Initial Dever 0.0.1

test/rust/runtime/auth/entry.rs

@@ -0,0 +1,69 @@
+use super::request::{configured, request};
+use dever_runtime::{
+    auth::{Error, Identity},
+    authorization::{self, Failure},
+    database::{Context as DatabaseContext, Registry, Sql},
+    task::Runtime,
+};
+
+struct Directory(std::path::PathBuf);
+impl Drop for Directory {
+    fn drop(&mut self) {
+        std::fs::remove_dir_all(&self.0).unwrap();
+    }
+}
+
+#[test]
+fn entry_namespace_requires_role_authorization_and_ignores_request_coordinates() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let cookie = super::request::cookie(&service);
+    let request = request(
+        "POST",
+        &[
+            ("Host", "unit.test"),
+            ("Origin", "https://unit.test"),
+            ("Cookie", &cookie),
+            ("X-Component", "forged"),
+            ("X-Domain", "forged"),
+        ],
+    );
+    let (mut context, _) = service.prepare("admin", &request, false, 100).unwrap();
+    assert_eq!(context.entry_namespace().unwrap_err(), Error::Forbidden);
+    context
+        .establish(Identity {
+            id: "user".into(),
+            user_id: Some(7),
+            tenant_id: None,
+        })
+        .unwrap();
+    assert_eq!(context.entry_namespace().unwrap_err(), Error::Forbidden);
+
+    let unique = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    let name = format!("dever-entry-{}-{unique}", std::process::id());
+    let executable = std::env::current_exe().unwrap();
+    let directory = Directory(executable.parent().unwrap().join(&name));
+    std::fs::create_dir(&directory.0).unwrap();
+    let settings = directory.0.join("setting.json");
+    std::fs::write(&settings, serde_json::json!({"database":{"default":{"type":"sqlite","path":format!("{name}/entry.db"),"max_connections":1}}}).to_string()).unwrap();
+    Runtime::new(Default::default()).unwrap().run(async |scope| {
+        let registry = Registry::load(&settings, &authorization::schema::BINDINGS, scope).await.unwrap();
+        let mut database = DatabaseContext::new(registry);
+        let executor = database.on(1, scope).await.unwrap();
+        executor.execute(scope, Sql::same("INSERT INTO _dever_permission(key,component,domain,site,action,method,kind,active) VALUES ('news.article.admin.create','news','article','admin','create','POST','http',1)"), vec![]).await.unwrap();
+        assert!(matches!(authorization::authorize_entry(&mut database, 1, scope, &mut context, "news", "article", "create").await, Err(Failure::Access(403))));
+        assert_eq!(context.entry_namespace().unwrap_err(), Error::Forbidden);
+        authorization::owner(database.on(1, scope).await.unwrap(), scope, "admin", 7).await.unwrap();
+        let transaction = database.enter();
+        authorization::authorize_entry(&mut database, 1, scope, &mut context, "news", "article", "create").await.unwrap();
+        assert_eq!(authorization::permissions(&mut database, 1, scope, &context, true).await.unwrap().len(), 1);
+        database.finish(scope, transaction, true).await.unwrap();
+        assert_eq!(context.entry_namespace().unwrap(), ("news", "article"));
+        assert_eq!(context.site(), "admin");
+        database.on(1, scope).await.unwrap().execute(scope, "UPDATE _dever_permission SET active=0", vec![]).await.unwrap();
+        assert!(authorization::permissions(&mut database, 1, scope, &context, true).await.unwrap().is_empty());
+        assert!(matches!(authorization::authorize_key(&mut database, 1, scope, &context, "news.article.admin.create").await, Err(Failure::Access(403))));
+    }).unwrap();
+}

test/rust/runtime/auth/metadata.rs

@@ -0,0 +1,119 @@
+use super::request::{configured, request};
+use dever_runtime::{
+    auth::{CookieOptions, Error, SameSite},
+    value::secret::Secret,
+};
+
+fn options() -> CookieOptions {
+    CookieOptions {
+        path: "/".into(),
+        domain: None,
+        max_age: None,
+        same_site: SameSite::Lax,
+        secure: true,
+        http_only: true,
+    }
+}
+
+#[test]
+fn metadata_guards_secret_values_cookie_origin_and_response_fields() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let request = request(
+        "POST",
+        &[
+            ("Host", "unit.test"),
+            ("Origin", "https://unit.test"),
+            ("Cookie", "theme=light; private=v1.c2VjcmV0"),
+            ("X-Test", "value"),
+            ("X-Forwarded-For", "203.0.113.9"),
+        ],
+    );
+    let (mut context, _) = service
+        .prepare_at(
+            "admin",
+            &request,
+            true,
+            100,
+            "127.0.0.1:1234".parse().unwrap(),
+        )
+        .unwrap();
+    assert_eq!(context.client_address().unwrap(), "127.0.0.1");
+    assert_eq!(context.request_id().unwrap(), context.request_id().unwrap());
+    assert_eq!(context.header("X-Test").unwrap().as_deref(), Some("value"));
+    assert_eq!(context.cookie("theme").unwrap().as_deref(), Some("light"));
+    assert!(matches!(context.cookie("private"), Err(Error::Forbidden)));
+    assert!(context.secret_cookie("private").unwrap().is_some());
+    assert!(context.secret_cookie("theme").unwrap().is_none());
+    for name in [
+        "Authorization",
+        "Cookie",
+        "Set-Cookie",
+        "Proxy-Authorization",
+        "X-Api-Key",
+    ] {
+        assert!(context.header(name).is_err());
+    }
+    for name in [
+        "Set-Cookie",
+        "Content-Length",
+        "Content-Type",
+        "Connection",
+        "Upgrade",
+    ] {
+        assert!(context.set_header(name, "value").is_err());
+    }
+    assert!(
+        context
+            .set_header("X-Test", "value\r\nInjected: yes")
+            .is_err()
+    );
+    assert!(context.set_header("X-Test", &"x".repeat(9000)).is_err());
+    assert!(
+        context
+            .set_cookie("session", "cannot overwrite provider", options())
+            .is_err()
+    );
+    assert!(
+        context
+            .set_cookie("theme", "bad; value", options())
+            .is_err()
+    );
+    assert!(
+        context
+            .set_secret_cookie(
+                "private",
+                &Secret::from_input(b"bytes".to_vec()),
+                CookieOptions {
+                    secure: false,
+                    ..options()
+                }
+            )
+            .is_err()
+    );
+    context
+        .set_secret_cookie("private", &Secret::from_input(b"bytes".to_vec()), options())
+        .unwrap();
+    assert!(
+        context
+            .set_cookie(
+                "cross",
+                "value",
+                CookieOptions {
+                    same_site: SameSite::None,
+                    secure: false,
+                    ..options()
+                }
+            )
+            .is_err()
+    );
+    context.set_header("X-Test", "response").unwrap();
+    let mut response = dever_runtime::api::response("{}");
+    context.publish(&mut response);
+    assert!(
+        response
+            .headers()
+            .get_all("set-cookie")
+            .iter()
+            .any(|header| header.as_bytes().starts_with(b"private=v1.Ynl0ZXM;"))
+    );
+}

test/rust/runtime/auth/mod.rs

@@ -0,0 +1,131 @@
+use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+use dever_runtime::{
+    adapter::Document,
+    auth::{Claims, Settings},
+    value::secret::Secret,
+};
+use hmac::{Hmac, Mac};
+use sha2::Sha256;
+#[cfg(feature = "authorization")]
+mod entry;
+mod metadata;
+mod request;
+mod tenant;
+
+const KEY: &str = "unit-test-only-key-not-for-deployment";
+
+fn settings() -> Settings {
+    let document = Document::parse(serde_json::json!({"auth":{"providers":{
+        "session":{"verify":"user.account.verify","jwtSecret":KEY,"ttlSeconds":60,"cookie":"session"},
+        "other":{"verify":"user.account.verify","jwtSecret":KEY,"ttlSeconds":60}
+    }}}).to_string()).unwrap();
+    Settings::load(&document).unwrap()
+}
+
+fn signed(header: &str, payload: &str, key: &str) -> Secret {
+    let signed = format!(
+        "{}.{}",
+        URL_SAFE_NO_PAD.encode(header),
+        URL_SAFE_NO_PAD.encode(payload)
+    );
+    let mut mac = Hmac::<Sha256>::new_from_slice(key.as_bytes()).unwrap();
+    mac.update(signed.as_bytes());
+    Secret::from_input(
+        format!(
+            "{signed}.{}",
+            URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes())
+        )
+        .into_bytes(),
+    )
+}
+
+#[test]
+fn signed_claims_remain_bound_to_provider_site_session_and_time() {
+    let settings = settings();
+    let provider = &settings.providers["session"];
+    let claims = Claims {
+        subject: "账号".into(),
+        session: "opaque-session".into(),
+        tenant: None,
+        site: "admin".into(),
+    };
+    let token = provider.issue(&claims, 100).unwrap();
+    assert_eq!(provider.verify_token(&token, "admin", 100).unwrap(), claims);
+    assert_eq!(provider.verify_token(&token, "admin", 159).unwrap(), claims);
+    assert!(provider.verify_token(&token, "admin", 160).is_err());
+    assert!(provider.verify_token(&token, "admin", 99).is_err());
+    assert!(provider.verify_token(&token, "front", 100).is_err());
+    assert!(
+        settings.providers["other"]
+            .verify_token(&token, "admin", 100)
+            .is_err()
+    );
+    assert!(!format!("{token:?}").contains("opaque-session"));
+}
+
+#[test]
+fn token_validation_rejects_algorithm_confusion_tampering_and_ambiguous_claims() {
+    let settings = settings();
+    let provider = &settings.providers["session"];
+    let payload =
+        r#"{"iss":"session","aud":"admin","sub":"u","sid":"s","tenant":null,"iat":100,"exp":160}"#;
+    let header = r#"{"alg":"HS256","typ":"JWT"}"#;
+    assert!(
+        provider
+            .verify_token(&signed(header, payload, KEY), "admin", 100)
+            .is_ok()
+    );
+    for token in [
+        signed(r#"{"alg":"none","typ":"JWT"}"#, payload, KEY),
+        signed(r#"{"alg":"RS256","typ":"JWT"}"#, payload, KEY),
+        signed(header, payload, "different-unit-test-signing-key"),
+        signed(
+            header,
+            &payload.replace("\"sub\":\"u\"", "\"sub\":\"u\",\"sub\":\"v\""),
+            KEY,
+        ),
+        signed(
+            header,
+            &payload.replace("\"sub\":\"u\"", "\"sub\":\"\""),
+            KEY,
+        ),
+        signed(header, &payload.replace("\"exp\":160", "\"exp\":161"), KEY),
+        signed(header, &payload.replace("\"iat\":100", "\"iat\":101"), KEY),
+        signed(header, &payload.replace("\"iat\":100", "\"iat\":-1"), KEY),
+        signed(header, &payload.replace("\"exp\":160", "\"exp\":1e9"), KEY),
+        signed(
+            header,
+            &payload.replace("\"tenant\":null,", "\"permissions\":[\"*\"],"),
+            KEY,
+        ),
+        Secret::from_input(vec![b'a'; 8193]),
+    ] {
+        assert_eq!(
+            provider.verify_token(&token, "admin", 100).unwrap_err(),
+            "invalid authentication"
+        );
+    }
+}
+
+#[test]
+fn authentication_settings_require_deployment_key_and_unambiguous_fields() {
+    for value in [
+        serde_json::json!({"verify":"user.account.verify","jwtSecret":"short","ttlSeconds":60}),
+        serde_json::json!({"verify":"user.account.verify","jwtSecret":KEY,"ttlSeconds":0}),
+        serde_json::json!({"verify":"user.account.verify","jwtSecret":KEY,"ttlSeconds":60,"cookie":"session; bad"}),
+        serde_json::json!({"verify":"user.account","jwtSecret":KEY,"ttlSeconds":60}),
+        serde_json::json!({"verify":"user.account.verify","jwtSecret":KEY,"ttlSeconds":60,"algorithm":"none"}),
+    ] {
+        let document = Document::parse(
+            serde_json::json!({"auth":{"providers":{"session":value}}}).to_string(),
+        )
+        .unwrap();
+        assert!(Settings::load(&document).is_err());
+    }
+    assert!(
+        Settings::load(&Document::parse("{}".into()).unwrap())
+            .unwrap()
+            .providers
+            .is_empty()
+    );
+}

test/rust/runtime/auth/request.rs

@@ -0,0 +1,198 @@
+use super::*;
+use dever_runtime::{
+    api,
+    api::Request,
+    auth::{Error, Identity, Route, Service, Verification},
+};
+use std::sync::{
+    Arc,
+    atomic::{AtomicU64, Ordering},
+};
+
+static NEXT: AtomicU64 = AtomicU64::new(0);
+
+pub(super) fn configured(origin: Option<&str>, verify: &str) -> Result<Service, String> {
+    let path = std::env::temp_dir().join(format!(
+        "dever-auth-config-{}-{}.json",
+        std::process::id(),
+        NEXT.fetch_add(1, Ordering::Relaxed)
+    ));
+    let settings = serde_json::json!({
+        "http":{"host":"127.0.0.1","port":8181},
+        "sites":{"admin":{"path":"admin","auth":"session","hosts":["unit.test"],"origin":origin}},
+        "auth":{"providers":{"session":{"verify":verify,"jwtSecret":KEY,"ttlSeconds":60,"cookie":"session"}}}
+    });
+    std::fs::write(&path, settings.to_string()).unwrap();
+    let config = api::Config::load(&path, &["admin"]);
+    std::fs::remove_file(path).unwrap();
+    Service::new(
+        Arc::new(config?),
+        &[Verification {
+            name: "user.account.verify",
+            user_model: 13,
+            tenant_model: 17,
+        }],
+        &[Route {
+            topic: "admin",
+            required: true,
+            user_models: &[],
+            tenant_models: &[],
+        }],
+    )
+}
+
+pub(super) fn request(method: &str, fields: &[(&str, &str)]) -> Request {
+    let mut request = hyper::Request::builder()
+        .method(method)
+        .uri("/user/account/admin/me");
+    for (name, value) in fields {
+        request = request.header(*name, *value);
+    }
+    request.body(Default::default()).unwrap()
+}
+
+pub(super) fn cookie(service: &Service) -> String {
+    let request = request(
+        "POST",
+        &[("Host", "unit.test"), ("Origin", "https://unit.test")],
+    );
+    let (mut context, claims) = service.prepare("admin", &request, true, 100).unwrap();
+    assert!(claims.is_none());
+    context
+        .issue_cookie("user", "session-id", None, 100)
+        .unwrap();
+    let mut response = api::response("{}");
+    assert!(!response.headers().contains_key("set-cookie"));
+    context.publish(&mut response);
+    let cookie = response.headers().get("set-cookie").unwrap();
+    let value = std::str::from_utf8(cookie.as_bytes()).unwrap();
+    assert!(value.contains("Secure; HttpOnly; SameSite=Lax; Max-Age=60"));
+    value.split(';').next().unwrap().into()
+}
+
+#[test]
+fn authentication_needs_compiled_verifier_before_it_establishes_identity() {
+    assert!(configured(None, "user.account.verify").is_err());
+    assert!(configured(Some("https://unit.test"), "user.account.arbitrary").is_err());
+    for origin in [
+        "https://unit.test/path",
+        "https://unit.test?query",
+        "https://user@unit.test",
+        "https://unit.test:bad",
+        "https://unit.test:99999",
+        "https://unit.test:0",
+    ] {
+        assert!(
+            configured(Some(origin), "user.account.verify").is_err(),
+            "{origin}"
+        );
+    }
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let cookie = cookie(&service);
+    let request = request("GET", &[("Host", "unit.test"), ("Cookie", &cookie)]);
+    let (mut context, claims) = service.prepare("admin", &request, false, 100).unwrap();
+    assert_eq!(context.id().unwrap_err(), Error::Unauthorized);
+    assert_eq!(claims.unwrap().subject, "user");
+    assert_eq!(context.verifier(), Some("user.account.verify"));
+    context
+        .establish(Identity {
+            id: "verified-user".into(),
+            user_id: Some(7),
+            tenant_id: None,
+        })
+        .unwrap();
+    assert_eq!(context.id().unwrap(), "verified-user");
+    assert_eq!(context.session().unwrap(), "session-id");
+    assert_eq!(context.user_id(Some(13)).unwrap(), Some(7));
+    assert_eq!(context.user_id(Some(17)).unwrap_err(), Error::Internal);
+}
+
+#[test]
+fn cookie_writes_require_exact_external_origin_and_host() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let cookie = cookie(&service);
+    for fields in [
+        vec![("Host", "unit.test")],
+        vec![("Host", "unit.test"), ("Origin", "null")],
+        vec![("Host", "unit.test"), ("Origin", "http://unit.test")],
+        vec![("Host", "unit.test"), ("Origin", "https://unit.test:444")],
+        vec![
+            ("Host", "internal.test"),
+            ("Origin", "https://unit.test"),
+            ("X-Forwarded-Host", "unit.test"),
+        ],
+        vec![("Host", "unit.test:bad"), ("Origin", "https://unit.test")],
+        vec![
+            ("Host", "unit.test"),
+            ("Origin", "https://unit.test"),
+            ("Origin", "https://unit.test"),
+        ],
+    ] {
+        let mut fields = fields;
+        fields.push(("Cookie", &cookie));
+        let request = request("POST", &fields);
+        assert!(matches!(
+            service.prepare("admin", &request, false, 100),
+            Err(Error::Forbidden)
+        ));
+        let (mut public, _) = service.prepare("admin", &request, true, 100).unwrap();
+        assert_eq!(public.clear_cookie().unwrap_err(), Error::Forbidden);
+        let mut response = api::response("{}");
+        public.publish(&mut response);
+        assert!(!response.headers().contains_key("set-cookie"));
+    }
+    let request = request(
+        "POST",
+        &[
+            ("Host", "UNIT.TEST:443"),
+            ("Origin", "https://unit.test"),
+            ("Cookie", &cookie),
+        ],
+    );
+    assert!(service.prepare("admin", &request, false, 100).is_ok());
+}
+
+#[test]
+fn public_ignores_old_cookie_but_rejects_explicit_bad_authorization() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let cookie = cookie(&service);
+    let old = request(
+        "GET",
+        &[("Host", "unit.test"), ("Cookie", "session=old-expired")],
+    );
+    assert!(
+        service
+            .prepare("admin", &old, true, 100)
+            .unwrap()
+            .1
+            .is_none()
+    );
+    assert!(matches!(
+        service.prepare("admin", &old, false, 100),
+        Err(Error::Unauthorized)
+    ));
+    for fields in [
+        vec![("Authorization", "Bearer invalid")],
+        vec![
+            ("Authorization", "Bearer invalid"),
+            ("Authorization", "Bearer invalid"),
+        ],
+        vec![
+            ("Cookie", cookie.as_str()),
+            ("Authorization", "Bearer invalid"),
+        ],
+        vec![("Cookie", cookie.as_str()), ("Cookie", cookie.as_str())],
+    ] {
+        let request = request("GET", &fields);
+        assert!(matches!(
+            service.prepare("admin", &request, false, 100),
+            Err(Error::Unauthorized)
+        ));
+        if fields.iter().any(|(name, _)| *name == "Authorization") {
+            assert!(matches!(
+                service.prepare("admin", &request, true, 100),
+                Err(Error::Unauthorized)
+            ));
+        }
+    }
+}

test/rust/runtime/auth/tenant.rs

@@ -0,0 +1,98 @@
+use super::{
+    request::{configured, request},
+    *,
+};
+use dever_runtime::auth::{Error, Identity};
+
+#[test]
+fn signed_tenant_reference_needs_provider_identity_before_becoming_storage_id() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let login = request(
+        "POST",
+        &[("Host", "unit.test"), ("Origin", "https://unit.test")],
+    );
+    let (mut context, _) = service.prepare("admin", &login, true, 100).unwrap();
+    let token = context
+        .issue("user", "session-id", Some("external-tenant"), 100)
+        .unwrap();
+    assert_eq!(
+        settings().providers["session"]
+            .verify_token(&token, "admin", 100)
+            .unwrap()
+            .tenant
+            .as_deref(),
+        Some("external-tenant")
+    );
+    context
+        .issue_cookie("user", "session-id", Some("external-tenant"), 100)
+        .unwrap();
+    let mut response = dever_runtime::api::response("{}");
+    context.publish(&mut response);
+    let value = response.headers().get("set-cookie").unwrap().as_bytes();
+    let cookie = std::str::from_utf8(value)
+        .unwrap()
+        .split(';')
+        .next()
+        .unwrap();
+    let incoming = request("GET", &[("Host", "unit.test"), ("Cookie", cookie)]);
+    let (mut verified, claims) = service.prepare("admin", &incoming, false, 100).unwrap();
+    assert_eq!(claims.unwrap().tenant.as_deref(), Some("external-tenant"));
+    assert_eq!(verified.verified_tenant(), None);
+    assert_eq!(verified.tenant_id(None).unwrap_err(), Error::Unauthorized);
+    for id in [0, -1] {
+        assert_eq!(
+            verified
+                .establish(Identity {
+                    id: "verified-user".into(),
+                    user_id: Some(7),
+                    tenant_id: Some(id)
+                })
+                .unwrap_err(),
+            Error::Unauthorized
+        );
+        assert_eq!(verified.verified_tenant(), None);
+    }
+    verified
+        .establish(Identity {
+            id: "verified-user".into(),
+            user_id: Some(7),
+            tenant_id: Some(43),
+        })
+        .unwrap();
+    assert_eq!(verified.verified_tenant(), Some(43));
+    assert_eq!(verified.tenant_id(Some(17)).unwrap(), Some(43));
+    assert_eq!(verified.tenant_id(Some(13)).unwrap_err(), Error::Internal);
+}
+
+#[test]
+#[cfg(feature = "job")]
+fn restored_job_reverifies_tenant_and_persists_the_internal_id_separately() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let claims = Claims {
+        subject: "user".into(),
+        session: "session-id".into(),
+        tenant: Some("external-tenant".into()),
+        site: "admin".into(),
+    };
+    assert!(service.trusted("other", &claims).is_err());
+    let mut context = service.trusted("session", &claims).unwrap();
+    assert_eq!(context.verified_tenant(), None);
+    assert!(
+        context
+            .job_execution("news.article.admin.create".into())
+            .is_err()
+    );
+    context
+        .establish(Identity {
+            id: "verified-user".into(),
+            user_id: Some(7),
+            tenant_id: Some(43),
+        })
+        .unwrap();
+    let execution = context
+        .job_execution("news.article.admin.create".into())
+        .unwrap();
+    assert!(
+        matches!(execution, dever_runtime::job::Execution::User { tenant: Some(reference), tenant_id: Some(43), .. } if reference == "external-tenant")
+    );
+}