@things-factory/auth-base 10.1.206 → 10.1.208

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.206",
+  "version": "10.1.208",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -35,10 +35,10 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.206",
+    "@things-factory/email-base": "^10.1.208",
     "@things-factory/env": "^10.1.149",
-    "@things-factory/shell": "^10.1.206",
-    "@things-factory/task-lease": "^10.1.206",
+    "@things-factory/shell": "^10.1.208",
+    "@things-factory/task-lease": "^10.1.208",
     "@things-factory/utils": "^10.1.179",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "18588a058a4a6cb21c379b2da5517e077c6442ba"
+  "gitHead": "ffc1ceaa9471b9f4a9b86f46c3021f2fed72d17d"
 }

package/tests/audit-db.test.ts

@@ -289,10 +289,10 @@ describe('signing in (§3.3)', () => {
     await flushAudit()
 
     const rows = await getRepository(AuditAction).find({ where: { kind: 'auth.signin' }, relations: ['actor'], order: { createdAt: 'ASC' } })
-    expect(rows.map(row => [row.outcome, row.code, row.actor?.id ?? null])).toEqual([
-      ['ok', null, kim.id],
-      ['error', 'password-not-matched', kim.id],
-      ['error', 'user not found', null]
+    expect(rows.map(row => [row.outcome, row.code, row.actor?.id ?? null, row.detail?.method])).toEqual([
+      ['ok', null, kim.id, 'password'],
+      ['error', 'password-not-matched', kim.id, 'password'],
+      ['error', 'user not found', null, 'password']
     ])
   })
 })

package/tests/passkey-authenticator.ts

@@ -0,0 +1,104 @@
+/**
+ * A passkey authenticator in software, for the tests.
+ *
+ * It answers registration and sign-in the way a browser hands them to the server - the same JSON
+ * `@simplewebauthn/browser` produces - with an ES256 key held here. `userVerified` sets the UV flag:
+ * the authenticator saying it checked a fingerprint, face or PIN. Nothing here verifies anything;
+ * that is the server's part, and the tests watch the server.
+ */
+
+import { createHash, generateKeyPairSync, randomBytes, sign as signData, type KeyObject } from 'crypto'
+
+const { isoCBOR } = require('@simplewebauthn/server/helpers')
+
+const FLAG_UP = 0x01
+const FLAG_UV = 0x04
+const FLAG_AT = 0x40
+
+const b64url = (bytes: Uint8Array | Buffer) => Buffer.from(bytes).toString('base64url')
+const sha256 = (data: Buffer | string) => createHash('sha256').update(data).digest()
+
+export type Site = { rpID: string; origin: string }
+
+export class SoftwareAuthenticator {
+  readonly credentialId = randomBytes(16)
+  private readonly privateKey: KeyObject
+  private readonly publicJwk: { x: string; y: string }
+  private counter = 0
+
+  constructor() {
+    const { privateKey, publicKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' })
+    this.privateKey = privateKey
+    this.publicJwk = publicKey.export({ format: 'jwk' }) as any
+  }
+
+  get id(): string {
+    return b64url(this.credentialId)
+  }
+
+  private authenticatorData(site: Site, flags: number, attested?: Buffer): Buffer {
+    const count = Buffer.alloc(4)
+    count.writeUInt32BE(this.counter)
+    return Buffer.concat([sha256(site.rpID), Buffer.from([flags]), count, ...(attested ? [attested] : [])])
+  }
+
+  private clientData(type: string, challenge: string, site: Site): Buffer {
+    return Buffer.from(JSON.stringify({ type, challenge, origin: site.origin, crossOrigin: false }))
+  }
+
+  /** The browser's answer to `navigator.credentials.create`. */
+  register(challenge: string, site: Site, { userVerified = true } = {}) {
+    const cose = new Map<number, number | Uint8Array>([
+      [1, 2],
+      [3, -7],
+      [-1, 1],
+      [-2, new Uint8Array(Buffer.from(this.publicJwk.x, 'base64url'))],
+      [-3, new Uint8Array(Buffer.from(this.publicJwk.y, 'base64url'))]
+    ])
+    const idLength = Buffer.alloc(2)
+    idLength.writeUInt16BE(this.credentialId.length)
+    const attested = Buffer.concat([Buffer.alloc(16), idLength, this.credentialId, Buffer.from(isoCBOR.encode(cose))])
+
+    const authData = this.authenticatorData(site, FLAG_UP | FLAG_AT | (userVerified ? FLAG_UV : 0), attested)
+    const attestationObject = isoCBOR.encode(
+      new Map<string, unknown>([
+        ['fmt', 'none'],
+        ['attStmt', new Map()],
+        ['authData', new Uint8Array(authData)]
+      ])
+    )
+
+    return {
+      id: this.id,
+      rawId: this.id,
+      type: 'public-key',
+      clientExtensionResults: {},
+      response: {
+        clientDataJSON: b64url(this.clientData('webauthn.create', challenge, site)),
+        attestationObject: b64url(attestationObject),
+        transports: ['internal', 'hybrid']
+      }
+    }
+  }
+
+  /** The browser's answer to `navigator.credentials.get`. */
+  assert(challenge: string, site: Site, { userVerified = true } = {}) {
+    this.counter++
+    const authData = this.authenticatorData(site, FLAG_UP | (userVerified ? FLAG_UV : 0))
+    const clientDataJSON = this.clientData('webauthn.get', challenge, site)
+    const signature = signData('sha256', Buffer.concat([authData, sha256(clientDataJSON)]), this.privateKey)
+
+    return {
+      id: this.id,
+      rawId: this.id,
+      type: 'public-key',
+      clientExtensionResults: {},
+      response: {
+        authenticatorData: b64url(authData),
+        clientDataJSON: b64url(clientDataJSON),
+        signature: b64url(signature),
+        userHandle: null
+      }
+    }
+  }
+}

package/tests/passkey-db.test.ts

@@ -0,0 +1,286 @@
+/**
+ * Passkeys (ADR-0156) - registration, sign-in, confirmation and the caller's own list, through the
+ * real controllers and resolvers on the sqlite harness. The authenticator is software
+ * (`passkey-authenticator.ts`); what is watched is what the server accepts and what it writes.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase, authDataSource } from './db'
+import { loadCompiled } from './compiled'
+import { SoftwareAuthenticator } from './passkey-authenticator'
+
+const { User } = loadCompiled('service/user/user')
+const { WebAuthCredential } = loadCompiled('service/web-auth-credential/web-auth-credential')
+const { WebAuthCredentialQuery } = loadCompiled('service/web-auth-credential/web-auth-credential-query')
+const { WebAuthCredentialMutation } = loadCompiled('service/web-auth-credential/web-auth-credential-mutation')
+const { AuditAction } = loadCompiled('service/audit/audit-action')
+const { flushAudit } = loadCompiled('service/audit/audit-recorder')
+const passkey = loadCompiled('controllers/passkey')
+
+const SITE = { rpID: 'localhost', origin: 'http://localhost:3000' }
+const PASSWORD = 'Passw0rd!'
+
+let domain: any
+let kim: any
+let lee: any
+
+async function seedUser(username: string, overrides: any = {}) {
+  const salt = User.generateSalt()
+  return await getRepository(User).save({
+    username,
+    email: `${username}@example.com`,
+    name: username,
+    salt,
+    password: User.encode(PASSWORD, salt),
+    status: 'activated',
+    domains: [domain],
+    ...overrides
+  })
+}
+
+/** A challenge the way the router makes one: from the options, into the session, taken back out. */
+async function signinChallenge(): Promise<string> {
+  const context: any = { session: {} }
+  passkey.rememberChallenge(context, (await passkey.signinOptions(SITE)).challenge)
+  return passkey.takeChallenge(context)
+}
+
+async function registered(user: any, name = 'macOS · Chrome') {
+  const authenticator = new SoftwareAuthenticator()
+  const { challenge } = await passkey.registrationOptions(user, 'Operato', SITE)
+  await passkey.registerPasskey(user, authenticator.register(challenge, SITE), name, challenge, SITE)
+  return authenticator
+}
+
+async function signinWith(authenticator: SoftwareAuthenticator, options: { userVerified?: boolean } = {}) {
+  const challenge = await signinChallenge()
+  return await passkey.signinWithPasskey(authenticator.assert(challenge, SITE, options), challenge, SITE)
+}
+
+const credentialOf = (authenticator: SoftwareAuthenticator) =>
+  getRepository(WebAuthCredential).findOne({ where: { credentialId: authenticator.id }, withDeleted: true })
+
+async function signinAudits() {
+  await flushAudit()
+  const rows = await getRepository(AuditAction).find({ where: { kind: 'auth.signin' }, relations: ['actor'], order: { createdAt: 'ASC' } })
+  return rows.map(row => [row.outcome, row.code, row.actor?.id ?? null, row.detail?.method])
+}
+
+function context(user: any) {
+  return { state: { user, tx: authDataSource().manager } } as any
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'factory', subdomain: 'factory' })
+  kim = await seedUser('kim')
+  lee = await seedUser('lee')
+})
+
+describe('what the browser is asked (decision 2)', () => {
+  it('registration needs a discoverable passkey and a verified person, and leaves the authenticator to the browser', async () => {
+    const options = await passkey.registrationOptions(kim, 'Operato', SITE)
+
+    expect(options.authenticatorSelection).toEqual({ residentKey: 'required', requireResidentKey: true, userVerification: 'required' })
+    expect(options.authenticatorSelection.authenticatorAttachment).toBeUndefined()
+  })
+
+  it('sign-in names no passkey and needs a verified person', async () => {
+    const options = await passkey.signinOptions(SITE)
+
+    expect(options.userVerification).toBe('required')
+    expect(options.allowCredentials ?? []).toEqual([])
+  })
+
+  it('registration lists what this person already has, so the browser can say so', async () => {
+    const authenticator = await registered(kim)
+    const options = await passkey.registrationOptions(kim, 'Operato', SITE)
+
+    expect(options.excludeCredentials.map(c => c.id)).toEqual([authenticator.id])
+  })
+})
+
+describe('a challenge answers once', () => {
+  it('is gone from the session after it is taken', () => {
+    const context: any = { session: {} }
+    passkey.rememberChallenge(context, 'abc')
+
+    expect(passkey.takeChallenge(context)).toBe('abc')
+    expect(() => passkey.takeChallenge(context)).toThrow('authn verification failed')
+  })
+
+  it('an answer to another challenge is refused', async () => {
+    const authenticator = await registered(kim)
+    const challenge = await signinChallenge()
+    const answer = authenticator.assert(challenge, SITE)
+
+    await expect(passkey.signinWithPasskey(answer, await signinChallenge(), SITE)).rejects.toThrow('authn verification failed')
+  })
+})
+
+describe('registration', () => {
+  it('keeps the passkey with its name and how it can be reached', async () => {
+    const authenticator = await registered(kim, '  macOS · Chrome  ')
+    const credential = await credentialOf(authenticator)
+
+    expect(credential.userId).toBe(kim.id)
+    expect(credential.name).toBe('macOS · Chrome')
+    expect(credential.transports).toEqual(['internal', 'hybrid'])
+  })
+
+  it('refuses a passkey made without verifying the person', async () => {
+    const authenticator = new SoftwareAuthenticator()
+    const { challenge } = await passkey.registrationOptions(kim, 'Operato', SITE)
+
+    await expect(
+      passkey.registerPasskey(kim, authenticator.register(challenge, SITE, { userVerified: false }), 'x', challenge, SITE)
+    ).rejects.toThrow('authn verification failed')
+    expect(await credentialOf(authenticator)).toBeNull()
+  })
+})
+
+describe('signing in (decisions 2 and 4)', () => {
+  it('signs the owner in, moves the counter on and notes when it was used', async () => {
+    const authenticator = await registered(kim)
+
+    const answer = await signinWith(authenticator)
+    const credential = await credentialOf(authenticator)
+
+    expect(answer.user.id).toBe(kim.id)
+    expect(answer.token).toEqual(expect.any(String))
+    expect(credential.counter).toBe(1)
+    expect(credential.lastUsedAt).toBeInstanceOf(Date)
+    expect(await signinAudits()).toEqual([['ok', null, kim.id, 'passkey']])
+  })
+
+  it('refuses an answer without a verified person, and the audit names the owner', async () => {
+    const authenticator = await registered(kim)
+
+    await expect(signinWith(authenticator, { userVerified: false })).rejects.toThrow('authn verification failed')
+    expect((await credentialOf(authenticator)).lastUsedAt).toBeNull()
+    expect(await signinAudits()).toEqual([['error', 'authn verification failed', kim.id, 'passkey']])
+  })
+
+  it('refuses a passkey nobody registered, and the audit names nobody', async () => {
+    await expect(signinWith(new SoftwareAuthenticator())).rejects.toThrow('authn verification failed')
+    expect(await signinAudits()).toEqual([['error', 'authn verification failed', null, 'passkey']])
+  })
+
+  it('refuses a removed passkey', async () => {
+    const authenticator = await registered(kim)
+    await getRepository(WebAuthCredential).softDelete({ credentialId: authenticator.id })
+
+    await expect(signinWith(authenticator)).rejects.toThrow('authn verification failed')
+  })
+
+  it('a locked account stays locked - the passkey neither lifts the lock nor counts as a failure', async () => {
+    const authenticator = await registered(kim)
+    await getRepository(User).update({ id: kim.id }, { status: 'locked', lockedAt: new Date(), failCount: 5 })
+
+    await expect(signinWith(authenticator)).rejects.toThrow('user-locked')
+
+    const after = await getRepository(User).findOneBy({ id: kim.id })
+    expect([after.status, after.failCount]).toEqual(['locked', 5])
+    expect((await credentialOf(authenticator)).lastUsedAt).toBeNull()
+  })
+
+  it('a lock that has run out lifts, the same as for a password', async () => {
+    const authenticator = await registered(kim)
+    await getRepository(User).update({ id: kim.id }, { status: 'locked', lockedAt: new Date(Date.now() - 24 * 60 * 60 * 1000), failCount: 5 })
+
+    await signinWith(authenticator)
+
+    const after = await getRepository(User).findOneBy({ id: kim.id })
+    expect([after.status, after.failCount]).toEqual(['activated', 0])
+  })
+
+  it('a deleted or inactive account is refused', async () => {
+    const authenticator = await registered(kim)
+
+    await getRepository(User).update({ id: kim.id }, { status: 'deleted' })
+    await expect(signinWith(authenticator)).rejects.toThrow('user-deleted')
+
+    await getRepository(User).update({ id: kim.id }, { status: 'inactive' })
+    await expect(signinWith(authenticator)).rejects.toThrow('user not activated')
+  })
+})
+
+describe('confirming it is the signed-in person', () => {
+  async function reverify(user: any, authenticator: SoftwareAuthenticator) {
+    const options = await passkey.reverifyOptions(user, SITE)
+    return await passkey.reverifyWithPasskey(user, authenticator.assert(options.challenge, SITE), options.challenge, SITE)
+  }
+
+  it("answers with the person's own passkey", async () => {
+    const authenticator = await registered(kim)
+
+    await expect(reverify(kim, authenticator)).resolves.toBeUndefined()
+  })
+
+  it("refuses somebody else's passkey", async () => {
+    await registered(kim)
+    const lees = await registered(lee)
+
+    await expect(reverify(kim, lees)).rejects.toThrow('authn verification failed')
+  })
+
+  it('has nothing to ask of a person without a passkey', async () => {
+    expect(await passkey.reverifyOptions(kim, SITE)).toBeNull()
+  })
+})
+
+describe("the caller's own passkeys (decision 6)", () => {
+  const query = new WebAuthCredentialQuery()
+  const mutation = new WebAuthCredentialMutation()
+
+  it('lists only the caller’s own', async () => {
+    const mine = await registered(kim)
+    await registered(lee)
+
+    const list = await query.myWebAuthCredentials(context(kim))
+
+    expect(list.map(c => c.credentialId)).toEqual([mine.id])
+  })
+
+  it('renames the caller’s own, and answers another person’s id as not found', async () => {
+    const credential = await credentialOf(await registered(kim))
+
+    const renamed = await mutation.updateMyWebAuthCredential(credential.id, ' Phone ', context(kim))
+    expect(renamed.name).toBe('Phone')
+
+    await expect(mutation.updateMyWebAuthCredential(credential.id, 'Mine now', context(lee))).rejects.toThrow('There is no passkey of yours')
+    expect((await credentialOf({ id: credential.credentialId } as any)).name).toBe('Phone')
+  })
+
+  it('removes the caller’s own - it signs nobody in afterwards and the removal is audited', async () => {
+    const authenticator = await registered(kim)
+    const credential = await credentialOf(authenticator)
+
+    await expect(mutation.deleteMyWebAuthCredential(credential.id, context(lee))).rejects.toThrow('There is no passkey of yours')
+    expect((await credentialOf(authenticator)).deletedAt).toBeNull()
+
+    expect(await mutation.deleteMyWebAuthCredential(credential.id, context(kim))).toBe(true)
+    expect((await credentialOf(authenticator)).deletedAt).toBeInstanceOf(Date)
+    expect(await query.myWebAuthCredentials(context(kim))).toEqual([])
+    await expect(signinWith(authenticator)).rejects.toThrow('authn verification failed')
+
+    await flushAudit()
+    const removals = await getRepository(AuditAction).find({ where: { kind: 'webauthn.remove' }, relations: ['actor'] })
+    expect(removals.map(row => row.actor?.id)).toEqual([kim.id])
+  })
+
+  it('the same authenticator can be registered again after its passkey was removed', async () => {
+    const authenticator = await registered(kim)
+    await getRepository(WebAuthCredential).softDelete({ credentialId: authenticator.id })
+
+    const { challenge } = await passkey.registrationOptions(kim, 'Operato', SITE)
+    await expect(passkey.registerPasskey(kim, authenticator.register(challenge, SITE), 'again', challenge, SITE)).resolves.toBeTruthy()
+  })
+})

package/translations/ko.json

@@ -1,6 +1,6 @@
 {
   "error.auth error": "인증 오류. {message}",
-  "error.authn verification failed": "사용자 자격 증명을 실패하였습니다.",
+  "error.authn verification failed": "패스키를 확인하지 못했습니다.",
   "error.confirm password not matched": "새 비밀번호와 확인 비밀번호가 일치하지 않습니다.",
   "error.domain mismatch": "인증서의 $t(term.domain)과 현재 $t(term.domain)이 일치하지 않습니다.",
   "error.domain not allowed": "'{subdomain}' 영역은 이 사용자에게 허가되지 않았습니다.",
@@ -264,5 +264,5 @@
   "privilege.allows.audit.query": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 볼 수 있습니다.",
   "task.auth-base.audit-reading.name": "감사 기록 열람",
   "task.auth-base.audit-reading.description": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 읽는다.",
-  "error.access-request-task-mismatch": "고른 업무에 거절된 권한이 들어 있지 않습니다."
+  "error.access-request-task-mismatch": "선택한 업무에 접근이 거부된 권한이 포함되어 있지 않습니다."
 }