alepha 0.14.2 → 0.14.4

package/src/security/__tests__/bug-1-wildcard-after-start.spec.ts

@@ -0,0 +1,229 @@
+import { Alepha } from "alepha";
+import { describe, expect, it } from "vitest";
+import { SecurityError, SecurityProvider } from "../index.ts";
+
+/**
+ * Bug #1: Multi-layer Wildcard Permission Validation Fails After App Start
+ *
+ * Issue: When creating roles with multi-layer wildcard permissions (e.g., "admin:api:*")
+ * after app.start(), the validation logic only checked if parts[1] === "*", which fails
+ * for deeper wildcards.
+ *
+ * Expected: Multi-layer wildcards should be validated correctly by checking if any
+ * permission exists with the matching group prefix.
+ */
+describe("Bug #1: Multi-layer Wildcard Permission Validation After App Start", () => {
+  it("should allow creating role with 2-layer wildcard after app start", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    sec.createPermission("hello:hey");
+    sec.createPermission("hello:ho");
+
+    await app.start();
+
+    // This should work - 2-layer wildcard with existing permissions
+    expect(() =>
+      sec.createRole({
+        name: "superuser",
+        permissions: [{ name: "hello:*" }],
+      }),
+    ).not.toThrow();
+
+    expect(sec.can("superuser", "hello:hey")).toEqual(true);
+    expect(sec.can("superuser", "hello:ho")).toEqual(true);
+  });
+
+  it("should allow creating role with 3-layer wildcard after app start", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    sec.createPermission("admin:api:users");
+    sec.createPermission("admin:api:posts");
+
+    await app.start();
+
+    // This is the bug - should work but previously failed
+    expect(() =>
+      sec.createRole({
+        name: "api-admin",
+        permissions: [{ name: "admin:api:*" }],
+      }),
+    ).not.toThrow();
+
+    expect(sec.can("api-admin", "admin:api:users")).toEqual(true);
+    expect(sec.can("api-admin", "admin:api:posts")).toEqual(true);
+  });
+
+  it("should allow creating role with 4-layer wildcard after app start", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    sec.createPermission("admin:api:v1:users");
+    sec.createPermission("admin:api:v1:posts");
+
+    await app.start();
+
+    // Deep wildcard should work
+    expect(() =>
+      sec.createRole({
+        name: "api-v1-admin",
+        permissions: [{ name: "admin:api:v1:*" }],
+      }),
+    ).not.toThrow();
+
+    expect(sec.can("api-v1-admin", "admin:api:v1:users")).toEqual(true);
+    expect(sec.can("api-v1-admin", "admin:api:v1:posts")).toEqual(true);
+  });
+
+  it("should allow wildcard that matches nested groups", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    // Create permissions with different nesting levels under same prefix
+    sec.createPermission("admin:api:users:read");
+    sec.createPermission("admin:api:users:write");
+    sec.createPermission("admin:api:posts:delete");
+
+    await app.start();
+
+    // Wildcard at intermediate level should work
+    expect(() =>
+      sec.createRole({
+        name: "api-manager",
+        permissions: [{ name: "admin:api:*" }],
+      }),
+    ).not.toThrow();
+
+    expect(sec.can("api-manager", "admin:api:users:read")).toEqual(true);
+    expect(sec.can("api-manager", "admin:api:users:write")).toEqual(true);
+    expect(sec.can("api-manager", "admin:api:posts:delete")).toEqual(true);
+  });
+
+  it("should reject wildcard when no matching permissions exist", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    sec.createPermission("hello:hey");
+
+    await app.start();
+
+    // This should fail - no permissions match "admin:*"
+    expect(() =>
+      sec.createRole({
+        name: "admin",
+        permissions: [{ name: "admin:*" }],
+      }),
+    ).toThrow(SecurityError);
+
+    expect(() =>
+      sec.createRole({
+        name: "admin-api",
+        permissions: [{ name: "admin:api:*" }],
+      }),
+    ).toThrow(SecurityError);
+  });
+
+  it("should allow global wildcard after app start", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    sec.createPermission("anything");
+
+    await app.start();
+
+    // Global wildcard should always work
+    expect(() =>
+      sec.createRole({
+        name: "admin",
+        permissions: [{ name: "*" }],
+      }),
+    ).not.toThrow();
+
+    expect(sec.can("admin", "anything")).toEqual(true);
+  });
+
+  it("should allow exact permission match after app start", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    sec.createPermission("admin:api:users:read");
+
+    await app.start();
+
+    // Exact permission should work
+    expect(() =>
+      sec.createRole({
+        name: "reader",
+        permissions: [{ name: "admin:api:users:read" }],
+      }),
+    ).not.toThrow();
+
+    expect(sec.can("reader", "admin:api:users:read")).toEqual(true);
+  });
+
+  it("should reject exact permission when it doesn't exist", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    sec.createPermission("hello:hey");
+
+    await app.start();
+
+    // Non-existent exact permission should fail
+    expect(() =>
+      sec.createRole({
+        name: "user",
+        permissions: [{ name: "admin:api:users:read" }],
+      }),
+    ).toThrow(SecurityError);
+  });
+
+  it("should handle mixed wildcards and exact permissions", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    sec.createPermission("admin:api:users:read");
+    sec.createPermission("admin:api:posts:write");
+    sec.createPermission("public:read");
+
+    await app.start();
+
+    // Mix of wildcard and exact should work if all exist
+    expect(() =>
+      sec.createRole({
+        name: "mixed",
+        permissions: [
+          { name: "admin:api:*" }, // wildcard - should match
+          { name: "public:read" }, // exact - exists
+        ],
+      }),
+    ).not.toThrow();
+
+    expect(sec.can("mixed", "admin:api:users:read")).toEqual(true);
+    expect(sec.can("mixed", "public:read")).toEqual(true);
+  });
+
+  it("should handle wildcard at exact group level", async () => {
+    const app = Alepha.create();
+    const sec = app.inject(SecurityProvider);
+
+    // Permission with exact group "admin:api"
+    sec.createPermission({ group: "admin:api", name: "execute" });
+    // Permission with nested group "admin:api:users"
+    sec.createPermission({ group: "admin:api:users", name: "read" });
+
+    await app.start();
+
+    // Wildcard "admin:api:*" should match both
+    expect(() =>
+      sec.createRole({
+        name: "api-all",
+        permissions: [{ name: "admin:api:*" }],
+      }),
+    ).not.toThrow();
+
+    expect(sec.can("api-all", "admin:api:execute")).toEqual(true);
+    expect(sec.can("api-all", "admin:api:users:read")).toEqual(true);
+  });
+});

package/src/security/__tests__/bug-2-password-validation.spec.ts

@@ -0,0 +1,245 @@
+import { Alepha } from "alepha";
+import { describe, expect, it } from "vitest";
+import { CryptoProvider } from "../index.ts";
+
+/**
+ * Bug #2: Password Verification Missing Input Validation
+ *
+ * Issue: The verifyPassword method didn't validate input format before processing,
+ * leading to crashes when:
+ * - stored hash is malformed (missing colon, wrong format)
+ * - stored hash has incorrect length
+ * - timingSafeEqual throws when buffer lengths differ
+ *
+ * Expected: All invalid inputs should return false gracefully instead of throwing.
+ */
+describe("Bug #2: Password Verification Missing Input Validation", () => {
+  it("should verify valid password correctly", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const password = "mySecurePassword123!";
+    const hashed = await crypto.hashPassword(password);
+
+    const isValid = await crypto.verifyPassword(password, hashed);
+    expect(isValid).toBe(true);
+
+    const isInvalid = await crypto.verifyPassword("wrongPassword", hashed);
+    expect(isInvalid).toBe(false);
+  });
+
+  it("should return false for malformed hash with no colon", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const malformed = "notavalidhashwithoutcolon";
+
+    // Should not throw, should return false
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for hash with multiple colons", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const malformed = "salt:hash:extra";
+
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for empty string", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const result = await crypto.verifyPassword("password", "");
+    expect(result).toBe(false);
+  });
+
+  it("should return false for hash with empty salt", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const malformed = ":somehashvalue";
+
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for hash with empty hash value", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const malformed = "somesalt:";
+
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for just a colon", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const malformed = ":";
+
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for invalid hex in hash portion", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    // Valid salt, but hash contains non-hex characters
+    const malformed = "validSalt123:notHexChars!@#";
+
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for odd-length hex string", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    // Hex strings must have even length (2 chars per byte)
+    const malformed = "salt:abc"; // 3 chars, odd
+
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for hash with wrong length", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    // Valid hex, but wrong length (scrypt produces 64 bytes = 128 hex chars)
+    const malformed = "salt:abcd"; // Only 4 hex chars = 2 bytes
+
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for corrupted but well-formed hash", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const password = "testPassword";
+    const hashed = await crypto.hashPassword(password);
+
+    // Corrupt the hash by changing one character
+    const removedChar = hashed.slice(-1);
+    const corrupted = hashed.slice(0, -1) + (removedChar === "0" ? "1" : "0");
+
+    const result = await crypto.verifyPassword(password, corrupted);
+    expect(result).toBe(false);
+  });
+
+  it("should return false for null or undefined input", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    // @ts-expect-error - testing runtime behavior
+    const resultNull = await crypto.verifyPassword("password", null);
+    expect(resultNull).toBe(false);
+
+    // @ts-expect-error - testing runtime behavior
+    const resultUndefined = await crypto.verifyPassword("password", undefined);
+    expect(resultUndefined).toBe(false);
+  });
+
+  it("should return false for non-string input", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    // @ts-expect-error - testing runtime behavior
+    const resultNumber = await crypto.verifyPassword("password", 12345);
+    expect(resultNumber).toBe(false);
+
+    // @ts-expect-error - testing runtime behavior
+    const resultObject = await crypto.verifyPassword("password", {
+      hash: "test",
+    });
+    expect(resultObject).toBe(false);
+  });
+
+  it("should handle special characters in salt gracefully", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    // If somehow a salt with special chars got stored
+    const malformed =
+      "salt\nwith\nnewlines:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+
+    // Should not crash, should return false (likely during scrypt or comparison)
+    const result = await crypto.verifyPassword("password", malformed);
+    expect(result).toBe(false);
+  });
+
+  it("should validate format before attempting expensive scrypt operation", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    // These should fail fast without calling scrypt
+    const invalidFormats = [
+      "no-colon-at-all",
+      "too:many:colons:here",
+      ":no-salt",
+      "no-hash:",
+      ":",
+      "",
+      "salt:invalidhex!",
+      "salt:abc", // odd length
+    ];
+
+    for (const invalid of invalidFormats) {
+      const result = await crypto.verifyPassword("password", invalid);
+      expect(result).toBe(false);
+    }
+  });
+
+  it("should properly handle valid hash format with correct verification", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    // Test multiple passwords
+    const passwords = [
+      "simple",
+      "with spaces",
+      "special!@#$%^&*()",
+      "emoji🔐🔑",
+      `${"very".repeat(100)}long`,
+    ];
+
+    for (const password of passwords) {
+      const hashed = await crypto.hashPassword(password);
+
+      // Verify format is correct (salt:hash with 128 hex chars for hash)
+      expect(hashed).toMatch(/^[0-9a-f]+:[0-9a-f]{128}$/i);
+
+      // Correct password should verify
+      expect(await crypto.verifyPassword(password, hashed)).toBe(true);
+
+      // Wrong password should not verify
+      expect(await crypto.verifyPassword(`${password}wrong`, hashed)).toBe(
+        false,
+      );
+    }
+  });
+
+  it("should prevent timing attacks with constant-time comparison", async () => {
+    const app = Alepha.create();
+    const crypto = app.inject(CryptoProvider);
+
+    const password = "testPassword";
+    const hashed = await crypto.hashPassword(password);
+
+    // Both wrong passwords should take similar time (constant-time comparison)
+    // This is a behavioral test - we're just checking they both return false
+    const wrongPassword1 = "x";
+    const wrongPassword2 = "x".repeat(100);
+
+    expect(await crypto.verifyPassword(wrongPassword1, hashed)).toBe(false);
+    expect(await crypto.verifyPassword(wrongPassword2, hashed)).toBe(false);
+  });
+});