archetech / archon / 30711375353 / 1

94%

main: 94%

push

github

test(herald): cover the email bridge, JSON store, and OAuth flow (#818)

fix(herald): generate the OAuth signing key as extractable

The OAuth tests exposed a live bug. oauth/index.ts called
generateKeyPair('ES256') without `extractable: true`; jose v6 returns
WebCrypto CryptoKeys that default to non-extractable, so persistJWTKey()
throws "non-extractable CryptoKey cannot be exported as a JWK".

The failure is self-sealing: on a node with no persisted key file,
initJWTKeys() throws — and writing that file is the very thing that
throws — so it can never recover. GET /.well-known/jwks.json returns 500
and all id_token signing fails, breaking OIDC login on any fresh
deployment. An existing key file masks it, since loadPersistedJWTKey()
short-circuits first. Not a recent regression: jose has been ^6.2.1 since
Herald landed in #261.

Tests added:

- email-bridge.ts (100%): reply-token minting and threading through the
  reply-to address, TTL pruning, inbound parsing, and the address regexes
  for reply tokens, display-name headers, and system-address filtering.
- db/json.ts (100%): user/token/mapping round-trips through the file,
  name lookup normalization, expiry pruning, and the corrupt-file and
  unwritable-path paths that log rather than throw.
- oauth/index.ts (89%): discovery, JWKS, client auth, admin gating, and a
  full authorization-code flow — authorize -> callback -> poll -> token ->
  userinfo — asserting the code is single-use, is bound to its
  redirect_uri, that /poll yields its redirect exactly once, and that the
  id_token is ES256-signed with matching sub/aud/did claims. The Grafana
  membership gate is covered for non-members, members without a
  credential, and credential holders.

createOAuthRoutes registers onto a module-scope Router, so it can only be
called once per module instance; the tests pass mutable dependency
holders that the factory reads lazily per request.

herald/server: 0 files instrumented -> 3 at 92.4% (269/291).

Co-... (continued)

3407 of 3959 branches covered (86.06%)

Branch coverage included in aggregate %.

15138 of 15694 relevant lines covered (96.46%)

362.58 hits per line