ui-syncup 0.3.13 → 0.4.0-beta.2

package/src/server/auth/__tests__/verify-email.property.test.ts

@@ -0,0 +1,372 @@
+/**
+ * Property-Based Tests for Email Verification
+ * 
+ * Tests correctness properties for the email verification flow using fast-check.
+ * Each test runs 100+ iterations with randomly generated inputs.
+ * 
+ * @module server/auth/__tests__/verify-email.property.test
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fc from 'fast-check';
+import { db } from '@/lib/db';
+import { users, verificationTokens } from '@/server/db/schema';
+import { generateToken, verifyToken, markTokenAsUsed } from '@/server/auth/tokens';
+import { hashPassword } from '@/server/auth/password';
+import { eq, and } from 'drizzle-orm';
+
+/**
+ * Property test configuration
+ * Run each property 100 times with different random inputs
+ */
+const propertyConfig = { numRuns: 25 };
+
+/**
+ * Generators for test data
+ */
+
+// Generate valid email addresses
+const emailArb = fc.emailAddress();
+
+// Generate valid passwords (8+ chars, uppercase, lowercase, number, special)
+const passwordArb = fc
+  .string({ minLength: 8, maxLength: 50 })
+  .filter((s) => {
+    return (
+      /[A-Z]/.test(s) &&
+      /[a-z]/.test(s) &&
+      /[0-9]/.test(s) &&
+      /[^A-Za-z0-9]/.test(s)
+    );
+  });
+
+// Generate valid names
+const nameArb = fc
+  .string({ minLength: 1, maxLength: 120 })
+  .filter((s) => s.trim().length > 0 && !s.includes("\\"));
+
+// Generate complete user data
+const userDataArb = fc.record({
+  email: emailArb,
+  password: passwordArb,
+  name: nameArb,
+});
+
+/**
+ * Helper function to create a test user
+ */
+async function createTestUser(data: { email: string; password: string; name: string }) {
+  const passwordHash = await hashPassword(data.password);
+  const uniqueEmail = `${Date.now()}-${Math.random()}-${data.email.toLowerCase().trim()}`;
+  const trimmedName = data.name.trim();
+  
+  const [user] = await db
+    .insert(users)
+    .values({
+      email: uniqueEmail,
+      name: trimmedName,
+      passwordHash,
+      emailVerified: false,
+    })
+    .returning({
+      id: users.id,
+      email: users.email,
+      name: users.name,
+      emailVerified: users.emailVerified,
+    });
+  
+  return user;
+}
+
+/**
+ * Helper function to clean up test data
+ */
+async function cleanupTestUser(userId: string) {
+  // Delete verification tokens first (foreign key constraint)
+  await db
+    .delete(verificationTokens)
+    .where(eq(verificationTokens.userId, userId));
+  
+  // Delete user
+  await db
+    .delete(users)
+    .where(eq(users.id, userId));
+}
+
+describe('Property 5: Valid verification marks user as verified', () => {
+  /**
+   * Feature: authentication-system, Property 5: Valid verification marks user as verified
+   * Validates: Requirements 2.1
+   * 
+   * For any user with a valid verification token, using the token should mark
+   * the user's emailVerified field as true.
+   */
+  
+  const testUserIds: string[] = [];
+  
+  afterEach(async () => {
+    // Clean up all test users created during tests
+    for (const userId of testUserIds) {
+      try {
+        await cleanupTestUser(userId);
+      } catch (error) {
+        // Ignore cleanup errors
+      }
+    }
+    testUserIds.length = 0;
+  });
+  
+  it('should mark user as verified when using valid token', async () => {
+    await fc.assert(
+      fc.asyncProperty(userDataArb, async (userData) => {
+        // Create test user
+        const user = await createTestUser(userData);
+        testUserIds.push(user.id);
+        
+        // Property 1: User should start as unverified
+        expect(user.emailVerified).toBe(false);
+        
+        // Generate verification token
+        const tokenResult = await generateToken(
+          user.id,
+          'email_verification',
+          24 * 60 * 60 * 1000 // 24 hours
+        );
+        
+        // Property 2: Token should be valid
+        const verified = await verifyToken(tokenResult.token, 'email_verification');
+        expect(verified).not.toBeNull();
+        expect(verified?.userId).toBe(user.id);
+        
+        // Mark user as verified (simulating the verify-email endpoint)
+        await db
+          .update(users)
+          .set({ 
+            emailVerified: true,
+            updatedAt: new Date(),
+          })
+          .where(eq(users.id, user.id));
+        
+        // Mark token as used
+        await markTokenAsUsed(tokenResult.tokenId);
+        
+        // Property 3: User should now be verified
+        const [updatedUser] = await db
+          .select({ emailVerified: users.emailVerified })
+          .from(users)
+          .where(eq(users.id, user.id))
+          .limit(1);
+        
+        expect(updatedUser.emailVerified).toBe(true);
+        
+        // Property 4: Token should be marked as used
+        const [usedToken] = await db
+          .select({ usedAt: verificationTokens.usedAt })
+          .from(verificationTokens)
+          .where(eq(verificationTokens.id, tokenResult.tokenId))
+          .limit(1);
+        
+        expect(usedToken.usedAt).not.toBeNull();
+        
+        // Property 5: Used token should not verify again
+        const verifiedAgain = await verifyToken(tokenResult.token, 'email_verification');
+        expect(verifiedAgain).toBeNull();
+      }),
+      propertyConfig
+    );
+  }, 60000); // 60 second timeout
+  
+  it('should not verify user with expired token', async () => {
+    await fc.assert(
+      fc.asyncProperty(userDataArb, async (userData) => {
+        // Create test user
+        const user = await createTestUser(userData);
+        testUserIds.push(user.id);
+        
+        // Generate verification token with very short expiration (1ms)
+        const tokenResult = await generateToken(
+          user.id,
+          'email_verification',
+          1 // 1 millisecond
+        );
+        
+        // Wait for token to expire
+        await new Promise(resolve => setTimeout(resolve, 10));
+        
+        // Property: Expired token should not verify
+        const verified = await verifyToken(tokenResult.token, 'email_verification');
+        expect(verified).toBeNull();
+        
+        // Property: User should remain unverified
+        const [currentUser] = await db
+          .select({ emailVerified: users.emailVerified })
+          .from(users)
+          .where(eq(users.id, user.id))
+          .limit(1);
+        
+        expect(currentUser.emailVerified).toBe(false);
+      }),
+      { numRuns: 10 } // Fewer runs due to setTimeout
+    );
+  }, 60000);
+  
+  it('should not verify user with already-used token', async () => {
+    await fc.assert(
+      fc.asyncProperty(userDataArb, async (userData) => {
+        // Create test user
+        const user = await createTestUser(userData);
+        testUserIds.push(user.id);
+        
+        // Generate verification token
+        const tokenResult = await generateToken(
+          user.id,
+          'email_verification',
+          24 * 60 * 60 * 1000
+        );
+        
+        // Verify token (first time)
+        const verified1 = await verifyToken(tokenResult.token, 'email_verification');
+        expect(verified1).not.toBeNull();
+        
+        // Mark token as used
+        await markTokenAsUsed(tokenResult.tokenId);
+        
+        // Property: Used token should not verify again
+        const verified2 = await verifyToken(tokenResult.token, 'email_verification');
+        expect(verified2).toBeNull();
+      }),
+      propertyConfig
+    );
+  }, 60000);
+  
+  it('should not verify user with invalid token signature', async () => {
+    await fc.assert(
+      fc.asyncProperty(userDataArb, fc.string({ minLength: 10, maxLength: 100 }), async (userData, randomString) => {
+        // Create test user
+        const user = await createTestUser(userData);
+        testUserIds.push(user.id);
+        
+        // Generate valid token
+        const tokenResult = await generateToken(
+          user.id,
+          'email_verification',
+          24 * 60 * 60 * 1000
+        );
+        
+        // Tamper with token by appending random string
+        const tamperedToken = tokenResult.token + randomString;
+        
+        // Property: Tampered token should not verify
+        const verified = await verifyToken(tamperedToken, 'email_verification');
+        expect(verified).toBeNull();
+        
+        // Property: User should remain unverified
+        const [currentUser] = await db
+          .select({ emailVerified: users.emailVerified })
+          .from(users)
+          .where(eq(users.id, user.id))
+          .limit(1);
+        
+        expect(currentUser.emailVerified).toBe(false);
+      }),
+      propertyConfig
+    );
+  }, 60000);
+  
+  it('should handle verification idempotently for already-verified users', async () => {
+    await fc.assert(
+      fc.asyncProperty(userDataArb, async (userData) => {
+        // Create test user
+        const user = await createTestUser(userData);
+        testUserIds.push(user.id);
+        
+        // Generate verification token
+        const tokenResult = await generateToken(
+          user.id,
+          'email_verification',
+          24 * 60 * 60 * 1000
+        );
+        
+        // Verify user (first time)
+        const verified1 = await verifyToken(tokenResult.token, 'email_verification');
+        expect(verified1).not.toBeNull();
+        
+        await db
+          .update(users)
+          .set({ 
+            emailVerified: true,
+            updatedAt: new Date(),
+          })
+          .where(eq(users.id, user.id));
+        
+        await markTokenAsUsed(tokenResult.tokenId);
+        
+        // Property: User should be verified
+        const [verifiedUser] = await db
+          .select({ emailVerified: users.emailVerified })
+          .from(users)
+          .where(eq(users.id, user.id))
+          .limit(1);
+        
+        expect(verifiedUser.emailVerified).toBe(true);
+        
+        // Property: Attempting to verify again should be idempotent (user stays verified)
+        // Even though token is used, user should remain verified
+        const [stillVerifiedUser] = await db
+          .select({ emailVerified: users.emailVerified })
+          .from(users)
+          .where(eq(users.id, user.id))
+          .limit(1);
+        
+        expect(stillVerifiedUser.emailVerified).toBe(true);
+      }),
+      propertyConfig
+    );
+  }, 60000);
+  
+  it('should preserve user data when marking as verified', async () => {
+    await fc.assert(
+      fc.asyncProperty(userDataArb, async (userData) => {
+        // Create test user
+        const user = await createTestUser(userData);
+        testUserIds.push(user.id);
+        
+        // Generate verification token
+        const tokenResult = await generateToken(
+          user.id,
+          'email_verification',
+          24 * 60 * 60 * 1000
+        );
+        
+        // Verify token
+        const verified = await verifyToken(tokenResult.token, 'email_verification');
+        expect(verified).not.toBeNull();
+        
+        // Mark user as verified
+        await db
+          .update(users)
+          .set({ 
+            emailVerified: true,
+            updatedAt: new Date(),
+          })
+          .where(eq(users.id, user.id));
+        
+        // Property: User data should be preserved (email, name, passwordHash)
+        const [updatedUser] = await db
+          .select({
+            email: users.email,
+            name: users.name,
+            emailVerified: users.emailVerified,
+          })
+          .from(users)
+          .where(eq(users.id, user.id))
+          .limit(1);
+        
+        expect(updatedUser.email).toBe(user.email);
+        expect(updatedUser.name).toBe(user.name);
+        expect(updatedUser.emailVerified).toBe(true);
+      }),
+      propertyConfig
+    );
+  }, 60000);
+});

package/src/server/auth/cookies.ts

@@ -0,0 +1,184 @@
+/**
+ * Cookie management utilities for session handling
+ * 
+ * This module provides secure cookie operations for session management,
+ * implementing security best practices including HTTP-only, Secure, and
+ * SameSite attributes.
+ * 
+ * Security features:
+ * - HTTP-only: Prevents JavaScript access to cookies
+ * - Secure: Requires HTTPS in production
+ * - SameSite=Lax: Prevents CSRF attacks while allowing normal navigation
+ * - 7-day expiration: Balances security and user experience
+ * 
+ * @module server/auth/cookies
+ */
+
+
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+import { env, isProduction } from '@/lib/env';
+
+/**
+ * Cookie configuration constants
+ */
+const SESSION_COOKIE_NAME = 'session_token';
+const BETTER_AUTH_COOKIE_NAME = 'better-auth.session_token';
+const SESSION_MAX_AGE = 7 * 24 * 60 * 60; // 7 days in seconds
+
+/**
+ * Cookie options for session cookies
+ * Implements security best practices for session management
+ */
+const COOKIE_OPTIONS = {
+  httpOnly: true,           // Prevent JavaScript access
+  secure: isProduction(),   // Require HTTPS in production
+  sameSite: 'lax' as const, // CSRF protection
+  maxAge: SESSION_MAX_AGE,  // 7 days
+  path: '/',                // Available across entire site
+} as const;
+
+/**
+ * Sets a session cookie in the HTTP response
+ * 
+ * This function adds a session cookie to the response with secure attributes.
+ * The cookie will be HTTP-only, Secure (in production), and use SameSite=Lax
+ * to prevent CSRF attacks.
+ * 
+ * @param response - The NextResponse object to set the cookie on
+ * @param sessionToken - The session token value to store
+ * @returns The modified NextResponse object (for chaining)
+ * 
+ * @example
+ * ```typescript
+ * // In an API route handler
+ * export async function POST(request: Request) {
+ *   const session = await createSession(userId);
+ *   const response = NextResponse.json({ success: true });
+ *   return setSessionCookie(response, session.token);
+ * }
+ * ```
+ */
+export function setSessionCookie(
+  response: NextResponse,
+  sessionToken: string
+): NextResponse {
+  // Trim whitespace and validate
+  const trimmedToken = sessionToken?.trim() ?? '';
+  
+  if (!trimmedToken || trimmedToken.length === 0) {
+    throw new Error('Session token cannot be empty');
+  }
+
+  response.cookies.set(SESSION_COOKIE_NAME, trimmedToken, COOKIE_OPTIONS);
+  
+  return response;
+}
+
+/**
+ * Gets the session cookie value from the current request
+ * 
+ * This function reads the session cookie from the incoming request.
+ * It checks both the custom session cookie and the better-auth session cookie.
+ * It should be called from server components or API routes.
+ * 
+ * @returns The session token string if present, null otherwise
+ * 
+ * @example
+ * ```typescript
+ * // In a server component or API route
+ * const sessionToken = getSessionCookie();
+ * if (!sessionToken) {
+ *   redirect('/sign-in');
+ * }
+ * ```
+ */
+export async function getSessionCookie(): Promise<string | null> {
+  const cookieStore = await cookies();
+  
+  // First check for our custom session cookie
+  const sessionCookie = cookieStore.get(SESSION_COOKIE_NAME);
+  if (sessionCookie?.value) {
+    return sessionCookie.value;
+  }
+  
+  // If not found, check for better-auth session cookie (used for OAuth)
+  // better-auth might verify prefixes, but we just need the token value for validation
+  const betterAuthCookie = cookieStore.get(BETTER_AUTH_COOKIE_NAME);
+  return betterAuthCookie?.value ?? null;
+}
+
+/**
+ * Clears the session cookie from the HTTP response
+ * 
+ * This function removes the session cookie by setting it with an expired
+ * date and empty value. This is used during sign-out to invalidate the
+ * client-side session. It clears bot custom and better-auth cookies.
+ * 
+ * @param response - The NextResponse object to clear the cookie from
+ * @returns The modified NextResponse object (for chaining)
+ * 
+ * @example
+ * ```typescript
+ * // In a sign-out API route
+ * export async function POST(request: Request) {
+ *   await deleteSession(sessionId);
+ *   const response = NextResponse.json({ message: 'Signed out successfully' });
+ *   return clearSessionCookie(response);
+ * }
+ * ```
+ */
+export function clearSessionCookie(response: NextResponse): NextResponse {
+  // Clear custom session cookie
+  response.cookies.set(SESSION_COOKIE_NAME, '', {
+    httpOnly: true,
+    secure: isProduction(),
+    sameSite: 'lax',
+    maxAge: 0,        // Expire immediately
+    path: '/',
+  });
+
+  // Clear better-auth session cookie
+  response.cookies.set(BETTER_AUTH_COOKIE_NAME, '', {
+    httpOnly: true,
+    secure: isProduction(),
+    sameSite: 'lax',
+    maxAge: 0,
+    path: '/',
+  });
+  
+  return response;
+}
+
+/**
+ * Gets the session cookie name
+ * Useful for testing and debugging
+ * 
+ * @returns The name of the session cookie
+ * 
+ */
+export function getSessionCookieName(): string {
+  return SESSION_COOKIE_NAME;
+}
+
+/**
+ * Gets the session cookie max age in seconds
+ * Useful for session expiration calculations
+ * 
+ * @returns The max age of session cookies in seconds (7 days)
+ */
+export function getSessionMaxAge(): number {
+  return SESSION_MAX_AGE;
+}
+
+/**
+ * Gets the team ID from the cookie
+ * 
+ * @returns The team ID string if present, null otherwise
+ */
+export async function getTeamIdCookie(): Promise<string | null> {
+  const cookieStore = await cookies();
+  const teamIdCookie = cookieStore.get('team_id');
+  
+  return teamIdCookie?.value ?? null;
+}

package/src/server/auth/password.ts

@@ -0,0 +1,94 @@
+/**
+ * Password hashing utilities using Argon2id
+ * 
+ * This module provides secure password hashing and verification using the Argon2id
+ * algorithm with appropriate security parameters.
+ * 
+ * Security parameters:
+ * - Algorithm: Argon2id (hybrid mode, resistant to both side-channel and GPU attacks)
+ * - Memory cost: 65536 KiB (64 MiB)
+ * - Iterations: 3
+ * - Parallelism: 1 (default)
+ * 
+ * @module server/auth/password
+ */
+
+import { hash, verify } from '@node-rs/argon2';
+
+/**
+ * Argon2id configuration parameters
+ * These values follow OWASP recommendations for password storage
+ */
+const ARGON2_OPTIONS = {
+  memoryCost: 65536, // 64 MiB
+  timeCost: 3,       // 3 iterations
+  outputLen: 32,     // 32 bytes output
+} as const;
+
+/**
+ * Hashes a plaintext password using Argon2id
+ * 
+ * @param password - The plaintext password to hash
+ * @returns A promise that resolves to the hashed password string
+ * @throws {Error} If password is empty or hashing fails
+ * 
+ * @example
+ * ```typescript
+ * const hash = await hashPassword('MySecurePassword123!');
+ * // Returns: $argon2id$v=19$m=65536,t=3,p=1$...
+ * ```
+ */
+export async function hashPassword(password: string): Promise<string> {
+  if (!password || password.length === 0) {
+    throw new Error('Password cannot be empty');
+  }
+
+  try {
+    const hashedPassword = await hash(password, ARGON2_OPTIONS);
+    return hashedPassword;
+  } catch (error) {
+    throw new Error(
+      `Failed to hash password: ${error instanceof Error ? error.message : 'Unknown error'}`
+    );
+  }
+}
+
+/**
+ * Verifies a plaintext password against a hashed password
+ * 
+ * Uses constant-time comparison to prevent timing attacks
+ * 
+ * @param password - The plaintext password to verify
+ * @param hash - The hashed password to compare against
+ * @returns A promise that resolves to true if the password matches, false otherwise
+ * @throws {Error} If verification fails due to invalid hash format
+ * 
+ * @example
+ * ```typescript
+ * const isValid = await verifyPassword('MySecurePassword123!', storedHash);
+ * if (isValid) {
+ *   // Password is correct
+ * }
+ * ```
+ */
+export async function verifyPassword(
+  password: string,
+  hash: string
+): Promise<boolean> {
+  if (!password || password.length === 0) {
+    return false;
+  }
+
+  if (!hash || hash.length === 0) {
+    return false;
+  }
+
+  try {
+    const isValid = await verify(hash, password);
+    return isValid;
+  } catch (error) {
+    // Invalid hash format or verification error
+    // Return false instead of throwing to prevent information leakage
+    return false;
+  }
+}