500 lines
17 KiB
TypeScript
500 lines
17 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import { describe, it } from "node:test";
|
|
import { authSessionCacheKvKey, authTokenHash } from "../src/auth.js";
|
|
import {
|
|
deviceRevocationRequest,
|
|
deviceRevocationRequestHash,
|
|
deviceRevocationProofBytes,
|
|
pendingDeviceRevocationProofBytes,
|
|
pendingDeviceRevocationRequestHash,
|
|
} from "../src/device_revocation_schema.js";
|
|
import { handleRequest } from "../src/index.js";
|
|
import {
|
|
ACCESS_TOKEN,
|
|
PUBLIC_KEY,
|
|
WRAPPING_PUBLIC_KEY,
|
|
sessionDocument,
|
|
signDeviceMessage,
|
|
testD1Database,
|
|
testEnv,
|
|
} from "./devices_test_support.js";
|
|
|
|
const USER_ID = "user-01", APPROVER_DEVICE_ID = "device-01";
|
|
const TARGET_DEVICE_ID = "device-02", OTHER_DEVICE_ID = "device-03";
|
|
const IDEMPOTENCY_KEY = "device-revocation-0001";
|
|
const PREVIOUS_KEY_ID = "a".repeat(64), NEW_KEY_ID = "b".repeat(64);
|
|
const PREVIOUS_GENERATION = 1, NEW_GENERATION = 2;
|
|
const SUITE = "HPKE-BASE-X25519-HKDF-SHA256-CHACHA20POLY1305";
|
|
describe("device revocation routes", () => {
|
|
it("atomically rotates the vault and revokes an approved device", async () => {
|
|
const body = deviceRevocationBody();
|
|
const d1 = testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
null,
|
|
currentVaultKeyRow(),
|
|
deviceRow({ device_id: TARGET_DEVICE_ID }),
|
|
await rotationResultRow(body, { r2_object_count: 2, r2_item_count: 2 }),
|
|
deviceRow({ device_id: TARGET_DEVICE_ID, approval_status: "revoked", revoked_at: 1_780_000_400 }),
|
|
],
|
|
allRowSets: [
|
|
[{ device_id: APPROVER_DEVICE_ID }, { device_id: OTHER_DEVICE_ID }],
|
|
[{ object_count: 2 }],
|
|
],
|
|
batchChanges: [[1, 1, 1, 1]],
|
|
});
|
|
|
|
const response = await revocationResponse(d1, body);
|
|
|
|
assert.equal(response.status, 200);
|
|
assert.equal(response.headers.get("cache-control"), "no-store");
|
|
assert.deepEqual(await response.json(), revocationDocument());
|
|
assert.deepEqual(d1.batches, [4]);
|
|
assert.ok(d1.queries[6]?.includes("INSERT INTO sync_vault_rotations"));
|
|
assert.ok(d1.queries[7]?.includes("INSERT INTO sync_vault_rotation_envelopes"));
|
|
assert.ok(d1.queries[5]?.includes("COUNT(*) AS object_count"));
|
|
assert.ok(d1.queries[9]?.includes("SET completed_at = ?"));
|
|
assert.deepEqual(d1.binds[6]?.slice(0, 2), [USER_ID, IDEMPOTENCY_KEY]);
|
|
assert.match(String(d1.binds[6]?.[2]), /^device-revoke:[a-f0-9]{64}$/);
|
|
assert.deepEqual(d1.binds[6]?.slice(3, 5), [TARGET_DEVICE_ID, APPROVER_DEVICE_ID]);
|
|
});
|
|
|
|
it("revokes a pending target without rotating or cleaning the vault", async () => {
|
|
const body = pendingRevocationBody();
|
|
const d1 = testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
null,
|
|
deviceRow({ approval_status: "pending", approved_at: null }),
|
|
await pendingResultRow(body),
|
|
deviceRow({ approval_status: "revoked", approved_at: null, revoked_at: 1_780_000_400 }),
|
|
],
|
|
batchChanges: [[1, 1]],
|
|
});
|
|
|
|
const response = await revocationResponse(d1, body);
|
|
|
|
assert.equal(response.status, 200);
|
|
assert.deepEqual(await response.json(), pendingRevocationDocument());
|
|
assert.deepEqual(d1.batches, [2]);
|
|
assert.ok(d1.queries[3]?.includes("INSERT INTO pending_device_revocations"));
|
|
assert.ok(d1.queries[4]?.includes("SET completed_at = ?"));
|
|
assert.equal(d1.queries.some((query) => query.includes("sync_vault_accounts")), false);
|
|
});
|
|
|
|
it("returns an exact pending revocation replay and rejects mismatches", async () => {
|
|
const body = pendingRevocationBody();
|
|
const replay = testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
await pendingResultRow(body),
|
|
deviceRow({ approval_status: "revoked", approved_at: null, revoked_at: 1_780_000_400 }),
|
|
],
|
|
});
|
|
assert.equal((await revocationResponse(replay, body)).status, 200);
|
|
assert.deepEqual(replay.batches, []);
|
|
|
|
const mismatch = testD1Database({
|
|
firstRows: [approverRow(), { ...await pendingResultRow(body), request_hash: "f".repeat(64) }],
|
|
});
|
|
assert.equal((await revocationResponse(mismatch, body)).status, 409);
|
|
assert.deepEqual(mismatch.batches, []);
|
|
});
|
|
|
|
it("rejects pending mode for an approved target and trigger races", async () => {
|
|
const body = pendingRevocationBody();
|
|
const approved = testD1Database({
|
|
firstRows: [approverRow(), null, deviceRow()],
|
|
});
|
|
assert.equal((await revocationResponse(approved, body)).status, 409);
|
|
assert.deepEqual(approved.batches, []);
|
|
|
|
const race = testD1Database({
|
|
firstRows: [approverRow(), null, deviceRow({ approval_status: "pending", approved_at: null })],
|
|
batchError: new Error("pending_device_revocation_guard_failed"),
|
|
});
|
|
assert.equal((await revocationResponse(race, body)).status, 409);
|
|
});
|
|
|
|
it("returns an exact idempotent replay", async () => {
|
|
const body = deviceRevocationBody();
|
|
const d1 = testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
await rotationResultRow(body),
|
|
deviceRow({ device_id: TARGET_DEVICE_ID, approval_status: "revoked", revoked_at: 1_780_000_400 }),
|
|
],
|
|
});
|
|
|
|
const response = await revocationResponse(d1, body);
|
|
|
|
assert.equal(response.status, 200);
|
|
assert.deepEqual(await response.json(), revocationDocument());
|
|
assert.deepEqual(d1.batches, []);
|
|
assert.equal(d1.queries.length, 3);
|
|
});
|
|
|
|
it("rejects a replay with different rotation metadata", async () => {
|
|
const body = deviceRevocationBody();
|
|
const d1 = testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
await rotationResultRow(body, { new_key_id: "c".repeat(64) }),
|
|
],
|
|
});
|
|
|
|
const response = await revocationResponse(d1, body);
|
|
|
|
assert.equal(response.status, 409);
|
|
assert.deepEqual(await response.json(), { error: "device_revocation_conflict" });
|
|
assert.deepEqual(d1.batches, []);
|
|
});
|
|
|
|
it("rejects missing and extra recipient envelopes", async () => {
|
|
const cases = [
|
|
{
|
|
body: deviceRevocationBody({ envelopes: [rotationEnvelope(APPROVER_DEVICE_ID)] }),
|
|
rows: [{ device_id: APPROVER_DEVICE_ID }, { device_id: OTHER_DEVICE_ID }],
|
|
},
|
|
{
|
|
body: deviceRevocationBody(),
|
|
rows: [{ device_id: APPROVER_DEVICE_ID }],
|
|
},
|
|
];
|
|
for (const testCase of cases) {
|
|
const d1 = preflightD1(testCase.rows);
|
|
const response = await revocationResponse(d1, testCase.body);
|
|
assert.equal(response.status, 409);
|
|
assert.deepEqual(await response.json(), { error: "device_revocation_conflict" });
|
|
assert.deepEqual(d1.batches, []);
|
|
}
|
|
});
|
|
|
|
it("rejects stale vault metadata before target reads", async () => {
|
|
const d1 = testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
null,
|
|
{ key_id: "c".repeat(64), generation: PREVIOUS_GENERATION },
|
|
],
|
|
});
|
|
|
|
const response = await revocationResponse(d1, deviceRevocationBody());
|
|
|
|
assert.equal(response.status, 409);
|
|
assert.deepEqual(d1.batches, []);
|
|
assert.equal(d1.queries.length, 3);
|
|
});
|
|
|
|
it("fails a rotation race when the D1 guard aborts", async () => {
|
|
const d1 = testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
null,
|
|
currentVaultKeyRow(),
|
|
deviceRow({ device_id: TARGET_DEVICE_ID }),
|
|
],
|
|
allRowSets: [
|
|
[{ device_id: APPROVER_DEVICE_ID }, { device_id: OTHER_DEVICE_ID }],
|
|
[{ object_count: 0 }],
|
|
],
|
|
batchError: new Error("sync_vault_rotation_guard_failed"),
|
|
});
|
|
|
|
const response = await revocationResponse(d1, deviceRevocationBody());
|
|
|
|
assert.equal(response.status, 409);
|
|
assert.deepEqual(await response.json(), { error: "device_revocation_conflict" });
|
|
});
|
|
|
|
it("fails closed when a zero-change finalize has no exact completed replay", async () => {
|
|
const body = deviceRevocationBody();
|
|
const d1 = testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
null,
|
|
currentVaultKeyRow(),
|
|
deviceRow({ device_id: TARGET_DEVICE_ID }),
|
|
null,
|
|
],
|
|
allRowSets: [
|
|
[{ device_id: APPROVER_DEVICE_ID }, { device_id: OTHER_DEVICE_ID }],
|
|
[{ object_count: 0 }],
|
|
],
|
|
batchChanges: [[1, 1, 1, 0]],
|
|
});
|
|
|
|
const response = await revocationResponse(d1, body);
|
|
|
|
assert.equal(response.status, 409);
|
|
assert.deepEqual(d1.batches, [4]);
|
|
});
|
|
|
|
it("accepts a zero-change finalize that resolves to the exact concurrent replay", async () => {
|
|
const body = deviceRevocationBody();
|
|
const d1 = successfulD1(body, "approved", [[1, 1, 1, 0]]);
|
|
|
|
const response = await revocationResponse(d1, body);
|
|
|
|
assert.equal(response.status, 200);
|
|
assert.deepEqual(await response.json(), revocationDocument());
|
|
});
|
|
|
|
it("rejects unapproved, self, and unauthenticated revocation", async () => {
|
|
const unapproved = testD1Database({ firstRows: [null] });
|
|
assert.equal((await revocationResponse(unapproved, deviceRevocationBody())).status, 403);
|
|
|
|
const self = testD1Database([]);
|
|
const selfBody = deviceRevocationBody({
|
|
device_id: APPROVER_DEVICE_ID,
|
|
envelopes: [rotationEnvelope(OTHER_DEVICE_ID)],
|
|
});
|
|
assert.equal((await revocationResponse(self, selfBody)).status, 403);
|
|
assert.deepEqual(self.queries, []);
|
|
|
|
const anonymous = testD1Database([]);
|
|
const response = await handleRequest(revocationRequest(deviceRevocationBody(), false), testEnv({ d1: anonymous }));
|
|
assert.equal(response.status, 401);
|
|
assert.deepEqual(anonymous.queries, []);
|
|
});
|
|
});
|
|
|
|
function successfulD1(
|
|
body: Record<string, unknown>,
|
|
targetStatus: "pending" | "approved",
|
|
batchChanges: number[][] = [[1, 1, 1, 1]],
|
|
): ReturnType<typeof testD1Database> {
|
|
return testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
null,
|
|
currentVaultKeyRow(),
|
|
deviceRow({ device_id: TARGET_DEVICE_ID, approval_status: targetStatus }),
|
|
rotationResultRow(body),
|
|
deviceRow({ device_id: TARGET_DEVICE_ID, approval_status: "revoked", revoked_at: 1_780_000_400 }),
|
|
],
|
|
allRowSets: [
|
|
[{ device_id: APPROVER_DEVICE_ID }, { device_id: OTHER_DEVICE_ID }],
|
|
[{ object_count: 0 }],
|
|
],
|
|
batchChanges,
|
|
});
|
|
}
|
|
|
|
function preflightD1(recipientRows: Record<string, unknown>[]): ReturnType<typeof testD1Database> {
|
|
return testD1Database({
|
|
firstRows: [
|
|
approverRow(),
|
|
null,
|
|
currentVaultKeyRow(),
|
|
deviceRow({ device_id: TARGET_DEVICE_ID }),
|
|
],
|
|
allRowSets: [recipientRows, [{ object_count: 0 }]],
|
|
});
|
|
}
|
|
|
|
function revocationResponse(
|
|
d1: ReturnType<typeof testD1Database>,
|
|
body: Record<string, unknown>,
|
|
): Promise<Response> {
|
|
return signedRevocationBody(body).then((signedBody) =>
|
|
handleRequest(revocationRequest(signedBody), testEnv({ d1 })),
|
|
);
|
|
}
|
|
|
|
function revocationRequest(body: Record<string, unknown>, authenticated = true): Request {
|
|
return new Request("https://elydora.test/api/devices/revoke", {
|
|
method: "POST",
|
|
headers: {
|
|
...(authenticated ? { authorization: `Bearer ${ACCESS_TOKEN}` } : {}),
|
|
"content-type": "application/json",
|
|
},
|
|
body: JSON.stringify(body),
|
|
});
|
|
}
|
|
|
|
function deviceRevocationBody(overrides: Record<string, unknown> = {}): Record<string, unknown> {
|
|
return {
|
|
version: 2,
|
|
mode: "approved_rotate",
|
|
device_id: TARGET_DEVICE_ID,
|
|
previous_key_id: PREVIOUS_KEY_ID,
|
|
previous_generation: PREVIOUS_GENERATION,
|
|
new_key_id: NEW_KEY_ID,
|
|
new_generation: NEW_GENERATION,
|
|
envelopes: [rotationEnvelope(OTHER_DEVICE_ID), rotationEnvelope(APPROVER_DEVICE_ID)],
|
|
idempotency_key: IDEMPOTENCY_KEY,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function pendingRevocationBody(overrides: Record<string, unknown> = {}): Record<string, unknown> {
|
|
return {
|
|
version: 2,
|
|
mode: "pending_revoke",
|
|
device_id: TARGET_DEVICE_ID,
|
|
idempotency_key: IDEMPOTENCY_KEY,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function rotationEnvelope(
|
|
recipientDeviceId: string,
|
|
overrides: Record<string, unknown> = {},
|
|
): Record<string, unknown> {
|
|
const other = recipientDeviceId === OTHER_DEVICE_ID;
|
|
return {
|
|
recipient_device_id: recipientDeviceId,
|
|
envelope: {
|
|
version: 1,
|
|
suite: SUITE,
|
|
encapped_key: other ? `${"C".repeat(42)}E` : "A".repeat(43),
|
|
ciphertext: other ? "D".repeat(64) : "B".repeat(64),
|
|
...overrides,
|
|
},
|
|
};
|
|
}
|
|
|
|
function currentVaultKeyRow(): Record<string, unknown> { return { key_id: PREVIOUS_KEY_ID, generation: PREVIOUS_GENERATION }; }
|
|
|
|
async function rotationResultRow(
|
|
body: Record<string, unknown>,
|
|
overrides: Record<string, unknown> = {},
|
|
): Promise<Record<string, unknown>> {
|
|
const parsed = await deviceRevocationRequest(revocationRequest(await signedRevocationBody(body)));
|
|
if (parsed.mode !== "approved_rotate") throw new Error("approved rotation expected");
|
|
const requestHash = await deviceRevocationRequestHash(USER_ID, APPROVER_DEVICE_ID, parsed);
|
|
return {
|
|
target_device_id: TARGET_DEVICE_ID,
|
|
approver_device_id: APPROVER_DEVICE_ID,
|
|
previous_key_id: PREVIOUS_KEY_ID,
|
|
previous_generation: PREVIOUS_GENERATION,
|
|
new_key_id: NEW_KEY_ID,
|
|
new_generation: NEW_GENERATION,
|
|
request_hash: requestHash,
|
|
envelope_count: 2,
|
|
r2_object_count: 0,
|
|
completed_at: 1_780_000_400,
|
|
current_key_id: NEW_KEY_ID,
|
|
current_generation: NEW_GENERATION,
|
|
target_status: "revoked",
|
|
revoked_at: 1_780_000_400,
|
|
active_session_count: 0,
|
|
item_count: 2,
|
|
r2_item_count: 0,
|
|
persisted_count: 2,
|
|
audit_count: 1,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
async function pendingResultRow(body: Record<string, unknown>): Promise<Record<string, unknown>> {
|
|
const parsed = await deviceRevocationRequest(revocationRequest(await signedRevocationBody(body)));
|
|
if (parsed.mode !== "pending_revoke") throw new Error("pending revocation expected");
|
|
return {
|
|
target_device_id: TARGET_DEVICE_ID,
|
|
approver_device_id: APPROVER_DEVICE_ID,
|
|
request_hash: await pendingDeviceRevocationRequestHash(USER_ID, APPROVER_DEVICE_ID, parsed),
|
|
completed_at: 1_780_000_400,
|
|
target_status: "revoked",
|
|
revoked_at: 1_780_000_400,
|
|
active_session_count: 0,
|
|
audit_count: 1,
|
|
};
|
|
}
|
|
|
|
async function signedRevocationBody(
|
|
body: Record<string, unknown>,
|
|
): Promise<Record<string, unknown>> {
|
|
if (body.mode === "pending_revoke") {
|
|
if (body.pending_revocation_proof !== undefined) return body;
|
|
const draft = { ...body, pending_revocation_proof: "0".repeat(128) };
|
|
try {
|
|
const parsed = await deviceRevocationRequest(revocationRequest(draft));
|
|
if (parsed.mode !== "pending_revoke") return draft;
|
|
const { pendingRevocationProof: _, ...unsigned } = parsed;
|
|
return {
|
|
...body,
|
|
pending_revocation_proof: await signDeviceMessage(
|
|
pendingDeviceRevocationProofBytes(USER_ID, APPROVER_DEVICE_ID, unsigned),
|
|
),
|
|
};
|
|
} catch {
|
|
return draft;
|
|
}
|
|
}
|
|
if (body.rotation_proof !== undefined) return body;
|
|
const draft = { ...body, rotation_proof: "0".repeat(128) };
|
|
try {
|
|
const parsed = await deviceRevocationRequest(revocationRequest(draft));
|
|
if (parsed.mode !== "approved_rotate") return draft;
|
|
const { rotationProof: _, ...unsigned } = parsed;
|
|
return {
|
|
...body,
|
|
rotation_proof: await signDeviceMessage(
|
|
deviceRevocationProofBytes(USER_ID, APPROVER_DEVICE_ID, unsigned),
|
|
),
|
|
};
|
|
} catch {
|
|
return draft;
|
|
}
|
|
}
|
|
|
|
function approverRow(): Record<string, unknown> { return { device_id: APPROVER_DEVICE_ID, signing_public_key: PUBLIC_KEY }; }
|
|
|
|
function deviceRow(overrides: Record<string, unknown> = {}): Record<string, unknown> {
|
|
return {
|
|
device_id: TARGET_DEVICE_ID,
|
|
public_key: PUBLIC_KEY,
|
|
wrapping_public_key: WRAPPING_PUBLIC_KEY,
|
|
device_name: "MacBook Pro",
|
|
platform: "macOS",
|
|
approval_status: "approved",
|
|
created_at: 1_780_000_000,
|
|
approved_at: 1_780_000_010,
|
|
last_active_at: 1_780_000_020,
|
|
revoked_at: null,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function revocationDocument(): Record<string, unknown> {
|
|
return {
|
|
version: 2,
|
|
mode: "approved_rotate",
|
|
user_id: USER_ID,
|
|
revoked_by_device_id: APPROVER_DEVICE_ID,
|
|
revoked_at: 1_780_000_400,
|
|
key_id: NEW_KEY_ID,
|
|
generation: NEW_GENERATION,
|
|
device: {
|
|
device_id: TARGET_DEVICE_ID,
|
|
public_key: PUBLIC_KEY,
|
|
wrapping_public_key: WRAPPING_PUBLIC_KEY,
|
|
device_name: "MacBook Pro",
|
|
platform: "macOS",
|
|
approval_status: "revoked",
|
|
created_at: 1_780_000_000,
|
|
approved_at: 1_780_000_010,
|
|
last_active_at: 1_780_000_020,
|
|
revoked_at: 1_780_000_400,
|
|
current: false,
|
|
},
|
|
};
|
|
}
|
|
|
|
function pendingRevocationDocument(): Record<string, unknown> {
|
|
const document = revocationDocument();
|
|
delete document.key_id;
|
|
delete document.generation;
|
|
return {
|
|
...document,
|
|
mode: "pending_revoke",
|
|
device: {
|
|
...(document.device as Record<string, unknown>),
|
|
approval_status: "revoked",
|
|
approved_at: null,
|
|
},
|
|
};
|
|
}
|