import { mkdir, readFile, writeFile } from "node:fs/promises";

import { afterAll, beforeAll, describe, expect, test } from "vitest";

import { PAIRING_SETUP_BOOTSTRAP_PROFILE } from "../shared/device-bootstrap-profile.js";

import { createSuiteTempRootTracker } from "../test-helpers/temp-dir.js";

import { issueDeviceBootstrapToken, verifyDeviceBootstrapToken } from "./device-bootstrap.js";

import {

approveBootstrapDevicePairing,

approveDevicePairing,

clearDevicePairing,

ensureDeviceToken,

getPairedDevice,

hasEffectivePairedDeviceRole,

listEffectivePairedDeviceRoles,

listDevicePairing,

removePairedDevice,

requestDevicePairing,

rejectDevicePairing,

revokeDeviceToken,

rotateDeviceToken,

updatePairedDeviceMetadata,

verifyDeviceToken,

type PairedDevice,

type RotateDeviceTokenResult,

} from "./device-pairing.js";

import { resolvePairingPaths } from "./pairing-files.js";

async function setupPairedOperatorDevice(baseDir: string, scopes: string[]) {

const request = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes,

},

baseDir,

);

await approveDevicePairing(request.request.requestId, { callerScopes: scopes }, baseDir);

}

async function setupPairedNodeDevice(baseDir: string) {

const request = await requestDevicePairing(

{

deviceId: "node-1",

publicKey: "public-key-node-1",

role: "node",

scopes: [],

},

baseDir,

);

await approveDevicePairing(request.request.requestId, { callerScopes: [] }, baseDir);

}

async function setupPairedBrowserOperatorDevice(baseDir: string) {

const request = await requestDevicePairing(

{

deviceId: "browser-device-1",

publicKey: "public-key-browser-1",

clientId: "openclaw-control-ui",

clientMode: "webchat",

role: "operator",

scopes: ["operator.read"],

},

baseDir,

);

await approveDevicePairing(

request.request.requestId,

{ callerScopes: ["operator.read"] },

baseDir,

);

}

async function setupOperatorToken(scopes: string[]) {

const baseDir = await makeDevicePairingDir();

await setupPairedOperatorDevice(baseDir, scopes);

const paired = await getPairedDevice("device-1", baseDir);

const token = requireToken(paired?.tokens?.operator?.token);

return { baseDir, token };

}

function verifyOperatorToken(params: { baseDir: string; token: string; scopes: string[] }) {

return verifyDeviceToken({

deviceId: "device-1",

token: params.token,

role: "operator",

scopes: params.scopes,

baseDir: params.baseDir,

});

}

function requireToken(token: string | undefined): string {

expect(typeof token).toBe("string");

if (typeof token !== "string") {

throw new Error("expected device token to be issued");

}

return token;

}

function requireValue<T>(value: T | null | undefined, message: string): T {

if (value == null) {

throw new Error(message);

}

return value;

}

function isRecord(value: unknown): value is Record<string, unknown> {

return typeof value === "object" && value !== null && !Array.isArray(value);

}

function requireRecord(value: unknown, message: string): Record<string, unknown> {

if (!isRecord(value)) {

throw new Error(message);

}

return value;

}

function expectRecordFields(

value: unknown,

message: string,

expected: Record<string, unknown>,

): Record<string, unknown> {

const record = requireRecord(value, message);

for (const [key, expectedValue] of Object.entries(expected)) {

expect(record[key], `${message}.${key}`).toEqual(expectedValue);

}

return record;

}

function expectArrayIncludesAll(value: unknown, expected: readonly unknown[], message: string) {

expect(Array.isArray(value), `${message} must be an array`).toBe(true);

for (const expectedValue of expected) {

expect(value as unknown[], `${message} must include ${String(expectedValue)}`).toContain(

expectedValue,

);

}

}

function requireRotatedEntry(result: RotateDeviceTokenResult) {

expect(result.ok).toBe(true);

if (!result.ok) {

throw new Error(`expected rotated token entry, got ${result.reason}`);

}

return result.entry;

}

async function overwritePairedOperatorTokenScopes(baseDir: string, scopes: string[]) {

const { pairedPath } = resolvePairingPaths(baseDir, "devices");

const pairedByDeviceId = JSON.parse(await readFile(pairedPath, "utf8")) as Record<

string,

PairedDevice

>;

const device = requireValue(pairedByDeviceId["device-1"], "expected paired device device-1");

const operatorToken = requireValue(device.tokens?.operator, "expected paired operator token");

operatorToken.scopes = scopes;

await writeFile(pairedPath, JSON.stringify(pairedByDeviceId, null, 2));

}

async function mutatePairedDevice(

baseDir: string,

deviceId: string,

mutate: (device: PairedDevice) => void,

) {

const { pairedPath } = resolvePairingPaths(baseDir, "devices");

const pairedByDeviceId = JSON.parse(await readFile(pairedPath, "utf8")) as Record<

string,

PairedDevice

>;

const device = requireValue(pairedByDeviceId[deviceId], `expected paired device ${deviceId}`);

mutate(device);

await writeFile(pairedPath, JSON.stringify(pairedByDeviceId, null, 2));

}

async function clearPairedOperatorApprovalBaseline(baseDir: string) {

await mutatePairedDevice(baseDir, "device-1", (device) => {

delete device.approvedScopes;

delete device.scopes;

});

}

const suiteRootTracker = createSuiteTempRootTracker({ prefix: "openclaw-device-pairing-" });

async function makeDevicePairingDir(): Promise<string> {

return await suiteRootTracker.make("case");

}

describe("device pairing tokens", () => {

beforeAll(async () => {

await suiteRootTracker.setup();

});

afterAll(async () => {

await suiteRootTracker.cleanup();

});

test("reuses existing pending requests for the same device", async () => {

const baseDir = await makeDevicePairingDir();

const first = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

},

baseDir,

);

const second = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

},

baseDir,

);

expect(first.created).toBe(true);

expect(second.created).toBe(false);

expect(second.request.requestId).toBe(first.request.requestId);

});

test("recovers when pairing state files were written as arrays", async () => {

const baseDir = await makeDevicePairingDir();

const paths = resolvePairingPaths(baseDir, "devices");

await mkdir(paths.dir, { recursive: true });

await writeFile(paths.pendingPath, "[]", "utf8");

await writeFile(paths.pairedPath, "[]", "utf8");

const pending = await requestDevicePairing(

{

deviceId: "device-array-state",

publicKey: "public-key-array-state",

role: "operator",

scopes: ["operator.read"],

},

baseDir,

);

const approved = await approveDevicePairing(

pending.request.requestId,

{ callerScopes: ["operator.read"] },

baseDir,

);

const approvedRecord = expectRecordFields(approved, "approved result", {

status: "approved",

});

expectRecordFields(approvedRecord.device, "approved device", {

deviceId: "device-array-state",

});

expect(Array.isArray(JSON.parse(await readFile(paths.pendingPath, "utf8")))).toBe(false);

const pairedByDeviceId = requireRecord(

JSON.parse(await readFile(paths.pairedPath, "utf8")),

"paired devices",

);

expectRecordFields(pairedByDeviceId["device-array-state"], "paired device", {

deviceId: "device-array-state",

});

});

test("re-requesting with identical params preserves the original ts to prevent queue-jumping", async () => {

// Regression: refreshPendingDevicePairingRequest must not bump ts to Date.now().

// An attacker who reconnects with the same key/role/scopes could otherwise

// silently move their request to the top of the implicit --latest approval queue.

const baseDir = await makeDevicePairingDir();

const first = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.read"],

},

baseDir,

);

const originalTs = first.request.ts - 1_000;

const paths = resolvePairingPaths(baseDir, "devices");

const pendingById = JSON.parse(await readFile(paths.pendingPath, "utf8")) as Record<

string,

{ ts: number }

>;

const pending = requireValue(

pendingById[first.request.requestId],

"expected pending pairing request",

);

pending.ts = originalTs;

await writeFile(paths.pendingPath, JSON.stringify(pendingById, null, 2));

const second = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.read"],

},

baseDir,

);

expect(second.created).toBe(false);

expect(second.request.requestId).toBe(first.request.requestId);

expect(second.request.ts).toBe(originalTs);

});

test("supersedes pending requests when requested roles/scopes change", async () => {

const baseDir = await makeDevicePairingDir();

const first = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "node",

scopes: [],

},

baseDir,

);

const second = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.read", "operator.write"],

},

baseDir,

);

expect(second.created).toBe(true);

expect(second.request.requestId).not.toBe(first.request.requestId);

expect(second.request.role).toBe("operator");

expectArrayIncludesAll(second.request.roles, ["node", "operator"], "request roles");

expectArrayIncludesAll(

second.request.scopes,

["operator.read", "operator.write"],

"request scopes",

);

const list = await listDevicePairing(baseDir);

expect(list.pending).toHaveLength(1);

expect(list.pending[0]?.requestId).toBe(second.request.requestId);

await approveDevicePairing(

second.request.requestId,

{ callerScopes: ["operator.read", "operator.write"] },

baseDir,

);

const paired = await getPairedDevice("device-1", baseDir);

expectArrayIncludesAll(paired?.roles, ["node", "operator"], "paired roles");

expectArrayIncludesAll(paired?.scopes, ["operator.read", "operator.write"], "paired scopes");

});

test("approves mixed node and operator requests with admin caller scopes", async () => {

const baseDir = await makeDevicePairingDir();

const request = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

roles: ["node", "operator"],

scopes: ["operator.read", "operator.write", "operator.talk.secrets"],

},

baseDir,

);

const approved = await approveDevicePairing(

request.request.requestId,

{ callerScopes: ["operator.admin", "operator.pairing"] },

baseDir,

);

expectRecordFields(approved, "approved result", {

status: "approved",

requestId: request.request.requestId,

});

const paired = await getPairedDevice("device-1", baseDir);

expect(paired && listEffectivePairedDeviceRoles(paired)).toEqual(["node", "operator"]);

expect(paired?.tokens?.node?.scopes).toStrictEqual([]);

expect(paired?.tokens?.operator?.scopes).toEqual([

"operator.read",

"operator.talk.secrets",

"operator.write",

]);

await expect(

verifyDeviceToken({

deviceId: "device-1",

token: requireToken(paired?.tokens?.node?.token),

role: "node",

scopes: [],

baseDir,

}),

).resolves.toEqual({ ok: true });

await expect(

verifyDeviceToken({

deviceId: "device-1",

token: requireToken(paired?.tokens?.operator?.token),

role: "operator",

scopes: ["operator.read"],

baseDir,

}),

).resolves.toEqual({ ok: true });

});

test("preserves existing operator token scopes when approving a scope upgrade", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedOperatorDevice(baseDir, ["operator.read"]);

const upgrade = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.write"],

},

baseDir,

);

const approved = await approveDevicePairing(

upgrade.request.requestId,

{ callerScopes: ["operator.read", "operator.write"] },

baseDir,

);

expectRecordFields(approved, "approved result", { status: "approved" });

const paired = await getPairedDevice("device-1", baseDir);

expect(paired?.approvedScopes).toEqual(["operator.read", "operator.write"]);

expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read", "operator.write"]);

});

test("does not widen a down-scoped operator token when approving a scope upgrade", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedOperatorDevice(baseDir, ["operator.read", "operator.write"]);

await overwritePairedOperatorTokenScopes(baseDir, ["operator.read"]);

const upgrade = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.talk.secrets"],

},

baseDir,

);

const approved = await approveDevicePairing(

upgrade.request.requestId,

{ callerScopes: ["operator.read", "operator.talk.secrets", "operator.write"] },

baseDir,

);

expectRecordFields(approved, "approved result", { status: "approved" });

const paired = await getPairedDevice("device-1", baseDir);

expect(paired?.approvedScopes).toEqual([

"operator.read",

"operator.write",

"operator.talk.secrets",

]);

expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read", "operator.talk.secrets"]);

expect(paired?.tokens?.operator?.scopes).not.toContain("operator.write");

});

test("preserves requested non-operator scopes on newly minted role tokens", async () => {

const baseDir = await makeDevicePairingDir();

const request = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "node",

scopes: ["node.exec"],

},

baseDir,

);

const approved = await approveDevicePairing(request.request.requestId, baseDir);

expectRecordFields(approved, "approved result", {

status: "approved",

requestId: request.request.requestId,

});

const paired = await getPairedDevice("device-1", baseDir);

expect(paired?.tokens?.node?.scopes).toEqual(["node.exec"]);

await expect(

verifyDeviceToken({

deviceId: "device-1",

token: requireToken(paired?.tokens?.node?.token),

role: "node",

scopes: ["node.exec"],

baseDir,

}),

).resolves.toEqual({ ok: true });

});

test.each([

{

name: "node custom scope",

roles: ["node"],

scopes: ["vault.admin"],

scope: "vault.admin",

callerScopes: [],

},

{

name: "operator custom scope",

roles: ["operator"],

scopes: ["vault.admin"],

scope: "vault.admin",

callerScopes: ["operator.pairing"],

},

{

name: "node requesting operator scope",

roles: ["node"],

scopes: ["operator.read"],

scope: "operator.read",

callerScopes: ["operator.read"],

},

])("rejects requested scopes outside requested roles: $name", async (params) => {

const baseDir = await makeDevicePairingDir();

const request = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

roles: params.roles,

scopes: params.scopes,

},

baseDir,

);

await expect(

approveDevicePairing(

request.request.requestId,

{ callerScopes: params.callerScopes },

baseDir,

),

).resolves.toEqual({

status: "forbidden",

reason: "scope-outside-requested-roles",

scope: params.scope,

});

await expect(getPairedDevice("device-1", baseDir)).resolves.toBeNull();

});

test("preserves existing non-operator scopes during operator-only mixed-role repairs", async () => {

const baseDir = await makeDevicePairingDir();

const initial = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "node",

scopes: ["node.exec"],

},

baseDir,

);

const approvedInitial = await approveDevicePairing(initial.request.requestId, baseDir);

expectRecordFields(approvedInitial, "initial approved result", {

status: "approved",

requestId: initial.request.requestId,

});

const repair = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

roles: ["node", "operator"],

scopes: ["operator.read"],

},

baseDir,

);

const approvedRepair = await approveDevicePairing(

repair.request.requestId,

{ callerScopes: ["operator.read"] },

baseDir,

);

expectRecordFields(approvedRepair, "repair approved result", {

status: "approved",

requestId: repair.request.requestId,

});

const paired = await getPairedDevice("device-1", baseDir);

expect(paired?.tokens?.node?.scopes).toEqual(["node.exec"]);

expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read"]);

await expect(

verifyDeviceToken({

deviceId: "device-1",

token: requireToken(paired?.tokens?.node?.token),

role: "node",

scopes: ["node.exec"],

baseDir,

}),

).resolves.toEqual({ ok: true });

});

test("keeps superseded requests interactive when an existing pending request is interactive", async () => {

const baseDir = await makeDevicePairingDir();

const first = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "node",

scopes: [],

silent: false,

},

baseDir,

);

expect(first.request.silent).toBe(false);

const second = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.read"],

silent: true,

},

baseDir,

);

expect(second.created).toBe(true);

expect(second.request.requestId).not.toBe(first.request.requestId);

expect(second.request.silent).toBe(false);

});

test("rejects bootstrap token replay before pending scope escalation can be approved", async () => {

const baseDir = await makeDevicePairingDir();

const issued = await issueDeviceBootstrapToken({

baseDir,

roles: ["operator"],

scopes: ["operator.approvals", "operator.read", "operator.write"],

});

await expect(

verifyDeviceBootstrapToken({

token: issued.token,

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.read"],

baseDir,

}),

).resolves.toEqual({ ok: true });

const first = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.read"],

},

baseDir,

);

await expect(

verifyDeviceBootstrapToken({

token: issued.token,

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.write", "operator.approvals"],

baseDir,

}),

).resolves.toEqual({ ok: false, reason: "bootstrap_token_invalid" });

const pending = await listDevicePairing(baseDir);

expect(pending.pending).toHaveLength(1);

expect(pending.pending[0]?.scopes).toEqual(["operator.read"]);

await approveDevicePairing(

first.request.requestId,

{ callerScopes: ["operator.read"] },

baseDir,

);

const paired = await getPairedDevice("device-1", baseDir);

expect(paired?.scopes).toEqual(["operator.read"]);

expect(paired?.approvedScopes).toEqual(["operator.read"]);

expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read"]);

});

test("rejecting a bootstrap-bound pending request revokes the bootstrap token", async () => {

const baseDir = await makeDevicePairingDir();

const issued = await issueDeviceBootstrapToken({ baseDir });

await expect(

verifyDeviceBootstrapToken({

token: issued.token,

deviceId: "bootstrap-reject-device",

publicKey: "bootstrap-reject-public-key",

role: "node",

scopes: [],

baseDir,

}),

).resolves.toEqual({ ok: true });

const pending = await requestDevicePairing(

{

deviceId: "bootstrap-reject-device",

publicKey: "bootstrap-reject-public-key",

role: "node",

roles: ["node"],

scopes: [],

},

baseDir,

);

await expect(rejectDevicePairing(pending.request.requestId, baseDir)).resolves.toEqual({

requestId: pending.request.requestId,

deviceId: "bootstrap-reject-device",

});

await expect(

verifyDeviceBootstrapToken({

token: issued.token,

deviceId: "bootstrap-reject-device",

publicKey: "bootstrap-reject-public-key",

role: "node",

scopes: [],

baseDir,

}),

).resolves.toEqual({ ok: false, reason: "bootstrap_token_invalid" });

});

test("fails closed for operator approvals when caller scopes are omitted", async () => {

const baseDir = await makeDevicePairingDir();

const request = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

scopes: ["operator.admin"],

},

baseDir,

);

await expect(approveDevicePairing(request.request.requestId, baseDir)).resolves.toEqual({

status: "forbidden",

reason: "caller-scopes-required",

scope: "operator.admin",

});

const approved = await approveDevicePairing(

request.request.requestId,

{

callerScopes: ["operator.admin"],

},

baseDir,

);

expectRecordFields(approved, "approved result", {

status: "approved",

requestId: request.request.requestId,

});

});

test("metadata refresh can update display metadata but not approved role and scope fields", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedNodeDevice(baseDir);

await updatePairedDeviceMetadata(

"node-1",

{

displayName: "renamed-node",

platform: "iOS 26.5.0",

role: "operator",

roles: ["operator"],

scopes: ["operator.admin"],

approvedScopes: ["operator.admin"],

tokens: {},

publicKey: "attacker-key",

} as unknown as Parameters<typeof updatePairedDeviceMetadata>[1],

baseDir,

);

const paired = await getPairedDevice("node-1", baseDir);

expect(paired?.displayName).toBe("renamed-node");

expect(paired?.platform).toBe("iOS 26.5.0");

expect(paired?.publicKey).toBe("public-key-node-1");

expect(paired?.role).toBe("node");

expect(paired?.roles).toEqual(["node"]);

expect(paired?.scopes).toStrictEqual([]);

expect(paired?.approvedScopes).toStrictEqual([]);

expect(typeof paired?.tokens?.node?.token).toBe("string");

expect(paired?.tokens?.operator).toBeUndefined();

});

test("metadata refresh persists last-seen fields and reports missing devices", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedNodeDevice(baseDir);

await expect(

updatePairedDeviceMetadata(

"node-1",

{

lastSeenAtMs: 4321,

lastSeenReason: "bg_app_refresh",

},

baseDir,

),

).resolves.toBe(true);

await expect(updatePairedDeviceMetadata("missing", { lastSeenAtMs: 1 }, baseDir)).resolves.toBe(

false,

);

const paired = await getPairedDevice("node-1", baseDir);

expectRecordFields(paired, "paired device", {

lastSeenAtMs: 4321,

lastSeenReason: "bg_app_refresh",

});

});

test("approval access metadata initializes paired device last-seen fields", async () => {

const baseDir = await makeDevicePairingDir();

const request = await requestDevicePairing(

{

deviceId: "node-1",

publicKey: "public-key-node-1",

role: "node",

scopes: [],

displayName: "pending-name",

remoteIp: "127.0.0.1",

},

baseDir,

);

const firstSeenAtMs = Date.now();

const approved = await approveDevicePairing(

request.request.requestId,

{

callerScopes: [],

accessMetadata: {

displayName: "connected-name",

remoteIp: "10.0.0.1",

lastSeenAtMs: firstSeenAtMs,

lastSeenReason: "connect",

},

},

baseDir,

);

expectRecordFields(approved, "approved result", { status: "approved" });

const paired = await getPairedDevice("node-1", baseDir);

expectRecordFields(paired, "paired device", {

displayName: "connected-name",

remoteIp: "10.0.0.1",

lastSeenAtMs: firstSeenAtMs,

lastSeenReason: "connect",

});

});

test("repair approvals preserve paired device last-seen fields without access metadata", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedNodeDevice(baseDir);

await updatePairedDeviceMetadata(

"node-1",

{

lastSeenAtMs: 1234,

lastSeenReason: "bg_app_refresh",

},

baseDir,

);

const repair = await requestDevicePairing(

{

deviceId: "node-1",

publicKey: "public-key-node-1",

role: "node",

scopes: [],

},

baseDir,

);

await approveDevicePairing(repair.request.requestId, { callerScopes: [] }, baseDir);

const paired = await getPairedDevice("node-1", baseDir);

expectRecordFields(paired, "paired device", {

lastSeenAtMs: 1234,

lastSeenReason: "bg_app_refresh",

});

});

test("device token verification refreshes paired device last-seen metadata", async () => {

const { baseDir, token } = await setupOperatorToken(["operator.read"]);

const beforeVerifyAtMs = Date.now();

await expect(

verifyDeviceToken({

deviceId: "device-1",

token,

role: "operator",

scopes: ["operator.read"],

baseDir,

}),

).resolves.toEqual({ ok: true });

const paired = await getPairedDevice("device-1", baseDir);

expect(paired?.lastSeenReason).toBe("device-token-auth");

expect(typeof paired?.lastSeenAtMs).toBe("number");

expect(paired?.lastSeenAtMs ?? 0).toBeGreaterThanOrEqual(beforeVerifyAtMs);

});

test("generates base64url device tokens with 256-bit entropy output length", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedOperatorDevice(baseDir, ["operator.admin"]);

const paired = await getPairedDevice("device-1", baseDir);

const token = requireToken(paired?.tokens?.operator?.token);

expect(token).toMatch(/^[A-Za-z0-9_-]{43}$/);

expect(Buffer.from(token, "base64url")).toHaveLength(32);

});

test("allows down-scoping from admin and preserves approved scope baseline", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedOperatorDevice(baseDir, ["operator.admin"]);

const downscoped = await rotateDeviceToken({

deviceId: "device-1",

role: "operator",

scopes: ["operator.read"],

baseDir,

});

expect(downscoped.ok).toBe(true);

let paired = await getPairedDevice("device-1", baseDir);

expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read"]);

expect(paired?.scopes).toEqual(["operator.admin"]);

expect(paired?.approvedScopes).toEqual(["operator.admin"]);

const reused = await rotateDeviceToken({

deviceId: "device-1",

role: "operator",

baseDir,

});

expect(reused.ok).toBe(true);

paired = await getPairedDevice("device-1", baseDir);

expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read"]);

});

test("preserves existing token scopes when approving a repair without requested scopes", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedOperatorDevice(baseDir, ["operator.admin"]);

const repair = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

},

baseDir,

);

await approveDevicePairing(

repair.request.requestId,

{ callerScopes: ["operator.admin"] },

baseDir,

);

const paired = await getPairedDevice("device-1", baseDir);

expect(paired?.scopes).toEqual(["operator.admin"]);

expect(paired?.approvedScopes).toEqual(["operator.admin"]);

expect(paired?.tokens?.operator?.scopes).toEqual([

"operator.admin",

"operator.read",

"operator.write",

]);

});

test("rejects repair without requested scopes when caller cannot approve inherited token scopes", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedOperatorDevice(baseDir, ["operator.admin"]);

const before = await getPairedDevice("device-1", baseDir);

const repair = await requestDevicePairing(

{

deviceId: "device-1",

publicKey: "public-key-1",

role: "operator",

},

baseDir,

);

await expect(

approveDevicePairing(

repair.request.requestId,

{ callerScopes: ["operator.pairing"] },

baseDir,

),

).resolves.toEqual({

status: "forbidden",

reason: "caller-missing-scope",

scope: "operator.admin",

});

const after = await getPairedDevice("device-1", baseDir);

expect(after?.tokens?.operator?.token).toEqual(before?.tokens?.operator?.token);

expect(after?.tokens?.operator?.scopes).toEqual([

"operator.admin",

"operator.read",

"operator.write",

]);

});

test("rejects scope escalation when rotating a token and leaves state unchanged", async () => {

const baseDir = await makeDevicePairingDir();

await setupPairedOperatorDevice(baseDir, ["operator.read"]);

const before = await getPairedDevice("device-1", baseDir);

const rotated = await rotateDeviceToken({

deviceId: "device-1",

role: "operator",

scopes: ["operator.admin"],

baseDir,

});

expect(rotated).toEqual({ ok: false, reason: "scope-outside-approved-baseline" });

const after = await getPairedDevice("device-1", baseDir);

expect(after?.tokens?.operator?.token).toEqual(before?.tokens?.operator?.token);

expect(after?.tokens?.operator?.scopes).toEqual(["operator.read"]);

expect(after?.scopes).toEqual(["operator.read"]);

expect(after?.approvedScopes).toEqual(["operator.read"]);

});

test("rejects omitted-scope rotation when caller cannot hold the current token scopes", async () => {