@antasphere/chassis-server 1.0.0

package/test/integration/security-fixes.test.ts

@@ -0,0 +1,190 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp,
+  host
+} from './helpers.js';
+
+/**
+ * The security-fix regression battery (audit merge, milestone A):
+ *  - login rate limit holds per-account under a shared/rotating IP;
+ *  - the /mcp endpoint has a rate-limit wall;
+ *  - an audit-write failure never fails the audited mutation.
+ * XFF is trusted in tests (helpers set TRUST_PROXY=true), so each request can
+ * own its bucket by setting x-forwarded-for.
+ */
+
+const OWNER = { email: 'owner@sec.test', name: 'Sec Owner', password: 'sec-owner-password-123' };
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+// Captured before any rate-limit spamming below exhausts the owner's login bucket.
+let ownerCookie: string;
+
+const json = (body: unknown) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json' },
+  body: JSON.stringify(body)
+});
+
+beforeAll(async () => {
+  container = await startPostgres();
+  app = await createTestApp(await createDatabase(container, 'sec'));
+  await app.app.request(
+    '/api/v1/setup',
+    json({ setupToken: 'integration-test-setup-token', instanceName: 'Sec', owner: OWNER })
+  );
+  const signIn = await app.app.request(
+    '/api/v1/auth/sign-in/email',
+    json({ email: OWNER.email, password: OWNER.password })
+  );
+  ownerCookie = extractCookie(signIn);
+});
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+describe('login rate limit is keyed per-account, not only per-IP', () => {
+  it('trips for one victim email even as the IP rotates every request', async () => {
+    const badLogin = (email: string, xff: string) =>
+      app.app.request('/api/v1/auth/sign-in/email', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'x-forwarded-for': xff },
+        body: JSON.stringify({ email, password: 'wrong-password-entirely' })
+      });
+
+    // Rotate the IP on every attempt so the per-IP key never accumulates; only
+    // the per-email key can trip. The login bucket is 10 per window.
+    let sawVictimRateLimit = false;
+    for (let i = 0; i < 15 && !sawVictimRateLimit; i++) {
+      const r = await badLogin(OWNER.email, `203.0.113.${i + 1}`);
+      if (r.status === 429) sawVictimRateLimit = true;
+      else expect(r.status).toBe(401);
+    }
+    expect(sawVictimRateLimit).toBe(true);
+
+    // A DIFFERENT account from a fresh IP is unaffected (its own email bucket).
+    const other = await badLogin('someone-else@sec.test', '198.51.100.42');
+    expect(other.status).toBe(401);
+  });
+});
+
+describe('/mcp rate-limit wall', () => {
+  it('rejects an unauthenticated flood from one IP with 429 after the limit', async () => {
+    const flood = () =>
+      app.app.request('/mcp', { method: 'POST', headers: { 'x-forwarded-for': '192.0.2.200' } });
+
+    // Before the wall trips, unauthenticated requests are 401 (RFC 9728).
+    const first = await flood();
+    expect(first.status).toBe(401);
+
+    // The mcp bucket is 1200/min (sized for an event's room); hammer past it and assert a 429 appears.
+    let sawRateLimit = false;
+    for (let i = 0; i < 1300 && !sawRateLimit; i++) {
+      const r = await flood();
+      if (r.status === 429) sawRateLimit = true;
+      else expect(r.status).toBe(401);
+    }
+    expect(sawRateLimit).toBe(true);
+
+    // The wall is per-IP: a different address still gets the normal 401.
+    const other = await app.app.request('/mcp', {
+      method: 'POST',
+      headers: { 'x-forwarded-for': '192.0.2.201' }
+    });
+    expect(other.status).toBe(401);
+  });
+});
+
+describe('request body size cap', () => {
+  it('rejects an oversized JSON body with 413', async () => {
+    const huge = 'x'.repeat(2 * 1024 * 1024); // 2 MiB > the 1 MiB JSON cap
+    const res = await app.app.request('/api/v1/api-keys', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', cookie: ownerCookie },
+      body: JSON.stringify({ name: huge, scopes: [host.scopes.read] })
+    });
+    expect(res.status).toBe(413);
+  });
+
+  it('does NOT cap file uploads (they stream with their own limit)', async () => {
+    // 1.5 MiB — above the JSON cap, well under MAX_FILE_SIZE_MB (100).
+    const body = 'a'.repeat(Math.floor(1.5 * 1024 * 1024));
+    const res = await app.app.request('/api/v1/files?name=big.bin', {
+      method: 'POST',
+      headers: { 'content-type': 'application/octet-stream', cookie: ownerCookie },
+      body
+    });
+    expect(res.status).toBe(201);
+  });
+});
+
+describe('audit retention purge', () => {
+  it('deletes rows older than the retention window and keeps recent ones', async () => {
+    const wsRes = await app.db.pool.query<{ id: string }>('SELECT id FROM workspaces LIMIT 1');
+    const workspaceId = wsRes.rows[0]?.id;
+    expect(workspaceId).toBeTruthy();
+
+    const countAncient = async () =>
+      (
+        await app.db.pool.query<{ n: number }>(
+          `SELECT count(*)::int AS n FROM audit_log WHERE action = 'ancient.event'`
+        )
+      ).rows[0]?.n ?? 0;
+
+    await app.db.pool.query(
+      `INSERT INTO audit_log (workspace_id, actor_via, action, resource_type, created_at)
+       VALUES ($1, 'system', 'ancient.event', 'test', now() - interval '400 days')`,
+      [workspaceId]
+    );
+    expect(await countAncient()).toBe(1);
+
+    // Trigger the worker's purge handler out of band (the schedule is 03:00).
+    await app.jobs.boss.send('audit-purge', {});
+
+    const deadline = Date.now() + 15_000;
+    let ancient = 1;
+    while (ancient > 0 && Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, 250));
+      ancient = await countAncient();
+    }
+    expect(ancient).toBe(0);
+
+    // Recent rows (created by earlier tests in this file) are untouched.
+    const recent = await app.db.pool.query<{ n: number }>(
+      `SELECT count(*)::int AS n FROM audit_log WHERE created_at > now() - interval '1 day'`
+    );
+    expect(recent.rows[0]?.n ?? 0).toBeGreaterThan(0);
+  }, 30_000);
+});
+
+describe('audit writes are best-effort (a committed mutation must not 500)', () => {
+  it('returns 201 and persists the mutation even when the audit insert fails', async () => {
+    // Break the audit sink out from under the request lifecycle.
+    await app.db.pool.query('ALTER TABLE audit_log RENAME TO audit_log_broken');
+    try {
+      const res = await app.app.request('/api/v1/api-keys', {
+        ...json({ name: 'survives-audit-outage', scopes: [host.scopes.read] }),
+        headers: { 'content-type': 'application/json', cookie: ownerCookie }
+      });
+      // The mutation committed; the failed audit write is logged, not fatal.
+      expect(res.status).toBe(201);
+      const body = await readJson(res);
+      expect(body.apiKey.name).toBe('survives-audit-outage');
+
+      // And it is really persisted (listable) despite the audit failure.
+      const list = await app.app.request('/api/v1/api-keys', { headers: { cookie: ownerCookie } });
+      const listBody = await readJson(list);
+      expect(listBody.apiKeys.map((k: { name: string }) => k.name)).toContain('survives-audit-outage');
+    } finally {
+      await app.db.pool.query('ALTER TABLE audit_log_broken RENAME TO audit_log');
+    }
+  });
+});

package/test/integration/setup-transport.test.ts

@@ -0,0 +1,118 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { createDatabase, createTestApp, startPostgres, type TestApp, SETUP_TOKEN } from './helpers.js';
+
+/**
+ * PLT-10, end to end: the one-shot wizard is the request that decides who
+ * owns the instance, and it carries the owner password plus the setup token.
+ * On a plaintext, non-loopback origin the server refuses it outright — the
+ * documented no-domain install path used to walk operators straight into
+ * handing both to the network.
+ *
+ * The refusal must sit BEFORE the token check, and it must not be reachable
+ * around by presenting a correct token.
+ */
+let container: StartedPostgreSqlContainer;
+
+const owner = {
+  email: 'owner@example.com',
+  password: 'correct-horse-battery-staple',
+  name: 'Owner'
+};
+
+async function bootWith(env: Record<string, string>, dbName: string): Promise<TestApp> {
+  const url = await createDatabase(container, dbName);
+  return createTestApp(url, env);
+}
+
+async function postSetup(app: TestApp, body: unknown): Promise<Response> {
+  return app.app.request('/api/v1/setup', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body)
+  });
+}
+
+beforeAll(async () => {
+  container = await startPostgres();
+}, 180_000);
+
+afterAll(async () => {
+  await container?.stop();
+});
+
+describe('POST /setup over plaintext on a non-loopback origin', () => {
+  it('403s with insecure_transport, and does NOT create the instance', async () => {
+    const app = await bootWith(
+      { PUBLIC_BASE_URL: 'http://platform.example.com', SETUP_TOKEN: 'the-setup-token' },
+      'plaintext_public'
+    );
+    try {
+      const res = await postSetup(app, {
+        owner,
+        instanceName: 'Acme',
+        setupToken: 'the-setup-token' // the CORRECT token — it must not help
+      });
+      expect(res.status).toBe(403);
+      expect(await res.json()).toMatchObject({ error: { code: 'insecure_transport' } });
+
+      // Still un-set-up: the wizard is genuinely still available over a safe
+      // transport, it was not consumed by the refused attempt.
+      const instance = await app.app.request('/api/v1/instance');
+      expect(((await instance.json()) as { setupRequired: boolean }).setupRequired).toBe(true);
+    } finally {
+      await app.stop();
+    }
+  }, 120_000);
+
+  it('is refused before the token check, so it cannot be probed for a valid token', async () => {
+    const app = await bootWith(
+      { PUBLIC_BASE_URL: 'http://10.0.0.4:3000', SETUP_TOKEN: 'the-setup-token' },
+      'plaintext_private'
+    );
+    try {
+      const res = await postSetup(app, { owner, instanceName: 'Acme', setupToken: 'wrong' });
+      expect(res.status).toBe(403);
+      // A wrong token would give invalid_setup_token; the transport verdict
+      // must come first so the two cases are indistinguishable.
+      expect(await res.json()).toMatchObject({ error: { code: 'insecure_transport' } });
+    } finally {
+      await app.stop();
+    }
+  }, 120_000);
+});
+
+describe('POST /setup on a transport the operator can trust', () => {
+  it('succeeds over plaintext LOOPBACK — the `ssh -L` tunnel path', async () => {
+    const app = await bootWith({ PUBLIC_BASE_URL: 'http://127.0.0.1:3000' }, 'plaintext_loopback');
+    try {
+      const res = await postSetup(app, { owner, instanceName: 'Acme', setupToken: SETUP_TOKEN });
+      expect(res.status).toBe(201);
+    } finally {
+      await app.stop();
+    }
+  }, 120_000);
+
+  it('succeeds over https on a public origin', async () => {
+    const app = await bootWith({ PUBLIC_BASE_URL: 'https://platform.example.com' }, 'https_public');
+    try {
+      const res = await postSetup(app, { owner, instanceName: 'Acme', setupToken: SETUP_TOKEN });
+      expect(res.status).toBe(201);
+    } finally {
+      await app.stop();
+    }
+  }, 120_000);
+
+  it('succeeds over plaintext on a public origin ONLY with the explicit opt-in', async () => {
+    const app = await bootWith(
+      { PUBLIC_BASE_URL: 'http://platform.example.com', ALLOW_INSECURE_SETUP: 'true' },
+      'plaintext_optin'
+    );
+    try {
+      const res = await postSetup(app, { owner, instanceName: 'Acme', setupToken: SETUP_TOKEN });
+      expect(res.status).toBe(201);
+    } finally {
+      await app.stop();
+    }
+  }, 120_000);
+});

package/test/integration/signin-wall.test.ts

@@ -0,0 +1,103 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { createDatabase, createTestApp, readJson, startPostgres, type TestApp } from './helpers.js';
+
+/**
+ * PRDCT-2830 / PRDCT-2848: the sign-in library's own wall (3 per 10 seconds
+ * per address on `/sign-in*`, on under NODE_ENV=production) answers 429 inside
+ * the `/auth/*` mount, and the chassis's failure-only login wall in front of
+ * it (10 per 15 minutes) counted every one of those 429s as a refused
+ * credential. A burst of ordinary sign-ins from one address (a room behind one
+ * public IP) then locked that address out for 15 minutes.
+ *
+ * Pinned here: a library 429 costs the chassis wall nothing; a wrong password
+ * still does; the federated start (`sign-in/oauth2`, no credential) is off the
+ * wall. The library's wall is off under NODE_ENV=test, so the suite switches
+ * it on in the live auth context, as production has it.
+ */
+
+const OWNER = { email: 'owner@wall.test', name: 'Wall Owner', password: 'wall-owner-password-123' };
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+type RateLimitCtx = { rateLimit: { enabled: boolean } };
+let authCtx: RateLimitCtx;
+
+const post = (path: string, ip: string, body: unknown) =>
+  app.app.request(`/api/v1/auth${path}`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-forwarded-for': ip, origin: 'http://localhost:3000' },
+    body: JSON.stringify(body)
+  });
+
+/** The chassis's own wall answers `{ error: { code: 'rate_limited' } }`; the library's does not. */
+async function isChassisWall(res: Response): Promise<boolean> {
+  if (res.status !== 429) return false;
+  const body = await readJson(res).catch(() => null);
+  return body?.error?.code === 'rate_limited';
+}
+
+beforeAll(async () => {
+  container = await startPostgres();
+  app = await createTestApp(await createDatabase(container, 'signin_wall'));
+  const setup = await app.app.request('/api/v1/setup', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ setupToken: 'integration-test-setup-token', instanceName: 'Wall', owner: OWNER })
+  });
+  expect(setup.status).toBeLessThan(300);
+  authCtx = (await (app.auth as unknown as { $context: Promise<RateLimitCtx> }).$context) as RateLimitCtx;
+});
+
+afterAll(async () => {
+  if (authCtx) authCtx.rateLimit.enabled = false;
+  await app?.stop();
+  await container?.stop();
+});
+
+describe('the login wall and the library wall behind it', () => {
+  it('a burst the library answers 429 does not lock the address out', async () => {
+    const ip = '198.51.100.10';
+    authCtx.rateLimit.enabled = true;
+    const statuses: number[] = [];
+    try {
+      for (let i = 0; i < 15; i++) {
+        const res = await post('/sign-in/email', ip, { email: OWNER.email, password: OWNER.password });
+        statuses.push(res.status);
+        expect(await isChassisWall(res)).toBe(false);
+      }
+    } finally {
+      // The library's 10-second window, elapsed.
+      authCtx.rateLimit.enabled = false;
+    }
+    // The library's wall did answer: 3 in, the rest 429 (more than the login wall's 10 points).
+    expect(statuses.filter((s) => s === 429).length).toBeGreaterThan(10);
+    // Once the library lets the address through again, the right password signs in.
+    const after = await post('/sign-in/email', ip, { email: OWNER.email, password: OWNER.password });
+    expect(after.status).toBe(200);
+  });
+
+  it('a wrong password still costs: the eleventh from one address meets the 15-minute wall', async () => {
+    const ip = '198.51.100.20';
+    for (let i = 0; i < 10; i++) {
+      const res = await post('/sign-in/email', ip, {
+        email: `nobody-${i}@wall.test`,
+        password: 'wrong-password-1'
+      });
+      expect(res.status).toBe(401);
+    }
+    const eleventh = await post('/sign-in/email', ip, {
+      email: 'nobody-x@wall.test',
+      password: 'wrong-password-1'
+    });
+    expect(await isChassisWall(eleventh)).toBe(true);
+  });
+
+  it('the federated start presents no credential and never meets the login wall', async () => {
+    const ip = '198.51.100.30';
+    for (let i = 0; i < 12; i++) {
+      const res = await post('/sign-in/oauth2', ip, { providerId: 'antasphere', callbackURL: '/' });
+      expect(await isChassisWall(res)).toBe(false);
+    }
+  });
+});