spec-3nweb-server 1.8.4 → 1.8.6

package/build/tests/protocols/mailerid.js

@@ -0,0 +1,210 @@
+"use strict";
+/*
+ Copyright (C) 2016, 2025 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+const async_jasmine_1 = require("../libs-for-tests/async-jasmine");
+const mailerid_1 = require("../libs-for-tests/server-components/mailerid");
+const mailerid_2 = require("../libs-for-tests/mailerid");
+const xhr_utils_1 = require("../libs-for-tests/xhr-utils");
+const provisioning_1 = require("../../lib-common/service-api/mailer-id/provisioning");
+const pklApi = require("../../lib-common/service-api/pub-key-login");
+const jwkeys_1 = require("../../lib-common/jwkeys");
+const requests_1 = require("../shared-checks/requests");
+const buffer_utils_1 = require("../../lib-common/buffer-utils");
+const ecma_nacl_1 = require("ecma-nacl");
+const pkl_1 = require("../libs-for-tests/pkl");
+const mid_sigs_NaCl_Ed_1 = require("../../lib-common/mid-sigs-NaCl-Ed");
+const random_node_1 = require("../../lib-common/random-node");
+const canonical_address_1 = require("../../lib-common/canonical-address");
+const json_equal_1 = require("../libs-for-tests/json-equal");
+const bytes_equal_1 = require("../libs-for-tests/bytes-equal");
+describe('MailerId', () => {
+    let midServer;
+    const midServiceDomain = 'mailerid.service.domain';
+    const signupDomains = ['company.inc', 'personal.net'];
+    let user1;
+    let user2;
+    (0, async_jasmine_1.beforeAllAsync)(async () => {
+        midServer = new mailerid_1.MailerIdComponent(signupDomains, midServiceDomain);
+        await midServer.start();
+        user1 = await midServer.addUser(`Bob Johnson @${signupDomains[0]}`);
+        user2 = await midServer.addUser(`William Young @${signupDomains[1]}`);
+    });
+    (0, async_jasmine_1.afterAllAsync)(async () => {
+        await midServer.stop();
+        midServer = undefined;
+    });
+    (0, async_jasmine_1.itAsync)('provides root certificates', async () => {
+        let reqOpts = {
+            url: midServer.midUrl,
+            method: 'GET',
+            responseType: 'json'
+        };
+        let rep = await (0, xhr_utils_1.doBodylessRequest)(reqOpts);
+        expect(rep.status).withContext('status code for OK reply').toBe(200);
+        expect(Array.isArray(rep.data["previous-certs"])).toBe(true);
+        expect((0, jwkeys_1.isLikeSignedKeyCert)(rep.data["current-cert"])).toBe(true);
+        expect(typeof rep.data["provisioning"]).toBe('string');
+    });
+    describe('provisioning stage', () => {
+        let provUrl;
+        (0, async_jasmine_1.beforeAllAsync)(async () => {
+            provUrl = await midServer.getProvUrl();
+        });
+        // TODO refactor Public Key Login into shared-checks spec, similarly to
+        //		MailerId login, so as to reuse it where PKL is used.
+        async function testFirstReqFor(useDefaultKey) {
+            let reqOpts = {
+                url: provUrl + pklApi.start.URL_END,
+                method: 'POST',
+                responseType: 'json'
+            };
+            // request with known user id
+            let req = (useDefaultKey ?
+                { userId: user1.id } :
+                { userId: user1.id, kid: user1.loginLabeledSKey.kid });
+            let rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status code for OK reply').toBe(pklApi.start.SC.ok);
+            expect(typeof rep.data).toBe('object');
+            expect(typeof rep.data.sessionId).toBe('string');
+            expect(() => {
+                // note that this user uses NaCl's box (Curve25519)
+                (0, pkl_1.decryptSessionParamsForCurve25519)(rep.data, user1.loginDefaultSKey);
+            }).not.toThrow();
+            // duplicating request, with session id now in a header
+            reqOpts.sessionId = rep.data.sessionId;
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('reaction to duplicate request').toBe(pklApi.ERR_SC.duplicate);
+            delete reqOpts.sessionId;
+            // when user id is unknown
+            req = { userId: 'unknown user @some.domain' };
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status code for an unknown user id').toBe(pklApi.start.SC.unknownUser);
+            req = { userId: 'unknown user @' + signupDomains[0] };
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status code for an unknown user id').toBe(pklApi.start.SC.unknownUser);
+            // requests with bad user ids and with bad json's
+            let badIds = ['', ' ', '\t', '\n',
+                5, null, undefined, {}]; // non-strings
+            let badJSONs = ['bar', 5, null, undefined, ['blah'],
+                { a: 1 }];
+            for (let id of badIds) {
+                req = { userId: id };
+                badJSONs.push(req);
+            }
+            const REQ_SIZE_LIMIT = 1024;
+            await (0, requests_1.expectNonAcceptanceOfBadJsonRequest)(reqOpts, REQ_SIZE_LIMIT, badJSONs);
+        }
+        (0, async_jasmine_1.itAsync)('starts with Public Key Login, using default key', () => testFirstReqFor(true));
+        (0, async_jasmine_1.itAsync)('starts with Public Key Login, using non-default (labeled) key', () => testFirstReqFor(false));
+        async function testSecondReqFor(useDefaultKey) {
+            let exchangeParams = await (0, pkl_1.startPKLSession)(provUrl, user1, useDefaultKey);
+            let reqOpts = {
+                url: provUrl + pklApi.complete.URL_END,
+                method: 'POST',
+                sessionId: exchangeParams.sessionId,
+                responseType: 'arraybuffer'
+            };
+            let rep = await (0, xhr_utils_1.doBinaryRequest)(reqOpts, exchangeParams.crypto.encResponse);
+            expect(rep.status).withContext('status code for successful login completion').toBe(pklApi.complete.SC.ok);
+            expect(rep.data.length).toBe(ecma_nacl_1.secret_box.POLY_LENGTH);
+            expect((0, bytes_equal_1.bytesEqual)(rep.data, exchangeParams.crypto.serverVerificationBytes)).withContext('returned bytes must be a missing poly part from the challenge, to verify to client, that server knows user\'s public key').toBe(true);
+            // repeating request is not ok
+            rep = await (0, xhr_utils_1.doBinaryRequest)(reqOpts, exchangeParams.crypto.encResponse);
+            expect(rep.status).withContext('reaction to duplicate request').toBe(pklApi.ERR_SC.duplicate);
+            // send incorrect challenge response
+            for (let i = 0; i < exchangeParams.crypto.encResponse.length; i += 1) {
+                let exchange2 = await (0, pkl_1.startPKLSession)(provUrl, user2, useDefaultKey);
+                let badReply = exchange2.crypto.encResponse;
+                badReply[i] ^= 1;
+                reqOpts.sessionId = exchange2.sessionId;
+                let rep = await (0, xhr_utils_1.doBinaryRequest)(reqOpts, badReply);
+                expect(rep.status).toBe(pklApi.complete.SC.authFailed);
+            }
+            let exchange2 = await (0, pkl_1.startPKLSession)(provUrl, user2, useDefaultKey);
+            let badReply = exchange2.crypto.encResponse.subarray(5);
+            reqOpts.sessionId = exchange2.sessionId;
+            rep = await (0, xhr_utils_1.doBinaryRequest)(reqOpts, badReply);
+            expect(rep.status).toBe(pklApi.complete.SC.authFailed);
+            // bad session id
+            await (0, requests_1.expectNonAcceptanceOfBadSessionId)(reqOpts);
+            // too long
+            const REQ_SIZE_LIMIT = 1024;
+            exchange2 = await (0, pkl_1.startPKLSession)(provUrl, user2, useDefaultKey);
+            reqOpts.sessionId = exchange2.sessionId;
+            await (0, requests_1.expectNonAcceptanceOfLongBody)(reqOpts, 'application/octet-stream', REQ_SIZE_LIMIT);
+            // wrong type
+            await (0, requests_1.expectNonAcceptanceOfBadType)(reqOpts, 'application/octet-stream', exchange2.crypto.encResponse);
+        }
+        (0, async_jasmine_1.itAsync)('second request completes Public Key Login, using default key', () => testSecondReqFor(true));
+        (0, async_jasmine_1.itAsync)('second request completes Public Key Login, with non-default key', () => testSecondReqFor(true));
+        (0, async_jasmine_1.itAsync)('certifies user\'s MailerId public key', async () => {
+            let midSigningPair = mid_sigs_NaCl_Ed_1.user.generateSigningKeyPair(random_node_1.bytesSync);
+            let reqData = {
+                pkey: midSigningPair.pkey,
+                duration: 12 * 60 * 60
+            };
+            let sessParams = await (0, pkl_1.doPubKeyLogin)(provUrl, user1);
+            let reqOpts = {
+                url: provUrl + provisioning_1.certify.URL_END,
+                method: 'POST',
+                sessionId: sessParams.sessionId,
+                responseType: 'arraybuffer'
+            };
+            let encrBody = sessParams.sessEncr.packJSON(reqData);
+            let rep = await (0, xhr_utils_1.doBinaryRequest)(reqOpts, encrBody);
+            expect(rep.status).withContext('status code for OK reply').toBe(provisioning_1.certify.SC.ok);
+            let repData = sessParams.sessEncr.openJSON(rep.data);
+            let pkeyAndAddress = mid_sigs_NaCl_Ed_1.relyingParty.verifyChainAndGetUserKey({
+                root: await (0, mailerid_2.getMidRoot)(midServer.midUrl),
+                prov: repData.provCert,
+                user: repData.userCert
+            }, midServer.midServiceDomain, Date.now() / 1000);
+            expect(pkeyAndAddress.address).withContext('certificate must be issued for session\'s user canonical address.').toBe((0, canonical_address_1.toCanonicalAddress)(user1.id));
+            let pkeyFromCert = {
+                alg: pkeyAndAddress.pkey.alg,
+                kid: pkeyAndAddress.pkey.kid,
+                use: pkeyAndAddress.pkey.use,
+                k: buffer_utils_1.base64.pack(pkeyAndAddress.pkey.k)
+            };
+            expect((0, json_equal_1.deepEqual)(pkeyFromCert, midSigningPair.pkey)).withContext('public key should be exactly the same as given one.').toBe(true);
+            // session is closed at this request
+            rep = await (0, xhr_utils_1.doBinaryRequest)(reqOpts, sessParams.sessEncr.packJSON(reqData));
+            expect(rep.status).withContext('session should be closed.').toBe(requests_1.UNAUTHORIZED_STATUS);
+            // messed up cipher body
+            sessParams = await (0, pkl_1.doPubKeyLogin)(provUrl, user1);
+            reqOpts.sessionId = sessParams.sessionId;
+            encrBody[20] ^= 1;
+            rep = await (0, xhr_utils_1.doBinaryRequest)(reqOpts, encrBody);
+            expect(rep.status).toBe(provisioning_1.certify.SC.cryptoVerifFail);
+            // empty body
+            sessParams = await (0, pkl_1.doPubKeyLogin)(provUrl, user1);
+            reqOpts.sessionId = sessParams.sessionId;
+            rep = await (0, xhr_utils_1.doBinaryRequest)(reqOpts, new Uint8Array(0));
+            expect(rep.status).toBe(provisioning_1.certify.SC.cryptoVerifFail);
+            // set session for fuzzing below
+            sessParams = await (0, pkl_1.doPubKeyLogin)(provUrl, user1);
+            reqOpts.sessionId = sessParams.sessionId;
+            // too long
+            const REQ_SIZE_LIMIT = 16 * 1024;
+            await (0, requests_1.expectNonAcceptanceOfLongBody)(reqOpts, 'application/octet-stream', REQ_SIZE_LIMIT);
+            // wrong type
+            encrBody = sessParams.sessEncr.packJSON(reqData);
+            await (0, requests_1.expectNonAcceptanceOfBadType)(reqOpts, 'application/octet-stream', encrBody);
+        });
+    });
+});

package/build/tests/shared-checks/check-mid-login.d.ts

@@ -0,0 +1,2 @@
+import { User } from '../libs-for-tests/mailerid';
+export declare function midLoginSpecs(loginUrl: () => string, user: () => User): () => void;

package/build/tests/shared-checks/check-mid-login.js

@@ -0,0 +1,131 @@
+"use strict";
+/*
+ Copyright (C) 2016, 2025 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.midLoginSpecs = void 0;
+const async_jasmine_1 = require("../libs-for-tests/async-jasmine");
+const login_1 = require("../../lib-common/service-api/mailer-id/login");
+const xhr_utils_1 = require("../libs-for-tests/xhr-utils");
+const mailerid_1 = require("../libs-for-tests/mailerid");
+const requests_1 = require("./requests");
+const mid = require("../../lib-common/mid-sigs-NaCl-Ed");
+const random_node_1 = require("../../lib-common/random-node");
+const url_1 = require("url");
+function midLoginSpecs(loginUrl, user) {
+    return () => {
+        (0, async_jasmine_1.itAsync)('first request starts session', async () => {
+            const reqOpts = {
+                url: (0, url_1.resolve)(loginUrl(), login_1.startSession.URL_END),
+                method: 'POST',
+                responseType: 'json'
+            };
+            // request with known user id
+            let req = { userId: user().id };
+            let rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status for ok reply').toBe(login_1.startSession.SC.ok);
+            expect(typeof rep.data).toBe('object');
+            expect(typeof rep.data.sessionId).withContext('session id be in reply').toBe('string');
+            // duplicating request, with session id now in a header
+            reqOpts.sessionId = rep.data.sessionId;
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('reaction to duplicate request').toBe(login_1.ERR_SC.duplicate);
+            delete reqOpts.sessionId;
+            // when user id is unknown
+            req = { userId: 'unknown user @some.domain' };
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status code for an unknown user id').toBe(login_1.startSession.SC.unknownUser);
+            // requests with bad json's
+            const badIds = ['', ' ', '\t', '\n',
+                5, null, undefined, {}]; // non-strings
+            const badJSONs = ['bar', 5, null, undefined, ['blah'],
+                { a: 1 }];
+            for (const id of badIds) {
+                req = { userId: id };
+                badJSONs.push(req);
+            }
+            const REQ_SIZE_LIMIT = 1024;
+            await (0, requests_1.expectNonAcceptanceOfBadJsonRequest)(reqOpts, REQ_SIZE_LIMIT, badJSONs);
+        });
+        (0, async_jasmine_1.itAsync)('second request authenticates session', async () => {
+            const url = loginUrl();
+            let sessionId = await (0, mailerid_1.startMidSession)(url, user().id);
+            const uInfo = user();
+            let midSigner = await (0, mailerid_1.provisionMidSigner)(uInfo.midUrl, uInfo);
+            const reqOpts = {
+                url: (0, url_1.resolve)(loginUrl(), login_1.authSession.URL_END),
+                method: 'POST',
+                responseType: 'json',
+                sessionId
+            };
+            const serviceDomain = (0, url_1.parse)(loginUrl()).hostname;
+            if (!serviceDomain) {
+                throw new Error(`Cannot get hostname from ${loginUrl()}`);
+            }
+            const req = {
+                assertion: midSigner.generateAssertionFor(serviceDomain, sessionId),
+                provCert: midSigner.providerCert,
+                userCert: midSigner.userCert
+            };
+            let rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status for ok reply').toBe(login_1.authSession.SC.ok);
+            // repeating request is not ok
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('reaction to duplicate request').toBe(login_1.ERR_SC.duplicate);
+            // wrong assertion is from a different session
+            sessionId = await (0, mailerid_1.startMidSession)(url, user().id);
+            reqOpts.sessionId = sessionId;
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status for autherization failure').toBe(login_1.authSession.SC.authFailed);
+            // wrong domain in assertion
+            sessionId = await (0, mailerid_1.startMidSession)(url, user().id);
+            reqOpts.sessionId = sessionId;
+            req.assertion = midSigner.generateAssertionFor('other.domain', sessionId);
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status for autherization failure').toBe(login_1.authSession.SC.authFailed);
+            // fake certs
+            const fakeRoot = mid.idProvider.generateRootKey(uInfo.midUrl, 365 * 12 * 60 * 60, random_node_1.bytesSync);
+            const fakeProvider = mid.idProvider.generateProviderKey(uInfo.midUrl, 30 * 12 * 60 * 60, fakeRoot.skey, random_node_1.bytesSync);
+            const fakeIdCertifier = mid.idProvider.makeIdProviderCertifier(uInfo.midUrl, 24 * 60 * 60, fakeProvider.skey);
+            const fakeUserKeys = mid.user.generateSigningKeyPair(random_node_1.bytesSync);
+            const fakeUserCert = fakeIdCertifier.certify(fakeUserKeys.pkey, user().id);
+            midSigner = mid.user.makeMailerIdSigner(fakeUserKeys.skey, fakeUserCert, fakeProvider.cert);
+            sessionId = await (0, mailerid_1.startMidSession)(url, user().id);
+            reqOpts.sessionId = sessionId;
+            req.assertion = midSigner.generateAssertionFor(serviceDomain, sessionId);
+            req.userCert = fakeUserCert; // keep unrelated provCert
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status for autherization failure').toBe(login_1.authSession.SC.authFailed);
+            sessionId = await (0, mailerid_1.startMidSession)(url, user().id);
+            reqOpts.sessionId = sessionId;
+            req.assertion = midSigner.generateAssertionFor(serviceDomain, sessionId);
+            req.provCert = fakeProvider.cert;
+            req.userCert = fakeUserCert;
+            rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
+            expect(rep.status).withContext('status for autherization failure').toBe(login_1.authSession.SC.authFailed);
+            // bad json
+            const REQ_SIZE_LIMIT = 4 * 1024;
+            sessionId = await (0, mailerid_1.startMidSession)(url, user().id);
+            reqOpts.sessionId = sessionId;
+            const badJSONs = [1, null, undefined, 'string'];
+            await (0, requests_1.expectNonAcceptanceOfBadJsonRequest)(reqOpts, REQ_SIZE_LIMIT, badJSONs);
+            // bad session id
+            await (0, requests_1.expectNonAcceptanceOfBadSessionId)(reqOpts);
+        });
+    };
+}
+exports.midLoginSpecs = midLoginSpecs;
+Object.freeze(exports);

package/build/tests/shared-checks/requests.d.ts

@@ -0,0 +1,20 @@
+import { RequestOpts } from '../libs-for-tests/xhr-utils';
+export declare const UNAUTHORIZED_STATUS = 401;
+/**
+ * This function should test json-expecting routes.
+ * @param opts
+ * @param maxBodyLen
+ * @param badJSONs
+ * @return a promise, resolvable when all checks are done.
+ */
+export declare function expectNonAcceptanceOfBadJsonRequest(opts: RequestOpts, maxBodyLen: number, badJSONs: any[]): Promise<void>;
+export declare type BodyType = 'application/octet-stream' | 'text/plain' | 'application/json';
+export declare function expectNonAcceptanceOfBadType(opts: RequestOpts, correctType: BodyType, body: Uint8Array): Promise<void>;
+export declare function expectNonAcceptanceOfLongBody(opts: RequestOpts, bodyType: BodyType, maxBodyLen: number): Promise<void>;
+export declare function expectNonAcceptanceOfNonEmptyBody(opts: RequestOpts): Promise<void>;
+/**
+ * @param opts
+ * @param hasBody is a flag, telling if body should be sent with the request.
+ * Default value is false, for no body in request.
+ */
+export declare function expectNonAcceptanceOfBadSessionId(opts: RequestOpts, hasBody?: boolean): Promise<void>;

package/build/tests/shared-checks/requests.js

@@ -0,0 +1,123 @@
+"use strict";
+/*
+ Copyright (C) 2016, 2019, 2025 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expectNonAcceptanceOfBadSessionId = exports.expectNonAcceptanceOfNonEmptyBody = exports.expectNonAcceptanceOfLongBody = exports.expectNonAcceptanceOfBadType = exports.expectNonAcceptanceOfBadJsonRequest = exports.UNAUTHORIZED_STATUS = void 0;
+const xhr_utils_1 = require("../libs-for-tests/xhr-utils");
+const crypto_1 = require("crypto");
+const buffer_utils_1 = require("../../lib-common/buffer-utils");
+const json_copy_1 = require("../libs-for-tests/json-copy");
+const LONG_BODY_STATUS = 413;
+const MALFORMED_BODY_STATUS = 400;
+const WRONG_CONTENT_TYPE_STATUS = 415;
+exports.UNAUTHORIZED_STATUS = 401;
+/**
+ * This function should test json-expecting routes.
+ * @param opts
+ * @param maxBodyLen
+ * @param badJSONs
+ * @return a promise, resolvable when all checks are done.
+ */
+async function expectNonAcceptanceOfBadJsonRequest(opts, maxBodyLen, badJSONs) {
+    // bad json
+    for (const badReq of badJSONs) {
+        const rep = await (0, xhr_utils_1.doJsonRequest)(opts, badReq);
+        expect(rep.status).withContext(`status code for malformed request: ${JSON.stringify(badReq)}`).toBe(MALFORMED_BODY_STATUS);
+    }
+    // bad non-json bodies
+    const badBodies = [Buffer.alloc(0), (0, crypto_1.randomBytes)(Math.floor(maxBodyLen / 2))];
+    for (const bytes of badBodies) {
+        const req = (0, xhr_utils_1.request)('application/json', opts);
+        req.xhr.send(bytes);
+        const rep = await req.promise;
+        expect(rep.status).withContext('status code for malformed request').toBe(MALFORMED_BODY_STATUS);
+    }
+    // wrong content type
+    await expectNonAcceptanceOfBadType(opts, 'application/json', buffer_utils_1.utf8.pack(JSON.stringify({})));
+    // request that is too long (>maxBodyLen)
+    await expectNonAcceptanceOfLongBody(opts, 'application/json', maxBodyLen);
+}
+exports.expectNonAcceptanceOfBadJsonRequest = expectNonAcceptanceOfBadJsonRequest;
+const bodyTypes = ['application/octet-stream',
+    'text/plain', 'application/json', undefined];
+async function expectNonAcceptanceOfBadType(opts, correctType, body) {
+    for (const bt of bodyTypes) {
+        if (correctType === bt) {
+            continue;
+        }
+        const req = (0, xhr_utils_1.request)(bt, opts);
+        req.xhr.send(body);
+        const rep = await req.promise;
+        expect(rep.status).withContext('status code for wrong content type request').toBe(WRONG_CONTENT_TYPE_STATUS);
+    }
+}
+exports.expectNonAcceptanceOfBadType = expectNonAcceptanceOfBadType;
+async function expectNonAcceptanceOfLongBody(opts, bodyType, maxBodyLen) {
+    const badReq = (0, crypto_1.randomBytes)(maxBodyLen + 1);
+    const req = (0, xhr_utils_1.request)(bodyType, opts);
+    req.xhr.send(badReq);
+    try {
+        const rep = await req.promise;
+        expect(rep.status).withContext('status code for long request').toBe(LONG_BODY_STATUS);
+    }
+    catch (exc) {
+        const cantConnect = exc.runtimeException &&
+            (exc.type === 'http-connect');
+        expect(cantConnect).withContext(`server can close connection on a long reply, resulting in a can't connect error on a client side`).toBe(true);
+    }
+}
+exports.expectNonAcceptanceOfLongBody = expectNonAcceptanceOfLongBody;
+async function expectNonAcceptanceOfNonEmptyBody(opts) {
+    const badReq = (0, crypto_1.randomBytes)(1);
+    const req = (0, xhr_utils_1.request)(undefined, opts);
+    req.xhr.send(badReq);
+    const rep = await req.promise;
+    expect(rep.status).withContext('status code for long request').toBe(LONG_BODY_STATUS);
+}
+exports.expectNonAcceptanceOfNonEmptyBody = expectNonAcceptanceOfNonEmptyBody;
+/**
+ * @param opts
+ * @param hasBody is a flag, telling if body should be sent with the request.
+ * Default value is false, for no body in request.
+ */
+async function expectNonAcceptanceOfBadSessionId(opts, hasBody = false) {
+    opts = (0, json_copy_1.copy)(opts);
+    // missing session id
+    delete opts.sessionId;
+    let req = (0, xhr_utils_1.request)(undefined, opts);
+    if (hasBody) {
+        req.xhr.send((0, crypto_1.randomBytes)(5));
+    }
+    else {
+        req.xhr.send();
+    }
+    let rep = await req.promise;
+    expect(rep.status).withContext('status code when required session id is missing').toBe(exports.UNAUTHORIZED_STATUS);
+    // invalid session id
+    opts.sessionId = 'bogus session id';
+    req = (0, xhr_utils_1.request)(undefined, opts);
+    if (hasBody) {
+        req.xhr.send((0, crypto_1.randomBytes)(5));
+    }
+    else {
+        req.xhr.send();
+    }
+    rep = await req.promise;
+    expect(rep.status).withContext('status code for an invalid session id').toBe(exports.UNAUTHORIZED_STATUS);
+}
+exports.expectNonAcceptanceOfBadSessionId = expectNonAcceptanceOfBadSessionId;
+Object.freeze(exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spec-3nweb-server",
-  "version": "1.8.4",
+  "version": "1.8.6",
   "description": "3NWeb spec server.",
   "main": "build/lib.js",
   "types": "build/lib.d.ts",

package/packing/create-deb.sh

@@ -0,0 +1,57 @@
+
+version_from_npm() {
+	node -e "
+		const packageInfo = JSON.parse(fs.readFileSync(
+			'package.json', { encoding: 'utf8' }
+		));
+		console.log(packageInfo.version);
+	" || return $?
+}
+
+src_dir="packing/deb"
+temp_dir="deb-bin"
+DEBIAN="$temp_dir/DEBIAN"
+lib_dir="$temp_dir/usr/lib/3nweb"
+conf_yaml="/etc/3nweb/conf.yaml"
+dist_dir="dist"
+
+mkdir -p $DEBIAN
+# cp -r $src_dir/etc $src_dir/lib $src_dir/usr $temp_dir/
+cp -r $src_dir/lib $src_dir/usr $temp_dir/
+mkdir -p $lib_dir
+cp $dist_dir/spec-3nweb-server $lib_dir/
+chmod 755 $lib_dir/*
+
+cd $temp_dir
+find . -type f | xargs md5sum > DEBIAN/md5sums
+cd ..
+
+cp $src_dir/postinst $DEBIAN/
+chmod 755 $DEBIAN/postinst
+
+# echo $conf_yaml > $DEBIAN/conffiles
+
+package_name="3nweb-server"
+deb_version=$(version_from_npm)-1
+size_kb=$(du -ksc $temp_dir/usr | grep total | cut -f1)
+
+echo "
+Package: $package_name
+Version: $deb_version
+Architecture: all
+Section: web
+Maintainer: 3NSoft Inc <hq@3nsoft.com>
+Installed-Size: $size_kb
+Homepage: https://3nweb.com
+Description: Provides messaging, storage and indentity services for 3NWeb
+ $package_name provides all 3NWeb services: ASMail messaging, 3NStorage and
+ MailerId identity.
+" > $DEBIAN/control
+
+echo ""
+
+dpkg --build $temp_dir $dist_dir/${package_name}_${deb_version}.deb
+
+dpkg_res=$?
+rm -rf $temp_dir
+exit $pkg_res

package/packing/deb/lib/systemd/system/3nweb.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=3NWeb server
+After=network.target
+
+[Service]
+Type=forking
+# systemd will capture
+ExecStart=sh -c "/usr/bin/3nweb run --config /etc/3nweb/conf.yaml & "
+
+[Install]
+WantedBy=multi-user.target

package/packing/deb/postinst

@@ -0,0 +1,44 @@
+#!/bin/sh
+
+var_dir=/var/3nweb
+bin_link=/usr/bin/3nweb
+lib_bin=/usr/lib/3nweb/spec-3nweb-server
+
+if [ ! -d $var_dir ]
+then
+	mkdir -p $var_dir
+fi
+
+if [ ! -e $bin_link ]
+then 
+   ln -s $lib_bin $bin_link
+fi
+
+etc=/etc/3nweb
+etc_conf=$etc/conf.yaml
+conf_template=/usr/share/doc/3nweb-server/conf-for-postinstall.yaml
+etc_mid=$etc/mailerid
+
+if [ ! -e $etc_conf ]
+then
+   echo "Writing out template configuration into $etc"
+   mkdir -p $etc_mid
+   cat $conf_template > $etc_conf
+fi
+
+if [ -n "$(which systemctl)" ]
+then
+   echo "Reloading systemd daemon and enabling 3nweb service."
+   systemctl daemon-reload
+   systemctl enable 3nweb
+fi
+
+echo "
+   ####################
+   #   3NWeb server   #
+   ####################
+
+1. Customize 3NWeb settings in $etc_conf
+
+2. Start systemd service \"sudo systemctl start 3nweb\"
+"

package/packing/deb/usr/share/doc/3nweb-server/conf-for-postinstall.yaml

@@ -0,0 +1,19 @@
+enabledServices:
+  asmail: true
+  storage: true
+  mailerId: true
+
+rootFolder: /var/3nweb
+
+# Customize domain at which clients reach this server from an outside.
+# domain: example.com
+
+mailerId:
+  certs: /etc/3nweb/mailerid/certs
+
+# Customize servicesConnect before starting this server
+# servicesConnect:
+#   port: 443
+#   letsencrypt: /etc/letsencrypt/live/example.com
+
+signup: {}

package/packing/deb/usr/share/doc/3nweb-server/copyright

@@ -0,0 +1,22 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: 3nweb-server
+Upstream-Contact: hg@3nsoft.com
+Source: https://github.com/3nsoft/spec-server
+
+Files: *
+Copyright: 2015 - 2023 3NSoft Inc.
+License: GPL-3+
+
+License: GPL-3+
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ .
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.

package/publish-task.sh

@@ -0,0 +1,10 @@
+
+echo "//registry.npmjs.org/:_authToken=$1" > .npmrc
+
+echo "Publishing package"
+npm publish
+pub_result=$?
+
+rm .npmrc
+
+exit $pub_result