@saltcorn/server 1.6.0-beta.3 → 1.6.0-beta.5

package/tests/auth.test.js

@@ -124,7 +124,7 @@ describe("AuthTest user settings", () => {
     expect(user.checkPassword("foHRrr46obar")).toBe(false);
     expect(user.checkPassword("ghrarhr54hg")).toBe(true);
   });
-   it("should needs old password value", async () => {
+  it("should needs old password value", async () => {
     const app = await getApp({ disableCsrf: true });
     //const loginCookie = await getStaffLoginCookie();
     await request(app)
@@ -755,3 +755,232 @@ describe("AuthTest Allowed login methods", () => {
       .expect(toRedirect("/auth/login"));
   });
 });
+
+describe("JWT login rate limiting", () => {
+  it("should rate-limit GET /auth/login-with/jwt after repeated failed attempts", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // Send many failed login attempts via the JWT endpoint
+    // The normal POST /auth/login is rate-limited to 3 attempts per 5 minutes per user,
+    // but GET /auth/login-with/jwt bypasses this rate limiting entirely.
+    // This test asserts that the JWT endpoint is also rate-limited.
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .get("/auth/login-with/jwt")
+        .query({ email: "user@foo.com", password: `wrongpassword${i}` });
+
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+    expect(rateLimited).toBe(true);
+  });
+
+  it("should rate-limit POST /auth/login-with/jwt after repeated failed attempts", async () => {
+    const app = await getApp({ disableCsrf: true });
+    const headers = {
+      "X-Requested-With": "XMLHttpRequest",
+      "X-Saltcorn-Client": "mobile-app",
+    };
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .post("/auth/login-with/jwt")
+        .set(headers)
+        .send({ email: "user@foo.com", password: `wrongpassword${i}` });
+        
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+    expect(rateLimited).toBe(true);
+  });
+});
+
+describe("JWT login disabled user bypass", () => {
+  let testUserEmail = "disabled-jwt-test@foo.com";
+  let testUserPassword = "TestPassword123!";
+
+  beforeAll(async () => {
+    // Create a test user and then disable them
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    // Disable the user
+    await u.update({ disabled: true });
+  });
+
+  afterAll(async () => {
+    // Clean up
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      await u.update({ disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should reject disabled user on normal login", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // Normal login should fail for disabled user - redirects back to login
+    await request(app)
+      .post("/auth/login/")
+      .send(`email=${testUserEmail}`)
+      .send(`password=${testUserPassword}`)
+      .expect(toRedirect("/auth/login"));
+  });
+
+  it("should reject disabled user on JWT login", async () => {
+    const app = await getApp({ disableCsrf: true });
+    const headers = {
+      "X-Requested-With": "XMLHttpRequest",
+      "X-Saltcorn-Client": "mobile-app",
+    };
+    const res = await request(app)
+      .post("/auth/login-with/jwt")
+      .set(headers)
+      .send({ email: testUserEmail, password: testUserPassword });
+
+    // A disabled user should NOT receive a valid JWT token.
+    // The response should contain an error, not a token string.
+    const body = res.body;
+    const isToken = typeof body === "string" && body.includes(".");
+    expect(isToken).toBe(false);
+  });
+});
+
+describe("API token disabled user bypass", () => {
+  let testUserEmail = "disabled-apitoken-test@foo.com";
+  let testUserPassword = "TestPassword456!";
+  let apiToken;
+
+  beforeAll(async () => {
+    // Clean up any leftover user from a previous run
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    // Create a user, generate an API token, then disable them
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    apiToken = await u.getNewAPIToken();
+  });
+
+  afterAll(async () => {
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      await u.update({ disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should allow API token access to rooms for enabled user", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // rooms table has min_role_read=80 (user role) - our user (role 80) can read it
+    const res = await request(app)
+      .get("/api/rooms/")
+      .set("Authorization", "Bearer " + apiToken);
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBeTruthy();
+  });
+
+  it("should reject API token access for disabled user", async () => {
+    // Disable the user
+    const u = await User.findOne({ email: testUserEmail });
+    await u.update({ disabled: true });
+
+    const app = await getApp({ disableCsrf: true });
+    // rooms table has min_role_read=80 (user). Our disabled user has role 80,
+    // so their token would grant access if the disabled check is missing.
+    // Public users (role 100) cannot read rooms.
+    // A disabled user's API token should NOT grant authenticated access.
+    const res = await request(app)
+      .get("/api/rooms/")
+      .set("Authorization", "Bearer " + apiToken);
+    const body = res.body;
+    // Should NOT succeed - a disabled user should not have user-level access
+    expect(body.success).toBeFalsy();
+  });
+});
+
+describe("TOTP brute force protection", () => {
+  let testUserEmail = "totp-bruteforce-test@foo.com";
+  let testUserPassword = "TotpBrute789!";
+  let totpKey = "abcdefghij";
+
+  beforeAll(async () => {
+    // Create a user with TOTP enabled
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    // Enable TOTP with a known key
+    u._attributes.totp_enabled = true;
+    u._attributes.totp_key = totpKey;
+    await u.update({ _attributes: u._attributes });
+  });
+
+  afterAll(async () => {
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      u._attributes.totp_enabled = false;
+      delete u._attributes.totp_key;
+      await u.update({ _attributes: u._attributes, disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should rate-limit TOTP login attempts after repeated failures", async () => {
+    const app = await getApp({ disableCsrf: true });
+
+    // Step 1: Login with correct password to get session with pending_user
+    const loginRes = await request(app)
+      .post("/auth/login/")
+      .send(`email=${testUserEmail}`)
+      .send(`password=${testUserPassword}`);
+    expect(loginRes.headers["location"]).toBe("/auth/twofa/login/totp");
+
+    const sessionCookie = resToLoginCookie(loginRes);
+
+    // Step 2: Send many wrong TOTP codes.
+    // The POST /auth/login endpoint is rate-limited (ipLimiter + userLimiter),
+    // but POST /auth/twofa/login/totp has NO rate limiting at all.
+    // This allows an attacker who knows the password to brute-force the 6-digit
+    // TOTP code (1,000,000 possibilities) without any throttling.
+    // The TOTP endpoint should have rate limiting just like the login endpoint.
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .post("/auth/twofa/login/totp")
+        .set("Cookie", sessionCookie)
+        .send(`code=${100000 + i}`);
+
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+
+    // This SHOULD be rate-limited to prevent TOTP brute-force attacks.
+    // Currently fails because the endpoint has no rate limiting.
+    expect(rateLimited).toBe(true);
+  });
+});

package/tests/files.test.js

@@ -19,6 +19,7 @@ const Field = require("@saltcorn/data/models/field");
 const Table = require("@saltcorn/data/models/table");
 const View = require("@saltcorn/data/models/view");
 const { existsSync } = require("fs");
+const { getState } = require("@saltcorn/data/db/state");
 
 const createTestFile = async (
   folder,
@@ -262,7 +263,7 @@ describe("files admin", () => {
           `/files/edit/${encodeURIComponent("_sc_test_subfolder_one/the-script.js")}`
         )
         .set("Cookie", loginCookie)
-        .expect(toInclude("Not found", 404));
+        .expect(toRedirect("/"));
     });
     it("denies editing a file", async () => {
       const app = await getApp({ disableCsrf: true });
@@ -273,12 +274,7 @@ describe("files admin", () => {
         )
         .set("Cookie", loginCookie)
         .send("value=console.log('I have been edited');")
-        .expect(toRedirect("/files"));
-
-      await request(app)
-        .get("/")
-        .set("Cookie", loginCookie)
-        .expect(toInclude("File not found"));
+        .expect(toRedirect("/"));
     });
 
     it("does not open for folders or not editable extensions", async () => {
@@ -474,6 +470,7 @@ describe("visible_entries test", () => {
   };
 
   it("shows allowed files", async () => {
+    await getState().setConfig("min_role_edit_files", 40)
     await setRole(100, path.join("_sc_test_subfolder_one", "foo_image.png"));
     await setDirRole(100, "_sc_test_subfolder_one");
 

package/tests/plugin_install.test.js

@@ -9,7 +9,6 @@ const {
 } = require("@saltcorn/admin-models/models/tenant");
 const { resetToFixtures } = require("../auth/testhelp");
 const db = require("@saltcorn/data/db");
-const load_plugins = require("../load_plugins");
 
 beforeAll(async () => {
   if (!db.isSQLite) await db.query(`drop schema if exists test101 CASCADE `);
@@ -37,7 +36,7 @@ describe("Tenant cannot install unsafe plugins", () => {
   if (!db.isSQLite) {
     it("creates a new tenant", async () => {
       db.enable_multi_tenant();
-      const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+      const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
 
       await getState().setConfig("base_url", "http://example.com/");
 
@@ -56,7 +55,7 @@ describe("Tenant cannot install unsafe plugins", () => {
     });
     it("can install safe plugins on tenant", async () => {
       await db.runWithTenant("test101", async () => {
-        const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
 
         await install_pack(
           plugin_pack({
@@ -73,7 +72,7 @@ describe("Tenant cannot install unsafe plugins", () => {
     });
     it("cannot install unsafe plugins on tenant", async () => {
       await db.runWithTenant("test101", async () => {
-        const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
 
         await install_pack(
           plugin_pack({
@@ -91,7 +90,7 @@ describe("Tenant cannot install unsafe plugins", () => {
     it("can install unsafe plugins on tenant when permitted", async () => {
       await getState().setConfig("tenants_unsafe_plugins", true);
       await db.runWithTenant("test101", async () => {
-        const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
 
         await install_pack(
           plugin_pack({
@@ -130,7 +129,7 @@ describe("Stable versioning install", () => {
     }
   });
   it("installs latest", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin_two",
@@ -147,7 +146,7 @@ describe("Stable versioning install", () => {
   });
 
   it("installs and downgrades latest", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -165,7 +164,7 @@ describe("Stable versioning install", () => {
   });
 
   it("installs and upgrades a fixed version", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -182,7 +181,7 @@ describe("Stable versioning install", () => {
   });
 
   it("installs and downgrades a fixed version", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -212,7 +211,7 @@ describe("Stable versioning upgrade", () => {
   });
 
   it("upgrades to latest", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin_two",
@@ -246,7 +245,7 @@ describe("Stable versioning upgrade", () => {
   });
 
   it("upgrades to latest with downgrade to supported", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -280,7 +279,7 @@ describe("Stable versioning upgrade", () => {
   });
 
   it("upgrades to fixed version", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin_two",
@@ -314,7 +313,7 @@ describe("Stable versioning upgrade", () => {
   });
 
   it("upgrades to fixed version with downgrade to supported", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",

package/tests/plugins.test.js

@@ -14,7 +14,6 @@ const {
   resetToFixtures,
 } = require("../auth/testhelp");
 const db = require("@saltcorn/data/db");
-const load_plugins = require("../load_plugins");
 
 beforeAll(async () => {
   if (!db.isSQLite) await db.query(`drop schema if exists test101 CASCADE `);
@@ -148,7 +147,7 @@ describe("Plugin dependency resolution and upgrade", () => {
       location: "@saltcorn/tabler",
       version: "0.1.2",
     });
-    await load_plugins.loadAndSaveNewPlugin(tabler);
+    await Plugin.loadAndSaveNewPlugin(tabler);
   });
   it("should refresh store", async () => {
     const loginCookie = await getAdminLoginCookie();