@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-mfa/verify-factor.ts

@@ -0,0 +1,58 @@
+import type Redis from "ioredis";
+import { burnToken } from "../shared";
+import { base32Decode } from "./base32";
+import type { UserMfaRow } from "./db/queries";
+import { findMatchingRecoveryCodeIndex } from "./recovery-codes";
+import { STEP_SECONDS, verifyTotp } from "./totp";
+
+export type MfaFactorVerifyResult =
+  | { readonly ok: true; readonly method: "totp" }
+  | { readonly ok: true; readonly method: "recovery"; readonly remainingHashes: readonly string[] }
+  | { readonly ok: false };
+
+// Shared by disable/regenerate-recovery (and later /auth/mfa/verify): tries
+// TOTP first (cheap HMAC), falls back to recovery codes (argon2, slower —
+// this is the rare path) only when the code isn't a valid TOTP. Callers
+// that get `method: "recovery"` must persist `remainingHashes` as the new
+// recoveryCodes.hashes — the matched code is single-use and already
+// excluded from the returned array.
+//
+// `replay` opts into TOTP-counter burn (RFC 6238 §5.2: an accepted code
+// must not verify again within its ±1-step window — otherwise a code an
+// attacker observed once, via phishing proxy or shoulder-surfing, stays
+// usable for ~90s of parallel logins). Omitted where a caller has no
+// ctx.redis available; the code-verify itself still works, just without
+// replay protection for that call.
+export async function verifyMfaFactor(
+  row: UserMfaRow,
+  code: string,
+  replay?: { readonly redis: Redis; readonly userId: string },
+): Promise<MfaFactorVerifyResult> {
+  const secret = base32Decode(row.totpSecret);
+  const counter = verifyTotp(secret, code);
+  if (counter !== false) {
+    if (replay) {
+      // Burn keyed by (userId, row.id, counter) — row.id, not just userId,
+      // because disable+re-enable creates a fresh aggregate with a new
+      // secret: two different secrets can hash to the same counter/step,
+      // and without row.id in the key a burn from the OLD secret would
+      // spuriously reject a fresh code under the NEW one. The counter's
+      // own step-expiry doubles as the burn marker's TTL, so it
+      // self-evicts once the code itself would have expired anyway — same
+      // mechanism as burnToken's HMAC-token callers, just with a synthetic
+      // expiresAtMs.
+      const expiresAtMs = (counter + 1) * STEP_SECONDS * 1000;
+      const burnUserId = `${replay.userId}:${row.id}`;
+      const burned = await burnToken(replay.redis, "mfa-totp", burnUserId, expiresAtMs);
+      if (burned === "already-used") return { ok: false };
+    }
+    return { ok: true, method: "totp" };
+  }
+
+  const hashes = row.recoveryCodes.hashes;
+  const matchIndex = await findMatchingRecoveryCodeIndex(code, hashes);
+  if (matchIndex === -1) return { ok: false };
+
+  const remainingHashes = hashes.filter((_, i) => i !== matchIndex);
+  return { ok: true, method: "recovery", remainingHashes };
+}

package/src/auth-mfa/web/__tests__/mfa-client.test.ts

@@ -0,0 +1,265 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { confirmMfaSetupPreauth, startMfaSetupPreauth, verifyMfaChallenge } from "../mfa-client";
+
+const originalFetch = globalThis.fetch;
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status });
+}
+
+describe("verifyMfaChallenge", () => {
+  test("posts challengeToken + code to /api/auth/mfa/verify", async () => {
+    const fetchMock = mock(async () =>
+      jsonResponse({ isSuccess: true, token: "t", user: { id: "u1", tenantId: "t1", roles: [] } }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    await verifyMfaChallenge("challenge-1", "123456");
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/auth/mfa/verify",
+      expect.objectContaining({
+        method: "POST",
+        credentials: "same-origin",
+        body: JSON.stringify({ challengeToken: "challenge-1", code: "123456" }),
+      }),
+    );
+  });
+
+  test("success → kind:success mit token+user", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: true,
+        token: "test-token",
+        user: { id: "u1", tenantId: "t1", roles: ["Admin"] },
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "123456");
+
+    expect(res).toEqual({
+      kind: "success",
+      data: { token: "test-token", user: { id: "u1", tenantId: "t1", roles: ["Admin"] } },
+    });
+  });
+
+  test("HTTP 429 → kind:failure reason:rate_limited (ohne Body-Parse)", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "rate_limited" } });
+  });
+
+  test("error als String → kind:failure reason:<string>", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: "invalid_totp_code" }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "invalid_totp_code" } });
+  });
+
+  test("error-Objekt mit details.reason → reason aus details, message+retryAfterSeconds übernommen", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: false,
+        error: {
+          code: "mfa_verify_failed",
+          message: "too many attempts",
+          details: { reason: "too_many_attempts", retryAfterSeconds: 60 },
+        },
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({
+      kind: "failure",
+      error: { reason: "too_many_attempts", message: "too many attempts", retryAfterSeconds: 60 },
+    });
+  });
+
+  test("error-Objekt ohne details.reason → fällt auf error.code zurück", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: { code: "invalid_challenge_token" } }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "invalid_challenge_token" } });
+  });
+
+  test("kein error-Feld, kein isSuccess → default reason mfa_verify_failed", async () => {
+    globalThis.fetch = mock(async () => jsonResponse({})) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "mfa_verify_failed" } });
+  });
+
+  test("kaputtes JSON → leeres Body-Objekt, default reason", async () => {
+    globalThis.fetch = mock(
+      async () => new Response("not json", { status: 200 }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "mfa_verify_failed" } });
+  });
+});
+
+describe("startMfaSetupPreauth", () => {
+  test("posts preauthSetupToken + accountLabel to /api/auth/mfa/preauth-enable-start", async () => {
+    const fetchMock = mock(async () =>
+      jsonResponse({
+        isSuccess: true,
+        setupToken: "setup-1",
+        otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD&issuer=App",
+        recoveryCodes: ["r1", "r2"],
+      }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    await startMfaSetupPreauth("preauth-1", "user@example.com");
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/auth/mfa/preauth-enable-start",
+      expect.objectContaining({
+        method: "POST",
+        credentials: "same-origin",
+        body: JSON.stringify({ preauthSetupToken: "preauth-1", accountLabel: "user@example.com" }),
+      }),
+    );
+  });
+
+  test("success → kind:success mit setupToken/otpauthUri/recoveryCodes", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: true,
+        setupToken: "setup-1",
+        otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD&issuer=App",
+        recoveryCodes: ["r1", "r2"],
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await startMfaSetupPreauth("preauth-1", "user@example.com");
+
+    expect(res).toEqual({
+      kind: "success",
+      data: {
+        setupToken: "setup-1",
+        otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD&issuer=App",
+        recoveryCodes: ["r1", "r2"],
+      },
+    });
+  });
+
+  test("HTTP 429 → kind:failure reason:rate_limited", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    const res = await startMfaSetupPreauth("preauth-1", "user@example.com");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "rate_limited" } });
+  });
+
+  test("error als String → kind:failure reason:<string>", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: "invalid_challenge_token" }),
+    ) as unknown as typeof fetch;
+
+    const res = await startMfaSetupPreauth("preauth-1", "user@example.com");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "invalid_challenge_token" } });
+  });
+
+  test("error-Objekt ohne details.reason → fällt auf error.code zurück", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: { code: "mfa_already_enabled" } }),
+    ) as unknown as typeof fetch;
+
+    const res = await startMfaSetupPreauth("preauth-1", "user@example.com");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "mfa_already_enabled" } });
+  });
+});
+
+describe("confirmMfaSetupPreauth", () => {
+  test("posts setupToken + code to /api/auth/mfa/preauth-confirm", async () => {
+    const fetchMock = mock(async () =>
+      jsonResponse({ isSuccess: true, token: "t", user: { id: "u1", tenantId: "t1", roles: [] } }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    await confirmMfaSetupPreauth("setup-1", "123456");
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/auth/mfa/preauth-confirm",
+      expect.objectContaining({
+        method: "POST",
+        credentials: "same-origin",
+        body: JSON.stringify({ setupToken: "setup-1", code: "123456" }),
+      }),
+    );
+  });
+
+  test("success → kind:success mit token+user", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: true,
+        token: "test-token",
+        user: { id: "u1", tenantId: "t1", roles: ["User"] },
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await confirmMfaSetupPreauth("setup-1", "123456");
+
+    expect(res).toEqual({
+      kind: "success",
+      data: { token: "test-token", user: { id: "u1", tenantId: "t1", roles: ["User"] } },
+    });
+  });
+
+  test("HTTP 429 → kind:failure reason:rate_limited", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    const res = await confirmMfaSetupPreauth("setup-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "rate_limited" } });
+  });
+
+  test("error-Objekt mit details.reason → reason + retryAfterSeconds übernommen", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: false,
+        error: {
+          code: "mfa_setup_confirm_failed",
+          details: { reason: "too_many_attempts", retryAfterSeconds: 30 },
+        },
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await confirmMfaSetupPreauth("setup-1", "000000");
+
+    expect(res).toEqual({
+      kind: "failure",
+      error: { reason: "too_many_attempts", retryAfterSeconds: 30 },
+    });
+  });
+});

package/src/auth-mfa/web/__tests__/mfa-enable-screen.test.tsx

@@ -0,0 +1,182 @@
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { makeSessionApi } from "../../../auth-email-password/web/__tests__/test-utils";
+import { SessionContext } from "../../../auth-email-password/web/session";
+import { defaultTranslations } from "../i18n";
+
+type WriteResult =
+  | { readonly isSuccess: true; readonly data: unknown }
+  | { readonly isSuccess: false; readonly error: { readonly i18nKey: string } };
+
+const dispatchSpy = mock<() => Promise<WriteResult>>(async () => ({
+  isSuccess: true,
+  data: {
+    setupToken: "setup-token-1",
+    otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD1234&issuer=App",
+    recoveryCodes: ["code-1", "code-2"],
+  },
+}));
+
+const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
+mock.module("@cosmicdrift/kumiko-renderer", () => ({
+  ...actual_renderer,
+  useDispatcher: mock(() => ({ write: dispatchSpy, query: mock(), batch: mock() })),
+}));
+
+mock.module("qrcode/lib/browser", () => ({
+  default: { toString: mock(async () => "<svg></svg>") },
+}));
+
+// bun's mock.module is process-global and outlives this file — without
+// restoring it, any later suite in the same test run that needs the real
+// useDispatcher from @cosmicdrift/kumiko-renderer silently gets this mock
+// instead (green-by-accident or a confusing foreign-suite failure,
+// depending on test order).
+afterAll(() => {
+  mock.module("@cosmicdrift/kumiko-renderer", () => actual_renderer);
+});
+
+const { MfaEnableScreen } = await import("../mfa-enable-screen");
+
+const session = makeSessionApi();
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <PrimitivesProvider value={defaultPrimitives}>
+      <LocaleProvider
+        resolver={createStaticLocaleResolver({ locale: "de" })}
+        fallbackBundles={[defaultTranslations]}
+      >
+        <SessionContext.Provider value={session}>{children}</SessionContext.Provider>
+      </LocaleProvider>
+    </PrimitivesProvider>
+  );
+}
+
+beforeEach(() => {
+  dispatchSpy.mockClear();
+});
+
+describe("MfaEnableScreen", () => {
+  test("rendert Intro + Start-Button, kein Setup-Bereich vor dem Start", () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+    expect(screen.getByText("Zwei-Faktor-Authentifizierung")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Einrichtung starten" })).toBeTruthy();
+    expect(screen.queryByLabelText("Code aus der Authenticator-App")).toBeNull();
+  });
+
+  test("Start-Klick → dispatcher.write ruft enable-start, danach Setup-Bereich mit Secret + Recovery-Codes", async () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+
+    await waitFor(() => {
+      expect(dispatchSpy).toHaveBeenCalledWith(
+        "auth-mfa:write:enable-start",
+        expect.objectContaining({ accountLabel: "user@example.com" }),
+      );
+    });
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    expect(screen.getByText(/code-1/)).toBeTruthy();
+    expect(screen.getByText(/code-2/)).toBeTruthy();
+  });
+
+  test("Bestätigen-Button bleibt disabled bis Recovery-Codes bestätigt + 6-stelliger Code eingegeben", async () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+
+    const confirm = screen.getByRole("button", { name: "Aktivieren" }) as HTMLButtonElement;
+    expect(confirm.disabled).toBe(true);
+
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    expect(confirm.disabled).toBe(true);
+
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+    expect(confirm.disabled).toBe(false);
+  });
+
+  test("Bestätigen → dispatcher.write ruft enable-confirm, danach Success-Banner", async () => {
+    dispatchSpy
+      .mockImplementationOnce(async () => ({
+        isSuccess: true,
+        data: {
+          setupToken: "setup-token-1",
+          otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD1234&issuer=App",
+          recoveryCodes: ["code-1", "code-2"],
+        },
+      }))
+      .mockImplementationOnce(async () => ({ isSuccess: true, data: undefined }));
+    const onEnabled = mock(() => {});
+    render(
+      <Wrapper>
+        <MfaEnableScreen onEnabled={onEnabled} />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: "Aktivieren" }));
+
+    await waitFor(() => {
+      expect(dispatchSpy).toHaveBeenCalledWith(
+        "auth-mfa:write:enable-confirm",
+        expect.objectContaining({ setupToken: "setup-token-1", code: "123456" }),
+      );
+    });
+    await waitFor(() => {
+      expect(screen.getByText("Zwei-Faktor-Authentifizierung ist jetzt aktiv.")).toBeTruthy();
+      expect(onEnabled).toHaveBeenCalled();
+    });
+  });
+
+  test("enable-start schlägt fehl → übersetztes Fehler-Banner, kein Setup-Bereich", async () => {
+    dispatchSpy.mockImplementationOnce(async () => ({
+      isSuccess: false,
+      error: { i18nKey: "auth.mfa.errors.mfaAlreadyEnabled" },
+    }));
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Zwei-Faktor-Authentifizierung ist bereits aktiv.")).toBeTruthy();
+    });
+    expect(screen.queryByText("ABCD1234")).toBeNull();
+  });
+});