okengine 0.18.4 → 0.19.0

package/src/plugins/passkey.ts

@@ -2,8 +2,9 @@
  * Passkey (WebAuthn) Gate auth method plugin.
  *
  * Registration and authentication verify clientDataJSON origin + challenge,
- * authenticatorData rpId hash, and ECDSA P-256 signature against the stored
- * SPKI public key. Presence-only authenticate is rejected.
+ * authenticatorData rpId hash + UV, and ECDSA P-256 signature against the
+ * stored SPKI public key. Challenges are bound to a ceremony sessionId (≤5m).
+ * UV=false and cloned-authenticator counters are rejected.
  */
 
 import { constantTimeEqual } from "../auth/constant-time.ts";
@@ -30,6 +31,7 @@ import {
   type AuthMethodOptions,
 } from "./auth/shared.ts";
 import { verifyWebAuthnCeremony } from "./passkey-webauthn.ts";
+import { okid } from "../okid.ts";
 
 /** Stored passkey credential. */
 export interface PasskeyCredential {
@@ -72,11 +74,40 @@ const CeremonyIn = z.object({
   publicKey: z.string().min(1).optional(),
   userId: z.string().min(1).optional(),
   challenge: z.string().min(1),
+  /** Opaque ceremony session id from options (challenge binding). */
+  sessionId: z.string().min(1),
   clientDataJSON: z.string().min(1),
   authenticatorData: z.string().min(1),
   signature: z.string().min(1),
 });
 
+/**
+ * Map WebAuthn verify failure reasons onto AuthFailed reasons.
+ *
+ * @param reason - Verifier reason
+ */
+function authFailedReason(reason: string): string {
+  if (reason === "invalid_origin") return "invalid_origin";
+  if (reason === "user_not_verified") return "user_not_verified";
+  if (reason === "cloned_authenticator") return "reregister_required";
+  return "invalid_credentials";
+}
+
+/**
+ * Remove a credential from both indexes (clone / revoke).
+ *
+ * @param store - Passkey store
+ * @param cred - Credential to drop
+ */
+function removeCredential(store: PasskeyStore, cred: PasskeyCredential): void {
+  store.byCredentialId.delete(cred.credentialId);
+  const list = store.byUserId.get(cred.userId);
+  if (!list) return;
+  const next = list.filter((c) => c.credentialId !== cred.credentialId);
+  if (next.length === 0) store.byUserId.delete(cred.userId);
+  else store.byUserId.set(cred.userId, next);
+}
+
 /**
  * Passkey register / authenticate with cryptographic WebAuthn verify (`oke_passkeys`).
  *
@@ -90,40 +121,49 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
   const rpId = opts.rpId ?? "localhost";
   const origins = opts.origins ?? ["http://localhost", "https://localhost"];
 
-  const registerOptions = flow("auth.passkeyRegisterOptions", {
-    plane: "user",
+  const registerOptionsContract = {
     out: z.object({
       challenge: z.string(),
+      sessionId: z.string(),
       rpId: z.string(),
       userId: z.string(),
     }),
     errors: { AuthFailed },
+  };
+
+  const registerOptions = flow("auth.passkeyRegisterOptions", {
+    plane: "user",
     do: async (_input, fx) => {
       const userId = fx.auth.userId;
       if (!userId) return fail("AuthFailed", { reason: "unauthenticated" });
-      const challenge = crypto.randomUUID().replace(/-/g, "");
+      const challenge = okid();
+      const sessionId = okid();
       const now = runtime.now();
       putVerification(challenges, {
-        id: crypto.randomUUID(),
+        id: okid(),
         identifier: `passkey-reg:${userId}`,
         value: await hashChallenge(challenge),
         expiresAt: now + 5 * 60 * 1000,
         createdAt: now,
         consumedAt: null,
         attempts: 0,
+        sessionId,
       });
-      return { challenge, rpId, userId };
+      return { challenge, sessionId, rpId, userId };
     },
   });
 
-  const register = flow("auth.passkeyRegister", {
-    plane: "user",
+  const registerContract = {
     in: CeremonyIn.extend({
       publicKey: z.string().min(1),
       userId: z.string().min(1),
     }),
     out: z.object({ ok: z.literal(true) }),
     errors: { AuthFailed },
+  };
+
+  const register = flow("auth.passkeyRegister", {
+    plane: "user",
     do: async (input, fx) => {
       const sessionUser = fx.auth.userId;
       if (!sessionUser || sessionUser !== input.userId) {
@@ -133,6 +173,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
         challenges,
         `passkey-reg:${input.userId}`,
         input.challenge,
+        input.sessionId,
         runtime.now(),
       );
       if (!consumed) return fail("AuthFailed", { reason: "invalid_credentials" });
@@ -148,9 +189,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
         signature: input.signature,
       });
       if (!verified.ok) {
-        return fail("AuthFailed", {
-          reason: verified.reason === "invalid_origin" ? "invalid_origin" : "invalid_credentials",
-        });
+        return fail("AuthFailed", { reason: authFailedReason(verified.reason) });
       }
       if (passkeys.byCredentialId.has(input.credentialId)) {
         return fail("AuthFailed", { reason: "invalid_credentials" });
@@ -186,34 +225,39 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
     },
   });
 
-  const authenticateOptions = flow("auth.passkeyAuthenticateOptions", {
-    plane: "user",
+  const authenticateOptionsContract = {
     in: z.object({ email: z.string().optional() }),
     out: z.object({
       challenge: z.string(),
+      sessionId: z.string(),
       rpId: z.string(),
       allowCredentials: z.array(z.string()),
     }),
     errors: { AuthFailed, AuthRateLimited },
+  };
+
+  const authenticateOptions = flow("auth.passkeyAuthenticateOptions", {
+    plane: "user",
     do: async (input) => {
-      const challenge = crypto.randomUUID().replace(/-/g, "");
+      const challenge = okid();
+      const sessionId = okid();
       const now = runtime.now();
       const key = input.email?.trim().toLowerCase() || "anonymous";
       putVerification(challenges, {
-        id: crypto.randomUUID(),
+        id: okid(),
         identifier: `passkey-auth:${key}`,
         value: await hashChallenge(challenge),
         expiresAt: now + 5 * 60 * 1000,
         createdAt: now,
         consumedAt: null,
         attempts: 0,
+        sessionId,
       });
-      return { challenge, rpId, allowCredentials: [] as string[] };
+      return { challenge, sessionId, rpId, allowCredentials: [] as string[] };
     },
   });
 
-  const authenticate = flow("auth.passkeyAuthenticate", {
-    plane: "user",
+  const authenticateContract = {
     in: CeremonyIn.extend({
       challenge: z.string().min(1),
       /** Challenge bucket key from authenticate options (default `anonymous`). */
@@ -221,6 +265,10 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
     }),
     out: SessionTokensOut,
     errors: { AuthFailed, AuthRateLimited },
+  };
+
+  const authenticate = flow("auth.passkeyAuthenticate", {
+    plane: "user",
     do: async (input) => {
       const cred = passkeys.byCredentialId.get(input.credentialId);
       if (!cred) return fail("AuthFailed", { reason: "invalid_credentials" });
@@ -230,6 +278,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
         challenges,
         `passkey-auth:${bucket}`,
         input.challenge,
+        input.sessionId,
         runtime.now(),
       );
       if (!consumed) return fail("AuthFailed", { reason: "invalid_credentials" });
@@ -246,9 +295,14 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
         previousSignCount: cred.counter,
       });
       if (!verified.ok) {
-        return fail("AuthFailed", {
-          reason: verified.reason === "invalid_origin" ? "invalid_origin" : "invalid_credentials",
-        });
+        if (verified.reason === "cloned_authenticator") {
+          console.warn(
+            `[passkey] possible cloned authenticator: credentialId=${cred.credentialId} userId=${cred.userId}`,
+          );
+          removeCredential(passkeys, cred);
+          return fail("AuthFailed", { reason: "reregister_required" });
+        }
+        return fail("AuthFailed", { reason: authFailedReason(verified.reason) });
       }
       cred.counter = verified.signCount;
 
@@ -269,22 +323,40 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
   return plugin("passkey", { version: "0.0.1", config: { method: "passkey" } })
     .needs("auth")
     .table("oke_passkeys", undefined, { plane: "user", description: "WebAuthn credentials" })
-    .binding(bindSessionAuth("/passkey/register/options", registerOptions))
-    .binding(bindSessionAuth("/passkey/register", register))
-    .binding(bindPublicAuth("/passkey/authenticate/options", authenticateOptions, "otp"))
-    .binding(bindPublicAuth("/passkey/authenticate", authenticate, "otp"));
+    .binding(bindSessionAuth("/passkey/register/options", registerOptions, registerOptionsContract))
+    .binding(bindSessionAuth("/passkey/register", register, registerContract))
+    .binding(
+      bindPublicAuth(
+        "/passkey/authenticate/options",
+        authenticateOptions,
+        "otp",
+        authenticateOptionsContract,
+      ),
+    )
+    .binding(bindPublicAuth("/passkey/authenticate", authenticate, "otp", authenticateContract));
 }
 
+/**
+ * Consume a single-use challenge bound to a ceremony sessionId.
+ *
+ * @param store - Challenge store
+ * @param identifier - Bucket key
+ * @param challenge - Raw challenge
+ * @param sessionId - Ceremony session from options
+ * @param now - Clock
+ */
 async function consumeChallenge(
   store: VerificationStore,
   identifier: string,
   challenge: string,
+  sessionId: string,
   now: number,
 ): Promise<boolean> {
   const hash = await hashChallenge(challenge);
   for (const row of store.rows.values()) {
     if (row.identifier !== identifier) continue;
     if (row.consumedAt !== null || row.expiresAt <= now) continue;
+    if (row.sessionId !== sessionId) continue;
     if (!constantTimeEqual(row.value, hash)) continue;
     row.consumedAt = now;
     return true;

package/src/plugins/pre-account-hijack.test.ts

@@ -0,0 +1,223 @@
+/**
+ * CVE-2026-67327 — pre-account hijacking defense.
+ *
+ * Attacker parks an unverified email+password account; victim proves email via
+ * magic-link or OTP; planted password must be invalidated and attacker sessions
+ * revoked.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import {
+  completeVerifiedEmailSignIn,
+  createIdentityStore,
+  createUserWithPassword,
+  type IdentityStore,
+} from "../auth/identity.ts";
+import { createSessionStore, issueSession } from "../auth/sessions.ts";
+import { oke } from "../kernel/app.ts";
+import { resetFlowSeq } from "../kernel/flow.ts";
+import { resetBindings } from "../kernel/on.ts";
+import { magicLink } from "./magic-link.ts";
+import { otp } from "./otp.ts";
+
+afterEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+const SECRET = "test-secret-at-least-16";
+const PLANTED_PASSWORD = "AttackerPlanted1!";
+
+function jsonPost(path: string, body: unknown): Request {
+  return new Request(`http://localhost${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+function emailAuthApp(plug: "magic-link" | "otp") {
+  const app = oke({
+    name: `pre-account-${crypto.randomUUID()}`,
+    env: "test",
+    registry: "ignore",
+    gate: {
+      auth: {
+        secret: SECRET,
+        emailAndPassword: { enabled: true },
+      },
+    },
+  });
+  if (plug === "magic-link") return app.plug(magicLink({ exposeDevToken: true }));
+  return app.plug(otp({ mode: "app", channels: ["email"], exposeDevOtp: true }));
+}
+
+describe("completeVerifiedEmailSignIn — pre-account reclaim", () => {
+  test("reclaims unverified password account: clears hash, revokes sessions, marks verified", async () => {
+    const identities = createIdentityStore();
+    const sessions = createSessionStore();
+    const now = () => 5_000_000;
+
+    const planted = await createUserWithPassword(identities, {
+      email: "hijack@example.com",
+      password: PLANTED_PASSWORD,
+      now,
+    });
+    expect(planted.emailVerified).toBe(false);
+
+    const attackerSession = await issueSession(
+      sessions,
+      { secret: SECRET, now },
+      { id: planted.id, plane: "user", scopes: [] },
+    );
+    expect(attackerSession.session.revokedAt).toBeNull();
+
+    const result = await completeVerifiedEmailSignIn(identities, sessions, {
+      provider: "magic-link",
+      providerAccountId: "hijack@example.com",
+      email: "hijack@example.com",
+      now,
+    });
+
+    expect(result.user.id).toBe(planted.id);
+    expect(result.user.emailVerified).toBe(true);
+    expect(result.credentialsCompromised).toBe(true);
+    expect(result.created).toBe(true);
+
+    const credential = [...identities.accounts.values()].find(
+      (a) => a.provider === "credential" && a.userId === planted.id,
+    );
+    expect(credential?.passwordHash).toBeNull();
+    expect(attackerSession.session.revokedAt).toBe(5_000_000);
+  });
+
+  test("verified owner re-auth attaches passwordless without purging password", async () => {
+    const identities = createIdentityStore();
+    const sessions = createSessionStore();
+    const now = () => 6_000_000;
+
+    const owner = await createUserWithPassword(identities, {
+      email: "owner@example.com",
+      password: "LegitimatePass1!",
+      emailVerified: true,
+      now,
+    });
+    const beforeHash = [...identities.accounts.values()].find(
+      (a) => a.provider === "credential",
+    )?.passwordHash;
+    expect(beforeHash).toBeTruthy();
+
+    const result = await completeVerifiedEmailSignIn(identities, sessions, {
+      provider: "otp",
+      providerAccountId: "owner@example.com",
+      email: "owner@example.com",
+      now,
+    });
+
+    expect(result.user.id).toBe(owner.id);
+    expect(result.credentialsCompromised).toBe(false);
+    const afterHash = [...identities.accounts.values()].find(
+      (a) => a.provider === "credential",
+    )?.passwordHash;
+    expect(afterHash).toBe(beforeHash);
+  });
+});
+
+describe("CVE-2026-67327 — HTTP pre-account hijack", () => {
+  test("magic-link reclaim invalidates planted password", async () => {
+    const app = emailAuthApp("magic-link");
+    await app.boot({ env: "test" });
+    const identities = app.identities as IdentityStore;
+
+    const signUp = await app.fetch(
+      jsonPost("/auth/sign-up/email", {
+        email: "hijack@example.com",
+        password: PLANTED_PASSWORD,
+      }),
+    );
+    expect(signUp.status).toBe(200);
+    const planted = (await signUp.json()) as { data: { userId: string; refreshToken: string } };
+    expect(identities.users.get(planted.data.userId)?.emailVerified).toBe(false);
+
+    const req = await app.fetch(
+      jsonPost("/auth/magic-link/request", { email: "hijack@example.com" }),
+    );
+    expect(req.status).toBe(200);
+    const { data: challenge } = (await req.json()) as { data: { devToken: string } };
+
+    const verify = await app.fetch(
+      jsonPost("/auth/magic-link/verify", { token: challenge.devToken }),
+    );
+    expect(verify.status).toBe(200);
+    const session = (await verify.json()) as { data: { userId: string; accessToken: string } };
+    expect(session.data.userId).toBe(planted.data.userId);
+    expect(identities.users.get(planted.data.userId)?.emailVerified).toBe(true);
+
+    const credential = [...identities.accounts.values()].find(
+      (a) => a.provider === "credential" && a.userId === planted.data.userId,
+    );
+    expect(credential?.passwordHash).toBeNull();
+
+    const signIn = await app.fetch(
+      jsonPost("/auth/sign-in/email", {
+        email: "hijack@example.com",
+        password: PLANTED_PASSWORD,
+      }),
+    );
+    const err = (await signIn.json()) as { error: { data?: { reason?: string } } };
+    expect(err.error.data?.reason).toBe("invalid_credentials");
+
+    const refresh = await app.fetch(
+      jsonPost("/auth/refresh", { refreshToken: planted.data.refreshToken }),
+    );
+    expect(refresh.status).not.toBe(200);
+
+    await app.stop();
+  });
+
+  test("email OTP reclaim invalidates planted password", async () => {
+    const app = emailAuthApp("otp");
+    await app.boot({ env: "test" });
+    const identities = app.identities as IdentityStore;
+
+    const signUp = await app.fetch(
+      jsonPost("/auth/sign-up/email", {
+        email: "otp-hijack@example.com",
+        password: PLANTED_PASSWORD,
+      }),
+    );
+    expect(signUp.status).toBe(200);
+    const planted = (await signUp.json()) as { data: { userId: string } };
+
+    const req = await app.fetch(jsonPost("/auth/otp/request", { email: "otp-hijack@example.com" }));
+    expect(req.status).toBe(200);
+    const { data: challenge } = (await req.json()) as { data: { devOtp: string } };
+
+    const verify = await app.fetch(
+      jsonPost("/auth/otp/verify", {
+        email: "otp-hijack@example.com",
+        otp: challenge.devOtp,
+      }),
+    );
+    expect(verify.status).toBe(200);
+    const session = (await verify.json()) as { data: { userId: string } };
+    expect(session.data.userId).toBe(planted.data.userId);
+    expect(identities.users.get(planted.data.userId)?.emailVerified).toBe(true);
+
+    const credential = [...identities.accounts.values()].find(
+      (a) => a.provider === "credential" && a.userId === planted.data.userId,
+    );
+    expect(credential?.passwordHash).toBeNull();
+
+    const signIn = await app.fetch(
+      jsonPost("/auth/sign-in/email", {
+        email: "otp-hijack@example.com",
+        password: PLANTED_PASSWORD,
+      }),
+    );
+    const err = (await signIn.json()) as { error: { data?: { reason?: string } } };
+    expect(err.error.data?.reason).toBe("invalid_credentials");
+
+    await app.stop();
+  });
+});