mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-28 22:25:24 +00:00
372 lines
11 KiB
TypeScript
372 lines
11 KiB
TypeScript
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
|
|
|
const webauthn = vi.hoisted(() => ({
|
|
verifyRegistration: vi.fn(),
|
|
verifyAuthentication: vi.fn(),
|
|
registrationOptions: vi.fn(),
|
|
authenticationOptions: vi.fn(),
|
|
}));
|
|
|
|
vi.mock("@simplewebauthn/server", () => ({
|
|
generateRegistrationOptions: webauthn.registrationOptions,
|
|
generateAuthenticationOptions: webauthn.authenticationOptions,
|
|
verifyRegistrationResponse: webauthn.verifyRegistration,
|
|
verifyAuthenticationResponse: webauthn.verifyAuthentication,
|
|
}));
|
|
|
|
import { startServer, type TestServer } from "./helpers";
|
|
import { requestOrigin } from "../../src/backend/passkeys.js";
|
|
|
|
let server: TestServer | null = null;
|
|
|
|
beforeEach(() => {
|
|
vi.clearAllMocks();
|
|
webauthn.registrationOptions.mockImplementation(async (input) => ({
|
|
challenge: "reg-challenge",
|
|
rp: { name: input.rpName, id: input.rpID },
|
|
}));
|
|
webauthn.authenticationOptions.mockImplementation(async (input) => ({
|
|
challenge: "auth-challenge",
|
|
allowCredentials: input.allowCredentials,
|
|
}));
|
|
webauthn.verifyRegistration.mockResolvedValue({
|
|
verified: true,
|
|
registrationInfo: {
|
|
credential: {
|
|
id: "cred-1",
|
|
publicKey: new Uint8Array([1, 2, 3]),
|
|
counter: 0,
|
|
},
|
|
credentialDeviceType: "multiDevice",
|
|
credentialBackedUp: true,
|
|
},
|
|
});
|
|
webauthn.verifyAuthentication.mockResolvedValue({
|
|
verified: true,
|
|
authenticationInfo: {
|
|
newCounter: 5,
|
|
userVerified: true,
|
|
credentialBackedUp: true,
|
|
credentialDeviceType: "multiDevice",
|
|
},
|
|
});
|
|
});
|
|
|
|
afterEach(async () => {
|
|
await server?.close();
|
|
server = null;
|
|
});
|
|
|
|
function passkeyMethod(target: TestServer) {
|
|
const method = target.mock.auth.loginMethods.find(
|
|
(entry) => entry.id === "passkey",
|
|
);
|
|
if (!method?.verify) throw new Error("passkey method not registered");
|
|
return method;
|
|
}
|
|
|
|
async function registerPasskey(target: TestServer, user = "user-1") {
|
|
const options = await target.request("POST", "/register/options", {
|
|
user,
|
|
body: { userVerification: "required" },
|
|
});
|
|
expect(options.status).toBe(200);
|
|
const verify = await target.request("POST", "/register/verify", {
|
|
user,
|
|
body: {
|
|
challengeId: options.body.challengeId,
|
|
name: "Laptop",
|
|
response: { id: "cred-1", response: { transports: ["internal"] } },
|
|
},
|
|
});
|
|
expect(verify.status).toBe(200);
|
|
}
|
|
|
|
async function loginWith(
|
|
target: TestServer,
|
|
body: Record<string, unknown> = {},
|
|
) {
|
|
const options = await target.request("POST", "/authenticate/options", {
|
|
user: "",
|
|
body,
|
|
});
|
|
expect(options.status).toBe(200);
|
|
return passkeyMethod(target).verify!(
|
|
{
|
|
body: {
|
|
challengeId: options.body.challengeId,
|
|
response: { id: "cred-1" },
|
|
},
|
|
query: {},
|
|
headers: {},
|
|
},
|
|
null,
|
|
);
|
|
}
|
|
|
|
describe("registration", () => {
|
|
it("registers a passkey for the caller and lists it", async () => {
|
|
server = await startServer();
|
|
await registerPasskey(server);
|
|
|
|
expect(webauthn.registrationOptions).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
rpName: "Termix Test",
|
|
rpID: "termix.test",
|
|
userName: "user-1",
|
|
}),
|
|
);
|
|
const list = await server.request("GET", "/credentials");
|
|
expect(list.body.credentials).toEqual([
|
|
expect.objectContaining({
|
|
name: "Laptop",
|
|
deviceType: "multiDevice",
|
|
backedUp: true,
|
|
transports: ["internal"],
|
|
userVerification: "required",
|
|
}),
|
|
]);
|
|
expect(
|
|
(await server.request("GET", "/credentials", { user: "user-2" })).body
|
|
.credentials,
|
|
).toEqual([]);
|
|
});
|
|
|
|
it("refuses a challenge issued to someone else", async () => {
|
|
server = await startServer();
|
|
const options = await server.request("POST", "/register/options", {
|
|
body: {},
|
|
});
|
|
const verify = await server.request("POST", "/register/verify", {
|
|
user: "user-2",
|
|
body: { challengeId: options.body.challengeId, response: { id: "x" } },
|
|
});
|
|
expect(verify.status).toBe(400);
|
|
});
|
|
|
|
it("refuses a failed attestation", async () => {
|
|
server = await startServer();
|
|
webauthn.verifyRegistration.mockResolvedValue({ verified: false });
|
|
const options = await server.request("POST", "/register/options", {
|
|
body: {},
|
|
});
|
|
const verify = await server.request("POST", "/register/verify", {
|
|
body: { challengeId: options.body.challengeId, response: { id: "x" } },
|
|
});
|
|
expect(verify.status).toBe(400);
|
|
});
|
|
|
|
it("deletes only the caller's own passkey", async () => {
|
|
server = await startServer();
|
|
await registerPasskey(server);
|
|
const [{ id }] = (await server.request("GET", "/credentials")).body
|
|
.credentials;
|
|
await server.request("DELETE", `/credentials/${id}`, { user: "user-2" });
|
|
expect(
|
|
(await server.request("GET", "/credentials")).body.credentials,
|
|
).toHaveLength(1);
|
|
await server.request("DELETE", `/credentials/${id}`);
|
|
expect(
|
|
(await server.request("GET", "/credentials")).body.credentials,
|
|
).toHaveLength(0);
|
|
});
|
|
});
|
|
|
|
describe("login", () => {
|
|
it("says who signed in and counts a verified user as the second factor", async () => {
|
|
server = await startServer();
|
|
await registerPasskey(server);
|
|
const identity = await loginWith(server);
|
|
expect(identity).toMatchObject({
|
|
kind: "user",
|
|
userId: "user-1",
|
|
mfaSatisfied: true,
|
|
});
|
|
const row = server.db.sqlite
|
|
.prepare("SELECT counter, last_used_at FROM p_webauthn_credentials")
|
|
.get() as { counter: number; last_used_at: string | null };
|
|
expect(row.counter).toBe(5);
|
|
expect(row.last_used_at).toBeTruthy();
|
|
});
|
|
|
|
it("leaves the second factor to core when the user was not verified", async () => {
|
|
server = await startServer();
|
|
await registerPasskey(server);
|
|
webauthn.verifyAuthentication.mockResolvedValue({
|
|
verified: true,
|
|
authenticationInfo: {
|
|
newCounter: 1,
|
|
userVerified: false,
|
|
credentialBackedUp: false,
|
|
credentialDeviceType: "singleDevice",
|
|
},
|
|
});
|
|
expect(await loginWith(server)).toMatchObject({ mfaSatisfied: false });
|
|
});
|
|
|
|
it("scopes the options to a username and 404s without passkeys", async () => {
|
|
server = await startServer();
|
|
await registerPasskey(server);
|
|
const options = await server.request("POST", "/authenticate/options", {
|
|
user: "",
|
|
body: { username: "user-1" },
|
|
});
|
|
expect(options.body.options.allowCredentials).toEqual([
|
|
{ id: "cred-1", transports: ["internal"] },
|
|
]);
|
|
expect(
|
|
(
|
|
await server.request("POST", "/authenticate/options", {
|
|
user: "",
|
|
body: { username: "user-2" },
|
|
})
|
|
).status,
|
|
).toBe(404);
|
|
});
|
|
|
|
it("refuses a passkey that belongs to another user than asked for", async () => {
|
|
server = await startServer();
|
|
await registerPasskey(server);
|
|
const options = await server.request("POST", "/authenticate/options", {
|
|
user: "",
|
|
body: { username: "user-1" },
|
|
});
|
|
server.db.sqlite.exec(
|
|
"UPDATE p_webauthn_credentials SET user_id = 'user-2'",
|
|
);
|
|
await expect(
|
|
passkeyMethod(server).verify!(
|
|
{
|
|
body: {
|
|
challengeId: options.body.challengeId,
|
|
response: { id: "cred-1" },
|
|
},
|
|
query: {},
|
|
headers: {},
|
|
},
|
|
null,
|
|
),
|
|
).rejects.toMatchObject({ status: 401 });
|
|
});
|
|
|
|
it("refuses an unknown passkey and a failed assertion", async () => {
|
|
server = await startServer();
|
|
await expect(loginWith(server)).rejects.toMatchObject({ status: 401 });
|
|
await registerPasskey(server);
|
|
webauthn.verifyAuthentication.mockRejectedValue(new Error("bad sig"));
|
|
await expect(loginWith(server)).rejects.toMatchObject({ status: 401 });
|
|
});
|
|
|
|
it("uses a challenge only once", async () => {
|
|
server = await startServer();
|
|
await registerPasskey(server);
|
|
const options = await server.request("POST", "/authenticate/options", {
|
|
user: "",
|
|
body: {},
|
|
});
|
|
const request = {
|
|
body: {
|
|
challengeId: options.body.challengeId,
|
|
response: { id: "cred-1" },
|
|
},
|
|
query: {},
|
|
headers: {},
|
|
};
|
|
await passkeyMethod(server).verify!(request, null);
|
|
await expect(
|
|
passkeyMethod(server).verify!(request, null),
|
|
).rejects.toMatchObject({ status: 400 });
|
|
});
|
|
});
|
|
|
|
describe("adoption", () => {
|
|
const LEGACY = `
|
|
CREATE TABLE webauthn_credentials (
|
|
id TEXT PRIMARY KEY,
|
|
user_id TEXT NOT NULL,
|
|
name TEXT NOT NULL,
|
|
credential_id TEXT NOT NULL UNIQUE,
|
|
public_key TEXT NOT NULL,
|
|
counter INTEGER NOT NULL DEFAULT 0,
|
|
device_type TEXT,
|
|
backed_up INTEGER NOT NULL DEFAULT 0,
|
|
transports TEXT,
|
|
user_verification TEXT NOT NULL DEFAULT 'preferred',
|
|
created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
last_used_at TEXT,
|
|
FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
|
|
);`;
|
|
|
|
it("keeps existing passkeys, which still sign in", async () => {
|
|
server = await startServer({
|
|
before: (sqlite) => {
|
|
sqlite
|
|
.prepare("INSERT INTO users (id, username) VALUES (?, ?)")
|
|
.run("old-user", "old-user");
|
|
sqlite.exec(LEGACY);
|
|
sqlite.exec(`INSERT INTO webauthn_credentials
|
|
(id, user_id, name, credential_id, public_key, counter, transports)
|
|
VALUES ('p1', 'old-user', 'Old key', 'cred-1', 'AQID', 3, '[]')`);
|
|
},
|
|
});
|
|
const tables = server.db.sqlite
|
|
.prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
|
|
.all()
|
|
.map((row) => (row as { name: string }).name);
|
|
expect(tables).toContain("p_webauthn_credentials");
|
|
expect(tables).not.toContain("webauthn_credentials");
|
|
expect(await loginWith(server)).toMatchObject({ userId: "old-user" });
|
|
});
|
|
|
|
it("creates the table on a fresh install", async () => {
|
|
server = await startServer();
|
|
expect(
|
|
server.db.sqlite
|
|
.prepare("SELECT COUNT(*) AS n FROM p_webauthn_credentials")
|
|
.get(),
|
|
).toEqual({ n: 0 });
|
|
});
|
|
});
|
|
|
|
describe("capabilities", () => {
|
|
it("fails closed without auth:provide", async () => {
|
|
await expect(
|
|
startServer({
|
|
capabilities: [
|
|
"db:own",
|
|
"network:serve",
|
|
"settings:read-core",
|
|
"ui:surface",
|
|
],
|
|
}),
|
|
).rejects.toThrow(/auth:provide/);
|
|
});
|
|
|
|
it("fails closed without network:serve", async () => {
|
|
await expect(
|
|
startServer({
|
|
capabilities: [
|
|
"db:own",
|
|
"auth:provide",
|
|
"settings:read-core",
|
|
"ui:surface",
|
|
],
|
|
}),
|
|
).rejects.toThrow(/network:serve/);
|
|
});
|
|
});
|
|
|
|
describe("requestOrigin", () => {
|
|
it("prefers Origin, then forwarded host and proto", () => {
|
|
expect(requestOrigin({ origin: "https://a.test" })).toBe("https://a.test");
|
|
expect(
|
|
requestOrigin({
|
|
"x-forwarded-proto": "https, http",
|
|
"x-forwarded-host": "b.test",
|
|
host: "internal",
|
|
}),
|
|
).toBe("https://b.test");
|
|
expect(requestOrigin({ host: "c.test:8080" })).toBe("http://c.test:8080");
|
|
});
|
|
});
|