@remit/auth-service 0.0.16 → 0.1.1

package/src/kill-switch.test.ts

@@ -0,0 +1,179 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { after, before, describe, it } from "node:test";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+import { type Auth, createAuth } from "./auth.js";
+import { openIdentityStore } from "./identity-store.js";
+import { createPeopleDirectory } from "./people.js";
+
+const ORIGIN = "http://localhost:3000";
+const MIGRATIONS = resolve(
+	import.meta.dirname,
+	"../../../deploy/vps/migrations-sqlite",
+);
+const EMAIL = "owner@remit.test";
+const PASSWORD = "correct horse battery staple";
+
+let dir: string;
+let filename: string;
+
+const build = async (signInEnabled: boolean): Promise<Auth> =>
+	createAuth(
+		{
+			connectionString: filename,
+			secret: "kill-switch-test-secret-value-32chars-min",
+			baseURL: ORIGIN,
+			selfSignUpEnabled: true,
+			signInEnabled,
+		},
+		await openIdentityStore(filename),
+	);
+
+const boot = async (auth: Auth, signInEnabled: boolean): Promise<void> => {
+	const people = await createPeopleDirectory({
+		auth,
+		store: await openIdentityStore(filename),
+		baseURL: ORIGIN,
+	});
+	people.applySignInSwitch(signInEnabled);
+	people.close();
+};
+
+const post = (auth: Auth, path: string, body: unknown, cookie = "") =>
+	auth.handler(
+		new Request(`${ORIGIN}/api/auth${path}`, {
+			method: "POST",
+			headers: { "content-type": "application/json", origin: ORIGIN, cookie },
+			body: JSON.stringify(body),
+		}),
+	);
+
+const get = (auth: Auth, path: string, cookie = "") =>
+	auth.handler(
+		new Request(`${ORIGIN}/api/auth${path}`, { headers: { cookie } }),
+	);
+
+const cookiesOf = (response: Response): string =>
+	response.headers
+		.getSetCookie()
+		.map((value) => value.split(";")[0])
+		.join("; ");
+
+const rows = (sql: string): unknown[] => {
+	const sqlite = new Database(filename, { readonly: true });
+	const found = sqlite.prepare(sql).all();
+	sqlite.close();
+	return found;
+};
+
+before(() => {
+	dir = mkdtempSync(join(tmpdir(), "remit-kill-switch-"));
+	filename = join(dir, "app.db");
+	const sqlite = new Database(filename);
+	sqlite.pragma("journal_mode = WAL");
+	sqlite.pragma("foreign_keys = ON");
+	for (const set of ["app", "mcp"]) {
+		migrate(drizzle(sqlite), {
+			migrationsFolder: join(MIGRATIONS, set),
+			migrationsTable: `__drizzle_migrations_${set}`,
+		});
+	}
+	sqlite.close();
+});
+
+after(() => {
+	rmSync(dir, { recursive: true, force: true });
+});
+
+describe("the sign-in kill switch", () => {
+	let cookie: string;
+
+	it("refuses sign-in, sign-up, token and session reads while it is off, and keeps the JWKS up", async () => {
+		const on = await build(true);
+		const signedUp = await post(on, "/sign-up/email", {
+			email: EMAIL,
+			password: PASSWORD,
+			name: "Owner",
+		});
+		assert.equal(signedUp.status, 200);
+		cookie = cookiesOf(signedUp);
+		const userId = (rows("SELECT id FROM auth_user")[0] as { id: string }).id;
+		const sqlite = new Database(filename);
+		sqlite
+			.prepare(
+				"INSERT INTO mcp_oauth_client (id, client_id, redirect_uris) VALUES ('client-row', 'client-1', '[]')",
+			)
+			.run();
+		sqlite
+			.prepare(
+				"INSERT INTO mcp_oauth_consent (id, client_id, user_id, scopes) VALUES ('consent-1', 'client-1', ?, '[]')",
+			)
+			.run(userId);
+		sqlite.close();
+
+		const off = await build(false);
+		const refusals = [
+			await post(off, "/sign-in/email", { email: EMAIL, password: PASSWORD }),
+			await post(off, "/sign-up/email", {
+				email: "new@remit.test",
+				password: PASSWORD,
+				name: "New",
+			}),
+			await get(off, "/token", cookie),
+			await get(off, "/get-session", cookie),
+		];
+		for (const response of refusals) {
+			assert.equal(response.status, 403);
+			assert.equal(
+				((await response.json()) as { code: string }).code,
+				"SIGN_IN_DISABLED",
+			);
+		}
+		assert.equal((await get(off, "/jwks")).status, 200);
+	});
+
+	it("revokes every session and MCP consent at boot, and records it once across two boots", async () => {
+		const off = await build(false);
+		await boot(off, false);
+		await boot(off, false);
+
+		assert.deepEqual(rows("SELECT id FROM auth_session"), []);
+		assert.deepEqual(rows("SELECT id FROM mcp_oauth_consent"), []);
+		assert.deepEqual(
+			rows(
+				"SELECT actor, target, action, client_ip AS clientIp FROM identity_audit_event WHERE action LIKE 'KillSwitch%'",
+			),
+			[
+				{
+					actor: "env",
+					target: "all",
+					action: "KillSwitchOn",
+					clientIp: "host",
+				},
+			],
+		);
+	});
+
+	it("lets a user sign in again once it is back on, with the old session still gone", async () => {
+		const on = await build(true);
+		await boot(on, true);
+
+		assert.equal((await get(on, "/token", cookie)).status, 401);
+		const signedIn = await post(on, "/sign-in/email", {
+			email: EMAIL,
+			password: PASSWORD,
+		});
+		assert.equal(signedIn.status, 200);
+		assert.equal((await get(on, "/token", cookiesOf(signedIn))).status, 200);
+		assert.deepEqual(
+			rows(
+				"SELECT action FROM identity_audit_event WHERE action LIKE 'KillSwitch%' ORDER BY occurred_at",
+			),
+			[{ action: "KillSwitchOn" }, { action: "KillSwitchOff" }],
+		);
+	});
+});

package/src/people.test.ts

@@ -0,0 +1,309 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { after, before, describe, it } from "node:test";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+import { type Auth, CLIENT_IP_HEADER, createAuth } from "./auth.js";
+import { openIdentityStore } from "./identity-store.js";
+import {
+	createPeopleDirectory,
+	type PeopleAdmin,
+	resetIdentifierOf,
+	type StepUpAction,
+} from "./people.js";
+
+const ORIGIN = "http://localhost:3000";
+const MIGRATIONS = resolve(
+	import.meta.dirname,
+	"../../../deploy/vps/migrations-sqlite",
+);
+const OPERATOR = "operator@remit.test";
+const PASSWORD = "correct horse battery staple";
+const PEER = "198.51.100.23";
+
+let dir: string;
+let filename: string;
+let auth: Auth;
+let people: PeopleAdmin;
+let operatorId: string;
+
+const post = (path: string, body: unknown, headers = {}) =>
+	auth.handler(
+		new Request(`${ORIGIN}/api/auth${path}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				origin: ORIGIN,
+				...headers,
+			},
+			body: JSON.stringify(body),
+		}),
+	);
+
+const tokenStatus = async (cookie: string): Promise<number> =>
+	(
+		await auth.handler(
+			new Request(`${ORIGIN}/api/auth/token`, { headers: { cookie } }),
+		)
+	).status;
+
+const cookiesOf = (response: Response): string =>
+	response.headers
+		.getSetCookie()
+		.map((value) => value.split(";")[0])
+		.join("; ");
+
+// Each group signs in from its own address: the sign-in limit is five a minute
+// per address, and the groups together sign in more often than that.
+const signInFrom =
+	(clientIp: string) =>
+	(email: string, password = PASSWORD) =>
+		post(
+			"/sign-in/email",
+			{ email, password },
+			{ [CLIENT_IP_HEADER]: clientIp },
+		);
+
+const signUp = async (email: string): Promise<string> => {
+	const response = await post("/sign-up/email", {
+		email,
+		password: PASSWORD,
+		name: email,
+	});
+	assert.equal(response.status, 200);
+	return ((await response.json()) as { user: { id: string } }).user.id;
+};
+
+const sql = (statement: string, ...params: unknown[]): unknown[] => {
+	const sqlite = new Database(filename);
+	const prepared = sqlite.prepare(statement);
+	const found = prepared.reader ? prepared.all(...params) : [];
+	if (!prepared.reader) prepared.run(...params);
+	sqlite.close();
+	return found;
+};
+
+const stepUp = async (
+	targetId: string,
+	action: StepUpAction,
+): Promise<string> => {
+	const granted = await people.createStepUp({
+		callerId: operatorId,
+		clientIp: PEER,
+		targetId,
+		action,
+		password: PASSWORD,
+	});
+	assert.ok(granted.ok, JSON.stringify(granted));
+	return granted.value.stepUpToken;
+};
+
+const codeOf = async (response: Response): Promise<string | undefined> =>
+	((await response.json()) as { code?: string }).code;
+
+before(async () => {
+	dir = mkdtempSync(join(tmpdir(), "remit-people-"));
+	filename = join(dir, "app.db");
+	const sqlite = new Database(filename);
+	sqlite.pragma("journal_mode = WAL");
+	sqlite.pragma("foreign_keys = ON");
+	for (const set of ["app", "mcp"]) {
+		migrate(drizzle(sqlite), {
+			migrationsFolder: join(MIGRATIONS, set),
+			migrationsTable: `__drizzle_migrations_${set}`,
+		});
+	}
+	sqlite.close();
+
+	const store = await openIdentityStore(filename);
+	auth = await createAuth(
+		{
+			connectionString: filename,
+			secret: "people-test-secret-value-of-32-chars-min",
+			baseURL: ORIGIN,
+			selfSignUpEnabled: true,
+			signInEnabled: true,
+		},
+		store,
+	);
+	people = await createPeopleDirectory({
+		auth,
+		store,
+		baseURL: ORIGIN,
+	});
+	operatorId = await signUp(OPERATOR);
+});
+
+after(() => {
+	people.close();
+	rmSync(dir, { recursive: true, force: true });
+});
+
+describe("a disabled account", () => {
+	const signIn = signInFrom("198.51.100.31");
+	const EMAIL = "disabled@remit.test";
+	let userId: string;
+
+	before(async () => {
+		userId = await signUp(EMAIL);
+		const disabled = await people.updatePerson({
+			callerId: operatorId,
+			clientIp: PEER,
+			targetId: userId,
+			status: "Disabled",
+			stepUpToken: await stepUp(userId, "Disable"),
+		});
+		assert.ok(disabled.ok);
+		assert.equal(disabled.value.status, "Disabled");
+	});
+
+	it("is refused after a right password, with a record, and answers 401 to a wrong one", async () => {
+		const right = await signIn(EMAIL);
+		assert.equal(right.status, 403);
+		assert.equal(await codeOf(right), "ACCOUNT_DISABLED");
+		assert.equal(right.headers.getSetCookie().length, 0);
+		assert.ok(
+			sql(
+				"SELECT 1 FROM identity_audit_event WHERE action = 'SignInRefusedDisabled' AND outcome = 'RefusedDisabled' AND target = ?",
+				userId,
+			).length > 0,
+		);
+
+		assert.equal((await signIn(EMAIL, "not the password")).status, 401);
+	});
+
+	it("loses a session that raced the disable, at its next token mint", async () => {
+		assert.ok((await people.enableByEmail(EMAIL)).ok);
+		const signedIn = await signIn(EMAIL);
+		assert.equal(signedIn.status, 200);
+		const cookie = cookiesOf(signedIn);
+		sql("UPDATE auth_user SET disabled = 1 WHERE id = ?", userId);
+
+		const minted = await auth.handler(
+			new Request(`${ORIGIN}/api/auth/token`, { headers: { cookie } }),
+		);
+		assert.equal(minted.status, 403);
+		assert.equal(await codeOf(minted), "ACCOUNT_DISABLED");
+		assert.deepEqual(
+			sql("SELECT id FROM auth_session WHERE user_id = ?", userId),
+			[],
+		);
+	});
+
+	it("signs in again once enabled", async () => {
+		assert.ok((await people.enableByEmail(EMAIL)).ok);
+		assert.equal((await signIn(EMAIL)).status, 200);
+	});
+});
+
+describe("a password reset link", () => {
+	const signIn = signInFrom("198.51.100.32");
+	const EMAIL = "reset@remit.test";
+	const NEW_PASSWORD = "a different long passphrase";
+	let userId: string;
+	let token: string;
+
+	const tokenOf = (resetUrl: string): string => {
+		const found = resetUrl.split("/").at(-1);
+		assert.ok(found);
+		return found;
+	};
+
+	const redeem = (resetToken: string, newPassword = NEW_PASSWORD) =>
+		post(
+			"/reset-password",
+			{ token: resetToken, newPassword },
+			{ [CLIENT_IP_HEADER]: PEER },
+		);
+
+	before(async () => {
+		userId = await signUp(EMAIL);
+		const issued = await people.createPasswordReset({
+			callerId: operatorId,
+			clientIp: PEER,
+			targetId: userId,
+			stepUpToken: await stepUp(userId, "ResetPassword"),
+		});
+		assert.ok(issued.ok);
+		assert.equal(
+			issued.value.resetUrl,
+			`${ORIGIN}/reset-password/${tokenOf(issued.value.resetUrl)}`,
+		);
+		token = tokenOf(issued.value.resetUrl);
+	});
+
+	it("is stored only as a digest", () => {
+		const stored = JSON.stringify(sql("SELECT * FROM auth_verification"));
+		assert.ok(!stored.includes(token));
+		assert.equal(
+			sql(
+				"SELECT 1 FROM auth_verification WHERE identifier = ? AND value = ?",
+				resetIdentifierOf(token),
+				userId,
+			).length,
+			1,
+		);
+	});
+
+	it("stops the old password and every session at once", async () => {
+		assert.equal((await signIn(EMAIL)).status, 401);
+		const listed = await people.listPeople({
+			callerId: operatorId,
+			clientIp: PEER,
+		});
+		assert.ok(listed.ok);
+		assert.equal(
+			listed.value.find((person) => person.userId === userId)?.sessionCount,
+			0,
+		);
+	});
+
+	it("works once, and a second redeem is refused with a record carrying the client address", async () => {
+		assert.equal((await redeem(token)).status, 200);
+		assert.equal((await signIn(EMAIL, NEW_PASSWORD)).status, 200);
+
+		const again = await redeem(token, "yet another long passphrase");
+		assert.equal(again.status, 400);
+		assert.deepEqual(
+			sql(
+				"SELECT actor, target, client_ip AS clientIp FROM identity_audit_event WHERE action = 'PasswordResetRefused'",
+			),
+			[{ actor: "unknown", target: "unknown", clientIp: PEER }],
+		);
+		assert.equal(
+			sql(
+				"SELECT 1 FROM identity_audit_event WHERE action = 'PasswordResetRedeemed' AND target = ? AND client_ip = ?",
+				userId,
+				PEER,
+			).length,
+			1,
+		);
+	});
+
+	it("is refused past its expiry", async () => {
+		const issued = await people.resetByEmail(EMAIL);
+		assert.ok(issued.ok);
+		sql(
+			"UPDATE auth_verification SET expires_at = ? WHERE value = ?",
+			Math.floor(Date.now() / 1000) - 60,
+			userId,
+		);
+		assert.equal((await redeem(tokenOf(issued.value.resetUrl))).status, 400);
+	});
+
+	it("dies when a newer one is issued, and the newer one survives", async () => {
+		const older = await people.resetByEmail(EMAIL);
+		const newer = await people.resetByEmail(EMAIL);
+		assert.ok(older.ok && newer.ok);
+		const newerToken = tokenOf(newer.value.resetUrl);
+		assert.deepEqual(
+			sql("SELECT identifier FROM auth_verification WHERE value = ?", userId),
+			[{ identifier: resetIdentifierOf(newerToken) }],
+		);
+		assert.equal((await redeem(tokenOf(older.value.resetUrl))).status, 400);
+		assert.equal((await redeem(newerToken)).status, 200);
+	});
+});