Sign in

flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp

g1t/apps/sudo/app/lib/access.test.ts

206 lines8,904 bytesCodeBlame
1import assert from "node:assert/strict";
2import { beforeEach, test } from "node:test";
3
4import {
5 type AccessSettings,
6 authorize,
7 clearKeyCache,
8 isSameOrigin,
9 readSettings,
10 verifyAccessJwt,
11} from "./access.ts";
12
13const TEAM = "g1t.cloudflareaccess.com";
14const AUD = "a".repeat(64);
15const SETTINGS: AccessSettings = { teamDomain: TEAM, aud: AUD, staff: ["owner@g1t.sh"] };
16const NOW = Date.UTC(2026, 9, 4, 12, 0, 0);
17const NOW_SECONDS = Math.floor(NOW / 1000);
18const RSA = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" } as const;
19
20async function rsaKey() {
21 return crypto.subtle.generateKey(
22 { ...RSA, modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]) },
23 true,
24 ["sign", "verify"],
25 );
26}
27
28const signing = await rsaKey();
29const stranger = await rsaKey();
30const publicJwk = { ...(await crypto.subtle.exportKey("jwk", signing.publicKey)), kid: "key-1", alg: "RS256", use: "sig" };
31
32function b64url(bytes: Uint8Array | string): string {
33 const raw = typeof bytes === "string" ? new TextEncoder().encode(bytes) : bytes;
34 let binary = "";
35 for (const byte of raw) binary += String.fromCharCode(byte);
36 return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
37}
38
39async function sign(
40 claims: Record<string, unknown>,
41 { key = signing.privateKey, kid = "key-1", alg = "RS256" }: { key?: CryptoKey; kid?: string; alg?: string } = {},
42): Promise<string> {
43 const body = `${b64url(JSON.stringify({ alg, kid, typ: "JWT" }))}.${b64url(JSON.stringify(claims))}`;
44 const signature = new Uint8Array(await crypto.subtle.sign(RSA, key, new TextEncoder().encode(body)));
45 return `${body}.${b64url(signature)}`;
46}
47
48function claims(overrides: Record<string, unknown> = {}): Record<string, unknown> {
49 return {
50 iss: `https://${TEAM}`,
51 aud: [AUD],
52 email: "owner@g1t.sh",
53 sub: "user-1",
54 iat: NOW_SECONDS - 60,
55 nbf: NOW_SECONDS - 60,
56 exp: NOW_SECONDS + 3600,
57 ...overrides,
58 };
59}
60
61let fetches: string[] = [];
62async function fetcher(url: string): Promise<Response> {
63 fetches.push(url);
64 return Response.json({ keys: [publicJwk], public_cert: { kid: "key-1", cert: "" } });
65}
66
67function request(token?: string): Request {
68 return new Request("https://sudo.g1t.sh/", {
69 headers: token ? { "cf-access-jwt-assertion": token } : {},
70 });
71}
72
73beforeEach(() => {
74 clearKeyCache();
75 fetches = [];
76});
77
78test("a valid token from staff is let in, by its email", async () => {
79 const result = await authorize(request(await sign(claims())), SETTINGS, { fetcher, now: NOW });
80 assert.deepEqual(result, { ok: true, email: "owner@g1t.sh" });
81 assert.deepEqual(fetches, [`https://${TEAM}/cdn-cgi/access/certs`]);
82});
83
84test("an audience given as a string is accepted too", async () => {
85 const result = await verifyAccessJwt(await sign(claims({ aud: AUD })), SETTINGS, { fetcher, now: NOW });
86 assert.equal(result.ok, true);
87});
88
89test("a token for another Access application is refused", async () => {
90 const result = await verifyAccessJwt(await sign(claims({ aud: ["b".repeat(64)] })), SETTINGS, { fetcher, now: NOW });
91 assert.deepEqual(result, { ok: false, reason: "wrong audience" });
92});
93
94test("a token from another team is refused", async () => {
95 const result = await verifyAccessJwt(
96 await sign(claims({ iss: "https://evil.cloudflareaccess.com" })),
97 SETTINGS,
98 { fetcher, now: NOW },
99 );
100 assert.deepEqual(result, { ok: false, reason: "wrong issuer" });
101});
102
103test("an expired token is refused", async () => {
104 const result = await verifyAccessJwt(await sign(claims({ exp: NOW_SECONDS - 3600 })), SETTINGS, { fetcher, now: NOW });
105 assert.deepEqual(result, { ok: false, reason: "expired" });
106});
107
108test("a token without an expiry is refused", async () => {
109 const result = await verifyAccessJwt(await sign(claims({ exp: undefined })), SETTINGS, { fetcher, now: NOW });
110 assert.deepEqual(result, { ok: false, reason: "no expiry" });
111});
112
113test("a token not valid yet is refused", async () => {
114 const result = await verifyAccessJwt(await sign(claims({ nbf: NOW_SECONDS + 3600 })), SETTINGS, { fetcher, now: NOW });
115 assert.deepEqual(result, { ok: false, reason: "not yet valid" });
116});
117
118test("a token signed by another key under a known key id is refused", async () => {
119 const result = await verifyAccessJwt(await sign(claims(), { key: stranger.privateKey }), SETTINGS, { fetcher, now: NOW });
120 assert.deepEqual(result, { ok: false, reason: "bad signature" });
121});
122
123test("a token whose claims were changed after signing is refused", async () => {
124 const token = await sign(claims({ email: "intern@g1t.sh" }));
125 const [header, , signature] = token.split(".");
126 const forged = `${header}.${b64url(JSON.stringify(claims()))}.${signature}`;
127 const result = await authorize(request(forged), SETTINGS, { fetcher, now: NOW });
128 assert.deepEqual(result, { ok: false, reason: "bad signature" });
129});
130
131test("a token signed by a key the team does not publish is refused", async () => {
132 const result = await verifyAccessJwt(await sign(claims(), { kid: "key-9" }), SETTINGS, { fetcher, now: NOW });
133 assert.deepEqual(result, { ok: false, reason: "unknown signing key" });
134});
135
136test("alg none and HS256 are refused before any key is fetched", async () => {
137 for (const alg of ["none", "HS256"]) {
138 const result = await verifyAccessJwt(await sign(claims(), { alg }), SETTINGS, { fetcher, now: NOW });
139 assert.deepEqual(result, { ok: false, reason: "unexpected algorithm" });
140 }
141 assert.deepEqual(fetches, []);
142});
143
144test("a valid token whose email is not staff is refused", async () => {
145 const result = await authorize(request(await sign(claims({ email: "someone@example.com" }))), SETTINGS, {
146 fetcher,
147 now: NOW,
148 });
149 assert.deepEqual(result, { ok: false, reason: "not staff", email: "someone@example.com" });
150});
151
152test("a service token, which has no email, is refused", async () => {
153 const result = await authorize(request(await sign(claims({ email: undefined }))), SETTINGS, { fetcher, now: NOW });
154 assert.deepEqual(result, { ok: false, reason: "token has no email" });
155});
156
157test("staff emails match without regard to case", async () => {
158 const result = await authorize(request(await sign(claims({ email: "Owner@G1T.sh" }))), SETTINGS, { fetcher, now: NOW });
159 assert.deepEqual(result, { ok: true, email: "owner@g1t.sh" });
160});
161
162test("a request without a token is refused", async () => {
163 assert.deepEqual(await authorize(request(), SETTINGS, { fetcher, now: NOW }), { ok: false, reason: "no Access token" });
164});
165
166test("garbage is refused", async () => {
167 for (const token of ["", "a.b", "a.b.c.d", "!!.??.**", "e30.e30.e30"]) {
168 const result = await verifyAccessJwt(token, SETTINGS, { fetcher, now: NOW });
169 assert.equal(result.ok, false, token);
170 }
171});
172
173test("the team's keys are fetched once and kept for a few minutes", async () => {
174 await verifyAccessJwt(await sign(claims()), SETTINGS, { fetcher, now: NOW });
175 await verifyAccessJwt(await sign(claims()), SETTINGS, { fetcher, now: NOW + 60_000 });
176 assert.equal(fetches.length, 1);
177 await verifyAccessJwt(await sign(claims()), SETTINGS, { fetcher, now: NOW + 10 * 60_000 });
178 assert.equal(fetches.length, 2);
179});
180
181test("when the keys cannot be fetched, nothing is let in", async () => {
182 const down = async () => new Response("no", { status: 503 });
183 const result = await verifyAccessJwt(await sign(claims()), SETTINGS, { fetcher: down, now: NOW });
184 assert.deepEqual(result, { ok: false, reason: "unknown signing key" });
185});
186
187test("sudo is closed until every setting is given", () => {
188 const full = { ACCESS_TEAM_DOMAIN: "https://g1t.cloudflareaccess.com/", ACCESS_AUD: AUD, STAFF_EMAILS: "A@g1t.sh, b@g1t.sh" };
189 assert.deepEqual(readSettings(full), { teamDomain: TEAM, aud: AUD, staff: ["a@g1t.sh", "b@g1t.sh"] });
190 assert.equal(readSettings({ ...full, ACCESS_AUD: "" }), null);
191 assert.equal(readSettings({ ...full, ACCESS_TEAM_DOMAIN: "" }), null);
192 assert.equal(readSettings({ ...full, STAFF_EMAILS: " , " }), null);
193 assert.equal(readSettings({ ...full, ACCESS_TEAM_DOMAIN: "evil.example.com" }), null);
194 assert.equal(readSettings({}), null);
195});
196
197test("changes are only taken from sudo's own pages", () => {
198 const post = (headers: Record<string, string>) => new Request("https://sudo.g1t.sh/x", { method: "POST", headers });
199 assert.equal(isSameOrigin(post({ origin: "https://sudo.g1t.sh" })), true);
200 assert.equal(isSameOrigin(post({ referer: "https://sudo.g1t.sh/accounts/x" })), true);
201 assert.equal(isSameOrigin(post({ origin: "https://evil.example" })), false);
202 assert.equal(isSameOrigin(post({ origin: "null" })), false);
203 assert.equal(isSameOrigin(post({ referer: "https://sudo.g1t.sh.evil.example/" })), false);
204 assert.equal(isSameOrigin(post({ origin: "https://sudo.g1t.sh", "sec-fetch-site": "cross-site" })), false);
205 assert.equal(isSameOrigin(post({})), false);
206});