@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/session-device-binding.test.js

@@ -12,6 +12,11 @@
 var helpers = require("../helpers");
 var b      = helpers.b;
 var check  = helpers.check;
+var setupTestDb    = helpers.setupTestDb;
+var teardownTestDb = helpers.teardownTestDb;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
 
 function _captureAudit() {
   var captured = [];
@@ -250,6 +255,195 @@ function testNamespaceFingerprint() {
   check("namespace fingerprint: diverges when a bound component changes", !fp1.equals(fp3));
 }
 
+// ---------------------------------------------------------------------------
+// b.session device-binding (lib/session.js) — the persisted, sid-keyed
+// fingerprint binding on b.session.create / verify / rotate. Distinct from the
+// stateless b.sessionDeviceBinding helper above; these drive the real
+// b.session.<method>() consumer path against a live test DB.
+// ---------------------------------------------------------------------------
+
+// A request whose client-IP + UA drive the b.session fingerprint. The bare
+// socket peer (no trustedProxies) is what b.session hashes by default, so a
+// different remoteAddress / user-agent is a genuine device drift.
+function _dev(remoteAddress, ua) {
+  return {
+    headers: { "user-agent": ua || "deviceA", "accept-language": "en-US,en;q=0.9" },
+    socket:  { remoteAddress: remoteAddress || "203.0.113.10" },
+  };
+}
+
+// The strict "maxAnomalyScore" binding policy must FAIL CLOSED when a real
+// drift occurs but no decisive anomaly score can be produced (operator set the
+// threshold but supplied no scorer, or the scorer can't return a number). The
+// pre-fix path left fingerprintAnomalyScore = null and skipped the refusal, so
+// a session bound to device A was accepted from device B under a declared
+// strict threshold — the exact "binding check that fails open accepts a
+// relocated session" this suite guards. Mirrors the existing bindingUnreadable
+// fail-closed rule, extended to the uncomputable-score branch.
+async function testSessionMaxAnomalyScoreFailsClosedWithoutScore() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-maxscore-"));
+  try {
+    await setupTestDb(tmpDir);
+    var devA = _dev("203.0.113.10", "deviceA");
+    var s = await b.session.create({ userId: "u-score", req: devA });
+
+    // Bound device under the same strict policy still verifies (no drift).
+    var same = await b.session.verify(s.token, { req: devA, maxAnomalyScore: 0.5 });
+    check("maxAnomalyScore: bound device still verifies", same && same.userId === "u-score");
+
+    // Drift from a different device under maxAnomalyScore with NO scorer: the
+    // score is uncomputable, so a strict threshold must refuse (null).
+    var devB = _dev("198.51.100.9", "deviceB");
+    var verdict = await b.session.verify(s.token, { req: devB, maxAnomalyScore: 0.5 });
+    check("maxAnomalyScore + drift + no scorer -> FAILS CLOSED (null)", verdict === null);
+
+    // Same root: a scorer that returns a non-number yields no score either.
+    var badScorer = await b.session.verify(s.token, {
+      req: devB, maxAnomalyScore: 0.5, scorer: function () { return "not-a-number"; },
+    });
+    check("maxAnomalyScore + drift + non-numeric scorer -> FAILS CLOSED (null)", badScorer === null);
+
+    // A scorer that THROWS is swallowed (best-effort) -> score null -> refuse.
+    var threwScorer = await b.session.verify(s.token, {
+      req: devB, maxAnomalyScore: 0.5, scorer: function () { throw new Error("boom"); },
+    });
+    check("maxAnomalyScore + drift + throwing scorer -> FAILS CLOSED (null)", threwScorer === null);
+
+    // A scorer that returns a non-finite number (Infinity/NaN) yields no score.
+    var infScorer = await b.session.verify(s.token, {
+      req: devB, maxAnomalyScore: 0.5, scorer: function () { return Infinity; },
+    });
+    check("maxAnomalyScore + drift + non-finite scorer -> FAILS CLOSED (null)", infScorer === null);
+
+    // The refusals above must NOT have destroyed the row (fingerprint refusal is
+    // not row cleanup) — the bound device still verifies.
+    var still = await b.session.verify(s.token, { req: devA, maxAnomalyScore: 0.5 });
+    check("maxAnomalyScore: strict refusal left the session row intact", still && still.userId === "u-score");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// The scorer path itself: a computed score below the threshold admits the
+// (drifted) session, above the threshold refuses it, and out-of-range scores
+// clamp to [0,1]. Locks the legitimate maxAnomalyScore behavior so the
+// fail-closed fix above doesn't over-refuse the benign-drift case.
+async function testSessionMaxAnomalyScoreScorerBands() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-scorer-"));
+  try {
+    await setupTestDb(tmpDir);
+    var devA = _dev("203.0.113.10", "deviceA");
+    var s = await b.session.create({ userId: "u-sc", req: devA });
+    var devB = _dev("198.51.100.9", "deviceB");
+
+    // Benign drift (score below threshold) -> accepted, drift + score surfaced.
+    var benign = await b.session.verify(s.token, {
+      req: devB, maxAnomalyScore: 0.8, scorer: function () { return 0.2; },
+    });
+    check("maxAnomalyScore: score below threshold -> accepted with drift",
+      benign && benign.fingerprintDrift === true && benign.fingerprintAnomalyScore === 0.2);
+
+    // Malicious drift (score above threshold) -> refused.
+    var refused = await b.session.verify(s.token, {
+      req: devB, maxAnomalyScore: 0.5, scorer: function () { return 0.9; },
+    });
+    check("maxAnomalyScore: score above threshold -> refused (null)", refused === null);
+
+    // Out-of-range score clamps to 1 -> above 0.99 -> refused.
+    var clamp = await b.session.verify(s.token, {
+      req: devB, maxAnomalyScore: 0.99, scorer: function () { return 5; },
+    });
+    check("maxAnomalyScore: score clamps to 1 -> above threshold -> refused (null)", clamp === null);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// requireFingerprintMatch: any drift on a readable binding refuses the session
+// (returns null) without destroying the row; default mode surfaces drift but
+// returns the session. Covers the strict-refuse and default-drift branches of
+// verify() that the unreadable-binding test does not exercise.
+async function testSessionRequireFingerprintMatchDrift() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-reqfp-"));
+  try {
+    await setupTestDb(tmpDir);
+    var devA = _dev("203.0.113.10", "deviceA");
+    var s = await b.session.create({ userId: "u-strict2", req: devA });
+
+    var ok = await b.session.verify(s.token, { req: devA, requireFingerprintMatch: true });
+    check("requireFingerprintMatch: same device verifies", ok && ok.userId === "u-strict2");
+
+    var devB = _dev("198.51.100.9", "deviceB");
+    var refused = await b.session.verify(s.token, { req: devB, requireFingerprintMatch: true });
+    check("requireFingerprintMatch: drift refuses (null)", refused === null);
+
+    var stillOk = await b.session.verify(s.token, { req: devA, requireFingerprintMatch: true });
+    check("requireFingerprintMatch: refusal did not destroy the row", stillOk && stillOk.userId === "u-strict2");
+
+    // Default mode (no strict opt) surfaces the drift but still returns it.
+    var lax = await b.session.verify(s.token, { req: devB });
+    check("default mode: drift surfaced, session returned", lax && lax.fingerprintDrift === true);
+    check("default mode: fingerprintAnomalyScore is null without a scorer", lax.fingerprintAnomalyScore === null);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// rotate() on a fingerprint-bound session without { req } throws (the sid-keyed
+// binding cannot follow the new sid otherwise) and leaves the old session
+// intact; an unbound session rotates without req. Covers the
+// ROTATE_FINGERPRINT_REQ_REQUIRED guard.
+async function testSessionRotateRequiresReqOnBound() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-rotreq-"));
+  try {
+    await setupTestDb(tmpDir);
+    var devA = _dev("203.0.113.10", "deviceA");
+    var s = await b.session.create({ userId: "u-rotreq", req: devA });
+
+    var err = null;
+    try { await b.session.rotate(s.token); } catch (e) { err = e; }
+    check("rotate on a bound session without req throws",
+      err && err.code === "ROTATE_FINGERPRINT_REQ_REQUIRED");
+
+    // The throw happened before the UPDATE — the bound session is untouched.
+    var still = await b.session.verify(s.token, { req: devA, requireFingerprintMatch: true });
+    check("rotate throw left the bound session intact", still && still.userId === "u-rotreq");
+
+    // An unbound session rotates fine without req.
+    var s2 = await b.session.create({ userId: "u-unbound" });
+    var r2 = await b.session.rotate(s2.token);
+    check("rotate on an unbound session without req succeeds", r2 && typeof r2.token === "string");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// Anonymous session minting + isAnonymous + destroyAllForUser's anon refusal.
+async function testSessionAnonymousLifecycle() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-anon-"));
+  try {
+    await setupTestDb(tmpDir);
+    var s = await b.session.create({ anonymous: true });
+    check("anonymous create returns a token", s && typeof s.token === "string");
+
+    var info = await b.session.verify(s.token);
+    check("anonymous session verifies", info && typeof info.userId === "string");
+    check("anonymous userId carries the anon: prefix", info.userId.indexOf(b.session.ANON_PREFIX) === 0);
+    check("b.session.isAnonymous true for an anon userId", b.session.isAnonymous(info.userId) === true);
+    check("b.session.isAnonymous false for a normal userId", b.session.isAnonymous("user-42") === false);
+
+    var both = null;
+    try { await b.session.create({ anonymous: true, userId: "u-x" }); } catch (e) { both = e; }
+    check("create rejects anonymous:true + userId together", both && both.code === "INVALID_ARG");
+
+    var refuseAnon = null;
+    try { await b.session.destroyAllForUser(info.userId); } catch (e) { refuseAnon = e; }
+    check("destroyAllForUser refuses an anon-prefix id", refuseAnon && refuseAnon.code === "INVALID_ARG");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function run() {
   testSurface();
   testNamespaceFingerprint();
@@ -262,6 +456,12 @@ async function run() {
   await testBindRefusesWithoutBoundKey();
   await testFingerprintIsStable();
   await testUnbind();
+  // b.session (lib/session.js) persisted device-binding paths.
+  await testSessionMaxAnomalyScoreFailsClosedWithoutScore();
+  await testSessionMaxAnomalyScoreScorerBands();
+  await testSessionRequireFingerprintMatchDrift();
+  await testSessionRotateRequiresReqOnBound();
+  await testSessionAnonymousLifecycle();
 }
 
 if (require.main === module) {

package/lib/vendor/blamejs/test/layer-0-primitives/session-strict-binding-missing-failclosed.test.js

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.session.verify must FAIL CLOSED under a strict device-fingerprint policy
+ * (requireFingerprintMatch / maxAnomalyScore) when the session carries NO stored
+ * binding at all — i.e. it was created WITHOUT { req } (the framework's own
+ * primary create() example does exactly this), so no __bj_fingerprint was ever
+ * sealed into its data.
+ *
+ * This is the sibling of the "binding unreadable" fail-closed case: there the
+ * sealed data cell existed but would not decrypt; here there is simply no
+ * binding. Both mean the same thing to a strict verify — the device match
+ * cannot be proven — so both must refuse, not silently skip the gate. The
+ * pre-fix behaviour treated "there is no binding to compare" as "the binding
+ * matches", admitting an unbound session from ANY device even though the
+ * operator asked for strict fingerprint matching (directly, or through the
+ * attachUser middleware that threads the flag into every verify).
+ */
+
+var helpers = require("../helpers");
+var b = helpers.b;
+var check = helpers.check;
+var setupTestDb = helpers.setupTestDb;
+var teardownTestDb = helpers.teardownTestDb;
+var fs = require("fs");
+var os = require("os");
+var path = require("path");
+
+var attachUser = b.middleware._modules.attachUser;
+
+function _makeReq(headers) {
+  return { headers: headers || {}, socket: {}, connection: {} };
+}
+
+// Drive the attachUser middleware to completion (it always calls next()).
+async function _drive(mw, req) {
+  var called = false;
+  mw(req, {}, function () { called = true; });
+  await helpers.waitUntil(function () { return called; }, {
+    timeoutMs: 5000,
+    label:     "session-strict-binding-missing: middleware called next()",
+  });
+}
+
+async function run() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-strict-missing-"));
+  try {
+    await setupTestDb(tmpDir);
+
+    // Session created WITHOUT { req } — no device-fingerprint binding is sealed.
+    // (This is exactly the shape of the create() docstring's primary example.)
+    var s = await b.session.create({ userId: "u-unbound", data: { role: "admin" } });
+
+    var devB = _makeReq({ "x-forwarded-for": "198.51.100.1", "user-agent": "attacker-device" });
+
+    // --- requireFingerprintMatch on an UNBOUND session must FAIL CLOSED.
+    var strict = await b.session.verify(s.token, { req: devB, requireFingerprintMatch: true });
+    check("requireFingerprintMatch on an unbound session FAILS CLOSED (null)",
+          strict === null);
+
+    // --- maxAnomalyScore on an UNBOUND session must FAIL CLOSED too.
+    var scored = await b.session.verify(s.token, { req: devB, maxAnomalyScore: 0.1 });
+    check("maxAnomalyScore on an unbound session FAILS CLOSED (null)",
+          scored === null);
+
+    // --- The strict refusal must NOT destroy the row: a legitimate non-strict
+    //     verify still returns the session (fail-closed, not fail-deleted).
+    var loose = await b.session.verify(s.token, { req: devB });
+    check("advisory verify (req, no strict opt) still returns the unbound session",
+          loose && loose.userId === "u-unbound" && loose.fingerprintDrift === false);
+
+    // --- Plain verify (no req) is unchanged — unbound sessions remain usable
+    //     when the operator does not assert a strict binding policy.
+    var plain = await b.session.verify(s.token);
+    check("plain verify (no req) still returns the unbound session",
+          plain && plain.userId === "u-unbound");
+
+    // --- Regression guard: a BOUND session under the strict policy from its
+    //     own device still verifies (the fix only closes the no-binding hole).
+    var devA = _makeReq({ "x-forwarded-for": "203.0.113.10", "user-agent": "deviceA" });
+    var bound = await b.session.create({ userId: "u-bound", req: devA });
+    var boundOk = await b.session.verify(bound.token, { req: devA, requireFingerprintMatch: true });
+    check("bound session under strict policy from its own device still verifies",
+          boundOk && boundOk.userId === "u-bound");
+
+    // --- The real consumer path: attachUser({ requireFingerprintMatch: true })
+    //     threads the strict flag into every verify. An unbound session token
+    //     must NOT attach a user from a foreign device.
+    var mw = attachUser.create({
+      userLoader:              async function (sess) { return { id: sess.userId }; },
+      tokenFrom:               "header",
+      requireFingerprintMatch: true,
+      audit:                   false,
+    });
+    var mwReq = _makeReq({ authorization: "Bearer " + s.token });
+    await _drive(mw, mwReq);
+    check("attachUser(requireFingerprintMatch) does NOT attach an unbound session",
+          mwReq.user === null && mwReq.session === null);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); });
+}