992 行
33 KiB
JavaScript
992 行
33 KiB
JavaScript
const crypto = require("node:crypto");
|
|
const { Client } = require("pg");
|
|
|
|
const { createPrismaClient } = require("../prismaClient");
|
|
const {
|
|
generateSixDigitCode,
|
|
hashAuthCode,
|
|
randomRefreshToken,
|
|
sha256Hex,
|
|
verifyPassword,
|
|
} = require("../utils/crypto");
|
|
|
|
const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
|
|
const EMPLOYEE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
|
|
|
class AuthConcurrencyCheckError extends Error {
|
|
constructor(code) {
|
|
super(code);
|
|
this.name = "AuthConcurrencyCheckError";
|
|
this.safeCode = code;
|
|
}
|
|
}
|
|
|
|
function fail(code) {
|
|
throw new AuthConcurrencyCheckError(code);
|
|
}
|
|
|
|
function requireValue(env, name) {
|
|
const value = String(env[name] ?? "").trim();
|
|
if (!value) fail(`${name.toLowerCase()}_required`);
|
|
return value;
|
|
}
|
|
|
|
function validateAuthRegressionEnvironment(env = process.env) {
|
|
if (env.RUN_AUTH_SECURITY_REGRESSION !== "1") fail("regression_opt_in_required");
|
|
if (env.NODE_ENV !== "test") fail("test_environment_required");
|
|
if (env.RATE_LIMIT_ENABLED !== "false") fail("rate_limit_must_be_disabled");
|
|
if (env.DEV_SHOW_PASSWORD_RESET_CODE !== "false") fail("code_logging_forbidden");
|
|
if (env.TRUST_PROXY_HOPS !== "0") fail("trust_proxy_must_be_disabled");
|
|
if (env.EMAIL_ENABLED !== "false") fail("email_provider_must_be_disabled");
|
|
if (String(env.SMTP_HOST ?? "").trim()) fail("smtp_host_forbidden");
|
|
if (String(env.SMTP_USER ?? "").trim() || String(env.SMTP_PASS ?? "").trim()) {
|
|
fail("smtp_credentials_forbidden");
|
|
}
|
|
if (env.IM_NOTIFIER_ENABLED !== "false") fail("im_notifier_must_be_disabled");
|
|
if (env.WECOM_ENABLED !== "false") fail("wecom_must_be_disabled");
|
|
if (String(env.WECOM_AGENT_SECRET ?? "").trim()) fail("wecom_secret_forbidden");
|
|
if (env.OIDC_ENABLED !== "false") fail("oidc_must_be_disabled");
|
|
if (String(env.OIDC_CLIENT_SECRET ?? "").trim()) fail("oidc_secret_forbidden");
|
|
|
|
const databaseUrl = requireValue(env, "DATABASE_URL");
|
|
let parsedDatabaseUrl;
|
|
try {
|
|
parsedDatabaseUrl = new URL(databaseUrl);
|
|
} catch {
|
|
fail("database_url_invalid");
|
|
}
|
|
if (!["postgres:", "postgresql:"].includes(parsedDatabaseUrl.protocol)) {
|
|
fail("database_protocol_invalid");
|
|
}
|
|
|
|
const pgConfig = new Client({ connectionString: databaseUrl });
|
|
const databaseHost = String(pgConfig.host ?? "").toLowerCase();
|
|
const databaseName = String(pgConfig.database ?? "");
|
|
if (!LOOPBACK_HOSTS.has(databaseHost)) fail("database_host_not_loopback");
|
|
if (!/^hyb_oa_auth_[A-Za-z0-9_]+$/.test(databaseName)) fail("database_name_not_isolated");
|
|
if (requireValue(env, "AUTH_SECURITY_DATABASE_CONFIRM") !== databaseName) {
|
|
fail("database_confirmation_mismatch");
|
|
}
|
|
|
|
const baseUrl = requireValue(env, "BASE_URL");
|
|
let parsedBaseUrl;
|
|
try {
|
|
parsedBaseUrl = new URL(baseUrl);
|
|
} catch {
|
|
fail("base_url_invalid");
|
|
}
|
|
if (parsedBaseUrl.protocol !== "http:" || !LOOPBACK_HOSTS.has(parsedBaseUrl.hostname)) {
|
|
fail("base_url_not_loopback");
|
|
}
|
|
|
|
const pepper = requireValue(env, "AUTH_CODE_PEPPER");
|
|
if (/^<[^>]+>$/.test(pepper) || Buffer.byteLength(pepper, "utf8") < 32) {
|
|
fail("auth_code_pepper_weak");
|
|
}
|
|
const jwtSecret = requireValue(env, "JWT_SECRET");
|
|
if (jwtSecret === pepper) fail("auth_code_pepper_not_independent");
|
|
requireValue(env, "FIELD_ENCRYPTION_KEY");
|
|
|
|
return {
|
|
baseUrl: parsedBaseUrl.origin,
|
|
databaseUrl,
|
|
pepper,
|
|
};
|
|
}
|
|
|
|
function validateAuthConcurrencyEnvironment(env = process.env) {
|
|
if (env.RUN_AUTH_POSTGRES_CONCURRENCY !== "1") fail("explicit_opt_in_required");
|
|
const baseContext = validateAuthRegressionEnvironment(env);
|
|
const employeeId = requireValue(env, "AUTH_SECURITY_EMPLOYEE_ID");
|
|
if (!EMPLOYEE_ID_PATTERN.test(employeeId)) fail("employee_id_invalid");
|
|
|
|
return {
|
|
...baseContext,
|
|
employeeId,
|
|
employeeEmail: requireValue(env, "AUTH_SECURITY_EMPLOYEE_EMAIL"),
|
|
currentPassword: requireValue(env, "AUTH_SECURITY_CURRENT_PASSWORD"),
|
|
};
|
|
}
|
|
|
|
function createStrongPassword(prefix) {
|
|
return `${prefix}A1!${crypto.randomBytes(12).toString("hex")}`;
|
|
}
|
|
|
|
function assertCondition(condition, code) {
|
|
if (!condition) fail(code);
|
|
}
|
|
|
|
async function postJson(baseUrl, path, payload, { headers = {}, signal } = {}) {
|
|
let response;
|
|
try {
|
|
response = await fetch(`${baseUrl}${path}`, {
|
|
method: "POST",
|
|
headers: {
|
|
"content-type": "application/json",
|
|
...headers,
|
|
},
|
|
body: JSON.stringify(payload),
|
|
signal,
|
|
});
|
|
} catch {
|
|
fail("http_request_failed");
|
|
}
|
|
|
|
let error = null;
|
|
if (response.status !== 200) {
|
|
try {
|
|
const body = await response.json();
|
|
error = {
|
|
code: body?.error?.code ?? null,
|
|
detailsCode: body?.error?.details?.code ?? null,
|
|
};
|
|
} catch {
|
|
error = null;
|
|
}
|
|
}
|
|
|
|
return {
|
|
status: response.status,
|
|
error,
|
|
setCookie: Boolean(response.headers.get("set-cookie")),
|
|
};
|
|
}
|
|
|
|
function extractRefreshCookie(response) {
|
|
const setCookie = String(response.headers.get("set-cookie") ?? "");
|
|
const match = setCookie.match(/(?:^|,\s*)refresh_token=([^;,\s]+)/);
|
|
return match ? `refresh_token=${match[1]}` : null;
|
|
}
|
|
|
|
async function loginForRace({ baseUrl, email, password, fingerprint, signal }) {
|
|
let response;
|
|
try {
|
|
response = await fetch(`${baseUrl}/api/auth/login`, {
|
|
method: "POST",
|
|
headers: {
|
|
"content-type": "application/json",
|
|
"x-device-fingerprint": fingerprint,
|
|
},
|
|
body: JSON.stringify({ identifier: email, password }),
|
|
signal,
|
|
});
|
|
} catch {
|
|
fail("login_http_request_failed");
|
|
}
|
|
|
|
let accessToken = null;
|
|
let error = null;
|
|
try {
|
|
const body = await response.json();
|
|
if (response.status === 200) {
|
|
accessToken = typeof body?.data?.accessToken === "string" ? body.data.accessToken : null;
|
|
} else {
|
|
error = {
|
|
code: body?.error?.code ?? null,
|
|
detailsCode: body?.error?.details?.code ?? null,
|
|
};
|
|
}
|
|
} catch {
|
|
error = null;
|
|
}
|
|
|
|
return {
|
|
status: response.status,
|
|
accessToken,
|
|
refreshCookie: extractRefreshCookie(response),
|
|
error,
|
|
};
|
|
}
|
|
|
|
async function getWithAccessToken(baseUrl, path, accessToken) {
|
|
let response;
|
|
try {
|
|
response = await fetch(`${baseUrl}${path}`, {
|
|
headers: { authorization: `Bearer ${accessToken}` },
|
|
});
|
|
} catch {
|
|
fail("access_token_probe_failed");
|
|
}
|
|
|
|
let errorCode = null;
|
|
if (response.status !== 200) {
|
|
try {
|
|
const body = await response.json();
|
|
errorCode = body?.error?.code ?? null;
|
|
} catch {
|
|
errorCode = null;
|
|
}
|
|
}
|
|
return { status: response.status, errorCode };
|
|
}
|
|
|
|
async function preparePasswordResetChallenge({
|
|
prisma,
|
|
employeeId,
|
|
pepper,
|
|
includeSession,
|
|
}) {
|
|
const now = new Date();
|
|
const expiresAt = new Date(now.getTime() + 10 * 60 * 1000);
|
|
const code = generateSixDigitCode();
|
|
const emailCode = generateSixDigitCode();
|
|
const codeHash = hashAuthCode({
|
|
employeeId,
|
|
code,
|
|
purpose: "password_reset",
|
|
pepper,
|
|
});
|
|
const emailCodeHash = hashAuthCode({
|
|
employeeId,
|
|
code: emailCode,
|
|
purpose: "email_login",
|
|
pepper,
|
|
});
|
|
const refreshToken = includeSession ? randomRefreshToken() : null;
|
|
|
|
const created = await prisma.$transaction(async (tx) => {
|
|
await tx.employee.update({
|
|
where: { id: employeeId },
|
|
data: {
|
|
password_reset_failed_count: 0,
|
|
password_reset_failed_first_at: null,
|
|
password_reset_locked_until: null,
|
|
password_reset_request_count: 0,
|
|
password_reset_request_first_at: null,
|
|
password_reset_last_requested_at: null,
|
|
email_login_code_failed_count: 0,
|
|
email_login_code_failed_first_at: null,
|
|
email_login_code_locked_until: null,
|
|
email_login_code_last_requested_at: null,
|
|
},
|
|
});
|
|
await tx.passwordResetCode.updateMany({
|
|
where: { employee_id: employeeId, invalidated_at: null },
|
|
data: { invalidated_at: now },
|
|
});
|
|
await tx.emailLoginCode.updateMany({
|
|
where: { employee_id: employeeId, used_at: null },
|
|
data: { used_at: now },
|
|
});
|
|
|
|
const resetCode = await tx.passwordResetCode.create({
|
|
data: {
|
|
employee_id: employeeId,
|
|
code_hash: codeHash,
|
|
expires_at: expiresAt,
|
|
created_ip: "127.0.0.1",
|
|
created_user_agent: "auth-concurrency-check",
|
|
},
|
|
select: { id: true },
|
|
});
|
|
const loginCode = await tx.emailLoginCode.create({
|
|
data: {
|
|
employee_id: employeeId,
|
|
code_hash: emailCodeHash,
|
|
expires_at: expiresAt,
|
|
created_ip: "127.0.0.1",
|
|
created_user_agent: "auth-concurrency-check",
|
|
},
|
|
select: { id: true },
|
|
});
|
|
|
|
let refreshSessionId = null;
|
|
if (refreshToken) {
|
|
const refreshSession = await tx.authSession.create({
|
|
data: {
|
|
employee_id: employeeId,
|
|
refresh_token_hash: sha256Hex(refreshToken),
|
|
device_fingerprint: "auth-concurrency-check",
|
|
ip_address: "127.0.0.1",
|
|
user_agent: "auth-concurrency-check",
|
|
expires_at: new Date(now.getTime() + 60 * 60 * 1000),
|
|
},
|
|
select: { id: true },
|
|
});
|
|
refreshSessionId = refreshSession.id;
|
|
}
|
|
|
|
return { resetCodeId: resetCode.id, emailCodeId: loginCode.id, refreshSessionId };
|
|
});
|
|
|
|
return { ...created, code, refreshToken };
|
|
}
|
|
|
|
async function getEmployeeSecurityState(prisma, employeeId) {
|
|
return prisma.employee.findUnique({
|
|
where: { id: employeeId },
|
|
select: {
|
|
id: true,
|
|
email: true,
|
|
status: true,
|
|
password_hash: true,
|
|
token_version: true,
|
|
password_reset_failed_count: true,
|
|
password_reset_locked_until: true,
|
|
},
|
|
});
|
|
}
|
|
|
|
async function countAudit(prisma, employeeId, action) {
|
|
return prisma.auditLog.count({
|
|
where: { actor_id: employeeId, action },
|
|
});
|
|
}
|
|
|
|
async function runConcurrentForgotPasswordRequests({ prisma, context }) {
|
|
const preparedAt = new Date();
|
|
await prisma.$transaction(async (tx) => {
|
|
await tx.employee.update({
|
|
where: { id: context.employeeId },
|
|
data: {
|
|
password_reset_failed_count: 0,
|
|
password_reset_failed_first_at: null,
|
|
password_reset_locked_until: null,
|
|
password_reset_request_count: 0,
|
|
password_reset_request_first_at: null,
|
|
password_reset_last_requested_at: null,
|
|
},
|
|
});
|
|
await tx.passwordResetCode.updateMany({
|
|
where: { employee_id: context.employeeId, invalidated_at: null },
|
|
data: { invalidated_at: preparedAt },
|
|
});
|
|
});
|
|
|
|
const requestedAuditBefore = await countAudit(
|
|
prisma,
|
|
context.employeeId,
|
|
"AUTH_PASSWORD_RESET_REQUESTED",
|
|
);
|
|
const responses = await Promise.all(
|
|
Array.from({ length: 20 }, () =>
|
|
postJson(context.baseUrl, "/api/auth/forgot-password", {
|
|
email: context.employeeEmail,
|
|
}),
|
|
),
|
|
);
|
|
assertCondition(
|
|
responses.every((response) => response.status === 200 && !response.setCookie),
|
|
"forgot_concurrent_response_invalid",
|
|
);
|
|
|
|
const [employee, activeCodes, requestedAuditAfter] = await Promise.all([
|
|
prisma.employee.findUnique({
|
|
where: { id: context.employeeId },
|
|
select: {
|
|
password_reset_failed_count: true,
|
|
password_reset_locked_until: true,
|
|
password_reset_request_count: true,
|
|
password_reset_request_first_at: true,
|
|
password_reset_last_requested_at: true,
|
|
},
|
|
}),
|
|
prisma.passwordResetCode.count({
|
|
where: {
|
|
employee_id: context.employeeId,
|
|
used_at: null,
|
|
invalidated_at: null,
|
|
expires_at: { gt: new Date() },
|
|
},
|
|
}),
|
|
countAudit(prisma, context.employeeId, "AUTH_PASSWORD_RESET_REQUESTED"),
|
|
]);
|
|
|
|
assertCondition(activeCodes === 1, "forgot_concurrent_active_code_count_invalid");
|
|
assertCondition(employee?.password_reset_request_count === 1, "forgot_request_count_invalid");
|
|
assertCondition(
|
|
employee?.password_reset_request_first_at instanceof Date &&
|
|
employee?.password_reset_last_requested_at instanceof Date,
|
|
"forgot_request_timestamps_missing",
|
|
);
|
|
assertCondition(employee?.password_reset_failed_count === 0, "forgot_failure_count_changed");
|
|
assertCondition(employee?.password_reset_locked_until === null, "forgot_account_locked");
|
|
assertCondition(
|
|
requestedAuditAfter === requestedAuditBefore + 1,
|
|
"forgot_request_audit_count_invalid",
|
|
);
|
|
}
|
|
|
|
async function runSameCodeConcurrency({ prisma, context }) {
|
|
const before = await getEmployeeSecurityState(prisma, context.employeeId);
|
|
assertCondition(before?.email === context.employeeEmail, "employee_identity_mismatch");
|
|
assertCondition(before.status === "active", "employee_not_active");
|
|
assertCondition(
|
|
await verifyPassword(context.currentPassword, before.password_hash),
|
|
"current_password_mismatch",
|
|
);
|
|
|
|
const challenge = await preparePasswordResetChallenge({
|
|
prisma,
|
|
employeeId: context.employeeId,
|
|
pepper: context.pepper,
|
|
includeSession: true,
|
|
});
|
|
const successAuditBefore = await countAudit(
|
|
prisma,
|
|
context.employeeId,
|
|
"AUTH_PASSWORD_RESET_SUCCEEDED",
|
|
);
|
|
const newPassword = createStrongPassword("Concurrent");
|
|
|
|
const responses = await Promise.all(
|
|
Array.from({ length: 20 }, () =>
|
|
postJson(context.baseUrl, "/api/auth/reset-password", {
|
|
email: context.employeeEmail,
|
|
code: challenge.code,
|
|
newPassword,
|
|
}),
|
|
),
|
|
);
|
|
const successes = responses.filter((response) => response.status === 200);
|
|
const failures = responses.filter((response) => response.status === 400);
|
|
if (successes.length !== 1) {
|
|
if (
|
|
responses.every(
|
|
(response) =>
|
|
response.status === 400 &&
|
|
response.error?.code === "VALID_001" &&
|
|
response.error?.detailsCode === "invalid_or_expired",
|
|
)
|
|
) {
|
|
const [rejectedCode, rejectedEmployee, activeCodeCount] = await Promise.all([
|
|
prisma.passwordResetCode.findUnique({
|
|
where: { id: challenge.resetCodeId },
|
|
select: { attempts_count: true, used_at: true, invalidated_at: true },
|
|
}),
|
|
prisma.employee.findUnique({
|
|
where: { id: context.employeeId },
|
|
select: {
|
|
password_reset_failed_count: true,
|
|
password_reset_locked_until: true,
|
|
},
|
|
}),
|
|
prisma.passwordResetCode.count({
|
|
where: {
|
|
employee_id: context.employeeId,
|
|
used_at: null,
|
|
invalidated_at: null,
|
|
expires_at: { gt: new Date() },
|
|
},
|
|
}),
|
|
]);
|
|
if (Number(rejectedCode?.attempts_count ?? 0) > 0) {
|
|
fail("concurrent_code_hash_mismatch");
|
|
}
|
|
if (rejectedEmployee?.password_reset_locked_until instanceof Date) {
|
|
fail("concurrent_account_prelocked");
|
|
}
|
|
if (activeCodeCount === 0) {
|
|
fail("concurrent_code_not_active");
|
|
}
|
|
fail("concurrent_active_code_not_selected");
|
|
}
|
|
if (
|
|
responses.every(
|
|
(response) =>
|
|
response.status === 400 &&
|
|
response.error?.code === "VALID_001" &&
|
|
response.error?.detailsCode === null,
|
|
)
|
|
) {
|
|
fail("concurrent_all_payloads_rejected");
|
|
}
|
|
fail("concurrent_success_count_invalid");
|
|
}
|
|
assertCondition(failures.length === 19, "concurrent_failure_count_invalid");
|
|
assertCondition(
|
|
failures.every(
|
|
(response) =>
|
|
response.error?.code === "VALID_001" &&
|
|
response.error?.detailsCode === "invalid_or_expired" &&
|
|
!response.setCookie,
|
|
),
|
|
"concurrent_failure_contract_invalid",
|
|
);
|
|
|
|
const after = await getEmployeeSecurityState(prisma, context.employeeId);
|
|
assertCondition(after.token_version === before.token_version + 1, "token_version_increment_invalid");
|
|
assertCondition(await verifyPassword(newPassword, after.password_hash), "new_password_not_active");
|
|
assertCondition(
|
|
!(await verifyPassword(context.currentPassword, after.password_hash)),
|
|
"old_password_still_active",
|
|
);
|
|
assertCondition(after.password_reset_failed_count === 0, "concurrent_loser_failure_count_changed");
|
|
assertCondition(after.password_reset_locked_until === null, "concurrent_losers_locked_account");
|
|
|
|
const [resetCode, emailCode, activeResetCodes, activeSessions, successAuditAfter] =
|
|
await Promise.all([
|
|
prisma.passwordResetCode.findUnique({
|
|
where: { id: challenge.resetCodeId },
|
|
select: { used_at: true, invalidated_at: true },
|
|
}),
|
|
prisma.emailLoginCode.findUnique({
|
|
where: { id: challenge.emailCodeId },
|
|
select: { used_at: true },
|
|
}),
|
|
prisma.passwordResetCode.count({
|
|
where: {
|
|
employee_id: context.employeeId,
|
|
used_at: null,
|
|
invalidated_at: null,
|
|
expires_at: { gt: new Date() },
|
|
},
|
|
}),
|
|
prisma.authSession.count({
|
|
where: {
|
|
employee_id: context.employeeId,
|
|
revoked_at: null,
|
|
expires_at: { gt: new Date() },
|
|
},
|
|
}),
|
|
countAudit(prisma, context.employeeId, "AUTH_PASSWORD_RESET_SUCCEEDED"),
|
|
]);
|
|
|
|
assertCondition(resetCode?.used_at instanceof Date, "reset_code_not_consumed");
|
|
assertCondition(resetCode?.invalidated_at instanceof Date, "reset_code_not_invalidated");
|
|
assertCondition(emailCode?.used_at instanceof Date, "email_code_not_invalidated");
|
|
assertCondition(activeResetCodes === 0, "active_reset_code_remains");
|
|
assertCondition(activeSessions === 0, "active_session_remains");
|
|
assertCondition(successAuditAfter === successAuditBefore + 1, "success_audit_count_invalid");
|
|
|
|
return newPassword;
|
|
}
|
|
|
|
async function waitForBlockedConnections(observer, excludedPids, expectedCount, timeoutMs) {
|
|
const deadline = Date.now() + timeoutMs;
|
|
while (Date.now() < deadline) {
|
|
const result = await observer.query(
|
|
`SELECT COUNT(*)::int AS count
|
|
FROM pg_stat_activity
|
|
WHERE datname = current_database()
|
|
AND pid <> $1
|
|
AND pid <> $2
|
|
AND cardinality(pg_blocking_pids(pid)) > 0`,
|
|
excludedPids,
|
|
);
|
|
if (Number(result.rows[0]?.count ?? 0) >= expectedCount) return;
|
|
await new Promise((resolve) => setTimeout(resolve, 50));
|
|
}
|
|
fail("blocked_connection_order_timeout");
|
|
}
|
|
|
|
async function withTimeout(promise, timeoutMs, code) {
|
|
let timeout;
|
|
try {
|
|
return await Promise.race([
|
|
promise,
|
|
new Promise((_, reject) => {
|
|
timeout = setTimeout(() => reject(new AuthConcurrencyCheckError(code)), timeoutMs);
|
|
}),
|
|
]);
|
|
} finally {
|
|
clearTimeout(timeout);
|
|
}
|
|
}
|
|
|
|
async function runLoginResetRace({ prisma, context, currentPassword }) {
|
|
const before = await getEmployeeSecurityState(prisma, context.employeeId);
|
|
assertCondition(
|
|
await verifyPassword(currentPassword, before.password_hash),
|
|
"race_current_password_mismatch",
|
|
);
|
|
const challenge = await preparePasswordResetChallenge({
|
|
prisma,
|
|
employeeId: context.employeeId,
|
|
pepper: context.pepper,
|
|
includeSession: false,
|
|
});
|
|
const successAuditBefore = await countAudit(
|
|
prisma,
|
|
context.employeeId,
|
|
"AUTH_PASSWORD_RESET_SUCCEEDED",
|
|
);
|
|
const loginAuditBefore = await countAudit(prisma, context.employeeId, "AUTH_LOGIN_SUCCESS");
|
|
const racePassword = createStrongPassword("RaceReset");
|
|
|
|
const holder = new Client({ connectionString: context.databaseUrl });
|
|
const observer = new Client({ connectionString: context.databaseUrl });
|
|
const resetAbort = new AbortController();
|
|
const loginAbort = new AbortController();
|
|
let holderInTransaction = false;
|
|
let resetPromise = null;
|
|
let loginPromise = null;
|
|
|
|
try {
|
|
await holder.connect();
|
|
await observer.connect();
|
|
const holderPid = holder.processID;
|
|
const observerPid = observer.processID;
|
|
await holder.query("BEGIN");
|
|
holderInTransaction = true;
|
|
await holder.query('SELECT id FROM "employees" WHERE id = $1::uuid FOR UPDATE', [
|
|
context.employeeId,
|
|
]);
|
|
|
|
resetPromise = postJson(
|
|
context.baseUrl,
|
|
"/api/auth/reset-password",
|
|
{
|
|
email: context.employeeEmail,
|
|
code: challenge.code,
|
|
newPassword: racePassword,
|
|
},
|
|
{ signal: resetAbort.signal },
|
|
);
|
|
await waitForBlockedConnections(observer, [holderPid, observerPid], 1, 15_000);
|
|
|
|
loginPromise = postJson(
|
|
context.baseUrl,
|
|
"/api/auth/login",
|
|
{
|
|
identifier: context.employeeEmail,
|
|
password: currentPassword,
|
|
},
|
|
{
|
|
headers: { "x-device-fingerprint": "auth-reset-race" },
|
|
signal: loginAbort.signal,
|
|
},
|
|
);
|
|
await waitForBlockedConnections(observer, [holderPid, observerPid], 2, 20_000);
|
|
|
|
await holder.query("COMMIT");
|
|
holderInTransaction = false;
|
|
const [resetResponse, loginResponse] = await Promise.all([
|
|
withTimeout(resetPromise, 30_000, "race_reset_timeout"),
|
|
withTimeout(loginPromise, 30_000, "race_login_timeout"),
|
|
]);
|
|
|
|
assertCondition(resetResponse.status === 200, "race_reset_failed");
|
|
assertCondition(
|
|
loginResponse.status === 401 &&
|
|
loginResponse.error?.code === "AUTH_001" &&
|
|
!loginResponse.setCookie,
|
|
"stale_login_was_accepted",
|
|
);
|
|
} finally {
|
|
resetAbort.abort();
|
|
loginAbort.abort();
|
|
if (holderInTransaction) {
|
|
await holder.query("ROLLBACK").catch(() => undefined);
|
|
}
|
|
await Promise.allSettled([resetPromise, loginPromise].filter(Boolean));
|
|
await holder.end().catch(() => undefined);
|
|
await observer.end().catch(() => undefined);
|
|
}
|
|
|
|
const after = await getEmployeeSecurityState(prisma, context.employeeId);
|
|
const [activeSessions, successAuditAfter, loginAuditAfter] = await Promise.all([
|
|
prisma.authSession.count({
|
|
where: {
|
|
employee_id: context.employeeId,
|
|
revoked_at: null,
|
|
expires_at: { gt: new Date() },
|
|
},
|
|
}),
|
|
countAudit(prisma, context.employeeId, "AUTH_PASSWORD_RESET_SUCCEEDED"),
|
|
countAudit(prisma, context.employeeId, "AUTH_LOGIN_SUCCESS"),
|
|
]);
|
|
assertCondition(after.token_version === before.token_version + 1, "race_token_version_invalid");
|
|
assertCondition(await verifyPassword(racePassword, after.password_hash), "race_password_not_active");
|
|
assertCondition(
|
|
!(await verifyPassword(currentPassword, after.password_hash)),
|
|
"race_old_password_still_active",
|
|
);
|
|
assertCondition(activeSessions === 0, "race_active_session_remains");
|
|
assertCondition(successAuditAfter === successAuditBefore + 1, "race_success_audit_invalid");
|
|
assertCondition(loginAuditAfter === loginAuditBefore, "race_login_success_audit_created");
|
|
return racePassword;
|
|
}
|
|
|
|
async function runLoginFirstResetRace({ prisma, context, currentPassword }) {
|
|
const before = await getEmployeeSecurityState(prisma, context.employeeId);
|
|
assertCondition(
|
|
await verifyPassword(currentPassword, before.password_hash),
|
|
"login_first_current_password_mismatch",
|
|
);
|
|
const challenge = await preparePasswordResetChallenge({
|
|
prisma,
|
|
employeeId: context.employeeId,
|
|
pepper: context.pepper,
|
|
includeSession: false,
|
|
});
|
|
const successAuditBefore = await countAudit(
|
|
prisma,
|
|
context.employeeId,
|
|
"AUTH_PASSWORD_RESET_SUCCEEDED",
|
|
);
|
|
const loginAuditBefore = await countAudit(prisma, context.employeeId, "AUTH_LOGIN_SUCCESS");
|
|
const nextPassword = createStrongPassword("LoginFirstReset");
|
|
const fingerprint = "auth-login-first-reset";
|
|
|
|
const holder = new Client({ connectionString: context.databaseUrl });
|
|
const observer = new Client({ connectionString: context.databaseUrl });
|
|
const loginAbort = new AbortController();
|
|
const resetAbort = new AbortController();
|
|
let holderInTransaction = false;
|
|
let loginPromise = null;
|
|
let resetPromise = null;
|
|
let loginResponse = null;
|
|
let resetResponse = null;
|
|
|
|
try {
|
|
await holder.connect();
|
|
await observer.connect();
|
|
const holderPid = holder.processID;
|
|
const observerPid = observer.processID;
|
|
await holder.query("BEGIN");
|
|
holderInTransaction = true;
|
|
await holder.query('SELECT id FROM "employees" WHERE id = $1::uuid FOR UPDATE', [
|
|
context.employeeId,
|
|
]);
|
|
|
|
loginPromise = loginForRace({
|
|
baseUrl: context.baseUrl,
|
|
email: context.employeeEmail,
|
|
password: currentPassword,
|
|
fingerprint,
|
|
signal: loginAbort.signal,
|
|
});
|
|
await waitForBlockedConnections(observer, [holderPid, observerPid], 1, 15_000);
|
|
|
|
resetPromise = postJson(
|
|
context.baseUrl,
|
|
"/api/auth/reset-password",
|
|
{
|
|
email: context.employeeEmail,
|
|
code: challenge.code,
|
|
newPassword: nextPassword,
|
|
},
|
|
{ signal: resetAbort.signal },
|
|
);
|
|
await waitForBlockedConnections(observer, [holderPid, observerPid], 2, 20_000);
|
|
|
|
await holder.query("COMMIT");
|
|
holderInTransaction = false;
|
|
[loginResponse, resetResponse] = await Promise.all([
|
|
withTimeout(loginPromise, 30_000, "login_first_login_timeout"),
|
|
withTimeout(resetPromise, 30_000, "login_first_reset_timeout"),
|
|
]);
|
|
|
|
assertCondition(
|
|
loginResponse.status === 200 &&
|
|
typeof loginResponse.accessToken === "string" &&
|
|
typeof loginResponse.refreshCookie === "string",
|
|
"login_first_login_failed",
|
|
);
|
|
assertCondition(resetResponse.status === 200, "login_first_reset_failed");
|
|
} finally {
|
|
loginAbort.abort();
|
|
resetAbort.abort();
|
|
if (holderInTransaction) {
|
|
await holder.query("ROLLBACK").catch(() => undefined);
|
|
}
|
|
await Promise.allSettled([loginPromise, resetPromise].filter(Boolean));
|
|
await holder.end().catch(() => undefined);
|
|
await observer.end().catch(() => undefined);
|
|
}
|
|
|
|
const [accessProbe, refreshProbe] = await Promise.all([
|
|
getWithAccessToken(context.baseUrl, "/api/me", loginResponse.accessToken),
|
|
postJson(
|
|
context.baseUrl,
|
|
"/api/auth/refresh",
|
|
{},
|
|
{
|
|
headers: {
|
|
cookie: loginResponse.refreshCookie,
|
|
origin: context.baseUrl,
|
|
"x-device-fingerprint": fingerprint,
|
|
},
|
|
},
|
|
),
|
|
]);
|
|
assertCondition(
|
|
accessProbe.status === 401 && accessProbe.errorCode === "AUTH_004",
|
|
"login_first_old_access_token_active",
|
|
);
|
|
assertCondition(
|
|
refreshProbe.status === 401 && refreshProbe.error?.code === "AUTH_005",
|
|
"login_first_old_refresh_token_active",
|
|
);
|
|
|
|
const after = await getEmployeeSecurityState(prisma, context.employeeId);
|
|
const [activeSessions, successAuditAfter, loginAuditAfter] = await Promise.all([
|
|
prisma.authSession.count({
|
|
where: {
|
|
employee_id: context.employeeId,
|
|
revoked_at: null,
|
|
expires_at: { gt: new Date() },
|
|
},
|
|
}),
|
|
countAudit(prisma, context.employeeId, "AUTH_PASSWORD_RESET_SUCCEEDED"),
|
|
countAudit(prisma, context.employeeId, "AUTH_LOGIN_SUCCESS"),
|
|
]);
|
|
assertCondition(
|
|
after.token_version === before.token_version + 1,
|
|
"login_first_token_version_invalid",
|
|
);
|
|
assertCondition(await verifyPassword(nextPassword, after.password_hash), "login_first_password_not_active");
|
|
assertCondition(activeSessions === 0, "login_first_session_not_revoked");
|
|
assertCondition(successAuditAfter === successAuditBefore + 1, "login_first_reset_audit_invalid");
|
|
assertCondition(loginAuditAfter === loginAuditBefore + 1, "login_first_login_audit_invalid");
|
|
return nextPassword;
|
|
}
|
|
|
|
async function runRefreshResetRace({ prisma, context, currentPassword }) {
|
|
const before = await getEmployeeSecurityState(prisma, context.employeeId);
|
|
assertCondition(
|
|
await verifyPassword(currentPassword, before.password_hash),
|
|
"refresh_race_current_password_mismatch",
|
|
);
|
|
const challenge = await preparePasswordResetChallenge({
|
|
prisma,
|
|
employeeId: context.employeeId,
|
|
pepper: context.pepper,
|
|
includeSession: true,
|
|
});
|
|
assertCondition(
|
|
typeof challenge.refreshToken === "string" && typeof challenge.refreshSessionId === "string",
|
|
"refresh_race_session_missing",
|
|
);
|
|
const successAuditBefore = await countAudit(
|
|
prisma,
|
|
context.employeeId,
|
|
"AUTH_PASSWORD_RESET_SUCCEEDED",
|
|
);
|
|
const nextPassword = createStrongPassword("RefreshReset");
|
|
|
|
const holder = new Client({ connectionString: context.databaseUrl });
|
|
const observer = new Client({ connectionString: context.databaseUrl });
|
|
const resetAbort = new AbortController();
|
|
const refreshAbort = new AbortController();
|
|
let holderInTransaction = false;
|
|
let resetPromise = null;
|
|
let refreshPromise = null;
|
|
|
|
try {
|
|
await holder.connect();
|
|
await observer.connect();
|
|
const holderPid = holder.processID;
|
|
const observerPid = observer.processID;
|
|
await holder.query("BEGIN");
|
|
holderInTransaction = true;
|
|
await holder.query('SELECT id FROM "employees" WHERE id = $1::uuid FOR UPDATE', [
|
|
context.employeeId,
|
|
]);
|
|
|
|
resetPromise = postJson(
|
|
context.baseUrl,
|
|
"/api/auth/reset-password",
|
|
{
|
|
email: context.employeeEmail,
|
|
code: challenge.code,
|
|
newPassword: nextPassword,
|
|
},
|
|
{ signal: resetAbort.signal },
|
|
);
|
|
await waitForBlockedConnections(observer, [holderPid, observerPid], 1, 15_000);
|
|
|
|
refreshPromise = postJson(
|
|
context.baseUrl,
|
|
"/api/auth/refresh",
|
|
{},
|
|
{
|
|
headers: {
|
|
cookie: `refresh_token=${challenge.refreshToken}`,
|
|
origin: context.baseUrl,
|
|
"x-device-fingerprint": "auth-concurrency-check",
|
|
},
|
|
signal: refreshAbort.signal,
|
|
},
|
|
);
|
|
await waitForBlockedConnections(observer, [holderPid, observerPid], 2, 20_000);
|
|
|
|
await holder.query("COMMIT");
|
|
holderInTransaction = false;
|
|
const [resetResponse, refreshResponse] = await Promise.all([
|
|
withTimeout(resetPromise, 30_000, "refresh_race_reset_timeout"),
|
|
withTimeout(refreshPromise, 30_000, "refresh_race_refresh_timeout"),
|
|
]);
|
|
assertCondition(resetResponse.status === 200, "refresh_race_reset_failed");
|
|
assertCondition(
|
|
refreshResponse.status === 401 && refreshResponse.error?.code === "AUTH_005",
|
|
"refresh_rotated_after_reset",
|
|
);
|
|
} finally {
|
|
resetAbort.abort();
|
|
refreshAbort.abort();
|
|
if (holderInTransaction) {
|
|
await holder.query("ROLLBACK").catch(() => undefined);
|
|
}
|
|
await Promise.allSettled([resetPromise, refreshPromise].filter(Boolean));
|
|
await holder.end().catch(() => undefined);
|
|
await observer.end().catch(() => undefined);
|
|
}
|
|
|
|
const after = await getEmployeeSecurityState(prisma, context.employeeId);
|
|
const [session, activeSessions, successAuditAfter] = await Promise.all([
|
|
prisma.authSession.findUnique({
|
|
where: { id: challenge.refreshSessionId },
|
|
select: { revoked_at: true },
|
|
}),
|
|
prisma.authSession.count({
|
|
where: {
|
|
employee_id: context.employeeId,
|
|
revoked_at: null,
|
|
expires_at: { gt: new Date() },
|
|
},
|
|
}),
|
|
countAudit(prisma, context.employeeId, "AUTH_PASSWORD_RESET_SUCCEEDED"),
|
|
]);
|
|
assertCondition(after.token_version === before.token_version + 1, "refresh_race_token_version_invalid");
|
|
assertCondition(await verifyPassword(nextPassword, after.password_hash), "refresh_race_password_not_active");
|
|
assertCondition(session?.revoked_at instanceof Date, "refresh_race_original_session_active");
|
|
assertCondition(activeSessions === 0, "refresh_race_active_session_remains");
|
|
assertCondition(successAuditAfter === successAuditBefore + 1, "refresh_race_audit_invalid");
|
|
return nextPassword;
|
|
}
|
|
|
|
async function runAuthPostgresConcurrencyCheck(env = process.env) {
|
|
const context = validateAuthConcurrencyEnvironment(env);
|
|
const { prisma, pool } = createPrismaClient();
|
|
try {
|
|
console.log("[AUTH-CONCURRENCY] forgot-password-20: start");
|
|
await runConcurrentForgotPasswordRequests({ prisma, context });
|
|
console.log("[AUTH-CONCURRENCY] forgot-password-20: pass");
|
|
console.log("[AUTH-CONCURRENCY] same-code-20: start");
|
|
let currentPassword = await runSameCodeConcurrency({ prisma, context });
|
|
console.log("[AUTH-CONCURRENCY] same-code-20: pass");
|
|
console.log("[AUTH-CONCURRENCY] reset-first-login-race: start");
|
|
currentPassword = await runLoginResetRace({ prisma, context, currentPassword });
|
|
console.log("[AUTH-CONCURRENCY] reset-first-login-race: pass");
|
|
console.log("[AUTH-CONCURRENCY] login-first-reset-race: start");
|
|
currentPassword = await runLoginFirstResetRace({ prisma, context, currentPassword });
|
|
console.log("[AUTH-CONCURRENCY] login-first-reset-race: pass");
|
|
console.log("[AUTH-CONCURRENCY] refresh-reset-race: start");
|
|
await runRefreshResetRace({ prisma, context, currentPassword });
|
|
console.log("[AUTH-CONCURRENCY] refresh-reset-race: pass");
|
|
} finally {
|
|
await prisma.$disconnect().catch(() => undefined);
|
|
await pool.end().catch(() => undefined);
|
|
}
|
|
}
|
|
|
|
if (require.main === module) {
|
|
runAuthPostgresConcurrencyCheck().catch((error) => {
|
|
const code =
|
|
error instanceof AuthConcurrencyCheckError
|
|
? error.safeCode
|
|
: "auth_concurrency_check_failed";
|
|
console.error(`[AUTH-CONCURRENCY][FAIL] ${code}`);
|
|
process.exitCode = 1;
|
|
});
|
|
}
|
|
|
|
module.exports = {
|
|
AuthConcurrencyCheckError,
|
|
runAuthPostgresConcurrencyCheck,
|
|
validateAuthConcurrencyEnvironment,
|
|
validateAuthRegressionEnvironment,
|
|
};
|