ident

11.0 KB

1. // tests/hardening.mjs — SESSION HARDENING GATE (ticket ident#2, mission 022):
2. // * a signed-in session has its OWN expiry (store.hl sessionUserTtl), independent of the
3. // webex session file's rolling idle/maxAge — IDENT_SESSION_TTL_MS on a short-clock server;
4. // * an OLDER session (no `since`/`epoch` yet, as after the mission-009 migration or from
5. // before this ticket) is NOT force-signed-out — it is upgraded on its next use;
6. // * "sign out everywhere" (store.hl signOutEverywhere / home.hl signOutAll) invalidates
7. // EVERY session of the account at once, the caller's own included, without touching any
8. // other session file;
9. // * "sign out of an app" (apps.hl disconnectConnection / appsettings.hl inboxDisconnect)
10. // forgets one connection: the app gets the same short id on a later login.
11. // Own servers (.scratch/hardening-gate, wiped at start): ident main :8700 (default TTL),
12. // ident short :8701 (IDENT_SESSION_TTL_MS=2000). No Chrome — HTTP + the face carrier only,
13. // same as migration.mjs's non-browser checks.
14. import { spawn } from 'node:child_process';
15. import { readFileSync, writeFileSync, rmSync, mkdirSync, existsSync, readdirSync } from 'node:fs';
16. import { createHash } from 'node:crypto';
17. import { dirname, join } from 'node:path';
18. import { fileURLToPath } from 'node:url';
20. const APP = join(dirname(fileURLToPath(import.meta.url)), '..');
21. const G = join(APP, '.scratch/hardening-gate');
22. const BIN = join(APP, 'bin/hybriel');
23. const MAIN = 'http://127.0.0.1:8700', SHORT = 'http://127.0.0.1:8701';
24. const J = JSON.stringify;
25. const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
27. let passed = 0, failed = 0;
28. const check = (name, ok, detail = '') => {
29. if (ok) { passed++; console.log(' ok ' + name); }
30. else { failed++; console.log(' FAIL ' + name + (detail ? ' — ' + detail : '')); }
31. };
33. rmSync(G, { recursive: true, force: true });
34. mkdirSync(join(G, 'main-sess'), { recursive: true });
35. mkdirSync(join(G, 'short-sess'), { recursive: true });
37. const procs = [];
38. function start(name, env) {
39. let out = '';
40. const p = spawn(BIN, ['project.hl'], { cwd: APP, env: { ...process.env, SMTP_HOST: '', SMTP_USER: '', SMTP_PASSWORD: '', ...env }, stdio: ['ignore', 'pipe', 'pipe'] });
41. p.stdout.on('data', (d) => { out += d; }); p.stderr.on('data', (d) => { out += d; });
42. p.on('exit', () => writeFileSync(join(G, `${name}.log`), out));
43. procs.push(p);
44. }
45. start('main', { IDENT_PORT: '8700', IDENT_STORAGE: join(G, 'main-store'), IDENT_SESSIONS: join(G, 'main-sess'), IDENT_MAIL_SINK: join(G, 'main-mail.txt'), IDENT_IP_LIMIT: '1000', IDENT_IP_DAY_LIMIT: '1000' });
46. start('short', { IDENT_PORT: '8701', IDENT_STORAGE: join(G, 'short-store'), IDENT_SESSIONS: join(G, 'short-sess'), IDENT_MAIL_SINK: join(G, 'short-mail.txt'), IDENT_SESSION_TTL_MS: '2000', IDENT_IP_LIMIT: '1000', IDENT_IP_DAY_LIMIT: '1000' });
47. for (const u of [MAIN, SHORT]) { for (let i = 0; i < 80; i++) { try { await fetch(u + '/', { redirect: 'manual' }); break; } catch {} await sleep(250); } }
49. // ---- helpers --------------------------------------------------------------------------
50. const mailCodeOnce = (sink, email) => {
51. if (!existsSync(sink)) return null;
52. const lines = readFileSync(sink, 'utf8').split('\n').filter((l) => l.startsWith(email + ' '));
53. return lines.length ? lines.at(-1).split(' ')[1] : null;
54. };
55. // the sink write lands after the /api/code response (apiCode returns before the write is
56. // guaranteed flushed) — poll briefly instead of reading it once right away
57. const mailCode = async (sink, email) => {
58. for (let i = 0; i < 20; i++) {
59. const c = mailCodeOnce(sink, email);
60. if (c) return c;
61. await sleep(100);
62. }
63. return null;
64. };
65. const cookieOf = (setCookie) => setCookie ? setCookie.split(';')[0] : null;
67. async function signIn(base, sink, email) {
68. // /api/code is a plain function route (no session, no Set-Cookie, project.hl apiCode):
69. // the FIRST cookie is minted by the /__hl/emit call below (the framework's `fresh`
70. // session path, WebFramework.hl). r1 never carries one — only r2 does.
71. const r1 = await fetch(base + '/api/code', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ email }) });
72. const code = await mailCode(sink, email);
73. const r2 = await fetch(base + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ t: 'emit', i: 1, event: 'verifyCode', payload: [email, code, 'UTC'] }) });
74. const cookie = cookieOf(r2.headers.get('set-cookie'));
75. const v = (await r2.json()).value;
76. return { cookie, value: v };
77. }
78. async function emit(base, cookie, event, payload) {
79. const r = await fetch(base + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', cookie }, body: J({ t: 'emit', i: 1, event, payload }) });
80. return (await r.json()).value;
81. }
83. // ---- 1. a session's own expiry (independent server, TTL 2s) ---------------------------
84. console.log('# session expiry (IDENT_SESSION_TTL_MS)');
85. {
86. const { cookie } = await signIn(SHORT, join(G, 'short-mail.txt'), '[email protected]');
87. let v = await emit(SHORT, cookie, 'addIdentity', [{}]);
88. check('right after signing in: an authenticated face works', v && v.error == null, J(v));
89. await sleep(2600);
90. v = await emit(SHORT, cookie, 'addIdentity', [{}]);
91. check('2.6s later (TTL 2s): the same cookie is signed out', v && v.error === 'you are not signed in', J(v));
92. }
94. // ---- 2. an older session (no since/epoch) is upgraded, not force-signed-out -----------
95. console.log('# older session (pre-hardening shape) stays signed in');
96. {
97. const { value } = await signIn(MAIN, join(G, 'main-mail.txt'), '[email protected]');
98. const accountId = value.account.id;
99. const sid = 'f'.repeat(32);
100. const file = join(G, 'main-sess', createHash('sha256').update(sid).digest('hex'));
101. writeFileSync(file, J({ created: Date.now() - 999999, data: {}, id: sid, seen: Date.now() - 999999, user: { id: accountId } }), { mode: 0o600 });
102. const v = await emit(MAIN, 'identsid=' + sid, 'addIdentity', [{}]);
103. check('an old-shape session (user: {id} only) still signs its account in', v && v.error == null && v.identities && v.identities.length === 2, J(v));
104. const after = JSON.parse(readFileSync(file, 'utf8'));
105. check('…and gets upgraded on disk (since + epoch stamped)', typeof after.user.since === 'number' && typeof after.user.epoch === 'number', J(after.user));
106. }
108. // ---- 3. sign out everywhere --------------------------------------------------------------
109. console.log('# sign out everywhere');
110. {
111. const email = '[email protected]';
112. const a = await signIn(MAIN, join(G, 'main-mail.txt'), email);
113. let v = await emit(MAIN, a.cookie, 'addIdentity', [{}]);
114. check('device A: signed in', v && v.error == null, J(v));
115. await fetch(MAIN + '/api/code', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ email }) });
116. const code = await mailCode(join(G, "main-mail.txt"), email);
117. const r2 = await fetch(MAIN + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ t: 'emit', i: 1, event: 'verifyCode', payload: [email, code, 'UTC'] }) });
118. const cookieB = cookieOf(r2.headers.get('set-cookie'));
119. v = (await r2.json()).value;
120. check('device B: same account, signed in too', v && v.error == null, J(v));
121. const mine = () => readdirSync(join(G, 'main-sess')).filter((f) => { const r = JSON.parse(readFileSync(join(G, 'main-sess', f), 'utf8')); return r.user != null && r.user.id === a.value.account.id; });
122. check('before: the account has 2 session files', mine().length === 2, J(mine()));
123. v = await emit(MAIN, cookieB, 'signOutAll', []);
124. check('device B calls "sign out everywhere"', v && v.ok === true, J(v));
125. const left = mine();
126. check('every session file of the account is deleted at once', left.length === 0, J(left));
127. v = await emit(MAIN, a.cookie, 'addIdentity', [{}]);
128. check('device A is now signed out too', v && v.error === 'you are not signed in', J(v));
129. v = await emit(MAIN, cookieB, 'addIdentity', [{}]);
130. check('device B (the caller) is signed out too', v && v.error === 'you are not signed in', J(v));
131. const again = await signIn(MAIN, join(G, 'main-mail.txt'), email);
132. check('the account can still sign in again afterwards', again.value && again.value.error == null, J(again.value));
133. }
135. // ---- 4. sign out of one app (disconnect) --------------------------------------------------
136. console.log('# sign out of one app');
137. {
138. const { cookie, value } = await signIn(MAIN, join(G, 'main-mail.txt'), '[email protected]');
139. const identityId = value.identities[0].id;
140. const created = await emit(MAIN, cookie, 'appCreate', [{ name: 'Hardening test app', origins: ['http://127.0.0.1:8703'] }]);
141. const { apiKey } = created.app; const secret = created.secret;
142. const login1 = await fetch(MAIN + `/login?key=${apiKey}&return=${encodeURIComponent('http://127.0.0.1:8703/cb')}`, { redirect: 'manual' });
143. const rid1 = login1.headers.get('location').split('/').pop();
144. const choice1 = await emit(MAIN, cookie, 'chooseIdentity', [rid1, identityId]);
145. const code1 = new URL(choice1.url).searchParams.get('ident_code');
146. const ex1 = await (await fetch(MAIN + '/api/exchange', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ key: apiKey, secret, code: code1 }) })).json();
147. check('the app first exchanges an id for the identity', ex1.identity && /^[2-9a-hj-km-np-z]{5}$/.test(ex1.identity), J(ex1));
149. // find the connection id the same way the inbox page would (a fresh dump on a COPY)
150. const cpDir = join(G, 'conn-dump'); mkdirSync(cpDir, { recursive: true });
151. const { cpSync, execFileSync } = await import('node:fs').then(async (fs) => ({ cpSync: fs.cpSync, execFileSync: (await import('node:child_process')).execFileSync }));
152. cpSync(join(G, 'main-store'), cpDir, { recursive: true });
153. const dump = JSON.parse(execFileSync(BIN, [join(APP, 'tools/dump-store.hl')], { cwd: APP, env: { ...process.env, IDENT_STORAGE: cpDir }, encoding: 'utf8' }));
154. const conn = dump.connections.find((c) => c.identity === identityId);
155. check('the connection for that app+identity exists', !!conn, J(dump.connections));
157. const disc = await emit(MAIN, cookie, 'inboxDisconnect', [conn.id]);
158. check('signing out of the app (disconnect) succeeds', disc && disc.disconnected === conn.id, J(disc));
159. const disc2 = await emit(MAIN, cookie, 'inboxDisconnect', [conn.id]);
160. check('…and cannot be repeated (the connection is gone)', disc2 && disc2.error != null, J(disc2));
162. const login2 = await fetch(MAIN + `/login?key=${apiKey}&return=${encodeURIComponent('http://127.0.0.1:8703/cb')}`, { redirect: 'manual' });
163. const rid2 = login2.headers.get('location').split('/').pop();
164. const choice2 = await emit(MAIN, cookie, 'chooseIdentity', [rid2, identityId]);
165. const code2 = new URL(choice2.url).searchParams.get('ident_code');
166. const ex2 = await (await fetch(MAIN + '/api/exchange', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ key: apiKey, secret, code: code2 }) })).json();
167. check('a later login gets the SAME short id again (it never changes)', ex2.identity && ex2.identity === ex1.identity, J({ old: ex1.identity, new: ex2.identity }));
168. }
170. for (const p of procs) p.kill();
171. console.log(`\n${passed} passed, ${failed} failed`);
172. process.exit(failed ? 1 : 0);