@bongos/core 1.19.415 → 1.19.417

package/tests/sso_checkin_identity_spoof.mjs

@@ -0,0 +1,348 @@
+// tests/sso_checkin_identity_spoof.mjs — the hub SSO check-in spoof (security
+// report 1000027, task 1003340, goal 1000045; ADR 0205).
+//
+// THE HOLE THIS PINS SHUT. `POST /sso/membership/check-in` authenticates the
+// CALLER (client_id + client_secret) and takes the SUBJECT (`github_id`) from the
+// request body. Client credentials say WHICH PROJECT is calling; they say nothing
+// about WHO that github_id is. So a project holding only its OWN credentials could:
+//
+//   1. rewrite the `github_login` + `avatar_url` on ANY person's hub account —
+//      `upsertAccount`'s ON CONFLICT re-synced both unconditionally — which is
+//      what the public profile renders; and
+//   2. mint the `platform_identity_project_memberships` row that
+//      `POST /sso/activity/rollup`'s `membership_required` precheck reads. That
+//      precheck IS the ADR 0171 D7 anti-impersonation gate, so the gate was
+//      satisfiable by the very call it was meant to gate: check in as the victim,
+//      then publish forged credits/karma/rank onto their PUBLIC profile.
+//
+// THE FIX, AND WHAT MAKES IT A GATE. A membership row is now born only at the two
+// moments the HUB itself authenticated a human for a client — `POST /sso/token`
+// (redeeming a code minted under a live hub session) and `POST /sso/device/poll`
+// (a GitHub device approval, audience bound from the registered origin) — each
+// stamping `signin_verified_at`, a column no request body can reach. Check-in may
+// only UPDATE a row carrying that witness, and creates the account shell
+// insert-only. The rollup precheck demands the witness, not merely a row.
+//
+// EVERY ASSERTION BELOW IS MUTATION-SENSITIVE: run this file against the code
+// before the fix and the spoof rows fail (200 instead of 409, an identity
+// re-sync where there must be none, an INSERT where there must be an UPDATE).
+// The two "still works" rows are the control — the fix is a gate, not a wall.
+//
+// DB-free: a recording fake pool, the REAL sso router, the REAL domain module,
+// core pinned through the doorway (the tests/account_privacy_flags.mjs pattern).
+// It therefore runs in the default unit gate, where a real-Postgres proof would
+// silently self-skip.
+//
+// Run:  node tests/sso_checkin_identity_spoof.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// ---- the recording fake pool ----------------------------------------------
+//
+// One shared pool object: the router's `pool` is destructured from the pinned
+// doorway at require time, so it must be the same object each test queues into.
+// SQL is whitespace-normalised on the way in so the assertions can match shapes
+// without caring how a statement is wrapped.
+let queued = [];
+let calls = [];
+const pool = {
+  query: async (text, params) => {
+    calls.push({ text: String(text).replace(/\s+/g, ' ').trim(), params: params || [] });
+    return queued.shift() || { rows: [], rowCount: 0 };
+  },
+};
+function expect(...responses) { queued = responses; calls = []; }
+const sqlFor = (re) => calls.filter((c) => re.test(c.text));
+
+// ---- the real routes over the real domain, with core pinned ----------------
+
+const noopLog = { info() {}, warn() {}, error() {}, debug() {} };
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    resolveSession: async () => null,          // the browser leg is not under test
+    logger: () => noopLog,
+    hasProvider: () => true,                   // the hub port is already registered
+    registerProvider: () => {},
+    on: () => () => {},                        // the SLO listener is not under test
+    resolveEnv: () => null,                    // no hub signing key ⇒ device legs 503
+    userAgent: () => 'cloud-bongos-tests',
+    LIVE_RANK_LADDER: ['xenos', 'thetes', 'metic', 'archon'],
+  },
+};
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildSsoRoutes = require('../modules/platform-identity/routes/sso.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildSsoRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// ---- fixtures --------------------------------------------------------------
+//
+// The attacker holds a fully legitimate, active SSO client and its real secret —
+// the whole point is that valid client credentials must not be authority over a
+// person. VICTIM is somebody else's github_id entirely.
+
+const CLIENT_ID = 'sec1000027-attacker-client';
+const CLIENT_SECRET = 'sec1000027-attacker-secret';
+const REDIRECT = 'https://attacker.example/api/gds/auth/web/callback';
+const VICTIM = 9002801777;
+const SIGNED_IN = 4242;
+
+const clientRow = () => ({
+  client_id: CLIENT_ID,
+  secret_hash: pi.sha256hex(CLIENT_SECRET),
+  name: 'Attacker Project',
+  redirect_uris: [REDIRECT],
+  origin: 'https://attacker.example',
+  owner_github_id: '1',
+  status: 'active',
+});
+const membershipRow = (over = {}) => ({
+  id: '5', client_id: CLIENT_ID, github_id: String(VICTIM),
+  membership_kind: 'member', joined_at: 'T0', last_active: 'T0',
+  signin_verified_at: null, ...over,
+});
+const checkInBody = (over = {}) => ({
+  client_id: CLIENT_ID,
+  client_secret: CLIENT_SECRET,
+  github_id: VICTIM,
+  github_login: 'pwned-login',
+  display_name: 'Pwned',
+  avatar_url: 'https://attacker.example/av.png',
+  membership_kind: 'member',
+  ...over,
+});
+const rollupBody = (over = {}) => ({
+  client_id: CLIENT_ID,
+  client_secret: CLIENT_SECRET,
+  github_id: VICTIM,
+  credits: 999999,
+  karma: 999999,
+  tasks_shipped: 9999,
+  rank: 'archon',
+  disciplines: ['engineer'],
+  ...over,
+});
+
+// ===========================================================================
+// 1. The attack itself — a client with valid credentials, an unaffiliated person
+// ===========================================================================
+
+test('check-in for an unaffiliated github_id is REFUSED (no hub sign-in witness)', async () => {
+  // getClient → the attacker's real client; the membership lookup finds nothing.
+  expect({ rows: [clientRow()] }, { rows: [] });
+  const r = await call('POST', '/sso/membership/check-in', checkInBody());
+  assert.equal(r.status, 409, 'valid client credentials are not authority over a person');
+  assert.equal(r.json.error.code, 'signin_required');
+});
+
+test('the refused check-in writes NOTHING — not the identity, not a membership', async () => {
+  expect({ rows: [clientRow()] }, { rows: [] });
+  await call('POST', '/sso/membership/check-in', checkInBody());
+  assert.equal(sqlFor(/platform_identity_accounts/).length, 0,
+    "the victim's account row must not be touched at all by a caller who cannot speak for them");
+  assert.equal(sqlFor(/INSERT INTO platform_identity_project_memberships/).length, 0,
+    'a check-in must never CREATE a membership — that is what unlocked the forged rollup');
+});
+
+test('an accepted check-in re-syncs no identity: the account write is insert-only', async () => {
+  expect(
+    { rows: [clientRow()] },
+    { rows: [membershipRow({ signin_verified_at: '2026-08-29T00:00:00.000Z' })] },
+    { rows: [{ id: '9', github_id: String(VICTIM), github_login: 'real-login', handle: 'real-login' }] },
+  );
+  const r = await call('POST', '/sso/membership/check-in', checkInBody());
+  assert.equal(r.status, 200);
+
+  const writes = sqlFor(/INSERT INTO platform_identity_accounts|UPDATE platform_identity_accounts/);
+  assert.equal(writes.length, 1, 'exactly one account WRITE');
+  assert.match(writes[0].text, /ON CONFLICT \(github_id\) DO NOTHING/,
+    'an existing account is left alone; only an absent one is created');
+  for (const c of sqlFor(/platform_identity_accounts/)) {
+    assert.doesNotMatch(c.text, /github_login = EXCLUDED\.github_login/,
+      'the public GitHub login must never be re-synced from an unproven request body');
+    assert.doesNotMatch(c.text, /avatar_url = EXCLUDED\.avatar_url/,
+      'nor the avatar the public profile renders');
+    assert.doesNotMatch(c.text, /DO UPDATE/,
+      'no statement this route issues may rewrite an existing account');
+  }
+});
+
+test('an accepted check-in only UPDATEs a membership the hub witnessed', async () => {
+  expect(
+    { rows: [clientRow()] },
+    { rows: [membershipRow({ signin_verified_at: '2026-08-29T00:00:00.000Z' })] },
+    { rows: [{ id: '9', handle: 'real-login' }] },
+  );
+  await call('POST', '/sso/membership/check-in', checkInBody());
+
+  const membership = sqlFor(/platform_identity_project_memberships/);
+  assert.equal(membership.length, 1, 'exactly one membership statement');
+  assert.match(membership[0].text, /^UPDATE platform_identity_project_memberships/);
+  assert.match(membership[0].text, /signin_verified_at IS NOT NULL/,
+    'the witness is the predicate — without it the UPDATE is a disguised INSERT');
+  assert.equal(membership[0].params[0], CLIENT_ID,
+    'keyed to the AUTHENTICATED client, never a caller-named one');
+});
+
+test('a non-numeric github_id is refused before it can reach the bigint column', async () => {
+  expect({ rows: [clientRow()] });
+  const r = await call('POST', '/sso/membership/check-in', checkInBody({ github_id: 'system:bfg' }));
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'invalid_github_id');
+});
+
+// ===========================================================================
+// 2. The rollup gate the check-in used to unlock (ADR 0171 D7)
+// ===========================================================================
+
+test('the forged portfolio is refused: a membership row without the witness is not a membership', async () => {
+  expect({ rows: [clientRow()] }, { rows: [membershipRow({ signin_verified_at: null })] });
+  const r = await call('POST', '/sso/activity/rollup', rollupBody());
+  assert.equal(r.status, 409, 'row-existence alone was never proof — the writer of the row was the caller');
+  assert.equal(r.json.error.code, 'membership_required');
+  assert.equal(sqlFor(/platform_identity_builder_project_activity/).length, 0,
+    'nothing reaches the table the public profile aggregates');
+});
+
+test('a pending INVITE row still fails the rollup gate, witness or not', async () => {
+  expect({ rows: [clientRow()] }, { rows: [membershipRow({ membership_kind: 'pending', signin_verified_at: '2026-08-29T00:00:00.000Z' })] });
+  const r = await call('POST', '/sso/activity/rollup', rollupBody());
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'membership_required');
+});
+
+test('CONTROL: a witnessed, non-pending membership still publishes its rollup', async () => {
+  expect(
+    { rows: [clientRow()] },
+    { rows: [membershipRow({ signin_verified_at: '2026-08-29T00:00:00.000Z' })] },
+    { rows: [{ id: '1', client_id: CLIENT_ID, github_id: String(VICTIM) }] },
+  );
+  const r = await call('POST', '/sso/activity/rollup', rollupBody());
+  assert.equal(r.status, 200, 'the fix is a gate on proof, not a blanket denial of federation');
+  assert.equal(sqlFor(/INSERT INTO platform_identity_builder_project_activity/).length, 1);
+});
+
+// ===========================================================================
+// 3. Where the proof comes from — the hub's own sign-in, never a request body
+// ===========================================================================
+
+test('POST /sso/token stamps the witness, for the github_id the REDEEMED code names', async () => {
+  expect(
+    { rows: [clientRow()] },
+    { rows: [{ github_id: String(SIGNED_IN), github_login: 'octo', display_name: 'Octo', avatar_url: 'https://a.example/o.png', redirect_uri: REDIRECT }] },
+    { rows: [{ id: '5', signin_verified_at: 'now' }] },
+  );
+  const r = await call('POST', '/sso/token', {
+    client_id: CLIENT_ID, client_secret: CLIENT_SECRET, code: 'the-code', redirect_uri: REDIRECT,
+  });
+  assert.equal(r.status, 200);
+
+  const stamp = sqlFor(/signin_verified_at = now\(\)/);
+  assert.equal(stamp.length, 1, 'the redeem is where a membership is born');
+  assert.deepEqual(stamp[0].params, [CLIENT_ID, String(SIGNED_IN)],
+    'the subject comes from the single-use code the hub minted, never from the caller');
+  assert.match(stamp[0].text, /INSERT INTO platform_identity_project_memberships/);
+});
+
+test('the token leg accepts no caller-named subject at all (strict schema)', async () => {
+  expect({ rows: [clientRow()] });
+  const r = await call('POST', '/sso/token', {
+    client_id: CLIENT_ID, client_secret: CLIENT_SECRET, code: 'the-code', redirect_uri: REDIRECT,
+    github_id: VICTIM,
+  });
+  assert.equal(r.status, 400, 'an undeclared github_id must be rejected, not quietly honoured');
+  assert.equal(r.json.error.code, 'validation_failed');
+});
+
+test('a failed redeem stamps nothing — no code, no witness', async () => {
+  expect({ rows: [clientRow()] }, { rows: [] });
+  const r = await call('POST', '/sso/token', {
+    client_id: CLIENT_ID, client_secret: CLIENT_SECRET, code: 'wrong', redirect_uri: REDIRECT,
+  });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'invalid_grant');
+  assert.equal(sqlFor(/signin_verified_at = now\(\)/).length, 0);
+});
+
+// ===========================================================================
+// 4. The stored shape + the avatar scheme check
+// ===========================================================================
+
+test('migration 014 adds the witness column and deliberately does NOT backfill it', () => {
+  const file = join(ROOT, 'modules/platform-identity/migrations/platform_identity_014_membership_signin_proof.sql');
+  assert.ok(existsSync(file), 'the witness column needs a migration to exist in');
+  const sql = readFileSync(file, 'utf8');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS signin_verified_at timestamptz/);
+  assert.doesNotMatch(sql, /SET signin_verified_at\s*=/,
+    'grandfathering existing rows would preserve exactly the rows the report is about');
+});
+
+test('safeAvatarUrl admits https and nothing else', () => {
+  assert.equal(pi.safeAvatarUrl('https://avatars.example/u/1.png'), 'https://avatars.example/u/1.png');
+  for (const bad of [
+    'http://avatars.example/u/1.png',
+    'data:image/svg+xml;base64,PHN2Zy8+',
+    'javascript:alert(1)',
+    'file:///etc/passwd',
+    '/relative/path.png',
+    'not a url at all',
+    '',
+  ]) {
+    assert.equal(pi.safeAvatarUrl(bad), null, `${bad || '(empty)'} must not reach storage`);
+  }
+  assert.equal(pi.safeAvatarUrl(null), null);
+  assert.equal(pi.safeAvatarUrl(undefined), null);
+});
+
+test('both account writers bind the sanitized avatar, never the raw string', async () => {
+  expect({ rows: [{ handle: 'h' }] });
+  await pi.upsertAccount({ githubId: 1, githubLogin: 'x', avatarUrl: 'javascript:alert(1)' }, { pool });
+  assert.equal(calls[0].params[3], null, 'upsertAccount (the hub-authenticated writer)');
+
+  expect({ rows: [{ handle: 'h' }] });
+  await pi.ensureAccount({ githubId: 1, githubLogin: 'x', avatarUrl: 'data:text/html,<script>' }, { pool });
+  assert.equal(calls[0].params[3], null, 'ensureAccount (the federated-client writer)');
+});