@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-mfa/__tests__/reencrypt-job.integration.test.ts

@@ -0,0 +1,247 @@
+// KEK-rotation job for kumiko-framework#266 Step 8. Proves two things:
+//
+//   1. The job actually rewraps totpSecret onto the current KEK version.
+//   2. Advisor-flagged trap: rotation must not just touch the live
+//      projection — a FULL PROJECTION REBUILD after rotation must still
+//      decrypt correctly. Events store CIPHERTEXT (see #967 — "the
+//      immutable log never sees plaintext, replay reproduces the row
+//      byte-identically"), so a rebuild replays events in order and lands
+//      on the LATEST event's ciphertext. That's only true if the rotation
+//      job goes through executor.update() (which appends a real event)
+//      instead of a raw UPDATE on the projection table — this test is the
+//      regression guard for that specific design choice.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  createEnvelopeCipher,
+  createEnvMasterKeyProvider,
+} from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createMutableMasterKeyProvider } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { mfaReencryptJob } from "../handlers/reencrypt.job";
+import { userMfaEntity, userMfaTable } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+const SETUP_TOKEN_SECRET = "test-setup-token-secret-do-not-use-in-prod";
+const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
+
+let stack: TestStack;
+const v1Key = randomBytes(32).toString("base64");
+const v2Key = randomBytes(32).toString("base64");
+const mutableProvider = createMutableMasterKeyProvider(
+  createEnvMasterKeyProvider({
+    env: {
+      KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+    },
+  }),
+);
+
+beforeAll(async () => {
+  const cipher = createEnvelopeCipher(mutableProvider, {});
+  configureEntityFieldEncryption(cipher);
+  const resolver = createConfigResolver({ cipher });
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+      }),
+    ],
+    masterKeyProvider: mutableProvider,
+    extraContext: { configResolver: resolver, configEncryption: cipher },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+type RawUserMfaRow = { id: string; totpSecret: string; version: number };
+
+async function readRawRow(): Promise<RawUserMfaRow> {
+  const rows = await selectMany<RawUserMfaRow>(stack.db, userMfaTable, {});
+  const row = rows[0];
+  if (!row) throw new Error("no user-mfa row");
+  return row;
+}
+
+const noopLog = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  debug: () => {},
+  child: () => noopLog,
+};
+
+function jobCtx(): AppContext {
+  return {
+    db: stack.db,
+    registry: stack.registry,
+    masterKeyProvider: mutableProvider,
+    log: noopLog,
+  } as AppContext; // @cast-boundary test-seam — job only reads db/registry/masterKeyProvider/log
+}
+
+describe("auth-mfa KEK-rotation job — kumiko-framework#266 Step 8", () => {
+  test("rotation rewraps totpSecret onto the current KEK, and a full projection rebuild still decrypts correctly", async () => {
+    const user = createTestUser({ id: 1, roles: ["User"] });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "user-1@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    const beforeRow = await readRawRow();
+    expect(JSON.parse(beforeRow.totpSecret).kekVersion).toBe(1);
+
+    // Simulate "ops added a new master key version and flipped CURRENT=2" —
+    // same simulate-rotation-without-restart helper secrets/rotate uses.
+    mutableProvider.replace(
+      createEnvMasterKeyProvider({
+        env: {
+          KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+          KUMIKO_SECRETS_MASTER_KEY_V2: v2Key,
+          KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "2",
+        },
+      }),
+    );
+
+    await mfaReencryptJob({}, jobCtx());
+
+    const afterJobRow = await readRawRow();
+    expect(JSON.parse(afterJobRow.totpSecret).kekVersion).toBe(2);
+
+    // The regression guard: rebuild the projection from scratch (replays
+    // every event for this aggregate) and confirm it still lands on the
+    // V2 envelope — NOT a resurrected V1 wrap from the original
+    // enable-confirm event.
+    await rebuildProjection("auth-mfa:projection:user-mfa-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+
+    const afterRebuildRow = await readRawRow();
+    expect(JSON.parse(afterRebuildRow.totpSecret).kekVersion).toBe(2);
+
+    // Decrypt-level proof, not just the version tag: a valid TOTP code
+    // against the post-rebuild secret still verifies — the plaintext
+    // survived rotation + rebuild byte-identically. disable() decrypts
+    // totpSecret to check the code, so a decrypt failure (wrong key)
+    // would surface here as invalid_totp_code or a hard error, not a
+    // silent pass.
+    await stack.http.writeOk(AuthMfaHandlers.disable, { code: currentTotpCode(secret) }, user);
+  });
+});
+
+describe("auth-mfa KEK-rotation job — unrecognized values are not silently skipped (kumiko-framework#1541)", () => {
+  test("a non-envelope totpSecret is counted failed, never alreadyCurrent, and is left untouched", async () => {
+    // Reset provider to V1 so a freshly-enabled row is "current" (nothing to
+    // rotate) — the garbage field is the only failure we expect.
+    mutableProvider.replace(
+      createEnvMasterKeyProvider({
+        env: {
+          KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+          KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+        },
+      }),
+    );
+
+    const user = createTestUser({ id: 2, roles: ["User"] });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "user-2@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    const beforeRow = await readRawRow();
+    const garbage = "not-a-stored-envelope";
+    await asRawClient(stack.db).unsafe(`UPDATE read_user_mfa SET totp_secret = $1 WHERE id = $2`, [
+      garbage,
+      beforeRow.id,
+    ]);
+
+    type CapturedLog = { info: string[]; warn: string[] };
+    const captured: CapturedLog = { info: [], warn: [] };
+    const capturingLog = {
+      info: (msg: string) => {
+        captured.info.push(msg);
+      },
+      warn: (msg: string) => {
+        captured.warn.push(msg);
+      },
+      error: () => {},
+      debug: () => {},
+      child: () => capturingLog,
+    };
+
+    await mfaReencryptJob({}, {
+      db: stack.db,
+      registry: stack.registry,
+      masterKeyProvider: mutableProvider,
+      log: capturingLog,
+    } as AppContext);
+
+    const completeLine = captured.info.find((line) =>
+      line.includes("[auth-mfa:reencrypt] complete:"),
+    );
+    if (!completeLine) throw new Error("job did not log a completion summary");
+    const result = JSON.parse(completeLine.slice(completeLine.indexOf("{"))) as {
+      migrated: number;
+      failed: number;
+      alreadyCurrent: number;
+    };
+    expect(result.migrated).toBe(0);
+    expect(result.failed).toBe(1);
+    expect(result.alreadyCurrent).toBe(0);
+
+    const rejectedWarning = captured.warn.find((line) =>
+      line.includes("not a current-cipher envelope"),
+    );
+    expect(rejectedWarning).toBeDefined();
+
+    const afterRow = await readRawRow();
+    expect(afterRow.totpSecret).toBe(garbage);
+  });
+});

package/src/auth-mfa/__tests__/session-auto-revoke.integration.test.ts

@@ -0,0 +1,169 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
+import { createSessionCallbacks } from "../../sessions/session-callbacks";
+import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { bindMfaRevokeAllOtherSessionsFromFeature, createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+// Enable/disable/regenerate are security-relevant state changes on the
+// account — every OTHER live session must be signed out (stolen-session
+// defense), but the session that performed the change must survive.
+
+let stack: TestStack;
+let sessionCallbacks: ReturnType<typeof createSessionCallbacks>;
+
+const SETUP_TOKEN_SECRET = "test-mfa-setup-secret-at-least-32-bytes-long!!";
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const mfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+  });
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createUserFeature(), createTenantFeature(), mfaFeature],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+  });
+
+  sessionCallbacks = createSessionCallbacks({ db: stack.db });
+  const bind = bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature);
+  if (!bind) throw new Error("auth-mfa did not export bindRevokeAllOtherSessions");
+  bind(sessionCallbacks.sessionRevokeAllOthers);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
+});
+
+describe("session auto-revoke on MFA state changes", () => {
+  test("enable-confirm revokes every OTHER session but keeps the caller's", async () => {
+    const userId = "revoke-enable-1";
+    const currentSid = await sessionCallbacks.sessionCreator(createTestUser({ id: userId }), {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+    const otherSid = await sessionCallbacks.sessionCreator(createTestUser({ id: userId }), {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+
+    const user = createTestUser({ id: userId, sid: currentSid });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: `${userId}@example.com` },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
+    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("revoked");
+  });
+
+  test("disable revokes every OTHER session but keeps the caller's", async () => {
+    const userId = "revoke-disable-1";
+    const setupUser = createTestUser({ id: userId });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: `${userId}@example.com` },
+      setupUser,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      setupUser,
+    );
+
+    const currentSid = await sessionCallbacks.sessionCreator(setupUser, {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+    const otherSid = await sessionCallbacks.sessionCreator(setupUser, {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+
+    const caller = createTestUser({ id: userId, sid: currentSid });
+    await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(secret) },
+      caller,
+    );
+
+    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
+    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("revoked");
+  });
+
+  test("a failed disable attempt does NOT revoke any session", async () => {
+    const userId = "revoke-fail-1";
+    const setupUser = createTestUser({ id: userId });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: `${userId}@example.com` },
+      setupUser,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      setupUser,
+    );
+
+    const currentSid = await sessionCallbacks.sessionCreator(setupUser, {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+    const otherSid = await sessionCallbacks.sessionCreator(setupUser, {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+
+    const caller = createTestUser({ id: userId, sid: currentSid });
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "000000" }, caller);
+    expectErrorIncludes(err, "invalid_totp_code");
+
+    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
+    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("live");
+  });
+});

package/src/auth-mfa/__tests__/totp.test.ts

@@ -0,0 +1,131 @@
+import { describe, expect, test } from "bun:test";
+import { createHmac } from "node:crypto";
+import { base32Decode, base32Encode } from "../base32";
+import { buildOtpauthUri } from "../otpauth-uri";
+import { generateTotpSecret, verifyTotp } from "../totp";
+
+// RFC 6238 Appendix B test vectors use the ASCII secret "12345678901234567890"
+// (20 bytes) with SHA1 — the same algorithm this implementation hardcodes
+// (RFC 6238's SHA256/SHA512 variants are out of scope, matching every real
+// authenticator app which only speaks SHA1).
+const RFC_SECRET = Buffer.from("12345678901234567890", "ascii");
+
+// RFC 6238 Appendix B, SHA1 column: T=59s → code "94287082" (8-digit RFC
+// vector). This codebase computes 6-digit codes (Google Authenticator
+// convention) — take the last 6 digits, which is truncation-equivalent
+// since dynamic truncation just modulos a wider range.
+function rfcVectorCode8Digit(epochSeconds: number): string {
+  // Precomputed from RFC 6238 Appendix B for T=59.
+  if (epochSeconds === 59) return "94287082";
+  throw new Error("no precomputed vector for this timestamp");
+}
+
+describe("TOTP — RFC 6238 vectors", () => {
+  test("6-digit code at T=59 matches the last 6 digits of the RFC 8-digit vector", () => {
+    const expected8 = rfcVectorCode8Digit(59);
+    const expected6 = expected8.slice(-6);
+    expect(verifyTotp(RFC_SECRET, expected6, 59_000)).not.toBe(false);
+  });
+
+  test("rejects a code from a different time window (>±1 step)", () => {
+    const expected8 = rfcVectorCode8Digit(59);
+    const expected6 = expected8.slice(-6);
+    // 59s + 3 steps (90s) is outside the ±1 (±30s) window.
+    expect(verifyTotp(RFC_SECRET, expected6, 59_000 + 3 * 30_000)).toBe(false);
+  });
+
+  test("accepts a code one step in the past or future (clock drift)", () => {
+    const secret = generateTotpSecret();
+    const now = 1_700_000_000_000;
+    // now + 25s crosses the 30s step boundary (deliberately) — this exercises
+    // the ±1 window, not same-step reuse. See the ±2-steps negative test below
+    // for the window's upper bound.
+    const codeAtNow = deriveCodeForTest(secret, now);
+    expect(verifyTotp(secret, codeAtNow, now + 25_000)).not.toBe(false);
+  });
+
+  test("rejects a code two steps in the future (outside the ±1 window)", () => {
+    const secret = generateTotpSecret();
+    const now = 1_700_000_000_000;
+    const codeAtNow = deriveCodeForTest(secret, now);
+    expect(verifyTotp(secret, codeAtNow, now + 2 * 30_000 + 5_000)).toBe(false);
+  });
+
+  test("rejects wrong-length or non-numeric input without throwing", () => {
+    const secret = generateTotpSecret();
+    expect(verifyTotp(secret, "12345")).toBe(false);
+    expect(verifyTotp(secret, "1234567")).toBe(false);
+    expect(verifyTotp(secret, "abcdef")).toBe(false);
+    expect(verifyTotp(secret, "")).toBe(false);
+  });
+
+  test("generateTotpSecret returns 20 random, non-zero bytes", () => {
+    const a = generateTotpSecret();
+    const b = generateTotpSecret();
+    expect(a.length).toBe(20);
+    expect(a.equals(b)).toBe(false);
+    expect(a.some((byte) => byte !== 0)).toBe(true);
+  });
+});
+
+describe("base32", () => {
+  test("round-trips arbitrary byte buffers", () => {
+    for (const input of [
+      Buffer.from([]),
+      Buffer.from([0]),
+      Buffer.from([255]),
+      generateTotpSecret(),
+      Buffer.from("hello world", "ascii"),
+    ]) {
+      expect(base32Decode(base32Encode(input)).equals(input)).toBe(true);
+    }
+  });
+
+  test("decode is case-insensitive and tolerates stray whitespace", () => {
+    const encoded = base32Encode(Buffer.from("test-secret-bytes!!"));
+    expect(base32Decode(encoded.toLowerCase()).equals(base32Decode(encoded))).toBe(true);
+    expect(base32Decode(` ${encoded} `).equals(base32Decode(encoded))).toBe(true);
+  });
+
+  test("decode throws on a genuinely invalid character (e.g. punctuation)", () => {
+    expect(() => base32Decode("!!!not-valid-base32!!!")).toThrow();
+  });
+});
+
+describe("otpauth URI", () => {
+  test("builds a well-formed otpauth://totp URI with the expected params", () => {
+    const secret = generateTotpSecret();
+    const uri = buildOtpauthUri({
+      issuer: "Kumiko",
+      accountLabel: "acme:jane@example.com",
+      secret,
+    });
+    expect(uri).toStartWith("otpauth://totp/Kumiko%3Aacme%3Ajane%40example.com?");
+    const query = new URLSearchParams(uri.split("?")[1]);
+    expect(query.get("issuer")).toBe("Kumiko");
+    expect(query.get("algorithm")).toBe("SHA1");
+    expect(query.get("digits")).toBe("6");
+    expect(query.get("period")).toBe("30");
+    expect(base32Decode(query.get("secret") ?? "").equals(secret)).toBe(true);
+  });
+});
+
+// Internal helper mirroring the private `hotp`/`totpAt` math in totp.ts, kept
+// test-local so we don't have to export internals just for round-trip tests.
+function deriveCodeForTest(secret: Buffer, epochMs: number): string {
+  const step = Math.floor(epochMs / 1000 / 30);
+  // Re-implements the exact truncation from totp.ts's hotp() — duplicated
+  // deliberately: verifyTotp is the thing under test, so this must NOT call
+  // through it to derive its own expectation.
+  const counterBuf = Buffer.alloc(8);
+  counterBuf.writeUInt32BE(Math.floor(step / 2 ** 32), 0);
+  counterBuf.writeUInt32BE(step % 2 ** 32, 4);
+  const hmac = createHmac("sha1", secret).update(counterBuf).digest();
+  const offset = (hmac[hmac.length - 1] ?? 0) & 0x0f;
+  const truncated =
+    (((hmac[offset] ?? 0) & 0x7f) << 24) |
+    (((hmac[offset + 1] ?? 0) & 0xff) << 16) |
+    (((hmac[offset + 2] ?? 0) & 0xff) << 8) |
+    ((hmac[offset + 3] ?? 0) & 0xff);
+  return String(truncated % 10 ** 6).padStart(6, "0");
+}