@learncard/lca-api-service 1.3.2 → 1.5.0

package/test/keys-recovery-rate-limit.spec.ts

@@ -0,0 +1,123 @@
+import { randomUUID } from 'crypto';
+
+import cache from '@cache';
+import { client } from '@mongo';
+import { getUserKeysCollection, type MongoUserKeyType } from '@models';
+import { checkRateLimit, clearRateLimit } from '@helpers/rateLimit.helpers';
+
+import { getClient } from './helpers/getClient';
+
+beforeAll(async () => {
+    process.env.IS_E2E_TEST = 'true';
+    await client.connect();
+});
+
+afterAll(async () => {
+    await client.close();
+});
+
+describe('LC-2207 recovery email rate limiting by auth provider', () => {
+    const uid = randomUUID();
+    const email = `login-${uid}@example.com`;
+    const recoveryEmail = `recovery-${uid}@example.com`;
+    const did = `did:key:z${uid}`;
+    const codeKey = `recovery_email_code:firebase:${uid}`;
+    const attemptKey = `recovery-verify-attempts:firebase:${uid}`;
+    const contactAttemptKey = `recovery-verify-attempts:email:${email}`;
+    const payload = Buffer.from(JSON.stringify({ sub: uid, email })).toString('base64url');
+    const input = { authToken: `header.${payload}.signature`, providerType: 'firebase' as const };
+    const caller = getClient({ did, isChallengeValid: true });
+
+    beforeEach(async () => {
+        const now = new Date();
+        const userKey: MongoUserKeyType = {
+            contactMethod: { type: 'email', value: email },
+            authProviders: [{ type: 'firebase', id: uid }],
+            primaryDid: did,
+            linkedDids: [],
+            keyProvider: 'sss',
+            authShare: { encryptedData: 'auth-share', encryptedDek: 'dek', iv: 'iv' },
+            shareVersion: 1,
+            shareUpdatedAt: now,
+            previousAuthShares: [],
+            securityLevel: 'basic',
+            recoveryMethods: [],
+            migratedFromWeb3Auth: false,
+            sssActivationState: 'active',
+            createdAt: now,
+            updatedAt: now,
+        };
+        await getUserKeysCollection().insertOne(userKey);
+        await cache.set(codeKey, JSON.stringify({ code: '123456', email: recoveryEmail }), 900);
+    });
+
+    afterEach(async () => {
+        await getUserKeysCollection().deleteMany({ 'authProviders.id': uid });
+        await cache.delete([codeKey]);
+        await clearRateLimit(attemptKey);
+        await clearRateLimit(contactAttemptKey);
+    });
+
+    it('locks out after five failures and deletes the pending code', async () => {
+        for (let attempt = 0; attempt < 5; attempt++) {
+            await expect(
+                caller.keys.verifyRecoveryEmail({ ...input, code: '000000' })
+            ).rejects.toMatchObject({
+                code: 'BAD_REQUEST',
+                message: 'Incorrect code. Please try again.',
+            });
+        }
+
+        await expect(
+            caller.keys.verifyRecoveryEmail({ ...input, code: '123456' })
+        ).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+            message: 'Too many attempts. Please resend code.',
+        });
+        expect(await cache.get(codeKey)).toBeFalsy();
+        await clearRateLimit(attemptKey);
+        await expect(
+            caller.keys.verifyRecoveryEmail({ ...input, code: '123456' })
+        ).rejects.toMatchObject({ message: 'No pending verification. Please request a new code.' });
+    });
+
+    it('clears the provider counter on success without using a recycled contact counter', async () => {
+        await cache.set(`rate-limit:${contactAttemptKey}`, '99', 900);
+        await expect(
+            caller.keys.verifyRecoveryEmail({ ...input, code: '000000' })
+        ).rejects.toThrow();
+        expect(await cache.get(`rate-limit:${attemptKey}`)).toBe('1');
+        await expect(
+            caller.keys.verifyRecoveryEmail({ ...input, code: '123456' })
+        ).resolves.toMatchObject({ success: true });
+        expect(await cache.get(`rate-limit:${attemptKey}`)).toBeFalsy();
+        expect(await cache.get(`rate-limit:${contactAttemptKey}`)).toBe('99');
+        expect(await cache.get(codeKey)).toBeFalsy();
+        expect(await getUserKeysCollection().findOne({ 'authProviders.id': uid })).toMatchObject({
+            recoveryEmail,
+        });
+    });
+
+    it('clears the provider counter when resending and accepts the new code', async () => {
+        await cache.set(`rate-limit:${attemptKey}`, '6', 900);
+        await caller.keys.addRecoveryEmail({ ...input, email: recoveryEmail });
+        expect(await cache.get(`rate-limit:${attemptKey}`)).toBeFalsy();
+        const pending = JSON.parse((await cache.get(codeKey))!);
+        expect(pending.code).toMatch(/^\d{6}$/);
+        await expect(
+            caller.keys.verifyRecoveryEmail({ ...input, code: pending.code })
+        ).resolves.toMatchObject({ success: true });
+    });
+
+    it('preserves the QR Redis prefix in the shared helper', async () => {
+        const key = `create:${uid}`;
+        try {
+            expect(await checkRateLimit(key, 1, 60, 'qr-login:rate:')).toBe(true);
+            expect(await checkRateLimit(key, 1, 60, 'qr-login:rate:')).toBe(false);
+            expect(await cache.get(`qr-login:rate:${key}`)).toBe('2');
+            expect(await cache.get(`rate-limit:${key}`)).toBeFalsy();
+        } finally {
+            await clearRateLimit(key, 'qr-login:rate:');
+        }
+    });
+});

package/test/keys-secret-leakage.spec.ts

@@ -0,0 +1,265 @@
+/**
+ * P0-4: Secret leakage — telemetry.
+ *
+ * Verifies that /keys/* routes never let share/token/recovery-key material
+ * reach Sentry: (1) the exported redaction helper strips every secret-shaped
+ * field from a realistic payload, and (2) exercising real /keys/* route
+ * handlers with sentinel values registers a Sentry scope event processor
+ * that redacts those sentinels from anything Sentry would capture.
+ */
+import * as Sentry from '@sentry/serverless';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+
+import { redactSecretFields } from '@routes';
+import { getClient, getUser } from './helpers/getClient';
+
+import { client } from '@mongo';
+
+const SENTINEL_SHARE = 'SENTINEL_SHARE_XYZ';
+const SENTINEL_TOKEN = 'SENTINEL_TOKEN_XYZ';
+
+const makeMockToken = (email: string, uid: string): string => {
+    const payload = Buffer.from(JSON.stringify({ sub: uid, email })).toString('base64url');
+    return `header.${payload}.signature`;
+};
+
+beforeAll(async () => {
+    process.env.IS_E2E_TEST = 'true';
+    process.env.SEED ||= 'a'.repeat(64);
+
+    try {
+        await client.connect();
+    } catch (error) {
+        console.error(error);
+    }
+});
+
+afterAll(async () => {
+    try {
+        await client.close();
+    } catch (error) {
+        console.error(error);
+    }
+});
+
+describe('redactSecretFields', () => {
+    it('redacts every secret-shaped field from a realistic /keys/* payload', () => {
+        const payload = {
+            authToken: SENTINEL_TOKEN,
+            authShare: { encryptedData: SENTINEL_SHARE, encryptedDek: 'x', iv: 'iv' },
+            emailShare: SENTINEL_SHARE,
+            encryptedShare: { encryptedData: SENTINEL_SHARE, iv: 'iv' },
+            recoveryKey: SENTINEL_SHARE,
+            seed: SENTINEL_SHARE,
+            blob: SENTINEL_SHARE,
+            envelope: { ciphertext: SENTINEL_SHARE },
+            sealedShare: { ciphertext: SENTINEL_SHARE },
+            resumeToken: SENTINEL_TOKEN,
+            clientEphemeralPublicKey: SENTINEL_SHARE,
+            credentialId: 'not-a-secret-cred-id',
+            providerType: 'firebase',
+            type: 'passkey',
+        };
+
+        const redacted = redactSecretFields(payload) as Record<string, unknown>;
+
+        expect(redacted.authToken).toBe('[Redacted]');
+        expect(redacted.authShare).toBe('[Redacted]');
+        expect(redacted.emailShare).toBe('[Redacted]');
+        expect(redacted.encryptedShare).toBe('[Redacted]');
+        expect(redacted.recoveryKey).toBe('[Redacted]');
+        expect(redacted.seed).toBe('[Redacted]');
+        expect(redacted.blob).toBe('[Redacted]');
+        expect(redacted.envelope).toBe('[Redacted]');
+        expect(redacted.sealedShare).toBe('[Redacted]');
+        expect(redacted.resumeToken).toBe('[Redacted]');
+        expect(redacted.clientEphemeralPublicKey).toBe('[Redacted]');
+        // Non-secret fields survive untouched
+        expect(redacted.credentialId).toBe('not-a-secret-cred-id');
+        expect(redacted.providerType).toBe('firebase');
+        expect(redacted.type).toBe('passkey');
+
+        const serialized = JSON.stringify(redacted);
+        expect(serialized).not.toContain(SENTINEL_SHARE);
+        expect(serialized).not.toContain(SENTINEL_TOKEN);
+    });
+
+    it('redacts nested secret-shaped fields recursively', () => {
+        const payload = {
+            recoveryMethods: [
+                { type: 'backup', encryptedShare: { encryptedData: SENTINEL_SHARE, iv: 'iv' } },
+            ],
+        };
+
+        const redacted = redactSecretFields(payload) as {
+            recoveryMethods: { encryptedShare: unknown }[];
+        };
+
+        expect(redacted.recoveryMethods[0]!.encryptedShare).toBe('[Redacted]');
+    });
+
+    it('leaves keys that do not match the secret pattern alone', () => {
+        const payload = { credentialId: SENTINEL_TOKEN, providerType: 'firebase' };
+
+        const redacted = redactSecretFields(payload) as Record<string, unknown>;
+
+        expect(redacted.credentialId).toBe(SENTINEL_TOKEN);
+        expect(redacted.providerType).toBe('firebase');
+    });
+});
+
+// Use a real isolated scope while capturing processors, without touching the hub.
+const captureScope = (
+    processors: Array<(event: Record<string, unknown>) => unknown>
+): Sentry.Scope => {
+    const scope = new Sentry.Scope();
+    vi.spyOn(scope, 'addEventProcessor').mockImplementation(processor => {
+        processors.push(event => processor(event, {}));
+        return scope;
+    });
+    return scope;
+};
+
+describe('Sentry event processor for /keys/* routes', () => {
+    it('redacts escrow inputs and outputs on the separate escrow router namespace', async () => {
+        const processors: Array<(event: Record<string, unknown>) => unknown> = [];
+        const spy = vi.spyOn(Sentry, 'configureScope').mockImplementation(callback => {
+            callback(captureScope(processors));
+        });
+        try {
+            // Even a disabled or rejected request must register the defense-in-depth processor.
+            await getClient()
+                .escrow.startRecovery({
+                    authToken: SENTINEL_TOKEN,
+                    providerType: 'firebase',
+                    clientEphemeralPublicKey: SENTINEL_SHARE,
+                })
+                .catch(() => undefined);
+        } finally {
+            spy.mockRestore();
+        }
+        expect(processors).toHaveLength(1);
+        const payload = {
+            envelope: { ciphertext: SENTINEL_SHARE },
+            sealedShare: { ciphertext: SENTINEL_SHARE },
+            resumeToken: SENTINEL_TOKEN,
+            clientEphemeralPublicKey: SENTINEL_SHARE,
+        };
+        const event = {
+            contexts: { trpc: { input: payload } },
+            extra: { output: payload },
+            request: { data: payload },
+        };
+        const serialized = JSON.stringify(processors[0]!(event));
+        expect(serialized).not.toContain(SENTINEL_SHARE);
+        expect(serialized).not.toContain(SENTINEL_TOKEN);
+    });
+    it('registers a redacting event processor for every /keys/* call, using sentinel inputs', async () => {
+        const email = `p04-sentry-${Date.now()}@example.com`;
+        const token = makeMockToken(email, `p04-uid-${Date.now()}`);
+        const { learnCard } = await getUser(`b${'1'.repeat(63)}`);
+        const authedCaller = getClient({ did: learnCard.id.did(), isChallengeValid: true });
+
+        const registeredProcessors: Array<(event: Record<string, unknown>) => unknown> = [];
+
+        const configureScopeSpy = vi
+            .spyOn(Sentry, 'configureScope')
+            .mockImplementation(callback => {
+                callback(captureScope(registeredProcessors));
+            });
+
+        try {
+            // Exercise every /keys/* route that accepts share/token-shaped
+            // input, with sentinel values, exactly as a real client would.
+            await authedCaller.keys.storeAuthShare({
+                authToken: token,
+                providerType: 'firebase',
+                authShare: { encryptedData: SENTINEL_SHARE, encryptedDek: 'x', iv: 'iv' },
+                primaryDid: learnCard.id.did(),
+            });
+
+            await authedCaller.keys.addRecoveryMethod({
+                authToken: token,
+                providerType: 'firebase',
+                type: 'backup',
+                encryptedShare: { encryptedData: SENTINEL_SHARE, iv: 'iv' },
+            });
+
+            await getClient().keys.getAuthShare({ authToken: token, providerType: 'firebase' });
+            await getClient().keys.getRecoveryShare({
+                authToken: token,
+                providerType: 'firebase',
+                type: 'backup',
+            });
+            await expect(
+                authedCaller.keys.sendEmailBackup({
+                    authToken: token,
+                    providerType: 'firebase',
+                    relayPayload: {
+                        version: 1,
+                        algorithm: 'P-256-HKDF-SHA256-AES-256-GCM',
+                        keyId: 'sentry-test-key',
+                        ephemeralPublicKey: 'TESTEPHEMERAL',
+                        salt: 'TESTSALT',
+                        iv: 'TESTIV',
+                        ciphertext: SENTINEL_SHARE,
+                    },
+                    confirmationCode: '123456',
+                    email: 'recovery-target@example.com',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        } finally {
+            configureScopeSpy.mockRestore();
+        }
+
+        // attachRpcInput is globally disabled (see routes/index.ts), so
+        // Sentry never received the raw input above in the first place.
+        // This proves the defense-in-depth layer independently: every one
+        // of the five /keys/* calls above registered a redacting processor.
+        expect(registeredProcessors.length).toBe(5);
+
+        const syntheticEvent = {
+            contexts: {
+                trpc: {
+                    procedure_type: 'mutation',
+                    input: {
+                        authToken: SENTINEL_TOKEN,
+                        authShare: { encryptedData: SENTINEL_SHARE, encryptedDek: 'x', iv: 'iv' },
+                        emailShare: SENTINEL_SHARE,
+                    },
+                },
+            },
+            extra: { recoveryKey: SENTINEL_SHARE, credentialId: 'safe-value' },
+        };
+
+        // Apply every registered processor, as the real Sentry client would.
+        let result: Record<string, unknown> = syntheticEvent;
+        for (const processor of registeredProcessors) {
+            result = (processor(result) as Record<string, unknown>) ?? result;
+        }
+
+        const serialized = JSON.stringify(result);
+        expect(serialized).not.toContain(SENTINEL_TOKEN);
+        expect(serialized).not.toContain(SENTINEL_SHARE);
+        // Confirms redaction is targeted, not a blanket event wipe
+        expect(serialized).toContain('safe-value');
+    });
+
+    it('does not register the redacting processor for non-/keys/* routes', async () => {
+        const registeredProcessors: Array<(event: Record<string, unknown>) => unknown> = [];
+
+        const configureScopeSpy = vi
+            .spyOn(Sentry, 'configureScope')
+            .mockImplementation(callback => {
+                callback(captureScope(registeredProcessors));
+            });
+
+        try {
+            await getClient().utilities.healthCheck();
+        } finally {
+            configureScopeSpy.mockRestore();
+        }
+
+        expect(registeredProcessors).toHaveLength(0);
+    });
+});

package/test/models/authSubjectIndexes.spec.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const collection = vi.hoisted(() => ({
+    indexes: vi.fn(),
+    dropIndex: vi.fn(async () => undefined),
+    createIndex: vi.fn(async () => 'index'),
+    findOneAndUpdate: vi.fn(),
+}));
+
+vi.mock('@mongo', () => ({ default: { collection: () => collection } }));
+
+const createAuthSubjectIndexes = async (): Promise<void> => {
+    const model = await import('../../src/models/AuthSubject');
+    await model.createAuthSubjectIndexes();
+};
+
+beforeEach(() => {
+    vi.resetModules();
+    collection.indexes.mockReset().mockResolvedValue([{ name: '_id_', key: { _id: 1 } }]);
+    collection.dropIndex.mockReset().mockResolvedValue(undefined);
+    collection.createIndex.mockReset().mockResolvedValue('index');
+    collection.findOneAndUpdate.mockReset().mockResolvedValue({ subject: 'subject' });
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+});
+afterEach(() => vi.restoreAllMocks());
+
+describe('createAuthSubjectIndexes', () => {
+    it('indexes subject without uniqueness so linked sign-in methods can share it', async () => {
+        await createAuthSubjectIndexes();
+
+        expect(collection.createIndex).toHaveBeenCalledWith({ subject: 1 });
+        expect(collection.createIndex).not.toHaveBeenCalledWith(
+            { subject: 1 },
+            expect.objectContaining({ unique: true })
+        );
+    });
+
+    it('keeps identityKey unique', async () => {
+        await createAuthSubjectIndexes();
+
+        expect(collection.createIndex).toHaveBeenCalledWith({ identityKey: 1 }, { unique: true });
+    });
+
+    it('drops a pre-existing unique subject index before recreating it', async () => {
+        collection.indexes.mockResolvedValue([
+            { name: '_id_', key: { _id: 1 } },
+            { name: 'subject_1', key: { subject: 1 }, unique: true },
+        ]);
+
+        await createAuthSubjectIndexes();
+
+        expect(collection.dropIndex).toHaveBeenCalledWith('subject_1');
+        expect(collection.dropIndex.mock.invocationCallOrder[0]).toBeLessThan(
+            collection.createIndex.mock.invocationCallOrder[0] ?? Infinity
+        );
+    });
+
+    it('leaves a non-unique subject index alone', async () => {
+        collection.indexes.mockResolvedValue([{ name: 'subject_1', key: { subject: 1 } }]);
+
+        await createAuthSubjectIndexes();
+
+        expect(collection.dropIndex).not.toHaveBeenCalled();
+    });
+
+    it('treats a missing collection as having no indexes', async () => {
+        collection.indexes.mockRejectedValue(Object.assign(new Error('ns'), { code: 26 }));
+
+        await createAuthSubjectIndexes();
+
+        expect(collection.createIndex).toHaveBeenCalledTimes(2);
+    });
+
+    it('tolerates the legacy index disappearing concurrently', async () => {
+        collection.indexes.mockResolvedValue([
+            { name: 'subject_1', key: { subject: 1 }, unique: true },
+        ]);
+        collection.dropIndex.mockRejectedValueOnce(Object.assign(new Error('gone'), { code: 27 }));
+
+        await expect(createAuthSubjectIndexes()).resolves.toBeUndefined();
+    });
+});
+
+describe('AuthSubject index readiness', () => {
+    it.each(['subject', 'identityKey'])(
+        'rejects all waiters when %s indexing fails, then retries',
+        async failedIndex => {
+            const { createIndex, findOneAndUpdate } = collection;
+            const { ensureAuthSubjectIndexes, getOrCreateAuthSubject } =
+                await import('../../src/models/AuthSubject');
+            const failure = new Error('index unavailable');
+            let rejectIndex!: (error: Error) => void;
+            const pendingIndex = new Promise<string>((_resolve, reject) => {
+                rejectIndex = reject;
+            });
+            if (failedIndex === 'identityKey') createIndex.mockResolvedValueOnce('subject');
+            createIndex.mockImplementationOnce(() => pendingIndex);
+
+            const ready = ensureAuthSubjectIndexes();
+            expect(ensureAuthSubjectIndexes()).toBe(ready);
+            const waiters = Promise.allSettled([
+                ready,
+                getOrCreateAuthSubject('email:test@example.com', { emailVerified: true }),
+                getOrCreateAuthSubject('email:test@example.com', { emailVerified: true }),
+            ]);
+            rejectIndex(failure);
+            expect(await waiters).toEqual(
+                Array.from({ length: 3 }, () => ({ status: 'rejected', reason: failure }))
+            );
+            expect(findOneAndUpdate).not.toHaveBeenCalled();
+
+            createIndex.mockClear();
+            const completed: string[] = [];
+            createIndex.mockImplementation(async (key: Record<string, number>) => {
+                completed.push(Object.keys(key)[0]!);
+                return 'index';
+            });
+            findOneAndUpdate.mockImplementation(async () => {
+                expect(completed).toEqual(['subject', 'identityKey']);
+                return { subject: 'subject' };
+            });
+            await getOrCreateAuthSubject('email:test@example.com', { emailVerified: true });
+            expect(createIndex.mock.calls).toEqual([
+                [{ subject: 1 }],
+                [{ identityKey: 1 }, { unique: true }],
+            ]);
+            expect(findOneAndUpdate).toHaveBeenCalledOnce();
+            await ensureAuthSubjectIndexes();
+            expect(createIndex).toHaveBeenCalledTimes(2);
+        }
+    );
+});