| 1 | package home |
| 2 | |
| 3 | import ( |
| 4 | "net/http" |
| 5 | "net/url" |
| 6 | "strings" |
| 7 | "testing" |
| 8 | |
| 9 | "amadan.net/oficina/home/handoff" |
| 10 | "amadan.net/oficina/home/internal/home/sealtest" |
| 11 | ) |
| 12 | |
| 13 | func TestHandoffFailuresHaveFixedPrivateDiagnostics(t *testing.T) { |
| 14 | p := newExchangePair(t) |
| 15 | credential := signInFully(t, p.credential, sealtest.CanaryAddress) |
| 16 | const secret = "private-address@example.invalid" |
| 17 | cases := []struct { |
| 18 | app *App |
| 19 | method, path, origin, stage, reason string |
| 20 | form url.Values |
| 21 | cookies []*http.Cookie |
| 22 | }{ |
| 23 | {p.credential.App, "GET", Origin + "/authorize?consumer=" + secret + "&nonce=" + secret, "", "authorize", "invalid_request", nil, nil}, |
| 24 | {p.credential.App, "GET", Origin + "/authorize/resume?private=" + secret, "", "assertion", "unexpected_query", nil, nil}, |
| 25 | {p.credential.App, "GET", Origin + "/authorize/resume", "", "assertion", "invalid_intent", nil, []*http.Cookie{{Name: assertionIntentCookie, Value: secret}}}, |
| 26 | {p.directory, "GET", directoryOrigin + handoff.StartPath + "?return_to=https://" + secret, "", "directory_start", "refused", nil, nil}, |
| 27 | {p.directory, "POST", directoryOrigin + handoff.CallbackPath, Origin, "directory_callback", "refused", url.Values{"assertion": {secret}}, nil}, |
| 28 | {p.directory, "GET", directoryOrigin + handoff.FinishPath, "", "directory_finish", "refused", nil, []*http.Cookie{{Name: "__Host-oficina-assertion-inbox", Value: secret}}}, |
| 29 | } |
| 30 | for _, tc := range cases { |
| 31 | p.logs.Reset() |
| 32 | if tc.app == p.credential.App { |
| 33 | tc.cookies = append(tc.cookies, credential) |
| 34 | } |
| 35 | response := exchangeRequest(tc.app, tc.method, tc.path, tc.origin, tc.form, tc.cookies...) |
| 36 | if response.Code != 400 || response.Header().Get("Cache-Control") != "no-store" { |
| 37 | t.Fatal(response.Code, response.Header()) |
| 38 | } |
| 39 | body := response.Body.String() |
| 40 | if !strings.Contains(body, "Could not finish signing in") || strings.Contains(body, "15 minutes") || !strings.Contains(body, `href="`+directoryOrigin+`"`) || strings.Contains(body, secret) { |
| 41 | t.Fatal("wrong handoff failure page", body) |
| 42 | } |
| 43 | log := p.logs.String() |
| 44 | if !strings.Contains(log, "stage="+tc.stage) || !strings.Contains(log, "reason="+tc.reason) || strings.Count(strings.TrimSpace(log), "\n") != 0 { |
| 45 | t.Fatal("wrong diagnostic", log) |
| 46 | } |
| 47 | for _, forbidden := range []string{secret, "nonce=", "consumer=", "https://", "token=", "cookie=", "subject="} { |
| 48 | if strings.Contains(log, forbidden) { |
| 49 | t.Fatal("diagnostic leaked request data", forbidden) |
| 50 | } |
| 51 | } |
| 52 | } |
| 53 | p.logs.Reset() |
| 54 | failedLink := exchangeRequest(p.credential.App, "POST", Origin+linkPath, Origin, url.Values{"token": {secret}}) |
| 55 | if failedLink.Code != 400 || !strings.Contains(failedLink.Body.String(), "Sign-in links work once and expire after 15 minutes") || strings.Contains(p.logs.String(), "home handoff failed") { |
| 56 | t.Fatal("magic-link failure changed", failedLink.Code) |
| 57 | } |
| 58 | } |
| 59 | |
| 60 | func TestDirectorySubjectConflictLogsStageWithoutSwitchingIdentity(t *testing.T) { |
| 61 | f := newMountedChooser(t) |
| 62 | p := f.p |
| 63 | previous := f.session(t, chooserOther) |
| 64 | credential := signInFully(t, p.credential, sealtest.CanaryAddress) |
| 65 | pending, intent := p.start(t) |
| 66 | token, _ := p.mint(t, intent, credential) |
| 67 | callback := exchangeRequest(p.directory, "POST", directoryOrigin+handoff.CallbackPath, Origin, url.Values{"assertion": {token}}) |
| 68 | if callback.Code != 303 { |
| 69 | t.Fatal(callback.Code) |
| 70 | } |
| 71 | inbox := namedCookie(t, callback, "__Host-oficina-assertion-inbox") |
| 72 | p.logs.Reset() |
| 73 | finish := exchangeRequest(p.directory, "GET", directoryOrigin+handoff.FinishPath, "", nil, pending, inbox, previous) |
| 74 | if finish.Code != 400 || sessionCookie(finish) != nil { |
| 75 | t.Fatal("conflicting identity accepted", finish.Code) |
| 76 | } |
| 77 | log := p.logs.String() |
| 78 | if !strings.Contains(log, "stage=directory_finish reason=refused") { |
| 79 | t.Fatal("missing finish diagnostic", log) |
| 80 | } |
| 81 | for _, secret := range []string{chooserOther, token, pending.Value, inbox.Value, sealtest.CanaryAddress, subjectOf(t, p.credential, credential)} { |
| 82 | if strings.Contains(log, secret) { |
| 83 | t.Fatal("identity or token leaked") |
| 84 | } |
| 85 | } |
| 86 | page := exchangeRequest(p.directory, "GET", directoryOrigin+"/", "", nil, previous) |
| 87 | if page.Code != 200 { |
| 88 | t.Fatal("previous session was changed", page.Code) |
| 89 | } |
| 90 | } |
| 91 | |
amadan