Claude
03e62b56ad
SSO login minted a full session immediately, ignoring the account's totp_enabled flag — so a 2FA admin with a linked Google/Discord/OIDC identity could sign in without their authenticator code, silently downgrading the account to single-factor (the strength of the IdP login). The local password flow already gates on needsTotp(); SSO did not. Wire SSO through the same staged-TOTP gate: - ssoState: createTotpPending/verifyTotpPending + a short-lived httpOnly sso_totp cookie. The pending token carries stage:'totp' (session validation rejects it) + kind:'sso_totp' (scoped to the SSO endpoint) plus the resolved context (userId, provider, authMethod, returnTo). - sso.controller: finishLogin now stages the challenge and redirects to /admin/login?sso_totp=1 instead of creating a session when the account has TOTP on. New finishSsoTotp verifies the code (backoff + bot-scoring on failure, mirroring loginTotp) and only then mints the session. - sso.routes: POST /auth/sso/totp behind the same backoff/slow/limiter stack and code validation as the local TOTP endpoint. - client: AdminLogin detects ?sso_totp=1 and completes over fetch via api.ssoLoginTotp; the challenge never touches the URL or JS. Keeps the second factor httpOnly throughout, consistent with the SSO tx cookie. 12 new tests; full suite 106/106. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV
71 lines
3.1 KiB
JavaScript
71 lines
3.1 KiB
JavaScript
// Point the DB at a closed port before requiring the auth layer: session.service
|
|
// (used by one test below) pulls in the users model → db pool at load, and an idle
|
|
// pool would keep this process alive. None of these tests touch the database.
|
|
process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-secret'
|
|
process.env.DB_HOST = '127.0.0.1'
|
|
process.env.DB_PORT = '59999'
|
|
|
|
const { test, after } = require('node:test')
|
|
const assert = require('node:assert/strict')
|
|
const crypto = require('crypto')
|
|
|
|
const ssoState = require('../src/auth/ssoState')
|
|
const db = require('../src/utils/db')
|
|
|
|
after(() => db.close())
|
|
|
|
test('createTx → verifyTx round-trips the flow payload', () => {
|
|
const tx = ssoState.createTx({ provider: 'google', mode: 'login', returnTo: '/admin/posts' })
|
|
assert.ok(tx.nonce && tx.verifier && tx.codeChallenge && tx.txToken)
|
|
|
|
const payload = ssoState.verifyTx(tx.txToken, tx.nonce)
|
|
assert.ok(payload)
|
|
assert.equal(payload.provider, 'google')
|
|
assert.equal(payload.mode, 'login')
|
|
assert.equal(payload.returnTo, '/admin/posts')
|
|
assert.equal(payload.verifier, tx.verifier)
|
|
})
|
|
|
|
test('codeChallenge is the S256 hash of the verifier', () => {
|
|
const tx = ssoState.createTx({ provider: 'discord', mode: 'login' })
|
|
const expected = crypto.createHash('sha256').update(tx.verifier).digest('base64url')
|
|
assert.equal(tx.codeChallenge, expected)
|
|
})
|
|
|
|
test('verifyTx rejects a mismatched / tampered nonce', () => {
|
|
const tx = ssoState.createTx({ provider: 'google', mode: 'login' })
|
|
assert.equal(ssoState.verifyTx(tx.txToken, 'wrong-nonce'), null)
|
|
assert.equal(ssoState.verifyTx(tx.txToken, null), null)
|
|
assert.equal(ssoState.verifyTx(null, tx.nonce), null)
|
|
})
|
|
|
|
test('verifyTx rejects a non-tx token', () => {
|
|
const token = require('../src/auth/token')
|
|
const notTx = token.signToken({ id: 1, username: 'a', role: 'admin' })
|
|
assert.equal(ssoState.verifyTx(notTx, 'anything'), null)
|
|
})
|
|
|
|
test('createTotpPending → verifyTotpPending round-trips the SSO 2FA context', () => {
|
|
const pending = ssoState.createTotpPending({ userId: 7, provider: 'google', authMethod: 'google', returnTo: '/admin/posts' })
|
|
const payload = ssoState.verifyTotpPending(pending)
|
|
assert.ok(payload)
|
|
assert.equal(payload.id, 7)
|
|
assert.equal(payload.provider, 'google')
|
|
assert.equal(payload.authMethod, 'google')
|
|
assert.equal(payload.returnTo, '/admin/posts')
|
|
assert.equal(payload.stage, 'totp')
|
|
})
|
|
|
|
test('a pending-TOTP token is NOT accepted as a session (stage + kind reject it)', () => {
|
|
const sessionService = require('../src/auth/session.service')
|
|
const pending = ssoState.createTotpPending({ userId: 7, provider: 'google', authMethod: 'google' })
|
|
assert.equal(sessionService.decodeIdentity(pending), null)
|
|
})
|
|
|
|
test('verifyTotpPending rejects a plain session and a bare TOTP challenge', () => {
|
|
const token = require('../src/auth/token')
|
|
assert.equal(ssoState.verifyTotpPending(token.signToken({ id: 1, username: 'a', role: 'admin' })), null)
|
|
assert.equal(ssoState.verifyTotpPending(token.signTotpChallenge({ id: 1 })), null)
|
|
assert.equal(ssoState.verifyTotpPending(null), null)
|
|
})
|