import * as NodeCrypto from "node:crypto";import type { RelayEnvironmentLinkProofPayload, RelayEnvironmentLinkRequest,} from "@t3tools/contracts/relay";import { RELAY_LINK_PROOF_TYP } from "@t3tools/shared/relayJwt";import { describe, expect, it } from "@effect/vitest";import * as DateTime from "effect/DateTime";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Redacted from "effect/Redacted";import * as Result from "effect/Result"; import * as DpopProofs from "../auth/DpopProofs.ts";import * as RelayTokens from "../auth/RelayTokens.ts";import * as EnvironmentCredentials from "./EnvironmentCredentials.ts";import * as EnvironmentLinks from "./EnvironmentLinks.ts";import * as RelayConfiguration from "../Config.ts";import * as EnvironmentLinker from "./EnvironmentLinker.ts";import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts"; const relayKeyPair = NodeCrypto.generateKeyPairSync("ed25519", { privateKeyEncoding: { format: "pem", type: "pkcs8" }, publicKeyEncoding: { format: "pem", type: "spki" },});const environmentKeyPair = NodeCrypto.generateKeyPairSync("ed25519", { privateKeyEncoding: { format: "pem", type: "pkcs8" }, publicKeyEncoding: { format: "pem", type: "spki" },});const config = RelayConfiguration.RelayConfiguration.of({ relayIssuer: "https://relay.example.test", apns: { environment: "sandbox", teamId: "team-id", keyId: "key-id", privateKey: Redacted.make("private-key"), bundleId: "com.t3tools.t3code.dev", }, apnsDeliveryJobSigningSecret: Redacted.make("job-secret"), clerkSecretKey: Redacted.make("clerk-secret"), clerkPublishableKey: "pk_test_test", clerkJwtAudience: "t3-code-relay", cloudMintPrivateKey: Redacted.make(relayKeyPair.privateKey), cloudMintPublicKey: relayKeyPair.publicKey, managedEndpointBaseDomain: undefined, managedEndpointNamespace: undefined,}); function signTestJwt(payload: object, typ: string, privateKey: string): string { const header = Buffer.from(JSON.stringify({ alg: "EdDSA", typ })).toString("base64url"); const encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url"); const signingInput = `${header}.${encodedPayload}`; return `${signingInput}.${NodeCrypto.sign(null, Buffer.from(signingInput), privateKey).toString("base64url")}`;} const makeRequest = Effect.gen(function* () { const now = yield* DateTime.now; const expiresAt = DateTime.add(now, { minutes: 5 }); const relayTokens = yield* RelayTokens.RelayTokens; const challenge = yield* relayTokens.issueLinkChallenge({ userId: "user_123", request: { notificationsEnabled: true, liveActivitiesEnabled: true, managedTunnelsEnabled: true, }, jti: "challenge-jti", issuedAtEpochSeconds: Math.floor(now.epochMilliseconds / 1_000), expiresAtEpochSeconds: Math.floor(expiresAt.epochMilliseconds / 1_000), }); const payload = { iss: "t3-env:env-link-test", aud: "https://relay.example.test", sub: "env-link-test", jti: "link-proof-jti", iat: Math.floor(now.epochMilliseconds / 1_000), exp: Math.floor(expiresAt.epochMilliseconds / 1_000), challenge, environmentId: "env-link-test" as RelayEnvironmentLinkProofPayload["environmentId"], descriptor: { environmentId: "env-link-test" as RelayEnvironmentLinkProofPayload["environmentId"], label: "Link Test Environment", platform: { os: "darwin", arch: "arm64" }, serverVersion: "0.0.0-test", capabilities: { repositoryIdentity: true }, }, environmentPublicKey: environmentKeyPair.publicKey.trim(), endpoint: { httpBaseUrl: "https://env.example.test/", wsBaseUrl: "wss://env.example.test/", providerKind: "manual", }, origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 }, scopes: ["agent_activity_notifications", "managed_tunnels"], } satisfies RelayEnvironmentLinkProofPayload; return { request: { proof: signTestJwt(payload, RELAY_LINK_PROOF_TYP, environmentKeyPair.privateKey), notificationsEnabled: true, liveActivitiesEnabled: true, managedTunnelsEnabled: false, } satisfies RelayEnvironmentLinkRequest, payload, };}); function testLayer(input?: { readonly upsert?: EnvironmentLinks.EnvironmentLinks["Service"]["upsert"]; readonly consume?: DpopProofs.DpopProofReplay["Service"]["consume"];}) { return EnvironmentLinker.layer.pipe( Layer.provideMerge(RelayTokens.layer), Layer.provide( Layer.mergeAll( RelayConfiguration.layer(config), Layer.succeed(DpopProofs.DpopProofReplay, { verifyAndConsume: () => Effect.die("unexpected DPoP proof verification"), consume: input?.consume ?? (() => Effect.succeed(true)), pruneExpired: Effect.void, }), Layer.succeed(EnvironmentLinks.EnvironmentLinks, { upsert: input?.upsert ?? (() => Effect.void), listUsersForEnvironment: () => Effect.succeed([]), listDeliveryUsersForEnvironment: () => Effect.succeed([]), listPublicKeysForEnvironment: () => Effect.succeed([]), listForUser: () => Effect.succeed([]), getForUser: () => Effect.succeed(null), revokeForUser: () => Effect.succeed(false), }), Layer.succeed(EnvironmentCredentials.EnvironmentCredentials, { create: () => Effect.succeed("t3env_credential_secret"), authenticate: () => Effect.succeedNone, revokeForEnvironmentPublicKey: () => Effect.succeed(false), }), Layer.succeed(ManagedEndpointProvider.ManagedEndpointProvider, { deprovision: () => Effect.void, provision: () => Effect.succeed({ endpoint: { httpBaseUrl: "https://managed.example.test/", wsBaseUrl: "wss://managed.example.test/ws", providerKind: "cloudflare_tunnel", }, runtime: { providerKind: "cloudflare_tunnel", connectorToken: "connector-token" }, }), }), ), ), );} describe("EnvironmentLinker", () => { it.effect("uses verified JWT claims when linking an environment", () => { let persistedEnvironmentId: string | null = null; return Effect.gen(function* () { const { request, payload } = yield* makeRequest; const linker = yield* EnvironmentLinker.EnvironmentLinker; const result = yield* linker.link({ userId: "user_123", request }); expect(result.environmentId).toBe(payload.environmentId); expect(result.environmentCredential).toBe("t3env_credential_secret"); expect(persistedEnvironmentId).toBe(payload.environmentId); }).pipe( Effect.provide( testLayer({ upsert: (input) => Effect.sync(() => { persistedEnvironmentId = input.proof.environmentId; }), }), ), ); }); it.effect("rejects a tampered compact proof before persistence", () => { let persisted = false; return Effect.gen(function* () { const { request } = yield* makeRequest; const segments = request.proof.split("."); const signature = segments[2]!; segments[2] = `${signature.startsWith("A") ? "B" : "A"}${signature.slice(1)}`; const tampered = { ...request, proof: segments.join(".") }; const linker = yield* EnvironmentLinker.EnvironmentLinker; const result = yield* Effect.result(linker.link({ userId: "user_123", request: tampered })); expect(Result.isFailure(result)).toBe(true); expect(persisted).toBe(false); }).pipe( Effect.provide( testLayer({ upsert: () => Effect.sync(() => { persisted = true; }), }), ), ); }); it.effect("rejects replayed JWT ids", () => Effect.gen(function* () { const { request } = yield* makeRequest; const linker = yield* EnvironmentLinker.EnvironmentLinker; const result = yield* Effect.result(linker.link({ userId: "user_123", request })); expect(Result.isFailure(result)).toBe(true); }).pipe(Effect.provide(testLayer({ consume: () => Effect.succeed(false) }))), );});
import * as NodeCrypto from "node:crypto";
import type {
RelayEnvironmentLinkProofPayload,
RelayEnvironmentLinkRequest,
} from "@t3tools/contracts/relay";
import { RELAY_LINK_PROOF_TYP } from "@t3tools/shared/relayJwt";
import { describe, expect, it } from "@effect/vitest";
import * as DateTime from "effect/DateTime";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Redacted from "effect/Redacted";
import * as Result from "effect/Result";
import * as DpopProofs from "../auth/DpopProofs.ts";
import * as RelayTokens from "../auth/RelayTokens.ts";
import * as EnvironmentCredentials from "./EnvironmentCredentials.ts";
import * as EnvironmentLinks from "./EnvironmentLinks.ts";
import * as RelayConfiguration from "../Config.ts";
import * as EnvironmentLinker from "./EnvironmentLinker.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
const relayKeyPair = NodeCrypto.generateKeyPairSync("ed25519", {
privateKeyEncoding: { format: "pem", type: "pkcs8" },
publicKeyEncoding: { format: "pem", type: "spki" },
});
const environmentKeyPair = NodeCrypto.generateKeyPairSync("ed25519", {
privateKeyEncoding: { format: "pem", type: "pkcs8" },
publicKeyEncoding: { format: "pem", type: "spki" },
});
const config = RelayConfiguration.RelayConfiguration.of({
relayIssuer: "https://relay.example.test",
apns: {
environment: "sandbox",
teamId: "team-id",
keyId: "key-id",
privateKey: Redacted.make("private-key"),
bundleId: "com.t3tools.t3code.dev",
},
apnsDeliveryJobSigningSecret: Redacted.make("job-secret"),
clerkSecretKey: Redacted.make("clerk-secret"),
clerkPublishableKey: "pk_test_test",
clerkJwtAudience: "t3-code-relay",
cloudMintPrivateKey: Redacted.make(relayKeyPair.privateKey),
cloudMintPublicKey: relayKeyPair.publicKey,
managedEndpointBaseDomain: undefined,
managedEndpointNamespace: undefined,
});
function signTestJwt(payload: object, typ: string, privateKey: string): string {
const header = Buffer.from(JSON.stringify({ alg: "EdDSA", typ })).toString("base64url");
const encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url");
const signingInput = `${header}.${encodedPayload}`;
return `${signingInput}.${NodeCrypto.sign(null, Buffer.from(signingInput), privateKey).toString("base64url")}`;
}
const makeRequest = Effect.gen(function* () {
const now = yield* DateTime.now;
const expiresAt = DateTime.add(now, { minutes: 5 });
const relayTokens = yield* RelayTokens.RelayTokens;
const challenge = yield* relayTokens.issueLinkChallenge({
userId: "user_123",
request: {
notificationsEnabled: true,
liveActivitiesEnabled: true,
managedTunnelsEnabled: true,
},
jti: "challenge-jti",
issuedAtEpochSeconds: Math.floor(now.epochMilliseconds / 1_000),
expiresAtEpochSeconds: Math.floor(expiresAt.epochMilliseconds / 1_000),
});
const payload = {
iss: "t3-env:env-link-test",
aud: "https://relay.example.test",
sub: "env-link-test",
jti: "link-proof-jti",
iat: Math.floor(now.epochMilliseconds / 1_000),
exp: Math.floor(expiresAt.epochMilliseconds / 1_000),
challenge,
environmentId: "env-link-test" as RelayEnvironmentLinkProofPayload["environmentId"],
descriptor: {
environmentId: "env-link-test" as RelayEnvironmentLinkProofPayload["environmentId"],
label: "Link Test Environment",
platform: { os: "darwin", arch: "arm64" },
serverVersion: "0.0.0-test",
capabilities: { repositoryIdentity: true },
},
environmentPublicKey: environmentKeyPair.publicKey.trim(),
endpoint: {
httpBaseUrl: "https://env.example.test/",
wsBaseUrl: "wss://env.example.test/",
providerKind: "manual",
},
origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
scopes: ["agent_activity_notifications", "managed_tunnels"],
} satisfies RelayEnvironmentLinkProofPayload;
return {
request: {
proof: signTestJwt(payload, RELAY_LINK_PROOF_TYP, environmentKeyPair.privateKey),
notificationsEnabled: true,
liveActivitiesEnabled: true,
managedTunnelsEnabled: false,
} satisfies RelayEnvironmentLinkRequest,
payload,
};
});
function testLayer(input?: {
readonly upsert?: EnvironmentLinks.EnvironmentLinks["Service"]["upsert"];
readonly consume?: DpopProofs.DpopProofReplay["Service"]["consume"];
}) {
return EnvironmentLinker.layer.pipe(
Layer.provideMerge(RelayTokens.layer),
Layer.provide(
Layer.mergeAll(
RelayConfiguration.layer(config),
Layer.succeed(DpopProofs.DpopProofReplay, {
verifyAndConsume: () => Effect.die("unexpected DPoP proof verification"),
consume: input?.consume ?? (() => Effect.succeed(true)),
pruneExpired: Effect.void,
}),
Layer.succeed(EnvironmentLinks.EnvironmentLinks, {
upsert: input?.upsert ?? (() => Effect.void),
listUsersForEnvironment: () => Effect.succeed([]),
listDeliveryUsersForEnvironment: () => Effect.succeed([]),
listPublicKeysForEnvironment: () => Effect.succeed([]),
listForUser: () => Effect.succeed([]),
getForUser: () => Effect.succeed(null),
revokeForUser: () => Effect.succeed(false),
}),
Layer.succeed(EnvironmentCredentials.EnvironmentCredentials, {
create: () => Effect.succeed("t3env_credential_secret"),
authenticate: () => Effect.succeedNone,
revokeForEnvironmentPublicKey: () => Effect.succeed(false),
}),
Layer.succeed(ManagedEndpointProvider.ManagedEndpointProvider, {
deprovision: () => Effect.void,
provision: () =>
Effect.succeed({
endpoint: {
httpBaseUrl: "https://managed.example.test/",
wsBaseUrl: "wss://managed.example.test/ws",
providerKind: "cloudflare_tunnel",
},
runtime: { providerKind: "cloudflare_tunnel", connectorToken: "connector-token" },
}),
}),
),
),
);
}
describe("EnvironmentLinker", () => {
it.effect("uses verified JWT claims when linking an environment", () => {
let persistedEnvironmentId: string | null = null;
return Effect.gen(function* () {
const { request, payload } = yield* makeRequest;
const linker = yield* EnvironmentLinker.EnvironmentLinker;
const result = yield* linker.link({ userId: "user_123", request });
expect(result.environmentId).toBe(payload.environmentId);
expect(result.environmentCredential).toBe("t3env_credential_secret");
expect(persistedEnvironmentId).toBe(payload.environmentId);
}).pipe(
Effect.provide(
testLayer({
upsert: (input) =>
Effect.sync(() => {
persistedEnvironmentId = input.proof.environmentId;
}),
}),
),
);
});
it.effect("rejects a tampered compact proof before persistence", () => {
let persisted = false;
return Effect.gen(function* () {
const { request } = yield* makeRequest;
const segments = request.proof.split(".");
const signature = segments[2]!;
segments[2] = `${signature.startsWith("A") ? "B" : "A"}${signature.slice(1)}`;
const tampered = { ...request, proof: segments.join(".") };
const linker = yield* EnvironmentLinker.EnvironmentLinker;
const result = yield* Effect.result(linker.link({ userId: "user_123", request: tampered }));
expect(Result.isFailure(result)).toBe(true);
expect(persisted).toBe(false);
}).pipe(
Effect.provide(
testLayer({
upsert: () =>
Effect.sync(() => {
persisted = true;
}),
}),
),
);
});
it.effect("rejects replayed JWT ids", () =>
Effect.gen(function* () {
const { request } = yield* makeRequest;
const linker = yield* EnvironmentLinker.EnvironmentLinker;
const result = yield* Effect.result(linker.link({ userId: "user_123", request }));
expect(Result.isFailure(result)).toBe(true);
}).pipe(Effect.provide(testLayer({ consume: () => Effect.succeed(false) }))),
);
});