@oneuptime/common 12.0.13 → 12.0.14

package/Tests/Server/API/UserTotpAuthAPI.test.ts

@@ -0,0 +1,427 @@
+import UserTotpAuthAPI from "../../../Server/API/UserTotpAuthAPI";
+import UserTotpAuthService from "../../../Server/Services/UserTotpAuthService";
+import UserService from "../../../Server/Services/UserService";
+import TotpAuth from "../../../Server/Utils/TotpAuth";
+import {
+  NextFunction,
+  OneUptimeRequest,
+  OneUptimeResponse,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { mockRouter } from "./Helpers";
+import Email from "../../../Types/Email";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ObjectID from "../../../Types/ObjectID";
+import UserTotpAuth from "../../../Models/DatabaseModels/UserTotpAuth";
+import User from "../../../Models/DatabaseModels/User";
+import * as OTPAuth from "otpauth";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * POST /user-totp-auth/validate — the endpoint that turns a scanned QR code
+ * into a working second factor.
+ *
+ * TotpAuth itself is deliberately NOT mocked here. The bug this endpoint
+ * failed on (issue #3275) lived precisely in the seam between what the QR code
+ * told the authenticator app and what the server recomputed, so a test that
+ * stubs the verifier proves nothing about it. The secret is generated by the
+ * real service path, the code is produced by parsing the stored otpauth:// URI
+ * exactly as an authenticator app would, and the endpoint gets the real thing.
+ *
+ * The second concern is ownership. `id` comes from the request body, so
+ * without the userId comparison any signed-in user could mark a stranger's
+ * pending TOTP row as verified using a code from their own phone — a second
+ * factor the victim does not hold. That check is asserted directly, and the
+ * assertion that matters is that isVerified is never written.
+ */
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+    setNoCacheHeaders: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/Services/UserTotpAuthService");
+jest.mock("../../../Server/Services/UserService");
+
+const VALIDATE_ROUTE: string = "/user-totp-auth/validate";
+
+const TOTP_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const OWNER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const ATTACKER_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+
+const OWNER_EMAIL: Email = new Email("owner@example.com");
+
+type CallValidateResult = {
+  thrown: unknown;
+  nextCallCount: number;
+};
+
+type CallValidateFunction = (data: {
+  body: Record<string, unknown>;
+  signedInUserId?: ObjectID | undefined;
+}) => Promise<CallValidateResult>;
+
+const callValidate: CallValidateFunction = async (data: {
+  body: Record<string, unknown>;
+  signedInUserId?: ObjectID | undefined;
+}): Promise<CallValidateResult> => {
+  const req: OneUptimeRequest = {
+    body: data.body,
+    params: {},
+    query: {},
+    headers: {},
+    userAuthorization: {
+      userId: data.signedInUserId || OWNER_ID,
+    },
+  } as unknown as OneUptimeRequest;
+
+  const res: OneUptimeResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    setHeader: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+  } as unknown as OneUptimeResponse;
+
+  const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+  await mockRouter
+    .match("post", VALIDATE_ROUTE)
+    .handlerFunction(req, res, next);
+
+  const nextMock: jest.Mock = next as unknown as jest.Mock;
+
+  return {
+    thrown: nextMock.mock.calls[0]?.[0],
+    nextCallCount: nextMock.mock.calls.length,
+  };
+};
+
+/*
+ * A pending enrolment, built the way the service builds one: a real secret and
+ * the real otpauth:// URI derived from it.
+ */
+type PendingEnrolmentFunction = (options?: { ownerId?: ObjectID }) => {
+  row: UserTotpAuth;
+  secret: string;
+  codeFromTheAuthenticatorApp: () => string;
+};
+
+const pendingEnrolment: PendingEnrolmentFunction = (options?: {
+  ownerId?: ObjectID;
+}) => {
+  const secret: string = TotpAuth.generateSecret();
+
+  const otpUrl: string = TotpAuth.generateUri({
+    secret: secret,
+    userEmail: OWNER_EMAIL,
+  });
+
+  const row: UserTotpAuth = new UserTotpAuth();
+  row.id = TOTP_ID;
+  row.userId = options?.ownerId || OWNER_ID;
+  row.twoFactorSecret = secret;
+  row.twoFactorOtpUrl = otpUrl;
+  row.isVerified = false;
+
+  return {
+    row: row,
+    secret: secret,
+    codeFromTheAuthenticatorApp: (): string => {
+      return (OTPAuth.URI.parse(otpUrl) as OTPAuth.TOTP).generate();
+    },
+  };
+};
+
+let findTotpById: jest.Mock;
+let updateTotpById: jest.Mock;
+let findUserById: jest.Mock;
+
+describe("POST /user-totp-auth/validate", () => {
+  beforeEach(() => {
+    mockRouter.routes.length = 0;
+
+    findTotpById = jest.fn();
+    updateTotpById = jest.fn(async () => {
+      return undefined;
+    });
+    findUserById = jest.fn();
+
+    UserTotpAuthService.findOneById = findTotpById as never;
+    UserTotpAuthService.updateOneById = updateTotpById as never;
+    UserTotpAuthService.getModel = jest
+      .fn()
+      .mockReturnValue({ tableName: "UserTotpAuth" }) as never;
+
+    UserService.findOneById = findUserById as never;
+
+    const owner: User = new User();
+    owner.id = OWNER_ID;
+    owner.email = OWNER_EMAIL;
+    findUserById.mockResolvedValue(owner as never);
+
+    new UserTotpAuthAPI();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("the route itself", () => {
+    test("is registered as a POST", () => {
+      expect(() => {
+        return mockRouter.match("post", VALIDATE_ROUTE);
+      }).not.toThrow();
+    });
+
+    /*
+     * Without an authentication middleware the handler would read
+     * `userAuthorization` off an unauthenticated request, the ownership
+     * comparison below would compare against `undefined`, and anybody could
+     * verify anybody's TOTP row.
+     */
+    test("is behind an authentication middleware", () => {
+      expect(mockRouter.match("post", VALIDATE_ROUTE).middlewares.length).toBe(
+        1,
+      );
+    });
+  });
+
+  describe("when the code is the one the user's app is showing", () => {
+    test("marks the enrolment verified", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeUndefined();
+
+      expect(updateTotpById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: TOTP_ID,
+          data: { isVerified: true },
+        }),
+      );
+
+      expect(Response.sendEmptySuccessResponse).toHaveBeenCalled();
+    });
+
+    /*
+     * Google Authenticator renders the code as "123 456" and the phone
+     * clipboard keeps the space. This is the same enrolment, pasted.
+     */
+    test("accepts the code as the phone's clipboard hands it over", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const code: string = enrolment.codeFromTheAuthenticatorApp();
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: `${code.slice(0, 3)} ${code.slice(3)}`,
+        },
+      });
+
+      expect(result.thrown).toBeUndefined();
+      expect(updateTotpById).toHaveBeenCalled();
+    });
+
+    test("reads the secret with root privileges, since the column is unreadable otherwise", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(findTotpById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          select: expect.objectContaining({ twoFactorSecret: true }),
+          props: { isRoot: true },
+        }),
+      );
+    });
+  });
+
+  describe("when the code is wrong", () => {
+    test("fails with Invalid code and leaves the enrolment unverified", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "000000" },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect((result.thrown as Exception).message).toBe("Invalid code");
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test.each([
+      ["a missing code", undefined],
+      ["an empty code", ""],
+      ["a truncated code", "1234"],
+    ])(
+      "rejects %s without verifying anything",
+      async (_name: string, code: string | undefined) => {
+        const enrolment: ReturnType<PendingEnrolmentFunction> =
+          pendingEnrolment();
+
+        findTotpById.mockResolvedValue(enrolment.row as never);
+
+        const result: CallValidateResult = await callValidate({
+          body: { id: TOTP_ID.toString(), code: code },
+        });
+
+        expect(result.thrown).toBeInstanceOf(BadDataException);
+        expect(updateTotpById).not.toHaveBeenCalled();
+      },
+    );
+
+    /*
+     * A code that is valid for a DIFFERENT enrolment. This is what an attacker
+     * with their own authenticator would submit.
+     */
+    test("rejects a code that is valid for somebody else's secret", async () => {
+      const victim: ReturnType<PendingEnrolmentFunction> = pendingEnrolment();
+      const attacker: ReturnType<PendingEnrolmentFunction> = pendingEnrolment();
+
+      findTotpById.mockResolvedValue(victim.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: attacker.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("ownership", () => {
+    /*
+     * `id` is attacker-controlled. If the handler stopped comparing userId, a
+     * signed-in attacker could point this endpoint at any pending enrolment in
+     * the database and verify it with a code from their own phone.
+     */
+    test("refuses to verify an enrolment belonging to another user", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> = pendingEnrolment({
+        ownerId: OWNER_ID,
+      });
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+        signedInUserId: ATTACKER_ID,
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("does not reveal that the enrolment exists", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> = pendingEnrolment({
+        ownerId: OWNER_ID,
+      });
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+        signedInUserId: ATTACKER_ID,
+      });
+
+      expect((result.thrown as Exception).message).toBe(
+        "Two factor auth not found",
+      );
+    });
+  });
+
+  describe("when the record is not usable", () => {
+    test("fails when no such enrolment exists", async () => {
+      findTotpById.mockResolvedValue(null as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "123456" },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("fails when the owning user has no email to label the entry with", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const emailless: User = new User();
+      emailless.id = OWNER_ID;
+      findUserById.mockResolvedValue(emailless as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("surfaces the failure through next() rather than crashing the request", async () => {
+      findTotpById.mockRejectedValue(new Error("database is on fire") as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "123456" },
+      });
+
+      expect(result.nextCallCount).toBe(1);
+      expect(result.thrown).toBeInstanceOf(Error);
+    });
+  });
+});