toiljs 0.0.117 → 0.0.118

package/server/auth/AuthController.ts

@@ -1,3 +1,5 @@
+import { FactorRepository } from './FactorSettings';
+import { SessionEpochs } from './SessionEpochs';
 import { Response, RouteContext } from 'toiljs/server/runtime';
 import { DataReader, DataWriter } from 'data';
 
@@ -500,6 +502,8 @@ class Challenge {
     nonce: Uint8Array = new Uint8Array(0);
     iat: u64 = 0;
     exp: u64 = 0;
+    sessionEpoch: u64 = 0;
+    sessionVersion: u8 = 0;
 }
 
 /** The lookup key for a login 2FA challenge: 16 random bytes minted per login.
@@ -531,6 +535,9 @@ class TwoFaChallenge {
     exp: u64 = 0;
     attempts: u32 = 0;
     targetMethod: u8 = 0;
+    sessionEpoch: u64 = 0;
+    sessionVersion: u8 = 0;
+    settingsRevision: u64 = 0;
 }
 
 @database
@@ -729,6 +736,9 @@ class Auth {
             c.nonce = nonce;
             c.iat = iat;
             c.exp = exp;
+            const account = AuthDb.accounts.get(new Username(h, username))!;
+            c.sessionEpoch = SessionEpochs.current(__toilEncodeAuthUser(this.stableUserId(ctx, h, username, account), username));
+            c.sessionVersion = 2;
             AuthDb.challenges.create(new ChallengeId(h, cid), c);
         }
 
@@ -763,6 +773,7 @@ class Auth {
         //    The challenge is realm-keyed, so one minted on another domain misses.
         const ch = AuthDb.challenges.getDelete(new ChallengeId(h, cid));
         if (ch == null) return fail();
+        if (ch.sessionVersion != 2) return fail();
         if (nowSecs() >= ch.exp) return fail();
 
         // 2. Rebuild the message from OUR stored values + the client's ct (and
@@ -810,11 +821,12 @@ class Auth {
         //     never resetTokens/confirmTokens). This runs AFTER the signature
         //     verify above, so it is not an oracle, and the login `Challenge` was
         //     already consumed (getDelete) at the top of this handler.
-        if (acct.twoFactorMethod != TWOFA_NONE) {
+        const factorMethod = FactorRepository.read(h, ch.username, acct.twoFactorMethod).method;
+        if (factorMethod != TWOFA_NONE) {
             const raw = randomBytes(16); // the twoFaId the client echoes to /2fa/verify
             const codeHash = this.twoFaDeliver(
                 h,
-                acct.twoFactorMethod,
+                factorMethod,
                 ch.username,
                 acct.email,
                 'Your login code',
@@ -823,10 +835,12 @@ class Auth {
             if (codeHash.length == 0) return fail(); // unsupported/misconfigured method
             const c2 = new TwoFaChallenge();
             c2.username = ch.username;
-            c2.method = acct.twoFactorMethod;
+            c2.method = factorMethod;
             c2.codeHash = codeHash;
             c2.exp = nowSecs() + TWOFA_TTL_SECS;
             c2.attempts = 0;
+            c2.sessionEpoch = ch.sessionEpoch;
+            c2.sessionVersion = 2;
             c2.targetMethod = TWOFA_NONE; // a LOGIN challenge changes no method on success
             AuthDb.twoFaLogins.create(new TwoFaId(h, raw), c2);
 
@@ -848,7 +862,7 @@ class Auth {
         w.writeBytes(userData); // opaque session token (the readable user payload)
         w.writeBytes(confirm);
         const resp = Response.bytes(w.toBytes());
-        resp.setCookie(AuthService.mintSession(userData, SESSION_TTL_SECS));
+        resp.setCookie(AuthService.mintSession(userData, SESSION_TTL_SECS, ch.sessionEpoch));
         resp.setCookie(AuthService.userCookie(userData, SESSION_TTL_SECS));
         return resp;
     }
@@ -951,9 +965,11 @@ class Auth {
         // Overwrite ONLY the login verifier. Salt/params are deterministic
         // constants (unchanged); a successful reset also implies email ownership,
         // so confirm the account while we are here.
+        const stableId = this.stableUserId(ctx, h, rec.username, acct);
         acct.publicKey = pk;
         acct.emailConfirmed = true;
         AuthDb.accounts.patch(new Username(h, rec.username), acct);
+        AuthService.revokeUserSessions(__toilEncodeAuthUser(stableId, rec.username));
         return Response.bytes(new DataWriter().writeU8(ST_OK).toBytes());
     }
 
@@ -986,6 +1002,18 @@ class Auth {
     @auth
     @post('/logout')
     public logout(_ctx: RouteContext): Response {
+        AuthService.revokeSession();
+        const resp = Response.text('bye\n', 200);
+        resp.setCookie(AuthService.clearSession());
+        resp.setCookie(AuthService.clearUserCookie());
+        return resp;
+    }
+
+    /** Revoke all sessions, including a copied cookie and pending pre-revocation logins. */
+    @auth
+    @post('/logout-all')
+    public logoutAll(_ctx: RouteContext): Response {
+        AuthService.revokeUserSessions(AuthService.getSessionBytes()!);
         const resp = Response.text('bye\n', 200);
         resp.setCookie(AuthService.clearSession());
         resp.setCookie(AuthService.clearUserCookie());
@@ -1029,6 +1057,7 @@ class Auth {
         // would otherwise lock the user out) until the attempt cap is reached.
         const ch = AuthDb.twoFaLogins.get(key);
         if (ch == null) return fail();
+        if (ch.sessionVersion != 2) return fail(); // reject pre-upgrade pending logins
         if (nowSecs() >= ch.exp || ch.attempts >= TWOFA_MAX_ATTEMPTS) {
             AuthDb.twoFaLogins.delete(key); // burn an expired / exhausted challenge
             return fail();
@@ -1043,7 +1072,8 @@ class Auth {
         }
 
         // SUCCESS: consume-once, then mint the session EXACTLY like login/finish.
-        AuthDb.twoFaLogins.getDelete(key);
+        const consumed = AuthDb.twoFaLogins.getDelete(key);
+        if (consumed == null) return fail();
         const acct = AuthDb.accounts.get(new Username(h, ch.username));
         if (acct == null) return fail();
         const toilUserId = this.stableUserId(ctx, h, ch.username, acct);
@@ -1052,7 +1082,7 @@ class Auth {
         w.writeU8(ST_OK);
         w.writeBytes(userData);
         const resp = Response.bytes(w.toBytes());
-        resp.setCookie(AuthService.mintSession(userData, SESSION_TTL_SECS));
+        resp.setCookie(AuthService.mintSession(userData, SESSION_TTL_SECS, ch.sessionEpoch));
         resp.setCookie(AuthService.userCookie(userData, SESSION_TTL_SECS));
         return resp;
     }
@@ -1078,8 +1108,9 @@ class Auth {
         const acct = AuthDb.accounts.get(new Username(h, u.username));
         if (acct == null) return fail();
 
+        const settings = FactorRepository.read(h, u.username, acct.twoFactorMethod);
         // Disabling when 2FA is already off: nothing to prove; generic ST_OK.
-        if (targetMethod == TWOFA_NONE && acct.twoFactorMethod == TWOFA_NONE) {
+        if (targetMethod == TWOFA_NONE && settings.method == TWOFA_NONE) {
             return Response.bytes(new DataWriter().writeU8(ST_OK).toBytes());
         }
 
@@ -1087,7 +1118,7 @@ class Auth {
         //   ENABLE  (targetMethod != NONE): the NEW method (prove you control it).
         //   DISABLE (targetMethod == NONE): the CURRENT method (prove you still
         //     hold the existing factor before it is removed).
-        const deliverMethod: u8 = targetMethod != TWOFA_NONE ? targetMethod : acct.twoFactorMethod;
+        const deliverMethod: u8 = targetMethod != TWOFA_NONE ? targetMethod : settings.method;
         // Action phrase for the 2FA email body (the `{action}` token): enabling proves the
         // new factor, disabling proves the current one before it is removed.
         const twoFaAction: string =
@@ -1106,6 +1137,9 @@ class Auth {
 
         const c = new TwoFaChallenge();
         c.username = u.username;
+        c.settingsRevision = settings.revision;
+        c.sessionVersion = 2;
+        c.sessionEpoch = SessionEpochs.current(AuthService.getSessionBytes()!);
         c.method = deliverMethod;
         c.codeHash = codeHash;
         c.exp = nowSecs() + TWOFA_TTL_SECS;
@@ -1148,7 +1182,7 @@ class Auth {
 
         const key = new Username(h, u.username);
         const ch = AuthDb.twoFaSetup.get(key);
-        if (ch == null) return fail();
+        if (ch == null || ch.sessionVersion != 2 || !SessionEpochs.allowed(AuthService.getSessionBytes()!, ch.sessionEpoch)) return fail();
         if (nowSecs() >= ch.exp || ch.attempts >= TWOFA_MAX_ATTEMPTS) {
             AuthDb.twoFaSetup.delete(key);
             return fail();
@@ -1161,12 +1195,17 @@ class Auth {
         }
 
         // SUCCESS: consume-once + apply the method change.
-        AuthDb.twoFaSetup.getDelete(key);
+        const consumed = AuthDb.twoFaSetup.getDelete(key);
+        if (consumed == null || nowSecs() >= consumed.exp || !this.twoFaVerifyCode(h, consumed.username, code, consumed)) return fail();
         const acct = AuthDb.accounts.get(key);
         if (acct == null) return fail();
-        acct.twoFactorMethod = ch.targetMethod;
-        AuthDb.accounts.patch(key, acct);
-        return Response.bytes(new DataWriter().writeU8(ST_OK).toBytes());
+        if (!FactorRepository.save(h, u.username, consumed.targetMethod, consumed.settingsRevision)) return fail();
+        const userData = __toilEncodeAuthUser(this.stableUserId(_ctx, h, u.username, acct), u.username);
+        AuthService.revokeUserSessions(userData);
+        const response = Response.bytes(new DataWriter().writeU8(ST_OK).toBytes());
+        response.setCookie(AuthService.clearSession());
+        response.setCookie(AuthService.clearUserCookie());
+        return response;
     }
 
     /** GET /auth/2fa/status  (@auth)  resp: u8(method)  (0 = off, 1 = email, ...)
@@ -1179,7 +1218,7 @@ class Auth {
         const h = realm(_ctx);
         const acct = AuthDb.accounts.get(new Username(h, u.username));
         if (acct == null) return fail();
-        return Response.bytes(new DataWriter().writeU8(acct.twoFactorMethod).toBytes());
+        return Response.bytes(new DataWriter().writeU8(FactorRepository.read(h, u.username, acct.twoFactorMethod).method).toBytes());
     }
 
     /**

package/server/auth/FactorSettings.ts

@@ -0,0 +1,41 @@
+@data
+class FactorKey {
+    host: string = '';
+    username: string = '';
+    constructor(host: string = '', username: string = '') { this.host = host; this.username = username; }
+}
+@data
+class FactorRevision {
+    host: string = '';
+    username: string = '';
+    revision: u64 = 0;
+    constructor(host: string = '', username: string = '', revision: u64 = 0) { this.host = host; this.username = username; this.revision = revision; }
+}
+@data
+export class FactorSettings {
+    method: u8 = 0;
+    revision: u64 = 0;
+}
+@database
+class FactorDb {
+    @collection static heads: Documents<FactorKey, FactorSettings>;
+    @collection static revisions: Unique<FactorRevision, FactorSettings>;
+}
+export class FactorRepository {
+    public static read(host: string, username: string, legacy: u8): FactorSettings {
+        let settings = FactorDb.heads.get(new FactorKey(host, username));
+        if (settings == null) { settings = new FactorSettings(); settings.method = legacy; }
+        for (let i: i32 = 0; i < 64; i++) {
+            const next = FactorDb.revisions.lookup(new FactorRevision(host, username, settings.revision + 1));
+            if (next == null) return settings;
+            settings = next;
+        }
+        throw new Error('Two-factor settings unavailable');
+    }
+    public static save(host: string, username: string, method: u8, expected: u64): bool {
+        const settings = new FactorSettings(); settings.method = method; settings.revision = expected + 1;
+        if (!FactorDb.revisions.claim(new FactorRevision(host, username, settings.revision), settings).claimed) return false;
+        FactorDb.heads.upsert(new FactorKey(host, username), settings);
+        return true;
+    }
+}

package/server/auth/SessionEpochs.ts

@@ -0,0 +1,58 @@
+import { DataReader } from 'data';
+@data
+class SessionUserKey {
+    id: string = '';
+    constructor(id: string = '') { this.id = id; }
+}
+@data
+class SessionEpochKey {
+    id: string = '';
+    revision: u64 = 0;
+    constructor(id: string = '', revision: u64 = 0) { this.id = id; this.revision = revision; }
+}
+@data
+class SessionEpoch {
+    revision: u64 = 0;
+}
+@database
+class SessionEpochDb {
+    @collection static heads: Documents<SessionUserKey, SessionEpoch>;
+    @collection static revisions: Unique<SessionEpochKey, SessionEpoch>;
+}
+/** Immutable per-user generations fence sessions and in-flight login challenges without clock assumptions. */
+export class SessionEpochs {
+    private static key(userData: Uint8Array): string {
+        const reader = new DataReader(userData);
+        reader.readU32(); // @data message-boundary identifier
+        const id = reader.readBytes();
+        if (!reader.ok || id.length != 32) throw new Error('Invalid session identity');
+        return crypto.toHex(id);
+    }
+    private static read(id: string): SessionEpoch {
+        let epoch = SessionEpochDb.heads.get(new SessionUserKey(id));
+        if (epoch == null) epoch = new SessionEpoch();
+        for (let i: i32 = 0; i < 64; i++) {
+            const next = SessionEpochDb.revisions.lookup(new SessionEpochKey(id, epoch.revision + 1));
+            if (next == null) return epoch;
+            epoch = next;
+        }
+        throw new Error('Session state unavailable');
+    }
+    public static current(userData: Uint8Array): u64 {
+        return SessionEpochs.read(SessionEpochs.key(userData)).revision;
+    }
+    public static allowed(userData: Uint8Array, generation: u64): bool {
+        return generation == SessionEpochs.current(userData);
+    }
+    public static revoke(userData: Uint8Array): void {
+        const id = SessionEpochs.key(userData);
+        for (let i: i32 = 0; i < 3; i++) {
+            const epoch = SessionEpochs.read(id);
+            epoch.revision += 1;
+            if (!SessionEpochDb.revisions.claim(new SessionEpochKey(id, epoch.revision), epoch).claimed) continue;
+            SessionEpochDb.heads.upsert(new SessionUserKey(id), epoch);
+            return;
+        }
+        throw new Error('Session revocation conflicted; retry');
+    }
+}

package/server/auth/SessionRevocations.ts

@@ -0,0 +1,13 @@
+@data
+export class SessionDigest {
+    digest: string = '';
+    constructor(digest: string = '') { this.digest = digest; }
+}
+@data
+export class RevokedSession {
+    revoked: bool = true;
+}
+@database
+export class SessionRevocations {
+    @collection static sessions: Unique<SessionDigest, RevokedSession>;
+}

package/server/globals/auth.ts

@@ -10,6 +10,8 @@
 // and the toiljs dev-server mock).
 
 import { DataWriter, DataReader } from 'data';
+import { SessionEpochs } from 'toiljs/server/auth/SessionEpochs';
+import { SessionRevocations, SessionDigest, RevokedSession } from 'toiljs/server/auth/SessionRevocations';
 import { HmacImportParams, HmacParams, ALG_SHA_256, FMT_RAW, USAGE_SIGN, USAGE_VERIFY } from 'crypto';
 
 import {
@@ -260,7 +262,7 @@ export namespace AuthService {
     }
 
     /** Session payload format version (first byte of the sealed payload). */
-    const SESSION_VERSION: u8 = 1;
+    const SESSION_VERSION: u8 = 2;
 
     /** Default session lifetime if `mintSession` is called without a ttl. */
     export const DEFAULT_SESSION_TTL_SECS: u64 = 86400; // 24h
@@ -290,6 +292,7 @@ export namespace AuthService {
             sessionCookieName(__reqIsSecure()),
         );
         if (sealed == null) return null;
+        if (SessionRevocations.sessions.lookup(new SessionDigest(crypto.toHex(crypto.sha256Text(sealed)))) != null) return null;
 
         const payload = base64UrlDecode(sealed);
         if (payload == null) return null;
@@ -299,9 +302,13 @@ export namespace AuthService {
         r.readU64();                                     // iat (unused on read)
         const exp = r.readU64();
         const userBytes = r.readBytes();
+        const nonce = r.readBytes();
+        const generation = r.readU64();
+        if (nonce.length != 32) return null;
         if (!r.ok) return null;                          // truncated/malformed
 
         if (Time.nowSeconds() >= exp) return null;       // expired
+        if (!SessionEpochs.allowed(userBytes, generation)) return null;
 
         return userBytes;
     }
@@ -367,13 +374,17 @@ export namespace AuthService {
      * `Response.setCookie(...)`. HMAC-signed, HttpOnly, Secure, SameSite=Lax,
      * `__Host-` scoped. The value stays readable but cannot be forged or moved.
      */
-    export function mintSession(userData: Uint8Array, ttlSecs: u64 = DEFAULT_SESSION_TTL_SECS): Cookie {
+    export function mintSession(userData: Uint8Array, ttlSecs: u64 = DEFAULT_SESSION_TTL_SECS, generation: u64 = u64.MAX_VALUE): Cookie {
         const now = Time.nowSeconds();
         const w = new DataWriter();
         w.writeU8(SESSION_VERSION);
         w.writeU64(now);
         w.writeU64(now + ttlSecs);
         w.writeBytes(userData);
+        const nonce = new Uint8Array(32);
+        crypto.getRandomValues(nonce);
+        w.writeBytes(nonce);
+        w.writeU64(generation != u64.MAX_VALUE ? generation : SessionEpochs.current(userData));
 
         const secure = __reqIsSecure();
         let cookie = Cookie.create(SESSION_BASE, base64UrlEncode(w.toBytes()))
@@ -384,6 +395,20 @@ export namespace AuthService {
         return SecureCookies.signed(__resolveSessionSecret()).seal(cookie);
     }
 
+    /** Invalidate all browser sessions authorized under the prior session generation. */
+    export function revokeUserSessions(userData: Uint8Array): void {
+        SessionEpochs.revoke(userData);
+    }
+
+    /** Revoke the verified signed payload, including its unpredictable per-login nonce. */
+    export function revokeSession(): void {
+        if (!hasSession()) return;
+        const req = Server.currentRequest!;
+        const sealed = SecureCookies.signed(__resolveSessionSecret()).open(req.cookies(), sessionCookieName(__reqIsSecure()));
+        if (sealed == null) return;
+        SessionRevocations.sessions.claim(new SessionDigest(crypto.toHex(crypto.sha256Text(sealed))), new RevokedSession());
+    }
+
     /** A `Set-Cookie` that immediately clears the session (logout). */
     export function clearSession(): Cookie {
         const secure = __reqIsSecure();