@oneuptime/common 12.0.13 → 12.0.15

package/Tests/Server/API/UserTotpAuthAPI.test.ts

@@ -0,0 +1,427 @@
+import UserTotpAuthAPI from "../../../Server/API/UserTotpAuthAPI";
+import UserTotpAuthService from "../../../Server/Services/UserTotpAuthService";
+import UserService from "../../../Server/Services/UserService";
+import TotpAuth from "../../../Server/Utils/TotpAuth";
+import {
+  NextFunction,
+  OneUptimeRequest,
+  OneUptimeResponse,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { mockRouter } from "./Helpers";
+import Email from "../../../Types/Email";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ObjectID from "../../../Types/ObjectID";
+import UserTotpAuth from "../../../Models/DatabaseModels/UserTotpAuth";
+import User from "../../../Models/DatabaseModels/User";
+import * as OTPAuth from "otpauth";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * POST /user-totp-auth/validate — the endpoint that turns a scanned QR code
+ * into a working second factor.
+ *
+ * TotpAuth itself is deliberately NOT mocked here. The bug this endpoint
+ * failed on (issue #3275) lived precisely in the seam between what the QR code
+ * told the authenticator app and what the server recomputed, so a test that
+ * stubs the verifier proves nothing about it. The secret is generated by the
+ * real service path, the code is produced by parsing the stored otpauth:// URI
+ * exactly as an authenticator app would, and the endpoint gets the real thing.
+ *
+ * The second concern is ownership. `id` comes from the request body, so
+ * without the userId comparison any signed-in user could mark a stranger's
+ * pending TOTP row as verified using a code from their own phone — a second
+ * factor the victim does not hold. That check is asserted directly, and the
+ * assertion that matters is that isVerified is never written.
+ */
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+    setNoCacheHeaders: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/Services/UserTotpAuthService");
+jest.mock("../../../Server/Services/UserService");
+
+const VALIDATE_ROUTE: string = "/user-totp-auth/validate";
+
+const TOTP_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const OWNER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const ATTACKER_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+
+const OWNER_EMAIL: Email = new Email("owner@example.com");
+
+type CallValidateResult = {
+  thrown: unknown;
+  nextCallCount: number;
+};
+
+type CallValidateFunction = (data: {
+  body: Record<string, unknown>;
+  signedInUserId?: ObjectID | undefined;
+}) => Promise<CallValidateResult>;
+
+const callValidate: CallValidateFunction = async (data: {
+  body: Record<string, unknown>;
+  signedInUserId?: ObjectID | undefined;
+}): Promise<CallValidateResult> => {
+  const req: OneUptimeRequest = {
+    body: data.body,
+    params: {},
+    query: {},
+    headers: {},
+    userAuthorization: {
+      userId: data.signedInUserId || OWNER_ID,
+    },
+  } as unknown as OneUptimeRequest;
+
+  const res: OneUptimeResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    setHeader: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+  } as unknown as OneUptimeResponse;
+
+  const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+  await mockRouter
+    .match("post", VALIDATE_ROUTE)
+    .handlerFunction(req, res, next);
+
+  const nextMock: jest.Mock = next as unknown as jest.Mock;
+
+  return {
+    thrown: nextMock.mock.calls[0]?.[0],
+    nextCallCount: nextMock.mock.calls.length,
+  };
+};
+
+/*
+ * A pending enrolment, built the way the service builds one: a real secret and
+ * the real otpauth:// URI derived from it.
+ */
+type PendingEnrolmentFunction = (options?: { ownerId?: ObjectID }) => {
+  row: UserTotpAuth;
+  secret: string;
+  codeFromTheAuthenticatorApp: () => string;
+};
+
+const pendingEnrolment: PendingEnrolmentFunction = (options?: {
+  ownerId?: ObjectID;
+}) => {
+  const secret: string = TotpAuth.generateSecret();
+
+  const otpUrl: string = TotpAuth.generateUri({
+    secret: secret,
+    userEmail: OWNER_EMAIL,
+  });
+
+  const row: UserTotpAuth = new UserTotpAuth();
+  row.id = TOTP_ID;
+  row.userId = options?.ownerId || OWNER_ID;
+  row.twoFactorSecret = secret;
+  row.twoFactorOtpUrl = otpUrl;
+  row.isVerified = false;
+
+  return {
+    row: row,
+    secret: secret,
+    codeFromTheAuthenticatorApp: (): string => {
+      return (OTPAuth.URI.parse(otpUrl) as OTPAuth.TOTP).generate();
+    },
+  };
+};
+
+let findTotpById: jest.Mock;
+let updateTotpById: jest.Mock;
+let findUserById: jest.Mock;
+
+describe("POST /user-totp-auth/validate", () => {
+  beforeEach(() => {
+    mockRouter.routes.length = 0;
+
+    findTotpById = jest.fn();
+    updateTotpById = jest.fn(async () => {
+      return undefined;
+    });
+    findUserById = jest.fn();
+
+    UserTotpAuthService.findOneById = findTotpById as never;
+    UserTotpAuthService.updateOneById = updateTotpById as never;
+    UserTotpAuthService.getModel = jest
+      .fn()
+      .mockReturnValue({ tableName: "UserTotpAuth" }) as never;
+
+    UserService.findOneById = findUserById as never;
+
+    const owner: User = new User();
+    owner.id = OWNER_ID;
+    owner.email = OWNER_EMAIL;
+    findUserById.mockResolvedValue(owner as never);
+
+    new UserTotpAuthAPI();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("the route itself", () => {
+    test("is registered as a POST", () => {
+      expect(() => {
+        return mockRouter.match("post", VALIDATE_ROUTE);
+      }).not.toThrow();
+    });
+
+    /*
+     * Without an authentication middleware the handler would read
+     * `userAuthorization` off an unauthenticated request, the ownership
+     * comparison below would compare against `undefined`, and anybody could
+     * verify anybody's TOTP row.
+     */
+    test("is behind an authentication middleware", () => {
+      expect(mockRouter.match("post", VALIDATE_ROUTE).middlewares.length).toBe(
+        1,
+      );
+    });
+  });
+
+  describe("when the code is the one the user's app is showing", () => {
+    test("marks the enrolment verified", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeUndefined();
+
+      expect(updateTotpById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: TOTP_ID,
+          data: { isVerified: true },
+        }),
+      );
+
+      expect(Response.sendEmptySuccessResponse).toHaveBeenCalled();
+    });
+
+    /*
+     * Google Authenticator renders the code as "123 456" and the phone
+     * clipboard keeps the space. This is the same enrolment, pasted.
+     */
+    test("accepts the code as the phone's clipboard hands it over", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const code: string = enrolment.codeFromTheAuthenticatorApp();
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: `${code.slice(0, 3)} ${code.slice(3)}`,
+        },
+      });
+
+      expect(result.thrown).toBeUndefined();
+      expect(updateTotpById).toHaveBeenCalled();
+    });
+
+    test("reads the secret with root privileges, since the column is unreadable otherwise", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(findTotpById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          select: expect.objectContaining({ twoFactorSecret: true }),
+          props: { isRoot: true },
+        }),
+      );
+    });
+  });
+
+  describe("when the code is wrong", () => {
+    test("fails with Invalid code and leaves the enrolment unverified", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "000000" },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect((result.thrown as Exception).message).toBe("Invalid code");
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test.each([
+      ["a missing code", undefined],
+      ["an empty code", ""],
+      ["a truncated code", "1234"],
+    ])(
+      "rejects %s without verifying anything",
+      async (_name: string, code: string | undefined) => {
+        const enrolment: ReturnType<PendingEnrolmentFunction> =
+          pendingEnrolment();
+
+        findTotpById.mockResolvedValue(enrolment.row as never);
+
+        const result: CallValidateResult = await callValidate({
+          body: { id: TOTP_ID.toString(), code: code },
+        });
+
+        expect(result.thrown).toBeInstanceOf(BadDataException);
+        expect(updateTotpById).not.toHaveBeenCalled();
+      },
+    );
+
+    /*
+     * A code that is valid for a DIFFERENT enrolment. This is what an attacker
+     * with their own authenticator would submit.
+     */
+    test("rejects a code that is valid for somebody else's secret", async () => {
+      const victim: ReturnType<PendingEnrolmentFunction> = pendingEnrolment();
+      const attacker: ReturnType<PendingEnrolmentFunction> = pendingEnrolment();
+
+      findTotpById.mockResolvedValue(victim.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: attacker.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("ownership", () => {
+    /*
+     * `id` is attacker-controlled. If the handler stopped comparing userId, a
+     * signed-in attacker could point this endpoint at any pending enrolment in
+     * the database and verify it with a code from their own phone.
+     */
+    test("refuses to verify an enrolment belonging to another user", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> = pendingEnrolment({
+        ownerId: OWNER_ID,
+      });
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+        signedInUserId: ATTACKER_ID,
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("does not reveal that the enrolment exists", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> = pendingEnrolment({
+        ownerId: OWNER_ID,
+      });
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+        signedInUserId: ATTACKER_ID,
+      });
+
+      expect((result.thrown as Exception).message).toBe(
+        "Two factor auth not found",
+      );
+    });
+  });
+
+  describe("when the record is not usable", () => {
+    test("fails when no such enrolment exists", async () => {
+      findTotpById.mockResolvedValue(null as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "123456" },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("fails when the owning user has no email to label the entry with", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const emailless: User = new User();
+      emailless.id = OWNER_ID;
+      findUserById.mockResolvedValue(emailless as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("surfaces the failure through next() rather than crashing the request", async () => {
+      findTotpById.mockRejectedValue(new Error("database is on fire") as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "123456" },
+      });
+
+      expect(result.nextCallCount).toBe(1);
+      expect(result.thrown).toBeInstanceOf(Error);
+    });
+  });
+});

package/Tests/Server/Infrastructure/Postgres/FixTotpOtpUrlAlgorithmMigration.test.ts

@@ -0,0 +1,265 @@
+import { FixTotpOtpUrlAlgorithm1787700000000 } from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/1787700000000-FixTotpOtpUrlAlgorithm";
+import SchemaMigrations from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import TotpAuth from "../../../../Server/Utils/TotpAuth";
+import Email from "../../../../Types/Email";
+import * as OTPAuth from "otpauth";
+import { MigrationInterface, QueryRunner } from "typeorm";
+import fs from "fs";
+import path from "path";
+import { beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * The data repair behind the code fix.
+ *
+ * A row created before the fix still has `algorithm=SHA256` in the URL its QR
+ * code is rendered from. That no longer locks anyone out — verification tries
+ * SHA1 first, which is what those phones were emitting all along, and the tests
+ * below prove both a phone and a conforming app get in either way. What the
+ * rewrite buys is a stored URL that stops lying, which matters for the apps
+ * that DO honour the parameter and have no SHA256.
+ *
+ * Two properties are load-bearing and both are asserted here:
+ *
+ *   1. the secret is untouched, so an app that already scanned the old QR code
+ *      keeps working (verification accepts SHA1 and legacy SHA256 either way);
+ *   2. verified rows are left alone. Their QR is never displayed again — the
+ *      Verify action only exists for unverified entries — so the stored URL is
+ *      a record of what the user's authenticator actually holds, and rewriting
+ *      it would falsify that record for no benefit.
+ *
+ * The statements are inspected rather than executed: these tests must run
+ * without a database, and what can go wrong here is the WHERE clause, not
+ * Postgres' REPLACE().
+ *
+ * The ordering of this migration against the others is no longer asserted
+ * here. It used to be — as a guard hand-carried from one migration's test to
+ * the next, which broke the moment a migration was added without moving it.
+ * It now lives in SchemaMigrationsOrdering.test.ts, written against the
+ * registry as a whole so that it covers whichever migration is newest without
+ * anybody having to remember it.
+ */
+
+const MIGRATION_TIMESTAMP: string = "1787700000000";
+
+const MIGRATION_DIRECTORY: string = path.join(
+  __dirname,
+  "../../../../Server/Infrastructure/Postgres/SchemaMigrations",
+);
+
+type CapturedQueryRunner = {
+  runner: QueryRunner;
+  queries: Array<string>;
+};
+
+type MockQueryRunnerFunction = () => CapturedQueryRunner;
+
+const mockQueryRunner: MockQueryRunnerFunction = (): CapturedQueryRunner => {
+  const queries: Array<string> = [];
+
+  return {
+    queries: queries,
+    runner: {
+      query: async (sql: string): Promise<void> => {
+        queries.push(sql);
+      },
+    } as unknown as QueryRunner,
+  };
+};
+
+const migration: FixTotpOtpUrlAlgorithm1787700000000 =
+  new FixTotpOtpUrlAlgorithm1787700000000();
+
+let up: CapturedQueryRunner;
+let down: CapturedQueryRunner;
+
+describe("FixTotpOtpUrlAlgorithm migration", () => {
+  beforeEach(async () => {
+    up = mockQueryRunner();
+    down = mockQueryRunner();
+
+    await migration.up(up.runner);
+    await migration.down(down.runner);
+  });
+
+  /*
+   * TypeORM matches migrations by this name. A mismatch between the class name
+   * and the `name` property makes the migration run again on every boot.
+   */
+  test("names itself consistently so it is recorded as run", () => {
+    expect(migration.name).toBe("FixTotpOtpUrlAlgorithm1787700000000");
+  });
+
+  test("is registered in SchemaMigrations/Index.ts, or it never runs", () => {
+    expect(SchemaMigrations).toContain(FixTotpOtpUrlAlgorithm1787700000000);
+  });
+
+  describe("registration", () => {
+    test("it is registered exactly once", () => {
+      const occurrences: number = SchemaMigrations.filter(
+        (migration: new () => MigrationInterface): boolean => {
+          return migration.name === "FixTotpOtpUrlAlgorithm1787700000000";
+        },
+      ).length;
+
+      expect(occurrences).toBe(1);
+    });
+
+    /*
+     * ...and the timestamp in the class name is the one on disk. A class
+     * renamed without renaming its file (or two migrations landing on the
+     * same timestamp) leaves the registry pointing at a different file from
+     * the one this test read.
+     */
+    test("exactly one file on disk carries its timestamp, and it is this one", () => {
+      const matching: Array<string> = fs
+        .readdirSync(MIGRATION_DIRECTORY)
+        .filter((file: string): boolean => {
+          return file.startsWith(`${MIGRATION_TIMESTAMP}-`);
+        });
+
+      expect(matching).toEqual([
+        `${MIGRATION_TIMESTAMP}-FixTotpOtpUrlAlgorithm.ts`,
+      ]);
+    });
+  });
+
+  describe("up", () => {
+    test("rewrites the algorithm in the stored otpauth URL", () => {
+      expect(up.queries).toHaveLength(1);
+      expect(up.queries[0]).toContain(`UPDATE "UserTotpAuth"`);
+      expect(up.queries[0]).toContain(
+        `REPLACE("twoFactorOtpUrl", 'algorithm=SHA256', 'algorithm=SHA1')`,
+      );
+    });
+
+    /*
+     * The secret is the only irreplaceable thing on the row. A migration that
+     * regenerated it would invalidate every authenticator entry in existence.
+     */
+    test("never touches the secret", () => {
+      expect(up.queries[0]).not.toContain("twoFactorSecret");
+    });
+
+    test("only touches enrolments that are still pending", () => {
+      expect(up.queries[0]).toContain(`"isVerified" = false`);
+    });
+
+    test("only touches rows that actually carry the broken algorithm", () => {
+      expect(up.queries[0]).toContain(
+        `"twoFactorOtpUrl" LIKE '%algorithm=SHA256%'`,
+      );
+    });
+
+    test("does not delete anything", () => {
+      expect(up.queries[0]).not.toMatch(/\bDELETE\b|\bDROP\b|\bTRUNCATE\b/i);
+    });
+  });
+
+  describe("down", () => {
+    test("is the exact inverse of up", () => {
+      expect(down.queries).toHaveLength(1);
+      expect(down.queries[0]).toContain(
+        `REPLACE("twoFactorOtpUrl", 'algorithm=SHA1', 'algorithm=SHA256')`,
+      );
+      expect(down.queries[0]).toContain(`"isVerified" = false`);
+    });
+
+    test("never touches the secret either", () => {
+      expect(down.queries[0]).not.toContain("twoFactorSecret");
+    });
+  });
+
+  /*
+   * What the SQL means, applied to a real URL. Postgres' REPLACE is a plain
+   * substring substitution, so doing it here in JavaScript is a faithful model
+   * of the statement above — and it lets the result be handed to the real
+   * parser and the real verifier.
+   */
+  describe("the effect on a row written before the fix", () => {
+    const EMAIL: Email = new Email("stuck.user@example.com");
+
+    type ApplyUpFunction = (url: string) => string;
+
+    const applyUp: ApplyUpFunction = (url: string): string => {
+      return url.split("algorithm=SHA256").join("algorithm=SHA1");
+    };
+
+    type LegacyUrlFunction = (secret: string) => string;
+
+    /*
+     * What the old code wrote: everything as today, but SHA256.
+     */
+    const legacyUrl: LegacyUrlFunction = (secret: string): string => {
+      return new OTPAuth.TOTP({
+        issuer: "OneUptime",
+        label: EMAIL.toString(),
+        algorithm: "SHA256",
+        digits: 6,
+        period: 30,
+        secret: secret,
+      }).toString();
+    };
+
+    test("the repaired QR code produces codes the server accepts", () => {
+      const secret: string = TotpAuth.generateSecret();
+
+      const repaired: OTPAuth.TOTP = OTPAuth.URI.parse(
+        applyUp(legacyUrl(secret)),
+      ) as OTPAuth.TOTP;
+
+      expect(repaired.algorithm).toBe("SHA1");
+
+      expect(
+        TotpAuth.verifyToken({
+          secret: secret,
+          token: repaired.generate(),
+          email: EMAIL,
+        }),
+      ).toBe(true);
+    });
+
+    test("the secret survives the rewrite unchanged", () => {
+      const secret: string = TotpAuth.generateSecret();
+
+      const repaired: OTPAuth.TOTP = OTPAuth.URI.parse(
+        applyUp(legacyUrl(secret)),
+      ) as OTPAuth.TOTP;
+
+      expect(repaired.secret.base32).toBe(secret);
+    });
+
+    /*
+     * Somebody mid-enrolment may already have scanned the old SHA256 QR with
+     * an app that honours the parameter. Rewriting the URL must not strand
+     * them: their app still emits SHA256 codes, and those still verify.
+     */
+    test("an app that already scanned the old SHA256 QR still verifies", () => {
+      const secret: string = TotpAuth.generateSecret();
+
+      const alreadyScanned: OTPAuth.TOTP = OTPAuth.URI.parse(
+        legacyUrl(secret),
+      ) as OTPAuth.TOTP;
+
+      expect(alreadyScanned.algorithm).toBe("SHA256");
+
+      expect(
+        TotpAuth.verifyToken({
+          secret: secret,
+          token: alreadyScanned.generate(),
+          email: EMAIL,
+        }),
+      ).toBe(true);
+    });
+
+    test("a URL that is already SHA1 is left exactly as it was", () => {
+      const secret: string = TotpAuth.generateSecret();
+
+      const current: string = TotpAuth.generateUri({
+        secret: secret,
+        userEmail: EMAIL,
+      });
+
+      expect(applyUp(current)).toBe(current);
+    });
+  });
+});