homeio

1import {
2  proxy,
3  resetAuthStatusCacheForTests,
4  verifySessionTokenInMiddleware,
5} from "@/proxy";
6import { NextRequest } from "next/server";
7import { createHmac } from "node:crypto";
8import { beforeEach, describe, expect, it, vi } from "vitest";
9
10function createToken(
11  sessionId: string,
12  expiresAtEpochSeconds: number,
13  secret: string,
14) {
15  const payload = `${sessionId}.${expiresAtEpochSeconds}`;
16  const signature = createHmac("sha256", secret).update(payload).digest("hex");
17  return `${payload}.${signature}`;
18}
19
20describe("middleware auth guard", () => {
21  const secret = "test-session-secret-123456";
22
23  beforeEach(() => {
24    vi.restoreAllMocks();
25    resetAuthStatusCacheForTests();
26  });
27
28  it("verifies a valid token", async () => {
29    const token = createToken(
30      "session-1",
31      Math.floor(Date.now() / 1000) + 3600,
32      secret,
33    );
34
35    await expect(verifySessionTokenInMiddleware(token, secret)).resolves.toBe(
36      true,
37    );
38  });
39
40  it("redirects unauthenticated users to login", async () => {
41    process.env.AUTH_SESSION_SECRET = secret;
42    vi.spyOn(global, "fetch").mockResolvedValueOnce(
43      new Response(JSON.stringify({ data: { hasUsers: true } }), {
44        status: 200,
45        headers: {
46          "Content-Type": "application/json",
47        },
48      }),
49    );
50
51    const request = new NextRequest("http://localhost/");
52    const response = await proxy(request);
53
54    expect(response.status).toBe(307);
55    expect(response.headers.get("location")).toContain("/login");
56  });
57
58  it("redirects unauthenticated users to register when no users exist", async () => {
59    process.env.AUTH_SESSION_SECRET = secret;
60    vi.spyOn(global, "fetch").mockResolvedValueOnce(
61      new Response(JSON.stringify({ data: { hasUsers: false } }), {
62        status: 200,
63        headers: {
64          "Content-Type": "application/json",
65        },
66      }),
67    );
68
69    const request = new NextRequest("http://localhost/");
70    const response = await proxy(request);
71
72    expect(response.status).toBe(307);
73    expect(response.headers.get("location")).toContain("/register");
74  });
75
76  it("allows authenticated users to root path", async () => {
77    process.env.AUTH_SESSION_SECRET = secret;
78    vi.spyOn(global, "fetch").mockResolvedValueOnce(
79      new Response(JSON.stringify({ data: { hasUsers: true } }), {
80        status: 200,
81        headers: {
82          "Content-Type": "application/json",
83        },
84      }),
85    );
86
87    const token = createToken(
88      "session-1",
89      Math.floor(Date.now() / 1000) + 3600,
90      secret,
91    );
92
93    const request = new NextRequest("http://localhost/", {
94      headers: {
95        cookie: `homeio_session=${token}`,
96      },
97    });
98
99    const response = await proxy(request);
100
101    expect(response.status).toBe(200);
102  });
103
104  it("redirects stale authenticated users to register when no users exist", async () => {
105    process.env.AUTH_SESSION_SECRET = secret;
106    vi.spyOn(global, "fetch").mockResolvedValueOnce(
107      new Response(JSON.stringify({ data: { hasUsers: false } }), {
108        status: 200,
109        headers: {
110          "Content-Type": "application/json",
111        },
112      }),
113    );
114
115    const token = createToken(
116      "session-1",
117      Math.floor(Date.now() / 1000) + 3600,
118      secret,
119    );
120
121    const request = new NextRequest("http://localhost/", {
122      headers: {
123        cookie: `homeio_session=${token}`,
124      },
125    });
126
127    const response = await proxy(request);
128
129    expect(response.status).toBe(307);
130    expect(response.headers.get("location")).toContain("/register");
131    expect(response.cookies.get("homeio_session")?.value).toBe("");
132  });
133
134  it("allows recovery route access without redirecting authenticated users", async () => {
135    process.env.AUTH_SESSION_SECRET = secret;
136
137    const token = createToken(
138      "session-1",
139      Math.floor(Date.now() / 1000) + 3600,
140      secret,
141    );
142
143    const request = new NextRequest("http://localhost/updating", {
144      headers: {
145        cookie: `homeio_session=${token}`,
146      },
147    });
148
149    const response = await proxy(request);
150
151    expect(response.status).toBe(200);
152  });
153
154  it("returns auth entry hint for unauthenticated /api/auth/me when users exist", async () => {
155    process.env.AUTH_SESSION_SECRET = secret;
156    vi.spyOn(global, "fetch").mockResolvedValueOnce(
157      new Response(JSON.stringify({ data: { hasUsers: true } }), {
158        status: 200,
159        headers: {
160          "Content-Type": "application/json",
161        },
162      }),
163    );
164
165    const request = new NextRequest("http://localhost/api/auth/me");
166    const response = await proxy(request);
167
168    expect(response.status).toBe(401);
169    expect(response.headers.get("x-auth-entry")).toBe("/login");
170  });
171
172  it("returns auth entry hint for unauthenticated /api/auth/me when no users exist", async () => {
173    process.env.AUTH_SESSION_SECRET = secret;
174    vi.spyOn(global, "fetch").mockResolvedValueOnce(
175      new Response(JSON.stringify({ data: { hasUsers: false } }), {
176        status: 200,
177        headers: {
178          "Content-Type": "application/json",
179        },
180      }),
181    );
182
183    const request = new NextRequest("http://localhost/api/auth/me");
184    const response = await proxy(request);
185
186    expect(response.status).toBe(401);
187    expect(response.headers.get("x-auth-entry")).toBe("/register");
188  });
189
190  it("shares one auth status lookup between visitors arriving together", async () => {
191    const fetchMock = vi.spyOn(global, "fetch").mockImplementation(
192      async () =>
193        new Response(JSON.stringify({ data: { hasUsers: true } }), {
194          status: 200,
195          headers: { "Content-Type": "application/json" },
196        }),
197    );
198
199    await Promise.all(Array.from({ length: 5 }, () => proxy(new NextRequest("http://localhost/"))));
200
201    expect(fetchMock).toHaveBeenCalledTimes(1);
202  });
203
204  it("remembers that accounts exist for a minute, but that none exist only briefly", async () => {
205    const now = vi.spyOn(Date, "now").mockReturnValue(1_000_000);
206    const answer = (hasUsers: boolean) =>
207      new Response(JSON.stringify({ data: { hasUsers } }), {
208        status: 200,
209        headers: { "Content-Type": "application/json" },
210      });
211    const fetchMock = vi
212      .spyOn(global, "fetch")
213      .mockResolvedValueOnce(answer(false))
214      .mockResolvedValueOnce(answer(true))
215      .mockResolvedValueOnce(answer(true));
216
217    await proxy(new NextRequest("http://localhost/"));
218    // The first account may be registered any moment: "none" is re-checked soon.
219    now.mockReturnValue(1_000_000 + 5_000);
220    await proxy(new NextRequest("http://localhost/"));
221    expect(fetchMock).toHaveBeenCalledTimes(2);
222
223    now.mockReturnValue(1_000_000 + 5_000 + 59_000);
224    await proxy(new NextRequest("http://localhost/"));
225    expect(fetchMock).toHaveBeenCalledTimes(2);
226
227    now.mockReturnValue(1_000_000 + 5_000 + 60_000);
228    await proxy(new NextRequest("http://localhost/"));
229    expect(fetchMock).toHaveBeenCalledTimes(3);
230  });
231
232  it("sends you to login, not register, when the auth status lookup fails", async () => {
233    // This used to answer /register. Not knowing whether accounts exist is not
234    // the same as knowing there are none, and treating it as "fresh install"
235    // offers a running machine up for registration and throws away the session
236    // of anyone signed in. One redirect to /login is the cheaper wrong answer.
237    process.env.AUTH_SESSION_SECRET = secret;
238    vi.spyOn(global, "fetch").mockRejectedValueOnce(new Error("network failure"));
239
240    const request = new NextRequest("http://localhost/");
241    const response = await proxy(request);
242
243    expect(response.status).toBe(307);
244    expect(response.headers.get("location")).toContain("/login");
245    expect(response.headers.get("location")).not.toContain("/register");
246  });
247
248  it("forbids a shared cache from keeping any answer it gives", async () => {
249    // A tunnel or CDN in front that caches redirects serves one visitor's
250    // answer to everybody: an install that was briefly empty answers
251    // 307 -> /register, and once that is cached every later visitor is sent to
252    // registration however many accounts exist. Incognito and a second device
253    // do not help, because the cache sits upstream of both.
254    process.env.AUTH_SESSION_SECRET = secret;
255    vi.spyOn(global, "fetch").mockResolvedValueOnce(
256      new Response(JSON.stringify({ data: { hasUsers: true } }), {
257        headers: { "Content-Type": "application/json" },
258      }),
259    );
260
261    const response = await proxy(new NextRequest("http://localhost/"));
262
263    expect(response.headers.get("Cache-Control")).toBe("private, no-store");
264  });
265
266  it("leaves immutable assets cacheable", async () => {
267    process.env.AUTH_SESSION_SECRET = secret;
268
269    const response = await proxy(
270      new NextRequest("http://localhost/_next/static/chunks/main.js"),
271    );
272
273    expect(response.headers.get("Cache-Control")).toBeNull();
274  });
275
276  it("allows unauthenticated calls to the TOTP login route through", async () => {
277    // Second leg of TOTP login: the caller has no session cookie yet, only a
278    // short-lived partial-auth token. The proxy must NOT short-circuit with
279    // a 401 — the route handler validates the token itself.
280    process.env.AUTH_SESSION_SECRET = secret;
281
282    const request = new NextRequest(
283      "http://localhost/api/v1/auth/login/totp",
284      { method: "POST" },
285    );
286    const response = await proxy(request);
287
288    expect(response.status).toBe(200);
289  });
290});
291