mirror of
https://github.com/fluxerapp/fluxer
synced 2026-10-18 05:25:40 +09:00
301 lines
11 KiB
TypeScript
301 lines
11 KiB
TypeScript
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
import {randomBytes} from 'node:crypto';
|
|
import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
|
|
import type {ApiTestHarness} from '../../test/ApiTestHarness';
|
|
import {HTTP_STATUS} from '../../test/TestConstants';
|
|
import {createBuilder, createBuilderWithoutAuth} from '../../test/TestRequestBuilder';
|
|
import {TotpGenerator} from '../../utils/TotpGenerator';
|
|
import {createAuthHarness, createTestAccount, loginUser, type TestAccount} from './AuthTestUtils';
|
|
|
|
const SUDO_MODE_HEADER = 'X-Fluxer-Sudo-Mode-JWT';
|
|
|
|
interface ErrorResponse {
|
|
code: string;
|
|
message: string;
|
|
}
|
|
|
|
interface BackupCodesResponse {
|
|
backup_codes: Array<{
|
|
code: string;
|
|
consumed: boolean;
|
|
}>;
|
|
}
|
|
|
|
function generateTotpSecret(): string {
|
|
const buffer = randomBytes(20);
|
|
const base32Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
|
|
let result = '';
|
|
for (let i = 0; i < buffer.length; i += 5) {
|
|
const bytes = [buffer[i]!, buffer[i + 1]!, buffer[i + 2]!, buffer[i + 3]!, buffer[i + 4]!];
|
|
const n = (bytes[0]! << 24) | (bytes[1]! << 16) | (bytes[2]! << 8) | bytes[3]!;
|
|
const indices = [
|
|
(n >> 3) & 0x1f,
|
|
((n >> 11) | ((bytes[4]! << 4) & 0xf)) & 0x1f,
|
|
((n >> 19) | ((bytes[4]! << 2) & 0x3c)) & 0x1f,
|
|
(bytes[4]! >> 1) & 0x1f,
|
|
];
|
|
result += base32Chars[indices[0]!];
|
|
result += base32Chars[indices[1]!];
|
|
result += base32Chars[indices[2]!];
|
|
result += base32Chars[indices[3]!];
|
|
}
|
|
return result;
|
|
}
|
|
|
|
async function generateTotpCode(secret: string): Promise<string> {
|
|
const totp = new TotpGenerator(secret);
|
|
const codes = await totp.generateTotp();
|
|
return codes[0]!;
|
|
}
|
|
|
|
async function enableTotpForAccount(harness: ApiTestHarness, account: TestAccount, secret: string): Promise<void> {
|
|
const code = await generateTotpCode(secret);
|
|
await createBuilder(harness, account.token)
|
|
.post('/users/@me/mfa/totp/enable')
|
|
.body({
|
|
secret,
|
|
code,
|
|
password: account.password,
|
|
})
|
|
.execute();
|
|
}
|
|
|
|
async function loginWithTotp(harness: ApiTestHarness, account: TestAccount, secret: string): Promise<TestAccount> {
|
|
const login = await loginUser(harness, {email: account.email, password: account.password});
|
|
if (!('mfa' in login)) {
|
|
throw new Error('Expected MFA login');
|
|
}
|
|
const mfaLoginResp = await createBuilderWithoutAuth<{
|
|
token: string;
|
|
}>(harness)
|
|
.post('/auth/login/mfa/totp')
|
|
.body({
|
|
ticket: login.ticket,
|
|
code: await generateTotpCode(secret),
|
|
})
|
|
.execute();
|
|
return {...account, token: mfaLoginResp.token};
|
|
}
|
|
|
|
async function getSudoTokenViaMfa(harness: ApiTestHarness, token: string, secret: string): Promise<string> {
|
|
const {response} = await createBuilder<BackupCodesResponse>(harness, token)
|
|
.post('/users/@me/mfa/backup-codes')
|
|
.body({
|
|
mfa_method: 'totp',
|
|
mfa_code: await generateTotpCode(secret),
|
|
regenerate: false,
|
|
})
|
|
.executeWithResponse();
|
|
const sudoToken = response.headers.get(SUDO_MODE_HEADER);
|
|
if (!sudoToken) {
|
|
throw new Error('No sudo token returned');
|
|
}
|
|
return sudoToken;
|
|
}
|
|
|
|
describe('Sudo mode negative cases', () => {
|
|
let harness: ApiTestHarness;
|
|
beforeAll(async () => {
|
|
harness = await createAuthHarness();
|
|
});
|
|
beforeEach(async () => {
|
|
await harness.reset();
|
|
});
|
|
afterAll(async () => {
|
|
await harness?.shutdown();
|
|
});
|
|
describe('invalid sudo token rejected', () => {
|
|
it('rejects malformed sudo token', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const secret = generateTotpSecret();
|
|
await enableTotpForAccount(harness, account, secret);
|
|
const loggedIn = await loginWithTotp(harness, account, secret);
|
|
const invalidTokens = [
|
|
'invalid-token',
|
|
'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.invalid.signature',
|
|
'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoibm90LXN1ZG8ifQ.fakesignature',
|
|
];
|
|
for (const invalidToken of invalidTokens) {
|
|
const {json: errResp} = await createBuilder<ErrorResponse>(harness, loggedIn.token)
|
|
.post('/users/@me/disable')
|
|
.header(SUDO_MODE_HEADER, invalidToken)
|
|
.body({})
|
|
.expect(HTTP_STATUS.FORBIDDEN)
|
|
.executeWithResponse();
|
|
expect(errResp.code).toBe('SUDO_MODE_REQUIRED');
|
|
}
|
|
});
|
|
it('rejects empty sudo token header', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const secret = generateTotpSecret();
|
|
await enableTotpForAccount(harness, account, secret);
|
|
const loggedIn = await loginWithTotp(harness, account, secret);
|
|
const {json: errResp} = await createBuilder<ErrorResponse>(harness, loggedIn.token)
|
|
.post('/users/@me/disable')
|
|
.body({})
|
|
.expect(HTTP_STATUS.FORBIDDEN)
|
|
.executeWithResponse();
|
|
expect(errResp.code).toBe('SUDO_MODE_REQUIRED');
|
|
});
|
|
});
|
|
describe('wrong password rejected when verifying sudo', () => {
|
|
it('rejects wrong password for password-only user', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const wrongPasswords = ['wrong-password', `${account.password}extra`, 'password123'];
|
|
for (const wrongPassword of wrongPasswords) {
|
|
await createBuilder(harness, account.token)
|
|
.post('/users/@me/disable')
|
|
.body({
|
|
password: wrongPassword,
|
|
})
|
|
.expect(HTTP_STATUS.BAD_REQUEST)
|
|
.execute();
|
|
}
|
|
});
|
|
it('requires password for password-only user - returns 403 without password', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const {json: errResp} = await createBuilder<ErrorResponse>(harness, account.token)
|
|
.post('/users/@me/disable')
|
|
.body({})
|
|
.expect(HTTP_STATUS.FORBIDDEN)
|
|
.executeWithResponse();
|
|
expect(errResp.code).toBe('SUDO_MODE_REQUIRED');
|
|
});
|
|
});
|
|
describe('wrong MFA code rejected', () => {
|
|
it('rejects incorrect TOTP codes', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const secret = generateTotpSecret();
|
|
await enableTotpForAccount(harness, account, secret);
|
|
const loggedIn = await loginWithTotp(harness, account, secret);
|
|
const wrongCodes = ['000000', '123456', '999999', '12345', '1234567', 'abcdef'];
|
|
for (const wrongCode of wrongCodes) {
|
|
await createBuilder(harness, loggedIn.token)
|
|
.post('/users/@me/disable')
|
|
.body({
|
|
mfa_method: 'totp',
|
|
mfa_code: wrongCode,
|
|
})
|
|
.expect(HTTP_STATUS.BAD_REQUEST)
|
|
.execute();
|
|
}
|
|
});
|
|
});
|
|
describe('sudo token for wrong user rejected', () => {
|
|
it('rejects sudo token from different user', async () => {
|
|
const account1 = await createTestAccount(harness);
|
|
const secret1 = generateTotpSecret();
|
|
await enableTotpForAccount(harness, account1, secret1);
|
|
const loggedIn1 = await loginWithTotp(harness, account1, secret1);
|
|
const user1SudoToken = await getSudoTokenViaMfa(harness, loggedIn1.token, secret1);
|
|
const account2 = await createTestAccount(harness);
|
|
const secret2 = generateTotpSecret();
|
|
await enableTotpForAccount(harness, account2, secret2);
|
|
const loggedIn2 = await loginWithTotp(harness, account2, secret2);
|
|
const {json: errResp} = await createBuilder<ErrorResponse>(harness, loggedIn2.token)
|
|
.post('/users/@me/disable')
|
|
.header(SUDO_MODE_HEADER, user1SudoToken)
|
|
.body({})
|
|
.expect(HTTP_STATUS.FORBIDDEN)
|
|
.executeWithResponse();
|
|
expect(errResp.code).toBe('SUDO_MODE_REQUIRED');
|
|
});
|
|
});
|
|
describe('password user requires password each time', () => {
|
|
it('password user does not receive sudo token', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const {response} = await createBuilder(harness, account.token)
|
|
.post('/users/@me/disable')
|
|
.body({
|
|
password: account.password,
|
|
})
|
|
.expect(HTTP_STATUS.NO_CONTENT)
|
|
.executeWithResponse();
|
|
const sudoToken = response.headers.get(SUDO_MODE_HEADER);
|
|
expect(sudoToken).toBeFalsy();
|
|
});
|
|
it('password user must provide password for subsequent sensitive operations', async () => {
|
|
const account = await createTestAccount(harness);
|
|
await createBuilder(harness, account.token)
|
|
.post('/users/@me/disable')
|
|
.body({
|
|
password: account.password,
|
|
})
|
|
.expect(HTTP_STATUS.NO_CONTENT)
|
|
.execute();
|
|
const login = await loginUser(harness, {email: account.email, password: account.password});
|
|
if ('mfa' in login && login.mfa) {
|
|
throw new Error('Expected non-MFA login');
|
|
}
|
|
const nonMfaLogin = login as {
|
|
user_id: string;
|
|
token: string;
|
|
};
|
|
const {json: errResp} = await createBuilder<ErrorResponse>(harness, nonMfaLogin.token)
|
|
.post('/users/@me/disable')
|
|
.body({})
|
|
.expect(HTTP_STATUS.FORBIDDEN)
|
|
.executeWithResponse();
|
|
expect(errResp.code).toBe('SUDO_MODE_REQUIRED');
|
|
});
|
|
});
|
|
describe('MFA registration without token fails', () => {
|
|
it('WebAuthn registration options do not issue sudo token', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const secret = generateTotpSecret();
|
|
await enableTotpForAccount(harness, account, secret);
|
|
const loggedIn = await loginWithTotp(harness, account, secret);
|
|
const sudoToken = await getSudoTokenViaMfa(harness, loggedIn.token, secret);
|
|
const {response} = await createBuilder(harness, loggedIn.token)
|
|
.post('/users/@me/mfa/webauthn/credentials/registration-options')
|
|
.header(SUDO_MODE_HEADER, sudoToken)
|
|
.body({})
|
|
.executeWithResponse();
|
|
const newSudoToken = response.headers.get(SUDO_MODE_HEADER);
|
|
expect(newSudoToken).toBeFalsy();
|
|
});
|
|
});
|
|
describe('existing MFA token allows skipping MFA', () => {
|
|
it('valid sudo token allows skipping MFA for subsequent requests', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const secret = generateTotpSecret();
|
|
await enableTotpForAccount(harness, account, secret);
|
|
const loggedIn = await loginWithTotp(harness, account, secret);
|
|
const {response: firstResp} = await createBuilder<BackupCodesResponse>(harness, loggedIn.token)
|
|
.post('/users/@me/mfa/backup-codes')
|
|
.body({
|
|
mfa_method: 'totp',
|
|
mfa_code: await generateTotpCode(secret),
|
|
regenerate: false,
|
|
})
|
|
.executeWithResponse();
|
|
const sudoToken = firstResp.headers.get(SUDO_MODE_HEADER);
|
|
expect(sudoToken).toBeTruthy();
|
|
const backupCodes = await createBuilder<BackupCodesResponse>(harness, loggedIn.token)
|
|
.post('/users/@me/mfa/backup-codes')
|
|
.header(SUDO_MODE_HEADER, sudoToken!)
|
|
.body({
|
|
regenerate: true,
|
|
})
|
|
.execute();
|
|
expect(backupCodes.backup_codes.length).toBeGreaterThan(0);
|
|
});
|
|
it('sudo token from MFA allows skipping MFA verification on sensitive endpoint', async () => {
|
|
const account = await createTestAccount(harness);
|
|
const secret = generateTotpSecret();
|
|
await enableTotpForAccount(harness, account, secret);
|
|
const loggedIn = await loginWithTotp(harness, account, secret);
|
|
const sudoToken = await getSudoTokenViaMfa(harness, loggedIn.token, secret);
|
|
const backupCodes = await createBuilder<BackupCodesResponse>(harness, loggedIn.token)
|
|
.post('/users/@me/mfa/backup-codes')
|
|
.header(SUDO_MODE_HEADER, sudoToken)
|
|
.body({
|
|
regenerate: false,
|
|
})
|
|
.execute();
|
|
expect(backupCodes.backup_codes.length).toBeGreaterThan(0);
|
|
});
|
|
});
|
|
});
|