@haverstack/server 0.8.0 → 0.9.1

package/tests/routes/auth.test.ts

@@ -1,448 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { generateDidKeypair } from '@haverstack/core/did';
-import { signAuthChallenge, base64urlEncode } from '@haverstack/core/wire';
-import type { DidKeypair } from '@haverstack/core/did';
-import {
-  buildTestApp,
-  req,
-  TEST_BASE_URL,
-  TEST_TOKEN,
-  OTHER_ENTITY_ID,
-  type TestApp,
-} from '../setup.js';
-
-const NOTE_TYPE_ID = 'com.example.test/note@1';
-
-async function challengeAndSign(
-  t: TestApp,
-  keypair: DidKeypair,
-  opts: { origin?: string; overrideNonce?: string } = {},
-) {
-  const { data } = await req(t.app, 'POST', '/auth/challenge', {
-    body: { did: keypair.did },
-  });
-  const { nonce } = data as { nonce: string; expiresAt: string };
-  const signedNonce = opts.overrideNonce ?? nonce;
-  const signature = await signAuthChallenge(keypair.privateKey, {
-    origin: opts.origin ?? TEST_BASE_URL,
-    did: keypair.did,
-    nonce: signedNonce,
-  });
-  return { nonce: signedNonce, signature: base64urlEncode(signature) };
-}
-
-describe('POST /auth/challenge', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  it('issues a nonce for a well-formed DID, unauthenticated', async () => {
-    const keypair = await generateDidKeypair();
-    const { status, data } = await req(t.app, 'POST', '/auth/challenge', {
-      body: { did: keypair.did },
-    });
-    expect(status).toBe(200);
-    const d = data as { nonce: string; expiresAt: string };
-    expect(d.nonce).toMatch(/^[A-Za-z0-9_-]+$/);
-    expect(new Date(d.expiresAt).getTime()).toBeGreaterThan(Date.now());
-  });
-
-  it('issues a fresh, distinct nonce on each call', async () => {
-    const keypair = await generateDidKeypair();
-    const first = await req(t.app, 'POST', '/auth/challenge', { body: { did: keypair.did } });
-    const second = await req(t.app, 'POST', '/auth/challenge', { body: { did: keypair.did } });
-    expect((first.data as { nonce: string }).nonce).not.toBe(
-      (second.data as { nonce: string }).nonce,
-    );
-  });
-
-  it('rejects a malformed DID with 400 invalid_did', async () => {
-    const { status, data } = await req(t.app, 'POST', '/auth/challenge', {
-      body: { did: 'not-a-did' },
-    });
-    expect(status).toBe(400);
-    expect((data as { error: { code: string } }).error.code).toBe('invalid_did');
-  });
-
-  it('rejects a missing did with 400 invalid_did', async () => {
-    const { status, data } = await req(t.app, 'POST', '/auth/challenge', { body: {} });
-    expect(status).toBe(400);
-    expect((data as { error: { code: string } }).error.code).toBe('invalid_did');
-  });
-});
-
-describe('POST /auth/token', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  it('issues an undelegated bearer token for a valid handshake', async () => {
-    const keypair = await generateDidKeypair();
-    const { nonce, signature } = await challengeAndSign(t, keypair);
-
-    const { status, data } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: keypair.did, nonce, signature },
-    });
-    expect(status).toBe(200);
-    const d = data as {
-      token: string;
-      expiresAt?: string;
-      principalId: string;
-      subjectId: string;
-    };
-    expect(typeof d.token).toBe('string');
-    expect(d.principalId).toBe(keypair.did);
-    expect(d.subjectId).toBe(keypair.did);
-
-    // The issued token actually authenticates as that DID.
-    const session = await t.ctx.tokens.lookupToken(d.token);
-    expect(session).toEqual({ principalId: keypair.did, subjectId: keypair.did });
-  });
-
-  it('never lets the client name its own subject, even if it tries', async () => {
-    const keypair = await generateDidKeypair();
-    const { nonce, signature } = await challengeAndSign(t, keypair);
-
-    const { status, data } = await req(t.app, 'POST', '/auth/token', {
-      body: {
-        did: keypair.did,
-        nonce,
-        signature,
-        onBehalfOf: 'did:key:someone-else',
-        subjectId: 'did:key:someone-else',
-      },
-    });
-    expect(status).toBe(200);
-    const d = data as { principalId: string; subjectId: string };
-    expect(d.principalId).toBe(keypair.did);
-    expect(d.subjectId).toBe(keypair.did);
-  });
-
-  it('is single-use: redeeming the same nonce twice fails the second time', async () => {
-    const keypair = await generateDidKeypair();
-    const { nonce, signature } = await challengeAndSign(t, keypair);
-
-    const first = await req(t.app, 'POST', '/auth/token', {
-      body: { did: keypair.did, nonce, signature },
-    });
-    expect(first.status).toBe(200);
-
-    const second = await req(t.app, 'POST', '/auth/token', {
-      body: { did: keypair.did, nonce, signature },
-    });
-    expect(second.status).toBe(401);
-    expect((second.data as { error: { code: string } }).error.code).toBe('unknown_nonce');
-  });
-
-  it('rejects a nonce that was never issued with 401 unknown_nonce', async () => {
-    const keypair = await generateDidKeypair();
-    const signature = await signAuthChallenge(keypair.privateKey, {
-      origin: TEST_BASE_URL,
-      did: keypair.did,
-      nonce: 'never-issued-nonce',
-    });
-    const { status, data } = await req(t.app, 'POST', '/auth/token', {
-      body: {
-        did: keypair.did,
-        nonce: 'never-issued-nonce',
-        signature: base64urlEncode(signature),
-      },
-    });
-    expect(status).toBe(401);
-    expect((data as { error: { code: string } }).error.code).toBe('unknown_nonce');
-  });
-
-  it('rejects a nonce bound to a different DID with 401 unknown_nonce, not invalid_signature', async () => {
-    const owner = await generateDidKeypair();
-    const impostor = await generateDidKeypair();
-    // Challenge is issued to `owner`, but `impostor` signs it correctly
-    // with its own key over the same nonce and origin.
-    const { data } = await req(t.app, 'POST', '/auth/challenge', { body: { did: owner.did } });
-    const { nonce } = data as { nonce: string };
-    const signature = await signAuthChallenge(impostor.privateKey, {
-      origin: TEST_BASE_URL,
-      did: impostor.did,
-      nonce,
-    });
-
-    const { status, data: body } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: impostor.did, nonce, signature: base64urlEncode(signature) },
-    });
-    expect(status).toBe(401);
-    expect((body as { error: { code: string } }).error.code).toBe('unknown_nonce');
-  });
-
-  it('rejects an expired nonce with 401 expired_nonce', async () => {
-    const keypair = await generateDidKeypair();
-    const nonce = 'seeded-expired-nonce';
-    t.ctx.nonces.seedForTesting(nonce, keypair.did, new Date(Date.now() - 1000));
-    const signature = await signAuthChallenge(keypair.privateKey, {
-      origin: TEST_BASE_URL,
-      did: keypair.did,
-      nonce,
-    });
-
-    const { status, data } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: keypair.did, nonce, signature: base64urlEncode(signature) },
-    });
-    expect(status).toBe(401);
-    expect((data as { error: { code: string } }).error.code).toBe('expired_nonce');
-  });
-
-  it('rejects a well-formed but wrong signature with 401 invalid_signature', async () => {
-    const signer = await generateDidKeypair();
-    const { nonce, signature } = await challengeAndSign(t, signer);
-    // Corrupt the signature bytes while keeping it syntactically valid
-    // base64url and the right length — still claims `signer`'s DID and the
-    // nonce issued to it, so this pins verification failure specifically,
-    // distinct from the DID-binding case above.
-    const { status, data } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: signer.did, nonce, signature: signature.slice(0, -4) + 'AAAA' },
-    });
-    expect(status).toBe(401);
-    expect((data as { error: { code: string } }).error.code).toBe('invalid_signature');
-  });
-
-  it('rejects a malformed (non-base64url) signature with 401 invalid_signature', async () => {
-    const keypair = await generateDidKeypair();
-    const { data } = await req(t.app, 'POST', '/auth/challenge', { body: { did: keypair.did } });
-    const { nonce } = data as { nonce: string };
-
-    const { status, data: body } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: keypair.did, nonce, signature: 'not+valid/base64url==' },
-    });
-    expect(status).toBe(401);
-    expect((body as { error: { code: string } }).error.code).toBe('invalid_signature');
-  });
-
-  it('rejects a malformed DID with 400 invalid_did before touching the nonce store', async () => {
-    const { status, data } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: 'not-a-did', nonce: 'x', signature: 'y' },
-    });
-    expect(status).toBe(400);
-    expect((data as { error: { code: string } }).error.code).toBe('invalid_did');
-  });
-
-  it('builds the signed origin from server config, not a client-supplied Host header', async () => {
-    const keypair = await generateDidKeypair();
-    // Signed for the server's real configured origin (TEST_BASE_URL) while
-    // the request lies about its Host — must still succeed, since the
-    // server never derives the origin from the header.
-    const { nonce, signature } = await challengeAndSign(t, keypair);
-    const { status } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: keypair.did, nonce, signature },
-      headers: { Host: 'evil.example.com', 'X-Forwarded-Host': 'evil.example.com' },
-    });
-    expect(status).toBe(200);
-  });
-
-  it('rejects a signature scoped to a different origin even if a client claims it via headers', async () => {
-    const keypair = await generateDidKeypair();
-    // Signed for an origin that is *not* this server's configured one.
-    const { nonce, signature } = await challengeAndSign(t, keypair, {
-      origin: 'https://attacker.example.com',
-    });
-    const { status, data } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: keypair.did, nonce, signature },
-      headers: { Host: 'attacker.example.com', 'X-Forwarded-Host': 'attacker.example.com' },
-    });
-    expect(status).toBe(401);
-    expect((data as { error: { code: string } }).error.code).toBe('invalid_signature');
-  });
-});
-
-describe('handshake input hardening', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  // A DID whose method core cannot verify can never redeem the nonce a
-  // challenge would issue, so issuing one is pure storage spent on a
-  // handshake guaranteed to fail. Refused up front instead.
-  it.each(['did:web:example.com', 'did:plc:ewvi7nxzyoun6zhxrhs64oiz'])(
-    'refuses to issue a challenge for a non-did:key DID (%s)',
-    async (did) => {
-      const { status, data } = await req(t.app, 'POST', '/auth/challenge', { body: { did } });
-      expect(status).toBe(400);
-      expect((data as { error: { code: string } }).error.code).toBe('invalid_did');
-    },
-  );
-
-  // The generic DID grammar has no length bound, so without one an
-  // unauthenticated caller writes a body-limit's worth of "DID" into a
-  // nonce row per request, retained for the nonce TTL.
-  it('refuses an oversized DID and stores nothing for it', async () => {
-    const { status } = await req(t.app, 'POST', '/auth/challenge', {
-      body: { did: 'did:key:z' + 'a'.repeat(500_000) },
-    });
-    expect(status).toBe(400);
-    const rows = (
-      t.ctx.nonces as unknown as {
-        db: { prepare(sql: string): { get(): { n: number } } };
-      }
-    ).db
-      .prepare('SELECT COUNT(*) AS n FROM nonces')
-      .get();
-    expect(rows.n).toBe(0);
-    // Tight timeout on purpose: refusing this rests on core screening the
-    // length before it decodes, and a lost screen surfaces as a hang rather
-    // than a wrong answer.
-  }, 5_000);
-
-  // `null` is valid JSON but not a readable body: indexing a field off it
-  // throws a bare TypeError, which surfaces as an unlabeled 500 — on an
-  // unauthenticated route.
-  it.each(['/auth/challenge', '/auth/token'])(
-    'answers 400, not 500, for a non-object JSON body (%s)',
-    async (path) => {
-      const res = await t.app.request(path, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: 'null',
-      });
-      expect(res.status).toBe(400);
-    },
-  );
-});
-
-describe('handshake token bookkeeping', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  // Without a label the owner's only view of what exists cannot tell a
-  // self-service token from one they minted deliberately.
-  it('labels handshake-issued tokens so the owner can tell them apart', async () => {
-    const keypair = await generateDidKeypair();
-    const { nonce, signature } = await challengeAndSign(t, keypair);
-    await req(t.app, 'POST', '/auth/token', { body: { did: keypair.did, nonce, signature } });
-
-    const { data } = await req(t.app, 'GET', '/tokens', { token: TEST_TOKEN });
-    const rows = (data as { tokens: Array<{ principalId: string; label: string | null }> }).tokens;
-    const issued = rows.find((r) => r.principalId === keypair.did);
-    expect(issued?.label).toBe('did-challenge');
-  });
-
-  // lookupToken() refuses an expired token but never deletes the row, and
-  // nothing else does either — so an unauthenticated route that mints one
-  // per call grows the table without bound.
-  it('reclaims expired token rows rather than letting them accumulate', async () => {
-    await t.ctx.tokens.createToken(OTHER_ENTITY_ID, { expiresAt: new Date(Date.now() - 1000) });
-    expect((await t.ctx.tokens.listTokens()).length).toBe(1);
-
-    const keypair = await generateDidKeypair();
-    const { nonce, signature } = await challengeAndSign(t, keypair);
-    await req(t.app, 'POST', '/auth/token', { body: { did: keypair.did, nonce, signature } });
-
-    const remaining = await t.ctx.tokens.listTokens();
-    expect(remaining.map((r) => r.principalId)).toEqual([keypair.did]);
-  });
-
-  // The redeem is one DELETE ... RETURNING rather than a SELECT then a
-  // DELETE; the DID predicate sits in the WHERE clause precisely so a
-  // mismatched attempt still spends nothing.
-  it('does not let a wrong-DID attempt burn a nonce the rightful holder still needs', async () => {
-    const owner = await generateDidKeypair();
-    const impostor = await generateDidKeypair();
-    const { data } = await req(t.app, 'POST', '/auth/challenge', { body: { did: owner.did } });
-    const { nonce } = data as { nonce: string };
-
-    const impostorSig = await signAuthChallenge(impostor.privateKey, {
-      origin: TEST_BASE_URL,
-      did: impostor.did,
-      nonce,
-    });
-    const attempt = await req(t.app, 'POST', '/auth/token', {
-      body: { did: impostor.did, nonce, signature: base64urlEncode(impostorSig) },
-    });
-    expect(attempt.status).toBe(401);
-
-    const ownerSig = await signAuthChallenge(owner.privateKey, {
-      origin: TEST_BASE_URL,
-      did: owner.did,
-      nonce,
-    });
-    const { status } = await req(t.app, 'POST', '/auth/token', {
-      body: { did: owner.did, nonce, signature: base64urlEncode(ownerSig) },
-    });
-    expect(status).toBe(200);
-  });
-});
-
-// A present-but-invalid credential must 401, never a silent downgrade to
-// anonymous: on an optional-auth route that would surface as a 200 with the
-// public-only subset instead of telling the caller its session is dead.
-describe('invalid bearer credentials', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-    await t.ctx.stack.defineType(NOTE_TYPE_ID, 'Note', {
-      body: { kind: 'text' as const, required: true as const },
-    });
-    await t.ctx.stack.create(
-      NOTE_TYPE_ID,
-      { body: 'public content' },
-      { permissions: [{ access: 'public' }] },
-    );
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  it('rejects an unknown token on an optional-auth route with 401, not an anonymous 200', async () => {
-    const { status, data } = await req(t.app, 'GET', '/records', { token: 'not-a-real-token' });
-    expect(status).toBe(401);
-    expect((data as { error: { code: string } }).error.code).toBe('unauthorized');
-  });
-
-  it('rejects an expired token on an optional-auth route with 401', async () => {
-    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID, {
-      expiresAt: new Date(Date.now() - 1000),
-    });
-    const { status } = await req(t.app, 'GET', '/records', { token });
-    expect(status).toBe(401);
-  });
-
-  it('rejects a revoked token on an optional-auth route with 401', async () => {
-    const { id, token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
-    await t.ctx.tokens.revokeToken(id);
-    const { status } = await req(t.app, 'GET', '/records', { token });
-    expect(status).toBe(401);
-  });
-
-  it('rejects a malformed Authorization header (non-Bearer scheme) with 401', async () => {
-    const { status } = await req(t.app, 'GET', '/records', {
-      headers: { Authorization: 'Basic dXNlcjpwYXNz' },
-    });
-    expect(status).toBe(401);
-  });
-
-  // No credential at all is a different state from a bad one — it must
-  // still serve the public subset, not be swept up by the fix above.
-  it('still serves the public subset with no Authorization header at all', async () => {
-    const { status, data } = await req(t.app, 'GET', '/records');
-    expect(status).toBe(200);
-    expect((data as { records: unknown[] }).records.length).toBe(1);
-  });
-
-  it('rejects an unknown token on a requireAuth() route with 401 too', async () => {
-    const { status } = await req(t.app, 'GET', '/entity', { token: 'not-a-real-token' });
-    expect(status).toBe(401);
-  });
-});