@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/integration/federation-auth.test.js

@@ -23,6 +23,16 @@
  *   - b.auth.saml.sp.create + buildAuthnRequest (HTTP-Redirect form
  *     against the IdP's SAML endpoint)
  *   - b.auth.saml.sp.metadata XML emit
+ *   - b.auth.oauth.deviceAuthorization + pollDeviceCode (RFC 8628
+ *     device grant — the poll survives the authorization_pending HTTP
+ *     400 rather than aborting on the first poll; provisions a
+ *     device-grant client via the admin API)
+ *   - b.auth.saml.sp.verifyResponse over a Keycloak-ENCRYPTED
+ *     assertion (SAML 2.0 §2.5). Keycloak 26.0.8 emits aes128-cbc +
+ *     rsa-oaep-mgf1p(SHA-1), which the framework refuses by design, so
+ *     the assertion is the fail-closed refusal; the AES-GCM +
+ *     RSA-OAEP-SHA256 positive-decrypt branch takes effect on Keycloak
+ *     >= 26.2 (see the stage comment).
  *
  * Deferred (open-conditions noted):
  *   - CIBA (Keycloak 26 supports it but requires extra realm-import
@@ -30,16 +40,21 @@
  *     `attributes.cibaBackchannelTokenDeliveryMode`).
  *   - OID4VCI / OID4VP (preview-only in Keycloak; re-open when the
  *     `oid4vc-issuer` SPI ships in the base image).
- *   - OpenID Federation 1.0 (no native Keycloak provider; re-open
- *     when an entity-statement publisher ships, OR when we add a
- *     standalone trust-anchor service to the compose stack).
+ *   - OpenID Federation 1.0 has no native Keycloak provider; the
+ *     trust-chain / metadata-policy path is covered in-process by
+ *     test/integration/openid-federation-chain.test.js (three loopback
+ *     entity-statement servers) rather than against Keycloak.
  */
 
 var helpers  = require("../helpers");
 var check    = helpers.check;
 var services = require("../helpers/services");
 var b        = require("../../");
-var nodeCrypto = require("node:crypto");
+var nodeCrypto       = require("node:crypto");
+var nodeChildProcess = require("node:child_process");
+var nodeFs           = require("node:fs");
+var nodeOs           = require("node:os");
+var nodePath         = require("node:path");
 
 var KEYCLOAK_BASE  = "http://127.0.0.1:18080";
 var REALM          = "blamejs-test";
@@ -190,6 +205,196 @@ async function _signLogoutToken(signingKid, sub, sid, jti) {
   return signingInput + "." + sig.toString("base64url");
 }
 
+// ---- Keycloak Admin REST helpers ----
+// The realm is imported once at container start; the device-grant and
+// encrypted-SAML stages need two client shapes the base import doesn't carry
+// (a device-grant client without a forced PKCE challenge, and a SAML SP with
+// assertion encryption on). They're applied idempotently via the admin API so
+// the test is robust against both the already-running container and a fresh
+// `compose up`; the realm JSON carries the same shapes for a cold start.
+var KC_ADMIN_USER    = "admin";
+var KC_ADMIN_PASS    = "blamejs-test-admin";
+var DEVICE_CLIENT_ID = "blamejs-device-oidc";
+var DEVICE_SECRET    = "blamejs-test-device-secret";
+var SP_ENC_ENTITY_ID = "https://sp-enc.blamejs-test.example";
+
+async function _adminToken() {
+  var body = new URLSearchParams();
+  body.set("grant_type", "password");
+  body.set("client_id",  "admin-cli");
+  body.set("username",   KC_ADMIN_USER);
+  body.set("password",   KC_ADMIN_PASS);
+  var res = await b.httpClient.request({
+    method:           "POST",
+    url:              KEYCLOAK_BASE + "/realms/master/protocol/openid-connect/token",
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+    headers:          { "Content-Type": "application/x-www-form-urlencoded" },
+    body:             body.toString(),
+  });
+  if (res.statusCode !== 200) {
+    throw new Error("admin token grant failed: " + res.statusCode + " " + (res.body && res.body.toString().slice(0, 200)));
+  }
+  return JSON.parse(res.body.toString("utf8")).access_token;
+}
+
+async function _kcAdmin(method, subPath, tok, jsonBody) {
+  var req = {
+    method:           method,
+    url:              KEYCLOAK_BASE + "/admin/realms/" + REALM + subPath,
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+    responseMode:     "always-resolve",
+    headers:          { Authorization: "Bearer " + tok },
+  };
+  if (jsonBody !== undefined) {
+    req.headers["Content-Type"] = "application/json";
+    req.body = JSON.stringify(jsonBody);
+  }
+  var res = await b.httpClient.request(req);
+  var json = null;
+  if (res.body && res.body.length) {
+    try { json = JSON.parse(res.body.toString("utf8")); } catch (_e) { json = null; }
+  }
+  return { statusCode: res.statusCode, json: json };
+}
+
+// Create-or-update a confidential OIDC client with the device grant enabled and
+// no forced PKCE challenge (b.auth.oauth.deviceAuthorization sends no
+// code_challenge, and the base blamejs-rp-oidc client forces S256).
+async function _ensureDeviceClient(tok) {
+  var rep = {
+    clientId:                  DEVICE_CLIENT_ID,
+    name:                      "blamejs OIDC device-grant (integration test)",
+    enabled:                   true,
+    protocol:                  "openid-connect",
+    publicClient:              false,
+    secret:                    DEVICE_SECRET,
+    standardFlowEnabled:       false,
+    directAccessGrantsEnabled: false,
+    serviceAccountsEnabled:    false,
+    attributes: {
+      "oauth2.device.authorization.grant.enabled": "true",
+      "pkce.code.challenge.method":                "",
+    },
+  };
+  var listed = await _kcAdmin("GET", "/clients?clientId=" + encodeURIComponent(DEVICE_CLIENT_ID), tok);
+  if (Array.isArray(listed.json) && listed.json.length > 0) {
+    var existing = listed.json[0];
+    var merged = Object.assign({}, existing, rep, {
+      id:         existing.id,
+      attributes: Object.assign({}, existing.attributes, rep.attributes),
+    });
+    await _kcAdmin("PUT", "/clients/" + existing.id, tok, merged);
+  } else {
+    await _kcAdmin("POST", "/clients", tok, rep);
+  }
+}
+
+// Generate an ephemeral SP RSA keypair + self-signed cert at runtime so no
+// private key is committed. Keycloak encrypts the assertion CEK to the cert's
+// RSA public key; the SP decrypts with the private key. Uses openssl (dev
+// tooling — the integration runner already shells to docker); returns null when
+// openssl is unavailable so the stage skips cleanly.
+function _generateSpEncryptionKeypair() {
+  var dir      = nodeFs.mkdtempSync(nodePath.join(nodeOs.tmpdir(), "blamejs-saml-sp-enc-"));
+  var keyPath  = nodePath.join(dir, "sp-key.pem");
+  var certPath = nodePath.join(dir, "sp-cert.pem");
+  try {
+    var r = nodeChildProcess.spawnSync("openssl", [
+      "req", "-x509", "-newkey", "rsa:2048", "-keyout", keyPath, "-out", certPath,
+      "-days", "3650", "-nodes", "-subj", "/CN=sp-enc.blamejs-test.example", "-sha256",
+    ], { stdio: "ignore" });
+    if (!r || r.status !== 0 || !nodeFs.existsSync(certPath) || !nodeFs.existsSync(keyPath)) return null;
+    var keyPem     = nodeFs.readFileSync(keyPath, "utf8");
+    var certPem    = nodeFs.readFileSync(certPath, "utf8");
+    var certDerB64 = new nodeCrypto.X509Certificate(certPem).raw.toString("base64");
+    return { keyPem: keyPem, certDerB64: certDerB64 };
+  } catch (_e) {
+    return null;
+  } finally {
+    try { nodeFs.rmSync(dir, { recursive: true, force: true }); } catch (_e2) {}
+  }
+}
+
+// Create-or-update a SAML SP client with assertion encryption enabled, keyed to
+// the supplied SP certificate. The algorithm attributes request AES-GCM +
+// RSA-OAEP-SHA256 (what the framework decrypts); Keycloak < 26.2 ignores them
+// and emits its aes128-cbc + rsa-oaep-mgf1p(SHA-1) defaults, which the framework
+// refuses by design.
+async function _ensureSamlEncClient(tok, certDerB64) {
+  var attrs = {
+    "saml.assertion.signature":               "true",
+    "saml.server.signature":                  "false",
+    "saml.signature.algorithm":               "RSA_SHA256",
+    "saml.client.signature":                  "false",
+    "saml.encrypt":                           "true",
+    "saml.encryption.certificate":            certDerB64,
+    "saml.encryption.algorithm":              "AES_256_GCM",
+    "saml.encryption.keyAlgorithm":           "RSA-OAEP",
+    "saml.encryption.digestMethod":           "SHA-256",
+    "saml.encryption.maskGenerationFunction": "MGF1-SHA256",
+    "saml.force.post.binding":                "true",
+    "saml_assertion_consumer_url_post":       SP_ACS_URL,
+    "saml_name_id_format":                    "username",
+    "saml.authnstatement":                    "true",
+  };
+  var rep = {
+    clientId:            SP_ENC_ENTITY_ID,
+    name:                "blamejs SAML SP encrypted (integration test)",
+    enabled:             true,
+    protocol:            "saml",
+    publicClient:        true,
+    redirectUris:        [SP_ACS_URL],
+    frontchannelLogout:  false,
+    attributes:          attrs,
+    defaultClientScopes: ["role_list"],
+  };
+  var listed = await _kcAdmin("GET", "/clients?clientId=" + encodeURIComponent(SP_ENC_ENTITY_ID), tok);
+  if (Array.isArray(listed.json) && listed.json.length > 0) {
+    var existing = listed.json[0];
+    var merged = Object.assign({}, existing, rep, {
+      id:         existing.id,
+      attributes: Object.assign({}, existing.attributes, attrs),
+    });
+    await _kcAdmin("PUT", "/clients/" + existing.id, tok, merged);
+  } else {
+    await _kcAdmin("POST", "/clients", tok, rep);
+  }
+}
+
+// Drive Keycloak's login form for a SAML AuthnRequest redirect URL and return
+// the base64 SAMLResponse from the auto-submit form (or null). Mirrors the
+// cookie-jar + form-post steps of the plaintext SAML round-trip so the
+// encrypted stage reuses the same login mechanics.
+async function _driveSamlLoginCapture(authnRedirectUrl) {
+  var jar = _newCookieJar();
+  var loginPage = await _httpReq("GET", authnRedirectUrl, jar);
+  if (loginPage.statusCode !== 200) return null;
+  var actionMatch = /action="(http:\/\/[^"]+\/login-actions\/authenticate[^"]+)"/.exec(loginPage.body.toString("utf8"));
+  if (!actionMatch) return null;
+  var loginBody = new URLSearchParams();
+  loginBody.set("username",     TEST_USERNAME);
+  loginBody.set("password",     TEST_PASSWORD);
+  loginBody.set("credentialId", "");
+  var loginPost = await _httpReq("POST", actionMatch[1].replace(/&amp;/g, "&"), jar, {
+    headers:  { "Content-Type": "application/x-www-form-urlencoded" },
+    body:     loginBody.toString(),
+    redirect: false,
+  });
+  var responseHtml;
+  if (loginPost.statusCode === 200) {
+    responseHtml = loginPost.body.toString("utf8");
+  } else if (loginPost.statusCode === 302 || loginPost.statusCode === 303) {
+    var follow = await _httpReq("GET", loginPost.headers.location || loginPost.headers.Location, jar);
+    responseHtml = follow.body.toString("utf8");
+  } else {
+    return null;
+  }
+  var m = /name="SAMLResponse"\s+value="([^"]+)"/.exec(responseHtml);
+  return m ? m[1] : null;
+}
+
 async function run() {
   // ---- service readiness ----
   var keycloak = await services.requireService("keycloak");
@@ -600,10 +805,113 @@ async function run() {
     check("DCR: deferred (AS doesn't advertise registration_endpoint)", true);
   }
 
+  // ---- OAuth Device Authorization Grant (RFC 8628) — the poll survives an
+  //      authorization_pending HTTP 400 ----
+  // RFC 8628 §3.5 / RFC 6749 §5.2 deliver `authorization_pending` as an HTTP
+  // 400 whose body carries the OAuth `error`. Before v0.16.5 the token poll ran
+  // in the http client's buffering mode, which rejected the 400 before the
+  // pending handler read the body, so the grant aborted on the FIRST poll
+  // (almost always authorization_pending, since the user hasn't approved yet).
+  // Drive the grant against Keycloak's real device endpoint and assert the poll
+  // keeps going across the pending 400s to a deterministic device-poll-timeout —
+  // not the HTTP_ERROR abort the buffered path threw.
+  var adminTok = await _adminToken();
+  await _ensureDeviceClient(adminTok);
+  var deviceOauth = b.auth.oauth.create({
+    issuer:        ISSUER,
+    clientId:      DEVICE_CLIENT_ID,
+    clientSecret:  DEVICE_SECRET,
+    redirectUri:   REDIRECT_URI,
+    isOidc:        true,
+    allowHttp:     true,
+    allowInternal: true,
+  });
+  var devAuth = await deviceOauth.deviceAuthorization();
+  check("deviceAuthorization: device_code + user_code + verification_uri returned",
+    typeof devAuth.device_code === "string" && typeof devAuth.user_code === "string" &&
+    typeof devAuth.verification_uri === "string");
+  // The user never approves, so every poll returns authorization_pending (400).
+  // maxWaitMs spans at least two 5s poll intervals — reaching device-poll-timeout
+  // proves the loop survived the pending 400s rather than aborting on the first
+  // (which is what a reverted buffer-mode poll would do, throwing HTTP_ERROR).
+  var devThrew = null;
+  try {
+    await deviceOauth.pollDeviceCode(devAuth.device_code, { interval: devAuth.interval, maxWaitMs: 6000 });
+  } catch (e) { devThrew = e; }
+  check("pollDeviceCode: survives authorization_pending 400 and reaches device-poll-timeout",
+    !!devThrew && devThrew.code === "auth-oauth/device-poll-timeout");
+
+  // ---- SAML EncryptedAssertion decrypt interop (SAML 2.0 §2.5) ----
+  // Enable assertion encryption on a dedicated SP client, drive the login, and
+  // hand the Keycloak-encrypted SAMLResponse to verifyResponse with the SP
+  // private key. Keycloak 26.0.8 emits aes128-cbc content + rsa-oaep-mgf1p
+  // (SHA-1) key transport — both refused by the framework by design (XMLEnc CBC
+  // padding-oracle; SHA-1 OAEP), so against that output the assertion is that
+  // the framework fails CLOSED (no auth bypass). On a Keycloak that emits
+  // AES-GCM + RSA-OAEP-SHA256 (26.2+, where the encryption algorithm attributes
+  // take effect), the GCM branch asserts nameId/issuer/audience decrypt. The SP
+  // keypair is generated at runtime so no private key is committed.
+  var spEnc = _generateSpEncryptionKeypair();
+  if (!spEnc) {
+    check("SAML EncryptedAssertion: skipped — openssl unavailable for runtime SP cert (see file header)", true);
+  } else {
+    await _ensureSamlEncClient(adminTok, spEnc.certDerB64);
+    var spEncHandle = b.auth.saml.sp.create({
+      entityId:                    SP_ENC_ENTITY_ID,
+      assertionConsumerServiceUrl: SP_ACS_URL,
+      idpEntityId:                 ISSUER,
+      idpSsoUrl:                   IDP_SSO_URL,
+      idpCertPem:                  idpSigningCertPem,
+    });
+    var arEnc = spEncHandle.buildAuthnRequest();
+    var encRespB64 = await _driveSamlLoginCapture(arEnc.redirectUrl);
+    check("SAML EncryptedAssertion: login round-trip captured a SAMLResponse",
+      typeof encRespB64 === "string" && encRespB64.length > 0);
+    if (encRespB64) {
+      var encXml = Buffer.from(encRespB64, "base64").toString("utf8");
+      check("SAML EncryptedAssertion: Keycloak returned an <EncryptedAssertion>",
+        encXml.indexOf("EncryptedAssertion") !== -1);
+      var contentAlgMatch = /EncryptedData\b[\s\S]*?EncryptionMethod Algorithm="([^"]+)"/.exec(encXml);
+      var keyAlgMatch     = /EncryptedKey\b[\s\S]*?EncryptionMethod Algorithm="([^"]+)"/.exec(encXml);
+      var contentAlg = contentAlgMatch ? contentAlgMatch[1] : "";
+      var keyAlg     = keyAlgMatch ? keyAlgMatch[1] : "";
+      var gcmContent = /aes(?:128|192|256)-gcm/.test(contentAlg);
+      var sha256Oaep = /xmlenc(?:11)?#sha(?:256|384|512)/.test(encXml);
+      if (gcmContent && sha256Oaep) {
+        // Keycloak >= 26.2 path: the framework decrypts the assertion.
+        var encInfo = spEncHandle.verifyResponse(encRespB64, {
+          spPrivateKeyPem:      spEnc.keyPem,
+          expectedInResponseTo: arEnc.id,
+        });
+        check("SAML EncryptedAssertion: decrypted nameId is alice",
+          encInfo && (encInfo.nameId === TEST_USERNAME || encInfo.nameId === "alice@example.com"));
+        check("SAML EncryptedAssertion: decrypted issuer matches IdP entityID",
+          encInfo && encInfo.issuer === ISSUER);
+        check("SAML EncryptedAssertion: decrypted audience matches SP entityID",
+          encInfo && encInfo.audience === SP_ENC_ENTITY_ID);
+      } else {
+        // Keycloak 26.0.8 path: aes128-cbc + rsa-oaep-mgf1p(SHA-1). The framework
+        // refuses both by design; assert the fail-closed refusal against the real
+        // IdP output. Positive decrypt is pending a Keycloak >= 26.2 image.
+        var encThrew = null;
+        try {
+          spEncHandle.verifyResponse(encRespB64, {
+            spPrivateKeyPem:      spEnc.keyPem,
+            expectedInResponseTo: arEnc.id,
+          });
+        } catch (e) { encThrew = e; }
+        check("SAML EncryptedAssertion: framework fails closed on Keycloak 26.0.8 weak-crypto envelope (" +
+              contentAlg + " / " + keyAlg + ")",
+          !!encThrew &&
+          /^auth-saml\/encrypted-(weak-oaep-digest|unsupported-content-alg|unsupported-key-alg)$/.test(encThrew.code || ""));
+      }
+    }
+  }
+
   // ---- Federation primitives — deferred, document the open conditions ----
   check("OID4VCI: deferred (Keycloak oid4vc-issuer SPI is preview-only)",                 true);
   check("OID4VP: deferred (no wallet harness in the test stack)",                         true);
-  check("OpenID Federation: deferred (no entity-statement publisher in the test stack)",  true);
+  check("OpenID Federation: covered by openid-federation-chain.test.js (loopback trust-chain, no Keycloak provider)", true);
   check("OIDC Native SSO: deferred (Keycloak's device_secret support is preview-only)",   true);
 }
 

package/lib/vendor/blamejs/test/integration/mail-dkim.test.js

@@ -11,6 +11,12 @@
  * Covers both signature algorithms the framework supports: rsa-sha256
  * (RFC 6376) and ed25519-sha256 (RFC 8463). PQC DKIM is forward-looking
  * — the framework's dkim docstring carries that intent already.
+ *
+ * The simple/simple canonicalization stage goes further than header
+ * presence: it fetches the RAW captured source back out of mailpit and
+ * cryptographically verifies the signature over the bytes that actually
+ * traversed the SMTP wire — simple canonicalization tolerates zero byte
+ * drift, so any framing change between sign and capture fails it.
  */
 var fs = require("node:fs");
 var http = require("node:http");
@@ -109,6 +115,77 @@ async function _runWithAlgorithm(algorithm, privateKey, label) {
         /b=[A-Za-z0-9+/=\s]+/.test(raw));
 }
 
+// Sign with simple/simple canonicalization, deliver through the live SMTP
+// transport, then VERIFY the signature on the raw bytes mailpit captured.
+// Simple canonicalization signs the headers and body verbatim (RFC 6376
+// sections 3.4.1 and 3.4.3), so this only passes when the exact signed
+// bytes survive smtpTransport framing, the SMTP hop, and mailpit capture.
+async function _runSimpleCanonWireVerify() {
+  await _httpDelete("http://127.0.0.1:8025/api/v1/messages");
+
+  var caPem = fs.readFileSync(process.env.BLAMEJS_TEST_CA_PATH, "utf8");
+  var kp = crypto.generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding:  { type: "spki",  format: "pem" },
+  });
+  var signer = b.mail.dkim.create({
+    domain:           "example.com",
+    selector:         "test",
+    privateKey:       kp.privateKey,
+    canonicalization: "simple/simple",
+    headersToSign:    ["From", "To", "Subject", "Date"],
+  });
+  var transport = b.mail.transports.smtp({
+    host:       "localhost",
+    port:       1025,
+    ehloName:   "blamejs-test",
+    timeoutMs:  5000,
+    ca:         caPem,
+    dkimSigner: signer,
+  });
+
+  await transport.send({
+    from:    "test@example.com",
+    to:      ["dkim-simple@blamejs.local"],
+    subject: "dkim-simple-simple-" + Date.now(),
+    text:    "Simple-canon wire-interop body line one.\r\nLine two.",
+  });
+
+  var listing = await _httpJson("http://127.0.0.1:8025/api/v1/messages");
+  check("[simple/simple] mailpit captured the dkim-signed message",
+        listing.messages.length === 1);
+  var captured = listing.messages[0];
+  var raw = await new Promise(function (resolve, reject) {
+    http.get("http://127.0.0.1:8025/api/v1/message/" + captured.ID + "/raw", function (res) {
+      var chunks = [];
+      res.on("data", function (c) { chunks.push(c); });
+      res.on("end", function () { resolve(Buffer.concat(chunks).toString("utf8")); });
+    }).once("error", reject);
+  });
+  check("[simple/simple] captured signature declares c=simple/simple",
+        /c=simple\/simple/.test(raw));
+
+  var pubB64 = kp.publicKey.replace(/-----[A-Z ]+-----/g, "").replace(/\s+/g, "");
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + pubB64]]; };
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var rv = await b.mail.dkim.verify(raw, { dnsLookup: dnsLookup });
+  check("[simple/simple] wire-captured message verifies: result pass",
+        Array.isArray(rv) && rv.length === 1 && rv[0].result === "pass");
+  check("[simple/simple] wire verify reports zero errors",
+        rv[0] && Array.isArray(rv[0].errors) && rv[0].errors.length === 0);
+
+  // Control: the pass above is cryptographic, not vacuous — one flipped
+  // body byte in the captured source must flip the verdict to fail.
+  var tampered = raw.replace("wire-interop body line one", "wire-interop body line 0ne");
+  check("[simple/simple] tamper control mutated the captured body",
+        tampered !== raw);
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var rvTampered = await b.mail.dkim.verify(tampered, { dnsLookup: dnsLookup });
+  check("[simple/simple] tampered wire body fails verification",
+        rvTampered[0] && rvTampered[0].result === "fail");
+}
+
 async function run() {
   var svc = await services.requireService("mailpit");
   if (!svc.ok) throw new Error("mailpit unreachable: " + svc.reason);
@@ -128,6 +205,9 @@ async function run() {
   });
   await _runWithAlgorithm("ed25519-sha256", ed.privateKey, "ed25519");
 
+  // ---- simple/simple canonicalization verified on the wire bytes ----
+  await _runSimpleCanonWireVerify();
+
   // ---- bad algorithm rejected at signer build time ----
   var threw = null;
   try {