cursedbelt-server 3.0.1 → 4.0.0

package/src/server/master-lock/accountsPage.spec.ts

@@ -0,0 +1,231 @@
+/**
+ * 🔴 The accounts page, and the one bug it exists to make impossible.
+ *
+ * `cursedbelt@2.5.1`'s React dialog minted a FRESH `kdf` salt on every rotation. Every
+ * account on an app derives under one shared descriptor, so honouring that salt stores a
+ * verifier hash nothing can match — the owner sets a new password, the rotation logs him
+ * out, and neither the old nor the new one opens the app. The server refuses that shape with
+ * `409 stale-client`; this page is what replaces the client that sent it.
+ *
+ * So the load-bearing assertion here is a NEGATIVE one: the rotation script this server
+ * serves must never put a `kdf` on the wire, and must never be able to mint one. A comment
+ * saying so would not have caught the dialog that did, which is why it is a test.
+ */
+import { beforeAll, describe, expect, test } from "bun:test";
+import {
+	MASTER_LOCK_PATHS,
+	type MasterLockKdfParams,
+	deriveMasterLockVerifier,
+} from "cursedbelt-core/master-lock";
+import {
+	MASTER_LOCK_ACCOUNTS_PAGE_PATHS,
+	MASTER_LOCK_ACCOUNTS_SCRIPT,
+	MASTER_LOCK_ACCOUNTS_STYLE,
+	accountsPageHtml,
+} from "./accountsPage";
+import { createMasterLockGuard } from "./guard";
+import { MasterLock } from "./masterLock";
+import { createMemoryMasterLockStore } from "./store";
+
+const KDF: MasterLockKdfParams = {
+	v: 1,
+	alg: "PBKDF2-SHA256",
+	iter: 1,
+	salt: "AAECAwQFBgcICQoLDA0ODw",
+};
+let VERIFIER = "";
+let NEXT_VERIFIER = "";
+let SEED = "";
+
+beforeAll(async () => {
+	VERIFIER = await deriveMasterLockVerifier("open sesame", KDF);
+	NEXT_VERIFIER = await deriveMasterLockVerifier("the one I picked myself", KDF);
+	SEED = JSON.stringify({
+		kdf: KDF,
+		verifierHash: await Bun.password.hash(VERIFIER, { algorithm: "argon2id" }),
+	});
+});
+
+function build() {
+	const lock = new MasterLock({ store: createMemoryMasterLockStore(), seedJson: SEED });
+	return { lock, guard: createMasterLockGuard({ lock, appLabel: "Test App" }) };
+}
+
+const doc = (path: string, cookie?: string): Request =>
+	new Request(`http://app.test${path}`, {
+		headers: { "sec-fetch-dest": "document", ...(cookie ? { cookie } : {}) },
+	});
+const xhr = (path: string, cookie?: string): Request =>
+	new Request(`http://app.test${path}`, {
+		headers: { "sec-fetch-dest": "empty", ...(cookie ? { cookie } : {}) },
+	});
+const send = (method: string, path: string, body: unknown, cookie?: string): Request =>
+	new Request(`http://app.test${path}`, {
+		method,
+		headers: { "content-type": "application/json", ...(cookie ? { cookie } : {}) },
+		body: JSON.stringify(body),
+	});
+
+/** Unlock and return the cookie pair the browser would send back. */
+async function open(guard: ReturnType<typeof build>["guard"]): Promise<string> {
+	const res = await guard.handle(send("POST", MASTER_LOCK_PATHS.unlock, { verifier: VERIFIER }));
+	expect(res?.status).toBe(200);
+	return (res?.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
+}
+
+describe("🔴 the rotation this page performs cannot be the one that locked the owner out", () => {
+	test("the served script never sends a kdf, and cannot mint one", () => {
+		// Two independent readings of the same property, because either alone is beatable:
+		// a script that never writes the word could still forward one it was handed, and a
+		// script with no randomness could still echo the server's.
+		expect(MASTER_LOCK_ACCOUNTS_SCRIPT).not.toContain("kdf:");
+		expect(MASTER_LOCK_ACCOUNTS_SCRIPT).not.toContain("getRandomValues");
+		expect(MASTER_LOCK_ACCOUNTS_SCRIPT).not.toContain("newKdf");
+		// It DOES read the app's params — that is how it derives under the shared descriptor.
+		expect(MASTER_LOCK_ACCOUNTS_SCRIPT).toContain("kdf = body.kdf");
+	});
+
+	test("a rotation posted the way this page posts it is ACCEPTED end to end", async () => {
+		const { guard, lock } = build();
+		const cookie = await open(guard);
+		const res = await guard.handle(
+			send(
+				"POST",
+				MASTER_LOCK_PATHS.change,
+				{ currentVerifier: VERIFIER, verifier: NEXT_VERIFIER },
+				cookie,
+			),
+		);
+		expect(res?.status).toBe(200);
+		// The new password opens the SAME tenant, which is the owner's whole requirement.
+		const reopened = await lock.unlock(NEXT_VERIFIER);
+		expect(reopened.ok && reopened.accountId).toBe("acct-1");
+	});
+
+	test("and the shape it replaced is still refused, distinguishably", async () => {
+		// The 409 stays. This page is why nothing sends that shape any more — not a reason to
+		// start honouring it, which would be the lockout itself.
+		const { guard } = build();
+		const cookie = await open(guard);
+		const res = await guard.handle(
+			send(
+				"POST",
+				MASTER_LOCK_PATHS.change,
+				{
+					kdf: { v: 1, alg: "PBKDF2-SHA256", iter: 600_000, salt: "ZZZZZZZZZZZZZZZZZZZZZZ" },
+					currentVerifier: VERIFIER,
+					verifier: NEXT_VERIFIER,
+				},
+				cookie,
+			),
+		);
+		expect(res?.status).toBe(409);
+		expect(await res?.json()).toEqual({ error: "stale-client" });
+	});
+});
+
+describe("who the page is served to", () => {
+	test("🔴 a document request while LOCKED gets the lock page, never the accounts page", async () => {
+		// It names every tenant, so it is behind the wall like the JSON is. Answering with the
+		// lock page rather than a 401 is what makes unlocking land back here.
+		const { guard } = build();
+		const res = await guard.handle(doc(MASTER_LOCK_PATHS.accounts));
+		expect(res?.status).toBe(200);
+		const html = (await res?.text()) ?? "";
+		expect(html).toContain("<title>Locked · Test App</title>");
+		expect(html).not.toContain("Master passwords");
+	});
+
+	test("the JSON half while locked is still the one uniform 401", async () => {
+		const { guard } = build();
+		const res = await guard.handle(xhr(MASTER_LOCK_PATHS.accounts));
+		expect(res?.status).toBe(401);
+		expect(await res?.json()).toEqual({ error: "locked", retryAfterMs: 0 });
+	});
+
+	test("one route, two representations — the page for a browser, the list for its fetch", async () => {
+		const { guard } = build();
+		const cookie = await open(guard);
+
+		const page = await guard.handle(doc(MASTER_LOCK_PATHS.accounts, cookie));
+		expect(page?.headers.get("content-type")).toContain("text/html");
+		expect(await page?.text()).toContain("<title>Master passwords · Test App</title>");
+
+		const json = await guard.handle(xhr(MASTER_LOCK_PATHS.accounts, cookie));
+		expect(json?.headers.get("content-type")).toContain("application/json");
+		expect(await json?.json()).toEqual({
+			accounts: [{ id: "acct-1", label: "Account 1", hint: "", createdAt: 0, current: true }],
+		});
+	});
+
+	test("🔴 the page itself carries no account data — the shell is the same for everyone", async () => {
+		// Whoever is looking has already unlocked, but the page is cached by nothing and
+		// rendered from nothing: a label or a hint baked into the HTML would be a second copy
+		// of the one fact the JSON route is the gate for.
+		const { guard, lock } = build();
+		const cookie = await open(guard);
+		const req = new Request(`http://app.test${MASTER_LOCK_PATHS.accounts}`, {
+			headers: { cookie, "sec-fetch-dest": "document" },
+		});
+		expect(
+			await lock.addAccount(req, {
+				currentVerifier: VERIFIER,
+				verifier: NEXT_VERIFIER,
+				label: "A second tenant",
+				hint: "a hint nobody else may read",
+			}),
+		).toMatchObject({ ok: true });
+
+		const html = (await (await guard.handle(doc(MASTER_LOCK_PATHS.accounts, cookie)))?.text()) ?? "";
+		expect(html).not.toContain("A second tenant");
+		expect(html).not.toContain("a hint nobody else may read");
+		expect(html).not.toContain("acct-");
+	});
+});
+
+describe("the page's own shape", () => {
+	test("no inline script, nothing loaded off-origin, and the app label escaped", () => {
+		const html = accountsPageHtml({ appLabel: '<img src=x onerror="alert(1)">' });
+		expect(html).not.toContain("<img");
+		expect(html).toContain("&lt;img");
+		// The guard serves it under the same CSP as the lock page — `script-src 'self'` with
+		// no nonce plumbing — so an inline <script> would be a blank page in production and a
+		// green test here.
+		expect(html).not.toMatch(/<script(?![^>]*\bsrc=)/);
+		for (const [, value] of html.matchAll(/\b(?:src|href)="([^"]*)"/g)) {
+			expect(value.startsWith("/") || value.startsWith("data:")).toBe(true);
+		}
+	});
+
+	test("it links the LOCK's stylesheet as well as its own, so the palette cannot split", () => {
+		const html = accountsPageHtml({ appLabel: "Collections" });
+		expect(html).toContain(`href="${MASTER_LOCK_PATHS.style}"`);
+		expect(html).toContain(`href="${MASTER_LOCK_ACCOUNTS_PAGE_PATHS.style}"`);
+		// Which is only true while this sheet defines no tokens of its own.
+		expect(MASTER_LOCK_ACCOUNTS_STYLE).not.toContain(":root");
+		expect(MASTER_LOCK_ACCOUNTS_STYLE).not.toContain("url(");
+	});
+
+	test("its two assets are served, and reachable without an unlock like the lock's are", async () => {
+		// They carry no tenant data — every app that mounts this guard serves the same bytes —
+		// and gating them would mean the page going blank the moment the idle clock lapsed
+		// between the document and its stylesheet.
+		const { guard } = build();
+		const style = await guard.handle(new Request(`http://app.test${MASTER_LOCK_ACCOUNTS_PAGE_PATHS.style}`));
+		expect(style?.status).toBe(200);
+		expect(style?.headers.get("content-type")).toContain("text/css");
+
+		const script = await guard.handle(new Request(`http://app.test${MASTER_LOCK_ACCOUNTS_PAGE_PATHS.script}`));
+		expect(script?.status).toBe(200);
+		expect(script?.headers.get("content-type")).toContain("text/javascript");
+		expect(await script?.text()).toBe(MASTER_LOCK_ACCOUNTS_SCRIPT);
+	});
+
+	test("every path the script talks to is one the guard actually answers", () => {
+		// The script names them off `MASTER_LOCK_PATHS`, interpolated at build time, so this
+		// pins the three it uses against the wire rather than against a hand-typed string.
+		for (const path of [MASTER_LOCK_PATHS.status, MASTER_LOCK_PATHS.accounts, MASTER_LOCK_PATHS.change]) {
+			expect(MASTER_LOCK_ACCOUNTS_SCRIPT).toContain(JSON.stringify(path));
+		}
+	});
+});