387 lines
15 KiB
TypeScript
387 lines
15 KiB
TypeScript
import { createHash, randomUUID } from 'node:crypto';
|
|
import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
|
|
import type { AuthUser, UserRole } from '../../src/lib/auth.js';
|
|
import { newFixture, type Fixture } from '../helpers/fixture.js';
|
|
|
|
// Exercise real password verification without weakening production scrypt costs.
|
|
vi.setConfig({ testTimeout: 20_000, hookTimeout: 20_000 });
|
|
const password = 'testpass';
|
|
const replacement = 'a replacement account passphrase';
|
|
const firstAddress = '192.0.2.1';
|
|
const limitedAddress = '192.0.2.2';
|
|
let passwordHash: string;
|
|
let fixture: Fixture;
|
|
let auth: typeof import('../../src/lib/server/auth/index.js');
|
|
let database: typeof import('../../src/lib/server/db/index.js');
|
|
|
|
beforeAll(async () => {
|
|
const passwords = await import('../../src/lib/server/auth/passwords.js');
|
|
passwordHash = await passwords.hashPassword(password);
|
|
});
|
|
beforeEach(async () => {
|
|
vi.resetModules();
|
|
fixture = await newFixture([]);
|
|
auth = await import('../../src/lib/server/auth/index.js');
|
|
database = await import('../../src/lib/server/db/index.js');
|
|
auth.setupRequired();
|
|
});
|
|
afterEach(async () => {
|
|
vi.restoreAllMocks();
|
|
vi.unstubAllEnvs();
|
|
await fixture.cleanup();
|
|
});
|
|
|
|
function seedUser(username = 'viewer', role: UserRole = 'viewer', disabled = false): AuthUser {
|
|
const id = randomUUID();
|
|
const now = Date.now();
|
|
database
|
|
.db()
|
|
.prepare(
|
|
`INSERT INTO auth_users(id,username,display_name,password_hash,role,disabled,created_at,updated_at)
|
|
VALUES(?,?,?,?,?,?,?,?)`
|
|
)
|
|
.run(id, username, username, passwordHash, role, Number(disabled), now, now);
|
|
return auth.getUser(id)!;
|
|
}
|
|
|
|
function exhaustPair(username: string, address = limitedAddress) {
|
|
for (let attempt = 0; attempt < 10; attempt++) auth.consumeAuthAttempt(address, username);
|
|
}
|
|
|
|
function devices() {
|
|
return database.db().prepare('SELECT * FROM auth_login_devices ORDER BY rowid').all();
|
|
}
|
|
|
|
async function loginRoute(
|
|
input: Record<string, unknown>,
|
|
options: { cookie?: string; address?: string; origin?: string } = {}
|
|
) {
|
|
const { POST } = await import('../../src/routes/api/auth/login/+server.js');
|
|
const url = new URL('/api/auth/login', options.origin ?? 'https://ec.test');
|
|
const deviceName = url.protocol === 'https:' ? '__Host-ec_login_device' : 'ec_login_device_dev';
|
|
const cookies = {
|
|
get: vi.fn((name: string) => (name === deviceName ? options.cookie : undefined)),
|
|
set: vi.fn()
|
|
};
|
|
const response = await POST({
|
|
request: new Request(url, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify(input)
|
|
}),
|
|
cookies,
|
|
url,
|
|
getClientAddress: () => options.address ?? firstAddress
|
|
} as unknown as Parameters<typeof POST>[0]);
|
|
return { response, cookies };
|
|
}
|
|
|
|
describe('known login device proof', () => {
|
|
it('creates an account-bound, hashed proof after password verification that cannot authenticate a session', async () => {
|
|
const now = 2_000_000_000_000;
|
|
vi.spyOn(Date, 'now').mockReturnValue(now);
|
|
const user = seedUser();
|
|
|
|
const result = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
firstAddress
|
|
);
|
|
|
|
const device = result.loginDevice!;
|
|
expect(device.token).toMatch(/^[A-Za-z0-9_-]{43}$/);
|
|
expect(device.token).not.toBe(result.session.token);
|
|
expect(device.expiresAt).toBe(now + 30 * 24 * 60 * 60_000);
|
|
expect(devices()).toEqual([
|
|
{
|
|
token_hash: createHash('sha256').update(device.token).digest('hex'),
|
|
user_id: user.id,
|
|
created_at: now,
|
|
expires_at: device.expiresAt
|
|
}
|
|
]);
|
|
expect(auth.readSession(device.token)).toBeNull();
|
|
expect(auth.readSession(result.session.token)?.user.id).toBe(user.id);
|
|
const persisted = JSON.stringify(devices()) + JSON.stringify(auth.listAuthAudit());
|
|
expect(persisted).not.toContain(device.token);
|
|
expect(persisted).not.toContain(result.session.token);
|
|
expect(persisted).not.toContain(password);
|
|
});
|
|
|
|
it('allows a proven account past an exhausted pair while still rejecting a wrong password', async () => {
|
|
const user = seedUser();
|
|
const initial = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
firstAddress
|
|
);
|
|
exhaustPair(user.username);
|
|
await expect(
|
|
auth.authenticatePassword({ username: user.username, password }, limitedAddress)
|
|
).rejects.toMatchObject({ status: 429 });
|
|
const original = devices();
|
|
|
|
await expect(
|
|
auth.authenticatePassword(
|
|
{ username: user.username, password: 'wrong password' },
|
|
limitedAddress,
|
|
initial.loginDevice!.token
|
|
)
|
|
).rejects.toMatchObject({ status: 401 });
|
|
expect(devices()).toEqual(original);
|
|
const result = await auth.authenticatePassword(
|
|
{ username: user.username.toUpperCase(), password },
|
|
limitedAddress,
|
|
initial.loginDevice!.token
|
|
);
|
|
|
|
expect(result.user.id).toBe(user.id);
|
|
expect(result.loginDevice).toEqual(initial.loginDevice);
|
|
expect(devices()).toEqual(original);
|
|
});
|
|
|
|
it.each(['other account', 'malformed', 'unknown', 'expired', 'session token'] as const)(
|
|
'does not bypass an exhausted pair with %s proof',
|
|
async (kind) => {
|
|
const user = seedUser();
|
|
const initial = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
firstAddress
|
|
);
|
|
const target = kind === 'other account' ? seedUser('another-viewer') : user;
|
|
let token = initial.loginDevice!.token;
|
|
if (kind === 'malformed') token += '!';
|
|
if (kind === 'unknown') token = 'x'.repeat(43);
|
|
if (kind === 'session token') token = initial.session.token;
|
|
if (kind === 'expired')
|
|
database.db().prepare('UPDATE auth_login_devices SET expires_at=?').run(Date.now());
|
|
exhaustPair(target.username);
|
|
const original = devices();
|
|
|
|
await expect(
|
|
auth.authenticatePassword(
|
|
{ username: target.username, password },
|
|
limitedAddress,
|
|
token
|
|
)
|
|
).rejects.toMatchObject({ status: 429 });
|
|
|
|
expect(devices()).toEqual(original);
|
|
}
|
|
);
|
|
|
|
it('continues enforcing the shared IP ceiling for a valid device', async () => {
|
|
const user = seedUser();
|
|
const initial = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
firstAddress
|
|
);
|
|
for (let attempt = 0; attempt < 30; attempt++)
|
|
auth.consumeAuthAttempt(limitedAddress, `missing-${attempt}`);
|
|
|
|
await expect(
|
|
auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
limitedAddress,
|
|
initial.loginDevice!.token
|
|
)
|
|
).rejects.toMatchObject({ status: 429 });
|
|
expect(devices()).toHaveLength(1);
|
|
});
|
|
|
|
it('accepts proof only from the request cookie and ignores body-only trust assertions', async () => {
|
|
const user = seedUser();
|
|
const initial = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
firstAddress
|
|
);
|
|
exhaustPair(user.username);
|
|
const input = {
|
|
username: user.username,
|
|
password,
|
|
loginDevice: initial.loginDevice!.token,
|
|
trusted: true,
|
|
knownDevice: true
|
|
};
|
|
|
|
const rejected = await loginRoute(input, { address: limitedAddress });
|
|
expect(rejected.response.status).toBe(429);
|
|
expect(rejected.cookies.set).not.toHaveBeenCalled();
|
|
const accepted = await loginRoute(input, {
|
|
address: limitedAddress,
|
|
cookie: initial.loginDevice!.token
|
|
});
|
|
expect(accepted.response.status).toBe(200);
|
|
expect(accepted.cookies.get).toHaveBeenCalledWith('__Host-ec_login_device');
|
|
expect(devices()).toHaveLength(1);
|
|
});
|
|
|
|
it('retains the original absolute expiry when the database is reopened and the device logs in again', async () => {
|
|
const now = 2_000_000_000_000;
|
|
const clock = vi.spyOn(Date, 'now').mockReturnValue(now);
|
|
const user = seedUser();
|
|
const initial = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
firstAddress
|
|
);
|
|
const original = devices();
|
|
database.closeDb();
|
|
clock.mockReturnValue(now + 5 * 24 * 60 * 60_000);
|
|
exhaustPair(user.username);
|
|
|
|
const next = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
limitedAddress,
|
|
initial.loginDevice!.token
|
|
);
|
|
|
|
expect(next.loginDevice).toEqual(initial.loginDevice);
|
|
expect(devices()).toEqual(original);
|
|
clock.mockReturnValue(initial.loginDevice!.expiresAt);
|
|
exhaustPair(user.username);
|
|
await expect(
|
|
auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
limitedAddress,
|
|
initial.loginDevice!.token
|
|
)
|
|
).rejects.toMatchObject({ status: 429 });
|
|
});
|
|
|
|
it('does not issue device cookies or store proof for failed password logins', async () => {
|
|
seedUser();
|
|
seedUser('disabled', 'viewer', true);
|
|
for (const input of [
|
|
{ username: 'viewer', password: 'wrong password' },
|
|
{ username: 'missing', password },
|
|
{ username: 'disabled', password }
|
|
]) {
|
|
const result = await loginRoute(input);
|
|
expect(result.response.status).toBe(401);
|
|
expect(result.cookies.set).not.toHaveBeenCalled();
|
|
expect(devices()).toEqual([]);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe('known login device lifecycle', () => {
|
|
it('keeps device proof through logout while removing the session cookie and session', async () => {
|
|
const user = seedUser();
|
|
const initial = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
firstAddress
|
|
);
|
|
const original = devices();
|
|
const { POST } = await import('../../src/routes/api/auth/logout/+server.js');
|
|
const cookies = {
|
|
get: vi.fn((name: string) =>
|
|
name === '__Host-ec_session' ? initial.session.token : initial.loginDevice!.token
|
|
),
|
|
delete: vi.fn()
|
|
};
|
|
const response = await POST({
|
|
cookies,
|
|
url: new URL('https://ec.test/api/auth/logout'),
|
|
locals: { user }
|
|
} as unknown as Parameters<typeof POST>[0]);
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(cookies.delete.mock.calls).toEqual([['__Host-ec_session', { path: '/' }]]);
|
|
expect(auth.readSession(initial.session.token)).toBeNull();
|
|
expect(devices()).toEqual(original);
|
|
exhaustPair(user.username);
|
|
await expect(
|
|
auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
limitedAddress,
|
|
initial.loginDevice!.token
|
|
)
|
|
).resolves.toMatchObject({ user: { id: user.id }, loginDevice: initial.loginDevice });
|
|
});
|
|
|
|
it.each(['role', 'disable', 'password reset', 'password change', 'revoke sessions'] as const)(
|
|
'revokes device proof after an account %s operation',
|
|
async (operation) => {
|
|
const admin = seedUser('administrator', 'admin');
|
|
const user = seedUser();
|
|
const initial = await auth.authenticatePassword(
|
|
{ username: user.username, password },
|
|
firstAddress
|
|
);
|
|
if (operation === 'role')
|
|
await auth.updateUser(admin.id, user.id, { role: 'operator' });
|
|
if (operation === 'disable')
|
|
await auth.updateUser(admin.id, user.id, { disabled: true });
|
|
if (operation === 'password reset')
|
|
await auth.updateUser(admin.id, user.id, { password: replacement });
|
|
if (operation === 'password change')
|
|
await auth.changePassword(
|
|
user.id,
|
|
password,
|
|
replacement,
|
|
auth.readSession(initial.session.token)!.tokenHash
|
|
);
|
|
if (operation === 'revoke sessions') auth.revokeUserSessions(admin.id, user.id);
|
|
|
|
expect(devices()).toEqual([]);
|
|
expect(auth.readSession(initial.session.token)).toBeNull();
|
|
exhaustPair(user.username);
|
|
await expect(
|
|
auth.authenticatePassword(
|
|
{
|
|
username: user.username,
|
|
password: operation.startsWith('password') ? replacement : password
|
|
},
|
|
limitedAddress,
|
|
initial.loginDevice!.token
|
|
)
|
|
).rejects.toMatchObject({ status: 429 });
|
|
}
|
|
);
|
|
|
|
it.each([
|
|
{ origin: 'https://ec.test', rememberMe: false },
|
|
{ origin: 'https://ec.test', rememberMe: true },
|
|
{ origin: 'http://localhost', rememberMe: false }
|
|
])('sets a separate device cookie for $origin with rememberMe=$rememberMe', async (options) => {
|
|
const now = 2_000_000_000_000;
|
|
vi.spyOn(Date, 'now').mockReturnValue(now);
|
|
const user = seedUser();
|
|
|
|
const { response, cookies } = await loginRoute(
|
|
{ username: user.username, password, rememberMe: options.rememberMe },
|
|
options
|
|
);
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(cookies.set).toHaveBeenCalledTimes(2);
|
|
const secure = options.origin.startsWith('https:');
|
|
const deviceName = secure ? '__Host-ec_login_device' : 'ec_login_device_dev';
|
|
const sessionName = secure ? '__Host-ec_session' : 'ec_session_dev';
|
|
const [, deviceToken, deviceOptions] = cookies.set.mock.calls.find(
|
|
([name]) => name === deviceName
|
|
)!;
|
|
const [, sessionToken, sessionOptions] = cookies.set.mock.calls.find(
|
|
([name]) => name === sessionName
|
|
)!;
|
|
expect(deviceOptions).toEqual({
|
|
path: '/',
|
|
httpOnly: true,
|
|
secure,
|
|
sameSite: 'lax',
|
|
expires: new Date(now + 30 * 24 * 60 * 60_000)
|
|
});
|
|
expect(sessionOptions.expires).toEqual(
|
|
new Date(
|
|
now +
|
|
(options.rememberMe
|
|
? auth.REMEMBERED_SESSION_LIFETIME_MS
|
|
: auth.SESSION_LIFETIME_MS)
|
|
)
|
|
);
|
|
expect(deviceToken).not.toBe(sessionToken);
|
|
expect(auth.readSession(deviceToken)).toBeNull();
|
|
expect(auth.readSession(sessionToken)?.remembered).toBe(options.rememberMe);
|
|
expect(response.headers.get('Cache-Control')).toBe('no-store');
|
|
expect(await response.json()).toEqual({ user: expect.objectContaining({ id: user.id }) });
|
|
});
|
|
});
|