samuelson-chen
diff --git a/‎showcase/aimock/feature-parity.json‎
Lines changed: 26 additions & 0 deletions b/‎showcase/aimock/feature-parity.json‎
Lines changed: 26 additions & 0 deletions
diff --git a/‎showcase/ops/src/http/auth.test.ts‎
Lines changed: 207 additions & 0 deletions b/‎showcase/ops/src/http/auth.test.ts‎
Lines changed: 207 additions & 0 deletions
diff --git a/‎showcase/ops/src/http/auth.ts‎
Lines changed: 113 additions & 0 deletions b/‎showcase/ops/src/http/auth.ts‎
Lines changed: 113 additions & 0 deletions
@@ -86,6 +86,32 @@
         ]
       }
     },
+    {
+      "match": {
+        "userMessage": "revenue by category as a pie chart"
+      },
+      "response": {
+        "toolCalls": [
+          {
+            "name": "render_pie_chart",
+            "arguments": "{\"title\":\"Revenue by Category\",\"description\":\"Revenue breakdown by product category\",\"data\":[{\"label\":\"Electronics\",\"value\":42000},{\"label\":\"Clothing\",\"value\":28000},{\"label\":\"Food\",\"value\":18000},{\"label\":\"Books\",\"value\":12000}]}"
+          }
+        ]
+      }
+    },
+    {
+      "match": {
+        "userMessage": "monthly expenses as a bar chart"
+      },
+      "response": {
+        "toolCalls": [
+          {
+            "name": "render_bar_chart",
+            "arguments": "{\"title\":\"Monthly Expenses\",\"description\":\"Expense breakdown by month\",\"data\":[{\"label\":\"Jan\",\"value\":12000},{\"label\":\"Feb\",\"value\":14500},{\"label\":\"Mar\",\"value\":13200},{\"label\":\"Apr\",\"value\":15800}]}"
+          }
+        ]
+      }
+    },
     {
       "match": {
         "userMessage": "30-minute meeting to learn about CopilotKit"
 
@@ -0,0 +1,207 @@
+import { Hono } from "hono";
+import { describe, it, expect, afterEach } from "vitest";
+import {
+  bearerAuth,
+  MissingAuthTokenError,
+  constantTimeEqual,
+} from "./auth.js";
+
+const ENV_VAR = "OPS_TRIGGER_TOKEN_TEST";
+
+function makeApp(token: string): Hono {
+  const app = new Hono();
+  app.use("/protected/*", bearerAuth({ expectedToken: token }));
+  app.post("/protected/trigger", (c) => c.json({ ok: true }));
+  return app;
+}
+
+describe("constantTimeEqual", () => {
+  it("returns true for identical strings", () => {
+    expect(constantTimeEqual("abc123", "abc123")).toBe(true);
+  });
+
+  it("returns false for different strings of equal length", () => {
+    expect(constantTimeEqual("abcdef", "abcdeg")).toBe(false);
+  });
+
+  it("returns false for strings of differing length without throwing", () => {
+    // Length mismatch must NOT throw — that would leak length via timing.
+    // Returning false is the correct constant-time-safe behavior.
+    expect(constantTimeEqual("a", "abc")).toBe(false);
+    expect(constantTimeEqual("abc", "a")).toBe(false);
+  });
+
+  it("returns false when either input is empty", () => {
+    expect(constantTimeEqual("", "x")).toBe(false);
+    expect(constantTimeEqual("x", "")).toBe(false);
+    // Two empty strings: defensively false — empty is never a valid token.
+    expect(constantTimeEqual("", "")).toBe(false);
+  });
+});
+
+describe("bearerAuth construction", () => {
+  afterEach(() => {
+    delete process.env[ENV_VAR];
+    delete process.env.OPS_TRIGGER_TOKEN;
+  });
+
+  it("throws MissingAuthTokenError when env var is unset and no expectedToken given", () => {
+    delete process.env[ENV_VAR];
+    expect(() => bearerAuth({ envVar: ENV_VAR })).toThrow(
+      MissingAuthTokenError,
+    );
+  });
+
+  it("throws MissingAuthTokenError when env var is empty string and no expectedToken given", () => {
+    process.env[ENV_VAR] = "";
+    expect(() => bearerAuth({ envVar: ENV_VAR })).toThrow(
+      MissingAuthTokenError,
+    );
+  });
+
+  it("does not throw when explicit expectedToken provided (env var unset)", () => {
+    delete process.env[ENV_VAR];
+    expect(() =>
+      bearerAuth({ expectedToken: "explicit-tok", envVar: ENV_VAR }),
+    ).not.toThrow();
+  });
+
+  it("explicit expectedToken takes priority over env lookup", () => {
+    process.env[ENV_VAR] = "env-token";
+    const mw = bearerAuth({ expectedToken: "explicit-tok", envVar: ENV_VAR });
+    expect(mw).toBeTypeOf("function");
+  });
+
+  it("defaults to OPS_TRIGGER_TOKEN env var when envVar option not provided", () => {
+    delete process.env.OPS_TRIGGER_TOKEN;
+    expect(() => bearerAuth()).toThrow(MissingAuthTokenError);
+    process.env.OPS_TRIGGER_TOKEN = "from-default-env";
+    expect(() => bearerAuth()).not.toThrow();
+  });
+});
+
+describe("bearerAuth middleware", () => {
+  const TOKEN = "s3cr3t-trigger-token";
+
+  it("returns 401 with JSON {error: 'unauthorized'} when Authorization header is missing", async () => {
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", { method: "POST" });
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body).toEqual({ error: "unauthorized" });
+  });
+
+  it("returns 401 when Authorization header lacks the Bearer prefix", async () => {
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: TOKEN }, // no "Bearer "
+    });
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body).toEqual({ error: "unauthorized" });
+  });
+
+  it("returns 401 when Authorization header uses a non-Bearer scheme (Basic, Token, etc.)", async () => {
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: `Token ${TOKEN}` },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it("returns 401 when Bearer prefix is present but token is wrong", async () => {
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: "Bearer wrong-token" },
+    });
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body).toEqual({ error: "unauthorized" });
+  });
+
+  it("returns 401 when Bearer is present but token portion is empty", async () => {
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: "Bearer " },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it("calls next() when token matches — handler runs and returns 200", async () => {
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${TOKEN}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body).toEqual({ ok: true });
+  });
+
+  it("is case-sensitive on the token (constant-time-safe compare)", async () => {
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${TOKEN.toUpperCase()}` },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it("rejects a token of different length without throwing", async () => {
+    // Constant-time compare must handle length mismatch gracefully —
+    // a throw here would leak length via timing AND surface as a 500.
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: "Bearer x" },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it("accepts the Bearer scheme case-insensitively (RFC 6750)", async () => {
+    // RFC 6750 §2.1: "Bearer" auth-scheme is case-insensitive. Be lenient
+    // on the scheme match; strict only on the token.
+    const app = makeApp(TOKEN);
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: `bearer ${TOKEN}` },
+    });
+    expect(res.status).toBe(200);
+  });
+
+  // R3-A.4: presented-token whitespace was trimmed but expected token was
+  // compared verbatim. An OPS_TRIGGER_TOKEN env var that was copy-pasted
+  // with surrounding whitespace would silently 401 every well-formed
+  // request. Trim BOTH sides at construction so the comparison is symmetric.
+  it("R3-A.4: accepts a Bearer token when expectedToken has leading/trailing whitespace", async () => {
+    // expectedToken padded with spaces — common env-var copy-paste mistake.
+    const padded = "  abc  ";
+    const app = new Hono();
+    app.use("/protected/*", bearerAuth({ expectedToken: padded }));
+    app.post("/protected/trigger", (c) => c.json({ ok: true }));
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: "Bearer abc" },
+    });
+    expect(res.status).toBe(200);
+  });
+
+  it("R3-A.4: accepts a Bearer token presented with extra whitespace when expected token is clean", async () => {
+    // Clean expectedToken; presented header has extra whitespace around the
+    // token portion. The regex captures anything after `Bearer\s+` up to the
+    // header end so trailing spaces show up in the captured group; .trim()
+    // normalises them.
+    const app = new Hono();
+    app.use("/protected/*", bearerAuth({ expectedToken: "abc" }));
+    app.post("/protected/trigger", (c) => c.json({ ok: true }));
+    const res = await app.request("/protected/trigger", {
+      method: "POST",
+      headers: { Authorization: "Bearer  abc  " },
+    });
+    expect(res.status).toBe(200);
+  });
+});
@@ -0,0 +1,113 @@
+import crypto from "node:crypto";
+import type { MiddlewareHandler } from "hono";
+
+/**
+ * Thrown at construction time when no expected token is available.
+ *
+ * This is intentionally fail-loud: a misconfigured deployment that silently
+ * defaulted to "always allow" is the failure mode this gate exists to
+ * prevent. Operators must see the error during boot, not after the trigger
+ * endpoint starts accepting unauthenticated requests in production.
+ */
+export class MissingAuthTokenError extends Error {
+  constructor(envVar: string) {
+    super(
+      `bearerAuth: no expected token configured. Set ${envVar} or pass an explicit expectedToken option.`,
+    );
+    this.name = "MissingAuthTokenError";
+  }
+}
+
+/**
+ * Constant-time string comparison.
+ *
+ * Wraps `crypto.timingSafeEqual` with two operator-friendly behaviors that
+ * the raw primitive lacks:
+ *
+ *   1. Length-mismatch returns `false` instead of throwing. The naked
+ *      `timingSafeEqual` requires equal-length buffers; throwing on
+ *      mismatch leaks length via timing AND surfaces as a 500 to the
+ *      caller. We swallow the mismatch and report a plain auth failure.
+ *   2. Empty strings always return `false`. An empty token is never a
+ *      valid credential — we refuse to even attempt the compare so a
+ *      construction bug that produces "" can't masquerade as a valid
+ *      match.
+ *
+ * Exported for direct unit-test coverage; the regex on
+ * `crypto.timingSafeEqual` is non-trivial to assert on indirectly.
+ */
+export function constantTimeEqual(a: string, b: string): boolean {
+  if (a.length === 0 || b.length === 0) return false;
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  if (bufA.length !== bufB.length) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+export interface BearerAuthOptions {
+  /**
+   * Explicit expected token. When provided, takes priority over the env
+   * lookup. Useful for tests and for callers that load the token from a
+   * non-env source (e.g. a secrets manager).
+   */
+  expectedToken?: string;
+  /**
+   * Name of the env var to read at construction time when `expectedToken`
+   * is not provided. Defaults to `OPS_TRIGGER_TOKEN`.
+   */
+  envVar?: string;
+}
+
+const DEFAULT_ENV_VAR = "OPS_TRIGGER_TOKEN";
+
+/**
+ * Construct a Hono bearer-auth middleware.
+ *
+ * Rejects with 401 + `{error: "unauthorized"}` JSON when:
+ *   - the Authorization header is absent
+ *   - the header is present but does not start with `Bearer ` (case-insensitive scheme per RFC 6750 §2.1)
+ *   - the bearer token does not match the expected token (constant-time compare)
+ *
+ * Calls `next()` on a successful match.
+ *
+ * Construction is fail-loud: if no `expectedToken` is supplied AND the
+ * env var is unset/empty, this function throws `MissingAuthTokenError`
+ * during boot. Defaulting to "always reject" or "always allow" would both
+ * be footguns — a misconfigured deployment must surface during init, not
+ * silently degrade once a trigger endpoint is hit.
+ */
+export function bearerAuth(opts: BearerAuthOptions = {}): MiddlewareHandler {
+  const envVar = opts.envVar ?? DEFAULT_ENV_VAR;
+  const rawExpected =
+    opts.expectedToken !== undefined ? opts.expectedToken : process.env[envVar];
+
+  // R3-A.4: trim BOTH sides at construction so the comparison is symmetric
+  // with the trimmed presented token below. Pre-fix, an OPS_TRIGGER_TOKEN
+  // env var copy-pasted with surrounding whitespace would silently 401
+  // every well-formed Bearer request — the presented side was trimmed but
+  // the expected side held the leading/trailing spaces verbatim. Trim
+  // here normalises both sides; an all-whitespace expected token is then
+  // caught by the empty-string fail-loud guard below.
+  const expectedToken = rawExpected?.trim() ?? "";
+
+  if (!expectedToken) {
+    // Fail-loud: empty string, undefined, AND whitespace-only are all
+    // treated as misconfig (whitespace-only collapses to "" after trim).
+    throw new MissingAuthTokenError(envVar);
+  }
+
+  return async (c, next) => {
+    const header = c.req.header("Authorization") ?? "";
+    // RFC 6750 §2.1: the auth-scheme is case-insensitive. Be lenient on
+    // "Bearer "/"bearer " etc., strict on the token portion.
+    const match = /^Bearer\s+(.+)$/i.exec(header);
+    if (!match) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    const presented = match[1].trim();
+    if (!constantTimeEqual(presented, expectedToken)) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    await next();
+  };
+}