fix(mcp): подготовить доступ и отзыв разрешений для приёмки

apps/api/test/api-coverage.test.ts

@@ -0,0 +1,431 @@
+import { createHash } from 'node:crypto'
+import { afterEach, describe, expect, it } from 'vitest'
+import { hash } from '@node-rs/argon2'
+import { createOidcClient, generateOidcClientSecret } from '@authportal/db'
+import { adminToken, buildTestApp } from './helpers.js'
+
+type App = Awaited<ReturnType<typeof buildTestApp>>
+let app: App | undefined
+afterEach(async () => {
+  await app?.close()
+  app = undefined
+})
+
+const auth = (token: string) => ({ authorization: `Bearer ${token}` })
+
+async function login(a: App, email = '[email protected]', password = 'adminpass') {
+  const res = await a.inject({
+    method: 'POST',
+    url: '/api/v1/auth/login',
+    payload: { email, password },
+  })
+  return res
+}
+
+describe('auth', () => {
+  it('login: неверный пароль 401, отключённый пользователь 401', async () => {
+    app = await buildTestApp()
+    const token = await adminToken(app)
+    expect((await login(app, '[email protected]', 'wrong')).statusCode).toBe(401)
+    expect((await login(app, '[email protected]', 'whatever')).statusCode).toBe(401)
+
+    const created = await app.inject({
+      method: 'POST',
+      url: '/api/v1/admin/users',
+      headers: auth(token),
+      payload: {
+        email: '[email protected]',
+        name: 'Off',
+        password: 'secret12',
+        is_admin: false,
+        apps: ['cfdm'],
+        permissions: [],
+      },
+    })
+    const id = (created.json() as { id: string }).id
+    await app.inject({
+      method: 'PATCH',
+      url: `/api/v1/admin/users/${id}`,
+      headers: auth(token),
+      payload: { disabled: true },
+    })
+    expect((await login(app, '[email protected]', 'secret12')).statusCode).toBe(401)
+  })
+
+  it('me / reissue / catalog / logout по cookie', async () => {
+    app = await buildTestApp()
+    const res = await login(app)
+    const token = (res.json() as { access_token: string }).access_token
+    const refresh = res.cookies.find((c) => c.name === 'refresh_token')!.value
+
+    const me = await app.inject({ method: 'GET', url: '/api/v1/auth/me', headers: auth(token) })
+    expect(me.statusCode).toBe(200)
+    expect((me.json() as { email: string }).email).toBe('[email protected]')
+
+    const reissue = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/reissue',
+      headers: auth(token),
+    })
+    expect(reissue.statusCode).toBe(200)
+    expect((reissue.json() as { access_token: string }).access_token).toBeTruthy()
+
+    const catalog = await app.inject({ method: 'GET', url: '/api/v1/catalog', headers: auth(token) })
+    expect(catalog.statusCode).toBe(200)
+    expect((catalog.json() as { apps: unknown[] }).apps.length).toBeGreaterThan(0)
+
+    const noAuth = await app.inject({ method: 'GET', url: '/api/v1/auth/me' })
+    expect(noAuth.statusCode).toBe(401)
+
+    const logout = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/logout',
+      headers: { ...auth(token), cookie: `refresh_token=${refresh}` },
+    })
+    expect(logout.statusCode).toBe(200)
+    const revoked = app.sqlite
+      .prepare('SELECT revoked_at FROM refresh_sessions')
+      .get() as { revoked_at: string | null }
+    expect(revoked.revoked_at).toBeTruthy()
+  })
+})
+
+describe('admin users', () => {
+  it('создание: конфликт email 409, валидация 400; patch и удаление', async () => {
+    app = await buildTestApp()
+    const token = await adminToken(app)
+    const payload = {
+      email: '[email protected]',
+      name: 'Dup',
+      password: 'secret12',
+      is_admin: false,
+      apps: ['cfdm'],
+      permissions: [],
+    }
+    const first = await app.inject({ method: 'POST', url: '/api/v1/admin/users', headers: auth(token), payload })
+    expect(first.statusCode).toBe(201)
+    const id = (first.json() as { id: string }).id
+    const dup = await app.inject({ method: 'POST', url: '/api/v1/admin/users', headers: auth(token), payload })
+    expect(dup.statusCode).toBe(409)
+    const bad = await app.inject({
+      method: 'POST',
+      url: '/api/v1/admin/users',
+      headers: auth(token),
+      payload: { email: 'nope' },
+    })
+    expect(bad.statusCode).toBe(400)
+
+    const patched = await app.inject({
+      method: 'PATCH',
+      url: `/api/v1/admin/users/${id}`,
+      headers: auth(token),
+      payload: { name: 'Renamed', password: 'newsecret12' },
+    })
+    expect(patched.statusCode).toBe(200)
+    expect((patched.json() as { name: string }).name).toBe('Renamed')
+    expect((await login(app, '[email protected]', 'newsecret12')).statusCode).toBe(200)
+    expect((await login(app, '[email protected]', 'secret12')).statusCode).toBe(401)
+
+    const del = await app.inject({ method: 'DELETE', url: `/api/v1/admin/users/${id}`, headers: auth(token) })
+    expect(del.statusCode).toBe(204)
+    const gone = await app.inject({ method: 'GET', url: `/api/v1/admin/users/${id}`, headers: auth(token) })
+    expect(gone.statusCode).toBe(404)
+  })
+
+  it('нельзя удалить себя; обычный пользователь не админ (403)', async () => {
+    app = await buildTestApp()
+    const token = await adminToken(app)
+    const me = await app.inject({ method: 'GET', url: '/api/v1/auth/me', headers: auth(token) })
+    const myId = (me.json() as { id: string }).id
+    const self = await app.inject({ method: 'DELETE', url: `/api/v1/admin/users/${myId}`, headers: auth(token) })
+    expect(self.statusCode).toBe(400)
+
+    await app.inject({
+      method: 'POST',
+      url: '/api/v1/admin/users',
+      headers: auth(token),
+      payload: {
+        email: '[email protected]',
+        name: 'Plain',
+        password: 'secret12',
+        is_admin: false,
+        apps: ['cfdm'],
+        permissions: [],
+      },
+    })
+    const userTok = ((await login(app, '[email protected]', 'secret12')).json() as { access_token: string }).access_token
+    const forbidden = await app.inject({ method: 'GET', url: '/api/v1/admin/users', headers: auth(userTok) })
+    expect(forbidden.statusCode).toBe(403)
+  })
+})
+
+describe('OIDC клиенты и обмен кода', () => {
+  async function setup(a: App) {
+    const token = await adminToken(a)
+    const created = await a.inject({
+      method: 'POST',
+      url: '/api/v1/admin/oidc/clients',
+      headers: auth(token),
+      payload: {
+        name: 'RP',
+        redirect_uris: ['https://rp.test.local/cb'],
+        scopes: ['openid', 'profile', 'email', 'groups'],
+        enabled: true,
+      },
+    })
+    expect(created.statusCode).toBe(200)
+    const client = created.json() as { id: string; client_id: string; client_secret: string }
+    const loginRes = await login(a)
+    const refresh = loginRes.cookies.find((c) => c.name === 'refresh_token')!.value
+    return { token, client, refresh }
+  }
+
+  async function authorizeCode(
+    a: App,
+    refresh: string,
+    clientId: string,
+    extra: Record<string, string> = {},
+  ): Promise<string> {
+    const res = await a.inject({
+      method: 'GET',
+      url: '/oauth/authorize',
+      cookies: { refresh_token: refresh },
+      query: {
+        client_id: clientId,
+        redirect_uri: 'https://rp.test.local/cb',
+        response_type: 'code',
+        scope: 'openid profile',
+        ...extra,
+      },
+    })
+    expect(res.statusCode).toBe(302)
+    return new URL(res.headers.location as string).searchParams.get('code')!
+  }
+
+  const exchange = (a: App, body: Record<string, string>) =>
+    a.inject({
+      method: 'POST',
+      url: '/oauth/token',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      payload: new URLSearchParams({
+        grant_type: 'authorization_code',
+        redirect_uri: 'https://rp.test.local/cb',
+        ...body,
+      }).toString(),
+    })
+
+  it('секрет нового клиента хранится как sha256, обмен работает, replay кода отклоняется', async () => {
+    app = await buildTestApp()
+    const { client, refresh } = await setup(app)
+    const stored = app.sqlite
+      .prepare('SELECT client_secret_hash h FROM oidc_clients')
+      .get() as { h: string }
+    expect(stored.h.startsWith('sha256:')).toBe(true)
+
+    const code = await authorizeCode(app, refresh, client.client_id)
+    const ok = await exchange(app, {
+      client_id: client.client_id,
+      client_secret: client.client_secret,
+      code,
+    })
+    expect(ok.statusCode).toBe(200)
+    expect((ok.json() as { id_token: string }).id_token).toBeTruthy()
+
+    const replay = await exchange(app, {
+      client_id: client.client_id,
+      client_secret: client.client_secret,
+      code,
+    })
+    expect(replay.statusCode).toBe(400)
+    expect((replay.json() as { error: string }).error).toBe('invalid_grant')
+  })
+
+  it('PKCE: S256 принимается, неверный verifier и отсутствие verifier отклоняются', async () => {
+    app = await buildTestApp()
+    const { client, refresh } = await setup(app)
+    const verifier = 'v'.repeat(50)
+    const challenge = createHash('sha256').update(verifier).digest('base64url')
+    const pkce = { code_challenge: challenge, code_challenge_method: 'S256' }
+    const creds = { client_id: client.client_id, client_secret: client.client_secret }
+
+    const good = await exchange(app, {
+      ...creds,
+      code: await authorizeCode(app, refresh, client.client_id, pkce),
+      code_verifier: verifier,
+    })
+    expect(good.statusCode).toBe(200)
+
+    const wrong = await exchange(app, {
+      ...creds,
+      code: await authorizeCode(app, refresh, client.client_id, pkce),
+      code_verifier: 'x'.repeat(50),
+    })
+    expect(wrong.statusCode).toBe(400)
+
+    const missing = await exchange(app, {
+      ...creds,
+      code: await authorizeCode(app, refresh, client.client_id, pkce),
+    })
+    expect(missing.statusCode).toBe(400)
+
+    const plain = await exchange(app, {
+      ...creds,
+      code: await authorizeCode(app, refresh, client.client_id, {
+        code_challenge: 'plain-challenge',
+        code_challenge_method: 'plain',
+      }),
+      code_verifier: 'plain-challenge',
+    })
+    expect(plain.statusCode).toBe(200)
+  })
+
+  it('неверный секрет 401; чужой redirect_uri и scope отклоняются; userinfo по access_token', async () => {
+    app = await buildTestApp()
+    const { client, refresh } = await setup(app)
+    const code = await authorizeCode(app, refresh, client.client_id)
+
+    const badSecret = await exchange(app, {
+      client_id: client.client_id,
+      client_secret: 'nope',
+      code,
+    })
+    expect(badSecret.statusCode).toBe(401)
+
+    const badRedirect = await app.inject({
+      method: 'GET',
+      url: '/oauth/authorize',
+      cookies: { refresh_token: refresh },
+      query: {
+        client_id: client.client_id,
+        redirect_uri: 'https://evil.test/cb',
+        response_type: 'code',
+        scope: 'openid',
+      },
+    })
+    expect(badRedirect.statusCode).toBe(400)
+
+    const badScope = await app.inject({
+      method: 'GET',
+      url: '/oauth/authorize',
+      cookies: { refresh_token: refresh },
+      query: {
+        client_id: client.client_id,
+        redirect_uri: 'https://rp.test.local/cb',
+        response_type: 'code',
+        scope: 'openid admin',
+      },
+    })
+    expect(badScope.statusCode).toBe(302)
+    expect(badScope.headers.location).toContain('error=invalid_scope')
+
+    const ok = await exchange(app, {
+      client_id: client.client_id,
+      client_secret: client.client_secret,
+      code,
+    })
+    const accessToken = (ok.json() as { access_token: string }).access_token
+    const info = await app.inject({
+      method: 'GET',
+      url: '/oauth/userinfo',
+      headers: auth(accessToken),
+    })
+    expect(info.statusCode).toBe(200)
+    expect((info.json() as { email: string }).email).toBe('[email protected]')
+    const noToken = await app.inject({ method: 'GET', url: '/oauth/userinfo' })
+    expect(noToken.statusCode).toBe(401)
+  })
+
+  it('без сессии authorize редиректит на логин', async () => {
+    app = await buildTestApp()
+    const { client } = await setup(app)
+    const res = await app.inject({
+      method: 'GET',
+      url: '/oauth/authorize',
+      query: {
+        client_id: client.client_id,
+        redirect_uri: 'https://rp.test.local/cb',
+        response_type: 'code',
+        scope: 'openid',
+      },
+    })
+    expect(res.statusCode).toBe(302)
+    expect(res.headers.location).toContain('return_to=')
+  })
+
+  it('старый argon2-секрет работает и мигрирует в sha256', async () => {
+    app = await buildTestApp()
+    const { refresh } = await setup(app)
+    const secret = generateOidcClientSecret()
+    const legacy = createOidcClient(app.db, {
+      name: 'Legacy',
+      redirectUris: ['https://rp.test.local/cb'],
+      scopes: ['openid', 'profile'],
+      enabled: true,
+      clientSecretHash: await hash(secret),
+    })
+    const code = await authorizeCode(app, refresh, legacy.clientId)
+    const res = await exchange(app, {
+      client_id: legacy.clientId,
+      client_secret: secret,
+      code,
+    })
+    expect(res.statusCode).toBe(200)
+    const row = app.sqlite
+      .prepare('SELECT client_secret_hash h FROM oidc_clients WHERE client_id=?')
+      .get(legacy.clientId) as { h: string }
+    expect(row.h.startsWith('sha256:')).toBe(true)
+
+    // после миграции секрет всё ещё работает
+    const code2 = await authorizeCode(app, refresh, legacy.clientId)
+    const again = await exchange(app, {
+      client_id: legacy.clientId,
+      client_secret: secret,
+      code: code2,
+    })
+    expect(again.statusCode).toBe(200)
+  })
+
+  it('CRUD клиента: patch, rotate-secret инвалидирует старый секрет, delete', async () => {
+    app = await buildTestApp()
+    const { token, client, refresh } = await setup(app)
+
+    const patch = await app.inject({
+      method: 'PATCH',
+      url: `/api/v1/admin/oidc/clients/${client.id}`,
+      headers: auth(token),
+      payload: { name: 'Renamed RP' },
+    })
+    expect(patch.statusCode).toBe(200)
+    expect((patch.json() as { name: string }).name).toBe('Renamed RP')
+
+    const rotate = await app.inject({
+      method: 'POST',
+      url: `/api/v1/admin/oidc/clients/${client.id}/rotate-secret`,
+      headers: auth(token),
+    })
+    expect(rotate.statusCode).toBe(200)
+    const fresh = (rotate.json() as { client_secret: string }).client_secret
+    expect(fresh).not.toBe(client.client_secret)
+
+    const code = await authorizeCode(app, refresh, client.client_id)
+    expect(
+      (await exchange(app, { client_id: client.client_id, client_secret: client.client_secret, code })).statusCode,
+    ).toBe(401)
+    expect(
+      (await exchange(app, { client_id: client.client_id, client_secret: fresh, code })).statusCode,
+    ).toBe(200)
+
+    const del = await app.inject({
+      method: 'DELETE',
+      url: `/api/v1/admin/oidc/clients/${client.id}`,
+      headers: auth(token),
+    })
+    expect(del.statusCode).toBe(200)
+    const gone = await app.inject({
+      method: 'GET',
+      url: `/api/v1/admin/oidc/clients/${client.id}`,
+      headers: auth(token),
+    })
+    expect(gone.statusCode).toBe(404)
+  })
+})