220 lines
16 KiB
JavaScript
220 lines
16 KiB
JavaScript
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const os = require('node:os');
|
|
const { spawn } = require('node:child_process');
|
|
const jwt = require('jsonwebtoken');
|
|
const http = require('node:http');
|
|
const { spawnSync } = require('node:child_process');
|
|
|
|
async function serverFixture(t) {
|
|
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'nodecast-auth-test-'));
|
|
const root = path.join(__dirname, '..');
|
|
let child, base;
|
|
const stop = async () => {
|
|
if (!child || child.exitCode !== null) return;
|
|
const closed = new Promise(resolve => child.once('close', resolve));
|
|
child.kill();
|
|
await closed;
|
|
};
|
|
const start = async () => {
|
|
child = spawn(process.execPath, ['server/index.js'], { cwd: root,
|
|
env: { ...process.env, PORT: '0', NODECAST_DATA_DIR: dir,
|
|
NODECAST_DISABLE_BACKGROUND_JOBS: 'true', JWT_SECRET: '', SESSION_SECRET: '',
|
|
OIDC_ISSUER_URL: '', ALLOW_LOCAL_MEDIA_URLS: 'true', AUTH_COOKIE_SECURE: 'false' },
|
|
stdio: ['ignore', 'pipe', 'pipe'] });
|
|
let output = '';
|
|
base = await new Promise((resolve, reject) => {
|
|
const timer = setTimeout(() => reject(new Error(`Server startup timed out: ${output}`)), 15000);
|
|
child.stdout.on('data', chunk => {
|
|
output += chunk;
|
|
const match = output.match(/server running on http:\/\/localhost:(\d+)/);
|
|
if (match) { clearTimeout(timer); resolve(`http://127.0.0.1:${match[1]}`); }
|
|
});
|
|
child.stderr.on('data', chunk => { output += chunk; });
|
|
child.once('exit', code => { clearTimeout(timer); reject(new Error(`Server exited ${code}: ${output}`)); });
|
|
child.once('error', reject);
|
|
});
|
|
return base;
|
|
};
|
|
t.after(async () => {
|
|
await stop();
|
|
assert.equal(path.dirname(path.resolve(dir)), path.resolve(os.tmpdir()));
|
|
fs.rmSync(dir, { recursive: true, force: true });
|
|
});
|
|
await start();
|
|
const request = async (endpoint, options = {}) => {
|
|
const response = await fetch(`${base}${endpoint}`, { ...options,
|
|
headers: { 'Content-Type': 'application/json', ...options.headers } });
|
|
const body = await response.text();
|
|
return { status: response.status, body: body ? JSON.parse(body) : null,
|
|
cookie: response.headers.getSetCookie().find(value => value.startsWith('nodecast_auth_')),
|
|
headers: response.headers };
|
|
};
|
|
return { dir, request, start, stop, get base() { return base; } };
|
|
}
|
|
const post = body => ({ method: 'POST', body: JSON.stringify(body) });
|
|
|
|
test('real application authenticates cookies and bearer clients, isolates users, and persists revocation', async t => {
|
|
const fixture = await serverFixture(t);
|
|
const { request } = fixture;
|
|
for (const route of ['/api/sources', '/api/proxy/stream?url=http://provider.test/a', '/api/probe',
|
|
'/api/remux', '/api/subtitle', '/api/transcode/sessions', '/api/settings', '/api/history']) {
|
|
assert.equal((await request(route)).status, 401, route);
|
|
}
|
|
const attempts = await Promise.all(['Admin', 'Other'].map(username => request('/api/auth/setup', post({ username, password: 'password123' }))));
|
|
assert.equal(attempts.filter(result => result.status === 201).length, 1);
|
|
const admin = attempts.find(result => result.status === 201);
|
|
const cookie = admin.cookie.split(';')[0];
|
|
assert.match(admin.cookie, /HttpOnly/);
|
|
assert.match(admin.cookie, /SameSite=Lax/);
|
|
assert.equal(admin.body.user.passwordHash, undefined);
|
|
const adminHeaders = { Cookie: cookie };
|
|
assert.equal((await request('/api/sources', { headers: adminHeaders })).status, 200);
|
|
assert.equal((await request('/api/auth/me', { headers: { Authorization: `Bearer ${admin.body.token}` } })).status, 200);
|
|
const viewer = await request('/api/auth/users', { ...post({ username: 'Viewer', password: 'password123', role: 'viewer' }), headers: adminHeaders });
|
|
assert.equal(viewer.status, 201);
|
|
const login = await request('/api/auth/login', post({ username: 'Viewer', password: 'password123' }));
|
|
const viewerCookie = login.cookie.split(';')[0];
|
|
const viewerHeaders = { Cookie: viewerCookie };
|
|
assert.equal((await request('/api/auth/me', { headers: viewerHeaders })).body.role, 'viewer');
|
|
for (const [route, method] of [['/api/settings', 'PUT'], ['/api/sources', 'POST'], ['/api/channels/hide', 'POST'], ['/api/auth/users', 'GET']]) {
|
|
assert.equal((await request(route, { method, headers: viewerHeaders, body: method === 'GET' ? undefined : '{}' })).status, 403, route);
|
|
}
|
|
assert.equal((await request('/api/settings', { headers: viewerHeaders })).status, 200);
|
|
assert.equal((await request('/api/remux?url=file:///etc/passwd', { headers: viewerHeaders })).status, 400);
|
|
assert.equal((await request('/api/probe?url=file:///etc/passwd', { headers: viewerHeaders })).status, 400);
|
|
assert.equal((await request('/api/transcode', { headers: viewerHeaders })).status, 400);
|
|
for (const route of ['/api/transcode?url=file:///etc/passwd', '/api/proxy/image?url=http://169.254.169.254/a',
|
|
'/api/subtitle?url=file:///etc/passwd&index=0']) assert.equal((await request(route, { headers: viewerHeaders })).status, 400, route);
|
|
assert.equal((await request('/api/auth/session', { method: 'POST', headers: { Authorization: `Bearer ${login.body.token}` } })).status, 200);
|
|
assert.equal((await request('/api/auth/logout', { method: 'POST', headers: viewerHeaders })).status, 200);
|
|
assert.equal((await request('/api/auth/me', { headers: viewerHeaders })).status, 401);
|
|
const secrets = fs.readFileSync(path.join(fixture.dir, 'security.json'), 'utf8');
|
|
await fixture.stop(); await fixture.start();
|
|
assert.equal(fs.readFileSync(path.join(fixture.dir, 'security.json'), 'utf8'), secrets);
|
|
assert.equal((await request('/api/auth/me', { headers: viewerHeaders })).status, 401);
|
|
assert.equal((await request('/api/auth/me', { headers: adminHeaders })).status, 200);
|
|
const secret = JSON.parse(secrets).jwt;
|
|
const invalid = jwt.sign({ id: admin.body.user.id, role: 'admin', kind: 'mfa' }, secret,
|
|
{ audience: 'nodecast-tv', expiresIn: '5m', jwtid: 'temporary' });
|
|
assert.equal((await request('/api/auth/me', { headers: { Authorization: `Bearer ${invalid}` } })).status, 401);
|
|
const nextLogin = await request('/api/auth/login', post({ username: 'Viewer', password: 'password123' }));
|
|
assert.equal(nextLogin.status, 200);
|
|
assert.equal((await request(`/api/auth/users/${viewer.body.id}`, { method: 'PUT', body: JSON.stringify({ password: 'changed123' }), headers: adminHeaders })).status, 200);
|
|
assert.equal((await request('/api/auth/me', { headers: { Authorization: `Bearer ${nextLogin.body.token}` } })).status, 401);
|
|
});
|
|
|
|
test('cross-site requests and spoofed forwarded hosts are blocked, and login attempts are bounded', async t => {
|
|
const { request, base } = await serverFixture(t);
|
|
assert.equal((await request('/api/auth/setup', { ...post({ username: 'Admin', password: 'password123' }),
|
|
headers: { Origin: 'https://untrusted.test', 'X-Forwarded-Host': 'untrusted.test' } })).status, 403);
|
|
assert.equal((await request('/api/auth/setup', { ...post({ username: 'Admin', password: 'password123' }), headers: { Origin: base } })).status, 201);
|
|
assert.equal((await request('/api/sources', { headers: { 'Sec-Fetch-Site': 'cross-site' } })).status, 403);
|
|
assert.equal((await request('/api/auth/login', { ...post({ username: 'Admin', password: 'password123' }), headers: { Origin: 'null' } })).status, 403);
|
|
for (let i = 0; i < 19; i++) assert.equal((await request('/api/auth/login', post({ username: 'Nobody', password: 'wrong' }))).status, 401);
|
|
const limited = await request('/api/auth/login', post({ username: 'Nobody', password: 'wrong' }));
|
|
assert.equal(limited.status, 429);
|
|
assert.ok(Number(limited.headers.get('Retry-After')) > 0);
|
|
});
|
|
|
|
test('separate installations reject each other\'s cookies even when user IDs match', async t => {
|
|
const first = await serverFixture(t), second = await serverFixture(t);
|
|
const one = await first.request('/api/auth/setup', post({ username: 'Admin', password: 'password123' }));
|
|
const two = await second.request('/api/auth/setup', post({ username: 'Admin', password: 'password123' }));
|
|
assert.equal(one.body.user.id, two.body.user.id);
|
|
assert.notEqual(one.cookie.split('=')[0], two.cookie.split('=')[0]);
|
|
assert.equal((await second.request('/api/auth/me', { headers: { Cookie: one.cookie.split(';')[0] } })).status, 401);
|
|
assert.equal((await first.request('/api/auth/me', { headers: { Cookie: two.cookie.split(';')[0] } })).status, 401);
|
|
});
|
|
|
|
function ffmpegBinary() {
|
|
if (spawnSync('ffmpeg', ['-version'], { stdio: 'ignore' }).status === 0) return 'ffmpeg';
|
|
try { const binary = require('ffmpeg-static'); if (binary && fs.existsSync(binary)) return binary; } catch {}
|
|
return null;
|
|
}
|
|
const ffmpeg = ffmpegBinary();
|
|
test('real authenticated media requests deliver remux and owned HLS output without premature cleanup', { skip: ffmpeg ? false : 'FFmpeg unavailable' }, async t => {
|
|
const fixture = await serverFixture(t);
|
|
const admin = await fixture.request('/api/auth/setup', post({ username: 'Admin', password: 'password123' }));
|
|
const adminHeaders = { Cookie: admin.cookie.split(';')[0] };
|
|
await fixture.request('/api/auth/users', { ...post({ username: 'Viewer', password: 'password123', role: 'viewer' }), headers: adminHeaders });
|
|
const viewer = await fixture.request('/api/auth/login', post({ username: 'Viewer', password: 'password123' }));
|
|
const headers = { Cookie: viewer.cookie.split(';')[0] };
|
|
const sample = path.join(fixture.dir, 'sample.ts');
|
|
const generated = spawnSync(ffmpeg, ['-hide_banner', '-loglevel', 'error', '-y',
|
|
'-f', 'lavfi', '-i', 'testsrc2=size=64x64:rate=10', '-f', 'lavfi', '-i', 'sine=sample_rate=48000',
|
|
'-t', '12', '-c:v', 'libx264', '-threads', '1', '-preset', 'ultrafast', '-g', '20', '-c:a', 'libmp3lame', '-f', 'mpegts', sample], { encoding: 'utf8', timeout: 15000 });
|
|
assert.equal(generated.status, 0, generated.stderr);
|
|
const bytes = fs.readFileSync(sample);
|
|
const origin = http.createServer((req, res) => { res.setHeader('Content-Length', bytes.length); res.end(bytes); });
|
|
await new Promise(resolve => origin.listen(0, '127.0.0.1', resolve));
|
|
t.after(() => new Promise(resolve => { origin.close(resolve); origin.closeAllConnections(); }));
|
|
const url = `http://127.0.0.1:${origin.address().port}/sample.ts`;
|
|
const remux = await fetch(`${fixture.base}/api/remux?url=${encodeURIComponent(url)}&audioCodecs=mp3`, { headers, signal: AbortSignal.timeout(10000) });
|
|
assert.equal(remux.status, 200);
|
|
const media = Buffer.from(await remux.arrayBuffer());
|
|
assert.ok(media.includes(Buffer.from('ftyp')));
|
|
assert.ok(media.includes(Buffer.from('mdat')));
|
|
const lease = 'real_fixture_playback_lease';
|
|
const session = await fixture.request('/api/transcode/session', { ...post({ url, videoMode: 'copy', videoCodec: 'h264', playbackLeaseId: lease }), headers });
|
|
assert.equal(session.status, 200, JSON.stringify(session.body));
|
|
const playlist = await fetch(`${fixture.base}${session.body.playlistUrl}`, { headers });
|
|
assert.equal(playlist.status, 200);
|
|
const text = await playlist.text(), segment = text.split(/\r?\n/).find(line => /^seg\d+\.ts$/.test(line));
|
|
assert.ok(segment, text);
|
|
const file = await fetch(`${fixture.base}/api/transcode/${session.body.sessionId}/${segment}`, { headers });
|
|
assert.equal(file.status, 200);
|
|
assert.match(file.headers.get('Cache-Control'), /private/);
|
|
assert.ok((await file.arrayBuffer()).byteLength > 0);
|
|
assert.equal((await fetch(`${fixture.base}${session.body.playlistUrl}`, { headers: adminHeaders })).status, 404);
|
|
assert.equal((await fixture.request('/api/transcode/lease', { ...post({ playbackLeaseId: lease }), method: 'DELETE', headers })).status, 200);
|
|
assert.equal((await fetch(`${fixture.base}${session.body.playlistUrl}`, { headers })).status, 404);
|
|
});
|
|
|
|
test('local login matches case variants and preserves account IDs, roles, passwords and display spelling', async t => {
|
|
const { request } = await serverFixture(t);
|
|
const admin = await request('/api/auth/setup', post({ username: 'Owner', password: 'owner-password' }));
|
|
assert.equal(admin.status, 201);
|
|
const headers = { Cookie: admin.cookie.split(';')[0] };
|
|
const viewer = await request('/api/auth/users', { ...post({ username: 'Viewer', password: 'viewer-password', role: 'viewer' }), headers });
|
|
assert.equal(viewer.status, 201);
|
|
for (const username of ['viewer', 'VIEWER', 'vIeWeR']) {
|
|
const login = await request('/api/auth/login', post({ username, password: 'viewer-password' }));
|
|
assert.equal(login.status, 200);
|
|
assert.deepEqual(login.body.user, { id: viewer.body.id, username: 'Viewer', role: 'viewer' });
|
|
}
|
|
assert.equal((await request('/api/auth/login', post({ username: 'viewer', password: 'VIEWER-PASSWORD' }))).status, 401);
|
|
assert.equal((await request('/api/auth/login', post({ username: 'owner', password: 'viewer-password' }))).status, 401);
|
|
assert.equal((await request('/api/auth/users', { ...post({ username: 'VIEWER', password: 'another-password', role: 'admin' }), headers })).status, 500);
|
|
assert.equal((await request(`/api/auth/users/${viewer.body.id}`, { method: 'PUT', body: JSON.stringify({ username: 'OWNER' }), headers })).status, 500);
|
|
assert.equal((await request(`/api/auth/users/${viewer.body.id}`, { method: 'PUT', body: JSON.stringify({ username: 'VIEWER' }), headers })).status, 200);
|
|
const renamed = await request('/api/auth/login', post({ username: 'viewer', password: 'viewer-password' }));
|
|
assert.equal(renamed.body.user.id, viewer.body.id); assert.equal(renamed.body.user.username, 'VIEWER');
|
|
});
|
|
|
|
test('legacy case-only accounts retain exact logins and reject ambiguous case variants until renamed', async t => {
|
|
const fixture = await serverFixture(t);
|
|
await fixture.request('/api/auth/setup', post({ username: 'Admin', password: 'admin-password' }));
|
|
await fixture.stop();
|
|
const filename = path.join(fixture.dir, 'db.json'), data = JSON.parse(fs.readFileSync(filename, 'utf8'));
|
|
const bcrypt = require('bcryptjs');
|
|
data.users.push({ id: data.nextId++, username: 'Twin', role: 'admin', passwordHash: await bcrypt.hash('first-password', 4) },
|
|
{ id: data.nextId++, username: 'twin', role: 'viewer', passwordHash: await bcrypt.hash('second-password', 4) });
|
|
fs.writeFileSync(filename, JSON.stringify(data)); await fixture.start();
|
|
for (const [username, password, role] of [['Twin', 'first-password', 'admin'], ['twin', 'second-password', 'viewer']]) {
|
|
const login = await fixture.request('/api/auth/login', post({ username, password }));
|
|
assert.equal(login.status, 200); assert.equal(login.body.user.role, role);
|
|
}
|
|
assert.equal((await fixture.request('/api/auth/login', post({ username: 'TWIN', password: 'first-password' }))).status, 401);
|
|
assert.equal((await fixture.request('/api/auth/login', post({ username: 'Twin', password: 'second-password' }))).status, 401);
|
|
const owner = await fixture.request('/api/auth/login', post({ username: 'admin', password: 'admin-password' }));
|
|
const headers = { Cookie: owner.cookie.split(';')[0] }, lower = data.users.find(user => user.username === 'twin');
|
|
assert.equal((await fixture.request(`/api/auth/users/${lower.id}`, { method: 'PUT', body: JSON.stringify({ username: 'twin', password: 'changed-password' }), headers })).status, 200);
|
|
assert.equal((await fixture.request(`/api/auth/users/${lower.id}`, { method: 'PUT', body: JSON.stringify({ username: 'TWIN' }), headers })).status, 500);
|
|
assert.equal((await fixture.request(`/api/auth/users/${lower.id}`, { method: 'PUT', body: JSON.stringify({ username: 'Other' }), headers })).status, 200);
|
|
const resolved = await fixture.request('/api/auth/login', post({ username: 'TWIN', password: 'first-password' }));
|
|
assert.equal(resolved.status, 200); assert.equal(resolved.body.user.username, 'Twin');
|
|
});
|