@bongos/core 1.24.95 → 1.25.1

package/tests/my_passkeys.mjs

@@ -14,7 +14,12 @@ const build = require('../src/bongos/routes/my-passkeys');
 
 const creds = [];
 const consumed = [];
+const stamped = [];
+let counterOk = true;
 const store = {
+  STEP_UP_WINDOW_SECONDS: 600,
+  recordUse: async () => (counterOk ? { ok: true } : { ok: false, reason: 'sign_count_regressed' }),
+  markSessionCardVerified: async (sid, b) => { stamped.push([sid, b]); return true; },
   listCredentials: async (b) => creds.filter((c) => c.builder_id === b),
   getOrCreateUserHandle: async () => 'aGFuZGxl',
   createChallenge: async () => ({ challenge: 'Y2hhbGw' }),
@@ -26,6 +31,12 @@ const store = {
 };
 let verifyOk = true;
 const webauthn = {
+  generateAuthenticationOptions: async (o) => ({ rpId: o.rpID, allowCredentials: o.allowCredentials, userVerification: o.userVerification }),
+  verifyAuthenticationResponse: async (o) => {
+    assert.equal(o.requireUserVerification, true);
+    if (!(await o.expectedChallenge('Y2hhbGw'))) throw new Error('challenge');
+    return { verified: true, authenticationInfo: { newCounter: 5 } };
+  },
   generateRegistrationOptions: async (o) => ({ rp: { id: o.rpID }, excludeCredentials: o.excludeCredentials }),
   verifyRegistrationResponse: async (o) => {
     assert.equal(o.requireUserVerification, true);
@@ -37,7 +48,7 @@ const webauthn = {
 const app = express();
 app.use(express.json());
 app.use((req, res, next) => { res.fail = (code, { status = 400, message } = {}) => res.status(status).json({ error: code, message }); next(); });
-app.use((req, res, next) => { req.builder = { id: '7', github_login: 'me' }; next(); });
+app.use((req, res, next) => { req.builder = { id: '7', github_login: 'me' }; req.gdsSession = { session_id: '42' }; next(); });
 app.use('/', build({ store, webauthn, requireBuilder: (q, r, n) => n() }));
 const server = http.createServer(app).listen(0);
 const port = server.address().port;
@@ -104,5 +115,40 @@ r = await new Promise((resolve) => {
 });
 assert.equal(r.status, 503); ok('unconfigured non-local host refused');
 
+// --- card check (task 1004747) ---
+creds.length = 0;
+r = await call('POST', '/me/passkeys/authenticate/options', {});
+assert.equal(r.status, 409); ok('card check refused when no card is registered');
+creds.push({ credential_id: 'cardA', builder_id: '7', public_key: Buffer.from([1]), sign_count: 1, transports: ['nfc'] });
+creds.push({ credential_id: 'cardB', builder_id: '8', public_key: Buffer.from([1]), sign_count: 1, transports: [] });
+r = await call('POST', '/me/passkeys/authenticate/options', {});
+assert.equal(r.status, 200); assert.equal(r.body.options.userVerification, 'required');
+assert.deepEqual(r.body.options.allowCredentials.map((c) => c.id), ['cardA']); ok('authenticate options list only the caller cards');
+consumed.length = 0;
+r = await call('POST', '/me/passkeys/authenticate/verify', { response: { id: 'cardA' } });
+assert.equal(r.status, 200); assert.deepEqual(stamped[0], ['42', '7']);
+assert.equal(consumed[0][1].expectPurpose, 'authenticate'); assert.equal(consumed[0][1].expectBuilderId, '7'); ok('verify stamps the caller session with an authenticate-bound challenge');
+stamped.length = 0;
+r = await call('POST', '/me/passkeys/authenticate/verify', { response: { id: 'cardB' } });
+assert.equal(r.status, 400); assert.equal(stamped.length, 0); ok('another builder card stamps nothing');
+r = await call('POST', '/me/passkeys/authenticate/verify', { response: { id: 'nope' } });
+assert.equal(r.status, 400); assert.equal(stamped.length, 0); ok('unknown card stamps nothing');
+counterOk = false;
+r = await call('POST', '/me/passkeys/authenticate/verify', { response: { id: 'cardA' } });
+assert.equal(r.status, 400); assert.equal(stamped.length, 0); ok('a counter that did not advance stamps nothing');
+counterOk = true;
+
+// --- the gate itself ---
+const { buildRequireCardStepUp } = require('../src/bongos/step-up');
+const gate = (st) => buildRequireCardStepUp({ store: { stepUpStatus: async () => { if (st instanceof Error) throw st; return st; } } });
+const run = async (mw, req) => { let out = 'next'; const res = { fail: (c, o) => { out = typeof o === 'number' ? [c, o] : [c, o.status]; } }; await mw(req, res, () => {}); return out; };
+const sess = { gdsSession: { session_id: '1' }, builder: { id: '7' } };
+assert.equal(await run(gate({ required: false, fresh: false }), sess), 'next'); ok('gate: requirement off passes');
+assert.equal(await run(gate({ required: true, fresh: true }), sess), 'next'); ok('gate: fresh tap passes');
+assert.deepEqual(await run(gate({ required: true, fresh: false }), sess), ['card_required', 403]); ok('gate: required and stale refused');
+assert.deepEqual(await run(gate(null), sess), ['card_required', 403]); ok('gate: unknown session refused');
+assert.deepEqual(await run(gate(new Error('db down')), sess), ['card_check_failed', 503]); ok('gate: fails closed on error');
+assert.deepEqual(await run(gate({ required: false, fresh: false }), {}), ['unauthenticated', 401]); ok('gate: no session refused');
+
 server.close();
 console.log(`${n} passed`);

package/tests/rank_change_broadcast_port.mjs

@@ -32,12 +32,14 @@ for (const fn of ['execFile', 'spawn', 'exec', 'fork']) {
   cp[fn] = (...args) => { spawned.push([fn, args[0], args[1]]); throw new Error(`test: ${fn} must not be called`); };
 }
 
+require('../src/bongos/passkeys').stepUpStatus = async () => ({ required: false, fresh: false }); // task 1004747: the step-up gate reads the DB; these stubs have none
 const authPath = require.resolve('../src/bongos/auth.js');
 require.cache[authPath] = {
   id: authPath, filename: authPath, loaded: true,
   exports: {
     requireBuilder: (req, _res, next) => {
       req.builder = { id: '1', rank: 'archon', github_login: 'archon1', display_name: 'Archon One' };
+      req.gdsSession = { session_id: '1' };
       next();
     },
     requireRank: () => (_req, _res, next) => next(),