@saluzi/saluzi-edu 0.2.9 → 0.2.11

package/packages/remote-control-server/src/__tests__/auth-security.test.ts

@@ -0,0 +1,547 @@
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { randomUUID, createHash } from 'node:crypto'
+
+// Mock config before any module imports
+const mockConfig = {
+  port: 3000,
+  host: '0.0.0.0',
+  apiKeys: ['test-api-key'],
+  baseUrl: 'http://localhost:3000',
+  pollTimeout: 8,
+  heartbeatInterval: 20,
+  jwtExpiresIn: 3600,
+  disconnectTimeout: 300,
+  webCorsOrigins: [],
+  wsIdleTimeout: 30,
+  wsKeepaliveInterval: 20,
+}
+
+mock.module('../config', () => ({
+  config: mockConfig,
+  getBaseUrl: () => 'http://localhost:3000',
+}))
+
+import { Hono } from 'hono'
+import { Database } from 'bun:sqlite'
+
+let authRoutes: Hono | undefined
+let shareRoutes: Hono | undefined
+let migrateDatabase: ((db: Database) => void) | undefined
+let initDatabase: ((path?: string) => Database) | undefined
+let resetDbSingleton: (() => void) | undefined
+let getDb: (() => Database) | undefined
+let resetRateLimits: (() => void) | undefined
+
+try {
+  const dbMod = await import('../db/sqlite')
+  migrateDatabase = dbMod.migrateDatabase
+  getDb = dbMod.getDb
+  initDatabase = dbMod.initDatabase
+  resetDbSingleton = dbMod.resetDbSingleton
+} catch {
+  // Module may not exist yet
+}
+
+try {
+  const mod = await import('../routes/web/auth-routes')
+  authRoutes = mod.default
+  resetRateLimits = mod._resetRateLimits
+} catch {
+  // Module may not exist yet
+}
+
+try {
+  const mod = await import('../routes/web/shares')
+  shareRoutes = mod.default
+} catch {
+  // Module may not exist yet
+}
+
+function freshDb(): Database {
+  if (resetDbSingleton) {
+    try {
+      resetDbSingleton()
+    } catch {
+      // ignore
+    }
+  }
+  // Use the same pattern as auth-login.test.ts: just reset and let
+  // getDb() lazily initialize at the default temp path.
+  // This ensures route handlers that call getDb() get the same instance.
+  if (getDb) {
+    return getDb()
+  }
+  throw new Error('getDb not available')
+}
+
+function createApp(): Hono {
+  const app = new Hono()
+  if (authRoutes) app.route('/web/auth', authRoutes)
+  if (shareRoutes) app.route('/web', shareRoutes)
+  return app
+}
+
+// ===========================================================================
+// Task 1: /setup concurrent protection
+// ===========================================================================
+describe('Security: /setup concurrent protection', () => {
+  let app: Hono
+
+  beforeEach(() => {
+    freshDb()
+    app = createApp()
+  })
+
+  test('concurrent setup requests only create one admin', async () => {
+    // Fire two setup requests concurrently
+    const [res1, res2] = await Promise.all([
+      app.request('/web/auth/setup', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          apiKey: 'test-api-key',
+          username: 'admin1',
+          password: 'secure-password-1',
+        }),
+      }),
+      app.request('/web/auth/setup', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          apiKey: 'test-api-key',
+          username: 'admin2',
+          password: 'secure-password-2',
+        }),
+      }),
+    ])
+
+    // Exactly one should succeed (200) and one should fail (409)
+    const statuses = [res1.status, res2.status].sort()
+    expect(statuses).toEqual([200, 409])
+
+    // Verify only one admin user exists in DB
+    const db = getDb!()
+    const count = db.query('SELECT COUNT(*) as count FROM users').get() as {
+      count: number
+    }
+    expect(count.count).toBe(1)
+  })
+})
+
+// ===========================================================================
+// Task 2: /login rate limiting
+// ===========================================================================
+describe('Security: /login rate limiting', () => {
+  let app: Hono
+
+  beforeEach(async () => {
+    freshDb()
+    if (resetRateLimits) resetRateLimits()
+    app = createApp()
+    // Create admin via setup
+    await app.request('/web/auth/setup', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        apiKey: 'test-api-key',
+        username: 'admin',
+        password: 'admin-password-123',
+      }),
+    })
+  })
+
+  test(
+    'returns 429 after 5 consecutive failed login attempts',
+    async () => {
+      // 5 failed attempts
+      for (let i = 0; i < 5; i++) {
+        const res = await app.request('/web/auth/login', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-Forwarded-For': '10.0.0.1',
+          },
+          body: JSON.stringify({
+            username: 'admin',
+            password: 'wrong-password',
+          }),
+        })
+        // Should be 401 for the first 4, may become 429 on the 5th
+        expect([401, 429]).toContain(res.status)
+      }
+
+      // 6th attempt should be rate-limited
+      const res6 = await app.request('/web/auth/login', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'X-Forwarded-For': '10.0.0.1',
+        },
+        body: JSON.stringify({
+          username: 'admin',
+          password: 'wrong-password',
+        }),
+      })
+      expect(res6.status).toBe(429)
+    },
+    { timeout: 30000 },
+  )
+
+  test(
+    'rate limit does not affect different IPs',
+    async () => {
+      // 5 failed attempts from IP A
+      for (let i = 0; i < 5; i++) {
+        await app.request('/web/auth/login', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-Forwarded-For': '10.0.0.1',
+          },
+          body: JSON.stringify({
+            username: 'admin',
+            password: 'wrong-password',
+          }),
+        })
+      }
+
+      // Attempt from IP B should not be rate-limited
+      const res = await app.request('/web/auth/login', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'X-Forwarded-For': '10.0.0.2',
+        },
+        body: JSON.stringify({
+          username: 'admin',
+          password: 'wrong-password',
+        }),
+      })
+      expect(res.status).toBe(401)
+    },
+    { timeout: 30000 },
+  )
+
+  test(
+    'successful login clears rate limit counter',
+    async () => {
+      // 4 failed attempts (one below threshold)
+      for (let i = 0; i < 4; i++) {
+        await app.request('/web/auth/login', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-Forwarded-For': '10.0.0.3',
+          },
+          body: JSON.stringify({
+            username: 'admin',
+            password: 'wrong-password',
+          }),
+        })
+      }
+
+      // Successful login
+      const successRes = await app.request('/web/auth/login', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'X-Forwarded-For': '10.0.0.3',
+        },
+        body: JSON.stringify({
+          username: 'admin',
+          password: 'admin-password-123',
+        }),
+      })
+      expect(successRes.status).toBe(200)
+
+      // After success, 4 more failed attempts should not trigger rate limit
+      for (let i = 0; i < 4; i++) {
+        const res = await app.request('/web/auth/login', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-Forwarded-For': '10.0.0.3',
+          },
+          body: JSON.stringify({
+            username: 'admin',
+            password: 'wrong-password',
+          }),
+        })
+        expect(res.status).toBe(401)
+      }
+    },
+    { timeout: 30000 },
+  )
+})
+
+// ===========================================================================
+// Task 3: Invitation max_uses atomic
+// ===========================================================================
+describe('Security: invitation max_uses atomic', () => {
+  let app: Hono
+  let inviteToken: string
+
+  beforeEach(async () => {
+    freshDb()
+    app = createApp()
+    // Setup admin
+    await app.request('/web/auth/setup', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        apiKey: 'test-api-key',
+        username: 'admin',
+        password: 'admin-password-123',
+      }),
+    })
+
+    // Create a max_uses=1 invitation
+    const db = getDb!()
+    inviteToken = `inv_race_${randomUUID().slice(0, 8)}`
+    const tokenHash = createHash('sha256').update(inviteToken).digest('hex')
+    const futureExpiry = new Date(Date.now() + 86400000).toISOString()
+    const adminRow = db
+      .query("SELECT id FROM users WHERE username = 'admin'")
+      .get() as { id: string }
+    db.exec(
+      `INSERT INTO invitations (token_hash, role, expires_at, max_uses, uses, created_by)
+       VALUES ('${tokenHash}', 'member', '${futureExpiry}', 1, 0, '${adminRow.id}')`,
+    )
+  })
+
+  test('concurrent joins with max_uses=1 only succeed once', async () => {
+    // Fire two join requests concurrently with the same invitation
+    const [res1, res2] = await Promise.all([
+      app.request('/web/auth/join', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          inviteToken,
+          username: 'user_a',
+          password: 'user-a-password-123',
+        }),
+      }),
+      app.request('/web/auth/join', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          inviteToken,
+          username: 'user_b',
+          password: 'user-b-password-123',
+        }),
+      }),
+    ])
+
+    const statuses = [res1.status, res2.status].sort()
+    // Exactly one 200 and one 400 (due to atomic check or username race)
+    expect(statuses).toEqual([200, 400])
+
+    // Verify only one new user was created (in addition to admin)
+    const db = getDb!()
+    const count = db.query('SELECT COUNT(*) as count FROM users').get() as {
+      count: number
+    }
+    expect(count.count).toBe(2) // admin + 1 new user
+  })
+})
+
+// ===========================================================================
+// Task 4: Refresh token rotation
+// ===========================================================================
+describe('Security: refresh token rotation', () => {
+  let app: Hono
+  let refreshToken: string
+
+  beforeEach(async () => {
+    freshDb()
+    app = createApp()
+    // Setup admin
+    await app.request('/web/auth/setup', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        apiKey: 'test-api-key',
+        username: 'admin',
+        password: 'admin-password-123',
+      }),
+    })
+    const loginRes = await app.request('/web/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        username: 'admin',
+        password: 'admin-password-123',
+      }),
+    })
+    const loginBody = await loginRes.json()
+    refreshToken = loginBody.refreshToken || loginBody.refresh_token || ''
+  })
+
+  test('refresh returns new access and refresh tokens', async () => {
+    const res = await app.request('/web/auth/refresh', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ refreshToken }),
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.accessToken).toBeDefined()
+    expect(body.refreshToken).toBeDefined()
+    // New refresh token should be different from old one
+    expect(body.refreshToken).not.toBe(refreshToken)
+  })
+
+  test('old refresh token is invalid after rotation', async () => {
+    // Use refresh token once
+    const res1 = await app.request('/web/auth/refresh', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ refreshToken }),
+    })
+    expect(res1.status).toBe(200)
+
+    // Try to use the OLD refresh token again — should fail
+    const res2 = await app.request('/web/auth/refresh', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ refreshToken }),
+    })
+    expect(res2.status).toBe(401)
+  })
+
+  test('new refresh token can be used for subsequent refresh', async () => {
+    const res1 = await app.request('/web/auth/refresh', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ refreshToken }),
+    })
+    const body1 = await res1.json()
+    const newRefreshToken = body1.refreshToken
+
+    // Use the new refresh token
+    const res2 = await app.request('/web/auth/refresh', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ refreshToken: newRefreshToken }),
+    })
+    expect(res2.status).toBe(200)
+    const body2 = await res2.json()
+    expect(body2.accessToken).toBeDefined()
+  })
+})
+
+// ===========================================================================
+// Task 5: API key bypass uses __system__ identity
+// ===========================================================================
+describe('Security: API key bypass identity', () => {
+  let app: Hono
+
+  beforeEach(() => {
+    freshDb()
+    app = new Hono()
+
+    // Protected route using sessionAuth
+    const { sessionAuth } = require('../auth/middleware')
+    app.get('/protected', async (c, next) => {
+      const result = await sessionAuth(c, next)
+      if (result) return result
+      return c.json({ userId: c.get('userId'), isAdmin: c.get('isAdmin') })
+    })
+  })
+
+  test('API key bypass sets userId to __system__ not __admin__', async () => {
+    const res = await app.request('/protected', {
+      headers: { Authorization: 'Bearer test-api-key' },
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.userId).toBe('__system__')
+    expect(body.isAdmin).toBe(true)
+  })
+})
+
+// ===========================================================================
+// Task 8: Share endpoint SELECT * fix
+// ===========================================================================
+describe('Security: share endpoint does not leak internal fields', () => {
+  let app: Hono
+  let shareToken: string
+  let accessToken: string
+
+  beforeEach(async () => {
+    freshDb()
+    app = createApp()
+
+    // Setup admin
+    await app.request('/web/auth/setup', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        apiKey: 'test-api-key',
+        username: 'admin',
+        password: 'admin-password-123',
+      }),
+    })
+
+    const loginRes = await app.request('/web/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        username: 'admin',
+        password: 'admin-password-123',
+      }),
+    })
+    const loginBody = await loginRes.json()
+    accessToken = loginBody.accessToken || loginBody.access_token || ''
+
+    // Create a session in the DB
+    const db = getDb!()
+    const sessionId = `ses_${randomUUID().replace(/-/g, '').slice(0, 16)}`
+    const now = new Date().toISOString()
+    db.query(
+      `INSERT INTO sessions (id, title, status, source, created_at, updated_at)
+       VALUES ($id, $title, $status, $source, $now, $now)`,
+    ).run({
+      $id: sessionId,
+      $title: 'Test session',
+      $status: 'idle',
+      $source: 'web',
+      $now: now,
+    })
+
+    // Create a share for the session
+    const adminRow = db
+      .query("SELECT id FROM users WHERE username = 'admin'")
+      .get() as { id: string }
+    shareToken = `shr_${randomUUID().replace(/-/g, '')}`
+    db.query(
+      `INSERT INTO session_shares (id, session_id, permission, granted_at, granted_by)
+       VALUES ($id, $sid, 'read', $now, $by)`,
+    ).run({
+      $id: shareToken,
+      $sid: sessionId,
+      $now: now,
+      $by: adminRow.id,
+    })
+  })
+
+  test('GET /web/sessions/s/:shareToken does not return environment_id', async () => {
+    const res = await app.request(`/web/sessions/s/${shareToken}`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+      },
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+
+    // Must have expected safe fields
+    expect(body.id).toBeDefined()
+    expect(body.title).toBe('Test session')
+    expect(body.status).toBe('idle')
+
+    // Must NOT have internal/sensitive fields
+    expect(body.environment_id).toBeUndefined()
+    expect(body.permission_mode).toBeUndefined()
+    expect(body.visibility).toBeUndefined()
+  })
+})

package/packages/remote-control-server/src/__tests__/auth.test.ts

@@ -7,26 +7,15 @@ import {
   mock,
   spyOn,
 } from 'bun:test'
+import { mockConfigModule } from './helpers/mock-config'
 
 // Mock config before importing modules that depend on it
-const mockConfig = {
-  port: 3000,
-  host: '0.0.0.0',
-  apiKeys: ['test-key-1', 'test-key-2'],
-  baseUrl: '',
-  pollTimeout: 8,
-  heartbeatInterval: 20,
-  jwtExpiresIn: 3600,
-  disconnectTimeout: 300,
-  webCorsOrigins: [],
-  wsIdleTimeout: 30,
-  wsKeepaliveInterval: 20,
-}
-
-mock.module('../config', () => ({
-  config: mockConfig,
-  getBaseUrl: () => 'http://localhost:3000',
-}))
+mock.module('../config', () =>
+  mockConfigModule({
+    apiKeys: ['test-key-1', 'test-key-2'],
+    baseUrl: '',
+  }),
+)
 
 import { validateApiKey, hashApiKey } from '../auth/api-key'
 import { generateWorkerJwt, verifyWorkerJwt } from '../auth/jwt'