hecks 3.11.0 → 3.12.0

data/rust/host/src/platform_signin/mapping_tests.rs

@@ -0,0 +1,254 @@
+//! The member mapping against a real Postgres, through the same functions the Google sign-in uses.
+//!
+//! Each test gets a scratch database shaped like the real head views. The one path these tests do
+//! not take is the write that links a member (it needs the compiled domain module); the mapping
+//! logic around it is covered with a fake store in the handler tests.
+
+use std::path::Path;
+use std::sync::Arc;
+
+use serde_json::{json, Value};
+use tokio::sync::Mutex;
+use tokio_postgres::{Client, NoTls};
+
+use super::extension::PlatformSignin;
+use super::session::{map_member, HostMembers};
+use super::wiring_support::*;
+use crate::journal::LineageConfig;
+use crate::lambda_client::NeverInvoker;
+
+fn domain_ir() -> Value {
+    json!({
+        "name": "Acme",
+        "lineage": {"capable_aggregates": [{"name": "Member", "storage_name": "member"}]},
+        "membership": {"provider": "Acme", "aggregate": "Acme::Member"},
+        "identity": {"provider": "Identity", "register": "Identity::Identity.Register", "link": "Identity::ExternalIdentifier.Link", "resolve": "Identity::ExternalIdentifier.ResolvedBy"},
+    })
+}
+
+async fn scratch(name: &str) -> Mutex<Client> {
+    let (admin, conn) = tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
+        .await
+        .expect("postgres");
+    tokio::spawn(async move {
+        let _ = conn.await;
+    });
+    admin
+        .batch_execute(&format!("DROP DATABASE IF EXISTS {name} WITH (FORCE)"))
+        .await
+        .unwrap();
+    admin
+        .batch_execute(&format!("CREATE DATABASE {name}"))
+        .await
+        .unwrap();
+    let (client, conn) = tokio_postgres::connect(&crate::test_pg::conninfo(name), NoTls)
+        .await
+        .expect("scratch");
+    tokio::spawn(async move {
+        let _ = conn.await;
+    });
+    client
+        .batch_execute(
+            "CREATE TABLE acme_member_head_snapshot_1 (id text PRIMARY KEY, ordinal bigint NOT NULL, state jsonb NOT NULL);
+             CREATE VIEW acme_member_head AS SELECT id, state FROM acme_member_head_snapshot_1;
+             CREATE TABLE acme_external_identifier_head_snapshot_1 (id text PRIMARY KEY, ordinal bigint NOT NULL, state jsonb NOT NULL);
+             CREATE VIEW acme_external_identifier_head AS SELECT id, state FROM acme_external_identifier_head_snapshot_1;",
+        )
+        .await
+        .unwrap();
+    Mutex::new(client)
+}
+
+async fn member(
+    db: &Mutex<Client>,
+    email: &str,
+    role: Option<&str>,
+    identity: Option<&str>,
+    disabled: bool,
+) {
+    let state = json!({
+        "name": {"value": "Person"}, "email": {"value": email},
+        "role": role.map(|r| json!({"value": r})), "identity_id": identity.map(|i| json!({"value": i})), "disabled": disabled,
+    });
+    db.lock().await.execute("INSERT INTO acme_member_head_snapshot_1 (id, ordinal, state) VALUES ($1, 1, $2::jsonb)", &[&email, &state]).await.unwrap();
+}
+
+async fn known_identity(db: &Mutex<Client>, issuer: &str, subject: &str, identity: &str) {
+    let state =
+        json!({"issuer": {"value": issuer}, "subject": {"value": subject}, "identity": identity});
+    let id = format!("{issuer}:{subject}");
+    db.lock().await.execute("INSERT INTO acme_external_identifier_head_snapshot_1 (id, ordinal, state) VALUES ($1, 1, $2::jsonb)", &[&id, &state]).await.unwrap();
+}
+
+struct World {
+    db: Mutex<Client>,
+    ir: Value,
+    config: LineageConfig,
+}
+
+impl World {
+    async fn new(name: &str) -> Self {
+        Self {
+            db: scratch(name).await,
+            ir: domain_ir(),
+            config: LineageConfig {
+                domain: "Acme".into(),
+                era: Some(1),
+                mirrored: None,
+            },
+        }
+    }
+
+    fn members(&self) -> HostMembers<'_> {
+        HostMembers {
+            client: &self.db,
+            domain_ir: &self.ir,
+            wasm_path: Path::new("unused.wasm"),
+            config: &self.config,
+            invoker: &NeverInvoker,
+        }
+    }
+
+    async fn signs_in(&self) -> Option<crate::auth::Session> {
+        let doc = vectors();
+        let claims = vector_claims(&doc, "valid");
+        map_member(&self.members(), &claims).await.unwrap()
+    }
+}
+
+#[tokio::test]
+async fn a_resolved_identity_signs_its_linked_member_in() {
+    let world = World::new("hecks_host_signin_resolves").await;
+    member(
+        &world.db,
+        "linked@example.test",
+        Some("Admin"),
+        Some("identity-1"),
+        false,
+    )
+    .await;
+    known_identity(
+        &world.db,
+        "https://idp.example",
+        "idp-subject-0001",
+        "identity-1",
+    )
+    .await;
+    let session = world.signs_in().await.expect("signed in");
+    assert_eq!(session.email, "linked@example.test");
+    assert_eq!(session.role.as_deref(), Some("Admin"));
+}
+
+#[tokio::test]
+async fn a_member_linked_to_another_identity_is_not_signed_in() {
+    let world = World::new("hecks_host_signin_other_identity").await;
+    member(
+        &world.db,
+        "person@example.test",
+        Some("Admin"),
+        Some("identity-other"),
+        false,
+    )
+    .await;
+    assert!(world.signs_in().await.is_none());
+}
+
+#[tokio::test]
+async fn an_unknown_person_is_not_signed_in() {
+    let world = World::new("hecks_host_signin_unknown").await;
+    assert!(world.signs_in().await.is_none());
+}
+
+#[tokio::test]
+async fn a_disabled_member_is_not_signed_in_by_identity_or_by_email() {
+    let world = World::new("hecks_host_signin_disabled").await;
+    member(&world.db, "person@example.test", Some("Admin"), None, true).await;
+    assert!(world.signs_in().await.is_none());
+    let linked = World::new("hecks_host_signin_disabled_linked").await;
+    member(
+        &linked.db,
+        "linked@example.test",
+        Some("Admin"),
+        Some("identity-1"),
+        true,
+    )
+    .await;
+    known_identity(
+        &linked.db,
+        "https://idp.example",
+        "idp-subject-0001",
+        "identity-1",
+    )
+    .await;
+    assert!(linked.signs_in().await.is_none());
+}
+
+#[tokio::test]
+async fn a_member_without_a_role_is_not_signed_in() {
+    let world = World::new("hecks_host_signin_no_role").await;
+    member(
+        &world.db,
+        "linked@example.test",
+        None,
+        Some("identity-1"),
+        false,
+    )
+    .await;
+    known_identity(
+        &world.db,
+        "https://idp.example",
+        "idp-subject-0001",
+        "identity-1",
+    )
+    .await;
+    assert!(world.signs_in().await.is_none());
+    let unlinked = World::new("hecks_host_signin_no_role_email").await;
+    member(&unlinked.db, "person@example.test", None, None, false).await;
+    assert!(unlinked.signs_in().await.is_none());
+}
+
+#[tokio::test]
+async fn the_whole_callback_over_a_real_store_sets_the_session_and_clears_the_cookie() {
+    let world = World::new("hecks_host_signin_whole").await;
+    member(
+        &world.db,
+        "linked@example.test",
+        Some("Admin"),
+        Some("identity-1"),
+        false,
+    )
+    .await;
+    known_identity(
+        &world.db,
+        "https://idp.example",
+        "idp-subject-0001",
+        "identity-1",
+    )
+    .await;
+    let doc = vectors();
+    let request = request_for(&single(&doc, "valid"));
+    let ext = PlatformSignin::new(vector_handler("alongside", Arc::new(Recorder::default())));
+    let response = ext.finish(&request, &world.members()).await;
+    assert_eq!(response["statusCode"], 302);
+    assert_eq!(response["headers"]["location"], "/admin.html");
+    assert_eq!(cookies_of(&response).len(), 2);
+}
+
+#[tokio::test]
+async fn the_whole_callback_over_a_real_store_refuses_an_unlinked_person() {
+    let world = World::new("hecks_host_signin_whole_unlinked").await;
+    member(
+        &world.db,
+        "person@example.test",
+        Some("Admin"),
+        Some("identity-other"),
+        false,
+    )
+    .await;
+    let doc = vectors();
+    let request = request_for(&single(&doc, "valid"));
+    let ext = PlatformSignin::new(vector_handler("alongside", Arc::new(Recorder::default())));
+    let response = ext.finish(&request, &world.members()).await;
+    assert_eq!(response["statusCode"], 403);
+    assert_eq!(cookies_of(&response), vec![super::cookie::clear_header()]);
+}

data/rust/host/src/platform_signin/mod.rs

@@ -0,0 +1,75 @@
+//! Signing a site's people in through a platform issuer: the token verifier and the flow around it.
+//!
+//! A site that lets a platform issuer sign its people in receives, on its callback, a compact JWS
+//! signed with Ed25519. The verifier ([`verify`], with [`jws`], [`jwks`], [`jti`] and [`config`])
+//! decides whether such a token is genuine, fresh, meant for this site and this environment, and
+//! not already used. It is a library of pure functions and small types: no HTTP client, no cookie
+//! code, no environment reads, no routes. Its caller supplies the clock, the values from the
+//! site's own sign-in cookie, and a [`jwks::JwksFetcher`].
+//!
+//! ## Why a reference implementation elsewhere
+//!
+//! The issuer's own verifier (the Ruby one in the platform repository) is the reference. This
+//! module gives the same verdict and the same stable refusal code, in the same check order, for
+//! every vector in the shared known-answer file (`tests/fixtures/platform_signin_vectors.json`).
+//! The check order is part of the contract: an attacker who can fail two checks at once must learn
+//! only about the first, and a request that fails an early check must never spend the token's
+//! single-use identifier.
+//!
+//! ## What the verifier is not
+//!
+//! The verifier does not log, and nothing in it ever formats a token. It is not a session:
+//! mapping a verified identity to a member of the site is the job of [`session`].
+//!
+//! ## The flow around it
+//!
+//! [`extension`] puts the sign-in on the host's routes, [`handler`] starts and finishes a sign-in,
+//! [`settings`] reads the switch and its companions once at boot, and [`cookie`], [`query`] and
+//! [`pages`] are the strict edges of the request and response. With the switch unset none of it
+//! is installed.
+
+/// Validated settings: the pinned issuer, key set address, site and environment.
+pub mod config;
+/// The site's own sign-in cookie: how it is written, deleted and strictly read.
+pub mod cookie;
+/// The host extension that puts the flow on the site's routes.
+pub mod extension;
+/// The real, bounded fetch of the issuer's key set.
+pub mod fetcher;
+/// Starting a sign-in and finishing it on the callback.
+pub mod handler;
+/// The bounded in-memory record that makes each token single-use.
+pub mod jti;
+/// The issuer's public keys: parsing, thumbprint indexing and a rate-limited cache.
+pub mod jwks;
+/// Strict compact JWS parsing and canonical base64url.
+pub mod jws;
+/// The redirects and refusal pages of the flow.
+pub mod pages;
+/// The callback's query string, read strictly.
+pub mod query;
+/// Mapping a verified token to a member of the site.
+pub mod session;
+/// The switch and the settings the flow needs, validated at boot.
+pub mod settings;
+/// A JSON object reader that refuses repeated keys and deep nesting.
+pub mod strict_json;
+/// The ordered checks, the stable refusal reasons and the verified claims.
+pub mod verify;
+
+#[cfg(test)]
+mod attack_tests;
+#[cfg(test)]
+mod handler_tests;
+#[cfg(test)]
+mod known_answer_tests;
+#[cfg(test)]
+mod mapping_tests;
+#[cfg(test)]
+mod mode_tests;
+#[cfg(test)]
+mod test_support;
+#[cfg(test)]
+mod ttl_tests;
+#[cfg(test)]
+mod wiring_support;