@hed-hog/core 0.0.398 → 0.0.400

package/src/authorize/authorize.module.ts

@@ -2,8 +2,11 @@ import { PrismaModule } from '@hed-hog/api-prisma';
 import { Module, forwardRef } from '@nestjs/common';
 import { AuthModule } from '../auth/auth.module';
 import { SecurityModule } from '../security/security.module';
+import { SessionModule } from '../session/session.module';
+import { TokenModule } from '../token/token.module';
 import { AuthorizeController } from './authorize.controller';
 import { AuthorizeService } from './authorize.service';
+import { WellKnownController } from './well-known.controller';
 
 /**
  * Separado de OAuthModule de propósito: lá o HedHog é *client* de IdPs externos
@@ -15,8 +18,10 @@ import { AuthorizeService } from './authorize.service';
     forwardRef(() => PrismaModule),
     forwardRef(() => SecurityModule),
     forwardRef(() => AuthModule),
+    forwardRef(() => SessionModule),
+    forwardRef(() => TokenModule),
   ],
-  controllers: [AuthorizeController],
+  controllers: [AuthorizeController, WellKnownController],
   providers: [AuthorizeService],
   exports: [AuthorizeService],
 })

package/src/authorize/authorize.service.spec.ts

@@ -52,11 +52,42 @@ const makeDeps = () => {
       session: { id: 1 },
     })),
   };
-  return { prisma, security, auth };
+  const session = {
+    peekByRefreshToken: jest.fn(async () => ({
+      id: 9,
+      user_id: 7,
+      audience: null,
+      oauth_client_id: null,
+      revoked_at: null,
+      expires_at: new Date('2099-01-01'),
+    })),
+    refresh: jest.fn(async () => ({
+      token: 'ROTATED-REFRESH',
+      session: { id: 9, user_id: 7, audience: null, oauth_client_id: null },
+    })),
+  };
+  const token = {
+    createAccessToken: jest.fn(async () => 'ACCESS'),
+  };
+  const metadata = {
+    getIssuer: jest.fn(async () => ISSUER),
+    getMcpResource: jest.fn(async () => MCP_RESOURCE),
+  };
+  return { prisma, security, auth, session, token, metadata };
 };
 
+const ISSUER = 'https://hub-api.example.com';
+const MCP_RESOURCE = `${ISSUER}/mcp`;
+
 const makeService = (deps: ReturnType<typeof makeDeps>) =>
-  new AuthorizeService(deps.prisma as never, deps.security as never, deps.auth as never);
+  new AuthorizeService(
+    deps.prisma as never,
+    deps.security as never,
+    deps.auth as never,
+    deps.session as never,
+    deps.token as never,
+    deps.metadata as never,
+  );
 
 const validIssueParams = (challenge: string) => ({
   userId: 7,
@@ -105,14 +136,20 @@ describe('AuthorizeService', () => {
     it('dá ao code um TTL curto (60s)', async () => {
       const before = Date.now();
       await service.issueCode(validIssueParams(sha256b64url(makeVerifier())));
+      const after = Date.now();
 
       const created = deps.prisma.oauth_authorization_code.create.mock.calls[0][0] as {
         data: { expires_at: Date };
       };
-      const ttl = created.data.expires_at.getTime() - before;
-
-      expect(ttl).toBeGreaterThan(0);
-      expect(ttl).toBeLessThanOrEqual(60_000);
+      const expiresAt = created.data.expires_at.getTime();
+
+      // A janela e [before, after] + 60s, e nao `expiresAt - before <= 60_000`:
+      // o servico calcula o vencimento com o relogio DE DENTRO da chamada, entao
+      // medir a partir de um instante anterior a ela fazia a assercao falhar
+      // sempre que a execucao levasse 1ms — falha intermitente que so aparecia
+      // com a suite inteira, sob carga.
+      expect(expiresAt).toBeGreaterThan(before);
+      expect(expiresAt).toBeLessThanOrEqual(after + 60_000);
     });
 
     it('rejeita redirect_uri não registrado', async () => {
@@ -192,6 +229,9 @@ describe('AuthorizeService', () => {
         '127.0.0.1',
         'jest',
         undefined,
+        // sem `resource` no request, nao ha vinculo de audiencia — o token sai
+        // igual ao de antes.
+        undefined,
       );
     });
 
@@ -214,6 +254,7 @@ describe('AuthorizeService', () => {
         '127.0.0.1',
         'jest',
         'ext-install-1',
+        undefined,
       );
     });
 
@@ -312,7 +353,13 @@ describe('AuthorizeService', () => {
         codeChallengeMethod: 'S256',
       });
 
-      expect(info).toEqual({ clientName: 'HedHog Vaults Extension', scopes: ['vaults'] });
+      // `issuer` e aditivo: a tela de consent precisa dele para devolver `iss` no
+      // redirect (RFC 9207), que os metadados anunciam suportar.
+      expect(info).toEqual({
+        clientName: 'HedHog Vaults Extension',
+        scopes: ['vaults'],
+        issuer: ISSUER,
+      });
     });
 
     it('valida antes de a página redirecionar para qualquer lugar', async () => {
@@ -327,4 +374,329 @@ describe('AuthorizeService', () => {
       ).rejects.toThrow(BadRequestException);
     });
   });
+
+  describe('resource (RFC 8707) e audience binding', () => {
+    it('recusa resource que nao e o deste servidor', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'mcp' }) as never);
+      const service = makeService(deps);
+      const verifier = makeVerifier();
+
+      await expect(
+        service.issueCode({
+          ...validIssueParams(sha256b64url(verifier)),
+          scope: 'mcp',
+          resource: 'https://outro.example.com/mcp',
+        }),
+      ).rejects.toMatchObject({ code: 'invalid_target', redirectable: true });
+    });
+
+    it('grava o resource no code e emite token com audiencia', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'mcp' }) as never);
+      const service = makeService(deps);
+      const verifier = makeVerifier();
+      const challenge = sha256b64url(verifier);
+
+      await service.issueCode({
+        ...validIssueParams(challenge),
+        scope: 'mcp',
+        resource: MCP_RESOURCE,
+      });
+
+      const created = deps.prisma.oauth_authorization_code.create.mock.calls[0][0] as any;
+      expect(created.data.resource).toBe(MCP_RESOURCE);
+
+      deps.prisma.$queryRaw.mockResolvedValue([
+        { user_id: 7, code_challenge: challenge, scope: 'mcp', resource: MCP_RESOURCE },
+      ] as never);
+
+      await service.exchangeCode({
+        ...validExchangeParams('any-code', verifier),
+        resource: MCP_RESOURCE,
+      });
+
+      expect(deps.auth.getAuthenticationPayload).toHaveBeenCalledWith(
+        'en', 7, '127.0.0.1', 'jest', undefined,
+        expect.objectContaining({
+          audience: MCP_RESOURCE,
+          scope: 'mcp',
+          clientId: CLIENT_ID,
+          issuer: ISSUER,
+        }),
+      );
+    });
+
+    // Autorizar para um recurso e pedir token para outro nao pode funcionar.
+    it('recusa quando o resource do token difere do da autorizacao', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'mcp' }) as never);
+      const service = makeService(deps);
+      const verifier = makeVerifier();
+      deps.prisma.$queryRaw.mockResolvedValue([
+        { user_id: 7, code_challenge: sha256b64url(verifier), scope: 'mcp', resource: MCP_RESOURCE },
+      ] as never);
+
+      await expect(
+        service.exchangeCode({ ...validExchangeParams('any-code', verifier), resource: undefined }),
+      ).rejects.toMatchObject({ code: 'invalid_target' });
+    });
+  });
+
+  /**
+   * REGRESSAO: `resource` era opcional mesmo para um client confinado ao MCP.
+   * Bastava omiti-lo para receber um token SEM `aud` — acesso a API REST inteira,
+   * TTL longo e renovavel pelo /auth/refresh. O confinamento virava opt-in pela
+   * parte que ele restringe.
+   */
+  describe('resource obrigatorio para concessao de MCP', () => {
+    it('recusa autorizacao com escopo mcp e sem resource', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'mcp' }) as never);
+      const service = makeService(deps);
+
+      await expect(
+        service.getAuthorizationInfo({
+          clientId: CLIENT_ID,
+          redirectUri: REDIRECT_URI,
+          scope: 'mcp',
+          codeChallenge: sha256b64url(makeVerifier()),
+          codeChallengeMethod: 'S256',
+        }),
+      ).rejects.toMatchObject({ code: 'invalid_target', redirectable: true });
+    });
+
+    it('recusa tambem quando o scope vem do registro do client', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'mcp' }) as never);
+      const service = makeService(deps);
+
+      // sem \`scope\` na query: o servico assume os escopos do client, que sao 'mcp'
+      await expect(
+        service.getAuthorizationInfo({
+          clientId: CLIENT_ID,
+          redirectUri: REDIRECT_URI,
+          codeChallenge: sha256b64url(makeVerifier()),
+          codeChallengeMethod: 'S256',
+        }),
+      ).rejects.toMatchObject({ code: 'invalid_target' });
+    });
+
+    it('client sem escopo mcp segue podendo omitir resource', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient() as never);
+      const service = makeService(deps);
+
+      await expect(
+        service.getAuthorizationInfo({
+          clientId: CLIENT_ID,
+          redirectUri: REDIRECT_URI,
+          scope: 'vaults',
+          codeChallenge: sha256b64url(makeVerifier()),
+          codeChallengeMethod: 'S256',
+        }),
+      ).resolves.toMatchObject({ clientName: 'HedHog Vaults Extension' });
+    });
+  });
+
+  describe('response_type', () => {
+    it('aceita ausente (e o que os clientes antigos mandam)', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient() as never);
+      const service = makeService(deps);
+
+      await expect(
+        service.getAuthorizationInfo({
+          clientId: CLIENT_ID,
+          redirectUri: REDIRECT_URI,
+          scope: 'vaults',
+          codeChallenge: sha256b64url(makeVerifier()),
+          codeChallengeMethod: 'S256',
+        }),
+      ).resolves.toMatchObject({ issuer: ISSUER });
+    });
+
+    it('recusa response_type diferente de code, de forma redirecionavel', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient() as never);
+      const service = makeService(deps);
+
+      await expect(
+        service.getAuthorizationInfo({
+          clientId: CLIENT_ID,
+          redirectUri: REDIRECT_URI,
+          scope: 'vaults',
+          codeChallenge: sha256b64url(makeVerifier()),
+          codeChallengeMethod: 'S256',
+          responseType: 'token',
+        }),
+      ).rejects.toMatchObject({ code: 'unsupported_response_type', redirectable: true });
+    });
+  });
+
+  describe('scope opcional', () => {
+    it('ausente, assume os escopos registrados do client', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient() as never);
+      const service = makeService(deps);
+
+      const info = await service.getAuthorizationInfo({
+        clientId: CLIENT_ID,
+        redirectUri: REDIRECT_URI,
+        codeChallenge: sha256b64url(makeVerifier()),
+        codeChallengeMethod: 'S256',
+      });
+
+      expect(info.scopes).toEqual(['vaults']);
+    });
+  });
+
+  describe('erros nao redirecionaveis', () => {
+    // RFC 6749 4.1.2.1: sem client ou redirect_uri validos nao ha para onde
+    // redirecionar com seguranca.
+    it('client desconhecido e redirect_uri invalido nao sao redirecionaveis', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(null as never);
+      const service = makeService(deps);
+
+      await expect(
+        service.getAuthorizationInfo({
+          clientId: 'nao-existe',
+          redirectUri: REDIRECT_URI,
+          scope: 'vaults',
+          codeChallenge: sha256b64url(makeVerifier()),
+          codeChallengeMethod: 'S256',
+        }),
+      ).rejects.toMatchObject({ code: 'invalid_client', redirectable: false });
+
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient() as never);
+      await expect(
+        service.getAuthorizationInfo({
+          clientId: CLIENT_ID,
+          redirectUri: 'https://atacante.example.com/cb',
+          scope: 'vaults',
+          codeChallenge: sha256b64url(makeVerifier()),
+          codeChallengeMethod: 'S256',
+        }),
+      ).rejects.toMatchObject({ code: 'invalid_request', redirectable: false });
+    });
+  });
+
+  describe('exchangeRefreshToken', () => {
+    it('reaplica o aud a partir da sessao', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'mcp' }) as never);
+      deps.session.peekByRefreshToken.mockResolvedValue({
+        id: 9, user_id: 7, audience: MCP_RESOURCE, oauth_client_id: CLIENT_ID,
+        revoked_at: null, expires_at: new Date('2099-01-01'),
+      } as never);
+      deps.session.refresh.mockResolvedValue({
+        token: 'ROTATED-REFRESH',
+        session: { id: 9, user_id: 7, audience: MCP_RESOURCE, oauth_client_id: CLIENT_ID },
+      } as never);
+      const service = makeService(deps);
+
+      const result = await service.exchangeRefreshToken({
+        refreshToken: 'old',
+        clientId: CLIENT_ID,
+        resource: MCP_RESOURCE,
+        locale: 'en',
+        ipAddress: '127.0.0.1',
+        userAgent: 'jest',
+      });
+
+      expect(deps.token.createAccessToken).toHaveBeenCalledWith(
+        expect.objectContaining({ aud: MCP_RESOURCE, scope: 'mcp', cid: CLIENT_ID }),
+      );
+      expect(result.refresh_token).toBe('ROTATED-REFRESH');
+      expect(result.refreshToken).toBe('ROTATED-REFRESH');
+    });
+
+    // Sem isto, o refresh token de um cliente valeria apresentado por outro.
+    it('recusa refresh token de outro client', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'mcp' }) as never);
+      deps.session.peekByRefreshToken.mockResolvedValue({
+        id: 9, user_id: 7, audience: MCP_RESOURCE, oauth_client_id: 'outro-app',
+        revoked_at: null, expires_at: new Date('2099-01-01'),
+      } as never);
+      const service = makeService(deps);
+
+      await expect(
+        service.exchangeRefreshToken({
+          refreshToken: 'old',
+          clientId: CLIENT_ID,
+          resource: MCP_RESOURCE,
+          locale: 'en',
+          ipAddress: '127.0.0.1',
+          userAgent: 'jest',
+        }),
+      ).rejects.toMatchObject({ code: 'invalid_grant' });
+    });
+
+    /**
+     * REGRESSAO: as validacoes vinham DEPOIS de session.refresh(), que ja
+     * commitou a rotacao. Uma recusa por client ou resource errado deixava o
+     * cliente com um token morto em 30s e sem substituto.
+     */
+    it('nao gira o refresh token quando vai recusar', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'mcp' }) as never);
+      deps.session.peekByRefreshToken.mockResolvedValue({
+        id: 9, user_id: 7, audience: MCP_RESOURCE, oauth_client_id: 'outro-app',
+        revoked_at: null, expires_at: new Date('2099-01-01'),
+      } as never);
+      const service = makeService(deps);
+
+      await expect(
+        service.exchangeRefreshToken({
+          refreshToken: 'old', clientId: CLIENT_ID, resource: MCP_RESOURCE,
+          locale: 'en', ipAddress: '127.0.0.1', userAgent: 'jest',
+        }),
+      ).rejects.toMatchObject({ code: 'invalid_grant' });
+
+      expect(deps.session.refresh).not.toHaveBeenCalled();
+    });
+
+    /**
+     * REGRESSAO: o escopo era o literal 'mcp', entao qualquer client que
+     * chegasse aqui era promovido a cliente de MCP — inclusive os que so tem
+     * 'profile' ou 'vaults'.
+     */
+    it('usa o escopo registrado do client, nao um literal', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'profile' }) as never);
+      const service = makeService(deps);
+
+      const result = await service.exchangeRefreshToken({
+        refreshToken: 'old', clientId: CLIENT_ID,
+        locale: 'en', ipAddress: '127.0.0.1', userAgent: 'jest',
+      });
+
+      expect(result.scope).toBe('profile');
+      const payload = deps.token.createAccessToken.mock.calls[0][0] as any;
+      expect(payload.scope).toBeUndefined();
+      expect(payload.aud).toBeUndefined();
+    });
+
+    /**
+     * REGRESSAO: erro de infraestrutura virava invalid_grant, que pelo RFC 6749
+     * 5.2 manda o cliente DESCARTAR a credencial — um soluco de banco
+     * desconectaria todos permanentemente.
+     */
+    it('nao converte erro de infraestrutura em invalid_grant', async () => {
+      const deps = makeDeps();
+      deps.prisma.oauth_app_client.findUnique.mockResolvedValue(makeClient({ scopes: 'profile' }) as never);
+      deps.session.refresh.mockRejectedValue(new Error('connection pool timeout') as never);
+      const service = makeService(deps);
+
+      await expect(
+        service.exchangeRefreshToken({
+          refreshToken: 'old', clientId: CLIENT_ID,
+          locale: 'en', ipAddress: '127.0.0.1', userAgent: 'jest',
+        }),
+      ).rejects.toThrow('connection pool timeout');
+    });
+  });
+
 });