CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-17 02:15:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(pairing): reject reserved clientId 'root' at all token writers

Browse Source 
'root' is the sentinel checkScope/checkDomain/checkRate and the server
command gate use for the omnipotent caller, so a scoped token carrying it
bypasses every enforcement path. Add ReservedClientIdError + a shared
assertValidClientId; createToken/createSetupKey throw, restoreRegistry
skips-and-logs (a corrupt state file must not brick boot). /pair and /token
surface it as a named 400, and the CLI fast-fails --client root.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-21 15:15:11 -07:00
committed by Garry Tan
co-authored by Claude Fable 5
parent 51932eceef
commit 783504d7ea
5 changed files with 110 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browse/test/pair-agent-e2e.test.ts
+27
View File
@@ -291,6 +291,33 @@ describe('pair-agent flow end-to-end (HTTP only, no ngrok)', () => {
expect(body.hint).not.toContain('--admin');
});
// ─── D2: reserved clientId is rejected with a named 400 ───────────────
test('POST /pair with clientId "root" returns 400 naming the reservation', async () => {
const resp = await fetch(`${daemon.baseUrl}/pair`, {
method: 'POST',
headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${daemon.token}` },
body: JSON.stringify({ clientId: 'root' }),
});
expect(resp.status).toBe(400);
const body = await resp.json() as any;
// The reservation is named, NOT hidden behind the generic "Invalid request body".
expect(body.error).toContain('root');
expect(body.error).not.toBe('Invalid request body');
});
test('POST /token with clientId "root" returns 400 naming the reservation', async () => {
const resp = await fetch(`${daemon.baseUrl}/token`, {
method: 'POST',
headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${daemon.token}` },
body: JSON.stringify({ clientId: 'root' }),
});
expect(resp.status).toBe(400);
const body = await resp.json() as any;
expect(body.error).toContain('root');
expect(body.error).not.toBe('Invalid request body');
});
// ─── Revocation e2e: revoke-all + the /agents verification surface ────
test('DELETE /token revokes session AND setup keys; agent leaves /agents; token 401s; re-connect fails', async () => {