@blamejs/blamejs-shop 0.4.31 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/break-glass.test.js

@@ -273,6 +273,46 @@ async function testGrantRefusalPaths() {
   }
 }
 
+// ---- Grant — concurrent TOTP replay (atomic step reservation) ----
+
+async function testConcurrentTotpGrantReplay() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", {
+      columns: ["ssn"],
+      factors: ["totp"],
+    });
+    var totp = _validTotp();
+    var req  = _fakeReq();   // one req → one actor → one (actor, secret) replay key
+    function grantOpts() {
+      return {
+        req:    req,
+        table:  "patients",
+        reason: "concurrent replay regression test",
+        factor: { type: "totp", code: totp.code, secret: totp.secret },
+      };
+    }
+    // Two grants in flight at once presenting the SAME in-window code. The
+    // accepted TOTP step is reserved atomically as part of acceptance, so
+    // exactly one grant succeeds and the other is refused as a replay — a
+    // read-then-commit floor let both observe the old floor and both pass.
+    var results = await Promise.allSettled([
+      b.breakGlass.grant(grantOpts()),
+      b.breakGlass.grant(grantOpts()),
+    ]);
+    var ok  = results.filter(function (r) { return r.status === "fulfilled"; });
+    var bad = results.filter(function (r) { return r.status === "rejected"; });
+    check("concurrent totp grant: exactly one grant succeeds", ok.length === 1);
+    check("concurrent totp grant: the other is refused as a replay",
+          bad.length === 1 &&
+          /breakglass\/bad-factor/.test((bad[0].reason && bad[0].reason.code) || ""));
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 // ---- Grant + unseal — full lifecycle on a real sealed table ----
 
 async function testUnsealRowLifecycle() {
@@ -300,8 +340,9 @@ async function testUnsealRowLifecycle() {
     });
     check("grant: maxRowsPerGrant honored from policy", grant.rowsRemaining === 3);
 
-    // Use grant once
-    var unsealed = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId);
+    // Use grant once. Default policy pins IP + session, so redemption
+    // threads the same request shape the grant was minted from.
+    var unsealed = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId, { req: _fakeReq() });
     check("unsealRow: returns the row",                 unsealed && unsealed._id === jid.jobId);
     check("unsealRow: payload column is decrypted",
           unsealed.payload && unsealed.payload.indexOf("alice") !== -1);
@@ -339,10 +380,10 @@ async function testGrantExhaustion() {
       reason: "compliance spot-check on queue row",
       factor: { type: "totp", code: totp.code, secret: totp.secret },
     });
-    await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId);
+    await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId, { req: _fakeReq() });
 
     var threw = null;
-    try { await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId); }
+    try { await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId, { req: _fakeReq() }); }
     catch (e) { threw = e; }
     check("exhaustion: second use of 1-row grant rejects",
           threw && /breakglass\/grant-exhausted/.test(threw.code));
@@ -375,7 +416,7 @@ async function testGrantRevoke() {
     });
     await b.breakGlass.revoke(grant.id, { reason: "task complete" });
     var threw = null;
-    try { await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId); }
+    try { await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId, { req: _fakeReq() }); }
     catch (e) { threw = e; }
     check("revoke: unseal after revoke rejects",
           threw && /breakglass\/grant-revoked/.test(threw.code));
@@ -441,6 +482,185 @@ async function testSweepExpiredGrants() {
   }
 }
 
+// ---- Grant binding enforcement: IP pin / session pin / fail-closed ----
+
+async function testIpPinEnforcement() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    var jid = await b.queue.enqueue("ip-pin-q", { secret: "row-ip-pin" });
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], maxRowsPerGrant: 5,
+      pinIp: true, sessionPin: false,   // isolate the IP pin
+    });
+    var totp = _validTotp();
+    // Mint from IP-A.
+    var grant = await b.breakGlass.grant({
+      req:    _fakeReq({ socket: { remoteAddress: "10.0.0.1" } }),
+      table:  "_blamejs_jobs",
+      reason: "ip-pin: minting from address A for redemption test",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+
+    // Redeem from IP-B → refused on the operator unsealRow consumer.
+    var threwUnseal = null;
+    try {
+      await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId,
+        { req: _fakeReq({ socket: { remoteAddress: "10.0.0.2" } }) });
+    } catch (e) { threwUnseal = e; }
+    check("ip-pin: IP-B redeem refused (unsealRow)",
+          threwUnseal && /breakglass\/grant-ip-mismatch/.test(threwUnseal.code));
+
+    // The mismatch must NOT have consumed the grant — same-IP redeem still
+    // succeeds afterward.
+    var ok = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId,
+      { req: _fakeReq({ socket: { remoteAddress: "10.0.0.1" } }) });
+    check("ip-pin: same-IP redeem succeeds (mismatch did not consume)",
+          ok && ok.payload && ok.payload.indexOf("row-ip-pin") !== -1);
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testSessionPinEnforcement() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    var jid = await b.queue.enqueue("sess-pin-q", { secret: "row-sess-pin" });
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], maxRowsPerGrant: 5,
+      pinIp: false, sessionPin: true,   // isolate the session pin
+    });
+    var totp = _validTotp();
+    var grant = await b.breakGlass.grant({
+      req:    _fakeReq({ session: { id: "sess-A" } }),
+      table:  "_blamejs_jobs",
+      reason: "session-pin: minting under session A for redemption test",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+
+    var threw = null;
+    try {
+      await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId,
+        { req: _fakeReq({ session: { id: "sess-B" } }) });
+    } catch (e) { threw = e; }
+    check("session-pin: different session redeem refused",
+          threw && /breakglass\/grant-session-mismatch/.test(threw.code));
+
+    var ok = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId,
+      { req: _fakeReq({ session: { id: "sess-A" } }) });
+    check("session-pin: same-session redeem succeeds",
+          ok && ok.payload && ok.payload.indexOf("row-sess-pin") !== -1);
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testIpPinFailClosedOnNullBinding() {
+  // An Express-shaped req exposes only `req.ip` (no socket.remoteAddress).
+  // When pinIp is on and the binding could not be captured at mint, the
+  // redemption must FAIL-CLOSED rather than silently skip enforcement.
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    var jid = await b.queue.enqueue("fc-q", { secret: "row-fc" });
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], maxRowsPerGrant: 5,
+      pinIp: true, sessionPin: false,
+    });
+    // Force a NULL ip binding at mint: a request with no socket AND no
+    // req.ip, so clientIp resolves null even with the req.ip fallback.
+    var noIpReq = {
+      user:    { id: "user-test-1" },
+      headers: { "user-agent": "test-agent" },
+      method:  "POST",
+      url:     "/admin/break-glass",
+    };
+    var totp = _validTotp();
+    var grant = await b.breakGlass.grant({
+      req:    noIpReq,
+      table:  "_blamejs_jobs",
+      reason: "fail-closed: minting with no resolvable client IP",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+
+    var threw = null;
+    try {
+      await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId,
+        { req: _fakeReq({ socket: { remoteAddress: "10.0.0.9" } }) });
+    } catch (e) { threw = e; }
+    check("ip-pin fail-closed: null binding refuses redemption",
+          threw && /breakglass\/grant-ip-mismatch/.test(threw.code));
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testTotpReplayDefense() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", {
+      columns: ["ssn"], factors: ["totp"], maxRowsPerGrant: 5,
+    });
+    // Pin a deterministic clock so both grant attempts land on the same
+    // TOTP step — the replay window.
+    var fixedNow = 1_700_000_000_000;
+    var secret = b.auth.totp.generateSecret();
+    var code = b.auth.totp.generate(secret, { now: fixedNow });
+
+    var g1 = await b.breakGlass.grant({
+      req:    _fakeReq(),
+      table:  "patients",
+      reason: "totp-replay: first redemption of the code",
+      factor: { type: "totp", secret: secret, code: code, now: fixedNow },
+    });
+    check("totp-replay: first grant succeeds", typeof g1.id === "string");
+
+    // Same code + same clock = same step → must be rejected as a replay.
+    var threw = null;
+    try {
+      await b.breakGlass.grant({
+        req:    _fakeReq(),
+        table:  "patients",
+        reason: "totp-replay: second use of the SAME code must fail",
+        factor: { type: "totp", secret: secret, code: code, now: fixedNow },
+      });
+    } catch (e) { threw = e; }
+    check("totp-replay: re-using the same code in-window refused",
+          threw && /breakglass\/bad-factor/.test(threw.code));
+
+    // A DIFFERENT credential accepting a code at the same step still
+    // succeeds — proves the replay floor is keyed by secret fingerprint,
+    // not actorId alone.
+    var secret2 = b.auth.totp.generateSecret();
+    var code2 = b.auth.totp.generate(secret2, { now: fixedNow });
+    var g2 = await b.breakGlass.grant({
+      req:    _fakeReq(),
+      table:  "patients",
+      reason: "totp-replay: distinct credential same window still works",
+      factor: { type: "totp", secret: secret2, code: code2, now: fixedNow },
+    });
+    check("totp-replay: distinct credential at same step still succeeds",
+          typeof g2.id === "string" && g2.id !== g1.id);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 // ---- v0.5.1: Cryptographic mode (Model B) ----
 
 async function testEncryptDecryptCellHappyPath() {
@@ -577,7 +797,7 @@ async function testCryptographicUnsealRow() {
       reason: "Model B integration test for cryptographic unseal",
       factor: { type: "totp", code: totp.code, secret: totp.secret },
     });
-    var row = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId);
+    var row = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId, { req: _fakeReq() });
     check("Model B unsealRow: decrypts cryptographic cell",
           row.payload === "alice's diagnosis (Model B)");
 
@@ -620,7 +840,7 @@ async function testMigrateModelAtoModelB() {
       reason: "post-migration verification of payload decrypt path",
       factor: { type: "totp", code: totp.code, secret: totp.secret },
     });
-    var row = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", j1.jobId);
+    var row = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", j1.jobId, { req: _fakeReq() });
     check("migrate: row-1 reads as cryptographic-mode plaintext",
           row.payload && row.payload.indexOf("row-1-secret") !== -1);
     void j2; void j3;
@@ -851,11 +1071,17 @@ async function run() {
   await testPolicyValidation();
   await testGrantHappyPath();
   await testGrantRefusalPaths();
+  await testConcurrentTotpGrantReplay();
   await testUnsealRowLifecycle();
   await testGrantExhaustion();
   await testGrantRevoke();
   await testTableMismatch();
   await testSweepExpiredGrants();
+  // grant binding enforcement (IP / session pin + fail-closed) + TOTP replay
+  await testIpPinEnforcement();
+  await testSessionPinEnforcement();
+  await testIpPinFailClosedOnNullBinding();
+  await testTotpReplayDefense();
   // v0.5.1 Model B
   await testEncryptDecryptCellHappyPath();
   await testEncryptionContextBinding();