cursedbelt-server 4.4.0 → 4.6.0

package/src/server/master-lock/beaconNeverReachesTheWall.spec.ts

@@ -0,0 +1,227 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import {
+	MASTER_LOCK_PATHS,
+	type MasterLockKdfParams,
+	deriveMasterLockVerifier,
+} from "cursedbelt-core/master-lock";
+import {
+	WEB_ANALYTICS_BEACON_ORIGIN,
+	WEB_ANALYTICS_BEACON_SRC,
+	WEB_ANALYTICS_SITE_TOKEN,
+	WEB_ANALYTICS_TAG,
+	foreignScriptSources,
+	htmlCarriesWebAnalytics,
+	scriptsRefusedByCsp,
+} from "../analytics";
+import { MASTER_LOCK_CSP, createMasterLockGuard } from "./guard";
+import { MasterLock } from "./masterLock";
+import { createMemoryMasterLockStore } from "./store";
+
+/**
+ * 🔴 **The wall never carries the beacon, and the public shells always do.** Both halves, in
+ * one file, because half of this decision is an ABSENCE and an absence is what nobody notices
+ * has stopped being true.
+ *
+ * ## The decision this proves
+ *
+ * Cloudflare Web Analytics was on `cursedalchemy.com` with **Automatic Setup**: the edge
+ * appended its beacon to every HTML response on the zone, including the master-lock wall —
+ * the one page whose entire job is to take a master password with nothing else on it. The
+ * wall's {@link MASTER_LOCK_CSP} refused the tag, correctly, and the refusal printed in the
+ * console. The owner read that console during an outage on 2026-09-17 and it was the first
+ * line he saw.
+ *
+ * Three ways out were put to him. He took none of them as written (2026-09-18):
+ *
+ * > *"do your recommendation with option c but not on the wall. If we can stop the console
+ * > error that would be good since we are purposely blocking on that page and it makes it look
+ * > like there is a mistake when it shows."*
+ *
+ * and, on why the CSP does not simply gain the host:
+ *
+ * > *"I don't want to trust cloudflare with master password data that is typed in."*
+ *
+ * So: manual install, the snippet in the public shells, nothing on the wall — and no console
+ * error, because under manual setup nothing is injected into the wall to be refused.
+ *
+ * ## Why the check lives HERE
+ *
+ * The wall is served by this package to every app that mounts the guard, and the CSP is one
+ * shared constant. An app-local check can only ever see one app's shell, and the deployed
+ * smoke that `apps/collections` gained on 2026-09-18 cannot see the wall at all — it runs with
+ * no credentials and the wall is behind SSO. The seam that covers every app is this one, next
+ * to the policy itself.
+ *
+ * ## What would turn this red
+ *
+ *  · somebody adds `static.cloudflareinsights.com` to {@link MASTER_LOCK_CSP} — the thing he
+ *    refused;
+ *  · somebody pastes the analytics tag into `lockPage.ts` or `accountsPage.ts`;
+ *  · the wall starts serving any cross-origin script its own policy would refuse, beacon or
+ *    not — the general invariant, which names no vendor.
+ */
+const KDF: MasterLockKdfParams = {
+	v: 1,
+	alg: "PBKDF2-SHA256",
+	iter: 1,
+	salt: "AAECAwQFBgcICQoLDA0ODw",
+};
+const PAGE = "https://collections.cursedalchemy.com/";
+
+let VERIFIER = "";
+let SEED = "";
+
+beforeAll(async () => {
+	VERIFIER = await deriveMasterLockVerifier("open sesame", KDF);
+	SEED = JSON.stringify({
+		kdf: KDF,
+		verifierHash: await Bun.password.hash(VERIFIER, { algorithm: "argon2id" }),
+	});
+});
+
+function build() {
+	const lock = new MasterLock({ store: createMemoryMasterLockStore(), seedJson: SEED });
+	return createMasterLockGuard({ lock, appLabel: "Test App" });
+}
+
+const doc = (path: string, cookie?: string): Request =>
+	new Request(`https://collections.cursedalchemy.com${path}`, {
+		headers: { "sec-fetch-dest": "document", ...(cookie ? { cookie } : {}) },
+	});
+
+/** Unlock, and hand back the cookie pair a browser would send with the next request. */
+async function open(guard: ReturnType<typeof build>): Promise<string> {
+	const res = await guard.handle(
+		new Request(`https://collections.cursedalchemy.com${MASTER_LOCK_PATHS.unlock}`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ verifier: VERIFIER }),
+		}),
+	);
+	expect(res?.status).toBe(200);
+	return (res?.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
+}
+
+/** Every HTML surface the wall can answer a browser with, as real responses. */
+async function wallPages(): Promise<{ label: string; html: string; csp: string | null }[]> {
+	const guard = build();
+	const locked = await guard.handle(doc("/some/deep/page"));
+	expect(locked?.status).toBe(200);
+	const cookie = await open(guard);
+	const accounts = await guard.handle(doc(MASTER_LOCK_PATHS.accounts, cookie));
+	expect(accounts?.status).toBe(200);
+	const pages = [
+		{ label: "lock page", res: locked as Response },
+		{ label: "accounts page", res: accounts as Response },
+	];
+	return Promise.all(
+		pages.map(async ({ label, res }) => ({
+			label,
+			html: await res.text(),
+			csp: res.headers.get("content-security-policy"),
+		})),
+	);
+}
+
+describe("the wall, as it is actually served", () => {
+	test("every HTML surface answers with the shared CSP", async () => {
+		for (const page of await wallPages()) {
+			expect(page.csp, `${page.label} must carry the wall's CSP`).toBe(MASTER_LOCK_CSP);
+		}
+	});
+
+	test("carries NO cross-origin script — beacon or otherwise", async () => {
+		for (const page of await wallPages()) {
+			expect(foreignScriptSources(page.html, PAGE), `${page.label} pulled in a foreign script`).toEqual(
+				[],
+			);
+		}
+	});
+
+	test("does not mention the analytics beacon anywhere in its markup", async () => {
+		for (const page of await wallPages()) {
+			expect(page.html).not.toContain(WEB_ANALYTICS_BEACON_SRC);
+			expect(page.html).not.toContain(WEB_ANALYTICS_SITE_TOKEN);
+			expect(htmlCarriesWebAnalytics(page.html)).toBe(false);
+		}
+	});
+
+	/** The general invariant: nothing that arrives may be refused by the policy on that response. */
+	test("nothing it serves is refused by its own CSP", async () => {
+		for (const page of await wallPages()) {
+			const refused = scriptsRefusedByCsp(page.csp, foreignScriptSources(page.html, PAGE), PAGE);
+			expect(refused.map((s) => s.origin), `${page.label} serves a script it then refuses`).toEqual(
+				[],
+			);
+		}
+	});
+});
+
+describe("the CSP keeps the beacon out by construction", () => {
+	test("MASTER_LOCK_CSP never names the beacon's host", () => {
+		expect(MASTER_LOCK_CSP).not.toContain("cloudflareinsights");
+		expect(MASTER_LOCK_CSP).toContain("script-src 'self'");
+	});
+
+	/**
+	 * 🔴 The coupling, and the reason this is one file rather than two assertions in two repos:
+	 * the wall's policy REFUSES the tag. So "the wall carries no beacon" cannot quietly become
+	 * "the wall carries a beacon that works" — reaching that state means somebody loosened the
+	 * policy, and the assertion above is what catches them.
+	 */
+	test("the tag, pasted into the wall, would be refused — and this names the origin", () => {
+		const refused = scriptsRefusedByCsp(
+			MASTER_LOCK_CSP,
+			foreignScriptSources(WEB_ANALYTICS_TAG, PAGE),
+			PAGE,
+		);
+		expect(refused.map((s) => s.origin)).toEqual([WEB_ANALYTICS_BEACON_ORIGIN]);
+	});
+
+	test("the failure path: allowing the host is what would make it load", () => {
+		const loosened = `${MASTER_LOCK_CSP}; script-src-elem 'self' ${WEB_ANALYTICS_BEACON_ORIGIN}`;
+		expect(scriptsRefusedByCsp(loosened, foreignScriptSources(WEB_ANALYTICS_TAG, PAGE), PAGE)).toEqual(
+			[],
+		);
+	});
+});
+
+describe("the other half — a public shell that carries it", () => {
+	/**
+	 * The shell an app ships: inline colour-scheme bootstrap, its own bundle, and the beacon.
+	 * An app asserts this about ITS OWN `index.html` (rule 3 — a repo's gate proves that repo);
+	 * what this package owes it is a helper pair that cannot disagree with the wall's.
+	 */
+	const SHELL = `<!doctype html><html><head>
+	<script>try { document.documentElement.classList.toggle("dark", true); } catch (e) {}</script>
+	${WEB_ANALYTICS_TAG}
+</head><body><div id="root"></div><script type="module" src="/src/main.tsx"></script></body></html>`;
+
+	test("the helper recognises the tag, and says no when it is missing", () => {
+		expect(htmlCarriesWebAnalytics(SHELL)).toBe(true);
+		expect(htmlCarriesWebAnalytics(SHELL.replace(WEB_ANALYTICS_TAG, ""))).toBe(false);
+	});
+
+	test("a shell carrying the RIGHT src but the site TAG as its token is not carrying it", () => {
+		// The trap `webAnalytics.ts` documents: tag and token are both 32 hex characters, the
+		// page still loads, and the data goes nowhere.
+		const wrong = SHELL.replace(WEB_ANALYTICS_SITE_TOKEN, "d1bea8562544421fbd2db5f11b74d1cc");
+		expect(htmlCarriesWebAnalytics(wrong)).toBe(false);
+	});
+
+	test("with no CSP the beacon is permitted — the public shells' actual state", () => {
+		expect(scriptsRefusedByCsp(null, foreignScriptSources(SHELL, PAGE), PAGE)).toEqual([]);
+	});
+
+	/**
+	 * 🔴 `apps/vault` is the exception, and it is an exception the general rule already gets
+	 * right without knowing the app's name: vault serves `script-src 'self'` on its PUBLIC
+	 * shell, so the beacon does not belong there either. Measured live on 2026-09-18 — vault's
+	 * shell was the one host on the zone the edge's injection never reached.
+	 */
+	test("a shell with a strict CSP must NOT carry it, and the check says why", () => {
+		const strict = "default-src 'self'; script-src 'self'; frame-ancestors 'none'";
+		const refused = scriptsRefusedByCsp(strict, foreignScriptSources(SHELL, PAGE), PAGE);
+		expect(refused.map((s) => s.origin)).toEqual([WEB_ANALYTICS_BEACON_ORIGIN]);
+	});
+});

package/src/server/master-lock/guard.ts

@@ -79,8 +79,16 @@ const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma
  * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
+ *
+ * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
+ * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
+ * without anything going red. It is also what
+ * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
+ * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
+ * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:
+ * *"I don't want to trust cloudflare with master password data that is typed in."*
  */
-const LOCK_CSP =
+export const MASTER_LOCK_CSP =
 	"default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
 	"img-src data:; form-action 'none'; base-uri 'none'; frame-ancestors 'none'";
 
@@ -357,7 +365,7 @@ function lockPage(options: LockPageOptions, lock: MasterLock): Response {
 		status: 200,
 		headers: {
 			"content-type": "text/html; charset=utf-8",
-			"content-security-policy": LOCK_CSP,
+			"content-security-policy": MASTER_LOCK_CSP,
 			"x-content-type-options": "nosniff",
 			[MASTER_LOCK_STATE_HEADER]: "locked",
 			...noStore,
@@ -377,7 +385,7 @@ function accountsPage(options: LockPageOptions): Response {
 		status: 200,
 		headers: {
 			"content-type": "text/html; charset=utf-8",
-			"content-security-policy": LOCK_CSP,
+			"content-security-policy": MASTER_LOCK_CSP,
 			"x-content-type-options": "nosniff",
 			...noStore,
 		},

package/src/server/master-lock/index.ts

@@ -27,7 +27,12 @@ export {
 	MASTER_LOCK_MIN_PASSWORD_LENGTH,
 	accountsPageHtml,
 } from "./accountsPage";
-export { type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard } from "./guard";
+export {
+	MASTER_LOCK_CSP,
+	type MasterLockGuard,
+	type MasterLockGuardOptions,
+	createMasterLockGuard,
+} from "./guard";
 export {
 	LOCK_SCRIPT,
 	LOCK_STYLE,