@johnnyboy11234/esg-idea-contest 0.2.1 → 0.2.3

package/backend/internal/auth/csrf_test.go

@@ -0,0 +1,281 @@
+package auth_test
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+const (
+	keyA = "0123456789abcdef0123456789abcdef"
+	keyB = "fedcba9876543210fedcba9876543210"
+)
+
+func sid(t *testing.T) string {
+	t.Helper()
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		t.Fatal(err)
+	}
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+func mustCSRF(t *testing.T, cur string, prev ...string) *auth.CSRF {
+	t.Helper()
+	c, err := auth.NewCSRF(cur, prev...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+
+type denial struct{ action, reason string }
+
+// csrfChain mirrors production order: session middleware, then CSRF, then router.
+func csrfChain(c *auth.CSRF, v auth.Validator, got *denial) http.Handler {
+	r := chi.NewRouter()
+	r.NotFound(web.NotFound)
+	r.MethodNotAllowed(web.MethodNotAllowed)
+	ok := func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }
+	r.Get("/auth/csrf", auth.Handler{CSRF: c, Log: slog.New(slog.DiscardHandler)}.GetCsrfToken)
+	r.Post("/w", ok)
+	r.Put("/w", ok)
+	r.Delete("/w", ok)
+	r.Post("/auth/logout", ok)
+	fail := func(w http.ResponseWriter, req *http.Request, err error) {
+		var e *web.Error
+		if errors.As(err, &e) && got != nil {
+			*got = denial{e.AuditAction, e.AuditReason}
+		}
+		web.WriteError(w, req, err)
+	}
+	action := func(req *http.Request) string {
+		if req.URL.Path == "/auth/logout" {
+			return "AUTH_LOGOUT"
+		}
+		return ""
+	}
+	public := func(req *http.Request) bool { return req.URL.Path == "/auth/csrf" || req.URL.Path == "/auth/logout" }
+	log := slog.New(slog.DiscardHandler)
+	return web.RequestID(auth.Middleware(v, public, log)(c.Middleware(fail, action)(r)))
+}
+
+func fetch(t *testing.T, h http.Handler, session string) string {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/auth/csrf", nil)
+	if session != "" {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("GET /auth/csrf = %d %s", rec.Code, rec.Body)
+	}
+	var body struct{ Token string }
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil || body.Token == "" {
+		t.Fatalf("body %s: %v", rec.Body, err)
+	}
+	var ck *http.Cookie
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == auth.CSRFCookie {
+			ck = c
+		}
+	}
+	if ck == nil || ck.Value != body.Token {
+		t.Fatalf("cookie %v does not match body token", ck)
+	}
+	if !ck.HttpOnly || !ck.Secure || ck.Path != "/" || ck.Domain != "" || ck.SameSite != http.SameSiteLaxMode {
+		t.Errorf("cookie attributes: %+v", ck)
+	}
+	if rec.Header().Get("Cache-Control") != "no-store" {
+		t.Errorf("Cache-Control = %q", rec.Header().Get("Cache-Control"))
+	}
+	return body.Token
+}
+
+func write(method, path, session, cookie, header string) *http.Request {
+	req := httptest.NewRequest(method, path, strings.NewReader("ignored"))
+	if session != "" {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	}
+	if cookie != "" {
+		req.AddCookie(&http.Cookie{Name: auth.CSRFCookie, Value: cookie})
+	}
+	if header != "" {
+		req.Header.Set(auth.CSRFHeader, header)
+	}
+	return req
+}
+
+func TestCSRFWrites(t *testing.T) {
+	c := mustCSRF(t, keyA)
+	s1, s2 := sid(t), sid(t)
+	user := security.Principal{UserID: uuid.New(), EmpNo: "U1", Role: security.RoleUser}
+	v := &fakeValidator{live: map[string]security.Principal{s1: user, s2: user}}
+	h := csrfChain(c, v, nil)
+
+	anon, tok1, tok2 := fetch(t, h, ""), fetch(t, h, s1), fetch(t, h, s2)
+	other := mustCSRF(t, keyB)
+	foreign, _ := other.Issue([]byte("x"))
+
+	tests := []struct {
+		name                    string
+		method, path            string
+		session, cookie, header string
+		status                  int
+	}{
+		{"session token, own session", "POST", "/w", s1, tok1, tok1, 204},
+		{"anonymous token, no session", "POST", "/auth/logout", "", anon, anon, 204},
+		{"PUT and DELETE are checked", "PUT", "/w", s1, "", "", 403},
+		{"DELETE with token", "DELETE", "/w", s1, tok1, tok1, 204},
+		{"no header", "POST", "/w", s1, tok1, "", 403},
+		{"no cookie", "POST", "/w", s1, "", tok1, 403},
+		{"cookie and header differ", "POST", "/w", s1, tok1, tok2, 403},
+		{"other session's token", "POST", "/w", s1, tok2, tok2, 403},
+		{"anonymous token against a session", "POST", "/w", s1, anon, anon, 403},
+		{"session token without a session (logout)", "POST", "/auth/logout", "", tok1, tok1, 403},
+		{"session token, stale session cookie (logout)", "POST", "/auth/logout", sid(t), tok1, tok1, 403},
+		{"signed by an unknown key", "POST", "/w", s1, foreign, foreign, 403},
+		{"garbage", "POST", "/w", s1, "abc", "abc", 403},
+		{"truncated signature", "POST", "/w", s1, tok1[:len(tok1)-2], tok1[:len(tok1)-2], 403},
+		{"no dot", "POST", "/w", s1, strings.ReplaceAll(tok1, ".", ""), strings.ReplaceAll(tok1, ".", ""), 403},
+		{"403 beats 404 on unknown path", "POST", "/nope", s1, "", "", 403},
+		{"unknown path, valid token, is 404", "POST", "/nope", s1, tok1, tok1, 404},
+		{"401 beats 403", "POST", "/w", "", "", "", 401},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, write(tc.method, tc.path, tc.session, tc.cookie, tc.header))
+			if rec.Code != tc.status {
+				t.Fatalf("status = %d, want %d (%s)", rec.Code, tc.status, rec.Body)
+			}
+			if tc.status == 403 && !strings.Contains(rec.Body.String(), `"code":"CSRF_INVALID"`) {
+				t.Errorf("body %s", rec.Body)
+			}
+		})
+	}
+}
+
+func TestCSRFSafeMethodsAreNotChecked(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	for _, m := range []string{"GET", "HEAD", "OPTIONS"} {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(m, "/auth/csrf", nil))
+		if rec.Code == 403 {
+			t.Errorf("%s was CSRF-checked", m)
+		}
+	}
+}
+
+func TestCSRFNeverReadsBody(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	req := write("POST", "/auth/logout", "", "", "")
+	req.Body = failReader{t}
+	h.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+type failReader struct{ t *testing.T }
+
+func (f failReader) Read([]byte) (int, error) { f.t.Error("body was read"); return 0, context.Canceled }
+func (failReader) Close() error               { return nil }
+
+func TestCSRFDenialAuditFields(t *testing.T) {
+	c := mustCSRF(t, keyA)
+	anon := fetch(t, csrfChain(c, &fakeValidator{}, nil), "")
+	for _, tc := range []struct{ name, cookie, header, reason string }{
+		{"missing", "", "", "csrf_missing"},
+		{"mismatch", anon, anon + "x", "csrf_mismatch"},
+		{"bad signature", "a.b", "a.b", "csrf_invalid_binding"},
+	} {
+		var d denial
+		rec := httptest.NewRecorder()
+		csrfChain(c, &fakeValidator{}, &d).ServeHTTP(rec, write("POST", "/auth/logout", "", tc.cookie, tc.header))
+		if rec.Code != 403 || d != (denial{"AUTH_LOGOUT", tc.reason}) {
+			t.Errorf("%s: status %d, audit %+v", tc.name, rec.Code, d)
+		}
+	}
+	// Unrouted write: denied, but nothing to audit.
+	var d denial
+	csrfChain(c, &fakeValidator{live: map[string]security.Principal{"x": {}}}, &d).
+		ServeHTTP(httptest.NewRecorder(), write("POST", "/w", "", "", ""))
+	if d != (denial{}) {
+		t.Errorf("unknown action was audited: %+v", d)
+	}
+}
+
+func TestCSRFTokensAreFresh(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	first, second := fetch(t, h, ""), fetch(t, h, "")
+	if first == second {
+		t.Error("two tokens are equal")
+	}
+}
+
+func TestCSRFKeyRotation(t *testing.T) {
+	b := []byte("binding")
+	old := mustCSRF(t, keyA)
+	tok, _ := old.Issue(b)
+
+	rotated := mustCSRF(t, keyB, keyA)
+	if !rotated.Verify(tok, b) {
+		t.Error("previous key must still verify")
+	}
+	if fresh, _ := rotated.Issue(b); !mustCSRF(t, keyB).Verify(fresh, b) || old.Verify(fresh, b) {
+		t.Error("new tokens must be signed by the current key only")
+	}
+	if mustCSRF(t, keyB).Verify(tok, b) {
+		t.Error("after the previous key is dropped the old token must fail")
+	}
+	if !mustCSRF(t, keyB, "").Verify(mustTok(t, mustCSRF(t, keyB), b), b) {
+		t.Error("empty previous key means none")
+	}
+	if old.Verify(tok, []byte("other")) {
+		t.Error("binding must be part of the signature")
+	}
+}
+
+func mustTok(t *testing.T, c *auth.CSRF, b []byte) string {
+	t.Helper()
+	tok, err := c.Issue(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tok
+}
+
+func TestNewCSRFRejectsShortKeys(t *testing.T) {
+	if _, err := auth.NewCSRF("short"); err == nil {
+		t.Error("short current key accepted")
+	}
+	if _, err := auth.NewCSRF(keyA, "short"); err == nil {
+		t.Error("short previous key accepted")
+	}
+}
+
+func TestCSRFSessionWithUnbindableIDIs500(t *testing.T) {
+	// A validator that accepts an ID Binding cannot parse is a wiring bug: fail closed.
+	v := &fakeValidator{live: map[string]security.Principal{"not-an-id": {Role: security.RoleUser}}}
+	h := csrfChain(mustCSRF(t, keyA), v, nil)
+	req := httptest.NewRequest("GET", "/auth/csrf", nil)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: "not-an-id"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 500 {
+		t.Errorf("status = %d", rec.Code)
+	}
+}

package/backend/internal/auth/internal/store/session.go

@@ -20,9 +20,14 @@ type Limits struct {
 	RefreshSeconds  int
 }
 
+// Execer is *sql.DB or *sql.Tx.
+type Execer interface {
+	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
+}
+
 // Insert stores a new session row. hash is SHA-256 of the session ID.
-func Insert(ctx context.Context, db *sql.DB, hash []byte, userID uuid.UUID) error {
-	_, err := db.ExecContext(ctx,
+func Insert(ctx context.Context, x Execer, hash []byte, userID uuid.UUID) error {
+	_, err := x.ExecContext(ctx,
 		`INSERT INTO session (id_hash, user_id) VALUES (?, ?)`, hash, userID.String())
 	if err != nil {
 		return fmt.Errorf("insert session: %w", err)
@@ -77,9 +82,10 @@ func Principal(ctx context.Context, db *sql.DB, hash []byte) (p security.Princip
 	return p, true, nil
 }
 
-// Delete removes one session; deleting a missing one is not an error.
-func Delete(ctx context.Context, db *sql.DB, hash []byte) error {
-	if _, err := db.ExecContext(ctx, `DELETE FROM session WHERE id_hash = ?`, hash); err != nil {
+// Delete removes one session; deleting a missing one is not an error. x is the
+// *sql.DB, or the caller's *sql.Tx so logout commits with its audit row.
+func Delete(ctx context.Context, x Execer, hash []byte) error {
+	if _, err := x.ExecContext(ctx, `DELETE FROM session WHERE id_hash = ?`, hash); err != nil {
 		return fmt.Errorf("delete session: %w", err)
 	}
 	return nil
@@ -109,3 +115,55 @@ func DeleteExpired(ctx context.Context, db *sql.DB, l Limits) (int64, error) {
 	}
 	return n, nil
 }
+
+// Account is the login view of app_user: what is needed to check a password
+// and answer the login response. PasswordHash never leaves the auth module.
+type Account struct {
+	ID           uuid.UUID
+	EmpNo        string
+	Name         string
+	Email        *string // NULL for Admin
+	PasswordHash string
+	Role         security.Role
+	Enabled      bool
+}
+
+// AccountByEmpNo reads one account by employee ID; found is false when none
+// exists.
+func AccountByEmpNo(ctx context.Context, db *sql.DB, empNo string) (a Account, found bool, err error) {
+	var id, role string
+	err = db.QueryRowContext(ctx,
+		`SELECT id, emp_no, name, email, password_hash, role, enabled
+		   FROM app_user WHERE emp_no = ?`, empNo).
+		Scan(&id, &a.EmpNo, &a.Name, &a.Email, &a.PasswordHash, &role, &a.Enabled)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Account{}, false, nil
+	}
+	if err != nil {
+		return Account{}, false, fmt.Errorf("read account: %w", err)
+	}
+	if a.ID, err = uuid.Parse(id); err != nil {
+		return Account{}, false, fmt.Errorf("parse user id %q: %w", id, err)
+	}
+	a.Role = security.Role(role)
+	return a, true, nil
+}
+
+// AccountByID reads one account by its user ID; found is false when none
+// exists.
+func AccountByID(ctx context.Context, db *sql.DB, id uuid.UUID) (a Account, found bool, err error) {
+	var sid, role string
+	err = db.QueryRowContext(ctx,
+		`SELECT id, emp_no, name, email, password_hash, role, enabled
+		   FROM app_user WHERE id = ?`, id.String()).
+		Scan(&sid, &a.EmpNo, &a.Name, &a.Email, &a.PasswordHash, &role, &a.Enabled)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Account{}, false, nil
+	}
+	if err != nil {
+		return Account{}, false, fmt.Errorf("read account by id: %w", err)
+	}
+	a.ID = id
+	a.Role = security.Role(role)
+	return a, true, nil
+}

package/backend/internal/auth/logging_integration_test.go

@@ -0,0 +1,88 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"bytes"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+type syncBuf struct {
+	mu sync.Mutex
+	b  bytes.Buffer
+}
+
+func (s *syncBuf) Write(p []byte) (int, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.Write(p)
+}
+
+func (s *syncBuf) String() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.String()
+}
+
+// TestLogsNeverContainSecrets drives login (good and bad), csrf, me, logout and
+// a rejected write at DEBUG level and asserts no secret reaches any log line
+// (PRD §6.5 / §8.2: no password, session ID, CSRF token or Cookie in logs).
+func TestLogsNeverContainSecrets(t *testing.T) {
+	buf := &syncBuf{}
+	e := newLoginEnvLog(t, slog.New(slog.NewJSONHandler(buf, &slog.HandlerOptions{Level: slog.LevelDebug})))
+	e.addUser(t, "123456", "USER", true)
+
+	const wrongPW = "Wr0ng-Secret-Passw0rd!"
+	secrets := []string{password, wrongPW}
+
+	e.login(t, creds("123456", wrongPW))
+	e.login(t, creds("999999", wrongPW))
+	e.login(t, `{"empNo":"123456","password":"`+wrongPW+`"`) // malformed JSON echoing the password
+
+	rec := e.login(t, creds("123456", password))
+	sess := findCookie(rec, auth.SessionCookie)
+	if sess == nil {
+		t.Fatalf("login failed: %d", rec.Code)
+	}
+	secrets = append(secrets, sess.Value)
+
+	tok, ck := e.csrf(t, sess)
+	secrets = append(secrets, tok, ck.Value)
+
+	if rec := e.me(t, true, sess.Value); rec.Code != 200 {
+		t.Fatalf("me: %d", rec.Code)
+	}
+	// Write with a bad CSRF token: denied, and the submitted token must not be logged.
+	bad := httptest.NewRequest("POST", "/api/v1/auth/logout", nil)
+	bad.Header.Set("X-CSRF-Token", "forged-token-value-123")
+	bad.AddCookie(sess)
+	bad.AddCookie(&http.Cookie{Name: "__Host-csrf", Value: "forged-cookie-value-456"})
+	e.do(bad)
+	secrets = append(secrets, "forged-token-value-123", "forged-cookie-value-456")
+
+	if rec := e.logout(tok, ck, sess); rec.Code != 204 {
+		t.Fatalf("logout: %d", rec.Code)
+	}
+
+	out := buf.String()
+	if strings.TrimSpace(out) == "" {
+		t.Fatal("no log output captured; the test would prove nothing")
+	}
+	for _, s := range secrets {
+		if s != "" && strings.Contains(out, s) {
+			t.Errorf("log contains secret %q", s)
+		}
+	}
+	for _, name := range []string{"Set-Cookie", "set-cookie", "__Host-session=", "X-CSRF-Token"} {
+		if strings.Contains(out, name) {
+			t.Errorf("log contains header material %q", name)
+		}
+	}
+}