mdg-filius/packages/server/test/ticket.test.ts

// The entry ticket checked in Node as itsdangerous checks it in Python
// (tools/ticket-oracle → tickets.python.json): every ticket the oracle made
// reads the same — the same payload, or refused where Python refuses it, for
// the same reason (a signature that does not match, an age beyond 60 s or
// more than 5 s ahead) —, except a ticket signed up to 5 s ahead of F's
// clock, which Python refuses and F takes (two machines' clocks); tickets signed in Node carry the same JSON and the same moment
// as Python's (packed by Node's zlib, Chromium's, the bytes differ; an
// unpacked one is the same to the byte); and
// the claims the server takes from a ticket: a person, a login, a project
// and a level, or nothing.

import { readFileSync } from 'node:fs';
import { inflateSync } from 'node:zlib';
import { describe, expect, it } from 'vitest';
import { readSigned, signature, TICKET_AHEAD_SECONDS, TICKET_SALT, TICKET_SECONDS, TicketError, verifyTicket } from '../src/ticket.js';
import { signTicket } from './tickets.js';

interface OracleCase {
  readonly name: string;
  readonly ticket: string;
  readonly now: number;
  readonly payload?: unknown;
  readonly error?: 'expired' | 'badSignature';
}

const oracle = JSON.parse(readFileSync(new URL('./tickets.python.json', import.meta.url), 'utf8')) as {
  readonly secret: string;
  readonly salt: string;
  readonly ttl: number;
  readonly signedAt: number;
  readonly cases: readonly OracleCase[];
};
/** A ticket's JSON as signed, unpacked. */
const unpacked = (ticket: string) => {
  const body = ticket.split('.').at(-3)!;
  const bytes = Buffer.from(body, 'base64url');
  return (ticket.startsWith('.') ? inflateSync(bytes) : bytes).toString('utf8');
};
const byName = (name: string) => oracle.cases.find((each) => each.name === name)!;
/** Python refuses these, F takes them: signed ahead of F's clock, within TICKET_AHEAD_SECONDS. */
const AHEAD = ['fromTheFuture', 'fiveSecondsAhead'];

function outcome(ticket: string, now: number): { payload: unknown } | { error: string } {
  try {
    return { payload: readSigned(ticket, oracle.secret, now) };
  } catch (error) {
    expect(error).toBeInstanceOf(TicketError);
    const message = (error as Error).message;
    return { error: /old|future/.test(message) ? 'expired' : 'badSignature' };
  }
}

describe('the ticket as itsdangerous signs it', () => {
  it('shares the salt and the lifetime with the dashboard', () => {
    expect([TICKET_SALT, TICKET_SECONDS]).toEqual([oracle.salt, oracle.ttl]);
  });

  it.each(oracle.cases.filter((each) => !AHEAD.includes(each.name)).map((each) => [each.name, each] as const))('reads „%s“ as Python does', (_name, each) => {
    expect(outcome(each.ticket, each.now)).toEqual(each.error === undefined ? { payload: each.payload } : { error: each.error });
  });

  it.each(oracle.cases.filter((each) => each.error === undefined).map((each) => [each.name, each] as const))('signs „%s“ with the same JSON at the same moment', (_name, each) => {
    const ours = signTicket(each.payload, oracle.secret, oracle.signedAt);
    const [body, stamp] = ours.split('.').slice(-3);
    const [theirBody, theirStamp] = each.ticket.split('.').slice(-3);
    expect(unpacked(ours)).toBe(unpacked(each.ticket));
    expect([ours.startsWith('.'), stamp]).toEqual([each.ticket.startsWith('.'), theirStamp]);
    if (!ours.startsWith('.')) expect(body).toBe(theirBody);
    expect(readSigned(ours, oracle.secret, oracle.signedAt)).toEqual(each.payload);
  });

  it.each(AHEAD)('takes „%s“, which Python refuses: a ticket from up to 5 s ahead of F\'s clock', (name) => {
    const each = byName(name);
    expect(each.error).toBe('expired');
    expect(outcome(each.ticket, each.now)).toEqual({ payload: byName('plain').payload });
    expect(oracle.signedAt - each.now).toBeLessThanOrEqual(TICKET_AHEAD_SECONDS);
  });

  it('covers a packed and an unpacked payload', () => {
    expect(byName('plain').ticket.startsWith('.')).toBe(true);
    expect(byName('listPayload').ticket.startsWith('.')).toBe(false);
  });

  it('refuses without a secret, whatever the ticket', () => {
    expect(() => readSigned(signTicket({ a: 1 }, '', oracle.signedAt), '', oracle.signedAt)).toThrow('no secret');
  });

  it('refuses a signed value without a moment of signing', () => {
    const value = Buffer.from('{}').toString('base64url');
    expect(() => readSigned(`${value}.${signature(value, oracle.secret)}`, oracle.secret, oracle.signedAt)).toThrow('no timestamp');
  });

  it('refuses a signed payload that is not packed JSON', () => {
    const value = `${Buffer.from('{"u":').toString('base64url')}.${Buffer.from([1]).toString('base64url')}`;
    const forged = signTicket({}, oracle.secret, 1).replace(/^[^.]*\.[^.]*/, value);
    // Re-signed after the change, so that only the payload is wrong.
    const signed = `${value}.${forged.split('.').at(-1)}`;
    expect(() => readSigned(signed, oracle.secret, 1)).toThrow();
    expect(() => readSigned(`.${Buffer.from('no zlib').toString('base64url')}.AQ.x`, oracle.secret, 1)).toThrow(TicketError);
  });
});

describe('the claims of a ticket', () => {
  const claims = (name: string) => verifyTicket(byName(name).ticket, oracle.secret, byName(name).now);

  it('names the person, the project and the level', () => {
    expect(claims('plain')).toEqual({
      user: '0b8f5f2e-1a3c-4d5e-8f90-123456789abc',
      login: 'ab12',
      name: 'Ada Beispiel',
      color: '#3366cc',
      language: 'de',
      project: '6f1d2c3b-4a59-4e8d-9c7b-a1b2c3d4e5f6',
      level: 'write',
    });
    expect(claims('readLevel').level).toBe('read');
    expect(claims('umlautsAndEmoji')).toMatchObject({ name: 'Jörg Ömer Weiß 🐧', language: 'en' });
  });

  it('fills the name, the colour and the language in when they are missing or empty', () => {
    expect(claims('onlyRequired')).toMatchObject({ login: 'ab12', name: 'ab12', color: '', language: 'de', level: 'read' });
    const at = oracle.signedAt;
    const empty = { u: '0b8f5f2e-1a3c-4d5e-8f90-123456789abc', n: 'ab12', d: '', c: '', lang: '', p: '6f1d2c3b-4a59-4e8d-9c7b-a1b2c3d4e5f6', lvl: 'read' };
    expect(verifyTicket(signTicket(empty, 's', at), 's', at)).toMatchObject({ name: 'ab12', color: '', language: 'de' });
    expect(() => verifyTicket(signTicket({ ...empty, n: '' }, 's', at), 's', at)).toThrow('no login');
    expect(() => verifyTicket(signTicket({ ...empty, n: 7 }, 's', at), 's', at)).toThrow('no login');
  });

  it.each([
    ['listPayload', 'payload is not an object'],
    ['withoutLevel', 'no level'],
    ['unknownLevel', 'no level'],
    ['projectNotAUuid', 'no project'],
    ['withoutName', 'no login'],
  ])('refuses „%s“ (%s)', (name, reason) => {
    expect(() => claims(name)).toThrow(reason);
  });

  it('refuses a person or a project that is not a UUID or only holds one, and null', () => {
    const at = oracle.signedAt;
    const person = '0b8f5f2e-1a3c-4d5e-8f90-123456789abc';
    const project = '6f1d2c3b-4a59-4e8d-9c7b-a1b2c3d4e5f6';
    const read = (fields: object) => verifyTicket(signTicket({ u: person, n: 'ab12', p: project, lvl: 'read', ...fields }, 's', at), 's', at);
    expect(() => read({ u: 'ab12' })).toThrow('no person');
    expect(() => read({ u: `x${person}` })).toThrow('no person');
    expect(() => read({ u: `${person}x` })).toThrow('no person');
    expect(() => read({ p: `../${project}` })).toThrow('no project');
    expect(() => read({ u: person.toUpperCase() })).toThrow('no person');
    expect(() => verifyTicket(signTicket(null, 's', at), 's', at)).toThrow('payload is not an object');
  });

  it('counts the age from now by default', () => {
    const ticket = signTicket({ u: '0b8f5f2e-1a3c-4d5e-8f90-123456789abc', n: 'ab12', p: '6f1d2c3b-4a59-4e8d-9c7b-a1b2c3d4e5f6', lvl: 'write' }, 's');
    expect(verifyTicket(ticket, 's').level).toBe('write');
    expect(() => verifyTicket(byName('plain').ticket, oracle.secret)).toThrow(TicketError);
  });
});