pig/apps/api/test/learn.test.ts

/**
 * Tests for the Learn boundary.
 *
 * The one that matters is `learn token is not a credential for anything else`.
 * Every other assertion here is supporting evidence for it: the design's whole
 * claim is that a code-holder cannot become a principal, and the way that
 * claim fails in practice is not a dramatic bug — it is somebody later
 * deciding it would be simpler to mint a `Principal` with an empty team list
 * and rely on capability checks downstream. That refactor passes every test
 * about learn resources and fails this one.
 *
 * The rest pin decisions that would otherwise fail silently: an embed resolver
 * that accepts a hostile host, a PATCH that promotes a supply video to
 * anon-visible because it validated the input instead of the merged row, and
 * a rate limiter whose window never closes.
 */
import { strict as assert } from 'node:assert';
import { describe, it } from 'node:test';
import {
  LEARN_CODE_TRACK,
  LEARN_FRAME_SRC_HOSTS,
  formatLearnDuration,
  learnEmbedUrl,
  learnVisibilityPermitted,
  resolveLearnEmbed,
} from '@pig/core';
import type { Database } from '@pig/db';
import { createApp } from '../src/app';
import { loadConfig } from '../src/lib/config';
import {
  LEARN_TOKEN_TTL_MS,
  createAttemptLimiter,
  learnResourceCreateSchema,
  mintLearnToken,
  rateLimitKey,
  verifyLearnToken,
} from '../src/routes/learn';

const ACCESS_CODE = 'carlthefog';

// ---------------------------------------------------------------- the embed

describe('embed allowlist', () => {
  it('resolves a Cap share link to an embed rebuilt from the table', () => {
    const resolved = resolveLearnEmbed('https://video.karti.ai/s/0n6n9p83efnxbs2');
    assert.equal(resolved.ok, true);
    assert.equal(resolved.ok && resolved.provider, 'cap');
    assert.equal(resolved.ok && resolved.externalId, '0n6n9p83efnxbs2');
    assert.equal(resolved.ok && resolved.embedUrl, 'https://video.karti.ai/embed/0n6n9p83efnxbs2');
  });

  it('accepts an embed link too, because that is what people copy', () => {
    const resolved = resolveLearnEmbed('https://video.karti.ai/embed/0n6n9p83efnxbs2');
    assert.equal(resolved.ok && resolved.watchUrl, 'https://video.karti.ai/s/0n6n9p83efnxbs2');
  });

  it('refuses every shape that would put someone else’s bytes in an iframe src', () => {
    // Each of these is a real technique, not a hypothetical. The suffix case
    // is why `hosts` is an exact-match list rather than an `endsWith` check,
    // and the credential case is why a URL that READS as trusted to a human is
    // rejected on the parsed hostname instead.
    const hostile = [
      'javascript:alert(1)',
      'data:text/html,<script>alert(1)</script>',
      'http://video.karti.ai/s/0n6n9p83efnxbs2',
      'https://video.karti.ai@evil.example/s/0n6n9p83efnxbs2',
      'https://evil-video.karti.ai.attacker.test/s/0n6n9p83efnxbs2',
      'https://notvideo.karti.ai/s/0n6n9p83efnxbs2',
      'https://video.karti.ai:8443/s/0n6n9p83efnxbs2',
      'https://video.karti.ai/s/../../admin',
      'https://video.karti.ai/s/0n6n9p83efnxbs2/edit',
      'https://video.karti.ai/s/"><script>alert(1)</script>',
      'https://video.karti.ai/',
      'not a url at all',
    ];
    for (const candidate of hostile) {
      assert.equal(resolveLearnEmbed(candidate).ok, false, `should reject: ${candidate}`);
    }
  });

  it('refuses a recognised but not-yet-enabled provider rather than framing it', () => {
    // Loom is in the table so that enabling it is a flag and a CSP host. Until
    // the CSP host exists, a Loom row would be a card that silently never
    // plays — so the row cannot be created at all.
    const resolved = resolveLearnEmbed('https://www.loom.com/share/0123456789abcdef');
    assert.equal(resolved.ok, false);
    assert.equal(resolved.ok === false && resolved.reason, 'provider_disabled');
  });

  it('re-validates a stored id rather than trusting the database', () => {
    // A row written before the pattern tightened, or by a path that skipped
    // the resolver, must not be framed on the strength of having persisted.
    assert.equal(learnEmbedUrl('cap', '"><iframe src=x'), null);
    assert.equal(learnEmbedUrl('cap', '0n6n9p83efnxbs2'), 'https://video.karti.ai/embed/0n6n9p83efnxbs2');
  });

  it('names every enabled host, so the CSP handoff cannot drift', () => {
    assert.deepEqual(LEARN_FRAME_SRC_HOSTS, ['https://video.karti.ai']);
  });
});

// ------------------------------------------------------------- the two rules

describe('code visibility', () => {
  it('permits code visibility on the platform track only', () => {
    assert.equal(learnVisibilityPermitted('platform', 'code'), true);
    assert.equal(learnVisibilityPermitted('supply', 'code'), false);
    assert.equal(learnVisibilityPermitted('demand', 'code'), false);
    // Members-only is legal everywhere, including on the platform track.
    for (const track of ['supply', 'demand', 'platform'] as const) {
      assert.equal(learnVisibilityPermitted(track, 'members'), true);
    }
  });

  it('refuses a code-visible concept resource at the write schema', () => {
    const rejected = learnResourceCreateSchema.safeParse({
      track: 'supply',
      title: 'How capacity is priced',
      url: 'https://video.karti.ai/s/0n6n9p83efnxbs2',
      visibility: 'code',
    });
    assert.equal(rejected.success, false);

    const accepted = learnResourceCreateSchema.safeParse({
      track: LEARN_CODE_TRACK,
      title: 'Your first hour in PIG',
      url: 'https://video.karti.ai/s/0n6n9p83efnxbs2',
      visibility: 'code',
    });
    assert.equal(accepted.success, true);
  });
});

// ----------------------------------------------------------------- the token

describe('learn token', () => {
  it('verifies a token it minted, and refuses one minted under another code', () => {
    const token = mintLearnToken(ACCESS_CODE, Date.now() + LEARN_TOKEN_TTL_MS);
    assert.equal(verifyLearnToken(ACCESS_CODE, token).valid, true);

    // Rotation is total precisely because the signing key is derived from the
    // code — there is no revocation list to forget to write to.
    const afterRotation = verifyLearnToken('anothercode', token);
    assert.equal(afterRotation.valid, false);
    assert.equal(afterRotation.valid === false && afterRotation.reason, 'mismatch');
  });

  it('refuses an expired token, a forged signature and a rewritten expiry', () => {
    const expiry = Date.now() + LEARN_TOKEN_TTL_MS;
    const token = mintLearnToken(ACCESS_CODE, expiry);

    assert.equal(verifyLearnToken(ACCESS_CODE, token, expiry + 1).valid, false);
    assert.equal(verifyLearnToken(ACCESS_CODE, `${token}x`).valid, false);
    assert.equal(verifyLearnToken(ACCESS_CODE, 'learn_v1.99999999999999.aaaa').valid, false);
    // The expiry is signed, so extending it invalidates the token rather than
    // extending the session.
    const [, , signature] = token.slice('learn_'.length).split('.');
    assert.equal(verifyLearnToken(ACCESS_CODE, `learn_v1.${expiry + 60_000}.${signature}`).valid, false);
    assert.equal(verifyLearnToken(ACCESS_CODE, undefined).valid, false);
    assert.equal(verifyLearnToken(null, token).valid, false);
  });
});

// ----------------------------------------------------------- the whole point

/**
 * A learn token must be worthless everywhere except one handler.
 *
 * This runs against the real `createApp`, not a stub, because the property
 * being asserted is about composition: what the authenticator does with a
 * bearer token it does not recognise, on routes this feature never mentions.
 * A fake would assert my own assumptions back at me.
 *
 * No database is touched — every path here fails in the auth middleware,
 * before a handler runs — so the stub below is a placeholder that would throw
 * loudly if anything ever reached it. That is deliberate: if a future change
 * lets a learn token past the middleware, this test fails with a database
 * error rather than passing quietly.
 */
describe('a learn token is not a credential for anything else', () => {
  const config = loadConfig({
    NODE_ENV: 'production',
    DATABASE_URL: 'postgres://unused:unused@127.0.0.1:1/unused',
    PIG_PUBLIC_URL: 'https://pig-learn-test.invalid',
    SUPABASE_URL: 'https://identity-learn-test.invalid',
    SUPABASE_ANON_KEY: 'learn-test-anon-key',
    SUPABASE_SERVICE_KEY: '',
    PIG_ADMIN_EMAILS: '',
    PIGGY_ENABLED: 'false',
  });

  const db = new Proxy(
    {},
    {
      get() {
        throw new Error('A learn token reached the database. It must never resolve a principal.');
      },
    },
  ) as unknown as Database;

  const authProvider = {
    name: 'learn-test-stub',
    async verifyAccessToken(): Promise<{ subject: string; email: string }> {
      // A learn token is not a JWT. If this is ever called with one, the
      // authenticator has started treating it as an identity assertion.
      throw new Error('Not a valid identity token.');
    },
  };

  const app = createApp(config, db, authProvider);
  const token = mintLearnToken(ACCESS_CODE, Date.now() + LEARN_TOKEN_TTL_MS);

  // The routes a leak would be worth having. `/api/dashboard` is the one
  // scripts/deploy.sh probes before it will finish a release.
  for (const path of ['/api/dashboard', '/api/accounts', '/api/contracts']) {
    it(`answers 401 on ${path} for a valid learn token`, async () => {
      const response = await app.request(`https://pig-learn-test.invalid${path}`, {
        headers: { authorization: `Bearer ${token}` },
      });
      assert.equal(response.status, 401, `${path} must refuse a learn token`);
    });
  }

  it('answers 401 on those routes with no credential at all, unchanged', async () => {
    // The deploy gate asserts exactly this. Adding a public path must not move
    // it, so it is pinned next to the token case rather than trusted.
    const response = await app.request('https://pig-learn-test.invalid/api/dashboard');
    assert.equal(response.status, 401);
  });

  it('is not a learn token once it is dressed as a PIG API key', () => {
    // `pig_` is the one prefix that reaches a database lookup, so the two
    // token vocabularies must not overlap in either direction. Asserted on the
    // verifier rather than through the app because the API-key branch needs a
    // real database to answer 401 `invalid_key`, and the e2e suite covers that
    // path with one.
    const dressed = `pig_${token}`;
    assert.equal(verifyLearnToken(ACCESS_CODE, dressed).valid, false);
    assert.equal(dressed.startsWith('learn_'), false);
  });
});

// ----------------------------------------------------------- the rate limiter

describe('attempt limiter', () => {
  it('allows the quota, refuses past it, and reopens after the window', () => {
    const limiter = createAttemptLimiter({ limit: 3, windowMs: 60_000 });
    const start = 1_000_000;
    for (let attempt = 0; attempt < 3; attempt += 1) {
      assert.equal(limiter.check('10.0.0.9', start).allowed, true);
    }
    const refused = limiter.check('10.0.0.9', start);
    assert.equal(refused.allowed, false);
    assert.ok(refused.retryAfterSeconds > 0);

    // A window that never reopens is a self-inflicted outage, not security.
    assert.equal(limiter.check('10.0.0.9', start + 60_001).allowed, true);
    // Buckets are per key.
    assert.equal(limiter.check('10.0.0.10', start).allowed, true);
  });

  it('buckets on the last forwarded hop, not the first', () => {
    // Caddy APPENDS the peer address, so the first entry is whatever the
    // client sent. Keying on it hands anyone unlimited buckets and the limiter
    // becomes decorative.
    assert.equal(rateLimitKey('203.0.113.7, 10.0.0.2'), '10.0.0.2');
    assert.equal(rateLimitKey('10.0.0.2'), '10.0.0.2');
    assert.equal(rateLimitKey(undefined), 'unknown');
  });
});

describe('duration formatting', () => {
  it('crosses the hour without renaming the minutes', () => {
    assert.equal(formatLearnDuration(272), '4:32');
    assert.equal(formatLearnDuration(3_852), '1:04:12');
    assert.equal(formatLearnDuration(60), '1:00');
    assert.equal(formatLearnDuration(null), null);
    assert.equal(formatLearnDuration(-1), null);
  });
});