78 lines
3.1 KiB
TypeScript
78 lines
3.1 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from 'vitest';
|
|
import {
|
|
authenticator,
|
|
createRecoveryCodes,
|
|
decryptSecret,
|
|
encryptSecret,
|
|
recoveryIndex,
|
|
totpCounter,
|
|
} from '../../src/lib/auth-crypto';
|
|
import { loginContext } from '../../src/lib/login-context';
|
|
|
|
afterEach(() => vi.unstubAllEnvs());
|
|
describe('Admin two-factor primitives', () => {
|
|
const secret = 'GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ';
|
|
it('matches RFC 6238 SHA1 vectors truncated to six digits', () => {
|
|
expect(authenticator(secret).generate({ timestamp: 59000 })).toBe('287082');
|
|
expect(authenticator(secret).generate({ timestamp: 1111111109000 })).toBe('081804');
|
|
});
|
|
it('accepts only the adjacent time window and prevents replay', () => {
|
|
const time = 1700000000000,
|
|
counter = Math.floor(time / 30000);
|
|
const code = authenticator(secret).generate({ timestamp: time });
|
|
expect(totpCounter(secret, code, -1, time)).toBe(counter);
|
|
expect(totpCounter(secret, code, counter, time)).toBeNull();
|
|
expect(
|
|
totpCounter(secret, authenticator(secret).generate({ timestamp: time - 90000 }), -1, time),
|
|
).toBeNull();
|
|
expect(totpCounter(secret, 'abcdef', -1, time)).toBeNull();
|
|
});
|
|
it('encrypts secrets with authenticated purpose binding and randomized IVs', () => {
|
|
vi.stubEnv('AUTH_ENCRYPTION_KEY', 'ab'.repeat(32));
|
|
const encrypted = encryptSecret(secret, 'totp:admin');
|
|
expect(encrypted).not.toContain(secret);
|
|
expect(encryptSecret(secret, 'totp:admin')).not.toBe(encrypted);
|
|
expect(decryptSecret(encrypted, 'totp:admin')).toBe(secret);
|
|
expect(() => decryptSecret(encrypted, 'smtp')).toThrow();
|
|
const parts = encrypted.split('.');
|
|
const data = Buffer.from(parts[2], 'base64url');
|
|
data[0] ^= 1;
|
|
parts[2] = data.toString('base64url');
|
|
expect(() => decryptSecret(parts.join('.'), 'totp:admin')).toThrow();
|
|
});
|
|
it('requires a persistent 256-bit encryption key', () => {
|
|
vi.stubEnv('AUTH_ENCRYPTION_KEY', '');
|
|
expect(() => encryptSecret(secret, 'test')).toThrow(/AUTH_ENCRYPTION_KEY/);
|
|
});
|
|
it('generates independent recovery codes and checks their hashes', () => {
|
|
const { codes, hashes } = createRecoveryCodes();
|
|
expect(new Set(codes).size).toBe(10);
|
|
expect(recoveryIndex(hashes, codes[2].toLowerCase())).toBe(2);
|
|
expect(
|
|
recoveryIndex(
|
|
hashes.filter((_, n) => n !== 2),
|
|
codes[2],
|
|
),
|
|
).toBe(-1);
|
|
expect(recoveryIndex(hashes, '000000')).toBe(-1);
|
|
expect(hashes).not.toContain(codes[0]);
|
|
});
|
|
});
|
|
describe('Reported login origin', () => {
|
|
it('does not trust the client-controlled first forwarded address', () => {
|
|
vi.stubEnv('TRUST_PROXY', 'false');
|
|
const context = loginContext(
|
|
new Request('https://hamham.test', {
|
|
headers: { 'x-forwarded-for': '1.2.3.4, 2001:db8::1', 'user-agent': 'Test browser' },
|
|
}),
|
|
);
|
|
expect(context.ip).toBe('2001:db8::1');
|
|
expect(context.ipSource).toContain('nicht verifiziert');
|
|
expect(
|
|
loginContext(
|
|
new Request('https://hamham.test', { headers: { 'x-forwarded-for': 'not-an-ip' } }),
|
|
).ip,
|
|
).toBeNull();
|
|
});
|
|
});
|