@sparkleideas/security 3.0.0-alpha.10

package/__tests__/credential-generator.test.ts

@@ -0,0 +1,310 @@
+/**
+ * Credential Generator Tests - CVE-3 Remediation Validation
+ *
+ * Tests verify:
+ * - Cryptographically secure random generation
+ * - No hardcoded defaults
+ * - Proper entropy levels
+ * - Unique credentials per generation
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+  CredentialGenerator,
+  CredentialGeneratorError,
+  createCredentialGenerator,
+  generateCredentials,
+} from '../../security/credential-generator.js';
+
+describe('CredentialGenerator', () => {
+  let generator: CredentialGenerator;
+
+  beforeEach(() => {
+    generator = new CredentialGenerator();
+  });
+
+  describe('Configuration', () => {
+    it('should use default configuration', () => {
+      expect(() => new CredentialGenerator()).not.toThrow();
+    });
+
+    it('should reject password length below 16', () => {
+      expect(() => new CredentialGenerator({
+        passwordLength: 8,
+      })).toThrow(CredentialGeneratorError);
+    });
+
+    it('should reject API key length below 32', () => {
+      expect(() => new CredentialGenerator({
+        apiKeyLength: 16,
+      })).toThrow(CredentialGeneratorError);
+    });
+
+    it('should reject secret length below 32', () => {
+      expect(() => new CredentialGenerator({
+        secretLength: 16,
+      })).toThrow(CredentialGeneratorError);
+    });
+  });
+
+  describe('Password Generation', () => {
+    it('should generate password of specified length', () => {
+      const password = generator.generatePassword();
+      expect(password.length).toBeGreaterThanOrEqual(32);
+    });
+
+    it('should generate unique passwords', () => {
+      const passwords = new Set<string>();
+      for (let i = 0; i < 100; i++) {
+        passwords.add(generator.generatePassword());
+      }
+      expect(passwords.size).toBe(100);
+    });
+
+    it('should include required character types', () => {
+      for (let i = 0; i < 10; i++) {
+        const password = generator.generatePassword();
+        expect(password).toMatch(/[A-Z]/); // Uppercase
+        expect(password).toMatch(/[a-z]/); // Lowercase
+        expect(password).toMatch(/\d/);    // Digit
+        expect(password).toMatch(/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/); // Special
+      }
+    });
+  });
+
+  describe('API Key Generation', () => {
+    it('should generate API key with prefix', () => {
+      const { key, prefix } = generator.generateApiKey('cf_');
+      expect(key.startsWith('cf_')).toBe(true);
+      expect(prefix).toBe('cf_');
+    });
+
+    it('should generate unique keys', () => {
+      const keys = new Set<string>();
+      for (let i = 0; i < 100; i++) {
+        keys.add(generator.generateApiKey().key);
+      }
+      expect(keys.size).toBe(100);
+    });
+
+    it('should include keyId', () => {
+      const { keyId } = generator.generateApiKey();
+      // Should be a valid UUID
+      expect(keyId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+    });
+
+    it('should include createdAt timestamp', () => {
+      const { createdAt } = generator.generateApiKey();
+      expect(createdAt).toBeInstanceOf(Date);
+    });
+  });
+
+  describe('Secret Generation', () => {
+    it('should generate hex-encoded secret', () => {
+      const secret = generator.generateSecret();
+      expect(secret).toMatch(/^[0-9a-f]+$/);
+    });
+
+    it('should generate secret of specified length', () => {
+      const secret = generator.generateSecret(64);
+      expect(secret.length).toBe(64);
+    });
+
+    it('should generate unique secrets', () => {
+      const secrets = new Set<string>();
+      for (let i = 0; i < 100; i++) {
+        secrets.add(generator.generateSecret());
+      }
+      expect(secrets.size).toBe(100);
+    });
+  });
+
+  describe('Encryption Key Generation', () => {
+    it('should generate 32-byte (256-bit) key as hex', () => {
+      const key = generator.generateEncryptionKey();
+      // 32 bytes = 64 hex characters
+      expect(key.length).toBe(64);
+      expect(key).toMatch(/^[0-9a-f]+$/);
+    });
+
+    it('should generate unique keys', () => {
+      const keys = new Set<string>();
+      for (let i = 0; i < 100; i++) {
+        keys.add(generator.generateEncryptionKey());
+      }
+      expect(keys.size).toBe(100);
+    });
+  });
+
+  describe('Installation Credentials', () => {
+    it('should generate complete credential set', () => {
+      const credentials = generator.generateInstallationCredentials();
+
+      expect(credentials.adminPassword).toBeDefined();
+      expect(credentials.servicePassword).toBeDefined();
+      expect(credentials.jwtSecret).toBeDefined();
+      expect(credentials.sessionSecret).toBeDefined();
+      expect(credentials.encryptionKey).toBeDefined();
+      expect(credentials.generatedAt).toBeInstanceOf(Date);
+    });
+
+    it('should set expiration when specified', () => {
+      const credentials = generator.generateInstallationCredentials(30);
+
+      expect(credentials.expiresAt).toBeInstanceOf(Date);
+
+      // Should be approximately 30 days in the future
+      const expectedExpiration = Date.now() + 30 * 24 * 60 * 60 * 1000;
+      const actualExpiration = credentials.expiresAt!.getTime();
+      expect(Math.abs(actualExpiration - expectedExpiration)).toBeLessThan(1000);
+    });
+
+    it('should generate unique credentials each time', () => {
+      const cred1 = generator.generateInstallationCredentials();
+      const cred2 = generator.generateInstallationCredentials();
+
+      expect(cred1.adminPassword).not.toBe(cred2.adminPassword);
+      expect(cred1.servicePassword).not.toBe(cred2.servicePassword);
+      expect(cred1.jwtSecret).not.toBe(cred2.jwtSecret);
+    });
+  });
+
+  describe('Token Generation', () => {
+    it('should generate session token', () => {
+      const token = generator.generateSessionToken();
+      expect(token).toBeDefined();
+      expect(token.length).toBeGreaterThan(0);
+    });
+
+    it('should generate CSRF token', () => {
+      const token = generator.generateCsrfToken();
+      expect(token).toBeDefined();
+      // Base64url encoded
+      expect(token).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+
+    it('should generate nonce', () => {
+      const nonce = generator.generateNonce();
+      expect(nonce).toBeDefined();
+      // Hex encoded, 16 bytes = 32 chars
+      expect(nonce.length).toBe(32);
+      expect(nonce).toMatch(/^[0-9a-f]+$/);
+    });
+  });
+
+  describe('Environment Script Generation', () => {
+    it('should generate valid shell script', () => {
+      const credentials = generator.generateInstallationCredentials();
+      const script = generator.createEnvScript(credentials);
+
+      expect(script).toContain('export CLAUDE_FLOW_ADMIN_PASSWORD=');
+      expect(script).toContain('export CLAUDE_FLOW_SERVICE_PASSWORD=');
+      expect(script).toContain('export CLAUDE_FLOW_JWT_SECRET=');
+      expect(script).toContain('export CLAUDE_FLOW_SESSION_SECRET=');
+      expect(script).toContain('export CLAUDE_FLOW_ENCRYPTION_KEY=');
+    });
+
+    it('should include warning comment', () => {
+      const credentials = generator.generateInstallationCredentials();
+      const script = generator.createEnvScript(credentials);
+
+      expect(script).toContain('Store these securely');
+    });
+  });
+
+  describe('JSON Config Generation', () => {
+    it('should generate valid JSON', () => {
+      const credentials = generator.generateInstallationCredentials();
+      const json = generator.createJsonConfig(credentials);
+
+      expect(() => JSON.parse(json)).not.toThrow();
+    });
+
+    it('should include all credentials', () => {
+      const credentials = generator.generateInstallationCredentials();
+      const json = generator.createJsonConfig(credentials);
+      const parsed = JSON.parse(json);
+
+      expect(parsed['claude-flow/admin-password']).toBe(credentials.adminPassword);
+      expect(parsed['claude-flow/service-password']).toBe(credentials.servicePassword);
+      expect(parsed['claude-flow/jwt-secret']).toBe(credentials.jwtSecret);
+      expect(parsed['claude-flow/session-secret']).toBe(credentials.sessionSecret);
+      expect(parsed['claude-flow/encryption-key']).toBe(credentials.encryptionKey);
+    });
+  });
+
+  describe('Factory Functions', () => {
+    it('should create generator with factory function', () => {
+      const gen = createCredentialGenerator();
+      expect(gen).toBeInstanceOf(CredentialGenerator);
+    });
+
+    it('should generate credentials with quick function', () => {
+      const credentials = generateCredentials();
+      expect(credentials.adminPassword).toBeDefined();
+      expect(credentials.jwtSecret).toBeDefined();
+    });
+  });
+
+  describe('CVE-3 Security Verification', () => {
+    it('should NOT produce hardcoded admin123 password', () => {
+      for (let i = 0; i < 100; i++) {
+        const credentials = generator.generateInstallationCredentials();
+        expect(credentials.adminPassword).not.toBe('admin123');
+        expect(credentials.servicePassword).not.toBe('service123');
+      }
+    });
+
+    it('should NOT produce predictable patterns', () => {
+      const passwords = new Set<string>();
+      for (let i = 0; i < 1000; i++) {
+        passwords.add(generator.generatePassword());
+      }
+
+      // All should be unique
+      expect(passwords.size).toBe(1000);
+
+      // None should match common patterns
+      const commonPatterns = ['password', 'admin', 'service', '123456', 'qwerty'];
+      for (const password of passwords) {
+        for (const pattern of commonPatterns) {
+          expect(password.toLowerCase()).not.toContain(pattern);
+        }
+      }
+    });
+
+    it('should use cryptographically secure random', () => {
+      // Generate many passwords and verify entropy
+      const passwords: string[] = [];
+      for (let i = 0; i < 100; i++) {
+        passwords.push(generator.generatePassword());
+      }
+
+      // Calculate average character distribution
+      const charCounts = new Map<string, number>();
+      for (const password of passwords) {
+        for (const char of password) {
+          charCounts.set(char, (charCounts.get(char) || 0) + 1);
+        }
+      }
+
+      // Should have good distribution (many different characters)
+      expect(charCounts.size).toBeGreaterThan(30);
+    });
+
+    it('should generate installation credentials with sufficient entropy', () => {
+      const credentials = generator.generateInstallationCredentials();
+
+      // Password should be at least 256 bits of entropy at minimum
+      expect(credentials.adminPassword.length).toBeGreaterThanOrEqual(32);
+      expect(credentials.servicePassword.length).toBeGreaterThanOrEqual(32);
+
+      // Secrets should be 512 bits
+      expect(credentials.jwtSecret.length).toBeGreaterThanOrEqual(64);
+      expect(credentials.sessionSecret.length).toBeGreaterThanOrEqual(64);
+
+      // Encryption key should be exactly 256 bits (64 hex chars)
+      expect(credentials.encryptionKey.length).toBe(64);
+    });
+  });
+});