Claude
31b31c3a17
Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).
Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
(create/validate/partial-TOTP/revoke), session.middleware.js
(attachSession/requireAuth/requireRole). utils/auth.js is now a thin
compat facade so existing imports are unchanged.
Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
long-lived refresh token, stored hashed and rotated on use, in a new
mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
TOTP. token.signToken gains a backward-compatible expiresIn option.
Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
identities are never auto-provisioned. Client secrets encrypted at rest
(AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
account linking (/admin/account/identities). New auth_providers +
user_identities tables.
Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
graceful with zero providers). New Authentication admin view
(Local/Google/Discord/Custom). Account page linked-accounts section.
Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
38 lines
1.3 KiB
JavaScript
38 lines
1.3 KiB
JavaScript
process.env.SECRET_ENC_KEY = process.env.SECRET_ENC_KEY || 'unit-test-enc-key'
|
|
|
|
const { test } = require('node:test')
|
|
const assert = require('node:assert/strict')
|
|
|
|
const secretBox = require('../src/utils/secretBox')
|
|
|
|
test('encrypt → decrypt round-trips a secret', () => {
|
|
const plain = 'super-secret-oauth-client-secret'
|
|
const enc = secretBox.encrypt(plain)
|
|
assert.notEqual(enc, plain)
|
|
assert.match(enc, /^[^:]+:[^:]+:[^:]+$/) // iv:tag:ct
|
|
assert.equal(secretBox.decrypt(enc), plain)
|
|
})
|
|
|
|
test('ciphertext differs each call (random IV) but both decrypt', () => {
|
|
const a = secretBox.encrypt('x')
|
|
const b = secretBox.encrypt('x')
|
|
assert.notEqual(a, b)
|
|
assert.equal(secretBox.decrypt(a), 'x')
|
|
assert.equal(secretBox.decrypt(b), 'x')
|
|
})
|
|
|
|
test('null/blank round-trips to null', () => {
|
|
assert.equal(secretBox.encrypt(''), null)
|
|
assert.equal(secretBox.encrypt(null), null)
|
|
assert.equal(secretBox.decrypt(null), null)
|
|
assert.equal(secretBox.decrypt(''), null)
|
|
})
|
|
|
|
test('tampered ciphertext fails authentication', () => {
|
|
const enc = secretBox.encrypt('secret')
|
|
const [iv, tag, ct] = enc.split(':')
|
|
const tampered = `${iv}:${tag}:${Buffer.from('garbage').toString('base64')}`
|
|
assert.throws(() => secretBox.decrypt(tampered))
|
|
assert.throws(() => secretBox.decrypt('only:two')) // malformed
|
|
})
|