NODE_ENV: "test", AUTH_MODE: "none", THT_PI_AUTH_FILE: join(root, "missing-auth.json") },
    (line) => stdout.push(line),
    (line) => stderr.push(line),
  );

  expect(exitCode).toBe(1);
  expect(stderr).toEqual([]);
  expect(stdout).toHaveLength(1);
  expect(JSON.parse(stdout[0])).toMatchObject({ ready: false, checks: [{ code: "auth_config_invalid" }] });
});

test.each([
  {
    ready: true, mode: "oidc", checks: [{ level: "error", code: "oidc_secret_missing", message: "attacker-message" }],
  },
  {
    ready: false, mode: "oidc", checks: [{ level: "info", code: "auth_ready", message: "attacker-message" }],
  },
  {
    ready: false, mode: "oidc", checks: [
      { level: "error", code: "oidc_secret_missing", message: "one" },
      { level: "error", code: "oidc_secret_missing", message: "duplicate-attacker" },
    ],
  },
  {
    ready: false, mode: "oidc", checks: [{
      level: "error", code: "oidc_secret_missing", message: "failure", field: "attacker-field-SENTINEL",
    }],
  },
])("fails closed on a hostile semantic report %#", async (hostile) => {
  const stdout: string[] = [];
  const exitCode = await runDiagnosticCommand(["--json"], {
    diagnoser: { inspect: async () => hostile as AuthDiagnostics },
    stdout: (line) => stdout.push(line),
    stderr: () => undefined,
  });

  expect(exitCode).toBe(1);
  expect(JSON.parse(stdout.join(""))).toEqual({
    ready: false,
    mode: "none",
    checks: [{ level: "error", code: "auth_config_invalid", message: "Authentication configuration is unavailable." }],
  });
  expect(stdout.join("")).not.toMatch(/attacker|duplicate/i);
});