@oneuptime/common 12.0.3 → 12.0.5

package/Tests/Server/API/DashboardMasterPasswordAPI.test.ts

@@ -3,6 +3,7 @@ import DashboardAPI from "../../../Server/API/DashboardAPI";
 import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
 import DashboardService from "../../../Server/Services/DashboardService";
 import CookieUtil from "../../../Server/Utils/Cookie";
+import PasswordHash from "../../../Server/Utils/PasswordHash";
 import {
   ExpressRequest,
   ExpressResponse,
@@ -75,8 +76,12 @@ describe("DashboardAPI master password", () => {
     dashboard.id = dashboardId;
     dashboard.isPublicDashboard = true;
     dashboard.enableMasterPassword = true;
+    dashboard.masterPasswordSalt = PasswordHash.generateSalt();
     dashboard.masterPassword = new HashedString(
-      await HashedString.hashValue(password, EncryptionSecret),
+      await PasswordHash.hash({
+        plainValue: password,
+        salt: dashboard.masterPasswordSalt,
+      }),
       true,
     );
 
@@ -204,6 +209,20 @@ describe("DashboardAPI master password", () => {
     );
   });
 
+  it("verifies a current scrypt password without rewriting it", async () => {
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(DashboardService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(updateSpy).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+  });
+
   it("rejects an incorrect password without issuing a cookie", async () => {
     mockRequest.body["password"] = "incorrect password";
 
@@ -222,4 +241,156 @@ describe("DashboardAPI master password", () => {
     expect(mockResponse.cookie).not.toHaveBeenCalled();
     expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
   });
+
+  it.each([123, { password: "nested" }, [password]])(
+    "rejects a non-string password body (%p) before hash verification",
+    async (invalidPassword: unknown) => {
+      (mockRequest.body as Record<string, unknown>)["password"] =
+        invalidPassword;
+      const verifySpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+        DashboardService,
+        "verifyHashedColumnValue",
+      );
+
+      await mockRouter
+        .match("post", "/dashboard/master-password/:dashboardId")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledTimes(1);
+      const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+      expect(error).toBeInstanceOf(BadDataException);
+      expect((error as BadDataException).message).toBe(
+        "Master password is required.",
+      );
+      expect(verifySpy).not.toHaveBeenCalled();
+      expect(DashboardService.findOneById).not.toHaveBeenCalled();
+      expect(mockResponse.cookie).not.toHaveBeenCalled();
+    },
+  );
+
+  it("uses this dashboard's selected salt when checking the password", async () => {
+    dashboard.masterPasswordSalt = PasswordHash.generateSalt();
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+    expect(error).toBeInstanceOf(BadDataException);
+    expect((error as BadDataException).message).toBe(
+      DASHBOARD_MASTER_PASSWORD_INVALID_MESSAGE,
+    );
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+  });
+
+  it("selects the salt needed for verification but never exposes either credential column", async () => {
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(DashboardService.findOneById).toHaveBeenCalledWith(
+      expect.objectContaining({
+        select: expect.objectContaining({
+          masterPassword: true,
+          masterPasswordSalt: true,
+        }),
+      }),
+    );
+    expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+      mockRequest,
+      mockResponse,
+    );
+    expect(Response.sendEntityResponse).not.toHaveBeenCalled();
+    expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+    expect(mockResponse.send).not.toHaveBeenCalled();
+    expect(mockResponse.json).not.toHaveBeenCalled();
+
+    const cookieArguments: Array<unknown> = (mockResponse.cookie as jest.Mock)
+      .mock.calls[0] as Array<unknown>;
+    const serializedCookieArguments: string = JSON.stringify(cookieArguments);
+
+    expect(serializedCookieArguments).not.toContain(password);
+    expect(serializedCookieArguments).not.toContain(
+      dashboard.masterPassword!.toString(),
+    );
+    expect(serializedCookieArguments).not.toContain(
+      dashboard.masterPasswordSalt,
+    );
+  });
+
+  it("accepts a legacy unsalted SHA-256 password and upgrades it to scrypt", async () => {
+    dashboard.masterPassword = new HashedString(
+      await HashedString.hashValue(password, EncryptionSecret),
+      true,
+    );
+    delete dashboard.masterPasswordSalt;
+
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(DashboardService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+    expect(updateSpy).toHaveBeenCalledTimes(1);
+
+    const update: {
+      id: ObjectID;
+      data: Record<string, unknown>;
+      expectedData?: Record<string, unknown>;
+      skipUpdateDateColumn?: boolean;
+    } = updateSpy.mock.calls[0]![0] as unknown as {
+      id: ObjectID;
+      data: Record<string, unknown>;
+      expectedData?: Record<string, unknown>;
+      skipUpdateDateColumn?: boolean;
+    };
+
+    expect(update.id.toString()).toBe(dashboardId.toString());
+    expect(update.skipUpdateDateColumn).toBe(true);
+    expect(update.data["masterPassword"]).toEqual(
+      expect.stringMatching(/^scrypt\$/),
+    );
+    expect(update.data["masterPasswordSalt"]).toEqual(
+      expect.stringMatching(/^[0-9a-f]{64}$/),
+    );
+    expect(update.expectedData).toEqual({
+      masterPassword: dashboard.masterPassword!.toString(),
+      masterPasswordSalt: null,
+    });
+    await expect(
+      PasswordHash.verify({
+        plainValue: password,
+        storedValue: update.data["masterPassword"] as string,
+        salt: update.data["masterPasswordSalt"] as string,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  it("does not upgrade a legacy hash when the password is wrong", async () => {
+    dashboard.masterPassword = new HashedString(
+      await HashedString.hashValue(password, EncryptionSecret),
+      true,
+    );
+    delete dashboard.masterPasswordSalt;
+    mockRequest.body["password"] = "incorrect password";
+
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(DashboardService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    expect(updateSpy).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+  });
 });