agent-messenger 2.32.0 → 2.32.1

package/src/platforms/slack/qr-http-login-2fa.test.ts

@@ -0,0 +1,398 @@
+import QRCode from 'qrcode'
+
+import { loginWithQr } from './qr-http-login'
+
+const WORKSPACE = 'acme'
+const QR_SECRET = 'z-app-1-2-abcdef'
+const MAGIC_LOGIN = 'z-app-1-3-ghijkl'
+const ZAPP_URL = `https://app.slack.com/t/${WORKSPACE}/login/${QR_SECRET}?src=qr_code&user_id=U1&team_id=T1`
+const D_COOKIE = 'xoxd-abc%2Bdef123'
+const TOKEN = `xoxc-1-2-3-${'a'.repeat(64)}`
+
+async function qrDataUrl(): Promise<string> {
+  return QRCode.toDataURL(ZAPP_URL, { margin: 2, width: 256 })
+}
+
+function redirect(location: string, setCookies: readonly string[] = []): Response {
+  const headers = new Headers({ location })
+  for (const cookie of setCookies) headers.append('set-cookie', cookie)
+  return new Response(null, { status: 302, headers })
+}
+
+function confirmationPage(email = 'user@acme.com'): Response {
+  const props = JSON.stringify({
+    action: 'request_primary',
+    emailAddress: email,
+    magicLogin: MAGIC_LOGIN,
+    twoFactorType: 'sms',
+  }).replaceAll('"', '&quot;')
+  return new Response(`<div id="props_node" data-props="${props}"></div>`, { status: 200 })
+}
+
+describe('loginWithQr confirmation code', () => {
+  it('keeps ordinary QR login prompt-free when Slack issues the session cookie directly', async () => {
+    // Given an ordinary QR redirect chain and an optional confirmation callback
+    const dataUrl = await qrDataUrl()
+    let confirmationRequests = 0
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`, [`d=${D_COOKIE}; Domain=.slack.com; Path=/`])
+      }
+      if (url.includes('/z-app-secret')) return new Response(null, { status: 200 })
+      if (url.includes('/ssb/redirect')) {
+        return new Response(`<script>var boot_data={"api_token":"${TOKEN}"}</script>`, { status: 200 })
+      }
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When logging in through the unified QR flow
+    const session = await loginWithQr(dataUrl, {
+      fetchImpl,
+      requestConfirmationCode: async () => {
+        confirmationRequests += 1
+        return '123456'
+      },
+    })
+
+    // Then ordinary QR login succeeds without asking for a confirmation code
+    expect(session.token).toBe(TOKEN)
+    expect(confirmationRequests).toBe(0)
+  })
+
+  it('submits a confirmation code from Slack data-props and returns the session', async () => {
+    // Given a QR chain that reaches Slack's confirmation-code page
+    const dataUrl = await qrDataUrl()
+    const requests: Array<{ url: string; method: string; body: string }> = []
+    const fetchImpl = (async (input: string | URL, init?: RequestInit) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      const method = init?.method ?? 'GET'
+      const body = typeof init?.body === 'string' ? init.body : ''
+      requests.push({ url, method, body })
+
+      if (method === 'GET' && url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/login/${QR_SECRET}?src=qr_code&user_id=U1&team_id=T1`)
+      }
+      if (method === 'GET' && url.includes(`/login/${QR_SECRET}`)) return confirmationPage()
+      if (method === 'POST' && url.includes(`/login/${QR_SECRET}`)) {
+        return redirect('https://slack.com/checkcookie?redir=x', [`d=${D_COOKIE}; Domain=.slack.com; Path=/`])
+      }
+      if (url.includes('/ssb/redirect')) {
+        return new Response(`<script>var boot_data={"api_token":"${TOKEN}"}</script>`, { status: 200 })
+      }
+      throw new Error(`unexpected fetch: ${method} ${url}`)
+    }) as typeof fetch
+
+    // When the caller supplies the code Slack sent
+    const session = await loginWithQr(dataUrl, {
+      fetchImpl,
+      requestConfirmationCode: async () => '123456',
+    })
+
+    // Then the server-issued magic login and entered code are posted to the exact workspace z-app URL
+    const post = requests.find((request) => request.method === 'POST')
+    expect(post?.url).toBe(
+      `https://${WORKSPACE}.slack.com/login/${QR_SECRET}?domain=${WORKSPACE}&domainLogin=1&email=user%40acme.com`,
+    )
+    expect(post?.body).toContain(`2fa_magiclogin=${MAGIC_LOGIN}`)
+    expect(post?.body).toContain('2fa_code=123456')
+    expect(post?.body).toContain('2fa_action=submit_primary')
+    expect(session).toEqual({ token: TOKEN, cookie: D_COOKIE, workspace: WORKSPACE })
+  })
+
+  it('rejects confirmation pages on another Slack subdomain before requesting the code', async () => {
+    // Given a QR chain redirected to a different Slack workspace host
+    const dataUrl = await qrDataUrl()
+    let confirmationRequests = 0
+    let postRequests = 0
+    const fetchImpl = (async (input: string | URL, init?: RequestInit) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if ((init?.method ?? 'GET') === 'POST') postRequests += 1
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://other.slack.com/login/${QR_SECRET}`)
+      }
+      if (url.startsWith('https://other.slack.com/')) return confirmationPage()
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When the unified login evaluates the confirmation page
+    const promise = loginWithQr(dataUrl, {
+      fetchImpl,
+      requestConfirmationCode: async () => {
+        confirmationRequests += 1
+        return '123456'
+      },
+    })
+
+    // Then no authentication material is requested or posted to the wrong workspace host
+    await expect(promise).rejects.toThrow(/workspace host|session/)
+    expect(confirmationRequests).toBe(0)
+    expect(postRequests).toBe(0)
+  })
+
+  it('rejects a same-workspace confirmation URL under an unexpected path prefix', async () => {
+    // Given a same-host redirect at an attacker-chosen path that still contains "/z-app-" and ends with the QR secret
+    const dataUrl = await qrDataUrl()
+    let confirmationRequests = 0
+    let postRequests = 0
+    const attackerPath = `/attacker-chosen/z-app-junk/${QR_SECRET}`
+    const fetchImpl = (async (input: string | URL, init?: RequestInit) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if ((init?.method ?? 'GET') === 'POST') postRequests += 1
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com${attackerPath}`)
+      }
+      if (url === `https://${WORKSPACE}.slack.com${attackerPath}`) return confirmationPage()
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When the unified login evaluates the confirmation URL
+    const promise = loginWithQr(dataUrl, {
+      fetchImpl,
+      requestConfirmationCode: async () => {
+        confirmationRequests += 1
+        return '123456'
+      },
+    })
+
+    // Then no confirmation code is requested and no material is posted to the wrong path
+    await expect(promise).rejects.toThrow(/session|confirmation|origin/)
+    expect(confirmationRequests).toBe(0)
+    expect(postRequests).toBe(0)
+  })
+
+  it('rejects an empty confirmation code without issuing a POST', async () => {
+    // Given a valid confirmation page and a caller that returns only whitespace
+    const dataUrl = await qrDataUrl()
+    let postRequests = 0
+    const fetchImpl = (async (input: string | URL, init?: RequestInit) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      const method = init?.method ?? 'GET'
+      if (method === 'POST') postRequests += 1
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/login/${QR_SECRET}`)
+      }
+      if (url.includes(`/login/${QR_SECRET}`)) return confirmationPage()
+      throw new Error(`unexpected fetch: ${method} ${url}`)
+    }) as typeof fetch
+
+    // When login receives the empty code
+    const promise = loginWithQr(dataUrl, {
+      fetchImpl,
+      requestConfirmationCode: async () => '   ',
+    })
+
+    // Then login fails before sending authentication material
+    await expect(promise).rejects.toThrow(/session|confirmation/)
+    expect(postRequests).toBe(0)
+  })
+
+  it('keeps debug output free of QR, email, code, and cookie secrets', async () => {
+    // Given a confirmation flow containing secret-bearing URLs and values
+    const dataUrl = await qrDataUrl()
+    const messages: string[] = []
+    const fetchImpl = (async (input: string | URL, init?: RequestInit) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      const method = init?.method ?? 'GET'
+      if (method === 'GET' && url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/login/${QR_SECRET}?email=user%40acme.com`)
+      }
+      if (method === 'GET' && url.includes(`/login/${QR_SECRET}`)) return confirmationPage()
+      if (method === 'POST') {
+        return redirect('https://slack.com/checkcookie', [`d=${D_COOKIE}; Domain=.slack.com; Path=/`])
+      }
+      if (url.includes('/ssb/redirect')) {
+        return new Response(`<script>var boot_data={"api_token":"${TOKEN}"}</script>`, { status: 200 })
+      }
+      throw new Error(`unexpected fetch: ${method} ${url}`)
+    }) as typeof fetch
+
+    // When login emits debug messages
+    await loginWithQr(dataUrl, {
+      fetchImpl,
+      requestConfirmationCode: async () => '123456',
+      debug: (message) => messages.push(message),
+    })
+
+    // Then no authentication material appears in the debug channel
+    const output = messages.join('\n')
+    for (const secret of [QR_SECRET, MAGIC_LOGIN, 'user@acme.com', '123456', D_COOKIE, TOKEN]) {
+      expect(output).not.toContain(secret)
+    }
+  })
+
+  it('respects host, path, and deletion cookie semantics across redirects', async () => {
+    // Given scoped cookies with the same name plus an explicitly deleted cookie
+    const dataUrl = await qrDataUrl()
+    const observedCookies: Record<string, string | null> = {}
+    const fetchImpl = (async (input: string | URL, init?: RequestInit) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      observedCookies[url] = new Headers(init?.headers).get('cookie')
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/login/${QR_SECRET}`, [
+          'hostOnly=app; Path=/',
+          'shared=root; Domain=.slack.com; Path=/',
+          'shared=login; Domain=.slack.com; Path=/login',
+          'deleted=gone; Domain=.slack.com; Path=/; Max-Age=0',
+        ])
+      }
+      if (url.includes(`/login/${QR_SECRET}`)) return new Response('<title>Link Expired</title>', { status: 200 })
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When redirects move from app.slack.com to the workspace login path
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/expired/)
+
+    // Then only cookies valid for that destination host and path are sent
+    const destinationCookies = observedCookies[`https://${WORKSPACE}.slack.com/login/${QR_SECRET}`]
+    expect(destinationCookies).not.toContain('hostOnly=app')
+    expect(destinationCookies).toContain('shared=root')
+    expect(destinationCookies).toContain('shared=login')
+    expect(destinationCookies).not.toContain('deleted=gone')
+  })
+
+  it('discards a malformed Set-Cookie header without aborting a valid session cookie', async () => {
+    // Given a redirect that emits an unparseable cookie ahead of the valid d session cookie
+    const dataUrl = await qrDataUrl()
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`, [
+          'bogus=1; Domain=.com; Path=/',
+          `d=${D_COOKIE}; Domain=.slack.com; Path=/`,
+        ])
+      }
+      if (url.includes('/z-app-secret')) return new Response(null, { status: 200 })
+      if (url.includes('/ssb/redirect')) {
+        return new Response(`<script>var boot_data={"api_token":"${TOKEN}"}</script>`, { status: 200 })
+      }
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When login processes the response
+    const session = await loginWithQr(dataUrl, { fetchImpl })
+
+    // Then the malformed cookie is silently discarded and the valid session cookie is captured
+    expect(session.cookie).toBe(D_COOKIE)
+    expect(session.token).toBe(TOKEN)
+  })
+
+  it('does not retain a deleted Slack session cookie', async () => {
+    // Given a redirect that creates and then deletes the d session cookie
+    const dataUrl = await qrDataUrl()
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/end`, [
+          `d=${D_COOKIE}; Domain=.slack.com; Path=/`,
+          'd=; Domain=.slack.com; Path=/; Max-Age=0',
+        ])
+      }
+      if (url === `https://${WORKSPACE}.slack.com/end`) return new Response(null, { status: 200 })
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When login processes the deleted session cookie
+    const promise = loginWithQr(dataUrl, { fetchImpl })
+
+    // Then the deleted session cannot authenticate the user
+    await expect(promise).rejects.toThrow(/session/)
+  })
+
+  it('does not capture a host-only d cookie set from app.slack.com when querying the workspace host', async () => {
+    // Given a d cookie set with no Domain attribute (host-only) on app.slack.com and a working token endpoint
+    const dataUrl = await qrDataUrl()
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/end`, [`d=${D_COOKIE}; Path=/; HttpOnly`])
+      }
+      if (url === `https://${WORKSPACE}.slack.com/end`) return new Response(null, { status: 200 })
+      if (url === `https://${WORKSPACE}.slack.com/ssb/redirect`) {
+        return new Response(`<script>var boot_data={"api_token":"${TOKEN}"}</script>`, { status: 200 })
+      }
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When login queries the jar for the workspace-scoped session cookie
+    const promise = loginWithQr(dataUrl, { fetchImpl })
+
+    // Then the host-only cookie is not treated as a valid workspace session, so auth fails before minting a token
+    await expect(promise).rejects.toThrow(/Could not establish|expired/)
+  })
+
+  it('does not capture a d cookie scoped to a path outside the token URL', async () => {
+    // Given a d cookie scoped to a path the token URL does not fall under and a working token endpoint
+    const dataUrl = await qrDataUrl()
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/end`, [`d=${D_COOKIE}; Domain=.slack.com; Path=/nowhere`])
+      }
+      if (url === `https://${WORKSPACE}.slack.com/end`) return new Response(null, { status: 200 })
+      if (url === `https://${WORKSPACE}.slack.com/ssb/redirect`) {
+        return new Response(`<script>var boot_data={"api_token":"${TOKEN}"}</script>`, { status: 200 })
+      }
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When login queries the jar for a cookie sendable to /ssb/redirect
+    const promise = loginWithQr(dataUrl, { fetchImpl })
+
+    // Then the path-restricted cookie is not returned for the token URL, so auth fails before minting a token
+    await expect(promise).rejects.toThrow(/Could not establish|expired/)
+  })
+
+  it('treats a d cookie with a past Expires date as deleted', async () => {
+    // Given a d cookie set and then invalidated via an Expires date in the past, plus a working token endpoint
+    const dataUrl = await qrDataUrl()
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/end`, [
+          `d=${D_COOKIE}; Domain=.slack.com; Path=/`,
+          'd=; Domain=.slack.com; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT',
+        ])
+      }
+      if (url === `https://${WORKSPACE}.slack.com/end`) return new Response(null, { status: 200 })
+      if (url === `https://${WORKSPACE}.slack.com/ssb/redirect`) {
+        return new Response(`<script>var boot_data={"api_token":"${TOKEN}"}</script>`, { status: 200 })
+      }
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When login processes the expired cookie
+    const promise = loginWithQr(dataUrl, { fetchImpl })
+
+    // Then the expired session is dropped and auth fails before minting a token
+    await expect(promise).rejects.toThrow(/Could not establish|expired/)
+  })
+
+  it('honors a d cookie deletion issued from slack.com root during a later hop', async () => {
+    // Given a workspace-issued d cookie followed by a slack.com-root deletion for the same .slack.com scope
+    const dataUrl = await qrDataUrl()
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/hop-2`, [`d=${D_COOKIE}; Domain=.slack.com; Path=/`])
+      }
+      if (url === `https://${WORKSPACE}.slack.com/hop-2`) {
+        return redirect('https://slack.com/checkcookie')
+      }
+      if (url === 'https://slack.com/checkcookie') {
+        return redirect(`https://${WORKSPACE}.slack.com/end`, ['d=; Domain=.slack.com; Path=/; Max-Age=0'])
+      }
+      if (url === `https://${WORKSPACE}.slack.com/end`) return new Response(null, { status: 200 })
+      if (url === `https://${WORKSPACE}.slack.com/ssb/redirect`) {
+        return new Response(`<script>var boot_data={"api_token":"${TOKEN}"}</script>`, { status: 200 })
+      }
+      throw new Error(`unexpected fetch: ${url}`)
+    }) as typeof fetch
+
+    // When login processes the deletion issued from the slack.com root
+    const promise = loginWithQr(dataUrl, { fetchImpl })
+
+    // Then the earlier workspace cookie is not resurrected and auth fails before minting a token
+    await expect(promise).rejects.toThrow(/Could not establish|expired/)
+  })
+})

package/src/platforms/slack/qr-http-login.test.ts

@@ -3,7 +3,7 @@ import { afterEach, describe, expect, it } from 'bun:test'
 import QRCode from 'qrcode'
 
 import { SlackError } from '@/platforms/slack/client'
-import { isSlackHost, loginWithQr, parseDCookie } from '@/platforms/slack/qr-http-login'
+import { isSlackHost, loginWithQr } from '@/platforms/slack/qr-http-login'
 
 const WORKSPACE = 'acme'
 const ZAPP_URL = `https://app.slack.com/t/${WORKSPACE}/login/z-app-1-2-abcdef?src=qr_code&user_id=U1&team_id=T1`
@@ -26,20 +26,6 @@ afterEach(() => {
   globalThis.fetch = originalFetch
 })
 
-describe('parseDCookie', () => {
-  it('extracts the d cookie value from a Set-Cookie header', () => {
-    expect(parseDCookie(`d=${D_COOKIE}; Path=/; HttpOnly; Secure`)).toBe(D_COOKIE)
-  })
-
-  it('ignores a non-d cookie', () => {
-    expect(parseDCookie('x=somevalue; Path=/')).toBeNull()
-  })
-
-  it('ignores a d cookie that is not an xoxd value', () => {
-    expect(parseDCookie('d=plainvalue; Path=/')).toBeNull()
-  })
-})
-
 describe('isSlackHost', () => {
   it('accepts slack.com and its subdomains over https', () => {
     expect(isSlackHost('https://slack.com/checkcookie')).toBe(true)
@@ -68,7 +54,10 @@ describe('loginWithQr', () => {
         return redirect(`https://${WORKSPACE}.slack.com/app-redir/login/x`)
       }
       if (url.includes('/app-redir/login/')) {
-        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`, `d=${D_COOKIE}; HttpOnly`)
+        return redirect(
+          `https://${WORKSPACE}.slack.com/z-app-secret`,
+          `d=${D_COOKIE}; Domain=.slack.com; Path=/; HttpOnly`,
+        )
       }
       if (url.includes('/z-app-secret')) {
         return redirect('https://slack.com/checkcookie?redir=x')
@@ -102,7 +91,10 @@ describe('loginWithQr', () => {
       requests.push({ url, cookie: headers.get('cookie') })
 
       if (url.startsWith('https://app.slack.com/t/')) {
-        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`, `d=${D_COOKIE}; HttpOnly`)
+        return redirect(
+          `https://${WORKSPACE}.slack.com/z-app-secret`,
+          `d=${D_COOKIE}; Domain=.slack.com; Path=/; HttpOnly`,
+        )
       }
       if (url.includes('/z-app-secret')) {
         return redirect('https://idp.example.com/saml/login')
@@ -186,7 +178,7 @@ describe('loginWithQr', () => {
     const stepAFetch = (async (input: string | URL) => {
       const url = typeof input === 'string' ? input : input.toString()
       if (url.startsWith('https://app.slack.com/t/')) {
-        return redirect(`https://${WORKSPACE}.slack.com/end`, `d=${D_COOKIE}; HttpOnly`)
+        return redirect(`https://${WORKSPACE}.slack.com/end`, `d=${D_COOKIE}; Domain=.slack.com; Path=/; HttpOnly`)
       }
       return new Response(null, { status: 200 })
     }) as typeof fetch