@saltcorn/server 1.6.0-beta.4 → 1.6.0-beta.6

package/routes/utils.js

@@ -389,9 +389,44 @@ const addOnDoneRedirect = (oldPath, req) => {
   return oldPath;
 };
 
-//https://stackoverflow.com/a/38979205/19839414
 const is_relative_url = (url) => {
-  return typeof url === "string" && !url.includes(":/") && !url.includes("//");
+  if (typeof url !== "string") return false;
+
+  // Normalise backslashes to forward slashes (WHATWG treats \ as / in special schemes)
+  const normalised = url.replace(/\\/g, "/");
+
+  // Reject protocol-relative URLs (//example.com)
+  if (normalised.trimStart().startsWith("//")) return false;
+
+  // Reject any scheme: URIs (e.g. http:, javascript:, data:, vbscript:)
+  // A scheme is a letter followed by letters/digits/+/-/. then a colon (RFC 3986 §3.1)
+  if (/^[a-zA-Z][a-zA-Z0-9+\-.]*:/u.test(normalised.trimStart())) return false;
+
+  return true;
+};
+
+const normalize_relative_url = (url) => {
+  if (typeof url !== "string") return null;
+
+  const normalised = url.replace(/\\/g, "/").trimStart();
+
+  // Reject protocol-relative URLs
+  if (normalised.startsWith("//")) return null;
+
+  // Reject any scheme (RFC 3986 §3.1)
+  if (/^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(normalised)) return null;
+
+  return normalised;
+};
+
+const safe_redirect = (res, url, default_url) => {
+  if (!url) {
+    res.redirect(default_url);
+    return;
+  }
+  const dest = normalize_relative_url(url);
+  if (dest !== null) res.redirect(dest);
+  else res.redirect(default_url);
 };
 
 /**
@@ -647,6 +682,8 @@ module.exports = {
   get_tenant_from_req,
   addOnDoneRedirect,
   is_relative_url,
+  normalize_relative_url,
+  safe_redirect,
   is_ip_address,
   get_sys_info,
   admin_config_route,

package/serve.js

@@ -24,11 +24,6 @@ const path = require("path");
 const getApp = require("./app");
 const Trigger = require("@saltcorn/data/models/trigger");
 const cluster = require("cluster");
-const {
-  loadAllPlugins,
-  loadAndSaveNewPlugin,
-  loadPlugin,
-} = require("./load_plugins");
 const { getConfig, setConfig } = require("@saltcorn/data/models/config");
 const { migrate } = require("@saltcorn/data/migrate");
 const socketio = require("socket.io");
@@ -255,7 +250,7 @@ const initMaster = async (
       async () => await migrate(db.connectObj.default_schema, true)
     );
   // load all plugins
-  await loadAllPlugins(true);
+  await Plugin.loadAllPlugins(true);
   // switch on sql logging - but it was initiated before???
   if (getState().getConfig("log_sql", false)) db.set_sql_logging();
 
@@ -265,7 +260,7 @@ const initMaster = async (
   if (db.is_it_multi_tenant()) {
     const tenants = await getAllTenants();
     await init_multi_tenant(
-      () => loadAllPlugins(true),
+      () => Plugin.loadAllPlugins(true),
       disableMigrate,
       tenants,
       db.connectObj.multi_node ? getMultiNodeListener : null
@@ -287,7 +282,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
 
   if (msg.refresh_plugin_cfg) {
     Plugin.findOne({ name: msg.refresh_plugin_cfg }).then((plugin) => {
-      if (plugin) loadPlugin(plugin);
+      if (plugin) Plugin.loadPlugin(plugin);
     });
   }
   if (!getState()) {
@@ -325,7 +320,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
   }
 
   if (msg.reload_plugins) {
-    loadAllPlugins(cluster.isPrimary, true);
+    Plugin.loadAllPlugins(cluster.isPrimary, true);
   }
   if (msg.refresh) {
     if (msg.refresh === "ephemeral_config")
@@ -337,7 +332,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
     add_tenant(msg.createTenant);
     create_tenant({
       t: msg.createTenant,
-      plugin_loader: loadAllPlugins,
+      plugin_loader: Plugin.loadAllPlugins,
       noSignalOrDB: true,
       tenant_template,
     });
@@ -346,9 +341,9 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
     });
   }
   if (msg.installPlugin) {
-    loadAndSaveNewPlugin(msg.installPlugin, msg.force, true);
+    Plugin.loadAndSaveNewPlugin(msg.installPlugin, msg.force, true);
   }
-  if (msg.restart_tenant) restart_tenant(loadAllPlugins);
+  if (msg.restart_tenant) restart_tenant(Plugin.loadAllPlugins);
   if (msg.removePlugin) getState().remove_plugin(msg.removePlugin, true);
 };
 
@@ -508,7 +503,7 @@ module.exports =
           4,
           "SIGHUP received: reloading plugins and state for all tenants"
         );
-        await loadAllPlugins(true, true);
+        await Plugin.loadAllPlugins(true, true);
         await getState().refresh_plugins(true);
         Object.entries(cluster.workers || {}).forEach(([wpid, w]) => {
           w.send({ reload_plugins: true });
@@ -516,7 +511,7 @@ module.exports =
         if (db.is_it_multi_tenant()) {
           for (const tenant of await getAllTenants()) {
             await db.runWithTenant(tenant, async () => {
-              await loadAllPlugins(true, true);
+              await Plugin.loadAllPlugins(true, true);
               await getState().refresh_plugins(true);
               Object.entries(cluster.workers || {}).forEach(([wpid, w]) => {
                 w.send({ tenant, reload_plugins: true });
@@ -856,16 +851,18 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
 
   // dynamic updates emitter (for run_js_actions)
   getState().setDynamicUpdateEmitter((tenant, data, userIds) => {
-    if (userIds) {
+    if (userIds === null) {
+      // explicit public-only; data may carry page_load_tag for client-side filtering
+      io.of("/").to(`_${tenant}_public_dynamic_update_room`).emit("dynamic_update", data);
+    } else if (userIds) {
       for (const userId of userIds) {
         io.of("/")
           .to(`_${tenant}:${userId}_dynamic_update_room`)
           .emit("dynamic_update", data);
       }
     } else {
-      io.of("/")
-        .to(`_${tenant}_dynamic_update_room`)
-        .emit("dynamic_update", data);
+      // undefined: broadcast to authenticated users only
+      io.of("/").to(`_${tenant}_dynamic_update_room`).emit("dynamic_update", data);
     }
   });
 
@@ -966,9 +963,12 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
           const enabled = getState().getConfig("enable_dynamic_updates", true);
           if (!enabled) throw new Error("Dynamic updates are not enabled");
           const user = socket.request.user;
-          if (!user) throw new Error("Not authorized");
-          socket.join(`_${tenant}_dynamic_update_room`);
-          socket.join(`_${tenant}:${user.id}_dynamic_update_room`);
+          if (user) {
+            socket.join(`_${tenant}_dynamic_update_room`);
+            socket.join(`_${tenant}:${user.id}_dynamic_update_room`);
+          } else {
+            socket.join(`_${tenant}_public_dynamic_update_room`);
+          }
           const socketIds = await getState().getConfig(
             "joined_dynamic_update_socket_ids",
             []

package/tests/admin.test.js

@@ -25,7 +25,7 @@ const {
   auto_backup_now,
 } = require("@saltcorn/admin-models/models/backup");
 
-jest.setTimeout(30000);
+jest.setTimeout(30000000);
 
 beforeAll(async () => {
   await resetToFixtures();
@@ -387,7 +387,7 @@ describe("actions", () => {
       .send("table_id=2")
       .send("name=mynewaction")
       .send("when_trigger=Insert")
-      .expect(toRedirect("/actions/configure/8"));
+      .expect(toRedirect("/actions/configure/9"));
   });
   it("show edit", async () => {
     const app = await getApp({ disableCsrf: true });
@@ -451,9 +451,9 @@ describe("actions", () => {
       .send("action=run_js_code")
       .send("when_trigger=API+call")
       .send("min_role=1")
-      .expect(toRedirect("/actions/configure/9"));
+      .expect(toRedirect("/actions/configure/10"));
     await request(app)
-      .post("/actions/configure/9")
+      .post("/actions/configure/10")
       .set("Cookie", loginCookie)
       .send("code=return 27")
       .expect(toRedirect("/actions/"));
@@ -461,7 +461,7 @@ describe("actions", () => {
       .post("/api/action/myact")
       .set("Cookie", loginCookie)
       .expect(
-        respondJsonWith(200, ({ success, data }) => success && data === 27)
+        respondJsonWith(200, ({ success, data }) => success === true && data === 27)
       );
   });
   it("deletes trigger", async () => {

package/tests/api.test.js

@@ -1007,3 +1007,221 @@ describe("API upload-files", () => {
       .expect(respondJsonWith(400, (resp) => resp.error === "No file found"));
   });
 });
+
+describe("API cross-table sub-select access control", () => {
+  it("should not allow probing restricted tables via sub-select query syntax", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The patients table has min_role_read=40 (staff).
+    // A public user should not be able to learn anything about patients data.
+    // The books table is public (min_role_read=100).
+    // The sub-select syntax (e.g. ?id.patients->name=Kirk) constructs:
+    //   WHERE id IN (SELECT id FROM patients WHERE name ILIKE '%Kirk%')
+    // This leaks whether a patient named "Kirk" exists by observing
+    // whether any books are returned.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // Query WITH a name that exists in patients ("Kirk Douglas", id=1)
+    const resp1 = await request(app)
+      .get("/api/books/?id.patients->name=Kirk")
+      .expect(200);
+
+    // Query with a name that does NOT exist in patients
+    const resp2 = await request(app)
+      .get("/api/books/?id.patients->name=ZZZNONEXISTENT")
+      .expect(200);
+
+    // If the sub-select is allowed, resp1 returns books (because patient
+    // "Kirk Douglas" has id=1 which matches book id=1) while resp2
+    // returns nothing. The difference reveals that "Kirk" exists in the
+    // restricted patients table.
+    //
+    // The secure behavior is that both queries return the same results
+    // (the sub-select against a restricted table is ignored or blocked),
+    // OR the query with the sub-select is rejected entirely.
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via or parameter with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The patients table has min_role_read=40 (staff).
+    // The books table is public (min_role_read=100).
+    //
+    // The 'or' query parameter is passed directly through stateFieldsToWhere
+    // into the db where-clause without access control checks. An attacker
+    // can embed an inSelect subquery in 'or' to probe restricted tables:
+    //   ?or[0][id][inSelect][table]=patients&or[0][id][inSelect][field]=favbook
+    //    &or[0][id][inSelect][where][name]=Kirk Douglas
+    // This generates: WHERE (id IN (SELECT favbook FROM patients WHERE name='Kirk Douglas'))
+    // By observing which books are returned, the attacker can determine
+    // whether a patient with a given name exists — leaking data from the
+    // restricted patients table.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // Kirk Douglas exists in patients with favbook=1 (Herman Melville)
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "or[0][id][inSelect][table]": "patients",
+        "or[0][id][inSelect][field]": "favbook",
+        "or[0][id][inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    // Non-existent patient
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "or[0][id][inSelect][table]": "patients",
+        "or[0][id][inSelect][field]": "favbook",
+        "or[0][id][inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    // If the or+inSelect bypass works, resp1 returns only book id=1
+    // (Kirk Douglas's favbook) while resp2 returns nothing.
+    // Secure behavior: both return the same results (all books or error).
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via field object with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // When a field value is an object, stateFieldsToWhere passes it through
+    // directly. An attacker can embed inSelect in a known field name:
+    //   ?id[inSelect][table]=patients&id[inSelect][field]=favbook&...
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "id[inSelect][table]": "patients",
+        "id[inSelect][field]": "favbook",
+        "id[inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "id[inSelect][table]": "patients",
+        "id[inSelect][field]": "favbook",
+        "id[inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via _not_ prefix with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The _not_ prefix passes user values into qstate.not[field].
+    // An attacker can embed inSelect to leak data:
+    //   ?_not_id[inSelect][table]=patients&_not_id[inSelect][field]=favbook&...
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "_not_id[inSelect][table]": "patients",
+        "_not_id[inSelect][field]": "favbook",
+        "_not_id[inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "_not_id[inSelect][table]": "patients",
+        "_not_id[inSelect][field]": "favbook",
+        "_not_id[inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via _relation_path_ parameter", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The _relation_path_ query parameter accepts JSON that specifies a
+    // relation path through arbitrary tables. handleRelationPath() constructs
+    // an inSelectWithLevels subquery with NO authorization checks.
+    //
+    // Attack: query the public books table with a _relation_path_ that
+    // traverses the restricted patients table (min_role_read=40):
+    //   ?_relation_path_={"relation":".books.patients$name","srcId":"Kirk Douglas"}
+    // This generates:
+    //   WHERE id IN (SELECT id FROM patients WHERE name = 'Kirk Douglas')
+    // A public user can determine whether a patient with a given name exists
+    // by observing which books are returned.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // srcId matching an existing patient name
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        _relation_path_: JSON.stringify({
+          relation: ".books.patients$name",
+          srcId: "Kirk Douglas",
+        }),
+      })
+      .expect(200);
+
+    // srcId with a non-existent patient name
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        _relation_path_: JSON.stringify({
+          relation: ".books.patients$name",
+          srcId: "ZZZNONEXISTENT",
+        }),
+      })
+      .expect(200);
+
+    // If the relation_path is allowed without authorization, resp1 returns
+    // book id=1 (because patient "Kirk Douglas" has id=1) while resp2
+    // returns nothing. The difference reveals that "Kirk Douglas" exists
+    // in the restricted patients table.
+    //
+    // Secure behavior: both queries return the same results (the subquery
+    // against the restricted table is blocked or ignored), OR the query
+    // is rejected.
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via dot-prefix relation path", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The dot-prefix syntax (e.g. ?.books.patients$name=value) is another
+    // way to invoke handleRelationPath, which has no authorization checks.
+    // This constructs the same inSelectWithLevels subquery.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({ ".books.patients$name": "Kirk Douglas" })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({ ".books.patients$name": "ZZZNONEXISTENT" })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+});

package/tests/auth.test.js

@@ -124,7 +124,7 @@ describe("AuthTest user settings", () => {
     expect(user.checkPassword("foHRrr46obar")).toBe(false);
     expect(user.checkPassword("ghrarhr54hg")).toBe(true);
   });
-   it("should needs old password value", async () => {
+  it("should needs old password value", async () => {
     const app = await getApp({ disableCsrf: true });
     //const loginCookie = await getStaffLoginCookie();
     await request(app)
@@ -755,3 +755,232 @@ describe("AuthTest Allowed login methods", () => {
       .expect(toRedirect("/auth/login"));
   });
 });
+
+describe("JWT login rate limiting", () => {
+  it("should rate-limit GET /auth/login-with/jwt after repeated failed attempts", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // Send many failed login attempts via the JWT endpoint
+    // The normal POST /auth/login is rate-limited to 3 attempts per 5 minutes per user,
+    // but GET /auth/login-with/jwt bypasses this rate limiting entirely.
+    // This test asserts that the JWT endpoint is also rate-limited.
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .get("/auth/login-with/jwt")
+        .query({ email: "user@foo.com", password: `wrongpassword${i}` });
+
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+    expect(rateLimited).toBe(true);
+  });
+
+  it("should rate-limit POST /auth/login-with/jwt after repeated failed attempts", async () => {
+    const app = await getApp({ disableCsrf: true });
+    const headers = {
+      "X-Requested-With": "XMLHttpRequest",
+      "X-Saltcorn-Client": "mobile-app",
+    };
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .post("/auth/login-with/jwt")
+        .set(headers)
+        .send({ email: "user@foo.com", password: `wrongpassword${i}` });
+        
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+    expect(rateLimited).toBe(true);
+  });
+});
+
+describe("JWT login disabled user bypass", () => {
+  let testUserEmail = "disabled-jwt-test@foo.com";
+  let testUserPassword = "TestPassword123!";
+
+  beforeAll(async () => {
+    // Create a test user and then disable them
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    // Disable the user
+    await u.update({ disabled: true });
+  });
+
+  afterAll(async () => {
+    // Clean up
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      await u.update({ disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should reject disabled user on normal login", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // Normal login should fail for disabled user - redirects back to login
+    await request(app)
+      .post("/auth/login/")
+      .send(`email=${testUserEmail}`)
+      .send(`password=${testUserPassword}`)
+      .expect(toRedirect("/auth/login"));
+  });
+
+  it("should reject disabled user on JWT login", async () => {
+    const app = await getApp({ disableCsrf: true });
+    const headers = {
+      "X-Requested-With": "XMLHttpRequest",
+      "X-Saltcorn-Client": "mobile-app",
+    };
+    const res = await request(app)
+      .post("/auth/login-with/jwt")
+      .set(headers)
+      .send({ email: testUserEmail, password: testUserPassword });
+
+    // A disabled user should NOT receive a valid JWT token.
+    // The response should contain an error, not a token string.
+    const body = res.body;
+    const isToken = typeof body === "string" && body.includes(".");
+    expect(isToken).toBe(false);
+  });
+});
+
+describe("API token disabled user bypass", () => {
+  let testUserEmail = "disabled-apitoken-test@foo.com";
+  let testUserPassword = "TestPassword456!";
+  let apiToken;
+
+  beforeAll(async () => {
+    // Clean up any leftover user from a previous run
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    // Create a user, generate an API token, then disable them
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    apiToken = await u.getNewAPIToken();
+  });
+
+  afterAll(async () => {
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      await u.update({ disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should allow API token access to rooms for enabled user", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // rooms table has min_role_read=80 (user role) - our user (role 80) can read it
+    const res = await request(app)
+      .get("/api/rooms/")
+      .set("Authorization", "Bearer " + apiToken);
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBeTruthy();
+  });
+
+  it("should reject API token access for disabled user", async () => {
+    // Disable the user
+    const u = await User.findOne({ email: testUserEmail });
+    await u.update({ disabled: true });
+
+    const app = await getApp({ disableCsrf: true });
+    // rooms table has min_role_read=80 (user). Our disabled user has role 80,
+    // so their token would grant access if the disabled check is missing.
+    // Public users (role 100) cannot read rooms.
+    // A disabled user's API token should NOT grant authenticated access.
+    const res = await request(app)
+      .get("/api/rooms/")
+      .set("Authorization", "Bearer " + apiToken);
+    const body = res.body;
+    // Should NOT succeed - a disabled user should not have user-level access
+    expect(body.success).toBeFalsy();
+  });
+});
+
+describe("TOTP brute force protection", () => {
+  let testUserEmail = "totp-bruteforce-test@foo.com";
+  let testUserPassword = "TotpBrute789!";
+  let totpKey = "abcdefghij";
+
+  beforeAll(async () => {
+    // Create a user with TOTP enabled
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    // Enable TOTP with a known key
+    u._attributes.totp_enabled = true;
+    u._attributes.totp_key = totpKey;
+    await u.update({ _attributes: u._attributes });
+  });
+
+  afterAll(async () => {
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      u._attributes.totp_enabled = false;
+      delete u._attributes.totp_key;
+      await u.update({ _attributes: u._attributes, disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should rate-limit TOTP login attempts after repeated failures", async () => {
+    const app = await getApp({ disableCsrf: true });
+
+    // Step 1: Login with correct password to get session with pending_user
+    const loginRes = await request(app)
+      .post("/auth/login/")
+      .send(`email=${testUserEmail}`)
+      .send(`password=${testUserPassword}`);
+    expect(loginRes.headers["location"]).toBe("/auth/twofa/login/totp");
+
+    const sessionCookie = resToLoginCookie(loginRes);
+
+    // Step 2: Send many wrong TOTP codes.
+    // The POST /auth/login endpoint is rate-limited (ipLimiter + userLimiter),
+    // but POST /auth/twofa/login/totp has NO rate limiting at all.
+    // This allows an attacker who knows the password to brute-force the 6-digit
+    // TOTP code (1,000,000 possibilities) without any throttling.
+    // The TOTP endpoint should have rate limiting just like the login endpoint.
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .post("/auth/twofa/login/totp")
+        .set("Cookie", sessionCookie)
+        .send(`code=${100000 + i}`);
+
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+
+    // This SHOULD be rate-limited to prevent TOTP brute-force attacks.
+    // Currently fails because the endpoint has no rate limiting.
+    expect(rateLimited).toBe(true);
+  });
+});