@proteinjs/user-server 1.22.0 → 1.22.2

package/dist/test/LoginThrottle.integration.test.js

@@ -0,0 +1,616 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var crypto_1 = require("crypto");
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var login_1 = require("../src/routes/login");
+var PasswordHasher_1 = require("../src/authentication/PasswordHasher");
+var passportSessionHarness_1 = require("./passportSessionHarness");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var LogCapture_1 = require("./LogCapture");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/**
+ * `POST /user/login`, end to end against the Spanner emulator, outcomes only (what the door
+ * answers, whether a session was bound, what the log holds):
+ * - per account: ten refused passwords in the window, then every try — the right password too —
+ *   answers "Too many attempts. Try again in a few minutes." and binds no session; an address
+ *   with no account walks the same steps with the same answers; a success clears the count;
+ * - per client address: fifty tries that are not successes, then the same answer for any account;
+ *   successes never count, however many;
+ * - a blank submission counts toward the address window, never an account's;
+ * - the throttled answer takes as long as a refused password, and a refusal for an address with
+ *   no account takes as long as one for an account (no timing tell either way);
+ * - every refusal is a "Sign-in refused" line and every throttled answer its own "Sign-in
+ *   throttled" line, each carrying the account digest and the coarse IP hash — one digest for
+ *   one address however it was typed — and never the address;
+ * - tries in flight at the same moment cannot all pass the account's window together;
+ * - a refusal for an account still in the legacy password format takes as long as any other;
+ * - a field that is not text is a blank one: the door answers, it never throws.
+ */
+var WRONG = 'User name or password incorrect';
+var THROTTLED = 'Too many attempts. Try again in a few minutes.';
+var BLANK = 'Email and password cannot be blank';
+var RIGHT_PASSWORD = 'the right horse battery';
+/** One sign-in attempt from `ip` as the server sees it with no proxy in front (the dev shape). */
+var attempt = function (ip, email, password) { return __awaiter(void 0, void 0, void 0, function () {
+    var sent, response, request;
+    var _a;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                response = {
+                    send: function (body) {
+                        sent = body;
+                    },
+                    status: function () { return response; },
+                };
+                return [4 /*yield*/, (0, passportSessionHarness_1.createPassportRequest)({
+                        body: { email: email, password: password },
+                        headers: {},
+                        socket: { remoteAddress: ip },
+                        app: { get: function () { return false; } },
+                    })];
+            case 1:
+                request = (_b.sent()).request;
+                return [4 /*yield*/, login_1.login.onRequest(request, response)];
+            case 2:
+                _b.sent();
+                return [2 /*return*/, { sent: sent, signedInAs: (_a = request.session.passport) === null || _a === void 0 ? void 0 : _a.user }];
+        }
+    });
+}); };
+var errors = function (count, ip, email, password) { return __awaiter(void 0, void 0, void 0, function () {
+    var answers, i, _a, _b;
+    var _c;
+    return __generator(this, function (_d) {
+        switch (_d.label) {
+            case 0:
+                answers = [];
+                i = 0;
+                _d.label = 1;
+            case 1:
+                if (!(i < count)) return [3 /*break*/, 4];
+                _b = (_a = answers).push;
+                return [4 /*yield*/, attempt(ip(i), email(i), password)];
+            case 2:
+                _b.apply(_a, [(_c = (_d.sent()).sent) === null || _c === void 0 ? void 0 : _c.error]);
+                _d.label = 3;
+            case 3:
+                i++;
+                return [3 /*break*/, 1];
+            case 4: return [2 /*return*/, answers];
+        }
+    });
+}); };
+var createAccount = function (email) { return __awaiter(void 0, void 0, void 0, function () {
+    var user, _a, _b, _c;
+    var _d;
+    return __generator(this, function (_e) {
+        switch (_e.label) {
+            case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Throttle User', email: email })];
+            case 1:
+                user = _e.sent();
+                _b = (_a = (0, db_1.getDbAsSystem)()).update;
+                _c = [user_1.tables.User];
+                _d = { id: user.id };
+                return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(RIGHT_PASSWORD)];
+            case 2: return [4 /*yield*/, _b.apply(_a, _c.concat([(_d.password = _e.sent(), _d)]))];
+            case 3:
+                _e.sent();
+                return [2 /*return*/, user];
+        }
+    });
+}); };
+var elapsedMs = function (run) { return __awaiter(void 0, void 0, void 0, function () {
+    var start;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                start = process.hrtime.bigint();
+                return [4 /*yield*/, run()];
+            case 1:
+                _a.sent();
+                return [2 /*return*/, Number(process.hrtime.bigint() - start) / 1e6];
+        }
+    });
+}); };
+var median = function (values) { return __spreadArray([], values, true).sort(function (a, b) { return a - b; })[Math.floor(values.length / 2)]; };
+/** Log text without terminal colour codes. */
+var plain = function (text) { return text.replace(new RegExp("".concat(String.fromCharCode(27), "\\[[0-9;]*m"), 'g'), ''); };
+/** The `field: '<16 hex>'` values on the lines that contain `marker`. */
+var fieldsOn = function (log, marker, field) {
+    return log.lines
+        .map(plain)
+        .filter(function (line) { return line.includes(marker); })
+        .map(function (line) { var _a, _b; return (_b = (_a = new RegExp("".concat(field, ": '([0-9a-f]{16})'")).exec(line)) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : 'missing'; });
+};
+describe('login route throttle', function () {
+    var originalSecret = process.env.SESSION_SECRET;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.SESSION_SECRET = 'login-throttle-test-secret';
+                    return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    if (originalSecret === undefined) {
+                        delete process.env.SESSION_SECRET;
+                    }
+                    else {
+                        process.env.SESSION_SECRET = originalSecret;
+                    }
+                    return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('ten wrong passwords are refused as today; the eleventh try — even with the right password — is "Too many attempts…" and no session', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var ip, email, _a, _b, right;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle-known@test.local')];
+                case 1:
+                    _c.sent();
+                    ip = function (i) { return "198.51.100.".concat(i + 1); };
+                    email = function (i) { return (i % 2 ? 'Throttle-Known@Test.local' : 'throttle-known@test.local'); };
+                    _a = expect;
+                    return [4 /*yield*/, errors(10, ip, email, 'wrong guess')];
+                case 2:
+                    _a.apply(void 0, [_c.sent()]).toEqual(Array(10).fill(WRONG));
+                    _b = expect;
+                    return [4 /*yield*/, attempt('198.51.100.50', 'throttle-known@test.local', 'wrong guess')];
+                case 3:
+                    _b.apply(void 0, [(_c.sent()).sent]).toEqual({
+                        error: THROTTLED,
+                    });
+                    return [4 /*yield*/, attempt('198.51.100.51', 'throttle-known@test.local', RIGHT_PASSWORD)];
+                case 4:
+                    right = _c.sent();
+                    expect(right.sent).toEqual({ error: THROTTLED });
+                    expect(right.signedInAs).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an address with no account walks the same steps with the same answers', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var ip, email, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    ip = function (i) { return "198.51.101.".concat(i + 1); };
+                    email = function () { return 'throttle-nobody@test.local'; };
+                    _a = expect;
+                    return [4 /*yield*/, errors(10, ip, email, 'wrong guess')];
+                case 1:
+                    _a.apply(void 0, [_c.sent()]).toEqual(Array(10).fill(WRONG));
+                    _b = expect;
+                    return [4 /*yield*/, attempt('198.51.101.50', 'throttle-nobody@test.local', 'wrong guess')];
+                case 2:
+                    _b.apply(void 0, [(_c.sent()).sent]).toEqual({
+                        error: THROTTLED,
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("a success clears the account's count: after it, ten more wrong tries are refused as usual before the throttle", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var ip, email, _a, success, again, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle-cleared@test.local')];
+                case 1:
+                    _d.sent();
+                    ip = function (i) { return "198.51.102.".concat(i + 1); };
+                    email = function () { return 'throttle-cleared@test.local'; };
+                    _a = expect;
+                    return [4 /*yield*/, errors(9, ip, email, 'wrong guess')];
+                case 2:
+                    _a.apply(void 0, [_d.sent()]).toEqual(Array(9).fill(WRONG));
+                    return [4 /*yield*/, attempt('198.51.102.100', 'throttle-cleared@test.local', RIGHT_PASSWORD)];
+                case 3:
+                    success = _d.sent();
+                    expect(success.sent).toEqual({});
+                    expect(success.signedInAs).toBe('throttle-cleared@test.local');
+                    again = function (i) { return "198.51.102.".concat(i + 120); };
+                    _b = expect;
+                    return [4 /*yield*/, errors(10, again, email, 'wrong guess')];
+                case 4:
+                    _b.apply(void 0, [_d.sent()]).toEqual(Array(10).fill(WRONG));
+                    _c = expect;
+                    return [4 /*yield*/, attempt('198.51.102.200', 'throttle-cleared@test.local', 'wrong guess')];
+                case 5:
+                    _c.apply(void 0, [(_d.sent()).sent]).toEqual({
+                        error: THROTTLED,
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('fifty wrong tries from one client address across fifty accounts, then the same answer for any account; another address is unaffected', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var ip, email, _a, right, elsewhere;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle-ip-target@test.local')];
+                case 1:
+                    _b.sent();
+                    ip = function () { return '203.0.113.20'; };
+                    email = function (i) { return "throttle-ip-".concat(i, "@test.local"); };
+                    _a = expect;
+                    return [4 /*yield*/, errors(50, ip, email, 'wrong guess')];
+                case 2:
+                    _a.apply(void 0, [_b.sent()]).toEqual(Array(50).fill(WRONG));
+                    return [4 /*yield*/, attempt('203.0.113.20', 'throttle-ip-target@test.local', RIGHT_PASSWORD)];
+                case 3:
+                    right = _b.sent();
+                    expect(right.sent).toEqual({ error: THROTTLED });
+                    expect(right.signedInAs).toBeUndefined();
+                    return [4 /*yield*/, attempt('203.0.113.21', 'throttle-ip-target@test.local', RIGHT_PASSWORD)];
+                case 4:
+                    elsewhere = _b.sent();
+                    expect(elsewhere.sent).toEqual({});
+                    expect(elsewhere.signedInAs).toBe('throttle-ip-target@test.local');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('successes never count against the address: thirty sign-ins from one address, then fifty wrong tries are still judged before the window shuts', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var ip, i, signedIn, email, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle-office@test.local')];
+                case 1:
+                    _c.sent();
+                    ip = function () { return '203.0.113.30'; };
+                    i = 0;
+                    _c.label = 2;
+                case 2:
+                    if (!(i < 30)) return [3 /*break*/, 5];
+                    return [4 /*yield*/, attempt(ip(), 'throttle-office@test.local', RIGHT_PASSWORD)];
+                case 3:
+                    signedIn = _c.sent();
+                    expect(signedIn.sent).toEqual({});
+                    expect(signedIn.signedInAs).toBe('throttle-office@test.local');
+                    _c.label = 4;
+                case 4:
+                    i++;
+                    return [3 /*break*/, 2];
+                case 5:
+                    email = function (i) { return "throttle-office-guess-".concat(i, "@test.local"); };
+                    _a = expect;
+                    return [4 /*yield*/, errors(50, ip, email, 'wrong guess')];
+                case 6:
+                    _a.apply(void 0, [_c.sent()]).toEqual(Array(50).fill(WRONG));
+                    _b = expect;
+                    return [4 /*yield*/, attempt(ip(), 'throttle-office@test.local', RIGHT_PASSWORD)];
+                case 7:
+                    _b.apply(void 0, [(_c.sent()).sent]).toEqual({ error: THROTTLED });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("blank submissions count toward the client address's window, never an account's", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var ip, _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle-blank@test.local')];
+                case 1:
+                    _e.sent();
+                    ip = function (i) { return "192.0.2.".concat(i + 1); };
+                    _a = expect;
+                    return [4 /*yield*/, errors(15, ip, function () { return 'throttle-blank@test.local'; }, '')];
+                case 2:
+                    _a.apply(void 0, [_e.sent()]).toEqual(Array(15).fill(BLANK));
+                    _b = expect;
+                    return [4 /*yield*/, attempt('192.0.2.100', 'throttle-blank@test.local', 'wrong guess')];
+                case 3:
+                    _b.apply(void 0, [(_e.sent()).sent]).toEqual({ error: WRONG });
+                    // Fifty blank submissions from one address: its fifty-first try is throttled.
+                    _c = expect;
+                    return [4 /*yield*/, errors(50, function () { return '192.0.2.200'; }, function () { return ''; }, '')];
+                case 4:
+                    // Fifty blank submissions from one address: its fifty-first try is throttled.
+                    _c.apply(void 0, [_e.sent()]).toEqual(Array(50).fill(BLANK));
+                    _d = expect;
+                    return [4 /*yield*/, attempt('192.0.2.200', 'throttle-blank@test.local', RIGHT_PASSWORD)];
+                case 5:
+                    _d.apply(void 0, [(_e.sent()).sent]).toEqual({
+                        error: THROTTLED,
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('no timing tell: the throttled answer takes as long as a refused password, and an address with no account is refused as slowly as one with', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var refused, unknown, throttled, _loop_1, i, _a, r, u, t;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle-timing-open@test.local')];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, createAccount('throttle-timing-shut@test.local')];
+                case 2:
+                    _b.sent();
+                    // Push one account over its window (from addresses the samples never use).
+                    return [4 /*yield*/, errors(10, function (i) { return "100.64.0.".concat(i + 1); }, function () { return 'throttle-timing-shut@test.local'; }, 'wrong guess')];
+                case 3:
+                    // Push one account over its window (from addresses the samples never use).
+                    _b.sent();
+                    refused = [];
+                    unknown = [];
+                    throttled = [];
+                    _loop_1 = function (i) {
+                        var _c, _d, _e, _f, _g, _h;
+                        return __generator(this, function (_j) {
+                            switch (_j.label) {
+                                case 0:
+                                    _d = (_c = refused).push;
+                                    return [4 /*yield*/, elapsedMs(function () { return attempt("100.64.1.".concat(i + 1), 'throttle-timing-open@test.local', 'wrong guess'); })];
+                                case 1:
+                                    _d.apply(_c, [_j.sent()]);
+                                    _f = (_e = unknown).push;
+                                    return [4 /*yield*/, elapsedMs(function () { return attempt("100.64.2.".concat(i + 1), 'throttle-timing-none@test.local', 'wrong guess'); })];
+                                case 2:
+                                    _f.apply(_e, [_j.sent()]);
+                                    _h = (_g = throttled).push;
+                                    return [4 /*yield*/, elapsedMs(function () { return attempt("100.64.3.".concat(i + 1), 'throttle-timing-shut@test.local', 'wrong guess'); })];
+                                case 3:
+                                    _h.apply(_g, [_j.sent()]);
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    i = 0;
+                    _b.label = 4;
+                case 4:
+                    if (!(i < 7)) return [3 /*break*/, 7];
+                    return [5 /*yield**/, _loop_1(i)];
+                case 5:
+                    _b.sent();
+                    _b.label = 6;
+                case 6:
+                    i++;
+                    return [3 /*break*/, 4];
+                case 7:
+                    _a = [median(refused), median(unknown), median(throttled)], r = _a[0], u = _a[1], t = _a[2];
+                    // A refusal costs one database read and one password verification (argon2, tens of ms).
+                    // The tolerance is wide on purpose — a throttled answer or an unknown address that SKIPPED
+                    // the verification lands near zero or at the read alone, far outside it.
+                    expect(t / r).toBeGreaterThan(0.6);
+                    expect(t / r).toBeLessThan(1.6);
+                    expect(u / r).toBeGreaterThan(0.6);
+                    expect(u / r).toBeLessThan(1.6);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('every refusal and every throttled answer is its own line with the account digest and the coarse IP hash — one digest per address however typed, never the address', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var spellings, log, refusedAccounts, throttledAccounts, person, ips, text, _i, _a, fragment;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle.privacy.person@test.local')];
+                case 1:
+                    _b.sent();
+                    spellings = [
+                        'throttle.privacy.person@test.local',
+                        'Throttle.Privacy.Person@TEST.local',
+                        ' THROTTLE.PRIVACY.PERSON@test.local',
+                    ];
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var i;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        i = 0;
+                                        _a.label = 1;
+                                    case 1:
+                                        if (!(i < 11)) return [3 /*break*/, 4];
+                                        return [4 /*yield*/, attempt('198.51.103.7', spellings[i % 3], 'wrong guess')];
+                                    case 2:
+                                        _a.sent();
+                                        _a.label = 3;
+                                    case 3:
+                                        i++;
+                                        return [3 /*break*/, 1];
+                                    case 4: return [4 /*yield*/, attempt('198.51.103.8', 'throttle.privacy.other@test.local', 'wrong guess')];
+                                    case 5:
+                                        _a.sent();
+                                        return [4 /*yield*/, attempt('198.51.103.8', '', '')];
+                                    case 6:
+                                        _a.sent();
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 2:
+                    log = _b.sent();
+                    refusedAccounts = fieldsOn(log, 'Sign-in refused', 'account');
+                    throttledAccounts = fieldsOn(log, 'Sign-in throttled', 'account');
+                    // Ten for the person, one for the other address, one for the blank submission (no account).
+                    expect(refusedAccounts).toHaveLength(12);
+                    expect(throttledAccounts).toHaveLength(1);
+                    person = refusedAccounts[0];
+                    expect(person).toMatch(/^[0-9a-f]{16}$/);
+                    expect(refusedAccounts.slice(0, 10)).toEqual(Array(10).fill(person));
+                    expect(throttledAccounts).toEqual([person]);
+                    expect(refusedAccounts[10]).toMatch(/^[0-9a-f]{16}$/);
+                    expect(refusedAccounts[10]).not.toBe(person);
+                    expect(refusedAccounts[11]).toBe('missing');
+                    ips = __spreadArray(__spreadArray([], fieldsOn(log, 'Sign-in refused', 'ip'), true), fieldsOn(log, 'Sign-in throttled', 'ip'), true);
+                    expect(ips).toHaveLength(13);
+                    expect(new Set(ips.slice(0, 10)).size).toBe(1);
+                    expect(ips[10]).not.toBe(ips[0]);
+                    expect(ips[12]).toBe(ips[0]);
+                    text = plain(log.text).toLowerCase();
+                    for (_i = 0, _a = ['throttle.privacy.person', 'throttle.privacy.other', 'throttle.privacy', '198.51.103.']; _i < _a.length; _i++) {
+                        fragment = _a[_i];
+                        expect(text).not.toContain(fragment);
+                    }
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('thirty wrong passwords for one account fired at once from thirty addresses: at most ten are judged, the rest are throttled', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var answers, judged, throttled, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle-burst@test.local')];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, Promise.all(Array.from({ length: 30 }, function (_, i) { return attempt("198.51.104.".concat(i + 1), 'throttle-burst@test.local', 'wrong guess'); }))];
+                case 2:
+                    answers = _b.sent();
+                    judged = answers.filter(function (answer) { var _a; return ((_a = answer.sent) === null || _a === void 0 ? void 0 : _a.error) === WRONG; }).length;
+                    throttled = answers.filter(function (answer) { var _a; return ((_a = answer.sent) === null || _a === void 0 ? void 0 : _a.error) === THROTTLED; }).length;
+                    expect(judged).toBeLessThanOrEqual(10);
+                    expect(judged + throttled).toBe(30);
+                    _a = expect;
+                    return [4 /*yield*/, attempt('198.51.104.50', 'throttle-burst@test.local', RIGHT_PASSWORD)];
+                case 3:
+                    _a.apply(void 0, [(_b.sent()).sent]).toEqual({
+                        error: THROTTLED,
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a refusal for an account still in the legacy sha256 format takes as long as one in the current format', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var legacy, current, legacyRow, _loop_2, i, ratio;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, createAccount('throttle-timing-current@test.local')];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Throttle User', email: 'throttle-timing-legacy@test.local' })];
+                case 2:
+                    legacy = _a.sent();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                            id: legacy.id,
+                            password: (0, crypto_1.createHash)('sha256').update(RIGHT_PASSWORD).digest('hex'),
+                        })];
+                case 3:
+                    _a.sent();
+                    current = [];
+                    legacyRow = [];
+                    _loop_2 = function (i) {
+                        var _b, _c, _d, _e;
+                        return __generator(this, function (_f) {
+                            switch (_f.label) {
+                                case 0:
+                                    _c = (_b = current).push;
+                                    return [4 /*yield*/, elapsedMs(function () { return attempt("100.64.4.".concat(i + 1), 'throttle-timing-current@test.local', 'wrong guess'); })];
+                                case 1:
+                                    _c.apply(_b, [_f.sent()]);
+                                    _e = (_d = legacyRow).push;
+                                    return [4 /*yield*/, elapsedMs(function () { return attempt("100.64.5.".concat(i + 1), 'throttle-timing-legacy@test.local', 'wrong guess'); })];
+                                case 2:
+                                    _e.apply(_d, [_f.sent()]);
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    i = 0;
+                    _a.label = 4;
+                case 4:
+                    if (!(i < 7)) return [3 /*break*/, 7];
+                    return [5 /*yield**/, _loop_2(i)];
+                case 5:
+                    _a.sent();
+                    _a.label = 6;
+                case 6:
+                    i++;
+                    return [3 /*break*/, 4];
+                case 7:
+                    ratio = median(legacyRow) / median(current);
+                    expect(ratio).toBeGreaterThan(0.6);
+                    expect(ratio).toBeLessThan(1.6);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a field that is not text is a blank one: the door answers and never throws', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var sent, response, request;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    response = {
+                        send: function (body) {
+                            sent = body;
+                        },
+                        status: function () { return response; },
+                    };
+                    return [4 /*yield*/, (0, passportSessionHarness_1.createPassportRequest)({
+                            body: { email: 123, password: { not: 'text' } },
+                            headers: {},
+                            socket: { remoteAddress: '198.51.105.1' },
+                            app: { get: function () { return false; } },
+                        })];
+                case 1:
+                    request = (_b.sent()).request;
+                    return [4 /*yield*/, login_1.login.onRequest(request, response)];
+                case 2:
+                    _b.sent();
+                    expect(sent).toEqual({ error: BLANK });
+                    expect((_a = request.session.passport) === null || _a === void 0 ? void 0 : _a.user).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=LoginThrottle.integration.test.js.map

package/dist/test/LoginThrottle.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginThrottle.integration.test.js","sourceRoot":"","sources":["../../test/LoginThrottle.integration.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAoC;AACpC,oCAA8C;AAC9C,wCAAyC;AACzC,6CAA4C;AAC5C,uEAAsE;AACtE,mEAAiE;AACjE,yEAAwE;AACxE,2CAA0C;AAE1C,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AAEH,IAAM,KAAK,GAAG,iCAAiC,CAAC;AAChD,IAAM,SAAS,GAAG,gDAAgD,CAAC;AACnE,IAAM,KAAK,GAAG,oCAAoC,CAAC;AACnD,IAAM,cAAc,GAAG,yBAAyB,CAAC;AAIjD,kGAAkG;AAClG,IAAM,OAAO,GAAG,UAAO,EAAU,EAAE,KAAa,EAAE,QAAgB;;;;;;gBAE1D,QAAQ,GAAQ;oBACpB,IAAI,EAAE,UAAC,IAAS;wBACd,IAAI,GAAG,IAAI,CAAC;oBACd,CAAC;oBACD,MAAM,EAAE,cAAM,OAAA,QAAQ,EAAR,CAAQ;iBACvB,CAAC;gBACkB,qBAAM,IAAA,8CAAqB,EAAC;wBAC9C,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,QAAQ,UAAA,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;wBAC7B,GAAG,EAAE,EAAE,GAAG,EAAE,cAAM,OAAA,KAAK,EAAL,CAAK,EAAE;qBAC1B,CAAC,EAAA;;gBALM,OAAO,GAAK,CAAA,SAKlB,CAAA,QALa;gBAMf,qBAAM,aAAK,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAA;;gBAAxC,SAAwC,CAAC;gBACzC,sBAAO,EAAE,IAAI,MAAA,EAAE,UAAU,EAAE,MAAA,OAAO,CAAC,OAAO,CAAC,QAAQ,0CAAE,IAAI,EAAE,EAAC;;;KAC7D,CAAC;AAEF,IAAM,MAAM,GAAG,UAAO,KAAa,EAAE,EAAyB,EAAE,KAA4B,EAAE,QAAgB;;;;;;gBACtG,OAAO,GAAa,EAAE,CAAC;gBACpB,CAAC,GAAG,CAAC;;;qBAAE,CAAA,CAAC,GAAG,KAAK,CAAA;gBACvB,KAAA,CAAA,KAAA,OAAO,CAAA,CAAC,IAAI,CAAA;gBAAE,qBAAM,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAA;;gBAAtD,cAAa,MAAA,CAAC,SAAwC,CAAC,CAAC,IAAI,0CAAE,KAAK,EAAC,CAAC;;;gBAD5C,CAAC,EAAE,CAAA;;oBAG9B,sBAAO,OAAO,EAAC;;;KAChB,CAAC;AAEF,IAAM,aAAa,GAAG,UAAO,KAAa;;;;;oBAC3B,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gBAAjE,IAAI,GAAG,SAA0D;gBACjE,KAAA,CAAA,KAAA,IAAA,kBAAa,GAAE,CAAA,CAAC,MAAM,CAAA;sBAAC,aAAM,CAAC,IAAI;uBAAI,EAAE,EAAE,IAAI,CAAC,EAAE;gBAAY,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAA;oBAAlH,qBAAM,yBAAmD,WAAQ,GAAE,SAA+C,QAAG,EAAA;;gBAArH,SAAqH,CAAC;gBACtH,sBAAO,IAAI,EAAC;;;KACb,CAAC;AAEF,IAAM,SAAS,GAAG,UAAO,GAA2B;;;;;gBAC5C,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtC,qBAAM,GAAG,EAAE,EAAA;;gBAAX,SAAW,CAAC;gBACZ,sBAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,EAAC;;;KACtD,CAAC;AAEF,IAAM,MAAM,GAAG,UAAC,MAAgB,IAAK,OAAA,kBAAI,MAAM,QAAE,IAAI,CAAC,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,CAAC,GAAG,CAAC,EAAL,CAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAhE,CAAgE,CAAC;AAEtG,8CAA8C;AAC9C,IAAM,KAAK,GAAG,UAAC,IAAY,IAAK,OAAA,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,UAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,gBAAa,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAA1E,CAA0E,CAAC;AAE3G,yEAAyE;AACzE,IAAM,QAAQ,GAAG,UAAC,GAAe,EAAE,MAAc,EAAE,KAAa;IAC9D,OAAA,GAAG,CAAC,KAAK;SACN,GAAG,CAAC,KAAK,CAAC;SACV,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAArB,CAAqB,CAAC;SACvC,GAAG,CAAC,UAAC,IAAI,gBAAK,OAAA,MAAA,MAAA,IAAI,MAAM,CAAC,UAAG,KAAK,uBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0CAAG,CAAC,CAAC,mCAAI,SAAS,CAAA,EAAA,CAAC;AAHvF,CAGuF,CAAC;AAE1F,QAAQ,CAAC,sBAAsB,EAAE;IAC/B,IAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAElD,SAAS,CAAC;;;;oBACR,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,4BAA4B,CAAC;oBAC1D,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,EAAE,MAAM,CAAC,CAAC;IAEX,QAAQ,CAAC;;;;oBACP,IAAI,cAAc,KAAK,SAAS,EAAE;wBAChC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;qBACnC;yBAAM;wBACL,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,cAAc,CAAC;qBAC7C;oBACD,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,EAAE,CAAC,oIAAoI,EAAE;;;;wBACvI,qBAAM,aAAa,CAAC,2BAA2B,CAAC,EAAA;;oBAAhD,SAAgD,CAAC;oBAE3C,EAAE,GAAG,UAAC,CAAS,IAAK,OAAA,qBAAc,CAAC,GAAG,CAAC,CAAE,EAArB,CAAqB,CAAC;oBAC1C,KAAK,GAAG,UAAC,CAAS,IAAK,OAAA,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,2BAA2B,CAAC,EAAnE,CAAmE,CAAC;oBAEjG,KAAA,MAAM,CAAA;oBAAC,qBAAM,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,EAAA;;oBAAjD,kBAAO,SAA0C,EAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAElF,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,eAAe,EAAE,2BAA2B,EAAE,aAAa,CAAC,EAAA;;oBAAlF,kBAAO,CAAC,SAA0E,CAAC,CAAC,IAAI,EAAC,CAAC,OAAO,CAAC;wBAChG,KAAK,EAAE,SAAS;qBACjB,CAAC,CAAC;oBACW,qBAAM,OAAO,CAAC,eAAe,EAAE,2BAA2B,EAAE,cAAc,CAAC,EAAA;;oBAAnF,KAAK,GAAG,SAA2E;oBACzF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;oBACjD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC1C,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE;;;;;oBACpE,EAAE,GAAG,UAAC,CAAS,IAAK,OAAA,qBAAc,CAAC,GAAG,CAAC,CAAE,EAArB,CAAqB,CAAC;oBAC1C,KAAK,GAAG,cAAM,OAAA,4BAA4B,EAA5B,CAA4B,CAAC;oBAEjD,KAAA,MAAM,CAAA;oBAAC,qBAAM,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,EAAA;;oBAAjD,kBAAO,SAA0C,EAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAClF,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,eAAe,EAAE,4BAA4B,EAAE,aAAa,CAAC,EAAA;;oBAAnF,kBAAO,CAAC,SAA2E,CAAC,CAAC,IAAI,EAAC,CAAC,OAAO,CAAC;wBACjG,KAAK,EAAE,SAAS;qBACjB,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,EAAE,CAAC,+GAA+G,EAAE;;;;wBAClH,qBAAM,aAAa,CAAC,6BAA6B,CAAC,EAAA;;oBAAlD,SAAkD,CAAC;oBAC7C,EAAE,GAAG,UAAC,CAAS,IAAK,OAAA,qBAAc,CAAC,GAAG,CAAC,CAAE,EAArB,CAAqB,CAAC;oBAC1C,KAAK,GAAG,cAAM,OAAA,6BAA6B,EAA7B,CAA6B,CAAC;oBAClD,KAAA,MAAM,CAAA;oBAAC,qBAAM,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,EAAA;;oBAAhD,kBAAO,SAAyC,EAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAEhE,qBAAM,OAAO,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,cAAc,CAAC,EAAA;;oBAAxF,OAAO,GAAG,SAA8E;oBAC9F,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;oBAEzD,KAAK,GAAG,UAAC,CAAS,IAAK,OAAA,qBAAc,CAAC,GAAG,GAAG,CAAE,EAAvB,CAAuB,CAAC;oBACrD,KAAA,MAAM,CAAA;oBAAC,qBAAM,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,EAAA;;oBAApD,kBAAO,SAA6C,EAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrF,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,aAAa,CAAC,EAAA;;oBAArF,kBAAO,CAAC,SAA6E,CAAC,CAAC,IAAI,EAAC,CAAC,OAAO,CAAC;wBACnG,KAAK,EAAE,SAAS;qBACjB,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,EAAE,CAAC,sIAAsI,EAAE;;;;wBACzI,qBAAM,aAAa,CAAC,+BAA+B,CAAC,EAAA;;oBAApD,SAAoD,CAAC;oBAC/C,EAAE,GAAG,cAAM,OAAA,cAAc,EAAd,CAAc,CAAC;oBAC1B,KAAK,GAAG,UAAC,CAAS,IAAK,OAAA,sBAAe,CAAC,gBAAa,EAA7B,CAA6B,CAAC;oBAC3D,KAAA,MAAM,CAAA;oBAAC,qBAAM,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,EAAA;;oBAAjD,kBAAO,SAA0C,EAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAEpE,qBAAM,OAAO,CAAC,cAAc,EAAE,+BAA+B,EAAE,cAAc,CAAC,EAAA;;oBAAtF,KAAK,GAAG,SAA8E;oBAC5F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;oBACjD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAEvB,qBAAM,OAAO,CAAC,cAAc,EAAE,+BAA+B,EAAE,cAAc,CAAC,EAAA;;oBAA1F,SAAS,GAAG,SAA8E;oBAChG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACnC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;;;;SACpE,CAAC,CAAC;IAEH,EAAE,CAAC,8IAA8I,EAAE;;;;wBACjJ,qBAAM,aAAa,CAAC,4BAA4B,CAAC,EAAA;;oBAAjD,SAAiD,CAAC;oBAC5C,EAAE,GAAG,cAAM,OAAA,cAAc,EAAd,CAAc,CAAC;oBACvB,CAAC,GAAG,CAAC;;;yBAAE,CAAA,CAAC,GAAG,EAAE,CAAA;oBACH,qBAAM,OAAO,CAAC,EAAE,EAAE,EAAE,4BAA4B,EAAE,cAAc,CAAC,EAAA;;oBAA5E,QAAQ,GAAG,SAAiE;oBAClF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAClC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;;;oBAHzC,CAAC,EAAE,CAAA;;;oBAMrB,KAAK,GAAG,UAAC,CAAS,IAAK,OAAA,gCAAyB,CAAC,gBAAa,EAAvC,CAAuC,CAAC;oBACrE,KAAA,MAAM,CAAA;oBAAC,qBAAM,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,EAAA;;oBAAjD,kBAAO,SAA0C,EAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAClF,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,EAAE,EAAE,EAAE,4BAA4B,EAAE,cAAc,CAAC,EAAA;;oBAAzE,kBAAO,CAAC,SAAiE,CAAC,CAAC,IAAI,EAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;;;;SAChH,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE;;;;wBACnF,qBAAM,aAAa,CAAC,2BAA2B,CAAC,EAAA;;oBAAhD,SAAgD,CAAC;oBAE3C,EAAE,GAAG,UAAC,CAAS,IAAK,OAAA,kBAAW,CAAC,GAAG,CAAC,CAAE,EAAlB,CAAkB,CAAC;oBAC7C,KAAA,MAAM,CAAA;oBAAC,qBAAM,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,cAAM,OAAA,2BAA2B,EAA3B,CAA2B,EAAE,EAAE,CAAC,EAAA;;oBAAlE,kBAAO,SAA2D,EAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBACnG,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,aAAa,EAAE,2BAA2B,EAAE,aAAa,CAAC,EAAA;;oBAAhF,kBAAO,CAAC,SAAwE,CAAC,CAAC,IAAI,EAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAElH,8EAA8E;oBAC9E,KAAA,MAAM,CAAA;oBACJ,qBAAM,MAAM,CACV,EAAE,EACF,cAAM,OAAA,aAAa,EAAb,CAAa,EACnB,cAAM,OAAA,EAAE,EAAF,CAAE,EACR,EAAE,CACH,EAAA;;oBAPH,8EAA8E;oBAC9E,kBACE,SAKC,EACF,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBACjC,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,aAAa,EAAE,2BAA2B,EAAE,cAAc,CAAC,EAAA;;oBAAjF,kBAAO,CAAC,SAAyE,CAAC,CAAC,IAAI,EAAC,CAAC,OAAO,CAAC;wBAC/F,KAAK,EAAE,SAAS;qBACjB,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,EAAE,CAAC,2IAA2I,EAAE;;;;wBAC9I,qBAAM,aAAa,CAAC,iCAAiC,CAAC,EAAA;;oBAAtD,SAAsD,CAAC;oBACvD,qBAAM,aAAa,CAAC,iCAAiC,CAAC,EAAA;;oBAAtD,SAAsD,CAAC;oBACvD,2EAA2E;oBAC3E,qBAAM,MAAM,CACV,EAAE,EACF,UAAC,CAAC,IAAK,OAAA,mBAAY,CAAC,GAAG,CAAC,CAAE,EAAnB,CAAmB,EAC1B,cAAM,OAAA,iCAAiC,EAAjC,CAAiC,EACvC,aAAa,CACd,EAAA;;oBAND,2EAA2E;oBAC3E,SAKC,CAAC;oBAEI,OAAO,GAAa,EAAE,CAAC;oBACvB,OAAO,GAAa,EAAE,CAAC;oBACvB,SAAS,GAAa,EAAE,CAAC;wCAGtB,CAAC;;;;;oCACR,KAAA,CAAA,KAAA,OAAO,CAAA,CAAC,IAAI,CAAA;oCACV,qBAAM,SAAS,CAAC,cAAM,OAAA,OAAO,CAAC,mBAAY,CAAC,GAAG,CAAC,CAAE,EAAE,iCAAiC,EAAE,aAAa,CAAC,EAA9E,CAA8E,CAAC,EAAA;;oCADvG,cACE,SAAqG,EACtG,CAAC;oCACF,KAAA,CAAA,KAAA,OAAO,CAAA,CAAC,IAAI,CAAA;oCACV,qBAAM,SAAS,CAAC,cAAM,OAAA,OAAO,CAAC,mBAAY,CAAC,GAAG,CAAC,CAAE,EAAE,iCAAiC,EAAE,aAAa,CAAC,EAA9E,CAA8E,CAAC,EAAA;;oCADvG,cACE,SAAqG,EACtG,CAAC;oCACF,KAAA,CAAA,KAAA,SAAS,CAAA,CAAC,IAAI,CAAA;oCACZ,qBAAM,SAAS,CAAC,cAAM,OAAA,OAAO,CAAC,mBAAY,CAAC,GAAG,CAAC,CAAE,EAAE,iCAAiC,EAAE,aAAa,CAAC,EAA9E,CAA8E,CAAC,EAAA;;oCADvG,cACE,SAAqG,EACtG,CAAC;;;;;oBATK,CAAC,GAAG,CAAC;;;yBAAE,CAAA,CAAC,GAAG,CAAC,CAAA;kDAAZ,CAAC;;;;;oBAAa,CAAC,EAAE,CAAA;;;oBAYpB,KAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAhE,CAAC,QAAA,EAAE,CAAC,QAAA,EAAE,CAAC,QAAA,CAA0D;oBACxE,wFAAwF;oBACxF,2FAA2F;oBAC3F,yEAAyE;oBACzE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;oBACnC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;oBAChC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;oBACnC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;;;;SACjC,CAAC,CAAC;IAEH,EAAE,CAAC,mKAAmK,EAAE;;;;wBACtK,qBAAM,aAAa,CAAC,oCAAoC,CAAC,EAAA;;oBAAzD,SAAyD,CAAC;oBACpD,SAAS,GAAG;wBAChB,oCAAoC;wBACpC,oCAAoC;wBACpC,qCAAqC;qBACtC,CAAC;oBAEU,qBAAM,uBAAU,CAAC,MAAM,CAAC;;;;;wCACzB,CAAC,GAAG,CAAC;;;6CAAE,CAAA,CAAC,GAAG,EAAE,CAAA;wCACpB,qBAAM,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,EAAA;;wCAA9D,SAA8D,CAAC;;;wCADzC,CAAC,EAAE,CAAA;;4CAG3B,qBAAM,OAAO,CAAC,cAAc,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAA;;wCAAjF,SAAiF,CAAC;wCAClF,qBAAM,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,CAAC,EAAA;;wCAArC,SAAqC,CAAC;;;;6BACvC,CAAC,EAAA;;oBANI,GAAG,GAAG,SAMV;oBAEI,eAAe,GAAG,QAAQ,CAAC,GAAG,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;oBAC9D,iBAAiB,GAAG,QAAQ,CAAC,GAAG,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;oBACxE,4FAA4F;oBAC5F,MAAM,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;oBACzC,MAAM,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBACpC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;oBACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;oBACrE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC5C,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;oBACtD,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC7C,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAEtC,GAAG,mCAAO,QAAQ,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAK,QAAQ,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,OAAC,CAAC;oBACrG,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;oBAC7B,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAEvB,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC3C,WAA+G,EAAxF,MAAC,yBAAyB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,aAAa,CAAC,EAAxF,cAAwF,EAAxF,IAAwF,EAAE;wBAAtG,QAAQ;wBACjB,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;qBACtC;;;;SACF,CAAC,CAAC;IAEH,EAAE,CAAC,4HAA4H,EAAE;;;;wBAC/H,qBAAM,aAAa,CAAC,2BAA2B,CAAC,EAAA;;oBAAhD,SAAgD,CAAC;oBAEjC,qBAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,OAAO,CAAC,qBAAc,CAAC,GAAG,CAAC,CAAE,EAAE,2BAA2B,EAAE,aAAa,CAAC,EAA1E,CAA0E,CAAC,CACjH,EAAA;;oBAFK,OAAO,GAAG,SAEf;oBAEK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAC,MAAM,YAAK,OAAA,CAAA,MAAA,MAAM,CAAC,IAAI,0CAAE,KAAK,MAAK,KAAK,CAAA,EAAA,CAAC,CAAC,MAAM,CAAC;oBACzE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,UAAC,MAAM,YAAK,OAAA,CAAA,MAAA,MAAM,CAAC,IAAI,0CAAE,KAAK,MAAK,SAAS,CAAA,EAAA,CAAC,CAAC,MAAM,CAAC;oBACtF,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;oBACvC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACpC,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,eAAe,EAAE,2BAA2B,EAAE,cAAc,CAAC,EAAA;;oBAAnF,kBAAO,CAAC,SAA2E,CAAC,CAAC,IAAI,EAAC,CAAC,OAAO,CAAC;wBACjG,KAAK,EAAE,SAAS;qBACjB,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE;;;;wBAC1G,qBAAM,aAAa,CAAC,oCAAoC,CAAC,EAAA;;oBAAzD,SAAyD,CAAC;oBAC3C,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,EAAA;;oBAAxG,MAAM,GAAG,SAA+F;oBAC9G,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;4BACxC,EAAE,EAAE,MAAM,CAAC,EAAE;4BACb,QAAQ,EAAE,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;yBACpE,CAAC,EAAA;;oBAHF,SAGE,CAAC;oBAEG,OAAO,GAAa,EAAE,CAAC;oBACvB,SAAS,GAAa,EAAE,CAAC;wCACtB,CAAC;;;;;oCACR,KAAA,CAAA,KAAA,OAAO,CAAA,CAAC,IAAI,CAAA;oCACV,qBAAM,SAAS,CAAC,cAAM,OAAA,OAAO,CAAC,mBAAY,CAAC,GAAG,CAAC,CAAE,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAjF,CAAiF,CAAC,EAAA;;oCAD1G,cACE,SAAwG,EACzG,CAAC;oCACF,KAAA,CAAA,KAAA,SAAS,CAAA,CAAC,IAAI,CAAA;oCACZ,qBAAM,SAAS,CAAC,cAAM,OAAA,OAAO,CAAC,mBAAY,CAAC,GAAG,CAAC,CAAE,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAhF,CAAgF,CAAC,EAAA;;oCADzG,cACE,SAAuG,EACxG,CAAC;;;;;oBANK,CAAC,GAAG,CAAC;;;yBAAE,CAAA,CAAC,GAAG,CAAC,CAAA;kDAAZ,CAAC;;;;;oBAAa,CAAC,EAAE,CAAA;;;oBAUpB,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;oBAClD,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;oBACnC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;;;;SACjC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE;;;;;;oBAEzE,QAAQ,GAAQ;wBACpB,IAAI,EAAE,UAAC,IAAS;4BACd,IAAI,GAAG,IAAI,CAAC;wBACd,CAAC;wBACD,MAAM,EAAE,cAAM,OAAA,QAAQ,EAAR,CAAQ;qBACvB,CAAC;oBACkB,qBAAM,IAAA,8CAAqB,EAAC;4BAC9C,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;4BAC/C,OAAO,EAAE,EAAE;4BACX,MAAM,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;4BACzC,GAAG,EAAE,EAAE,GAAG,EAAE,cAAM,OAAA,KAAK,EAAL,CAAK,EAAE;yBAC1B,CAAC,EAAA;;oBALM,OAAO,GAAK,CAAA,SAKlB,CAAA,QALa;oBAOf,qBAAM,aAAK,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAA;;oBAAxC,SAAwC,CAAC;oBAEzC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBACvC,MAAM,CAAC,MAAA,OAAO,CAAC,OAAO,CAAC,QAAQ,0CAAE,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SACxD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/MalformedResetTokens.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The `token` field of a request that does not carry a well-formed reset token: every type a
+ * parsed body or query string can deliver, and every near-miss of the token's shape. The
+ * near-misses are cut from a LIVE token, so a shape check that loosens (a lost anchor, a wider
+ * length, a case-insensitive class, a missing type check) would be looking up something derived
+ * from a real credential — and the suites that use this table assert that no lookup is built.
+ */
+export declare class MalformedResetTokens {
+    static readonly CASES: [label: string, tokenField: (liveToken: string) => Record<string, unknown>][];
+}
+//# sourceMappingURL=MalformedResetTokens.d.ts.map