fix(auth): harden tht auth mutations

2026-08-16 19:37:12 +02:00
parent 9646ae09a0
commit 856ac05edc
6 changed files with 245 additions and 31 deletions
@@ -4,12 +4,14 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"

 	"github.com/aritmolab/thothii/tools/tht/internal/config"
+	"github.com/aritmolab/thothii/tools/tht/internal/safeio"
 )

 func TestRunConfiguresLocalRegistryAndRedactsStatusJSON(t *testing.T) {
@@ -155,6 +157,145 @@ func TestRunRefusesNonTTYPasswordsWithoutPasswordFile(t *testing.T) {
 	}
 }

+func TestRunBumpsRevisionExactlyOnceForEverySecurityMutation(t *testing.T) {
+	directory := newAuthDirectory(t)
+	installation := authInstallation(directory)
+	adminPassword := writePasswordFile(t, "initial administrator password\n")
+	userPassword := writePasswordFile(t, "ordinary user password one\n")
+	if code := Run(context.Background(), installation, []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", adminPassword}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
+		t.Fatalf("configure = %d", code)
+	}
+	if code := Run(context.Background(), installation, []string{"user", "add", "operator", "--role", "user", "--password-file", userPassword}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
+		t.Fatalf("add = %d", code)
+	}
+	for _, test := range []struct {
+		args         []string
+		wantRevision uint64
+		wantCode     int
+	}{
+		{[]string{"user", "set-password", "operator", "--password-file", adminPassword}, 2, 0},
+		{[]string{"user", "disable", "operator"}, 3, 0},
+		{[]string{"user", "disable", "operator"}, 3, 0}, // intentional idempotent no-op
+		{[]string{"user", "enable", "operator"}, 4, 0},
+		{[]string{"user", "enable", "operator"}, 4, 0}, // intentional idempotent no-op
+		{[]string{"user", "grant", "operator", "--role", "admin"}, 5, 0},
+		{[]string{"user", "grant", "operator", "--role", "admin"}, 5, 2}, // rejected duplicate
+		{[]string{"user", "revoke", "operator", "--role", "admin"}, 6, 0},
+		{[]string{"user", "revoke", "operator", "--role", "admin"}, 6, 2}, // rejected duplicate
+		{[]string{"user", "logout-all", "operator", "--yes"}, 7, 0},
+	} {
+		code := Run(context.Background(), installation, test.args, strings.NewReader(""), ioDiscard{}, ioDiscard{})
+		if code != test.wantCode {
+			t.Fatalf("%v = %d, want %d", test.args, code, test.wantCode)
+		}
+		if got := authRevisionFor(t, directory, "operator"); got != test.wantRevision {
+			t.Fatalf("%v revision = %d, want %d", test.args, got, test.wantRevision)
+		}
+	}
+}
+
+func TestRunUserListJSONRedactsPasswordHash(t *testing.T) {
+	directory := newAuthDirectory(t)
+	installation := authInstallation(directory)
+	passwordFile := writePasswordFile(t, "this is a local test password\n")
+	if code := Run(context.Background(), installation, []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
+		t.Fatalf("configure = %d", code)
+	}
+	var stdout, stderr bytes.Buffer
+	if code := Run(context.Background(), installation, []string{"user", "list", "--json"}, strings.NewReader(""), &stdout, &stderr); code != 0 {
+		t.Fatalf("list = %d, stderr=%q", code, stderr.String())
+	}
+	var listed struct {
+		Users []User `json:"users"`
+	}
+	if err := json.Unmarshal(stdout.Bytes(), &listed); err != nil || len(listed.Users) != 1 {
+		t.Fatalf("list JSON = %q, err=%v", stdout.String(), err)
+	}
+	if strings.Contains(stdout.String()+stderr.String(), "this is a local test password") || strings.Contains(stdout.String()+stderr.String(), "$argon2id$") || strings.Contains(stdout.String(), "passwordHash") {
+		t.Fatalf("list JSON exposed password material: stdout=%q stderr=%q", stdout.String(), stderr.String())
+	}
+}
+
+func TestStrictOptionParsersRejectEmptyDuplicateMissingAndWrongModeFlags(t *testing.T) {
+	for _, args := range [][]string{
+		{"--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-display-name", "", "--admin-display-name", "Admin"},
+		{"--mode", "local", "--public-url", "http://127.0.0.1:8080", "--issuer", "https://auth.example.org/"},
+		{"--mode", "oidc", "--public-url", "https://thothii.example.org", "--issuer", "https://auth.example.org/", "--client-id", "client", "--authentik-base-url", "https://auth.example.org", "--user-group", "users", "--admin-group", "admins", "--password-file", "password-file"},
+		{"--mode", "local", "--public-url"},
+	} {
+		if _, err := parseConfigure(args); err == nil {
+			t.Fatalf("parseConfigure(%q) accepted unsafe options", args)
+		}
+	}
+	for _, args := range [][]string{
+		{"operator", "--role", "user", "--display-name", "", "--display-name", "Operator"},
+		{"operator", "--role", "user", "--password-file", ""},
+		{"operator", "--role"},
+	} {
+		if _, _, err := parseUserRolePassword(args); err == nil {
+			t.Fatalf("parseUserRolePassword(%q) accepted unsafe options", args)
+		}
+	}
+}
+
+func TestConfigureRecoversSafeOrphanUsersFileAfterInterruptedBootstrap(t *testing.T) {
+	directory := writeAuthFiles(t, defaultAuthYAML, registryYAML(adminUserYAML("abandoned", "Abandoned", true, "admin")))
+	if err := safeio.RemoveCanonicalPrivateRegular(filepath.Join(directory, authFileName)); err != nil {
+		t.Fatal(err)
+	}
+	passwordFile := writePasswordFile(t, "this is a local test password\n")
+	if code := Run(context.Background(), authInstallation(directory), []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
+		t.Fatalf("recovered configure = %d", code)
+	}
+	if got := authRevisionFor(t, directory, "admin"); got != 1 {
+		t.Fatalf("recovered initial administrator revision = %d, want 1", got)
+	}
+}
+
+func TestConfigureRollsBackPublishFailureAndRetrySucceeds(t *testing.T) {
+	for _, failAt := range []int{1, 2} {
+		t.Run("publish failure", func(t *testing.T) {
+			directory := newAuthDirectory(t)
+			passwordFile := writePasswordFile(t, "this is a local test password\n")
+			previous := writeNewAuthFile
+			calls := 0
+			writeNewAuthFile = func(path string, contents []byte, mode os.FileMode) error {
+				calls++
+				if calls == failAt {
+					return errors.New("injected publish failure")
+				}
+				return previous(path, contents, mode)
+			}
+			t.Cleanup(func() { writeNewAuthFile = previous })
+			if code := Run(context.Background(), authInstallation(directory), []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code == 0 {
+				t.Fatal("configure succeeded despite injected publish failure")
+			}
+			for _, name := range []string{authFileName, usersFileName} {
+				if _, err := os.Lstat(filepath.Join(directory, name)); !errors.Is(err, os.ErrNotExist) {
+					t.Fatalf("%s remains after failed bootstrap: %v", name, err)
+				}
+			}
+			writeNewAuthFile = previous
+			if code := Run(context.Background(), authInstallation(directory), []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
+				t.Fatalf("retry = %d", code)
+			}
+		})
+	}
+}
+
+func authRevisionFor(t *testing.T, directory, username string) uint64 {
+	t.Helper()
+	_, registry, err := Load(directory)
+	if err != nil {
+		t.Fatal(err)
+	}
+	user := registry.FindByUsername(username)
+	if user == nil {
+		t.Fatalf("missing user %q", username)
+	}
+	return user.AuthRevision
+}
+
 func writePasswordFile(t *testing.T, password string) string {
 	t.Helper()
 	path := filepath.Join(newAuthDirectory(t), "password")