Claude
31b31c3a17
Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).
Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
(create/validate/partial-TOTP/revoke), session.middleware.js
(attachSession/requireAuth/requireRole). utils/auth.js is now a thin
compat facade so existing imports are unchanged.
Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
long-lived refresh token, stored hashed and rotated on use, in a new
mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
TOTP. token.signToken gains a backward-compatible expiresIn option.
Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
identities are never auto-provisioned. Client secrets encrypted at rest
(AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
account linking (/admin/account/identities). New auth_providers +
user_identities tables.
Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
graceful with zero providers). New Authentication admin view
(Local/Google/Discord/Custom). Account page linked-accounts section.
Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
82 lines
3.6 KiB
JavaScript
82 lines
3.6 KiB
JavaScript
// Set before requiring the auth layer (token.js reads JWT_SECRET at load) and
|
|
// db.js (pulled in transitively; the pool builds at load). Closed DB port keeps
|
|
// idle connections from holding the process open — these tests are DB-free and
|
|
// only exercise the pure token/hash logic of the mobile session service.
|
|
process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-secret'
|
|
process.env.DB_HOST = '127.0.0.1'
|
|
process.env.DB_PORT = '59999'
|
|
|
|
const { test, after } = require('node:test')
|
|
const assert = require('node:assert/strict')
|
|
const jwt = require('jsonwebtoken')
|
|
|
|
const sessionService = require('../src/auth/session.service')
|
|
const tokenLib = require('../src/auth/token')
|
|
const db = require('../src/utils/db')
|
|
|
|
after(() => db.close())
|
|
|
|
const USER = { id: 42, username: 'mobileuser', role: 'admin' }
|
|
|
|
test('createMobileSession mints a bearer-validatable access token + opaque refresh token', () => {
|
|
const out = sessionService.createMobileSession(USER, { deviceHash: 'abc', userAgent: 'Android' })
|
|
|
|
// Access token validates as a mobile session.
|
|
const session = sessionService.validateBearerToken(out.accessToken)
|
|
assert.ok(session)
|
|
assert.equal(session.userId, USER.id)
|
|
assert.equal(session.authMethod, 'mobile')
|
|
assert.ok(session.sessionId)
|
|
|
|
// Refresh token is opaque (not a JWT) and its stored form is the sha256 hash.
|
|
assert.equal(typeof out.refreshToken, 'string')
|
|
assert.ok(out.refreshToken.length >= 40)
|
|
assert.equal(out.refreshHash, sessionService.hashRefreshToken(out.refreshToken))
|
|
assert.equal(sessionService.validateBearerToken(out.refreshToken), null, 'refresh token is not a bearer session')
|
|
|
|
// Metadata + a future expiry are carried through for the controller to persist.
|
|
assert.equal(out.deviceHash, 'abc')
|
|
assert.equal(out.userAgent, 'Android')
|
|
assert.ok(out.refreshExpiresAt instanceof Date)
|
|
assert.ok(out.refreshExpiresAt.getTime() > Date.now())
|
|
})
|
|
|
|
test('access token is short-lived (mobile TTL, not the 1d web default)', () => {
|
|
const { accessToken } = sessionService.createMobileSession(USER)
|
|
const decoded = jwt.decode(accessToken)
|
|
const lifetime = decoded.exp - decoded.iat
|
|
// Default MOBILE_ACCESS_TTL is 15m — comfortably under the 1d web session.
|
|
assert.ok(lifetime <= 15 * 60, `access token lifetime ${lifetime}s should be <= 15m`)
|
|
})
|
|
|
|
test('refreshMobileSession issues a distinct new pair (rotation)', () => {
|
|
const a = sessionService.createMobileSession(USER)
|
|
const b = sessionService.refreshMobileSession(USER)
|
|
assert.notEqual(a.refreshToken, b.refreshToken)
|
|
assert.notEqual(a.refreshHash, b.refreshHash)
|
|
})
|
|
|
|
test('hashRefreshToken is stable and deterministic', () => {
|
|
assert.equal(sessionService.hashRefreshToken('token-xyz'), sessionService.hashRefreshToken('token-xyz'))
|
|
assert.notEqual(sessionService.hashRefreshToken('a'), sessionService.hashRefreshToken('b'))
|
|
// sha256 hex is 64 chars.
|
|
assert.equal(sessionService.hashRefreshToken('anything').length, 64)
|
|
})
|
|
|
|
test('validateBearerToken rejects a TOTP challenge and garbage', () => {
|
|
const challenge = sessionService.createPartialSession(USER)
|
|
assert.equal(sessionService.validateBearerToken(challenge), null)
|
|
assert.equal(sessionService.validateBearerToken('not-a-jwt'), null)
|
|
assert.equal(sessionService.validateBearerToken(null), null)
|
|
})
|
|
|
|
test('token.signToken honors an expiresIn override, else uses the default', () => {
|
|
const short = tokenLib.signToken(USER, {}, { expiresIn: '1s' })
|
|
const shortDecoded = jwt.decode(short)
|
|
assert.equal(shortDecoded.exp - shortDecoded.iat, 1)
|
|
|
|
// No option → historical default (JWT_EXPIRES_IN, 1d) unchanged.
|
|
const dflt = jwt.decode(tokenLib.signToken(USER))
|
|
assert.equal(dflt.exp - dflt.iat, 24 * 60 * 60)
|
|
})
|