@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-mfa/__tests__/mfa-preauth-setup-token.test.ts

@@ -0,0 +1,113 @@
+import { describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
+import { signMfaChallengeToken, verifyMfaChallengeToken } from "../mfa-challenge-token";
+import { signMfaPreauthSetupToken, verifyMfaPreauthSetupToken } from "../mfa-preauth-setup-token";
+
+const SECRET = "test-mfa-preauth-setup-secret-at-least-32-bytes!!";
+const USER_ID = "11111111-1111-4111-8111-111111111111";
+const TENANT_ID = "22222222-2222-4222-8222-222222222222";
+
+describe("mfa-preauth-setup-token", () => {
+  test("round-trip: sign → verify → payload", () => {
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    const result = verifyMfaPreauthSetupToken(token, SECRET);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.payload).toEqual({ userId: USER_ID, tenantId: TENANT_ID });
+    }
+  });
+
+  test("cross-domain replay from a challenge-shaped signature is rejected", () => {
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    const [bodyB64] = token.split(".");
+    const forged = `${bodyB64}.${Buffer.from("not-the-real-signature-bytes").toString("base64url")}`;
+    expect(verifyMfaPreauthSetupToken(forged, SECRET)).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  test("a genuine mfa-challenge token cannot be replayed as a preauth-setup token, and vice versa", () => {
+    // Both bodies share the identical JSON shape ({userId, tenantId,
+    // expiresAtMs}), so this only fails if the domain-separated signing
+    // string (`mfa-challenge:` vs `mfa-preauth-setup:`) actually differs.
+    const { token: challengeToken } = signMfaChallengeToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    expect(verifyMfaPreauthSetupToken(challengeToken, SECRET)).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+
+    const { token: setupToken } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    expect(verifyMfaChallengeToken(setupToken, SECRET)).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  test("tampered signature → bad_signature", () => {
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    const tampered = `${token.slice(0, -3)}XXX`;
+    expect(verifyMfaPreauthSetupToken(tampered, SECRET)).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  test("different secret → bad_signature", () => {
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    expect(verifyMfaPreauthSetupToken(token, "other-secret-not-the-same-one!!!!")).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  test("expired → expired", () => {
+    const t0 = Temporal.Instant.fromEpochMilliseconds(1_700_000_000_000);
+    const laterThanTtl = t0.add({ minutes: 11 });
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+      t0,
+    );
+    expect(verifyMfaPreauthSetupToken(token, SECRET, laterThanTtl)).toEqual({
+      ok: false,
+      reason: "expired",
+    });
+  });
+
+  test("malformed: wrong part count", () => {
+    expect(verifyMfaPreauthSetupToken("not-a-token", SECRET)).toEqual({
+      ok: false,
+      reason: "malformed",
+    });
+    expect(verifyMfaPreauthSetupToken("a.b.c", SECRET)).toEqual({
+      ok: false,
+      reason: "malformed",
+    });
+  });
+});

package/src/auth-mfa/__tests__/no-redis.integration.test.ts

@@ -0,0 +1,209 @@
+// #1467: verify / enable-confirm / enable-confirm-preauth used to silently
+// skip their brute-force cap and single-use burn when ctx.redis was
+// unavailable, instead of failing closed. Real HTTP through setupTestStack
+// with redis explicitly unwired (same pattern as
+// auth-email-password/__tests__/account-lockout-no-redis.integration.test.ts),
+// asserting each handler now returns an internal_error instead of silently
+// degrading and continuing to the TOTP check.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import {
+  configureEntityFieldEncryption,
+  createEventStoreExecutor,
+  createTenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  type SessionUser,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user/feature";
+import { base32Encode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { signMfaChallengeToken } from "../mfa-challenge-token";
+import { signMfaSetupToken } from "../mfa-setup-token";
+import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa";
+import { generateTotpSecret } from "../totp";
+
+let stack: TestStack;
+
+const CHALLENGE_TOKEN_SECRET = "no-redis-test-challenge-token-secret-not-real-0001";
+const SETUP_TOKEN_SECRET = "no-redis-test-setup-token-secret-not-real-0002";
+const TENANT_ID: TenantId = testTenantId(421);
+
+// Mirrors framework's auth-routes.ts GUEST_USER — verify/enable-confirm-preauth
+// are guest-callable (access: { roles: ["all"] }), the real identity comes
+// entirely from the signed token, not from this dispatch-level user.
+const GUEST_USER: SessionUser = {
+  id: "00000000-0000-0000-0000-000000000000",
+  tenantId: SYSTEM_TENANT_ID,
+  roles: ["all"],
+};
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+      }),
+    ],
+    // extraContext runs after the default `redis: testRedis.redis` spread —
+    // setting redis:undefined here overrides it on the handler-facing
+    // AppContext (see account-lockout-no-redis.integration.test.ts).
+    extraContext: () => ({
+      configResolver: resolver,
+      configEncryption: encryption,
+      redis: undefined,
+    }),
+  });
+
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+// disable/regenerate-recovery are session-authed and only reachable once
+// MFA is already enabled — but enable-confirm itself now requires
+// ctx.redis (#1467), so it can't run against this no-redis stack to seed
+// the row. Insert the row directly via the same executor.create the
+// handler uses, bypassing the HTTP layer entirely (irrelevant to what
+// this test is pinning: the handler's own ctx.redis gate).
+const userMfaExecutor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
+  entityName: "user-mfa",
+});
+
+async function seedEnabledMfa(user: SessionUser): Promise<void> {
+  const tdb = createTenantDb(stack.db, user.tenantId, "system");
+  const result = await userMfaExecutor.create(
+    {
+      userId: user.id,
+      totpSecret: base32Encode(generateTotpSecret()),
+      recoveryCodes: encodeRecoveryCodes([]),
+      enabledAt: Temporal.Now.instant(),
+      lastUsedAt: null,
+    },
+    user,
+    tdb,
+  );
+  if (!result.isSuccess) throw new Error(`seedEnabledMfa failed: ${result.error.code}`);
+}
+
+describe("auth-mfa handlers — ctx.redis unset (#1467)", () => {
+  test("verify: fails closed with internal_error instead of skipping the brute-force cap/burn", async () => {
+    const user = createTestUser({ tenantId: TENANT_ID });
+    const { token } = signMfaChallengeToken(
+      { userId: user.id, tenantId: TENANT_ID },
+      5,
+      CHALLENGE_TOKEN_SECRET,
+    );
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.verify,
+      { challengeToken: token, code: "123456" },
+      GUEST_USER,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+
+  test("enable-confirm-preauth: fails closed with internal_error instead of skipping the brute-force cap/burn", async () => {
+    const user = createTestUser({ tenantId: TENANT_ID });
+    const { token } = signMfaSetupToken(
+      {
+        userId: user.id,
+        tenantId: TENANT_ID,
+        totpSecretBase32: base32Encode(generateTotpSecret()),
+        recoveryCodeHashes: [],
+      },
+      5,
+      SETUP_TOKEN_SECRET,
+    );
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.enableConfirmPreauth,
+      { setupToken: token, code: "123456" },
+      GUEST_USER,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+
+  test("enable-confirm: fails closed with internal_error instead of skipping the single-use burn", async () => {
+    const user = createTestUser({ tenantId: TENANT_ID });
+    const { token } = signMfaSetupToken(
+      {
+        userId: user.id,
+        totpSecretBase32: base32Encode(generateTotpSecret()),
+        recoveryCodeHashes: [],
+      },
+      5,
+      SETUP_TOKEN_SECRET,
+    );
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: token, code: "123456" },
+      user,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+
+  // kumiko-framework#1534: disable/regenerate-recovery used to keep the
+  // old two-factor-authenticate-then-verify flow working even without
+  // ctx.redis (verifyMfaFactor's replay-burn silently no-ops), so an
+  // observed TOTP code could be replayed within the ±1-step window against
+  // a session-authed route — unlike verify/enable-confirm-preauth, no
+  // guest-token expiry limits the attack window.
+  test("disable: fails closed with internal_error instead of skipping TOTP replay protection", async () => {
+    const user = createTestUser({ id: 501, tenantId: TENANT_ID });
+    await seedEnabledMfa(user);
+
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "123456" }, user);
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+
+  test("regenerate-recovery: fails closed with internal_error instead of skipping TOTP replay protection", async () => {
+    const user = createTestUser({ id: 502, tenantId: TENANT_ID });
+    await seedEnabledMfa(user);
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.regenerateRecovery,
+      { code: "123456" },
+      user,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+});

package/src/auth-mfa/__tests__/pii-subject-encryption.integration.test.ts

@@ -0,0 +1,139 @@
+// Regression test for a real crash found via manual browser testing in a
+// consumer app (kumiko-studio) that mounts the full GDPR/user-data-rights
+// stack: totpSecret and recoveryCodes are both `encrypted: true` +
+// `userOwned` (schema/user-mfa.ts) — the SECOND layer (per-subject
+// crypto-shredding, entity-field-encryption.ts's sibling pipeline) only
+// activates when `configurePiiSubjectKms` has been called, which none of
+// the other auth-mfa integration tests do. That gap let a real bug ship:
+// recoveryCodes used to be a `createJsonbField` (an object, not a string),
+// and `encryptPiiFieldValues` throws "PII field must be a string" for any
+// non-string userOwned field. enable-confirm failed for EVERY real deployment
+// with crypto-shredding configured, while every test here stayed green.
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+let stack: TestStack;
+
+const SETUP_TOKEN_SECRET = "test-setup-token-secret-do-not-use-in-prod";
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+// The second, independent encryption layer — same activation recipe as
+// crypto-shredding/__tests__/forget-subject.integration.test.ts.
+beforeEach(() => {
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+describe("with per-subject PII crypto-shredding active", () => {
+  test("enable-confirm succeeds and persists both totpSecret and recoveryCodes", async () => {
+    const user = createTestUser({ id: "pii-enable-1", roles: ["User"] });
+
+    const start = await stack.http.writeOk<{
+      setupToken: string;
+      otpauthUri: string;
+      recoveryCodes: string[];
+    }>(AuthMfaHandlers.enableStart, { accountLabel: "pii-enable@example.com" }, user);
+
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+
+    const confirmed = await stack.http.writeOk<{ enabled: boolean }>(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+    expect(confirmed.enabled).toBe(true);
+
+    // recoveryCodes round-trips through both encryption layers correctly —
+    // a recovery code (not just the TOTP code) still authenticates.
+    const disableRes = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: start.recoveryCodes[0] },
+      user,
+    );
+    expect(disableRes.disabled).toBe(true);
+  });
+
+  test("regenerate-recovery re-encrypts the new codes without crashing", async () => {
+    const user = createTestUser({ id: "pii-regen-1", roles: ["User"] });
+
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "pii-regen@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    const regenerated = await stack.http.writeOk<{ recoveryCodes: string[] }>(
+      AuthMfaHandlers.regenerateRecovery,
+      { code: currentTotpCode(secret) },
+      user,
+    );
+    expect(regenerated.recoveryCodes).toHaveLength(8);
+
+    const disableRes = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: regenerated.recoveryCodes[0] },
+      user,
+    );
+    expect(disableRes.disabled).toBe(true);
+  });
+});