@bevel-software/platform-core-backend 0.33.0 → 0.35.0

package/src/modules/auth/__tests__/password-change-sessions.pg.test.ts

@@ -0,0 +1,269 @@
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import express from 'express';
+import type { Server } from 'node:http';
+import { eq } from 'drizzle-orm';
+import { users, type Database } from '../../database/index.js';
+import { PG_ADMIN_URL, PG_TEST_TIMEOUT, dropScratchDatabases, openMigratedScratchDb } from '../../../__tests__/pg-scratch.js';
+import { AuthService } from '../auth.service.js';
+import { SessionEndedError } from '../account-admission.js';
+import { createAuthRoutes } from '../auth.routes.js';
+import { AUTH_COOKIE_NAME, createAuthMiddleware } from '../auth.middleware.js';
+import { verifyPassword } from '../password-hash.js';
+
+/**
+ * Something to run once, the next time a password is hashed: a change hashes
+ * its new password after reading the row and proving the current one, and
+ * before writing, so this is where "another session changed it first" lands.
+ */
+const beforeNextHash = vi.hoisted(() => ({ run: null as null | (() => Promise<void>) }));
+vi.mock('../password-hash.js', async (importOriginal) => {
+  const original = await importOriginal<typeof import('../password-hash.js')>();
+  return {
+    ...original,
+    hashPassword: async (password: string) => {
+      const run = beforeNextHash.run;
+      beforeNextHash.run = null;
+      if (run) await run();
+      return original.hashPassword(password);
+    },
+  };
+});
+
+/**
+ * Changing your password ends the sessions opened with the old one, and a
+ * change whose current password stopped being current is refused. Both are
+ * a row's session generation and a conditional write on it, which no stub
+ * can stand in for, so this crosses a real Postgres (see `pg-scratch.ts`)
+ * through the real routes and the real auth middleware.
+ */
+const JWT_SECRET = 'test-jwt-secret';
+
+describe.skipIf(!PG_ADMIN_URL)('a password change and the sessions opened before it, on a real Postgres', () => {
+  let db: Database;
+  let closeDb: () => Promise<void>;
+  let auth: AuthService;
+  let server: Server;
+  let base: string;
+
+  beforeAll(async () => {
+    ({ db, close: closeDb } = await openMigratedScratchDb('hexis_pwchange'));
+    auth = new AuthService(db, { jwtSecret: JWT_SECRET, adminEmail: '', adminPassword: '', allowedEmailDomains: [] });
+    const app = express();
+    app.use(express.json());
+    app.use('/api', createAuthRoutes(auth, createAuthMiddleware(auth)));
+    await new Promise<void>((resolve) => {
+      server = app.listen(0, resolve);
+    });
+    const address = server.address();
+    if (typeof address === 'string' || !address) throw new Error('no port');
+    base = `http://127.0.0.1:${address.port}`;
+  }, PG_TEST_TIMEOUT);
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => {
+      if (server) server.close(() => resolve());
+      else resolve();
+    });
+    if (db) await closeDb();
+    await dropScratchDatabases();
+  }, PG_TEST_TIMEOUT);
+
+  /** A sign-in: its bearer token, and the auth cookie a browser would keep. */
+  async function signIn(email: string, password: string): Promise<{ token: string; cookie: string }> {
+    const res = await fetch(`${base}/api/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, password }),
+    });
+    expect(res.status).toBe(200);
+    return { token: ((await res.json()) as { token: string }).token, cookie: authCookie(res) };
+  }
+
+  function authCookie(res: Response): string {
+    const set = res.headers.getSetCookie().find((c) => c.startsWith(`${AUTH_COOKIE_NAME}=`));
+    if (!set) throw new Error('no auth cookie set');
+    return set.split(';')[0];
+  }
+
+  function changePassword(token: string, currentPassword: string, newPassword: string) {
+    return fetch(`${base}/api/auth/change-password`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ currentPassword, newPassword }),
+    });
+  }
+
+  const meWithBearer = (token: string) =>
+    fetch(`${base}/api/auth/me`, { headers: { Authorization: `Bearer ${token}` } }).then((r) => r.status);
+  const meWithCookie = (cookie: string) =>
+    fetch(`${base}/api/auth/me`, { headers: { Cookie: cookie } }).then((r) => r.status);
+
+  async function storedRow(email: string) {
+    const [row] = await db.select().from(users).where(eq(users.emailBidx, email)).limit(1);
+    return row;
+  }
+
+  it(
+    'ends every token and browser session issued before the change, except the one that made it',
+    async () => {
+      await auth.createAccount('kim@acme.test', 'Kim', 'old-password-1');
+      const changer = await signIn('kim@acme.test', 'old-password-1');
+      const laptop = await signIn('kim@acme.test', 'old-password-1');
+      const browser = await signIn('kim@acme.test', 'old-password-1');
+      // All three are live, and the cached answer the middleware now holds
+      // is exactly what the change has to get past.
+      expect(await meWithBearer(changer.token)).toBe(200);
+      expect(await meWithBearer(laptop.token)).toBe(200);
+      expect(await meWithCookie(browser.cookie)).toBe(200);
+
+      const res = await changePassword(changer.token, 'old-password-1', 'new-password-1');
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { ok: boolean; token: string };
+      expect(body.ok).toBe(true);
+
+      // Every session opened before the change answers 401 on its next request...
+      expect(await meWithBearer(laptop.token)).toBe(401);
+      expect(await meWithCookie(browser.cookie)).toBe(401);
+      expect(await meWithBearer(browser.token)).toBe(401);
+      expect(await meWithCookie(laptop.cookie)).toBe(401);
+      // ...the changer's old credentials included: what it carries on with is
+      // the fresh token and cookie the change handed back.
+      expect(await meWithBearer(changer.token)).toBe(401);
+      expect(await meWithCookie(changer.cookie)).toBe(401);
+      expect(await meWithBearer(body.token)).toBe(200);
+      expect(await meWithCookie(authCookie(res))).toBe(200);
+
+      // The old password signs nobody in; the new one does, and its session lives.
+      const old = await fetch(`${base}/api/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'kim@acme.test', password: 'old-password-1' }),
+      });
+      expect(old.status).toBe(401);
+      const again = await signIn('kim@acme.test', 'new-password-1');
+      expect(await meWithBearer(again.token)).toBe(200);
+      // ...and so does the changer's, alongside it.
+      expect(await meWithBearer(body.token)).toBe(200);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'refuses, in words, a change whose current password another session changed first, and writes nothing',
+    async () => {
+      await auth.createAccount('lena@acme.test', 'Lena', 'old-password-1');
+      const first = await signIn('lena@acme.test', 'old-password-1');
+      const second = await signIn('lena@acme.test', 'old-password-1');
+
+      // The second session's change has read the row and proven the old
+      // password when the first session's change lands.
+      let firstStatus = 0;
+      beforeNextHash.run = async () => {
+        firstStatus = (await changePassword(first.token, 'old-password-1', 'first-new-password')).status;
+      };
+      const raced = await changePassword(second.token, 'old-password-1', 'second-new-password');
+      expect(firstStatus).toBe(200);
+      expect(raced.status).toBe(409);
+      expect(((await raced.json()) as { error: string }).error).toMatch(
+        /changed from another session.*nothing was changed/,
+      );
+
+      // Nothing of the refused change was written: the first change's
+      // password is the account's, and the generation moved on once.
+      const afterRace = await storedRow('lena@acme.test');
+      expect(await verifyPassword('first-new-password', afterRace.passwordHash!)).toBe(true);
+      expect(await verifyPassword('second-new-password', afterRace.passwordHash!)).toBe(false);
+      expect(afterRace.sessionVersion).toBe(1);
+
+      // A session opened since, typing the password that is no longer
+      // current, is refused in words and changes nothing either.
+      const third = await signIn('lena@acme.test', 'first-new-password');
+      const stale = await changePassword(third.token, 'old-password-1', 'third-new-password');
+      expect(stale.status).toBe(400);
+      expect(((await stale.json()) as { error: string }).error).toBe('Current password is incorrect');
+      const afterStale = await storedRow('lena@acme.test');
+      expect(afterStale.passwordHash).toBe(afterRace.passwordHash);
+      expect(afterStale.sessionVersion).toBe(1);
+      expect(await meWithBearer(third.token)).toBe(200);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'ends the sessions opened before an admin reset, and refuses a change that read the row before it',
+    async () => {
+      await auth.createAccount('noor@acme.test', 'Noor', 'old-password-1');
+      const laptop = await signIn('noor@acme.test', 'old-password-1');
+      const changer = await signIn('noor@acme.test', 'old-password-1');
+      expect(await meWithBearer(laptop.token)).toBe(200);
+      expect(await meWithCookie(laptop.cookie)).toBe(200);
+
+      // The reset lands after the self-service change has proven the old password.
+      beforeNextHash.run = async () => {
+        await auth.createAccount('noor@acme.test', undefined, 'reset-password-1');
+      };
+      const raced = await changePassword(changer.token, 'old-password-1', 'self-new-password');
+      expect(raced.status).toBe(409);
+
+      // The reset is the account's password, and the generation moved on once.
+      const row = await storedRow('noor@acme.test');
+      expect(await verifyPassword('reset-password-1', row.passwordHash!)).toBe(true);
+      expect(row.sessionVersion).toBe(1);
+      expect(await meWithBearer(laptop.token)).toBe(401);
+      expect(await meWithCookie(laptop.cookie)).toBe(401);
+      expect(await meWithBearer(changer.token)).toBe(401);
+      const fresh = await signIn('noor@acme.test', 'reset-password-1');
+      expect(await meWithBearer(fresh.token)).toBe(200);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'ends the old sessions on another replica at their next request too',
+    async () => {
+      // A second process on the same database, with its own cache, which has
+      // just seen the session live.
+      const replica = new AuthService(db, { jwtSecret: JWT_SECRET, adminEmail: '', adminPassword: '', allowedEmailDomains: [] });
+      await auth.createAccount('omar@acme.test', 'Omar', 'old-password-1');
+      const laptop = await signIn('omar@acme.test', 'old-password-1');
+      const changer = await signIn('omar@acme.test', 'old-password-1');
+      await expect(replica.resolveSession(laptop.token)).resolves.toMatchObject({ email: 'omar@acme.test' });
+
+      const res = await changePassword(changer.token, 'old-password-1', 'new-password-1');
+      expect(res.status).toBe(200);
+      const { token } = (await res.json()) as { token: string };
+
+      const ended = replica.resolveSession(laptop.token);
+      await expect(ended).rejects.toBeInstanceOf(SessionEndedError);
+      await expect(ended).rejects.toThrow(/password was changed after this session was opened/);
+      await expect(replica.resolveSession(token)).resolves.toMatchObject({ email: 'omar@acme.test' });
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'refuses a first password set from the Account page when an admin set a starting one meanwhile',
+    async () => {
+      // Single sign-on only: no password yet, so the Account page asks for no current one.
+      const { token: sso } = await auth.loginWithSso('pia@acme.test', 'Pia', { admittedByProvider: true });
+      expect(await meWithBearer(sso)).toBe(200);
+
+      beforeNextHash.run = async () => {
+        const set = await auth.createAccountWithStartingPassword('pia@acme.test', 'starting-password-1');
+        expect(set.passwordSet).toBe(true);
+      };
+      const raced = await fetch(`${base}/api/auth/change-password`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${sso}` },
+        body: JSON.stringify({ newPassword: 'self-new-password' }),
+      });
+      expect(raced.status).toBe(409);
+
+      const row = await storedRow('pia@acme.test');
+      expect(await verifyPassword('starting-password-1', row.passwordHash!)).toBe(true);
+      expect(row.sessionVersion).toBe(1);
+      expect(await meWithBearer(sso)).toBe(401);
+    },
+    PG_TEST_TIMEOUT,
+  );
+});

package/src/modules/auth/account-admission.ts

@@ -82,6 +82,25 @@ export class AccountDeactivatedError extends Error {
   }
 }
 
+/**
+ * A session token that verifies but is no longer honoured: the account's
+ * password was changed after the token was issued, which ends every session
+ * opened before it. A 401 with these words, so the person knows why they are
+ * back at the sign-in form rather than reading "invalid token".
+ */
+export class SessionEndedError extends Error {
+  readonly status = 401;
+
+  constructor(message = SESSION_ENDED_MESSAGE) {
+    super(message);
+    this.name = 'SessionEndedError';
+  }
+}
+
+/** What a person whose session a password change ended is told. */
+export const SESSION_ENDED_MESSAGE =
+  'Your password was changed after this session was opened. Sign in again with the new password.';
+
 /**
  * Whether the account behind a credential is on could not be asked — the
  * database failed. Not the caller's fault and not a verdict on them: a

package/src/modules/auth/auth.middleware.ts

@@ -1,6 +1,6 @@
 import type { Request, Response, NextFunction } from 'express';
 import type { AuthService } from './auth.service.js';
-import { AccountDeactivatedError, AuthBackendError } from './account-admission.js';
+import { AccountDeactivatedError, AuthBackendError, SessionEndedError } from './account-admission.js';
 
 // Augment Express Request so userId/userEmail are available after auth middleware
 declare global {
@@ -20,10 +20,49 @@ declare global {
  * header, which the frontend stores in memory and attaches via `authFetch`.
  *
  * Same JWT value as the Bearer token. The cookie is `HttpOnly` + `SameSite=Lax`
- * + `Secure` (in prod) — see `auth.routes.ts` for the issue site.
+ * + `Secure` when the deployment is reached over https — {@link setAuthCookie}
+ * is its one issue site, for every sign-in path and the password change.
  */
 export const AUTH_COOKIE_NAME = 'bevel_token';
 
+/**
+ * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
+ * '7d'` so the cookie expires when the token does — browsers stop
+ * sending it past expiry, sparing the auth middleware verifying tokens
+ * that are guaranteed to fail.
+ */
+export const AUTH_COOKIE_MAX_AGE_S = 7 * 24 * 60 * 60;
+
+/**
+ * Whether the auth cookie is marked `Secure`, from the scheme the deployment
+ * is reached on: a browser never sends a `Secure` cookie over plain http, so
+ * deriving it from `NODE_ENV` left a production deployment served over http
+ * (a private network, a proxy that terminates nothing) without SSE and
+ * images. One rule, asked by the composition root for every path that sets
+ * the cookie. Read by the URL parser, as the deployment's URL is everywhere
+ * else: a scheme is case-insensitive, and `HTTPS://` is https.
+ */
+export function authCookieSecure(publicUrl: string): boolean {
+  return new URL(publicUrl).protocol === 'https:';
+}
+
+/**
+ * Set the JWT as the HttpOnly auth cookie so transports that can't carry
+ * headers (EventSource for SSE, image tags) authenticate automatically. JSON
+ * callers continue to use the Bearer header returned in the body. The one
+ * place the cookie's attributes are spelled: password login, the password
+ * change and every SSO provider set it through here.
+ */
+export function setAuthCookie(res: Response, token: string, secure: boolean): void {
+  res.cookie(AUTH_COOKIE_NAME, token, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure,
+    maxAge: AUTH_COOKIE_MAX_AGE_S * 1000,
+    path: '/',
+  });
+}
+
 /**
  * Read the auth cookie out of the raw `Cookie` header without pulling in
  * `cookie-parser`. We only ever look for one cookie, so a tiny parser
@@ -78,8 +117,10 @@ export function createAuthMiddleware(authService: Pick<AuthService, 'resolveSess
         return;
       }
       // A 401 otherwise, so the app drops the session and shows the login
-      // page; a switched-off account is told why there.
-      res.status(401).json({ error: err instanceof AccountDeactivatedError ? err.message : 'Invalid or expired token' });
+      // page; a switched-off account, and a session a password change
+      // ended, are told why there.
+      const worded = err instanceof AccountDeactivatedError || err instanceof SessionEndedError;
+      res.status(401).json({ error: worded ? err.message : 'Invalid or expired token' });
       return;
     }
     req.userId = session.userId;

package/src/modules/auth/auth.routes.ts

@@ -2,19 +2,26 @@ import express from 'express';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('auth');
-import type { AuthService } from './auth.service.js';
-import { AUTH_COOKIE_NAME } from './auth.middleware.js'; // also imports Express Request augmentation
+import { PasswordChangedMeanwhileError, PasswordRefusedError, type AuthService } from './auth.service.js';
+import { setAuthCookie } from './auth.middleware.js'; // also imports Express Request augmentation
 import { FixedWindowRateLimiter } from './rate-limit.js';
 import { AccountDeactivatedError } from './account-admission.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
 
-/**
- * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
- * '7d'` so the cookie expires when the token does — browsers stop
- * sending it past expiry, sparing the auth middleware verifying tokens
- * that are guaranteed to fail.
- */
-export const AUTH_COOKIE_MAX_AGE_S = 7 * 24 * 60 * 60;
+// The cookie's lifetime lives beside its one issue site now; still offered
+// here for the providers that learnt it from this file.
+export { AUTH_COOKIE_MAX_AGE_S } from './auth.middleware.js';
+
+/** What {@link createAuthRoutes} takes beyond its services. */
+export interface AuthRoutesOptions {
+  /**
+   * Whether the auth cookie is marked `Secure`: the composition root derives
+   * it from the deployment's public URL (`authCookieSecure`), the one rule
+   * every provider's cookie follows too. Absent — a harness that mounts the
+   * routes on their own — it falls back to `NODE_ENV === 'production'`.
+   */
+  cookieSecure?: boolean;
+}
 
 /**
  * A pluggable SSO login method. Core ships password login and (when
@@ -49,8 +56,10 @@ export function createAuthRoutes(
   authMiddleware: express.RequestHandler,
   providers: AuthProviderPlugin[] = [],
   passwordLoginEnabled = true,
+  options: AuthRoutesOptions = {},
 ): express.Router {
   const router = express.Router();
+  const cookieSecure = options.cookieSecure ?? process.env.NODE_ENV === 'production';
 
   // Brute-force guards on the password endpoints (scrypt also makes each
   // attempt expensive server-side, so these double as DoS protection):
@@ -100,18 +109,7 @@ export function createAuthRoutes(
       // attempts isn't rate-limited on their next visit. (The wider per-ip
       // window intentionally keeps counting.)
       loginPairLimiter.reset(pairKey);
-      // Also set the JWT as an HttpOnly cookie so transports that can't
-      // carry headers (EventSource for SSE, image tags) authenticate
-      // automatically. JSON callers continue to use the Bearer header
-      // returned in the body. Secure in production; off in dev so the
-      // cookie survives `http://localhost` requests.
-      res.cookie(AUTH_COOKIE_NAME, result.token, {
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: process.env.NODE_ENV === 'production',
-        maxAge: AUTH_COOKIE_MAX_AGE_S * 1000,
-        path: '/',
-      });
+      setAuthCookie(res, result.token, cookieSecure);
       res.json(result);
     } catch (error) {
       // The password was right and an admin switched the account off: said
@@ -144,6 +142,9 @@ export function createAuthRoutes(
   // POST /api/auth/change-password — self-service (protected). Requires the
   // current password whenever one is set; an SSO-only account sets its first
   // password without one.
+  //
+  // A change ends every session opened before it, this one included, so the
+  // caller is handed a fresh token (body and cookie) to carry on with.
   router.post('/auth/change-password', authMiddleware, async (req, res) => {
     const { currentPassword, newPassword } = req.body as {
       currentPassword?: string;
@@ -158,13 +159,27 @@ export function createAuthRoutes(
       return;
     }
     try {
-      await authService.changePassword(req.userId!, currentPassword, newPassword);
-      res.json({ ok: true });
+      const { token } = await authService.changePassword(req.userId!, currentPassword, newPassword);
+      setAuthCookie(res, token, cookieSecure);
+      res.json({ ok: true, token });
     } catch (error) {
-      const msg = error instanceof Error ? error.message : 'Unknown error';
-      // Policy violations and a wrong current password are caller errors, not
-      // server faults — and the message is safe to show verbatim.
-      res.status(400).json({ error: msg });
+      // Another session changed the password first: what this one proved is
+      // no longer current, and nothing was written.
+      if (error instanceof PasswordChangedMeanwhileError) {
+        res.status(409).json({ error: error.message });
+        return;
+      }
+      // A refusal the service made on purpose — a policy violation, a wrong
+      // current password, an account whose password is not kept here — is
+      // the caller's to fix, and its words are written for them.
+      if (error instanceof PasswordRefusedError) {
+        res.status(400).json({ error: error.message });
+        return;
+      }
+      // Anything else is a fault, not a verdict: logged in full, answered
+      // generic, so a driver's message never reaches a browser.
+      log.error('Change-password error:', { err: error });
+      res.status(500).json({ error: 'Could not change the password' });
     }
   });
 
@@ -216,8 +231,10 @@ export function createAuthRoutes(
       }
       res.json(user);
     } catch (error) {
-      const msg = error instanceof Error ? error.message : 'Unknown error';
-      res.status(500).json({ error: msg });
+      // Logged in full, returned generic — the rule every route here follows:
+      // a raw driver message would hand the caller the schema or the host.
+      log.error('Auth me error:', { err: error });
+      res.status(500).json({ error: 'Could not load your account' });
     }
   });