mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
301e6eb01a
Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.
886 lines
30 KiB
TypeScript
886 lines
30 KiB
TypeScript
import { randomUUID } from "node:crypto";
|
|
import { eq } from "drizzle-orm";
|
|
import * as OTPAuth from "otpauth";
|
|
import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
|
|
|
|
vi.resetModules();
|
|
const { mockEnterpriseFeatures } = await import("../../helpers/enterprise-mock.js");
|
|
mockEnterpriseFeatures(["mfa"]);
|
|
|
|
const { buildTestApp, loginAsAdmin, loginAsUser, createUserAndLogin } = await import(
|
|
"../test-server.js"
|
|
);
|
|
const { db, schema } = await import("../../../apps/api/src/db/index.js");
|
|
const { sharedRedis } = await import("../../../apps/api/src/jobs/connection.js");
|
|
|
|
import type { TestApp } from "../test-server.js";
|
|
|
|
let testApp: TestApp;
|
|
let adminToken: string;
|
|
|
|
function generateTotpCode(uri: string): string {
|
|
const totp = OTPAuth.URI.parse(uri) as OTPAuth.TOTP;
|
|
return totp.generate();
|
|
}
|
|
|
|
async function clearMfaState(username: string): Promise<void> {
|
|
await db
|
|
.update(schema.users)
|
|
.set({
|
|
totpSecret: null,
|
|
totpEnabled: false,
|
|
recoveryCodesHash: null,
|
|
updatedAt: new Date(),
|
|
})
|
|
.where(eq(schema.users.username, username));
|
|
}
|
|
|
|
beforeAll(async () => {
|
|
testApp = await buildTestApp();
|
|
adminToken = await loginAsAdmin(testApp.app);
|
|
}, 30_000);
|
|
|
|
afterAll(async () => {
|
|
await clearMfaState("admin");
|
|
await testApp.cleanup();
|
|
}, 10_000);
|
|
|
|
describe("POST /api/auth/mfa/enroll", () => {
|
|
afterEach(async () => {
|
|
await clearMfaState("admin");
|
|
});
|
|
|
|
it("returns 401 without authentication", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
});
|
|
|
|
it("returns TOTP URI and recovery codes on success", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.uri).toBeDefined();
|
|
expect(body.recoveryCodes).toBeDefined();
|
|
expect(Array.isArray(body.recoveryCodes)).toBe(true);
|
|
});
|
|
|
|
it("recovery codes array has 8 entries", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const body = JSON.parse(res.body);
|
|
expect(body.recoveryCodes).toHaveLength(8);
|
|
});
|
|
|
|
it("URI contains otpauth://totp/", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const body = JSON.parse(res.body);
|
|
expect(body.uri).toContain("otpauth://totp/");
|
|
});
|
|
|
|
it("returns 409 when MFA is already enabled", async () => {
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
const code = generateTotpCode(uri);
|
|
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code },
|
|
});
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(res.statusCode).toBe(409);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.code).toBe("MFA_ALREADY_ENABLED");
|
|
});
|
|
|
|
it("restarting enrollment after canceling (no verify in between) issues a fresh, working secret instead of 409ing", async () => {
|
|
// First attempt: user clicks Enable, sees the QR, then cancels/abandons
|
|
// without verifying. This leaves a pending, unverified secret.
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
|
|
// Second attempt: user clicks Enable again later. Must not be a dead
|
|
// end requiring an admin reset -- it should just issue a new secret.
|
|
const secondEnrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(secondEnrollRes.statusCode).toBe(200);
|
|
const { uri: secondUri } = JSON.parse(secondEnrollRes.body);
|
|
|
|
// The new secret is genuinely live: verifying with it actually works.
|
|
const code = generateTotpCode(secondUri);
|
|
const verifyRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code },
|
|
});
|
|
expect(verifyRes.statusCode).toBe(200);
|
|
});
|
|
});
|
|
|
|
describe("POST /api/auth/mfa/verify", () => {
|
|
afterEach(async () => {
|
|
await clearMfaState("admin");
|
|
});
|
|
|
|
it("returns 401 without authentication", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
payload: { code: "123456" },
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
});
|
|
|
|
it("returns 400 with missing code", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: {},
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
|
|
it("returns 401 with invalid code", async () => {
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: "000000" },
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.code).toBe("INVALID_CODE");
|
|
});
|
|
|
|
it("successfully activates MFA with correct TOTP code", async () => {
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
const code = generateTotpCode(uri);
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.ok).toBe(true);
|
|
|
|
const [dbUser] = await db.select().from(schema.users).where(eq(schema.users.username, "admin"));
|
|
expect(dbUser.totpEnabled).toBe(true);
|
|
});
|
|
|
|
it("returns 400 NO_PENDING_ENROLLMENT when no enrollment was started", async () => {
|
|
// State was cleared by afterEach, so there is no pending totpSecret.
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: "123456" },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
expect(JSON.parse(res.body).code).toBe("NO_PENDING_ENROLLMENT");
|
|
});
|
|
|
|
it("returns 409 MFA_ALREADY_ENABLED when MFA is already active", async () => {
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
const code = generateTotpCode(uri);
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code },
|
|
});
|
|
|
|
// Second verify against an already-active enrollment is a conflict.
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: generateTotpCode(uri) },
|
|
});
|
|
expect(res.statusCode).toBe(409);
|
|
expect(JSON.parse(res.body).code).toBe("MFA_ALREADY_ENABLED");
|
|
});
|
|
});
|
|
|
|
describe("POST /api/auth/mfa/disable", () => {
|
|
afterEach(async () => {
|
|
await clearMfaState("admin");
|
|
});
|
|
|
|
it("returns 401 without authentication", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/disable",
|
|
payload: { code: "123456" },
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
});
|
|
|
|
it("returns 400 with missing code", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/disable",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: {},
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
|
|
it("returns 400 MFA_NOT_ENABLED when MFA was never activated", async () => {
|
|
// afterEach clears state, so totpEnabled is false here.
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/disable",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: "123456" },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
expect(JSON.parse(res.body).code).toBe("MFA_NOT_ENABLED");
|
|
});
|
|
|
|
it("returns 401 INVALID_CODE when the TOTP code is wrong", async () => {
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: generateTotpCode(uri) },
|
|
});
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/disable",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: "000000" },
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
expect(JSON.parse(res.body).code).toBe("INVALID_CODE");
|
|
});
|
|
|
|
it("clears all MFA data on success with a valid TOTP code", async () => {
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: generateTotpCode(uri) },
|
|
});
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/disable",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: generateTotpCode(uri) },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
expect(JSON.parse(res.body).ok).toBe(true);
|
|
|
|
const [dbUser] = await db.select().from(schema.users).where(eq(schema.users.username, "admin"));
|
|
expect(dbUser.totpEnabled).toBe(false);
|
|
expect(dbUser.totpSecret).toBeNull();
|
|
expect(dbUser.recoveryCodesHash).toBeNull();
|
|
});
|
|
});
|
|
|
|
describe("POST /api/auth/users/:id/mfa/reset", () => {
|
|
it("returns 401 without authentication", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/users/nonexistent-id/mfa/reset",
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
});
|
|
|
|
it("returns 403 for non-admin users", async () => {
|
|
const regRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/register",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { username: "mfa_regular_user", password: "TestPass1", role: "user" },
|
|
});
|
|
const userId = JSON.parse(regRes.body).id;
|
|
|
|
await db
|
|
.update(schema.users)
|
|
.set({ mustChangePassword: false })
|
|
.where(eq(schema.users.username, "mfa_regular_user"));
|
|
|
|
const loginRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "mfa_regular_user", password: "TestPass1" },
|
|
});
|
|
const userToken = JSON.parse(loginRes.body).token;
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${userId}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${userToken}` },
|
|
});
|
|
expect(res.statusCode).toBe(403);
|
|
});
|
|
|
|
it("returns 404 NOT_FOUND for an unknown target user", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${randomUUID()}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(res.statusCode).toBe(404);
|
|
expect(JSON.parse(res.body).code).toBe("NOT_FOUND");
|
|
});
|
|
|
|
it("returns 400 MFA_NOT_ENABLED when the target has no MFA", async () => {
|
|
const { userId } = await createUserAndLogin(testApp.app, "mfa_reset_no_mfa_user", "user");
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${userId}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
expect(JSON.parse(res.body).code).toBe("MFA_NOT_ENABLED");
|
|
|
|
await db.delete(schema.users).where(eq(schema.users.id, userId));
|
|
});
|
|
|
|
it("returns 403 ESCALATION_DENIED when a scoped admin key can't manage the target role", async () => {
|
|
// A second admin is the target. The actor is the built-in admin, but acting
|
|
// through an API key scoped to ONLY users:manage: it passes the route's
|
|
// permission gate yet lacks the full admin permission set, so it cannot
|
|
// manage another admin. This is the real authority-boundary path (#618).
|
|
const { userId: targetAdminId } = await createUserAndLogin(
|
|
testApp.app,
|
|
"mfa_reset_target_admin",
|
|
"admin",
|
|
);
|
|
|
|
const keyRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/api-keys",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name: "scoped-users-manage", permissions: ["users:manage"] },
|
|
});
|
|
expect(keyRes.statusCode).toBe(201);
|
|
const { key: scopedKey, id: scopedKeyId } = JSON.parse(keyRes.body);
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${targetAdminId}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${scopedKey}` },
|
|
});
|
|
expect(res.statusCode).toBe(403);
|
|
expect(JSON.parse(res.body).code).toBe("ESCALATION_DENIED");
|
|
|
|
// Delete the target admin (cascades its sessions) and the stray scoped key
|
|
// so neither leaks into other suites sharing the fork DB.
|
|
await db.delete(schema.users).where(eq(schema.users.id, targetAdminId));
|
|
await db.delete(schema.apiKeys).where(eq(schema.apiKeys.id, scopedKeyId));
|
|
});
|
|
|
|
it("clears MFA data for a target user on success", async () => {
|
|
const username = "mfa_reset_target_user";
|
|
const { userId, token: userToken } = await createUserAndLogin(testApp.app, username, "user");
|
|
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${userToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${userToken}` },
|
|
payload: { code: generateTotpCode(uri) },
|
|
});
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${userId}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
expect(JSON.parse(res.body).ok).toBe(true);
|
|
|
|
const [dbUser] = await db.select().from(schema.users).where(eq(schema.users.id, userId));
|
|
expect(dbUser.totpEnabled).toBe(false);
|
|
expect(dbUser.totpSecret).toBeNull();
|
|
expect(dbUser.recoveryCodesHash).toBeNull();
|
|
|
|
await db.delete(schema.users).where(eq(schema.users.id, userId));
|
|
});
|
|
});
|
|
|
|
describe("GET /api/auth/session totpEnabled", () => {
|
|
afterEach(async () => {
|
|
await clearMfaState("admin");
|
|
});
|
|
|
|
it("is false when the user has not enrolled", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "GET",
|
|
url: "/api/auth/session",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.user.totpEnabled).toBe(false);
|
|
});
|
|
|
|
it("is true once the user has completed enrollment", async () => {
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
const code = generateTotpCode(uri);
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code },
|
|
});
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "GET",
|
|
url: "/api/auth/session",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const body = JSON.parse(res.body);
|
|
expect(body.user.totpEnabled).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("MFA login flow", () => {
|
|
let totpUri: string;
|
|
|
|
beforeAll(async () => {
|
|
await clearMfaState("admin");
|
|
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
totpUri = JSON.parse(enrollRes.body).uri;
|
|
const code = generateTotpCode(totpUri);
|
|
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code },
|
|
});
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await clearMfaState("admin");
|
|
});
|
|
|
|
it("login returns requiresMfa with mfaToken when MFA is enabled", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "admin", password: "Adminpass1" },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.requiresMfa).toBe(true);
|
|
expect(body.mfaToken).toBeDefined();
|
|
expect(typeof body.mfaToken).toBe("string");
|
|
expect(body.token).toBeUndefined();
|
|
});
|
|
|
|
it("POST /api/auth/mfa/complete with valid mfaToken and TOTP code creates session", async () => {
|
|
const loginRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "admin", password: "Adminpass1" },
|
|
});
|
|
const { mfaToken } = JSON.parse(loginRes.body);
|
|
|
|
const code = generateTotpCode(totpUri);
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
payload: { mfaToken, code },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.token).toBeDefined();
|
|
expect(typeof body.token).toBe("string");
|
|
expect(body.user).toBeDefined();
|
|
expect(body.user.username).toBe("admin");
|
|
expect(body.expiresAt).toBeDefined();
|
|
});
|
|
|
|
it("burns the challenge after repeated wrong codes so the correct code no longer works", async () => {
|
|
const loginRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "admin", password: "Adminpass1" },
|
|
});
|
|
const { mfaToken } = JSON.parse(loginRes.body);
|
|
|
|
// Exhaust the wrong-code budget. Each wrong attempt is a 401.
|
|
for (let i = 0; i < 5; i++) {
|
|
const bad = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
payload: { mfaToken, code: "000000" },
|
|
});
|
|
expect(bad.statusCode).toBe(401);
|
|
}
|
|
|
|
// The challenge is now burned: even the correct TOTP is rejected as expired,
|
|
// forcing the attacker back through the login (and its rate limit).
|
|
const code = generateTotpCode(totpUri);
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
payload: { mfaToken, code },
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
expect(JSON.parse(res.body).code).toBe("MFA_EXPIRED");
|
|
});
|
|
});
|
|
|
|
describe("POST /api/auth/mfa/complete edge cases", () => {
|
|
afterEach(async () => {
|
|
await clearMfaState("admin");
|
|
});
|
|
|
|
it("returns 400 VALIDATION_ERROR when mfaToken is not a uuid", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
payload: { mfaToken: "not-a-uuid", code: "123456" },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
expect(JSON.parse(res.body).code).toBe("VALIDATION_ERROR");
|
|
});
|
|
|
|
it("returns 401 MFA_EXPIRED for an unknown challenge token", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
// Valid uuid shape so it passes Zod, but no Redis entry backs it.
|
|
payload: { mfaToken: randomUUID(), code: "123456" },
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
expect(JSON.parse(res.body).code).toBe("MFA_EXPIRED");
|
|
});
|
|
|
|
it("returns 401 MFA_NOT_CONFIGURED when the challenged user has no TOTP secret", async () => {
|
|
// A live challenge token whose user never finished enrollment (no secret).
|
|
const [dbUser] = await db.select().from(schema.users).where(eq(schema.users.username, "admin"));
|
|
const mfaToken = randomUUID();
|
|
await sharedRedis().setex(`mfa:${mfaToken}`, 300, dbUser.id);
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
payload: { mfaToken, code: "123456" },
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
expect(JSON.parse(res.body).code).toBe("MFA_NOT_CONFIGURED");
|
|
await sharedRedis().del(`mfa:${mfaToken}`);
|
|
});
|
|
|
|
it("returns 401 MFA_NOT_CONFIGURED when the challenged user's role is disabled", async () => {
|
|
// Enroll + verify a disposable user so it has a real secret, then disable
|
|
// its role. The disabled-role guard must reject even with a valid secret.
|
|
const username = "mfa_disabled_complete_user";
|
|
const { userId, token: userToken } = await createUserAndLogin(testApp.app, username, "user");
|
|
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${userToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${userToken}` },
|
|
payload: { code: generateTotpCode(uri) },
|
|
});
|
|
|
|
await db.update(schema.users).set({ role: "disabled" }).where(eq(schema.users.id, userId));
|
|
|
|
const mfaToken = randomUUID();
|
|
await sharedRedis().setex(`mfa:${mfaToken}`, 300, userId);
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
payload: { mfaToken, code: generateTotpCode(uri) },
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
expect(JSON.parse(res.body).code).toBe("MFA_NOT_CONFIGURED");
|
|
|
|
await sharedRedis().del(`mfa:${mfaToken}`);
|
|
await db.delete(schema.users).where(eq(schema.users.id, userId));
|
|
});
|
|
|
|
it("completes login with a recovery code and consumes it", async () => {
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const { uri, recoveryCodes } = JSON.parse(enrollRes.body);
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { code: generateTotpCode(uri) },
|
|
});
|
|
|
|
const loginRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "admin", password: "Adminpass1" },
|
|
});
|
|
const { mfaToken } = JSON.parse(loginRes.body);
|
|
|
|
// Use a recovery code (not the TOTP) to complete: hits the recoveryUsed path.
|
|
const recoveryCode = recoveryCodes[0];
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
payload: { mfaToken, code: recoveryCode },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.token).toBeDefined();
|
|
expect(body.user.username).toBe("admin");
|
|
|
|
// The recovery code was consumed: the stored hash list dropped one entry.
|
|
const [dbUser] = await db.select().from(schema.users).where(eq(schema.users.username, "admin"));
|
|
expect(dbUser.recoveryCodesHash).not.toBeNull();
|
|
const remaining = (dbUser.recoveryCodesHash ?? "").split(",").filter(Boolean);
|
|
expect(remaining).toHaveLength(recoveryCodes.length - 1);
|
|
});
|
|
|
|
it("burns the last remaining recovery code to an empty stored list", async () => {
|
|
// Enroll a fresh user, then overwrite its stored recovery hash with a
|
|
// single known code so the consume path collapses to the empty-string
|
|
// (`|| null`) branch.
|
|
const username = "mfa_last_recovery_user";
|
|
const { userId, token: userToken } = await createUserAndLogin(testApp.app, username, "user");
|
|
|
|
const enrollRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/enroll",
|
|
headers: { authorization: `Bearer ${userToken}` },
|
|
});
|
|
const { uri } = JSON.parse(enrollRes.body);
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/verify",
|
|
headers: { authorization: `Bearer ${userToken}` },
|
|
payload: { code: generateTotpCode(uri) },
|
|
});
|
|
|
|
const { createHash } = await import("node:crypto");
|
|
const singleCode = "lastcode";
|
|
const singleHash = createHash("sha256").update(singleCode).digest("hex");
|
|
await db
|
|
.update(schema.users)
|
|
.set({ recoveryCodesHash: singleHash })
|
|
.where(eq(schema.users.id, userId));
|
|
|
|
const mfaToken = randomUUID();
|
|
await sharedRedis().setex(`mfa:${mfaToken}`, 300, userId);
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/mfa/complete",
|
|
payload: { mfaToken, code: singleCode },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
|
|
// Consuming the only code leaves an empty string -> stored as null.
|
|
const [dbUser] = await db.select().from(schema.users).where(eq(schema.users.id, userId));
|
|
expect(dbUser.recoveryCodesHash).toBeNull();
|
|
|
|
await sharedRedis().del(`mfa:${mfaToken}`);
|
|
await db.delete(schema.users).where(eq(schema.users.id, userId));
|
|
});
|
|
});
|
|
|
|
async function setMfaPolicy(value: "optional" | "admins_only" | "required"): Promise<void> {
|
|
await db
|
|
.insert(schema.settings)
|
|
.values({ key: "mfaPolicy", value })
|
|
.onConflictDoUpdate({ target: schema.settings.key, set: { value } });
|
|
}
|
|
|
|
// This is the actual fix for #515/#529: exercises the real /api/auth/login
|
|
// route end to end, not a mocked response. Everything else in this repo that
|
|
// covers this bug (the license gate on saving the setting, the frontend's
|
|
// handling of a stubbed 403) would still pass if this exact backend branch
|
|
// were reverted or its response code were renamed.
|
|
describe("POST /api/auth/login with mfaPolicy enforcement", () => {
|
|
afterEach(async () => {
|
|
await setMfaPolicy("optional");
|
|
await clearMfaState("admin");
|
|
});
|
|
|
|
it("blocks an unenrolled admin with 403 MFA_ENROLLMENT_REQUIRED when policy is required", async () => {
|
|
await setMfaPolicy("required");
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "admin", password: "Adminpass1" },
|
|
});
|
|
|
|
expect(res.statusCode).toBe(403);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.code).toBe("MFA_ENROLLMENT_REQUIRED");
|
|
expect(body.token).toBeUndefined();
|
|
});
|
|
|
|
it("blocks an unenrolled admin under an admins_only policy", async () => {
|
|
await setMfaPolicy("admins_only");
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "admin", password: "Adminpass1" },
|
|
});
|
|
|
|
expect(res.statusCode).toBe(403);
|
|
expect(JSON.parse(res.body).code).toBe("MFA_ENROLLMENT_REQUIRED");
|
|
});
|
|
|
|
it("does not block a non-admin user under an admins_only policy", async () => {
|
|
// Ensure the shared test user exists while policy is still permissive.
|
|
await loginAsUser(testApp.app);
|
|
await setMfaPolicy("admins_only");
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "plainuser", password: "Userpass1" },
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
expect(JSON.parse(res.body).token).toBeDefined();
|
|
});
|
|
|
|
it("does not block anyone when policy is optional", async () => {
|
|
await setMfaPolicy("optional");
|
|
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: "admin", password: "Adminpass1" },
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
expect(JSON.parse(res.body).token).toBeDefined();
|
|
});
|
|
});
|
|
|
|
// The mirror image of tests/integration/platform/mfa-policy-license-gate.test.ts
|
|
// (which proves an UNlicensed instance can't save this policy). This file is
|
|
// already licensed (mockEnterpriseFeatures(["mfa"]) above), so it proves the
|
|
// gate doesn't also accidentally block a legitimately licensed instance.
|
|
describe("PUT /api/v1/settings mfaPolicy (licensed)", () => {
|
|
afterEach(async () => {
|
|
await setMfaPolicy("optional");
|
|
});
|
|
|
|
it("allows saving required when mfa is licensed", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: "/api/v1/settings",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { mfaPolicy: "required" },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
|
|
const check = await testApp.app.inject({
|
|
method: "GET",
|
|
url: "/api/v1/settings/mfaPolicy",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(JSON.parse(check.body).value).toBe("required");
|
|
});
|
|
|
|
it("allows saving admins_only when mfa is licensed", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: "/api/v1/settings",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { mfaPolicy: "admins_only" },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
});
|