@blamejs/blamejs-shop 0.4.85 → 0.4.86

package/lib/vendor/blamejs/test/layer-0-primitives/network-nts-handshake-byte-cap.test.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * b.* NTS-KE handshake byte-cap.
+ *
+ * The NTS-KE (RFC 8915) key-establishment handshake reader accumulates
+ * received bytes until a REC_END record terminates the exchange. A
+ * wall-clock timer bounds the handshake by time, but NOT by memory: a
+ * server that streams non-END records fast enough OOMs the process
+ * before the timer fires. The reader must cap the accumulated buffer at
+ * a sane ceiling (64 KiB) and fail closed with an nts/* typed error.
+ *
+ * This drives the real consumer path — network-nts.performKeHandshake
+ * against a live loopback TLS server negotiating ALPN "ntske/1" that
+ * streams > 64 KiB of non-END records.
+ */
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+var nts     = require("../../lib/network-nts");
+var nodeTls = require("node:tls");
+
+var REC_NEW_COOKIE = 5;
+
+// Encode an NTS-KE record: u16 type (top bit = critical) || u16 length
+// || body. We emit non-critical NEW_COOKIE records that never include a
+// REC_END (type 0), so a conformant reader keeps accumulating.
+function _encodeRecord(type, body) {
+  var hdr = Buffer.alloc(4);
+  hdr.writeUInt16BE(type & 0x7fff, 0);
+  hdr.writeUInt16BE(body.length, 2);
+  return Buffer.concat([hdr, body]);
+}
+
+function testHandshakeByteCapFailsClosed() {
+  return new Promise(function (resolve, reject) {
+    (async function () {
+      var server = null;
+      try {
+        var ca = await helpers.b.mtlsEngine.generateCa({ name: "nts-test-ca" });
+        var leaf = await helpers.b.mtlsEngine.signClientCert({
+          cn:           "localhost",
+          caCertPem:    ca.caCertPem,
+          caKeyPem:     ca.caKeyPem,
+          usage:        "server",
+          sans:         ["DNS:localhost", "IP:127.0.0.1"],
+          validityDays: 1,
+        });
+
+        // One ~1 KiB non-END record; streamed enough times to exceed the
+        // 64 KiB ceiling without ever sending REC_END.
+        var oneRecord = _encodeRecord(REC_NEW_COOKIE, Buffer.alloc(1020, 0x41));
+        var TOTAL_BYTES = 128 * 1024; // 2x the 64 KiB cap
+
+        server = nodeTls.createServer({
+          key:           leaf.key,
+          cert:          leaf.cert,
+          minVersion:    "TLSv1.3",
+          maxVersion:    "TLSv1.3",
+          ALPNProtocols: ["ntske/1"],
+        }, function (sock) {
+          sock.on("error", function () { /* client tears down mid-stream */ });
+          var sent = 0;
+          function pump() {
+            while (sent < TOTAL_BYTES) {
+              sent += oneRecord.length;
+              if (!sock.write(oneRecord)) {
+                sock.once("drain", pump);
+                return;
+              }
+            }
+          }
+          pump();
+        });
+
+        server.listen(0, "127.0.0.1", function () {
+          var port = server.address().port;
+          var startedAt = Date.now();
+          nts.performKeHandshake({
+            host:       "127.0.0.1",
+            port:       port,
+            servername: "localhost",
+            ca:         ca.caCertPem,
+            // Generous timeout: a passing run must reject on the byte cap
+            // FAST (well under this), proving the cap — not the timer —
+            // bounded the read.
+            timeoutMs:  30000,
+          }).then(function () {
+            server.close();
+            reject(new Error("handshake resolved despite > 64 KiB of non-END records"));
+          }).catch(function (e) {
+            var elapsed = Date.now() - startedAt;
+            try { server.close(); } catch (_e) { /* best-effort */ }
+            try {
+              check("handshake rejects on oversized stream",
+                    e && e.code === "nts/ke-too-large");
+              check("rejection is NtsError typed",
+                    e instanceof nts.NtsError);
+              check("rejection is bounded, not the wall-clock timeout",
+                    e.code !== "nts/ke-timeout");
+              check("bounded fast (well under the 30s timer)",
+                    elapsed < 15000);
+              resolve();
+            } catch (assertErr) {
+              reject(assertErr);
+            }
+          });
+        });
+
+        server.on("error", function (e) { reject(e); });
+      } catch (e) {
+        if (server) { try { server.close(); } catch (_e) { /* best-effort */ } }
+        reject(e);
+      }
+    })();
+  });
+}
+
+async function run() {
+  await testHandshakeByteCapFailsClosed();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/saml-subjectconfirmation-notbefore.test.js

@@ -0,0 +1,238 @@
+"use strict";
+/**
+ * b.auth.saml.sp.verifyResponse — Bearer SubjectConfirmationData
+ * NotBefore must fail closed when present-but-unparseable.
+ *
+ * SAML 2.0 Web Browser SSO Profile §4.1.4.2: a Bearer
+ * SubjectConfirmationData MAY carry a `NotBefore` bounding the start of
+ * its validity window. When NotBefore is PRESENT, the verifier must
+ * honor it. A NotBefore that cannot be parsed (Date.parse → NaN) is an
+ * IdP error or a tampered attribute — it cannot establish that the
+ * confirmation has begun, so it must NOT be silently dropped, leaving
+ * the SCD accepted. It must fail closed (the confirmation is skipped,
+ * the verifier tries the next one, and an assertion with no other valid
+ * confirmation is refused) — mirroring the NotOnOrAfter line just above
+ * and the already-hardened Conditions block.
+ *
+ * These tests drive the shipped consumer path:
+ *   sp = b.auth.saml.sp.create({ ... }); sp.verifyResponse(b64, vopts).
+ * They mint a self-signed RSA IdP cert, build a genuinely XMLDSig-
+ * signed SAML Response (digest + SignatureValue computed through the
+ * framework's own b.xmlC14n so the verifier's recomputation matches),
+ * and vary ONLY the SubjectConfirmationData's NotBefore between the
+ * accepted and refused cases.
+ */
+
+var helpers    = require("../helpers");
+var check      = helpers.check;
+var b          = helpers.b;
+var nodeCrypto = require("node:crypto");
+var c14n       = require("../../lib/xml-c14n");
+
+var DS  = "http://www.w3.org/2000/09/xmldsig#";
+var EXC = "http://www.w3.org/2001/10/xml-exc-c14n#";
+
+var IDP_ENTITY_ID = "https://idp.example";
+var SP_ENTITY_ID  = "https://sp.example";
+var ACS_URL       = "https://sp.example/saml/acs";
+
+// Mint a self-signed RSA cert via the vendored @peculiar/x509 bundle.
+// verifyResponse parses idpCertPem with nodeCrypto.createPublicKey and
+// verifies an rsa-sha256 PKCS1 signature, so a real RSA cert + matching
+// private key is required — there is no test bypass of the signature
+// check.
+async function _mintRsaCert(cn) {
+  var pki  = require("../../lib/vendor/pki.cjs");
+  var x509 = pki.x509;
+  var keys = await nodeCrypto.webcrypto.subtle.generateKey(
+    { name: "RSASSA-PKCS1-v1_5", modulusLength: 2048,                                           // allow:raw-byte-literal — RFC 8301 §3.1 RSA bit floor
+      publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+    true, ["sign", "verify"]);
+  var now = new Date();
+  var cert = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber:     "01",
+    name:             "CN=" + cn,
+    notBefore:        now,
+    notAfter:         new Date(now.getTime() + 365 * 24 * 3600 * 1000),                         // allow:raw-time-literal — 1y fixture validity
+    signingAlgorithm: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    keys:             keys,
+  });
+  var pkcs8 = await nodeCrypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  var keyPem = "-----BEGIN PRIVATE KEY-----\n" +
+    Buffer.from(pkcs8).toString("base64").match(/.{1,64}/g).join("\n") +
+    "\n-----END PRIVATE KEY-----\n";
+  return { certPem: cert.toString("pem"), keyPem: keyPem };
+}
+
+function _isoFromNow(ms) { return new Date(Date.now() + ms).toISOString(); }
+
+// Build a SAML Response with an Assertion-level enveloped XMLDSig
+// signature. The Assertion's Signature child is stripped before the
+// digest (the enveloped-signature transform), and both the digest and
+// the SignedInfo are canonicalized through b.xmlC14n so the values
+// match exactly what verifyResponse recomputes.
+function _buildSignedResponse(idp, parts) {
+  var assertionId  = "_assertion-" + parts.tag;
+  var responseId   = "_response-" + parts.tag;
+  var issueInstant = _isoFromNow(0);
+  var subjectConfirmation =
+    "<saml:SubjectConfirmation Method=\"" + parts.method + "\">" +
+    parts.scd +
+    "</saml:SubjectConfirmation>";
+
+  var assertionInner =
+    "<saml:Issuer>" + IDP_ENTITY_ID + "</saml:Issuer>" +
+    "SIGNATURE_PLACEHOLDER" +
+    "<saml:Subject>" +
+    "<saml:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">" +
+    parts.nameId + "</saml:NameID>" +
+    subjectConfirmation +
+    "</saml:Subject>" +
+    (parts.conditions !== undefined ? parts.conditions :
+      "<saml:Conditions NotBefore=\"" + _isoFromNow(-5 * 60 * 1000) +                            // allow:raw-time-literal — 5m skew window
+      "\" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\">" +                                // allow:raw-time-literal — 5m skew window
+      "<saml:AudienceRestriction><saml:Audience>" + SP_ENTITY_ID +
+      "</saml:Audience></saml:AudienceRestriction>" +
+      "</saml:Conditions>") +
+    "<saml:AuthnStatement SessionIndex=\"_sess-1\" AuthnInstant=\"" + issueInstant + "\">" +
+    "<saml:AuthnContext><saml:AuthnContextClassRef>" +
+    "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" +
+    "</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>";
+
+  var assertionOpen =
+    "<saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" " +
+    "ID=\"" + assertionId + "\" Version=\"2.0\" IssueInstant=\"" + issueInstant + "\">";
+  var assertionClose = "</saml:Assertion>";
+
+  // Digest the assertion with no Signature child (enveloped-signature
+  // transform output), canonicalized through b.xmlC14n.
+  var assertionNoSig = assertionOpen +
+    assertionInner.replace("SIGNATURE_PLACEHOLDER", "") + assertionClose;
+  var digest = nodeCrypto.createHash("sha256")
+    .update(c14n.canonicalize(assertionNoSig)).digest("base64");
+
+  var signedInfo =
+    "<ds:SignedInfo xmlns:ds=\"" + DS + "\">" +
+    "<ds:CanonicalizationMethod Algorithm=\"" + EXC + "\"></ds:CanonicalizationMethod>" +
+    "<ds:SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\"></ds:SignatureMethod>" +
+    "<ds:Reference URI=\"#" + assertionId + "\">" +
+    "<ds:Transforms>" +
+    "<ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"></ds:Transform>" +
+    "<ds:Transform Algorithm=\"" + EXC + "\"></ds:Transform>" +
+    "</ds:Transforms>" +
+    "<ds:DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></ds:DigestMethod>" +
+    "<ds:DigestValue>" + digest + "</ds:DigestValue>" +
+    "</ds:Reference>" +
+    "</ds:SignedInfo>";
+  var priv = nodeCrypto.createPrivateKey({ key: idp.keyPem, format: "pem" });
+  var sigValue = nodeCrypto.sign("sha256", c14n.canonicalize(signedInfo),
+    { key: priv, padding: nodeCrypto.constants.RSA_PKCS1_PADDING }).toString("base64");
+
+  var signatureXml =
+    "<ds:Signature xmlns:ds=\"" + DS + "\">" + signedInfo +
+    "<ds:SignatureValue>" + sigValue + "</ds:SignatureValue></ds:Signature>";
+  var assertionFull = assertionOpen +
+    assertionInner.replace("SIGNATURE_PLACEHOLDER", signatureXml) + assertionClose;
+
+  var response =
+    "<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" " +
+    "xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" " +
+    "ID=\"" + responseId + "\" Version=\"2.0\" IssueInstant=\"" + issueInstant + "\" " +
+    "Destination=\"" + ACS_URL + "\">" +
+    "<saml:Issuer>" + IDP_ENTITY_ID + "</saml:Issuer>" +
+    "<samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status>" +
+    assertionFull + "</samlp:Response>";
+
+  return Buffer.from(response, "utf8").toString("base64");
+}
+
+function _bearerScd(notBeforeAttr, inResponseTo) {
+  return "<saml:SubjectConfirmationData" +
+    " NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"" +                                      // allow:raw-time-literal — 5m future, otherwise-valid window
+    notBeforeAttr +
+    " Recipient=\"" + ACS_URL + "\"" +
+    " InResponseTo=\"" + inResponseTo + "\"/>";
+}
+
+function _newSp(idp) {
+  return b.auth.saml.sp.create({
+    entityId:                    SP_ENTITY_ID,
+    assertionConsumerServiceUrl: ACS_URL,
+    idpEntityId:                 IDP_ENTITY_ID,
+    idpSsoUrl:                   "https://idp.example/sso",
+    idpCertPem:                  idp.certPem,
+  });
+}
+
+function _verifyThrows(sp, b64, vopts) {
+  try { sp.verifyResponse(b64, vopts); return null; }
+  catch (e) { return e.code || e.message; }
+}
+
+// Case 1 — a past (already-valid) NotBefore succeeds. Proves the signer
+// + harness are correct and the fail-closed fix does not break the happy
+// path (an otherwise-acceptable confirmation that has begun).
+async function testBearerPastNotBeforeAccepted() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-past-nb";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-past-nb",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotBefore=\"" + _isoFromNow(-5 * 60 * 1000) + "\"", inResponseTo),       // allow:raw-time-literal — 5m past, already valid
+  });
+  var info = sp.verifyResponse(b64, { expectedInResponseTo: inResponseTo });
+  check("Bearer with past NotBefore verifies",           info && typeof info === "object");
+  check("Bearer past NotBefore: nameId returned",        info.nameId === "alice@example.com");
+}
+
+// Case 2 — a NotBefore in the FUTURE (not yet valid) must be refused.
+// This path already fails closed on the unfixed tree (isFinite(nb) is
+// true and nb > now), so it is the harness-correctness control proving
+// the not-yet-valid axis is enforced at all.
+async function testBearerFutureNotBeforeRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-future-nb";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-future-nb",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotBefore=\"" + _isoFromNow(60 * 60 * 1000) + "\"", inResponseTo),       // allow:raw-time-literal — 1h future, not yet valid
+  });
+  check("Bearer with future NotBefore is refused (not yet valid)",
+    _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo }) === "auth-saml/no-valid-confirmation");
+}
+
+// Case 3 — the RED case: a Bearer SubjectConfirmationData with a
+// present-but-UNPARSEABLE NotBefore. On the unfixed tree `isFinite(nb)`
+// is false, so the `&&`-guarded not-yet-valid check is skipped and the
+// SCD is wrongly ACCEPTED. It must fail closed: an unparseable NotBefore
+// cannot establish that the confirmation has begun, so the SCD is
+// skipped and the assertion (with no other valid confirmation) refused.
+async function testBearerUnparseableNotBeforeRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-bad-nb";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-bad-nb",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotBefore=\"not-a-date\"", inResponseTo),
+  });
+  check("Bearer unparseable NotBefore is refused (fail-closed)",
+    _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo }) === "auth-saml/no-valid-confirmation");
+}
+
+async function run() {
+  await testBearerPastNotBeforeAccepted();
+  await testBearerFutureNotBeforeRefused();
+  await testBearerUnparseableNotBeforeRefused();
+}
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/session-destroy-all-store-backed.test.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * b.session.destroyAllForUser must succeed for a store-backed-only consumer
+ * (b.session.useStore) that never called b.db.init() (#340).
+ *
+ * A store-backed-only deployment points session data at an isolated localDbThin
+ * file and registers the _blamejs_sessions sealed/derived-hash schema directly
+ * (so sealRow / lookupHash work) WITHOUT initializing the framework db. Every
+ * revoke-all path — logout-everywhere, suspend, delete, role change — calls
+ * destroyAllForUser, which deletes the store rows and then raises the stateless
+ * valid-from boundary via bump(). The boundary table lives in the framework db,
+ * so an uninitialized db threw db/not-initialized (a regression: worked in
+ * 0.15.11, broke when bump() was added) and 500'd the revoke even though the
+ * store rows were already deleted.
+ *
+ * RED on the pre-fix tree: destroyAllForUser throws (db/not-initialized rewrapped
+ * to MISCONFIGURED). GREEN: it resolves AND the stateless valid-from boundary is
+ * honored (routed through the configured store), so b.session.check revokes a
+ * token issued before the boundary.
+ *
+ * Drives the real consumer path through the public b.session surface — no db.init.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var setupVaultOnly    = helpers.setupVaultOnly;
+var teardownVaultOnly = helpers.teardownVaultOnly;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+
+// Mirror the framework's _blamejs_sessions sealed/derived schema (db.js
+// FRAMEWORK_SCHEMA) so sealRow / lookupHash work without b.db.init().
+function _registerSessionSchema() {
+  b.cryptoField.registerTable("_blamejs_sessions", {
+    sealedFields:  ["userId", "data"],
+    derivedHashes: { userIdHash: { from: "userId" } },
+  });
+}
+
+async function run() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-das-"));
+  var storeFile = path.join(tmpDir, "sessions.db");
+  var store = null;
+  try {
+    // Vault only — NO b.db.init(). This is the store-backed-only deployment.
+    await setupVaultOnly(tmpDir);
+    b.cluster._resetForTest();
+    b.session._resetForTest();
+    b.cryptoField.clearForTest();
+    _registerSessionSchema();
+
+    store = b.session.stores.localDbThin({ file: storeFile, audit: false });
+    b.session.useStore(store);
+
+    var s = b.session;
+    var uid = "user-340";
+
+    // Create a real store-backed session so destroyAllForUser has a row to
+    // delete (drives sealRow + the store INSERT — the shipped consumer path).
+    var created = await s.create({ userId: uid });
+    check("create returns a sealed cookie token", typeof created.token === "string" && created.token.length > 0);
+
+    // A token issued NOW (before any revoke) is valid against the boundary.
+    var iatBefore = Date.now();
+    check("a token issued before any revoke passes session.check",
+      (await s.check(uid, iatBefore)) === true);
+    check("a fresh subject's valid-from boundary is 0", (await s.validFrom(uid)) === 0);
+
+    // The bug: destroyAllForUser deletes the store rows, then bump() routes the
+    // valid-from upsert to the framework db (uninitialized) and throws. With the
+    // fix it falls back to the configured store and resolves.
+    var revoked = null;
+    var threw = null;
+    try {
+      revoked = await s.destroyAllForUser(uid);
+    } catch (e) {
+      threw = e;
+    }
+    check("destroyAllForUser resolves for a store-backed-only consumer (no db.init)",
+      threw === null);
+    if (threw) {
+      check("  (pre-fix would throw db/not-initialized → MISCONFIGURED): " +
+        (threw.code || threw.message), false);
+    }
+    check("destroyAllForUser reports the deleted store-row count",
+      typeof revoked === "number" && revoked >= 1);
+
+    // The stateless valid-from boundary was actually raised (routed through the
+    // store), not silently dropped — a token issued before it is now revoked.
+    var boundary = await s.validFrom(uid);
+    check("the stateless valid-from boundary was raised (honored, not dropped)",
+      typeof boundary === "number" && boundary >= iatBefore);
+    check("a token issued BEFORE the revoke now fails session.check",
+      (await s.check(uid, iatBefore - 1000)) === false);
+    check("a token issued AFTER the boundary still passes session.check",
+      (await s.check(uid, boundary + 5000)) === true);
+
+    // Monotonicity still holds through the store backend.
+    var lower = await s.bump(uid, { epochMs: boundary - 5000 });
+    check("a lower-epoch bump is a monotonic no-op through the store",
+      lower === boundary);
+
+    // With NEITHER a framework db NOR a store, bump still fails closed (the
+    // boundary is never silently dropped — a real misconfiguration propagates).
+    b.session.useStore(null);
+    var threwNoStorage = null;
+    try {
+      await s.bump("user-no-storage");
+    } catch (e) { threwNoStorage = e; }
+    check("bump fails closed when neither a framework db nor a store exists",
+      threwNoStorage !== null);
+  } finally {
+    try { if (store && store.close) store.close(); } catch (_e) { /* best-effort */ }
+    b.session.useStore(null);
+    b.session._resetForTest();
+    b.cryptoField.clearForTest();
+    try { teardownVaultOnly(tmpDir); } catch (_e) { /* best-effort */ }
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+  }
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e && e.stack ? e.stack : e); process.exit(1); });
+}