113 lines
5.1 KiB
TypeScript
113 lines
5.1 KiB
TypeScript
import { afterEach, expect, test } from "vitest";
|
|
import { chmodSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { stringify } from "yaml";
|
|
import { buildApp } from "../src/app.js";
|
|
import { loadConfig } from "../src/config.js";
|
|
import { deriveCsrfToken } from "../src/auth/csrf.js";
|
|
|
|
const password = "correct horse battery staple";
|
|
const passwordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";
|
|
const adminId = "6ba7b810-9dad-4ed1-80b4-00c04fd430c8";
|
|
const publicUrl = "http://127.0.0.1:8787";
|
|
const cleanups: Array<() => Promise<void>> = [];
|
|
|
|
afterEach(async () => {
|
|
for (const cleanup of cleanups.splice(0).reverse()) await cleanup();
|
|
});
|
|
|
|
function sessionCookie(response: { headers: Record<string, string | string[] | undefined> }): string {
|
|
const setCookie = response.headers["set-cookie"];
|
|
const first = Array.isArray(setCookie) ? setCookie[0] : setCookie;
|
|
return first?.split(";", 1)[0] ?? "";
|
|
}
|
|
|
|
async function createApp() {
|
|
const directory = mkdtempSync(join(realpathSync(tmpdir()), "thothii-auth-csrf-"));
|
|
chmodSync(directory, 0o700);
|
|
const authConfigFile = join(directory, "auth.yaml");
|
|
const usersFile = join(directory, "users.yaml");
|
|
writeFileSync(authConfigFile, stringify({
|
|
version: 1, mode: "local", publicUrl, local: { usersFile: "users.yaml" },
|
|
}), { encoding: "utf8", mode: 0o600 });
|
|
writeFileSync(usersFile, [
|
|
"version: 1", "users:", ` - id: ${adminId}`, " username: Admin",
|
|
" displayName: Local administrator", ` passwordHash: ${passwordHash}`,
|
|
" roles:", " - admin", " enabled: true", " authRevision: 1", "",
|
|
].join("\n"), { encoding: "utf8", mode: 0o600 });
|
|
chmodSync(authConfigFile, 0o600);
|
|
chmodSync(usersFile, 0o600);
|
|
const app = buildApp(loadConfig({
|
|
THT_AUTH_CONFIG_FILE: authConfigFile,
|
|
THT_AUTH_STATE_ROOT: join(directory, "auth-state"),
|
|
THT_HARNESS_DIR: "/tmp/h",
|
|
}));
|
|
cleanups.push(async () => {
|
|
await app.close();
|
|
rmSync(directory, { recursive: true, force: true });
|
|
});
|
|
const signedIn = await app.inject({
|
|
method: "POST", url: "/auth/local/login",
|
|
headers: { origin: publicUrl, "sec-fetch-site": "same-origin" },
|
|
payload: { username: "Admin", password },
|
|
});
|
|
const cookie = sessionCookie(signedIn);
|
|
const me = await app.inject({ method: "GET", url: "/me", headers: { cookie } });
|
|
return { app, cookie, csrfToken: me.json().csrfToken as string };
|
|
}
|
|
|
|
test("derived CSRF tokens are deterministic per opaque cookie and are never the cookie token", async () => {
|
|
const { cookie, csrfToken } = await createApp();
|
|
const token = cookie.split("=", 2)[1] ?? "";
|
|
expect(deriveCsrfToken(token)).toBe(csrfToken);
|
|
expect(csrfToken).toMatch(/^[A-Za-z0-9_-]{43}$/);
|
|
expect(csrfToken).not.toBe(token);
|
|
});
|
|
|
|
test("cookie-authenticated state changes require an exact Origin, Fetch Metadata when present, and CSRF token", async () => {
|
|
const { app, cookie, csrfToken } = await createApp();
|
|
const cases = [
|
|
{ headers: { cookie, origin: publicUrl, "sec-fetch-site": "same-origin" } },
|
|
{ headers: { cookie, origin: "http://127.0.0.1:8788", "sec-fetch-site": "same-origin", "x-thothii-csrf": csrfToken } },
|
|
{ headers: { cookie, origin: publicUrl, "sec-fetch-site": "cross-site", "x-thothii-csrf": csrfToken } },
|
|
{ headers: { cookie, origin: publicUrl, "x-thothii-csrf": csrfToken.slice(0, -1) } },
|
|
];
|
|
|
|
for (const request of cases) {
|
|
const response = await app.inject({ method: "POST", url: "/auth/logout", ...request });
|
|
expect(response.statusCode).toBe(403);
|
|
expect(response.json()).toEqual({ code: "csrf_failed", error: "Request origin validation failed" });
|
|
}
|
|
});
|
|
|
|
test("duplicate or malformed CSRF and session-cookie headers fail closed", async () => {
|
|
const { app, cookie, csrfToken } = await createApp();
|
|
const duplicateCsrf = await app.inject({
|
|
method: "POST", url: "/auth/logout",
|
|
headers: { cookie, origin: publicUrl, "x-thothii-csrf": `${csrfToken}, ${csrfToken}` },
|
|
});
|
|
const duplicateCookie = await app.inject({
|
|
method: "POST", url: "/auth/logout",
|
|
headers: { cookie: `${cookie}; ${cookie}`, origin: publicUrl, "x-thothii-csrf": csrfToken },
|
|
});
|
|
const malformedCookie = await app.inject({
|
|
method: "POST", url: "/auth/logout",
|
|
headers: { cookie: "thothii_session=not-a-token", origin: publicUrl, "x-thothii-csrf": csrfToken },
|
|
});
|
|
|
|
expect(duplicateCsrf.statusCode).toBe(403);
|
|
expect(duplicateCookie.statusCode).toBe(401);
|
|
expect(malformedCookie.statusCode).toBe(401);
|
|
});
|
|
|
|
test("an unauthenticated state-changing application route cannot bypass the central boundary", async () => {
|
|
const { app } = await createApp();
|
|
const response = await app.inject({
|
|
method: "POST", url: "/sessions", headers: { origin: publicUrl, "x-thothii-csrf": "x".repeat(43) },
|
|
payload: { question: "must not reach a session handler" },
|
|
});
|
|
expect(response.statusCode).toBe(401);
|
|
expect(response.json()).toEqual({ code: "authentication_required", error: "Authentication is required" });
|
|
});
|