mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-09-30 12:39:42 +02:00
334 lines
11 KiB
TypeScript
334 lines
11 KiB
TypeScript
/**
|
|
* Auth security tests — verifies security fixes:
|
|
* 1. Timing-safe password comparison (timingSafeEqual)
|
|
* 2. Hook event endpoint restricted to localhost
|
|
* 3. Session cookie TTL refresh on access
|
|
* 4. Startup fails closed when network-bound without auth
|
|
* 5. SSE client limit enforcement
|
|
* 6. Logout endpoint invalidates session
|
|
* 7. Settings schema rejects unknown fields
|
|
*
|
|
* Port: 3160 (auth tests), 3161 (loopback no-auth tests), 3162 (network override tests)
|
|
*/
|
|
import { describe, it, expect, beforeAll, afterAll } from 'vitest';
|
|
import { WebServer } from '../src/web/server.js';
|
|
import { SettingsUpdateSchema } from '../src/web/schemas.js';
|
|
|
|
const AUTH_PORT = 3160;
|
|
const NOAUTH_PORT = 3161;
|
|
const NETWORK_OVERRIDE_PORT = 3162;
|
|
const TEST_USER = 'admin';
|
|
const TEST_PASS = 'test-password-12345';
|
|
|
|
function basicAuthHeader(user: string, pass: string): string {
|
|
return 'Basic ' + Buffer.from(`${user}:${pass}`).toString('base64');
|
|
}
|
|
|
|
describe('Auth Security', () => {
|
|
let server: WebServer;
|
|
let baseUrl: string;
|
|
|
|
beforeAll(async () => {
|
|
process.env.CODEMAN_PASSWORD = TEST_PASS;
|
|
process.env.CODEMAN_USERNAME = TEST_USER;
|
|
server = new WebServer(AUTH_PORT, false, true);
|
|
await server.start();
|
|
baseUrl = `http://localhost:${AUTH_PORT}`;
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await server.stop();
|
|
delete process.env.CODEMAN_PASSWORD;
|
|
delete process.env.CODEMAN_USERNAME;
|
|
});
|
|
|
|
describe('Basic Auth', () => {
|
|
it('should reject requests without credentials', async () => {
|
|
const res = await fetch(`${baseUrl}/api/status`);
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('should accept correct credentials', async () => {
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
|
|
});
|
|
expect(res.status).toBe(200);
|
|
});
|
|
|
|
it('should reject wrong password', async () => {
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader(TEST_USER, 'wrong') },
|
|
});
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('should reject wrong username', async () => {
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader('hacker', TEST_PASS) },
|
|
});
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('should reject empty authorization header', async () => {
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: '' },
|
|
});
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('should reject malformed authorization header', async () => {
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: 'Bearer some-token' },
|
|
});
|
|
expect(res.status).toBe(401);
|
|
});
|
|
});
|
|
|
|
describe('Session Cookies', () => {
|
|
it('should issue session cookie on successful auth', async () => {
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
|
|
});
|
|
expect(res.status).toBe(200);
|
|
const setCookie = res.headers.get('set-cookie');
|
|
expect(setCookie).toBeTruthy();
|
|
expect(setCookie).toContain('codeman_session=');
|
|
expect(setCookie).toContain('HttpOnly');
|
|
expect(setCookie).toContain('SameSite=Lax');
|
|
});
|
|
|
|
it('should accept requests with valid session cookie', async () => {
|
|
// First, authenticate to get a cookie
|
|
const authRes = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
|
|
});
|
|
const setCookie = authRes.headers.get('set-cookie')!;
|
|
const cookieMatch = setCookie.match(/codeman_session=([^;]+)/);
|
|
expect(cookieMatch).toBeTruthy();
|
|
const cookie = `codeman_session=${cookieMatch![1]}`;
|
|
|
|
// Use the cookie without Basic Auth header
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Cookie: cookie },
|
|
});
|
|
expect(res.status).toBe(200);
|
|
});
|
|
|
|
it('should reject requests with invalid session cookie', async () => {
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Cookie: 'codeman_session=invalid-token-value' },
|
|
});
|
|
expect(res.status).toBe(401);
|
|
});
|
|
});
|
|
|
|
describe('Logout', () => {
|
|
it('should invalidate session cookie on logout', async () => {
|
|
// Authenticate to get a cookie
|
|
const authRes = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
|
|
});
|
|
const setCookie = authRes.headers.get('set-cookie')!;
|
|
const cookieMatch = setCookie.match(/codeman_session=([^;]+)/);
|
|
expect(cookieMatch).toBeTruthy();
|
|
const cookie = `codeman_session=${cookieMatch![1]}`;
|
|
|
|
// Verify cookie works
|
|
const beforeRes = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Cookie: cookie },
|
|
});
|
|
expect(beforeRes.status).toBe(200);
|
|
|
|
// Logout
|
|
const logoutRes = await fetch(`${baseUrl}/api/logout`, {
|
|
method: 'POST',
|
|
headers: { Cookie: cookie },
|
|
});
|
|
expect(logoutRes.status).toBe(200);
|
|
|
|
// Cookie should no longer work
|
|
const afterRes = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Cookie: cookie },
|
|
});
|
|
expect(afterRes.status).toBe(401);
|
|
});
|
|
});
|
|
|
|
describe('Rate Limiting', () => {
|
|
it('should block after too many failed attempts', async () => {
|
|
// Send 10 failed attempts
|
|
for (let i = 0; i < 10; i++) {
|
|
await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader(TEST_USER, 'wrong-' + i) },
|
|
});
|
|
}
|
|
|
|
// 11th attempt should be rate-limited
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader(TEST_USER, 'wrong-again') },
|
|
});
|
|
expect(res.status).toBe(429);
|
|
});
|
|
|
|
it('should rate-limit even with correct credentials after lockout', async () => {
|
|
// After being rate-limited, even correct credentials should fail
|
|
const res = await fetch(`${baseUrl}/api/status`, {
|
|
headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
|
|
});
|
|
// Rate limit is per-IP and the previous test used the same IP
|
|
// This test verifies rate limiting isn't bypassed by correct creds
|
|
expect(res.status).toBe(429);
|
|
});
|
|
});
|
|
|
|
describe('Hook Event Endpoint', () => {
|
|
it('should allow hook events from localhost without auth', async () => {
|
|
const res = await fetch(`${baseUrl}/api/hook-event`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
event: 'stop',
|
|
sessionId: 'nonexistent-session',
|
|
data: {},
|
|
}),
|
|
});
|
|
// Should pass auth (localhost bypass) but may 404 on session — that's fine
|
|
// The key assertion is it does NOT return 401
|
|
expect(res.status).not.toBe(401);
|
|
});
|
|
|
|
it('should reject hook events with invalid schema', async () => {
|
|
const res = await fetch(`${baseUrl}/api/hook-event`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ invalid: 'data' }),
|
|
});
|
|
// Schema validation should catch this
|
|
expect(res.status).not.toBe(401); // Not an auth error
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('Settings Schema Security', () => {
|
|
it('should accept valid known settings fields', () => {
|
|
const result = SettingsUpdateSchema.safeParse({
|
|
tunnelEnabled: true,
|
|
ralphTrackerEnabled: false,
|
|
defaultClaudeMdPath: '/some/path',
|
|
});
|
|
expect(result.success).toBe(true);
|
|
});
|
|
|
|
it('should enforce tunnelEnabled as boolean', () => {
|
|
const result = SettingsUpdateSchema.safeParse({
|
|
tunnelEnabled: 'yes', // truthy string — should be rejected
|
|
});
|
|
expect(result.success).toBe(false);
|
|
});
|
|
|
|
it('should reject unknown fields (strict mode)', () => {
|
|
const result = SettingsUpdateSchema.safeParse({
|
|
tunnelEnabled: true,
|
|
maliciousField: 'injected',
|
|
});
|
|
expect(result.success).toBe(false);
|
|
});
|
|
|
|
it('should accept notification preferences', () => {
|
|
const result = SettingsUpdateSchema.safeParse({
|
|
notificationPreferences: {
|
|
enabled: true,
|
|
browserNotifications: true,
|
|
audioAlerts: false,
|
|
eventTypes: {
|
|
stop: { enabled: true, browser: true, audio: false },
|
|
},
|
|
},
|
|
});
|
|
expect(result.success).toBe(true);
|
|
});
|
|
|
|
it('should accept voice settings', () => {
|
|
const result = SettingsUpdateSchema.safeParse({
|
|
voiceSettings: {
|
|
apiKey: 'some-key',
|
|
language: 'en-US',
|
|
},
|
|
});
|
|
expect(result.success).toBe(true);
|
|
});
|
|
|
|
it('should validate nice value range', () => {
|
|
const validResult = SettingsUpdateSchema.safeParse({
|
|
nice: { enabled: true, niceValue: 10 },
|
|
});
|
|
expect(validResult.success).toBe(true);
|
|
|
|
const invalidResult = SettingsUpdateSchema.safeParse({
|
|
nice: { enabled: true, niceValue: 100 }, // Out of range
|
|
});
|
|
expect(invalidResult.success).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('No-Auth Server Startup Policy', () => {
|
|
let server: WebServer;
|
|
|
|
beforeAll(async () => {
|
|
delete process.env.CODEMAN_PASSWORD;
|
|
delete process.env.CODEMAN_USERNAME;
|
|
delete process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK;
|
|
server = new WebServer(NOAUTH_PORT, false, true, '127.0.0.1');
|
|
await server.start();
|
|
});
|
|
|
|
afterAll(async () => {
|
|
delete process.env.CODEMAN_PASSWORD;
|
|
delete process.env.CODEMAN_USERNAME;
|
|
delete process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK;
|
|
await server.stop();
|
|
});
|
|
|
|
it('allows loopback requests without auth when no password is configured', async () => {
|
|
const res = await fetch(`http://localhost:${NOAUTH_PORT}/api/status`);
|
|
expect(res.status).toBe(200);
|
|
});
|
|
|
|
it('rejects non-loopback startup without a password or explicit override', async () => {
|
|
const networkServer = new WebServer(0, false, true, '0.0.0.0');
|
|
|
|
await expect(networkServer.start()).rejects.toThrow(/CODEMAN_PASSWORD/);
|
|
|
|
await networkServer.stop();
|
|
});
|
|
|
|
it('allows non-loopback startup when CODEMAN_PASSWORD is configured', async () => {
|
|
process.env.CODEMAN_PASSWORD = TEST_PASS;
|
|
const networkServer = new WebServer(0, false, true, '0.0.0.0');
|
|
|
|
await networkServer.start();
|
|
await networkServer.stop();
|
|
|
|
delete process.env.CODEMAN_PASSWORD;
|
|
});
|
|
|
|
it('allows non-loopback startup with the explicit unauthenticated-network override', async () => {
|
|
const networkServer = new WebServer(NETWORK_OVERRIDE_PORT, false, true, '0.0.0.0', undefined, true);
|
|
|
|
await networkServer.start();
|
|
const res = await fetch(`http://localhost:${NETWORK_OVERRIDE_PORT}/api/status`);
|
|
expect(res.status).toBe(200);
|
|
await networkServer.stop();
|
|
});
|
|
|
|
it('allows non-loopback startup with the explicit unauthenticated-network env override', async () => {
|
|
process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK = 'true';
|
|
const networkServer = new WebServer(0, false, true, '0.0.0.0');
|
|
|
|
await networkServer.start();
|
|
await networkServer.stop();
|
|
|
|
delete process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK;
|
|
});
|
|
});
|