machina-auth 1.2.0 → 1.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc18de6ee1048be86f05320f0a2864092dce1b886689a98e042bb4b68385649f
-  data.tar.gz: 0657bf99e18fe6418ee481e3234ffe3a0dc5ae27fe9aab6dfff6363b7e682c56
+  metadata.gz: 66b857d79a8bb10d1bf4923827dc40e5ba31497b72034d299d0a6789d915cd8a
+  data.tar.gz: 614e23b95bfd42a36fff9d0884c67bec96dd3cbb795892ccb17c0637ed5c2f72
 SHA512:
-  metadata.gz: 6fb9094979c7931d23102d76f4a4da200943ac503c36ba165ee9bd20fa605a737a16cbada861890e1529434972fbf8c64f3f222cf85389bae462276f2387e734
-  data.tar.gz: 061dc831c51829d43b2e9a7f1f91a22b8ff41eade182ffb25ac2f53c0b8958c4a1189003e15403130d27b1808f63305835da2ac2330623b3c38527397617c070
+  metadata.gz: ae953fa84f664a1e2bddfdafc01bd4ac076d6790ca78b89cf1e40b8cb95c8d3b804b110c8177c17175702a360f3ec53d376729d3f5ed5e4ec477aeb17bbe3cd0
+  data.tar.gz: 4cc174ca36e1bf7e928a737b00d1fa5eb3ab2676328e6526f7dded1263948f7fd66d3b603227bf1d45562552905c3dcc87c4593818ef02d4be0f94d951b16b99

data/app/controllers/machina/callbacks_controller.rb

@@ -25,9 +25,13 @@ module Machina
     private
 
     def valid_state?
-      expected = cookies.signed[:machina_state]
+      # A duplicate callback arrives while the cookie is already marked
+      # consumed; the marker is not part of the nonce the URL carries.
+      expected = cookies.signed[:machina_state].to_s.delete_suffix(Machina::ControllerHelpers::CONSUMED_STATE_MARKER)
       given = params[:state].to_s
-      expected.present? && given.present? && ActiveSupport::SecurityUtils.secure_compare(given, expected)
+      # secure_compare raises on unequal lengths; a length mismatch is a mismatch.
+      expected.present? && given.bytesize == expected.bytesize &&
+        ActiveSupport::SecurityUtils.secure_compare(given, expected)
     end
 
     def reject(reason)
@@ -36,16 +40,26 @@ module Machina
       render plain: 'Invalid authentication callback', status: :unprocessable_content
     end
 
-    # A stale, overwritten or missing state proves nothing either way, so
-    # re-run the handshake with a fresh nonce instead of dead-ending.
+    # A stale, forged or missing state proves nothing either way, so re-run the
+    # handshake instead of dead-ending. The nonce must be brand new: the cookie
+    # still holds the unmarked in-flight one, and issue_state would reuse it and
+    # stretch its expiry to 10 minutes. A mismatched callback has to burn that
+    # nonce, not refresh it — otherwise anything that can hit this endpoint can
+    # keep a victim's handshake alive indefinitely.
     def restart_handshake(reason)
       Rails.logger.warn("[machina] Auth callback rejected: #{reason}; restarting handshake")
+      cookies.delete(:machina_state)
       redirect_to Machina.authorize_url(return_to: safe_return_to, state: issue_state), allow_other_host: true
     end
 
+    # Marks the nonce consumed inside the signed value and keeps it only for
+    # the grace window. issue_state treats a marked value as spent, so a later
+    # handshake mints a fresh nonce instead of stretching this one to 10 minutes.
     def extend_state_cookie
+      nonce = cookies.signed[:machina_state].to_s
+                     .delete_suffix(Machina::ControllerHelpers::CONSUMED_STATE_MARKER)
       cookies.signed[:machina_state] = {
-        value: cookies.signed[:machina_state],
+        value: "#{nonce}#{Machina::ControllerHelpers::CONSUMED_STATE_MARKER}",
         httponly: true,
         same_site: :lax,
         secure: Machina.secure_cookies?,

data/lib/machina/controller_helpers.rb

@@ -48,13 +48,27 @@ module Machina
       cookies.delete(:machina_session)
     end
 
+    # Appended inside the signed cookie once the callback has consumed the
+    # nonce. It rides in the signed value so a client cannot forge or strip it,
+    # and it can never appear in a nonce: urlsafe_base64 emits only
+    # [A-Za-z0-9_-]. The callback strips it before comparing, so a duplicate
+    # callback inside the grace window still matches the URL it came back on.
+    CONSUMED_STATE_MARKER = ':consumed'
+
     private
 
-    # Mints the CSRF state for the auth handshake. The value rides
-    # on the callback URL through Console; the callback rejects a redirect
-    # whose state does not match this cookie.
+    # CSRF state for the auth handshake. Reuses the nonce already in the
+    # signed cookie so a second tab, reload or prefetch does not overwrite a
+    # handshake still in flight, and re-issues the cookie with a fresh expiry
+    # so that handshake is not starved by the original one. Mints a new nonce
+    # when the cookie is absent, unreadable, or already consumed by a callback:
+    # a consumed nonce is single-use and must not be stretched past the grace
+    # window the callback set. The value rides on the callback URL through
+    # Console; the callback rejects a redirect whose state does not match.
     def issue_state
-      state = SecureRandom.urlsafe_base64(32)
+      held = cookies.signed[:machina_state].to_s
+      state = held.presence
+      state = SecureRandom.urlsafe_base64(32) if state.nil? || state.end_with?(CONSUMED_STATE_MARKER)
       cookies.signed[:machina_state] = {
         value: state,
         httponly: true,

data/lib/machina/middleware/authentication.rb

@@ -6,7 +6,7 @@ module Machina
   module Middleware
     # Rack middleware that extracts authentication tokens from incoming requests,
     # resolves them against the identity service, and sets Current.authorized.
-    class Authentication
+    class Authentication # rubocop:disable Metrics/ClassLength
       TRANSIENT_FAILURE = :transient_failure
 
       # Negative-cache marker for a rejected token. A Hash, so it round-trips through any cache coder.
@@ -97,7 +97,7 @@ module Machina
         match && match[1]
       end
 
-      def resolve_session(token, hints)
+      def resolve_session(token, hints) # rubocop:disable Metrics/AbcSize
         cached = Machina.cache.read(cache_key(token, hints))
         return nil if cached == INVALID_SESSION
         return cached if cached.present? && !(cached.is_a?(Hash) && cached['stale'])
@@ -109,7 +109,14 @@ module Machina
         # signal transient failure so the caller preserves the cookie.
         Rails.logger.warn("[machina] Identity service unreachable: #{e.class} — #{e.message}")
         cached.presence || TRANSIENT_FAILURE
-      rescue StandardError
+      rescue Machina::ConfigurationError => e
+        # Misconfiguration is not a bad token: don't log the user out or negative-cache it.
+        Rails.logger.error("[machina] Cannot resolve sessions: #{e.message}")
+        raise if Rails.env.development?
+
+        TRANSIENT_FAILURE
+      rescue StandardError => e
+        Rails.logger.error("[machina] Session resolve failed: #{e.class} — #{e.message}")
         nil
       end
 

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '1.2.0'
+  VERSION = '1.2.2'
 end

data/spec/machina/controller_helpers_spec.rb

@@ -3,6 +3,8 @@
 require_relative '../rails_helper'
 
 RSpec.describe Machina::ControllerHelpers, type: :controller do
+  include ActiveSupport::Testing::TimeHelpers
+
   controller(ActionController::Base) do
     include Machina::ControllerHelpers
 
@@ -50,6 +52,36 @@ RSpec.describe Machina::ControllerHelpers, type: :controller do
     expect(CGI.unescape(response.location)).to include("state=#{CGI.escape(state)}")
   end
 
+  it 'reuses the state already in the cookie on a second unauthenticated request' do
+    Machina.config.identity_callback_uri = 'http://localhost:3000/auth/machina/callback'
+
+    get :index
+    first = controller.send(:cookies).signed[:machina_state]
+    request.cookies[:machina_state] = response.cookies['machina_state']
+
+    get :index
+
+    second = controller.send(:cookies).signed[:machina_state]
+    expect(second).to eq(first)
+    expect(CGI.unescape(response.location)).to include("state=#{CGI.escape(first)}")
+  end
+
+  it 're-issues the reused state cookie httponly, same_site lax, with a fresh expiry' do
+    Machina.config.identity_callback_uri = 'http://localhost:3000/auth/machina/callback'
+
+    get :index
+    request.cookies[:machina_state] = response.cookies['machina_state']
+    travel 2.minutes
+
+    get :index
+
+    set_cookie = response.headers['Set-Cookie'].to_s
+    expect(set_cookie).to match(/machina_state=.*httponly/i)
+    expect(set_cookie).to match(/samesite=lax/i)
+    expires_at = Time.httpdate(set_cookie[/expires=([^;]+)/i, 1])
+    expect(expires_at).to be_within(5.seconds).of(10.minutes.from_now)
+  end
+
   it 'passes return_to as a relative path so the callback accepts it' do
     Machina.config.identity_callback_uri = 'http://localhost:3000/auth/machina/callback'
 

data/spec/machina/middleware/authentication_spec.rb

@@ -401,6 +401,47 @@ RSpec.describe Machina::Middleware::Authentication do
     end
   end
 
+  context 'when the service token is not configured' do
+    let(:config) do
+      Machina::Configuration.new.tap do |c|
+        c.identity_service_url = 'https://console.example.test'
+        c.service_token = ''
+      end
+    end
+    let(:env) { Rack::MockRequest.env_for('/resource', 'HTTP_COOKIE' => 'machina_session=ps_unconfigured') }
+
+    before do
+      allow(Machina).to receive(:identity_client).and_return(Machina::IdentityClient.new(config:))
+      allow(Rails.logger).to receive(:error)
+    end
+
+    it 'logs the misconfiguration and keeps the cookie and cache untouched' do
+      status, headers, = middleware.call(env)
+
+      expect(status).to eq(200)
+      expect(headers['set-cookie']).to be_nil
+      expect(Machina.cache.read('machina:session:ps_unconfigured')).to be_nil
+      expect(Rails.logger).to have_received(:error).with(/service_token is required/)
+    end
+
+    it 'raises in development so the cause is not hidden behind a redirect loop' do
+      allow(Rails.env).to receive(:development?).and_return(true)
+
+      expect { middleware.call(env) }.to raise_error(Machina::ConfigurationError, /service_token is required/)
+    end
+  end
+
+  it 'logs an unexpected resolve error before treating the token as invalid' do
+    allow(identity_client).to receive(:resolve_session).with('ps_boom').and_raise(JSON::ParserError, 'bad body')
+    allow(Rails.logger).to receive(:error)
+
+    env = Rack::MockRequest.env_for('/resource', 'HTTP_AUTHORIZATION' => 'Bearer ps_boom')
+    status, = middleware.call(env)
+
+    expect(status).to eq(200)
+    expect(Rails.logger).to have_received(:error).with(/JSON::ParserError — bad body/)
+  end
+
   it 'uses the cache on subsequent requests' do
     response = Machina::IdentityClient::Response.new(
       status: 200,

data/spec/requests/machina/callbacks_spec.rb

@@ -35,6 +35,28 @@ RSpec.describe Machina::CallbacksController, type: :controller do
       expect(response.cookies['machina_state']).to be_present
     end
 
+    it 'marks the nonce consumed so a later handshake mints a new one' do
+      Machina.config.identity_callback_uri = 'http://localhost:3000/machina/callback'
+      grace_expiry = Machina::CallbacksController::STATE_GRACE_PERIOD.from_now
+
+      get :show, params: { token:, state: }
+
+      consumed = response.cookies['machina_state']
+      expect(controller.send(:cookies).signed[:machina_state]).to end_with(
+        Machina::ControllerHelpers::CONSUMED_STATE_MARKER,
+      )
+      state_cookie = Array(response.headers['Set-Cookie']).find { |c| c.start_with?('machina_state=') }
+      expect(Time.httpdate(state_cookie[/expires=([^;]+)/i, 1])).to be_within(5.seconds).of(grace_expiry)
+
+      request.cookies['machina_state'] = consumed
+
+      follow_up = controller.send(:issue_state)
+
+      expect(follow_up).not_to eq(state)
+      expect(follow_up).not_to include(Machina::ControllerHelpers::CONSUMED_STATE_MARKER)
+      expect(controller.send(:cookies).signed[:machina_state]).to eq(follow_up)
+    end
+
     it 'accepts a repeated callback and stores the newest token' do
       get :show, params: { token: 'ps_first', state: }
       request.cookies['machina_state'] = response.cookies['machina_state']
@@ -106,6 +128,13 @@ RSpec.describe Machina::CallbacksController, type: :controller do
       end
 
       include_examples 'restarts the handshake'
+
+      it 'burns the in-flight nonce instead of re-issuing it' do
+        minted = controller.send(:cookies).signed[:machina_state]
+        expect(minted).to be_present
+        expect(minted).not_to eq(state)
+        expect(CGI.unescape(response.location)).to include("state=#{CGI.escape(minted)}")
+      end
     end
 
     context 'with a missing state param' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.2
 platform: ruby
 authors:
 - ZAR
@@ -216,7 +216,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Shared authentication and workspace scoping for Machina product apps
 test_files: []