fix(auth): harden async login boundaries
This commit is contained in:
@@ -1,60 +1,17 @@
|
||||
import { afterEach, expect, test } from "vitest";
|
||||
import { chmodSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import { stringify } from "yaml";
|
||||
import { buildApp } from "../src/app.js";
|
||||
import { loadConfig } from "../src/config.js";
|
||||
import { deriveCsrfToken } from "../src/auth/csrf.js";
|
||||
import { createLocalAuthFixture, localPublicUrl } from "./auth-test-fixtures.js";
|
||||
|
||||
const password = "correct horse battery staple";
|
||||
const passwordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";
|
||||
const adminId = "6ba7b810-9dad-4ed1-80b4-00c04fd430c8";
|
||||
const publicUrl = "http://127.0.0.1:8787";
|
||||
const cleanups: Array<() => Promise<void>> = [];
|
||||
|
||||
afterEach(async () => {
|
||||
for (const cleanup of cleanups.splice(0).reverse()) await cleanup();
|
||||
});
|
||||
|
||||
function sessionCookie(response: { headers: Record<string, string | string[] | undefined> }): string {
|
||||
const setCookie = response.headers["set-cookie"];
|
||||
const first = Array.isArray(setCookie) ? setCookie[0] : setCookie;
|
||||
return first?.split(";", 1)[0] ?? "";
|
||||
}
|
||||
|
||||
async function createApp() {
|
||||
const directory = mkdtempSync(join(realpathSync(tmpdir()), "thothii-auth-csrf-"));
|
||||
chmodSync(directory, 0o700);
|
||||
const authConfigFile = join(directory, "auth.yaml");
|
||||
const usersFile = join(directory, "users.yaml");
|
||||
writeFileSync(authConfigFile, stringify({
|
||||
version: 1, mode: "local", publicUrl, local: { usersFile: "users.yaml" },
|
||||
}), { encoding: "utf8", mode: 0o600 });
|
||||
writeFileSync(usersFile, [
|
||||
"version: 1", "users:", ` - id: ${adminId}`, " username: Admin",
|
||||
" displayName: Local administrator", ` passwordHash: ${passwordHash}`,
|
||||
" roles:", " - admin", " enabled: true", " authRevision: 1", "",
|
||||
].join("\n"), { encoding: "utf8", mode: 0o600 });
|
||||
chmodSync(authConfigFile, 0o600);
|
||||
chmodSync(usersFile, 0o600);
|
||||
const app = buildApp(loadConfig({
|
||||
THT_AUTH_CONFIG_FILE: authConfigFile,
|
||||
THT_AUTH_STATE_ROOT: join(directory, "auth-state"),
|
||||
THT_HARNESS_DIR: "/tmp/h",
|
||||
}));
|
||||
cleanups.push(async () => {
|
||||
await app.close();
|
||||
rmSync(directory, { recursive: true, force: true });
|
||||
});
|
||||
const signedIn = await app.inject({
|
||||
method: "POST", url: "/auth/local/login",
|
||||
headers: { origin: publicUrl, "sec-fetch-site": "same-origin" },
|
||||
payload: { username: "Admin", password },
|
||||
});
|
||||
const cookie = sessionCookie(signedIn);
|
||||
const me = await app.inject({ method: "GET", url: "/me", headers: { cookie } });
|
||||
return { app, cookie, csrfToken: me.json().csrfToken as string };
|
||||
const fixture = await createLocalAuthFixture();
|
||||
cleanups.push(() => fixture.close());
|
||||
return fixture;
|
||||
}
|
||||
|
||||
test("derived CSRF tokens are deterministic per opaque cookie and are never the cookie token", async () => {
|
||||
@@ -68,10 +25,10 @@ test("derived CSRF tokens are deterministic per opaque cookie and are never the
|
||||
test("cookie-authenticated state changes require an exact Origin, Fetch Metadata when present, and CSRF token", async () => {
|
||||
const { app, cookie, csrfToken } = await createApp();
|
||||
const cases = [
|
||||
{ headers: { cookie, origin: publicUrl, "sec-fetch-site": "same-origin" } },
|
||||
{ headers: { cookie, origin: localPublicUrl, "sec-fetch-site": "same-origin" } },
|
||||
{ headers: { cookie, origin: "http://127.0.0.1:8788", "sec-fetch-site": "same-origin", "x-thothii-csrf": csrfToken } },
|
||||
{ headers: { cookie, origin: publicUrl, "sec-fetch-site": "cross-site", "x-thothii-csrf": csrfToken } },
|
||||
{ headers: { cookie, origin: publicUrl, "x-thothii-csrf": csrfToken.slice(0, -1) } },
|
||||
{ headers: { cookie, origin: localPublicUrl, "sec-fetch-site": "cross-site", "x-thothii-csrf": csrfToken } },
|
||||
{ headers: { cookie, origin: localPublicUrl, "x-thothii-csrf": csrfToken.slice(0, -1) } },
|
||||
];
|
||||
|
||||
for (const request of cases) {
|
||||
@@ -85,26 +42,36 @@ test("duplicate or malformed CSRF and session-cookie headers fail closed", async
|
||||
const { app, cookie, csrfToken } = await createApp();
|
||||
const duplicateCsrf = await app.inject({
|
||||
method: "POST", url: "/auth/logout",
|
||||
headers: { cookie, origin: publicUrl, "x-thothii-csrf": `${csrfToken}, ${csrfToken}` },
|
||||
headers: { cookie, origin: localPublicUrl, "x-thothii-csrf": `${csrfToken}, ${csrfToken}` },
|
||||
});
|
||||
const duplicateCookie = await app.inject({
|
||||
method: "POST", url: "/auth/logout",
|
||||
headers: { cookie: `${cookie}; ${cookie}`, origin: publicUrl, "x-thothii-csrf": csrfToken },
|
||||
headers: { cookie: `${cookie}; ${cookie}`, origin: localPublicUrl, "x-thothii-csrf": csrfToken },
|
||||
});
|
||||
const malformedCookie = await app.inject({
|
||||
method: "POST", url: "/auth/logout",
|
||||
headers: { cookie: "thothii_session=not-a-token", origin: publicUrl, "x-thothii-csrf": csrfToken },
|
||||
headers: { cookie: "thothii_session=not-a-token", origin: localPublicUrl, "x-thothii-csrf": csrfToken },
|
||||
});
|
||||
const oversizedCsrf = await app.inject({
|
||||
method: "POST", url: "/auth/logout",
|
||||
headers: { cookie, origin: localPublicUrl, "x-thothii-csrf": "x".repeat(4097) },
|
||||
});
|
||||
const oversizedCookie = await app.inject({
|
||||
method: "POST", url: "/auth/logout",
|
||||
headers: { cookie: `${cookie}; padding=${"x".repeat(4097)}`, origin: localPublicUrl, "x-thothii-csrf": csrfToken },
|
||||
});
|
||||
|
||||
expect(duplicateCsrf.statusCode).toBe(403);
|
||||
expect(duplicateCookie.statusCode).toBe(401);
|
||||
expect(malformedCookie.statusCode).toBe(401);
|
||||
expect(oversizedCsrf.statusCode).toBe(403);
|
||||
expect(oversizedCookie.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("an unauthenticated state-changing application route cannot bypass the central boundary", async () => {
|
||||
const { app } = await createApp();
|
||||
const response = await app.inject({
|
||||
method: "POST", url: "/sessions", headers: { origin: publicUrl, "x-thothii-csrf": "x".repeat(43) },
|
||||
method: "POST", url: "/sessions", headers: { origin: localPublicUrl, "x-thothii-csrf": "x".repeat(43) },
|
||||
payload: { question: "must not reach a session handler" },
|
||||
});
|
||||
expect(response.statusCode).toBe(401);
|
||||
|
||||
@@ -2,11 +2,11 @@ import { readFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
import { describe, expect, test, vi } from "vitest";
|
||||
|
||||
const { argon2SyncSpy } = vi.hoisted(() => ({ argon2SyncSpy: vi.fn() }));
|
||||
const { argon2Spy } = vi.hoisted(() => ({ argon2Spy: vi.fn() }));
|
||||
vi.mock("node:crypto", async (importOriginal) => {
|
||||
const actual = await importOriginal<typeof import("node:crypto")>();
|
||||
argon2SyncSpy.mockImplementation(actual.argon2Sync);
|
||||
return { ...actual, argon2Sync: argon2SyncSpy };
|
||||
argon2Spy.mockImplementation(actual.argon2);
|
||||
return { ...actual, argon2: argon2Spy };
|
||||
});
|
||||
|
||||
import { verifyPassword } from "../src/auth/password.js";
|
||||
@@ -22,51 +22,51 @@ const vectors = JSON.parse(readFileSync(
|
||||
)) as Argon2Vector[];
|
||||
|
||||
describe("local Argon2id password verification", () => {
|
||||
test("accepts every committed Go-generated vector", () => {
|
||||
test("accepts every committed Go-generated vector", async () => {
|
||||
expect(vectors.length).toBeGreaterThan(0);
|
||||
for (const vector of vectors) {
|
||||
expect(verifyPassword(vector.password, vector.phc)).toBe(true);
|
||||
await expect(verifyPassword(vector.password, vector.phc)).resolves.toBe(true);
|
||||
}
|
||||
});
|
||||
|
||||
test("rejects a one-byte password change", () => {
|
||||
test("rejects a one-byte password change", async () => {
|
||||
for (const vector of vectors) {
|
||||
expect(verifyPassword(`${vector.password}!`, vector.phc)).toBe(false);
|
||||
await expect(verifyPassword(`${vector.password}!`, vector.phc)).resolves.toBe(false);
|
||||
}
|
||||
});
|
||||
|
||||
test("rejects ill-formed Unicode instead of authenticating as U+FFFD", () => {
|
||||
test("rejects ill-formed Unicode instead of authenticating as U+FFFD", async () => {
|
||||
const replacementPassword = "correct horse battery stap\uFFFD";
|
||||
const loneSurrogatePassword = "correct horse battery stap\uD800";
|
||||
const replacementPasswordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$+tAXzgaQVnNaonNvgevyG6UKlaKcwyRMi1mESNk0BvQ";
|
||||
|
||||
expect(verifyPassword(replacementPassword, replacementPasswordHash)).toBe(true);
|
||||
expect(verifyPassword(loneSurrogatePassword, replacementPasswordHash)).toBe(false);
|
||||
await expect(verifyPassword(replacementPassword, replacementPasswordHash)).resolves.toBe(true);
|
||||
await expect(verifyPassword(loneSurrogatePassword, replacementPasswordHash)).resolves.toBe(false);
|
||||
});
|
||||
|
||||
test("accepts a multibyte password at exactly the 1024-byte boundary", () => {
|
||||
test("accepts a multibyte password at exactly the 1024-byte boundary", async () => {
|
||||
const password = "é".repeat(512);
|
||||
const passwordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$LfO3M3JBKeXf1knenCjQ6m9z4B7nedb0As2uc522I1I";
|
||||
|
||||
expect(Buffer.byteLength(password, "utf8")).toBe(1024);
|
||||
expect(verifyPassword(password, passwordHash)).toBe(true);
|
||||
expect(verifyPassword(`${password}é`, passwordHash)).toBe(false);
|
||||
await expect(verifyPassword(password, passwordHash)).resolves.toBe(true);
|
||||
await expect(verifyPassword(`${password}é`, passwordHash)).resolves.toBe(false);
|
||||
});
|
||||
|
||||
test("rejects an over-limit password before converting it with Buffer.from", () => {
|
||||
test("rejects an over-limit password before converting it with Buffer.from", async () => {
|
||||
const password = "é".repeat(513);
|
||||
const fromSpy = vi.spyOn(Buffer, "from");
|
||||
|
||||
try {
|
||||
expect(Buffer.byteLength(password, "utf8")).toBe(1026);
|
||||
expect(verifyPassword(password, vectors[0].phc)).toBe(false);
|
||||
await expect(verifyPassword(password, vectors[0].phc)).resolves.toBe(false);
|
||||
expect(fromSpy.mock.calls.some(([value, encoding]) => value === password && encoding === "utf8")).toBe(false);
|
||||
} finally {
|
||||
fromSpy.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
test("rejects malformed and oversized PHC parameters before Argon2 allocation", () => {
|
||||
test("rejects malformed and oversized PHC parameters before Argon2 allocation", async () => {
|
||||
const password = vectors[0].password;
|
||||
const digest = vectors[0].phc.split("$")[5];
|
||||
const salt = vectors[0].phc.split("$")[4];
|
||||
@@ -79,9 +79,9 @@ describe("local Argon2id password verification", () => {
|
||||
];
|
||||
|
||||
for (const phc of cases) {
|
||||
argon2SyncSpy.mockClear();
|
||||
expect(verifyPassword(password, phc)).toBe(false);
|
||||
expect(argon2SyncSpy).not.toHaveBeenCalled();
|
||||
argon2Spy.mockClear();
|
||||
await expect(verifyPassword(password, phc)).resolves.toBe(false);
|
||||
expect(argon2Spy).not.toHaveBeenCalled();
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -0,0 +1,80 @@
|
||||
import { afterAll, beforeAll, expect, test } from "vitest";
|
||||
import { createLocalAuthFixture, type LocalAuthFixture, localPublicUrl } from "./auth-test-fixtures.js";
|
||||
|
||||
interface StateChangingRoute {
|
||||
family: string;
|
||||
method: "POST" | "PUT" | "DELETE";
|
||||
url: string;
|
||||
}
|
||||
|
||||
const stateChangingRoutes: readonly StateChangingRoute[] = [
|
||||
{ family: "auth logout", method: "POST", url: "/auth/logout" },
|
||||
{ family: "runtime prewarm", method: "POST", url: "/runtime/prewarm" },
|
||||
{ family: "session create", method: "POST", url: "/sessions" },
|
||||
{ family: "session mutation", method: "POST", url: "/sessions/session-1/response" },
|
||||
{ family: "session mutation", method: "POST", url: "/sessions/session-1/steer" },
|
||||
{ family: "session mutation", method: "POST", url: "/sessions/session-1/resume" },
|
||||
{ family: "session mutation", method: "POST", url: "/sessions/session-1/close" },
|
||||
{ family: "session mutation", method: "POST", url: "/sessions/session-1/rename" },
|
||||
{ family: "session mutation", method: "POST", url: "/sessions/session-1/group" },
|
||||
{ family: "session archive", method: "POST", url: "/sessions/session-1/archive" },
|
||||
{ family: "session archive", method: "POST", url: "/sessions/session-1/unarchive" },
|
||||
{ family: "session delete", method: "DELETE", url: "/sessions/session-1" },
|
||||
{ family: "SQL preview", method: "POST", url: "/sessions/session-1/sql/preview" },
|
||||
{ family: "SQL export", method: "POST", url: "/sessions/session-1/sql/export" },
|
||||
{ family: "workspace registry", method: "POST", url: "/workspace-registry/pull" },
|
||||
{ family: "workspace validation", method: "POST", url: "/workspaces/validate" },
|
||||
{ family: "workspace secrets", method: "PUT", url: "/workspaces/workspace-1/secrets" },
|
||||
{ family: "workspace secrets", method: "DELETE", url: "/workspaces/workspace-1/secrets/secret-1" },
|
||||
{ family: "workspace diagnostics", method: "POST", url: "/workspaces/workspace-1/test" },
|
||||
{ family: "settings", method: "PUT", url: "/settings" },
|
||||
{ family: "Pi management", method: "PUT", url: "/pi-management/config" },
|
||||
{ family: "Pi management", method: "POST", url: "/pi-management/test" },
|
||||
{ family: "maintenance", method: "POST", url: "/internal/maintenance/activate" },
|
||||
{ family: "maintenance", method: "POST", url: "/internal/maintenance/deactivate" },
|
||||
];
|
||||
|
||||
let fixture: LocalAuthFixture;
|
||||
|
||||
beforeAll(async () => {
|
||||
fixture = await createLocalAuthFixture();
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await fixture.close();
|
||||
});
|
||||
|
||||
test.each(stateChangingRoutes)(
|
||||
"$family $method $url rejects every production CSRF/session-boundary failure before downstream code",
|
||||
async ({ method, url }) => {
|
||||
const failures = [
|
||||
fixture.sessionHeaders({ "x-thothii-csrf": undefined }),
|
||||
fixture.sessionHeaders({ "x-thothii-csrf": "malformed" }),
|
||||
fixture.sessionHeaders({ origin: undefined }),
|
||||
fixture.sessionHeaders({ origin: "http://wrong.example.test" }),
|
||||
fixture.sessionHeaders({ "sec-fetch-site": "cross-site" }),
|
||||
];
|
||||
|
||||
for (const headers of failures) {
|
||||
fixture.resetDownstreamHits();
|
||||
const response = await fixture.app.inject({ method, url, headers, payload: {} });
|
||||
expect(response.statusCode).toBe(403);
|
||||
expect(response.json()).toEqual({ code: "csrf_failed", error: "Request origin validation failed" });
|
||||
expect(fixture.downstreamHits()).toBe(0);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
test("a valid real local session cookie and derived CSRF token cross the same production boundary", async () => {
|
||||
fixture.resetDownstreamHits();
|
||||
const response = await fixture.app.inject({
|
||||
method: "PUT",
|
||||
url: "/settings",
|
||||
headers: fixture.sessionHeaders(),
|
||||
payload: {},
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(fixture.downstreamHits()).toBe(1);
|
||||
expect(localPublicUrl).toBe("http://127.0.0.1:8787");
|
||||
});
|
||||
@@ -5,6 +5,7 @@ import { join } from "node:path";
|
||||
import { stringify } from "yaml";
|
||||
import { buildApp } from "../src/app.js";
|
||||
import { loadConfig } from "../src/config.js";
|
||||
import { LoginFailureLimiter } from "../src/auth/routes.js";
|
||||
|
||||
const password = "correct horse battery staple";
|
||||
const passwordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";
|
||||
@@ -270,6 +271,66 @@ test("failed logins are limited by normalized username and source address", asyn
|
||||
expect((await login(addressLimited.app, { username: "A-new-username" })).statusCode).toBe(429);
|
||||
});
|
||||
|
||||
test("failed-attempt limiter keeps exact bounded windows without check-time mutation or active-key eviction", () => {
|
||||
const now = 1_000_000;
|
||||
const limiter = new LoginFailureLimiter({ maximumEntries: 2 });
|
||||
|
||||
expect(limiter.isLimited("checked-only", "127.0.0.1", now)).toBe(false);
|
||||
expect(limiter.recordFailure("victim", "127.0.0.1", now)).toBe(true);
|
||||
expect(limiter.recordFailure("attacker", "127.0.0.1", now)).toBe(true);
|
||||
expect(limiter.recordFailure("flood", "127.0.0.1", now)).toBe(false);
|
||||
|
||||
for (let attempt = 1; attempt < 10; attempt += 1) {
|
||||
expect(limiter.recordFailure("victim", "127.0.0.1", now)).toBe(true);
|
||||
}
|
||||
expect(limiter.isLimited("victim", "127.0.0.1", now)).toBe(true);
|
||||
expect(limiter.recordFailure("victim", "127.0.0.1", now)).toBe(false);
|
||||
expect(limiter.isLimited("victim", "127.0.0.1", now + 10 * 60 * 1000 - 1)).toBe(true);
|
||||
expect(limiter.isLimited("victim", "127.0.0.1", now + 10 * 60 * 1000)).toBe(false);
|
||||
expect(limiter.recordFailure("victim", "127.0.0.1", now + 10 * 60 * 1000)).toBe(true);
|
||||
});
|
||||
|
||||
test("failed-attempt limiter allows twenty source-address failures, then rejects the twenty-first", () => {
|
||||
const limiter = new LoginFailureLimiter();
|
||||
const now = 1_000_000;
|
||||
|
||||
for (let attempt = 0; attempt < 20; attempt += 1) {
|
||||
expect(limiter.recordFailure(`user-${attempt}`, "127.0.0.1", now)).toBe(true);
|
||||
}
|
||||
expect(limiter.isLimited("new-user", "127.0.0.1", now)).toBe(true);
|
||||
expect(limiter.recordFailure("new-user", "127.0.0.1", now)).toBe(false);
|
||||
});
|
||||
|
||||
test("successful and pre-authentication failures never reset or consume failed-login counters", async () => {
|
||||
let calls = 0;
|
||||
const user = {
|
||||
id: adminId, username: "Admin", normalizedUsername: "admin", displayName: "Local administrator",
|
||||
passwordHash, roles: ["admin"], enabled: true, authRevision: 1,
|
||||
};
|
||||
const { app } = await createLocalApp({
|
||||
registry: {
|
||||
findByUsername: async () => user,
|
||||
findBySubject: async () => user,
|
||||
verify: async () => {
|
||||
calls += 1;
|
||||
return calls === 10;
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
const originRejected = await app.inject({
|
||||
method: "POST", url: "/auth/local/login", headers: { origin: "http://wrong.example.test" },
|
||||
payload: { username: "Admin", password },
|
||||
});
|
||||
expect(originRejected.statusCode).toBe(403);
|
||||
expect(calls).toBe(0);
|
||||
for (let attempt = 0; attempt < 9; attempt += 1) expect((await login(app)).statusCode).toBe(401);
|
||||
expect((await login(app)).statusCode).toBe(200);
|
||||
expect((await login(app)).statusCode).toBe(401);
|
||||
expect((await login(app)).statusCode).toBe(429);
|
||||
expect((await login(app)).statusCode).toBe(429);
|
||||
});
|
||||
|
||||
test("only two Argon2 verifications run concurrently and excess login attempts fail immediately", async () => {
|
||||
let calls = 0;
|
||||
let release!: () => void;
|
||||
@@ -302,6 +363,19 @@ test("only two Argon2 verifications run concurrently and excess login attempts f
|
||||
expect((await second).statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("the real native asynchronous Argon2 verifier holds two permits and releases them after completion", async () => {
|
||||
const { app } = await createLocalApp();
|
||||
const first = login(app, { password: `${password}!` });
|
||||
const second = login(app, { password: `${password}!` });
|
||||
await new Promise<void>((resolve) => setImmediate(resolve));
|
||||
|
||||
const excess = await login(app, { password: `${password}!` });
|
||||
expect(excess.statusCode).toBe(429);
|
||||
await expect(first).resolves.toMatchObject({ statusCode: 401 });
|
||||
await expect(second).resolves.toMatchObject({ statusCode: 401 });
|
||||
await expect(login(app, { password: `${password}!` })).resolves.toMatchObject({ statusCode: 401 });
|
||||
});
|
||||
|
||||
test("a verifier failure is sanitized and releases its concurrency permit", async () => {
|
||||
let attempts = 0;
|
||||
const user = {
|
||||
|
||||
@@ -0,0 +1,112 @@
|
||||
import { chmodSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import type { FastifyInstance } from "fastify";
|
||||
import { stringify } from "yaml";
|
||||
import { buildApp, type BuildAppDeps } from "../src/app.js";
|
||||
import { loadConfig } from "../src/config.js";
|
||||
|
||||
export const localPassword = "correct horse battery staple";
|
||||
export const localPasswordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";
|
||||
export const localAdminId = "6ba7b810-9dad-4ed1-80b4-00c04fd430c8";
|
||||
export const localPublicUrl = "http://127.0.0.1:8787";
|
||||
|
||||
export interface LocalAuthFixture {
|
||||
app: FastifyInstance;
|
||||
cookie: string;
|
||||
csrfToken: string;
|
||||
downstreamHits(): number;
|
||||
resetDownstreamHits(): void;
|
||||
sessionHeaders(overrides?: Record<string, string | undefined>): Record<string, string>;
|
||||
close(): Promise<void>;
|
||||
}
|
||||
|
||||
function firstSetCookie(response: { headers: Record<string, string | string[] | undefined> }): string {
|
||||
const header = response.headers["set-cookie"];
|
||||
return Array.isArray(header) ? header[0] ?? "" : header ?? "";
|
||||
}
|
||||
|
||||
function cookiePair(setCookie: string): string {
|
||||
return setCookie.split(";", 1)[0] ?? "";
|
||||
}
|
||||
|
||||
/** Creates a production-local app and authenticates through the real login/session boundary. */
|
||||
export async function createLocalAuthFixture(deps?: BuildAppDeps): Promise<LocalAuthFixture> {
|
||||
const directory = mkdtempSync(join(realpathSync(tmpdir()), "thothii-auth-fixture-"));
|
||||
chmodSync(directory, 0o700);
|
||||
const authConfigFile = join(directory, "auth.yaml");
|
||||
const usersFile = join(directory, "users.yaml");
|
||||
writeFileSync(authConfigFile, stringify({
|
||||
version: 1,
|
||||
mode: "local",
|
||||
publicUrl: localPublicUrl,
|
||||
local: { usersFile: "users.yaml" },
|
||||
}), { encoding: "utf8", mode: 0o600 });
|
||||
writeFileSync(usersFile, [
|
||||
"version: 1",
|
||||
"users:",
|
||||
` - id: ${localAdminId}`,
|
||||
" username: Admin",
|
||||
" displayName: Local administrator",
|
||||
` passwordHash: ${localPasswordHash}`,
|
||||
" roles:",
|
||||
" - admin",
|
||||
" enabled: true",
|
||||
" authRevision: 1",
|
||||
"",
|
||||
].join("\n"), { encoding: "utf8", mode: 0o600 });
|
||||
chmodSync(authConfigFile, 0o600);
|
||||
chmodSync(usersFile, 0o600);
|
||||
|
||||
const app = buildApp(loadConfig({
|
||||
THT_AUTH_CONFIG_FILE: authConfigFile,
|
||||
THT_AUTH_STATE_ROOT: join(directory, "auth-state"),
|
||||
THT_HARNESS_DIR: "/tmp/h",
|
||||
}), deps);
|
||||
let downstream = 0;
|
||||
app.addHook("preHandler", async () => { downstream += 1; });
|
||||
|
||||
try {
|
||||
const signedIn = await app.inject({
|
||||
method: "POST",
|
||||
url: "/auth/local/login",
|
||||
headers: { origin: localPublicUrl, "sec-fetch-site": "same-origin" },
|
||||
payload: { username: "Admin", password: localPassword },
|
||||
});
|
||||
if (signedIn.statusCode !== 200) throw new Error("local_auth_fixture_login_failed");
|
||||
const cookie = cookiePair(firstSetCookie(signedIn));
|
||||
const me = await app.inject({ method: "GET", url: "/me", headers: { cookie } });
|
||||
const csrfToken = (me.json() as { csrfToken?: unknown }).csrfToken;
|
||||
if (me.statusCode !== 200 || typeof csrfToken !== "string") throw new Error("local_auth_fixture_session_failed");
|
||||
downstream = 0;
|
||||
|
||||
return {
|
||||
app,
|
||||
cookie,
|
||||
csrfToken,
|
||||
downstreamHits: () => downstream,
|
||||
resetDownstreamHits: () => { downstream = 0; },
|
||||
sessionHeaders(overrides = {}) {
|
||||
const headers: Record<string, string> = {
|
||||
cookie,
|
||||
origin: localPublicUrl,
|
||||
"sec-fetch-site": "same-origin",
|
||||
"x-thothii-csrf": csrfToken,
|
||||
};
|
||||
for (const [key, value] of Object.entries(overrides)) {
|
||||
if (value === undefined) delete headers[key];
|
||||
else headers[key] = value;
|
||||
}
|
||||
return headers;
|
||||
},
|
||||
async close() {
|
||||
await app.close();
|
||||
rmSync(directory, { recursive: true, force: true });
|
||||
},
|
||||
};
|
||||
} catch (error) {
|
||||
await app.close();
|
||||
rmSync(directory, { recursive: true, force: true });
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user