fix: seed builtin admin only on empty DB; recover page-load sessions with one refresh
Auth seeding (last-resort guard) - `_seed_builtin_admin()` in get_db() now skips when VACUUM_WALL_SEED_BUILTIN_ADMIN=0 or when the users table already contains any user — previously a fresh service start after a non-default bootstrap (e.g. --mgmt-user alice) seeded a hard-coded `admin` with an unrecoverable random password, shadowing the operator's account - bootstrap_auth.py sets VACUUM_WALL_SEED_BUILTIN_ADMIN=0: bootstrap creates the operator user itself on a fresh install, so exactly one account exists and no seeded admin can appear Frontend (session recovery) - on page load/restore the in-memory TTL timer is gone, so a valid 7-day refresh token could sit in sessionStorage while the access token is already expired server-side: the session `check` now attempts exactly one refresh (POST /api/auth/refresh with the stored refresh token) on 401 before treating the session as dead - extract shared `_doRefresh()` used by both the `check` 401 fallback and the `refresh` action (removes the duplicated rotation logic) Tests - update seeding tests to the new any-user-present check; add test_seed_skipped_when_users_exist, test_seed_skipped_via_env, test_bootstrap_flow_creates_exactly_one_user, and the auth-model JS test suite (tests/test-auth-model.js) Docs - AGENTS.md: document VACUUM_WALL_SEED_BUILTIN_ADMIN - architecture.md / hoover.md / security.md: describe the bootstrap check 401 → one-refresh fallback path
This commit is contained in:
@@ -0,0 +1,203 @@
|
||||
/**
|
||||
* Tests for hoover/auth_model.js
|
||||
*
|
||||
* Model-level tests: the 'check' action (session validation, including the
|
||||
* single refresh fallback on a 401) and the 'refresh' action (rotation).
|
||||
*
|
||||
* auth_model.js only pulls in model.js → reactivity.js (no DOM at import),
|
||||
* so the tests run under plain node with stubbed globals (fetch,
|
||||
* sessionStorage, document, window, timers).
|
||||
*
|
||||
* Run with `node tests/test-auth-model.js`.
|
||||
*/
|
||||
|
||||
import { createAuthModel } from '../webui/static/hoover/auth_model.js';
|
||||
import { modelRegister, modelFetch, getModel } from '../webui/static/hoover/model.js';
|
||||
|
||||
let passed = 0;
|
||||
let failed = 0;
|
||||
const tests = [];
|
||||
|
||||
function test(name, fn) {
|
||||
tests.push({ name, fn });
|
||||
}
|
||||
|
||||
function assert(cond, msg) {
|
||||
if (!cond) throw new Error(msg || 'Assertion failed');
|
||||
}
|
||||
|
||||
function assertEq(a, b, msg) {
|
||||
if (a !== b) throw new Error((msg || 'Assertion failed') + `: got ${JSON.stringify(a)}, want ${JSON.stringify(b)}`);
|
||||
}
|
||||
|
||||
/* ── Stubs ─────────────────────────────────────────────────── */
|
||||
|
||||
function makeStorage(initial = {}) {
|
||||
const m = new Map(Object.entries(initial));
|
||||
return {
|
||||
getItem: (k) => (m.has(k) ? m.get(k) : null),
|
||||
setItem: (k, v) => m.set(k, String(v)),
|
||||
removeItem: (k) => m.delete(k),
|
||||
keys: () => [...m.keys()],
|
||||
};
|
||||
}
|
||||
|
||||
/** Programmed URL → response queue. Missing routes are 500. */
|
||||
function makeFetch() {
|
||||
const byUrl = new Map();
|
||||
globalThis.fetch = async (url) => {
|
||||
const arr = byUrl.get(url) || [];
|
||||
const r = arr.length ? arr.shift() : { status: 500, body: { ok: false, error: 'unprogrammed route' } };
|
||||
return {
|
||||
ok: r.status >= 200 && r.status < 300,
|
||||
status: r.status,
|
||||
json: async () => r.body,
|
||||
};
|
||||
};
|
||||
const state = { calls: [], route: (url, status, body) => { if (!byUrl.has(url)) byUrl.set(url, []); state.calls.push(url); byUrl.get(url).push({ status, body }); } };
|
||||
return state;
|
||||
}
|
||||
|
||||
/** Stub the TTL refresh timer so the node process never waits on it. */
|
||||
const _timers = [];
|
||||
globalThis.setTimeout = (fn, ms) => { _timers.push({ fn, ms }); return _timers.length; };
|
||||
globalThis.clearTimeout = (id) => { if (id && _timers[id - 1]) _timers[id - 1] = undefined; };
|
||||
|
||||
const storedSession = {
|
||||
'vw:access': 'access-old',
|
||||
'vw:refresh': 'refresh-old',
|
||||
'vw:session_id': 'sess-old',
|
||||
'vw:access_ttl': '900000',
|
||||
};
|
||||
|
||||
/**
|
||||
* Stubs + model registration for one scenario.
|
||||
* @param {{initialStorage?: object, hash?: string}} [cfg]
|
||||
* @returns {{calls: string[], route: function, events: Array}}
|
||||
*/
|
||||
function setup({ initialStorage = storedSession, hash = '#/dashboard' } = {}) {
|
||||
const { calls, route } = makeFetch();
|
||||
globalThis.sessionStorage = makeStorage(initialStorage);
|
||||
globalThis.document = { location: { hash } };
|
||||
const events = [];
|
||||
globalThis.window = {
|
||||
dispatchEvent: (e) => events.push(e),
|
||||
addEventListener: () => {},
|
||||
};
|
||||
modelRegister('auth', createAuthModel());
|
||||
return { calls, route, events };
|
||||
}
|
||||
|
||||
/** Run the auth model action through the real modelFetch (dedup, hooks). */
|
||||
async function act(action) {
|
||||
await modelFetch('auth', { action });
|
||||
}
|
||||
|
||||
/* ── Tests ─────────────────────────────────────────────────── */
|
||||
|
||||
test('check 200 returns verified identity on the stored tokens', async () => {
|
||||
const s = setup();
|
||||
s.route('/api/auth/session', 200, {
|
||||
ok: true,
|
||||
data: { user: { username: 'alice' }, permissions: { firewall: 'rw' } },
|
||||
});
|
||||
await act('check');
|
||||
assertEq(s.calls.length, 1, 'session check only');
|
||||
assertEq(s.calls[0], '/api/auth/session');
|
||||
const data = getModel('auth').data;
|
||||
assertEq(data.token, 'access-old', 'stored access token kept');
|
||||
assertEq(data.refresh, 'refresh-old', 'stored refresh token kept');
|
||||
assertEq(data.session_id, 'sess-old', 'stored session_id kept');
|
||||
assertEq(data.user?.username, 'alice', 'verified user merged');
|
||||
assert(data.permissions?.firewall === 'rw', 'verified permissions merged');
|
||||
});
|
||||
|
||||
test('check 401 with stored refresh token: one refresh, session preserved', async () => {
|
||||
const s = setup();
|
||||
s.route('/api/auth/session', 401, { ok: false, error: 'unauthorized' });
|
||||
s.route('/api/auth/refresh', 200, {
|
||||
ok: true,
|
||||
data: {
|
||||
tokens: { access_token: 'access-new', refresh_token: 'refresh-new', session_id: 'sess-new' },
|
||||
user: { username: 'alice' },
|
||||
permissions: { firewall: 'rw' },
|
||||
access_ttl: 300,
|
||||
},
|
||||
});
|
||||
await act('check');
|
||||
assertEq(s.calls.length, 2, 'exactly one refresh attempt');
|
||||
assertEq(s.calls[0], '/api/auth/session', 'session check first');
|
||||
assertEq(s.calls[1], '/api/auth/refresh', 'refresh fallback second');
|
||||
const data = getModel('auth').data;
|
||||
assertEq(data.token, 'access-new', 'rotated access token');
|
||||
assertEq(data.refresh, 'refresh-new', 'rotated refresh token');
|
||||
assertEq(data.session_id, 'sess-new', 'rotated session_id binding wins');
|
||||
assertEq(data.user?.username, 'alice', 'refreshed identity');
|
||||
assertEq(globalThis.sessionStorage.getItem('vw:session_id'), 'sess-new', 'storage carries rotated session_id');
|
||||
assert(s.events.length === 0, 'no terminal event on recovered session');
|
||||
});
|
||||
|
||||
test('check 401 without refresh token: terminal, no refresh attempted', async () => {
|
||||
const s = setup({ initialStorage: { 'vw:access': 'access-old', 'vw:session_id': 'sess-old' } });
|
||||
s.route('/api/auth/session', 401, { ok: false, error: 'unauthorized' });
|
||||
await act('check');
|
||||
assertEq(s.calls.length, 1, 'session check only');
|
||||
assertEq(s.calls[0], '/api/auth/session');
|
||||
const data = getModel('auth').data;
|
||||
assert(!data?.token, 'terminal: no token');
|
||||
assert(globalThis.sessionStorage.keys().length === 0, 'storage cleared');
|
||||
assertEq(globalThis.document.location.hash, '/login', 'redirected to login');
|
||||
assert(s.events.some((e) => e.type === 'auth:logout'), 'terminal auth:logout dispatched');
|
||||
});
|
||||
|
||||
test('check 401 with failed refresh: terminal', async () => {
|
||||
const s = setup();
|
||||
s.route('/api/auth/session', 401, { ok: false, error: 'unauthorized' });
|
||||
s.route('/api/auth/refresh', 401, { ok: false, error: 'invalid refresh token' });
|
||||
await act('check');
|
||||
assertEq(s.calls.length, 2, 'refresh was attempted');
|
||||
assert(!getModel('auth').data?.token, 'terminal: no token');
|
||||
assert(globalThis.sessionStorage.keys().length === 0, 'storage cleared');
|
||||
assertEq(globalThis.document.location.hash, '/login', 'redirected to login');
|
||||
assert(s.events.some((e) => e.type === 'auth:logout'), 'terminal auth:logout dispatched');
|
||||
});
|
||||
|
||||
test('refresh action rotates tokens; new session_id wins, omitted fields fall back', async () => {
|
||||
const s = setup();
|
||||
s.route('/api/auth/refresh', 200, {
|
||||
ok: true,
|
||||
data: {
|
||||
tokens: { access_token: 'a2', refresh_token: 'r2', session_id: 's2' },
|
||||
access_ttl: 300,
|
||||
user: { username: 'alice' },
|
||||
permissions: { firewall: 'rw' },
|
||||
},
|
||||
});
|
||||
await act('refresh');
|
||||
assertEq(s.calls.length, 1, 'single refresh call');
|
||||
assertEq(s.calls[0], '/api/auth/refresh');
|
||||
const data = getModel('auth').data;
|
||||
assertEq(data.token, 'a2', 'rotated access token');
|
||||
assertEq(data.refresh, 'r2', 'rotated refresh token');
|
||||
assertEq(data.session_id, 's2', 'new session_id wins');
|
||||
assertEq(data.ttl, 300 * 1000, 'ttl from access_ttl seconds → ms');
|
||||
assertEq(globalThis.sessionStorage.getItem('vw:session_id'), 's2', 'storage rotated');
|
||||
assertEq(data.user?.username, 'alice', 'user from response');
|
||||
});
|
||||
|
||||
/* ── Runner ────────────────────────────────────────────────── */
|
||||
|
||||
(async () => {
|
||||
for (const { name, fn } of tests) {
|
||||
try {
|
||||
await fn();
|
||||
console.log(` \u2713 ${name}`);
|
||||
passed++;
|
||||
} catch (e) {
|
||||
console.error(` \u2717 ${name}: ${e.message}`);
|
||||
failed++;
|
||||
}
|
||||
}
|
||||
console.log(`${passed + failed} tests: ${passed} passed, ${failed} failed`);
|
||||
process.exitCode = failed ? 1 : 0;
|
||||
})();
|
||||
Reference in New Issue
Block a user