@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/auth-jwt-defenses.test.js

@@ -75,6 +75,29 @@ function _ecPair(curve) {
   });
 }
 
+// -------- Core b.auth.jwt (PQC framework signer) helpers --------
+// ML-DSA-87 keygen is available on the Node 24 CI floor; SLH-DSA keygen is
+// Node-26+ (see auth-status-list.test.js), so the core round-trips below sign
+// with ML-DSA-87 and only NAME SLH-DSA-SHAKE-256f in headers/allowlists.
+function _mlPair() { return nodeCrypto.generateKeyPairSync("ml-dsa-87"); }
+
+function _b64urlJson(obj) {
+  return Buffer.from(JSON.stringify(obj)).toString("base64url");
+}
+
+// _rawJws — build a compact JWS with a caller-chosen header, so a test can
+// forge the header.alg/key divergence that the shipped sign() now refuses to
+// emit. Signs with null digest (KeyObject drives the real algorithm), exactly
+// as lib/auth/jwt.js does.
+function _rawJws(privateKey, header, payload) {
+  var input = _b64urlJson(header) + "." + _b64urlJson(payload);
+  var sig = nodeCrypto.sign(null, Buffer.from(input, "ascii"), privateKey);
+  return input + "." + Buffer.from(sig).toString("base64url");
+}
+
+var _NOW_MS  = 1700000000000;                                                    // allow:raw-byte-literal — fixed test clock (epoch ms)
+var _NOW_SEC = 1700000000;                                                       // allow:raw-byte-literal — same instant, seconds
+
 // -------- CVE-2026-22817 — alg/kty cross-check (jwt-external) --------
 
 async function testAlgKtyMismatchRsaWithEs256() {
@@ -405,7 +428,420 @@ async function testOauthCreateNonFiniteSkewRejected() {
   }
 }
 
+// ========================================================================
+// Core b.auth.jwt (PQC framework signer) — verify/sign/decode defenses
+// ========================================================================
+
+// PRIMARY RED — algorithm-confusion / allowlist bypass (CWE-347).
+//
+// node:crypto.verify(null, ...) drives the algorithm from the KeyObject, NOT
+// the JWS header.alg. verify() gates its algorithm allowlist on that header
+// label. So a token signed by an ML-DSA-87 key but declaring
+// alg="SLH-DSA-SHAKE-256f" passes an SLH-ONLY allowlist and is verified with
+// the ML-DSA key — a full algorithm-allowlist bypass. Exactly the shape an
+// operator uses the allowlist to prevent (pin the high-assurance algorithm).
+//
+// RED on the buggy tree: verify RESOLVES with the attacker's claims.
+// GREEN after binding header.alg to the key: auth-jwt/alg-key-mismatch.
+async function testAlgConfusionAllowlistBypass() {
+  var ml = _mlPair();
+  // Forge: header says SLH-DSA-SHAKE-256f, signature is a real ML-DSA-87 sig.
+  var confused = _rawJws(ml.privateKey,
+    { alg: "SLH-DSA-SHAKE-256f", typ: "JWT" },
+    { sub: "attacker", role: "admin", iat: _NOW_SEC });
+
+  var claims = null, threw = null;
+  try {
+    claims = await b.auth.jwt.verify(confused, {
+      publicKey:  ml.publicKey,
+      algorithms: ["SLH-DSA-SHAKE-256f"],   // SLH-only allowlist
+      now:        _NOW_MS,
+    });
+  } catch (e) { threw = e; }
+  check("core jwt: SLH-declared/ML-signed token refused (alg-key binding, CWE-347)",
+        threw && threw.code === "auth-jwt/alg-key-mismatch");
+  check("core jwt: alg-confused token yields NO claims (fail closed, no bypass)",
+        claims === null);
+
+  // Ordering control: when the forged label is NOT in the allowlist, the
+  // allowlist gate fires first (algorithm-not-allowed), still fail-closed.
+  var threw2 = null;
+  try {
+    await b.auth.jwt.verify(confused, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: _NOW_MS,
+    });
+  } catch (e) { threw2 = e; }
+  check("core jwt: forged label outside allowlist refused (algorithm-not-allowed)",
+        threw2 && threw2.code === "auth-jwt/algorithm-not-allowed");
+
+  // Positive control: a correctly-labeled ML-DSA token still verifies, proving
+  // the binding didn't break the happy path.
+  var honest = _rawJws(ml.privateKey,
+    { alg: "ML-DSA-87", typ: "JWT" }, { sub: "u1", iat: _NOW_SEC });
+  var ok = await b.auth.jwt.verify(honest, {
+    publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: _NOW_MS,
+  });
+  check("core jwt: correctly-labeled ML-DSA token still verifies", ok && ok.sub === "u1");
+}
+
+// RED (sign side of the same root) — sign() must not EMIT a token whose header
+// alg misstates the signing key's real algorithm (the artifact the verify
+// bypass consumes). Config-time throw.
+async function testSignRefusesMismatchedAlgKey() {
+  var ml = _mlPair();
+  var threw = null;
+  try {
+    await b.auth.jwt.sign({ sub: "u1" },
+      { privateKey: ml.privateKey, algorithm: "SLH-DSA-SHAKE-256f" });
+  } catch (e) { threw = e; }
+  check("core jwt: sign refuses SLH alg with an ML-DSA key (no mislabeled token emitted)",
+        threw && threw.code === "auth-jwt/alg-key-mismatch");
+
+  // Matched alg/key still signs (happy path intact).
+  var tok = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87" });
+  check("core jwt: sign with matched ML-DSA alg/key emits a 3-part token",
+        typeof tok === "string" && tok.split(".").length === 3);
+}
+
+// decode() — malformed-segment / non-object / part-count branches all return
+// typed auth-jwt/malformed, never a raw throw.
+function testCoreJwtDecodeMalformed() {
+  var cases = [
+    ["", "empty string"],
+    ["only-two.parts", "two parts"],
+    ["a.b.c.d", "four parts"],
+    ["!!!.b.c", "non-base64url header"],
+    [_b64urlJson([1, 2, 3]) + "." + _b64urlJson({ sub: "x" }) + ".c", "array header (not object)"],
+    [_b64urlJson({ alg: "ML-DSA-87" }) + "." + _b64urlJson("string-payload") + ".c", "scalar payload (not object)"],
+  ];
+  for (var i = 0; i < cases.length; i++) {
+    var threw = null;
+    try { b.auth.jwt.decode(cases[i][0]); } catch (e) { threw = e; }
+    check("core jwt: decode(" + cases[i][1] + ") throws typed auth-jwt/malformed",
+          threw && threw.code === "auth-jwt/malformed");
+  }
+  // Non-string token.
+  var t2 = null;
+  try { b.auth.jwt.decode(12345); } catch (e) { t2 = e; }
+  check("core jwt: decode(non-string) throws auth-jwt/malformed",
+        t2 && t2.code === "auth-jwt/malformed");
+}
+
+// Key resolution branches: missing key, keyResolver/publicKey conflict,
+// resolver-throws, resolver-returns-nothing, resolver-success.
+async function testCoreJwtKeyResolution() {
+  var ml = _mlPair();
+  var token = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", now: _NOW_MS });
+
+  var t1 = null;
+  try { await b.auth.jwt.verify(token, { algorithms: ["ML-DSA-87"], now: _NOW_MS }); }
+  catch (e) { t1 = e; }
+  check("core jwt: verify with neither publicKey nor keyResolver → missing-key",
+        t1 && t1.code === "auth-jwt/missing-key");
+
+  var t2 = null;
+  try {
+    await b.auth.jwt.verify(token, {
+      publicKey: ml.publicKey, keyResolver: function () { return ml.publicKey; },
+      algorithms: ["ML-DSA-87"], now: _NOW_MS,
+    });
+  } catch (e) { t2 = e; }
+  check("core jwt: keyResolver AND publicKey together → conflicting-key-source",
+        t2 && t2.code === "auth-jwt/conflicting-key-source");
+
+  var t3 = null;
+  try {
+    await b.auth.jwt.verify(token, {
+      keyResolver: function () { throw new Error("jwks down"); },
+      algorithms: ["ML-DSA-87"], now: _NOW_MS,
+    });
+  } catch (e) { t3 = e; }
+  check("core jwt: keyResolver that throws → key-resolver-failed",
+        t3 && t3.code === "auth-jwt/key-resolver-failed");
+
+  var t4 = null;
+  try {
+    await b.auth.jwt.verify(token, {
+      keyResolver: function () { return null; },
+      algorithms: ["ML-DSA-87"], now: _NOW_MS,
+    });
+  } catch (e) { t4 = e; }
+  check("core jwt: keyResolver returning no key → key-not-found",
+        t4 && t4.code === "auth-jwt/key-not-found");
+
+  // Async resolver returning the right key succeeds, and receives the full
+  // decoded header (kid is delegated to the operator to sanitize).
+  var sawKid = null;
+  var ok = await b.auth.jwt.verify(token, {
+    keyResolver: function (hdr) { sawKid = hdr.alg; return Promise.resolve(ml.publicKey); },
+    algorithms: ["ML-DSA-87"], now: _NOW_MS,
+  });
+  check("core jwt: async keyResolver returning the right key verifies",
+        ok && ok.sub === "u1" && sawKid === "ML-DSA-87");
+}
+
+// crit + expectedTyp defenses.
+async function testCoreJwtCritAndTyp() {
+  var ml = _mlPair();
+  // Unknown crit extension → refused (RFC 7515 §4.1.11).
+  var critTok = _rawJws(ml.privateKey,
+    { alg: "ML-DSA-87", typ: "JWT", crit: ["exp"] }, { sub: "u1", iat: _NOW_SEC });
+  var t1 = null;
+  try {
+    await b.auth.jwt.verify(critTok, { publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: _NOW_MS });
+  } catch (e) { t1 = e; }
+  check("core jwt: unknown crit header refused (auth-jwt/unknown-crit)",
+        t1 && t1.code === "auth-jwt/unknown-crit");
+
+  // expectedTyp mismatch (case-insensitive per RFC 8725 §3.11).
+  var jwtTok = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", typ: "JWT", now: _NOW_MS });
+  var t2 = null;
+  try {
+    await b.auth.jwt.verify(jwtTok, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], expectedTyp: "at+jwt", now: _NOW_MS,
+    });
+  } catch (e) { t2 = e; }
+  check("core jwt: expectedTyp mismatch refused (auth-jwt/typ-mismatch)",
+        t2 && t2.code === "auth-jwt/typ-mismatch");
+
+  // Matching typ (different case) accepted.
+  var ok = await b.auth.jwt.verify(jwtTok, {
+    publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], expectedTyp: "jwt", now: _NOW_MS,
+  });
+  check("core jwt: expectedTyp matches case-insensitively", ok && ok.sub === "u1");
+
+  // Empty/blank expectedTyp is a config error.
+  var t3 = null;
+  try {
+    await b.auth.jwt.verify(jwtTok, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], expectedTyp: "", now: _NOW_MS,
+    });
+  } catch (e) { t3 = e; }
+  check("core jwt: empty expectedTyp refused (auth-jwt/bad-expected-typ)",
+        t3 && t3.code === "auth-jwt/bad-expected-typ");
+}
+
+// Algorithm allowlist gate branches: an unsupported entry in the caller's list,
+// and a token alg outside the list.
+async function testCoreJwtAlgAllowlist() {
+  var ml = _mlPair();
+  var token = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", now: _NOW_MS });
+
+  // Caller lists a bogus algorithm → surfaced at config time.
+  var t1 = null;
+  try {
+    await b.auth.jwt.verify(token, { publicKey: ml.publicKey, algorithms: ["HS256"], now: _NOW_MS });
+  } catch (e) { t1 = e; }
+  check("core jwt: unsupported alg in allowlist refused (auth-jwt/unsupported-algorithm)",
+        t1 && t1.code === "auth-jwt/unsupported-algorithm");
+
+  // "none" can never be configured into the allowlist.
+  var t2 = null;
+  try {
+    await b.auth.jwt.verify(token, { publicKey: ml.publicKey, algorithms: ["none"], now: _NOW_MS });
+  } catch (e) { t2 = e; }
+  check("core jwt: alg 'none' cannot enter the allowlist (auth-jwt/unsupported-algorithm)",
+        t2 && t2.code === "auth-jwt/unsupported-algorithm");
+
+  // Token alg legitimately outside the (valid) allowlist.
+  var t3 = null;
+  try {
+    await b.auth.jwt.verify(token, {
+      publicKey: ml.publicKey, algorithms: ["SLH-DSA-SHAKE-256f"], now: _NOW_MS,
+    });
+  } catch (e) { t3 = e; }
+  check("core jwt: token alg outside allowlist refused (auth-jwt/algorithm-not-allowed)",
+        t3 && t3.code === "auth-jwt/algorithm-not-allowed");
+}
+
+// Signature integrity: tampering the payload after signing invalidates it.
+async function testCoreJwtTamperedSignature() {
+  var ml = _mlPair();
+  var token = await b.auth.jwt.sign({ sub: "u1", role: "user" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", now: _NOW_MS });
+  var parts = token.split(".");
+  var forgedPayload = _b64urlJson({ sub: "u1", role: "admin", iat: _NOW_SEC });
+  var tampered = parts[0] + "." + forgedPayload + "." + parts[2];
+  var threw = null;
+  try {
+    await b.auth.jwt.verify(tampered, { publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: _NOW_MS });
+  } catch (e) { threw = e; }
+  check("core jwt: tampered payload refused (auth-jwt/invalid-signature)",
+        threw && threw.code === "auth-jwt/invalid-signature");
+}
+
+// Time-based claims: exp / nbf enforcement, clock tolerance leeway, bad
+// tolerance config, and NumericDate typing (a string exp must not bypass).
+async function testCoreJwtTimeClaims() {
+  var ml = _mlPair();
+
+  // Expired token (exp = now + 100s; verify 200s later).
+  var expiredTok = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", expiresInSec: 100, now: _NOW_MS });
+  var laterMs = (_NOW_SEC + 200) * 1000;                                          // allow:raw-byte-literal — seconds→ms
+  var t1 = null;
+  try {
+    await b.auth.jwt.verify(expiredTok, { publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: laterMs });
+  } catch (e) { t1 = e; }
+  check("core jwt: expired token refused (auth-jwt/expired)",
+        t1 && t1.code === "auth-jwt/expired");
+
+  // Clock tolerance widens the window enough to accept it.
+  var okTol = await b.auth.jwt.verify(expiredTok, {
+    publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: laterMs, clockToleranceSec: 300,
+  });
+  check("core jwt: clockToleranceSec leeway accepts a barely-expired token", okTol && okTol.sub === "u1");
+
+  // not-yet-valid (nbf in the future).
+  var futureTok = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", notBeforeSec: 100, now: _NOW_MS });
+  var t2 = null;
+  try {
+    await b.auth.jwt.verify(futureTok, { publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: _NOW_MS });
+  } catch (e) { t2 = e; }
+  check("core jwt: nbf-in-future refused (auth-jwt/not-yet-valid)",
+        t2 && t2.code === "auth-jwt/not-yet-valid");
+
+  // Negative / non-finite clock tolerance is a config error.
+  var bad = [-1, Infinity, NaN];
+  for (var i = 0; i < bad.length; i++) {
+    var tb = null;
+    try {
+      await b.auth.jwt.verify(expiredTok, {
+        publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: laterMs, clockToleranceSec: bad[i],
+      });
+    } catch (e) { tb = e; }
+    check("core jwt: clockToleranceSec=" + String(bad[i]) + " refused (auth-jwt/bad-clock-tolerance)",
+          tb && tb.code === "auth-jwt/bad-clock-tolerance");
+  }
+
+  // NumericDate typing: a STRING exp must not silently bypass expiry.
+  var strExpTok = _rawJws(ml.privateKey,
+    { alg: "ML-DSA-87", typ: "JWT" }, { sub: "u1", exp: "9999999999", iat: _NOW_SEC });
+  var t3 = null;
+  try {
+    await b.auth.jwt.verify(strExpTok, { publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], now: _NOW_MS });
+  } catch (e) { t3 = e; }
+  check("core jwt: string exp refused as malformed (no expiry bypass, RFC 7519 NumericDate)",
+        t3 && t3.code === "auth-jwt/malformed");
+}
+
+// Registered-claim assertions: iss (StringOrURI, not an array), aud (any-of),
+// sub (exact).
+async function testCoreJwtClaimAssertions() {
+  var ml = _mlPair();
+
+  // iss-array injection: iss:["evil","trusted"] must NOT satisfy a single
+  // trusted-issuer expectation (CVE-2025-30144 class).
+  var arrIssTok = await b.auth.jwt.sign(
+    { sub: "u1", iss: ["evil.example", "trusted.example"] },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", now: _NOW_MS });
+  var t1 = null;
+  try {
+    await b.auth.jwt.verify(arrIssTok, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], issuer: "trusted.example", now: _NOW_MS,
+    });
+  } catch (e) { t1 = e; }
+  check("core jwt: array iss does not satisfy single-issuer expectation (auth-jwt/iss-mismatch)",
+        t1 && t1.code === "auth-jwt/iss-mismatch");
+
+  // aud any-of: token aud is an array, expectation matches one entry.
+  var audTok = await b.auth.jwt.sign(
+    { sub: "u1", aud: ["svc-a", "svc-b"] },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", now: _NOW_MS });
+  var okAud = await b.auth.jwt.verify(audTok, {
+    publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], audience: "svc-b", now: _NOW_MS,
+  });
+  check("core jwt: aud array matches expected any-of", okAud && okAud.sub === "u1");
+  var t2 = null;
+  try {
+    await b.auth.jwt.verify(audTok, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], audience: "svc-c", now: _NOW_MS,
+    });
+  } catch (e) { t2 = e; }
+  check("core jwt: aud mismatch refused (auth-jwt/aud-mismatch)",
+        t2 && t2.code === "auth-jwt/aud-mismatch");
+
+  // sub exact match.
+  var subTok = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", now: _NOW_MS });
+  var t3 = null;
+  try {
+    await b.auth.jwt.verify(subTok, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], subject: "u2", now: _NOW_MS,
+    });
+  } catch (e) { t3 = e; }
+  check("core jwt: sub mismatch refused (auth-jwt/sub-mismatch)",
+        t3 && t3.code === "auth-jwt/sub-mismatch");
+}
+
+// Replay defense: jti-less token refused when replayStore is wired; a valid
+// token verifies once and is refused on second use; a store missing
+// checkAndInsert is a config error.
+async function testCoreJwtReplay() {
+  var ml = _mlPair();
+  var store = b.nonceStore.create({ backend: "memory" });
+  // The memory replay store evicts against real wall-clock, and expireAt is
+  // derived from the token's exp claim — so drive this case on the real clock
+  // (a fixed past exp would evict the entry before the replay check).
+  var realNowMs = Date.now();
+
+  // No exp → no auto-jti → replayStore has nothing to bind → refuse.
+  var noJtiTok = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", now: realNowMs });
+  var t1 = null;
+  try {
+    await b.auth.jwt.verify(noJtiTok, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], replayStore: store, now: realNowMs,
+    });
+  } catch (e) { t1 = e; }
+  check("core jwt: replayStore with a jti-less token refused (auth-jwt/replay-no-jti)",
+        t1 && t1.code === "auth-jwt/replay-no-jti");
+
+  // exp present → jti auto-minted → first verify ok, second is a replay.
+  var repTok = await b.auth.jwt.sign({ sub: "u1" },
+    { privateKey: ml.privateKey, algorithm: "ML-DSA-87", expiresInSec: 3600, now: realNowMs });
+  var okFirst = await b.auth.jwt.verify(repTok, {
+    publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], replayStore: store, now: realNowMs,
+  });
+  check("core jwt: first use of a jti verifies with replayStore", okFirst && okFirst.sub === "u1");
+  var t2 = null;
+  try {
+    await b.auth.jwt.verify(repTok, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], replayStore: store, now: realNowMs,
+    });
+  } catch (e) { t2 = e; }
+  check("core jwt: second use of the same jti refused (auth-jwt/replay)",
+        t2 && t2.code === "auth-jwt/replay");
+
+  // A store lacking checkAndInsert is a config error.
+  var t3 = null;
+  try {
+    await b.auth.jwt.verify(repTok, {
+      publicKey: ml.publicKey, algorithms: ["ML-DSA-87"], replayStore: {}, now: realNowMs,
+    });
+  } catch (e) { t3 = e; }
+  check("core jwt: replayStore missing checkAndInsert refused (auth-jwt/bad-replay-store)",
+        t3 && t3.code === "auth-jwt/bad-replay-store");
+
+  if (typeof store.close === "function") store.close();
+}
+
 async function run() {
+  await testAlgConfusionAllowlistBypass();
+  await testSignRefusesMismatchedAlgKey();
+  testCoreJwtDecodeMalformed();
+  await testCoreJwtKeyResolution();
+  await testCoreJwtCritAndTyp();
+  await testCoreJwtAlgAllowlist();
+  await testCoreJwtTamperedSignature();
+  await testCoreJwtTimeClaims();
+  await testCoreJwtClaimAssertions();
+  await testCoreJwtReplay();
   await testJwtExternalNonFiniteSkewRejected();
   await testOauthCreateNonFiniteSkewRejected();
   await testNullJoseHeaderTypedError();