@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/tests/cases/unit/idp/claimMappingValidation.test.ts

@@ -0,0 +1,134 @@
+import { describe, expect, test } from 'bun:test'
+import { Acl } from '@contember/schema'
+import { MembershipResolver, MembershipValidationErrorType } from '@contember/schema-utils'
+import { ClaimMappingMembership, ClaimMappingMembershipErrorType, validateClaimMappingMembership } from '../../../../src/model/service/idp/index.js'
+
+// Unit coverage for the shared A09 membership validator. It delegates the membership-shape checks
+// (role/variable existence, predefined rejection, condition-value parse) to MembershipResolver — the
+// same validator the direct add-member path uses — and adds the claim-aware condition-injection guard.
+
+const acl: Acl.Schema = {
+	roles: {
+		editor: {
+			stages: '*',
+			entities: {},
+			variables: {
+				language: { type: Acl.VariableType.entity, entityName: 'Language' },
+				// optional (carries a fallback) so a membership that omits it is a valid partial grant
+				siteFilter: { type: Acl.VariableType.condition, fallback: { never: true } },
+				me: { type: Acl.VariableType.predefined, value: 'identityID' },
+			},
+		},
+	},
+}
+
+const membership = (role: string, variables: ClaimMappingMembership['variables'] = []): ClaimMappingMembership => ({
+	project: 'demo',
+	role,
+	variables,
+})
+const types = (errors: { type: ClaimMappingMembershipErrorType }[]) => errors.map(it => it.type)
+
+describe('validateClaimMappingMembership', () => {
+	test('accepts a valid partial grant (an entity variable set, the others omitted)', () => {
+		expect(validateClaimMappingMembership(acl, membership('editor', [{ name: 'language', values: ['uuid-en'] }]))).toEqual([])
+	})
+
+	test('accepts a role with no variables (partial grant — VARIABLE_EMPTY is tolerated, unlike the direct path)', () => {
+		expect(validateClaimMappingMembership(acl, membership('editor'))).toEqual([])
+	})
+
+	test('rejects an unknown role', () => {
+		expect(types(validateClaimMappingMembership(acl, membership('salesperson')))).toEqual([ClaimMappingMembershipErrorType.roleNotFound])
+	})
+
+	test('rejects an unknown membership variable', () => {
+		expect(types(validateClaimMappingMembership(acl, membership('editor', [{ name: 'ghost', values: ['x'] }]))))
+			.toEqual([ClaimMappingMembershipErrorType.variableNotFound])
+	})
+
+	test('rejects setting a predefined variable (the runtime binds it to the signed-in identity)', () => {
+		expect(types(validateClaimMappingMembership(acl, membership('editor', [{ name: 'me', values: ['x'] }]))))
+			.toEqual([ClaimMappingMembershipErrorType.predefinedVariable])
+	})
+
+	test('a role / variable named after a prototype member is not silently accepted (own-property lookups, no throw)', () => {
+		for (const role of ['__proto__', 'constructor', 'toString', 'hasOwnProperty']) {
+			expect(types(validateClaimMappingMembership(acl, membership(role)))).toEqual([ClaimMappingMembershipErrorType.roleNotFound])
+		}
+		for (const name of ['__proto__', 'constructor', 'toString', 'hasOwnProperty']) {
+			expect(types(validateClaimMappingMembership(acl, membership('editor', [{ name, values: ['x'] }]))))
+				.toEqual([ClaimMappingMembershipErrorType.variableNotFound])
+		}
+	})
+
+	describe('condition variables', () => {
+		test('rejects a claim-derived condition value without an allow allowlist (injection guard)', () => {
+			expect(types(validateClaimMappingMembership(acl, membership('editor', [{ name: 'siteFilter', from: { claim: 'filter' } }]))))
+				.toContain(ClaimMappingMembershipErrorType.conditionInjection)
+		})
+
+		test('rejects a passthrough claim-derived condition value even with an allow allowlist', () => {
+			expect(types(validateClaimMappingMembership(
+				acl,
+				membership('editor', [{ name: 'siteFilter', from: { claim: 'filter' }, passthrough: true, allow: ['{"eq":"x"}'] }]),
+			))).toContain(ClaimMappingMembershipErrorType.conditionInjection)
+		})
+
+		test('rejects an allow:undefined claim-derived condition value (the empty-vs-undefined distinction)', () => {
+			// allow defined-but-empty is allowed shape-wise (it just yields no derived values); allow undefined is the injection case
+			expect(types(validateClaimMappingMembership(acl, membership('editor', [{ name: 'siteFilter', from: { claim: 'filter' }, allow: [] }]))))
+				.not.toContain(ClaimMappingMembershipErrorType.conditionInjection)
+		})
+
+		test('accepts a claim-derived condition value bounded by an allow allowlist of valid conditions', () => {
+			expect(validateClaimMappingMembership(acl, membership('editor', [{ name: 'siteFilter', from: { claim: 'filter' }, allow: ['{"eq":"site-1"}'] }])))
+				.toEqual([])
+		})
+
+		test('rejects a constant condition value that is not a parseable ACL condition', () => {
+			expect(types(validateClaimMappingMembership(acl, membership('editor', [{ name: 'siteFilter', values: ['not-a-condition'] }]))))
+				.toEqual([ClaimMappingMembershipErrorType.conditionValueInvalid])
+		})
+
+		test('CORR-2: rejects a malformed `allow` entry on a condition variable (not just constant `values`)', () => {
+			expect(
+				types(validateClaimMappingMembership(acl, membership('editor', [{ name: 'siteFilter', from: { claim: 'filter' }, allow: ['not-a-condition'] }]))),
+			)
+				.toContain(ClaimMappingMembershipErrorType.conditionValueInvalid)
+		})
+
+		test('CORR-2: rejects a malformed `map` output on a condition variable', () => {
+			expect(types(validateClaimMappingMembership(
+				acl,
+				membership('editor', [{ name: 'siteFilter', from: { claim: 'filter' }, map: { a: ['not-a-condition'] }, allow: ['not-a-condition'] }]),
+			))).toContain(ClaimMappingMembershipErrorType.conditionValueInvalid)
+		})
+	})
+
+	test('ARCH-2: agrees with MembershipResolver on whether a constant-only membership is valid (excluding partial-grant VARIABLE_EMPTY)', () => {
+		const corpus: ClaimMappingMembership[] = [
+			membership('editor', [{ name: 'language', values: ['uuid-en'] }]),
+			membership('editor', [{ name: 'siteFilter', values: ['{"eq":"x"}'] }]),
+			membership('editor', [{ name: 'siteFilter', values: ['not-a-condition'] }]),
+			membership('editor', [{ name: 'me', values: ['x'] }]),
+			membership('editor', [{ name: 'ghost', values: ['x'] }]),
+			membership('salesperson'),
+			membership('editor'),
+		]
+		const resolver = new MembershipResolver()
+		for (const m of corpus) {
+			const a09Rejects = validateClaimMappingMembership(acl, m).length > 0
+			const resolverRejects = resolver
+				.resolve(
+					acl,
+					[{ role: m.role, variables: (m.variables ?? []).map(v => ({ name: v.name, values: v.values ?? [] })) }],
+					MembershipResolver.UnknownIdentity,
+					false,
+				)
+				.errors.filter(it => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY)
+				.length > 0
+			expect(a09Rejects).toBe(resolverRejects)
+		}
+	})
+})

package/tests/cases/unit/idp/idpManagerConfigMerge.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, test } from 'bun:test'
+import { IDPHandlerRegistry, IDPManager } from '../../../../src/model/service/idp/index.js'
+import { UpdateIdpCommand } from '../../../../src/model/commands/idp/UpdateIdpCommand.js'
+import { DatabaseContext } from '../../../../src/index.js'
+import { IdPMock } from '../../../src/IdPMock.js'
+
+// updateIDP with `mergeConfiguration: true` merges configurer-supplied keys into the stored config. A
+// crafted `__proto__` / `constructor` / `prototype` key is a prototype-pollution sink, so the merge skips
+// those keys outright. This pins that guard (the only updateIDP test otherwise just asserts a rejection).
+
+const makeManager = () => {
+	const registry = new IDPHandlerRegistry()
+	registry.registerHandler('mock', new IdPMock())
+	return new IDPManager(registry, { getSchema: () => Promise.resolve(undefined) })
+}
+
+const makeDb = (existingConfiguration: Record<string, unknown>) => {
+	const executed: unknown[] = []
+	const inner: any = {
+		queryHandler: {
+			fetch: async () => ({ id: 'idp-1', slug: 'mock', type: 'mock', configuration: existingConfiguration, disabledAt: null }),
+		},
+		commandBus: { execute: async (command: unknown) => void executed.push(command) },
+	}
+	inner.transaction = async (cb: (db: any) => Promise<unknown>) => cb(inner)
+	return { db: inner as unknown as DatabaseContext, executed }
+}
+
+describe('IDPManager.updateIDP — config-merge prototype-pollution guard', () => {
+	test('skips own __proto__ / constructor / prototype keys when merging (no reparenting, not stored)', async () => {
+		const { db, executed } = makeDb({ externalIdentifier: 'sub' })
+		// Built via JSON.parse so the dunder names are OWN ENUMERABLE keys — an object literal `{ __proto__: … }`
+		// would set the literal's prototype instead. This mirrors how a hostile JSON config arrives over the wire.
+		const malicious = JSON.parse('{"__proto__":{"polluted":true},"constructor":{"x":1},"prototype":{"y":1},"email":"e@x.io"}')
+		const response = await makeManager().updateIDP(db, 'mock', { configuration: malicious }, true)
+		expect(response.ok).toBe(true)
+
+		const update = executed.find((c): c is UpdateIdpCommand => c instanceof UpdateIdpCommand)
+		expect(update).toBeDefined()
+		const storedConfiguration = (update as unknown as { data: { configuration: Record<string, unknown> } }).data.configuration
+		// the `__proto__` key was skipped, so the merged object's prototype is still Object.prototype (not reparented)
+		expect(Object.getPrototypeOf(storedConfiguration)).toBe(Object.prototype)
+		// only the legit merged key + the pre-existing one survive; all three dunder keys were dropped
+		expect(storedConfiguration).toEqual({ externalIdentifier: 'sub', email: 'e@x.io' })
+		expect(Object.prototype.hasOwnProperty.call(storedConfiguration, 'constructor')).toBe(false)
+		expect(Object.prototype.hasOwnProperty.call(storedConfiguration, 'prototype')).toBe(false)
+	})
+
+	test('a normal merge still overwrites keys and a null deletes them', async () => {
+		const { db, executed } = makeDb({ externalIdentifier: 'sub', email: 'old@x.io', name: 'drop-me' })
+		const response = await makeManager().updateIDP(db, 'mock', { configuration: { email: 'new@x.io', name: null } }, true)
+		expect(response.ok).toBe(true)
+		const update = executed.find((c): c is UpdateIdpCommand => c instanceof UpdateIdpCommand)
+		const storedConfiguration = (update as unknown as { data: { configuration: Record<string, unknown> } }).data.configuration
+		expect(storedConfiguration).toEqual({ externalIdentifier: 'sub', email: 'new@x.io' })
+	})
+
+	test('merges a nested config object instead of replacing it, so updating claimMapping.rules keeps the OIDC identity-remap', async () => {
+		// `configuration.claimMapping` holds two independent concerns in one object: the OIDC identity-remap
+		// (externalIdentifier/email/name/attributesKey) AND the A09 `rules`. A shallow replace of the whole
+		// `claimMapping` key while updating only `rules` would silently wipe the remap (and vice versa).
+		const { db, executed } = makeDb({
+			clientId: 'cid',
+			claimMapping: { externalIdentifier: 'oid', email: 'mail', rules: [{ claim: 'old', grantMembership: { project: 'p', role: 'r' } }] },
+		})
+		const response = await makeManager().updateIDP(db, 'mock', {
+			configuration: { claimMapping: { rules: [{ claim: 'groups', contains: 'admins', grantMembership: { project: 'p', role: 'admin' } }] } },
+		}, true)
+		expect(response.ok).toBe(true)
+		const update = executed.find((c): c is UpdateIdpCommand => c instanceof UpdateIdpCommand)
+		const storedConfiguration = (update as unknown as { data: { configuration: Record<string, unknown> } }).data.configuration
+		expect(storedConfiguration).toEqual({
+			clientId: 'cid',
+			claimMapping: {
+				// remap siblings preserved
+				externalIdentifier: 'oid',
+				email: 'mail',
+				// array value replaced wholesale (not merged element-wise)
+				rules: [{ claim: 'groups', contains: 'admins', grantMembership: { project: 'p', role: 'admin' } }],
+			},
+		})
+	})
+
+	test('a nested null deletes only that nested key, and nested dunder keys are skipped at every level', async () => {
+		const { db, executed } = makeDb({ claimMapping: { externalIdentifier: 'oid', attributesKey: 'attrs' } })
+		// nested dunder arrives as an OWN key (built via JSON.parse, like a hostile JSON config over the wire)
+		const updates = JSON.parse('{"claimMapping":{"attributesKey":null,"name":"display","__proto__":{"polluted":true}}}')
+		const response = await makeManager().updateIDP(db, 'mock', { configuration: updates }, true)
+		expect(response.ok).toBe(true)
+		const update = executed.find((c): c is UpdateIdpCommand => c instanceof UpdateIdpCommand)
+		const storedConfiguration = (update as unknown as { data: { configuration: Record<string, unknown> } }).data.configuration
+		expect(storedConfiguration).toEqual({ claimMapping: { externalIdentifier: 'oid', name: 'display' } })
+		// the nested __proto__ key did not reparent the merged child object
+		expect(Object.getPrototypeOf(storedConfiguration.claimMapping)).toBe(Object.prototype)
+		expect(Object.prototype.hasOwnProperty.call(storedConfiguration.claimMapping, '__proto__')).toBe(false)
+	})
+})

package/tests/cases/unit/idp/idpManagerUnknownConfigKeys.test.ts

@@ -0,0 +1,101 @@
+import { describe, expect, test } from 'bun:test'
+import { IDPHandlerRegistry, IDPManager } from '../../../../src/model/service/idp/index.js'
+import { OIDCProvider } from '../../../../src/model/service/idp/providers/OIDCProvider.js'
+import { DatabaseContext } from '../../../../src/index.js'
+
+// Provider configurations are parsed with `Typesafe.partial`, which DROPS unknown properties. Without a
+// write-time guard, `addIDP` / `updateIDP` answer `ok` to a configuration the provider will never act on:
+// a typo such as `fetchUserinfo` (lowercase i) reads as an applied setting while the option stays off.
+// These pin the rejection. `OIDCProvider.validateConfiguration` is pure Typesafe parsing (no discovery,
+// no network), so the real provider can be used here rather than a pass-through double.
+
+const OIDC_BASE = { url: 'https://idp.example.com', clientId: 'client', clientSecret: 'secret' }
+const OPTIONS = { autoSignUp: false, exclusive: false, initReturnsConfig: false, requireVerifiedEmail: false, assumeEmailVerified: false }
+
+const makeManager = () => {
+	const registry = new IDPHandlerRegistry()
+	registry.registerHandler('oidc', new OIDCProvider())
+	return new IDPManager(registry, { getSchema: () => Promise.resolve(undefined) })
+}
+
+/** `existing` undefined ⇒ no IdP with that slug yet (the addIDP path). */
+const makeDb = (existing?: Record<string, unknown>) => {
+	const executed: unknown[] = []
+	const inner: any = {
+		queryHandler: {
+			fetch: async () => existing ? { id: 'idp-1', slug: 'sso', type: 'oidc', configuration: existing, disabledAt: null } : undefined,
+		},
+		commandBus: { execute: async (command: unknown) => void executed.push(command) },
+	}
+	inner.transaction = async (cb: (db: any) => Promise<unknown>) => cb(inner)
+	return { db: inner as unknown as DatabaseContext, executed }
+}
+
+describe('IDPManager — unknown configuration keys', () => {
+	test('addIDP rejects a key the provider would silently ignore', async () => {
+		const { db, executed } = makeDb()
+		const response = await makeManager().addIDP(db, {
+			slug: 'sso',
+			type: 'oidc',
+			// `fetchUserinfo` is a plausible typo of `fetchUserInfo`; before the guard this returned ok
+			// and left the option off.
+			configuration: { ...OIDC_BASE, fetchUserinfo: true },
+			options: OPTIONS,
+		})
+
+		expect(response.ok).toBe(false)
+		expect(response.ok === false && response.error).toBe('INVALID_CONFIGURATION')
+		expect(response.ok === false && response.errorMessage).toContain('fetchUserinfo')
+		// nothing was written
+		expect(executed).toHaveLength(0)
+	})
+
+	test('reports every unknown key at once, so several typos take one round trip', async () => {
+		const { db } = makeDb()
+		const response = await makeManager().addIDP(db, {
+			slug: 'sso',
+			type: 'oidc',
+			configuration: { ...OIDC_BASE, fetchUserinfo: true, tokenEndpointAuthMethd: 'client_secret_post' },
+			options: OPTIONS,
+		})
+
+		expect(response.ok).toBe(false)
+		const message = response.ok === false ? response.errorMessage ?? '' : ''
+		expect(message).toContain('fetchUserinfo')
+		expect(message).toContain('tokenEndpointAuthMethd')
+	})
+
+	test('a configuration the provider fully understands still passes', async () => {
+		const { db, executed } = makeDb()
+		const response = await makeManager().addIDP(db, {
+			slug: 'sso',
+			type: 'oidc',
+			configuration: { ...OIDC_BASE, scope: 'openid email', fetchUserInfo: true },
+			options: OPTIONS,
+		})
+
+		expect(response.ok).toBe(true)
+		expect(executed).toHaveLength(1)
+	})
+
+	test('updateIDP rejects an unknown key in the MERGED result, not just in the patch', async () => {
+		const { db, executed } = makeDb(OIDC_BASE)
+		const response = await makeManager().updateIDP(db, 'sso', { configuration: { fetchUserinfo: true } }, true)
+
+		expect(response.ok).toBe(false)
+		expect(response.ok === false && response.error).toBe('INVALID_CONFIGURATION')
+		expect(response.ok === false && response.errorMessage).toContain('fetchUserinfo')
+		expect(executed).toHaveLength(0)
+	})
+
+	test('an update that does not touch the configuration is not re-validated', async () => {
+		// A row written before this guard may hold keys the provider ignores. Toggling something else
+		// about it must not become impossible — the guard is a write-time check on a submitted
+		// configuration, not a re-validation of what is already stored.
+		const { db, executed } = makeDb({ ...OIDC_BASE, legacyIgnoredKey: true })
+		const response = await makeManager().updateIDP(db, 'sso', { options: { autoSignUp: true } }, false)
+
+		expect(response.ok).toBe(true)
+		expect(executed).toHaveLength(1)
+	})
+})