cursedbelt-server 1.0.0

package/src/server/auth/middleware.spec.ts

@@ -0,0 +1,148 @@
+import { Database } from 'bun:sqlite';
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { Hono } from 'hono';
+import { createKysely } from '../db/kysely';
+import { AUTH_COOKIE_NAME } from './cookie';
+import { getOnlyEnforcement } from './getOnly';
+import { signToken } from './jwt';
+import { createAuthMiddleware } from './middleware';
+import { createSessionStore } from './sessionStore';
+import type { AuthEnv, SessionStore } from './types';
+
+const SECRET = 'integration-test-secret-32-chars-min!';
+const REQ = (path: string, init?: RequestInit) => new Request(`http://localhost${path}`, init);
+const withCookie = (token: string): RequestInit => ({
+  headers: { cookie: `${AUTH_COOKIE_NAME}=${token}` },
+});
+
+const DDL = `CREATE TABLE auth_sessions (
+  session_id TEXT PRIMARY KEY, user_id TEXT NOT NULL, created_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL, refresh_expires_at TEXT NOT NULL, access_expires_at TEXT,
+  get_only INTEGER NOT NULL DEFAULT 0, disabled INTEGER NOT NULL DEFAULT 0,
+  disabled_at TEXT, disabled_by TEXT, user_agent TEXT, ip TEXT)`;
+
+let db: Database;
+let store: SessionStore;
+
+const buildApp = () => {
+  const app = new Hono<AuthEnv>();
+  app.use('*', createAuthMiddleware(store, SECRET));
+  app.use('*', getOnlyEnforcement());
+  app.get('/me', (c) => {
+    const user = c.get('user');
+    return c.json({ user, attributedUserId: c.get('userId') });
+  });
+  app.post('/notes', (c) => c.json({ ok: true }));
+  app.get('/ctgrpo/notes', (c) => c.json({ ok: true }));
+  return app;
+};
+
+beforeEach(() => {
+  db = new Database(':memory:');
+  db.run(DDL);
+  store = createSessionStore(createKysely(db));
+});
+afterEach(() => {
+  store.stop();
+  db.close();
+});
+
+describe('createAuthMiddleware', () => {
+  test('valid cookie + live session → sets c.get("user") and userId', async () => {
+    await store.create({ sessionId: 's1', userId: 'u1', getOnly: false });
+    const token = await signToken(
+      { userId: 'u1', sessionId: 's1', roles: ['owner'], getOnly: false },
+      SECRET,
+      '15m',
+    );
+    const res = await buildApp().fetch(REQ('/me', withCookie(token)));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.user).toEqual({ id: 'u1', roles: ['owner'], getOnly: false, sessionId: 's1' });
+    expect(body.attributedUserId).toBe('u1');
+  });
+
+  test('no cookie → 401 Unauthorized', async () => {
+    const res = await buildApp().fetch(REQ('/me'));
+    expect(res.status).toBe(401);
+    expect((await res.json()).error.message).toBe('Unauthorized');
+  });
+
+  test('garbage / wrong-secret token → 401 Invalid token', async () => {
+    await store.create({ sessionId: 's1', userId: 'u1' });
+    const bad = await signToken(
+      { userId: 'u1', sessionId: 's1', roles: [], getOnly: false },
+      'a-different-secret-32-characters!!',
+      '15m',
+    );
+    const res = await buildApp().fetch(REQ('/me', withCookie(bad)));
+    expect(res.status).toBe(401);
+    expect((await res.json()).error.message).toBe('Invalid token');
+  });
+
+  test('unknown session → 401 Session revoked', async () => {
+    const token = await signToken(
+      { userId: 'u1', sessionId: 'ghost', roles: [], getOnly: false },
+      SECRET,
+      '15m',
+    );
+    const res = await buildApp().fetch(REQ('/me', withCookie(token)));
+    expect(res.status).toBe(401);
+    expect((await res.json()).error.message).toBe('Session revoked');
+  });
+
+  test('disabled session → 401 Session revoked', async () => {
+    await store.create({ sessionId: 's1', userId: 'u1' });
+    await store.disable('s1');
+    const token = await signToken(
+      { userId: 'u1', sessionId: 's1', roles: [], getOnly: false },
+      SECRET,
+      '15m',
+    );
+    const res = await buildApp().fetch(REQ('/me', withCookie(token)));
+    expect(res.status).toBe(401);
+    expect((await res.json()).error.message).toBe('Session revoked');
+  });
+
+  test('expired refresh window → 401 Session expired', async () => {
+    await store.create({
+      sessionId: 's1',
+      userId: 'u1',
+      refreshExpiresAt: new Date(Date.now() - 1000).toISOString(),
+    });
+    const token = await signToken(
+      { userId: 'u1', sessionId: 's1', roles: [], getOnly: false },
+      SECRET,
+      '15m',
+    );
+    const res = await buildApp().fetch(REQ('/me', withCookie(token)));
+    expect(res.status).toBe(401);
+    expect((await res.json()).error.message).toBe('Session expired');
+  });
+
+  test('a missing getOnly claim normalizes to getOnly:false on c.get("user")', async () => {
+    await store.create({ sessionId: 's1', userId: 'u1' });
+    // sign WITHOUT a getOnly key (cast — simulates a pre-getOnly token)
+    const token = await signToken(
+      { userId: 'u1', sessionId: 's1', roles: [] } as never,
+      SECRET,
+      '15m',
+    );
+    const body = await (await buildApp().fetch(REQ('/me', withCookie(token)))).json();
+    expect(body.user.getOnly).toBe(false);
+  });
+
+  test('getOnly session: raw POST 403 but a ctgr GET-twin passes', async () => {
+    await store.create({ sessionId: 's1', userId: 'u1', getOnly: true });
+    const token = await signToken(
+      { userId: 'u1', sessionId: 's1', roles: [], getOnly: true },
+      SECRET,
+      '15m',
+    );
+    const app = buildApp();
+    expect((await app.fetch(REQ('/notes', { method: 'POST', ...withCookie(token) }))).status).toBe(
+      403,
+    );
+    expect((await app.fetch(REQ('/ctgrpo/notes', withCookie(token)))).status).toBe(200);
+  });
+});

package/src/server/auth/middleware.ts

@@ -0,0 +1,56 @@
+import type { MiddlewareHandler } from 'hono';
+import { ApiError, toErrorEnvelope } from '../errors';
+import { readAuthCookie } from './cookie';
+import { verifyToken } from './jwt';
+import type { AppJwtPayload, AuthEnv, AuthUser, SessionStore } from './types';
+
+/**
+ * The composed auth middleware. Reads the httpOnly `access_token` cookie, verifies
+ * the JWT, checks the session is live (present, not revoked, inside its sliding
+ * window), and sets the normalized {@link AuthUser} on `c.get('user')` (plus
+ * `userId` for request-log attribution). Every failure maps to a 401 in the
+ * canonical error envelope.
+ *
+ * Deliberately minimal: it does NOT slide/re-issue the token — that (and the
+ * `/f`-vs-`/login` policy) is app business (task 32). Mount {@link
+ * ./getOnly.getOnlyEnforcement} AFTER this to add the GET-only gate.
+ */
+export function createAuthMiddleware(
+  sessionStore: SessionStore,
+  jwtSecret: string,
+): MiddlewareHandler<AuthEnv> {
+  return async (c, next) => {
+    const token = readAuthCookie(c);
+    if (!token) {
+      return c.json(toErrorEnvelope(new ApiError(401, 'Unauthorized')), 401);
+    }
+
+    let payload: AppJwtPayload;
+    try {
+      payload = await verifyToken<AppJwtPayload>(token, jwtSecret);
+    } catch {
+      return c.json(toErrorEnvelope(new ApiError(401, 'Invalid token')), 401);
+    }
+
+    const session = sessionStore.get(payload.sessionId);
+    if (!session || session.disabled) {
+      return c.json(toErrorEnvelope(new ApiError(401, 'Session revoked')), 401);
+    }
+    if (new Date(session.refreshExpiresAt) < new Date()) {
+      return c.json(toErrorEnvelope(new ApiError(401, 'Session expired')), 401);
+    }
+
+    const user: AuthUser = {
+      id: payload.userId,
+      roles: payload.roles ?? [],
+      // A token minted before the claim existed has no `getOnly` → treat as false,
+      // preserving access for pre-existing cookies.
+      getOnly: payload.getOnly ?? false,
+      sessionId: payload.sessionId,
+    };
+    c.set('user', user);
+    c.set('userId', user.id);
+
+    await next();
+  };
+}

package/src/server/auth/password.spec.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from 'bun:test';
+import { pbkdf2Sync, randomBytes } from 'node:crypto';
+import { hashPassword, needsRehash, verifyPassword } from './password';
+
+// Reproduce the OLD app's legacy hash shape: PBKDF2-SHA512 @ 1000 iterations, the
+// salt + derived hex joined as "<salt>:<hex>" (what the ETL stores in the password
+// column for un-upgraded users).
+const legacyHash = (plain: string, salt = randomBytes(16).toString('hex')): string => {
+  const hex = pbkdf2Sync(plain, salt, 1000, 64, 'sha512').toString('hex');
+  return `${salt}:${hex}`;
+};
+
+describe('hashPassword / verifyPassword (argon2id)', () => {
+  test('mints a self-describing argon2id hash and verifies it', async () => {
+    const hash = await hashPassword('hunter2');
+    expect(hash.startsWith('$argon2id$')).toBe(true);
+    expect(await verifyPassword('hunter2', hash)).toBe(true);
+    expect(await verifyPassword('wrong', hash)).toBe(false);
+  });
+
+  test('two hashes of the same password differ (random salt) yet both verify', async () => {
+    const a = await hashPassword('same');
+    const b = await hashPassword('same');
+    expect(a).not.toBe(b);
+    expect(await verifyPassword('same', a)).toBe(true);
+    expect(await verifyPassword('same', b)).toBe(true);
+  });
+});
+
+describe('verifyPassword (legacy PBKDF2)', () => {
+  test('verifies a correct password against a legacy salt:hex digest', async () => {
+    const stored = legacyHash('password');
+    expect(await verifyPassword('password', stored)).toBe(true);
+    expect(await verifyPassword('nope', stored)).toBe(false);
+  });
+
+  test('a malformed (colon-less) legacy value is a non-match, not a throw', async () => {
+    expect(await verifyPassword('x', 'no-colon-here')).toBe(false);
+    expect(await verifyPassword('x', '')).toBe(false);
+  });
+});
+
+describe('needsRehash', () => {
+  test('true for legacy, false for argon2id', async () => {
+    expect(needsRehash(legacyHash('p'))).toBe(true);
+    expect(needsRehash(await hashPassword('p'))).toBe(false);
+  });
+});

package/src/server/auth/password.ts

@@ -0,0 +1,71 @@
+import { pbkdf2 as pbkdf2Cb, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+
+/**
+ * Password hashing on `Bun.password` (argon2id — memory-hard, thread-pooled, zero
+ * deps, the current OWASP default). The argon2id hash is self-describing
+ * (`$argon2id$v=19$m=…$<salt>$<hash>`) so there is NO separate salt column — the new
+ * schema stores just the hash string.
+ *
+ * Legacy upgrade path: the old app used PBKDF2-SHA512 @ 1000 iterations with a
+ * separate salt; the ETL (task 43) brings those forward as a combined `"<salt>:<hex>"`
+ * string in the password column (it can't re-hash — it lacks the plaintext).
+ * {@link verifyPassword} transparently verifies BOTH shapes; on a legacy match the
+ * caller re-hashes with argon2id ({@link needsRehash}) — a silent per-login upgrade,
+ * no forced reset.
+ */
+
+// Legacy PBKDF2-SHA512 parameters — used ONLY to verify pre-argon2id hashes; never
+// to mint new ones. (1000 iterations is far below modern guidance — exactly why we
+// moved off it.)
+const LEGACY_ITERATIONS = 1000;
+const LEGACY_KEYLEN = 64;
+const LEGACY_DIGEST = 'sha512';
+
+const pbkdf2 = promisify(pbkdf2Cb);
+
+const isArgon2 = (hash: string): boolean => hash.startsWith('$argon2');
+
+/** Mint an argon2id password hash. Returns the self-describing PHC string. */
+export function hashPassword(plain: string): Promise<string> {
+  return Bun.password.hash(plain, { algorithm: 'argon2id' });
+}
+
+/**
+ * Verify a candidate against a stored hash, handling BOTH formats: an argon2id PHC
+ * string (new) via `Bun.password.verify`; a legacy `"<salt>:<pbkdf2-hex>"` digest by
+ * re-deriving PBKDF2-SHA512 with the stored salt and comparing in constant time.
+ */
+export async function verifyPassword(plain: string, stored: string): Promise<boolean> {
+  if (isArgon2(stored)) {
+    try {
+      return await Bun.password.verify(plain, stored);
+    } catch {
+      return false;
+    }
+  }
+  // Legacy: split on the FIRST colon — salt (hex) : derived (hex). A malformed value
+  // (no colon) is simply a non-match.
+  const sep = stored.indexOf(':');
+  if (sep === -1) return false;
+  const salt = stored.slice(0, sep);
+  const expectedHex = stored.slice(sep + 1);
+  if (!salt || !expectedHex) return false;
+
+  const derived = (
+    await pbkdf2(plain, salt, LEGACY_ITERATIONS, LEGACY_KEYLEN, LEGACY_DIGEST)
+  ).toString('hex');
+  // timingSafeEqual throws on length mismatch; a length diff is already a non-match
+  // and short-circuiting leaks nothing a compare wouldn't.
+  if (derived.length !== expectedHex.length) return false;
+  return timingSafeEqual(Buffer.from(derived), Buffer.from(expectedHex));
+}
+
+/**
+ * True when a stored hash is a legacy (non-argon2id) digest and should be upgraded.
+ * Call AFTER a successful {@link verifyPassword} to opportunistically re-hash with
+ * argon2id — never block auth on the upgrade.
+ */
+export function needsRehash(stored: string): boolean {
+  return !isArgon2(stored);
+}

package/src/server/auth/sessionStore.spec.ts

@@ -0,0 +1,189 @@
+import { Database } from 'bun:sqlite';
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { createKysely, type PlumbingDb } from '../db/kysely';
+import { createSessionStore } from './sessionStore';
+import type { SessionStore } from './types';
+
+const DDL = `CREATE TABLE auth_sessions (
+  session_id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  refresh_expires_at TEXT NOT NULL,
+  access_expires_at TEXT,
+  get_only INTEGER NOT NULL DEFAULT 0,
+  disabled INTEGER NOT NULL DEFAULT 0,
+  disabled_at TEXT,
+  disabled_by TEXT,
+  user_agent TEXT,
+  ip TEXT
+)`;
+
+let db: Database;
+let ky: PlumbingDb;
+let store: SessionStore;
+
+beforeEach(() => {
+  db = new Database(':memory:');
+  db.run(DDL);
+  ky = createKysely(db);
+  store = createSessionStore(ky);
+});
+
+afterEach(() => {
+  store.stop();
+  db.close();
+});
+
+const rowCount = (): number =>
+  (db.query('SELECT COUNT(*) AS n FROM auth_sessions').get() as { n: number }).n;
+
+describe('createSessionStore', () => {
+  test('create caches in memory AND persists to the DB', async () => {
+    const s = await store.create({ sessionId: 's1', userId: 'u1', getOnly: true, ip: '1.2.3.4' });
+    expect(s.getOnly).toBe(true);
+    expect(s.disabled).toBe(false);
+    expect(store.get('s1')).toEqual(s);
+    expect(rowCount()).toBe(1);
+    const row = db
+      .query('SELECT get_only, ip FROM auth_sessions WHERE session_id = ?')
+      .get('s1') as {
+      get_only: number;
+      ip: string;
+    };
+    expect(row.get_only).toBe(1);
+    expect(row.ip).toBe('1.2.3.4');
+  });
+
+  test('isValid is true for a fresh session, false when disabled or expired', async () => {
+    await store.create({ sessionId: 's1', userId: 'u1' });
+    expect(store.isValid(store.get('s1'))).toBe(true);
+    expect(store.isValid(undefined)).toBe(false);
+
+    await store.create({
+      sessionId: 'sExpired',
+      userId: 'u1',
+      refreshExpiresAt: new Date(Date.now() - 1000).toISOString(),
+    });
+    expect(store.isValid(store.get('sExpired'))).toBe(false);
+  });
+
+  test('touch slides the refresh deadline and updates lastSeenAt', async () => {
+    const created = await store.create({
+      sessionId: 's1',
+      userId: 'u1',
+      refreshExpiresAt: new Date(Date.now() + 1000).toISOString(),
+    });
+    // `create`/`get` hand back the live map object, so capture the string by value
+    // before `touch` mutates it.
+    const beforeRefresh = created.refreshExpiresAt;
+    await new Promise((r) => setTimeout(r, 5));
+    await store.touch('s1', { accessExpiresAt: '2099-01-01T00:00:00.000Z' }); // forces a flush
+    const after = store.get('s1');
+    expect(after).toBeDefined();
+    expect(Date.parse(after?.refreshExpiresAt ?? '')).toBeGreaterThan(Date.parse(beforeRefresh));
+    expect(after?.accessExpiresAt).toBe('2099-01-01T00:00:00.000Z');
+    // forced flush persisted the access expiry
+    const row = db
+      .query('SELECT access_expires_at FROM auth_sessions WHERE session_id = ?')
+      .get('s1') as {
+      access_expires_at: string;
+    };
+    expect(row.access_expires_at).toBe('2099-01-01T00:00:00.000Z');
+  });
+
+  test('disable revokes in memory + DB (audit row kept)', async () => {
+    await store.create({ sessionId: 's1', userId: 'u1' });
+    expect(await store.disable('s1', 'admin-7')).toBe(true);
+    expect(store.get('s1')?.disabled).toBe(true);
+    expect(store.isValid(store.get('s1'))).toBe(false);
+    const row = db
+      .query('SELECT disabled, disabled_by FROM auth_sessions WHERE session_id = ?')
+      .get('s1') as {
+      disabled: number;
+      disabled_by: string;
+    };
+    expect(row.disabled).toBe(1);
+    expect(row.disabled_by).toBe('admin-7');
+  });
+
+  test('disableAllForUser returns affected ids and revokes them', async () => {
+    await store.create({ sessionId: 'a', userId: 'u1' });
+    await store.create({ sessionId: 'b', userId: 'u1' });
+    await store.create({ sessionId: 'c', userId: 'u2' });
+    const affected = await store.disableAllForUser('u1', 'admin');
+    expect(affected.sort()).toEqual(['a', 'b']);
+    expect(store.get('a')?.disabled).toBe(true);
+    expect(store.get('c')?.disabled).toBe(false);
+  });
+
+  test('remove forgets the session entirely (memory + DB)', async () => {
+    await store.create({ sessionId: 's1', userId: 'u1' });
+    await store.remove('s1');
+    expect(store.get('s1')).toBeUndefined();
+    expect(rowCount()).toBe(0);
+  });
+
+  test('deleteByUser hard-deletes all of a user’s sessions', async () => {
+    await store.create({ sessionId: 'a', userId: 'u1' });
+    await store.create({ sessionId: 'b', userId: 'u1' });
+    await store.create({ sessionId: 'c', userId: 'u2' });
+    await store.deleteByUser('u1');
+    expect(store.get('a')).toBeUndefined();
+    expect(store.get('c')).toBeDefined();
+    expect(rowCount()).toBe(1);
+  });
+
+  test('listByUser returns all rows (incl. disabled) newest-first from the DB', async () => {
+    await store.create({
+      sessionId: 'a',
+      userId: 'u1',
+      refreshExpiresAt: new Date(Date.now() + 1e6).toISOString(),
+    });
+    await new Promise((r) => setTimeout(r, 5));
+    await store.create({ sessionId: 'b', userId: 'u1' });
+    await store.disable('a');
+    const list = await store.listByUser('u1');
+    expect(list.map((s) => s.sessionId)).toEqual(['b', 'a']); // created_at desc
+    expect(list.find((s) => s.sessionId === 'a')?.disabled).toBe(true);
+  });
+
+  test('getLastSeenForUser tracks the most recent active session', async () => {
+    await store.create({ sessionId: 'a', userId: 'u1' });
+    await new Promise((r) => setTimeout(r, 5));
+    await store.touch('a', { accessExpiresAt: null });
+    const last = store.getLastSeenForUser('u1');
+    expect(last).toBe(store.get('a')?.lastSeenAt ?? null);
+    expect(store.getLastSeenForUser('nobody')).toBeNull();
+  });
+
+  test('rehydrate rebuilds the in-memory map with only currently-valid sessions', async () => {
+    await store.create({ sessionId: 'live', userId: 'u1' });
+    await store.create({
+      sessionId: 'expired',
+      userId: 'u1',
+      refreshExpiresAt: new Date(Date.now() - 1000).toISOString(),
+    });
+    await store.create({ sessionId: 'dead', userId: 'u1' });
+    await store.disable('dead');
+
+    // A fresh store over the SAME db simulates a restart.
+    const fresh = createSessionStore(ky);
+    await fresh.rehydrate();
+    expect(fresh.get('live')).toBeDefined();
+    expect(fresh.get('expired')).toBeUndefined();
+    expect(fresh.get('dead')).toBeUndefined();
+    fresh.stop();
+  });
+
+  test('prune drops rows past the retention window', async () => {
+    const shortStore = createSessionStore(ky, { retentionMs: 10 });
+    await shortStore.create({ sessionId: 's1', userId: 'u1' });
+    await new Promise((r) => setTimeout(r, 30));
+    const removed = await shortStore.prune();
+    expect(removed).toBe(1);
+    expect(shortStore.get('s1')).toBeUndefined();
+    expect(rowCount()).toBe(0);
+    shortStore.stop();
+  });
+});