feat: release passwordless hierarchical APT v1.2.5

test/proxy-launch.test.js

@@ -11,7 +11,7 @@ const APPROVED_DIRECTORY = 'C:\\Program Files\\Alta Proxy Tool';
 const APPROVED_HELPER = 'C:\\Program Files\\Alta Proxy Tool\\aware-cam-proxy.exe';
 const VALID_HOST = 'tenant.avasecurity.com';
 const VALID_DEVICE_ID = '123e4567-e89b-42d3-a456-426614174000';
-const VALID_USERNAME = 'proxy.operator+apt@example.com';
+const SYNTHETIC_COOKIE = 'HERMES_SENTINEL_SESSION_COOKIE';
 
 function loadModule() {
   return require(MODULE_PATH);
@@ -67,7 +67,7 @@ function validRequest(overrides = {}) {
   return {
     deploymentHost: VALID_HOST,
     deviceId: VALID_DEVICE_ID,
-    username: VALID_USERNAME,
+    cookie: SYNTHETIC_COOKIE,
     ...overrides
   };
 }
@@ -76,18 +76,18 @@ test('exports the proxy manager module', () => {
   assert.doesNotThrow(() => loadModule());
 });
 
-test('launches the approved helper directly in a visible interactive console', () => {
+test('launches the approved helper directly with the paired Alta session', () => {
   const { manager, calls } = createHarness();
 
   const result = manager.launchProxy(validRequest());
 
   assert.deepEqual(calls, [[
     APPROVED_HELPER,
-    ['-a', VALID_HOST, '-u', VALID_USERNAME, '-d', VALID_DEVICE_ID],
+    ['-a', VALID_HOST, '-d', VALID_DEVICE_ID, '-k', SYNTHETIC_COOKIE],
     {
       shell: false,
       detached: true,
-      stdio: 'inherit',
+      stdio: 'ignore',
       windowsHide: false
     }
   ]]);
@@ -100,16 +100,15 @@ test('launches the approved helper directly in a visible interactive console', (
   });
 });
 
-test('passes username punctuation literally in argv without invoking a shell', () => {
-  const username = 'proxy+apt&literal|name@example.com';
+test('passes the paired cookie literally without invoking a shell or console prompt', () => {
+  const cookie = 'abc_DEF-123.456==';
   const { manager, calls } = createHarness();
 
-  manager.launchProxy(validRequest({ username }));
+  manager.launchProxy(validRequest({ cookie }));
 
-  assert.equal(calls[0][1][3], username);
+  assert.equal(calls[0][1][5], cookie);
   assert.equal(calls[0][2].shell, false);
-  assert.equal(calls[0][2].stdio, 'inherit');
-  assert.notEqual(calls[0][2].stdio, 'ignore');
+  assert.equal(calls[0][2].stdio, 'ignore');
 });
 
 test('rejects the CRLF calc.exe reproducer in every structured input', () => {
@@ -117,8 +116,8 @@ test('rejects the CRLF calc.exe reproducer in every structured input', () => {
   const attacks = [
     { deploymentHost: `${VALID_HOST}\r\ncalc.exe` },
     { deviceId: `${VALID_DEVICE_ID}\r\ncalc.exe` },
-    { username: `${VALID_USERNAME}\r\ncalc.exe` },
-    { username: `${VALID_USERNAME}\0calc.exe` }
+    { cookie: `${SYNTHETIC_COOKIE}\r\ncalc.exe` },
+    { cookie: `${SYNTHETIC_COOKIE}\0calc.exe` }
   ];
 
   for (const attack of attacks) {
@@ -191,10 +190,10 @@ test('normalizes a valid Alta hostname to lowercase', () => {
   assert.equal(calls[0][1][1], 'tenant.avigilon.com');
 });
 
-test('rejects empty, oversized, non-string, and control-character usernames', () => {
-  for (const username of ['', 'x'.repeat(255), 42, 'user\nname', 'user\rname', 'user\0name', 'user\u007fname']) {
+test('rejects empty, oversized, non-string, and control-character cookies', () => {
+  for (const cookie of ['', 'x'.repeat(4097), 42, 'abc\nxyz', 'abc\rxyz', 'abc\0xyz', 'abc;xyz']) {
     const { manager } = createHarness();
-    assert.throws(() => manager.launchProxy(validRequest({ username })), /username/i);
+    assert.throws(() => manager.launchProxy(validRequest({ cookie })), /cookie/i);
   }
 });
 
@@ -218,25 +217,27 @@ test('requires an absolute approved application directory and Windows platform',
   );
 });
 
-test('reports a bounded spawn failure without credential redaction machinery', () => {
+test('redacts the cookie if spawn throws an error containing it', () => {
   const { createProxyManager } = loadModule();
   const manager = createProxyManager({
     appDirectory: APPROVED_DIRECTORY,
     fs: { existsSync: () => true },
     platform: 'win32',
-    spawn: () => { throw new Error('spawn failed'); }
+    spawn: () => { throw new Error(`spawn failed for ${SYNTHETIC_COOKIE}`); }
   });
 
   assert.throws(
     () => manager.launchProxy(validRequest()),
     (error) => {
       assert.match(error.message, /spawn failed/);
+      assert.match(error.message, /\[REDACTED\]/);
+      assert.doesNotMatch(error.message, /HERMES_SENTINEL_SESSION_COOKIE/);
       return true;
     }
   );
 });
 
-test('tracks only safe process metadata and never exposes usernames', () => {
+test('tracks only safe process metadata and never exposes cookies', () => {
   const { manager } = createHarness();
   manager.launchProxy(validRequest());
 
@@ -247,7 +248,7 @@ test('tracks only safe process metadata and never exposes usernames', () => {
     startedAt: 1_777_777_777_777,
     status: 'running'
   }]);
-  assert.doesNotMatch(JSON.stringify(tracked), /proxy\.operator/);
+  assert.doesNotMatch(JSON.stringify(tracked), /HERMES_SENTINEL_SESSION_COOKIE/);
 });
 
 test('stopping one tracked process waits for confirmed exit and leaves the other alive', async () => {
@@ -381,9 +382,8 @@ test('exit events remove only the matching owned child', () => {
   assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4101]);
 });
 
-test('source contains no bearer argv, shell launchers, broad process killers, or persistence APIs', () => {
+test('source contains no shell launchers, broad process killers, or credential persistence APIs', () => {
   const source = fs.readFileSync(path.join(__dirname, '..', 'src', 'proxy-launch.js'), 'utf8');
-  assert.doesNotMatch(source, /cookie|bearer|token|-k/i);
   assert.doesNotMatch(source, /\b(?:cmd(?:\.exe)?|powershell|taskkill|pkill|wmic)\b/i);
   assert.doesNotMatch(source, /\.(?:bat|command)\b/i);
   assert.doesNotMatch(source, /(?:writeFile|appendFile|mkdtemp|tmpdir)/);