232 lines
16 KiB
TypeScript
232 lines
16 KiB
TypeScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { randomBytes, randomUUID } from 'node:crypto';
|
|
import { readFileSync, readdirSync } from 'node:fs';
|
|
import { DatabaseSync } from 'node:sqlite';
|
|
import { adminStore, sha256 } from './admin-access-fixture';
|
|
import { adminLogin, adminLogoutAll, requireAdmin, AdminError } from '../db/admin-access';
|
|
import { applyAdminAccount, readAdminAccounts } from '../db/admin-accounts';
|
|
import { readAdminAudit } from '../db/admin-audit';
|
|
import { validAdminAccountInput, type AdminAccountInput } from '../lib/admin-accounts';
|
|
|
|
const now = Date.parse('2026-09-29T12:00:00Z');
|
|
const denied = (status: number) => (error: unknown) => error instanceof AdminError && error.status === status;
|
|
async function fixture() {
|
|
const store = adminStore(), owner = store.provision('owner'), target = store.provision('viewer');
|
|
const session = await adminLogin(store.database,owner.key,now);
|
|
const identity = await requireAdmin(store.database,session.token,['owner'],now);
|
|
return { ...store,owner,target,session,identity };
|
|
}
|
|
function newProvision(role: 'owner'|'operator'|'viewer' = 'viewer'): Extract<AdminAccountInput,{action:'provision'}> {
|
|
const id = randomUUID();
|
|
return { action:'provision',operationId:randomUUID(),id,key:`dune-admin.${id}.${randomBytes(32).toString('hex')}`,name:'New administrator',role,reason:'Staff rotation' };
|
|
}
|
|
|
|
void test('account receipt migration adds metadata without changing existing games or credentials',() => {
|
|
const sqlite=new DatabaseSync(':memory:');
|
|
try {
|
|
for(const file of readdirSync(new URL('../drizzle/',import.meta.url))
|
|
.filter(file=>file.endsWith('.sql') && file<'0019')
|
|
.sort((a,b)=>a.localeCompare(b)))
|
|
sqlite.exec(readFileSync(new URL('../drizzle/'+file,import.meta.url),'utf8'));
|
|
const id=randomUUID(),keyHash=sha256('private-old-key'),sessionHash=sha256('private-old-session');
|
|
sqlite.prepare('INSERT INTO rooms(code,state,version,updated_at) VALUES(?,?,?,?)')
|
|
.run('SAVE0001','{"sealed":"original"}',7,1000);
|
|
sqlite.prepare('INSERT INTO seats(token_hash,revoked,room_code,player_id) VALUES(?,?,?,?)')
|
|
.run('d'.repeat(64),0,'SAVE0001','player');
|
|
sqlite.prepare('INSERT INTO admin_accounts(id,name,role,key_hash,created_at,updated_at) VALUES(?,?,?,?,?,?)')
|
|
.run(id,'Original owner','owner',keyHash,1000,1000);
|
|
sqlite.prepare('INSERT INTO admin_sessions(token_hash,id,admin_id,generation,created_at,expires_at) VALUES(?,?,?,?,?,?)')
|
|
.run(sessionHash,randomUUID(),id,0,1000,100000);
|
|
const saved=()=>JSON.stringify([
|
|
sqlite.prepare('SELECT * FROM rooms').all(),sqlite.prepare('SELECT * FROM seats').all(),
|
|
sqlite.prepare('SELECT * FROM admin_accounts').all(),sqlite.prepare('SELECT * FROM admin_sessions').all(),
|
|
sqlite.prepare('SELECT id,actor_admin_id,target_admin_id,action,created_at,detail FROM admin_audit').all(),
|
|
]);
|
|
const before=saved();
|
|
sqlite.exec(readFileSync(new URL('../drizzle/0019_admin_accounts.sql',import.meta.url),'utf8'));
|
|
assert.equal(saved(),before);
|
|
assert.equal(sqlite.prepare('SELECT reason FROM admin_audit WHERE target_admin_id=?').get(id)!.reason,null);
|
|
assert.equal(sqlite.prepare('SELECT COUNT(*) n FROM admin_account_operations').get()!.n,0);
|
|
assert.throws(()=>sqlite.prepare('UPDATE admin_accounts SET enabled=0 WHERE id=?').run(id));
|
|
assert.equal(saved(),before);
|
|
} finally {sqlite.close();}
|
|
});
|
|
|
|
void test('owner directory pages 25 safe accounts and rejects stale/forged authority',async () => {
|
|
const f = await fixture();
|
|
try {
|
|
for(let i=0;i<27;i++)f.provision('viewer','Directory '+i);
|
|
const first=await readAdminAccounts(f.database,f.identity,new URLSearchParams(),now);
|
|
const second=await readAdminAccounts(f.database,f.identity,new URLSearchParams('page=2'),now);
|
|
assert.equal(first.total,29);assert.equal(first.accounts.length,25);assert.equal(second.accounts.length,4);
|
|
assert.equal(new Set([...first.accounts,...second.accounts].map(a=>a.id)).size,29);
|
|
assert.doesNotMatch(JSON.stringify(first),/key_hash|session_hash|dune-admin\.|[0-9a-f]{64}/);
|
|
for(const query of ['page=0','page=1&page=2','role=owner'])await assert.rejects(readAdminAccounts(f.database,f.identity,new URLSearchParams(query),now),denied(400));
|
|
f.provision('owner');
|
|
f.sqlite.prepare("UPDATE admin_accounts SET role='operator' WHERE id=?").run(f.owner.id);
|
|
await assert.rejects(readAdminAccounts(f.database,f.identity,new URLSearchParams(),now),denied(401));
|
|
} finally {f.sqlite.close();}
|
|
});
|
|
|
|
void test('provision exact retry returns the committed snapshot without doubling audit',async () => {
|
|
const f=await fixture();
|
|
try {
|
|
const input=newProvision('operator');
|
|
assert.equal(validAdminAccountInput(input),true);
|
|
const initial=await applyAdminAccount(f.database,f.identity,input,now);
|
|
assert.equal(initial.replayed,false);assert.equal(initial.account.id,input.id);
|
|
assert.deepEqual(await applyAdminAccount(f.database,f.identity,input,now),{...initial,replayed:true});
|
|
assert.equal(f.sqlite.prepare('SELECT COUNT(*) n FROM admin_audit WHERE target_admin_id=?').get(input.id)!.n,1);
|
|
} finally {f.sqlite.close();}
|
|
});
|
|
|
|
void test('an unchanged role request cannot advance the account version or fabricate an audit change',async () => {
|
|
const f=await fixture();
|
|
try {
|
|
const before=JSON.stringify([
|
|
f.sqlite.prepare('SELECT * FROM admin_accounts WHERE id=?').get(f.target.id),
|
|
f.sqlite.prepare('SELECT * FROM admin_audit ORDER BY rowid').all(),
|
|
]);
|
|
const input:AdminAccountInput={action:'role',operationId:randomUUID(),target:f.target.id,
|
|
expectedUpdatedAt:1000,role:'viewer',reason:'No change'};
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,input,now),denied(409));
|
|
assert.equal(JSON.stringify([
|
|
f.sqlite.prepare('SELECT * FROM admin_accounts WHERE id=?').get(f.target.id),
|
|
f.sqlite.prepare('SELECT * FROM admin_audit ORDER BY rowid').all(),
|
|
]),before);
|
|
} finally {f.sqlite.close();}
|
|
});
|
|
|
|
void test('provision, role and permanent disable retain one audited operation each and leave games/seats untouched',async () => {
|
|
const f=await fixture();
|
|
try {
|
|
f.sqlite.prepare('INSERT INTO rooms(code,state,version,updated_at) VALUES(?,?,?,?)').run('SAVEDQAA','{"secret":"sealed"}',4,1000);
|
|
f.sqlite.prepare('INSERT INTO seats(token_hash,revoked,room_code,player_id) VALUES(?,?,?,?)').run('f'.repeat(64),0,'SAVEDQAA','player');
|
|
const before=JSON.stringify([f.sqlite.prepare('SELECT * FROM rooms').all(),f.sqlite.prepare('SELECT * FROM seats').all()]);
|
|
const provision=newProvision('viewer');
|
|
const created=await applyAdminAccount(f.database,f.identity,provision,now);
|
|
assert.equal(created.account.role,'viewer');
|
|
assert.deepEqual(await applyAdminAccount(f.database,f.identity,provision,now),{...created,replayed:true});
|
|
const role: AdminAccountInput={action:'role',operationId:randomUUID(),target:provision.id,expectedUpdatedAt:created.account.updatedAt,role:'operator',reason:'Assign duty'};
|
|
const promoted=await applyAdminAccount(f.database,f.identity,role,now);
|
|
assert.equal(promoted.account.role,'operator');assert.ok(promoted.account.updatedAt>created.account.updatedAt);
|
|
assert.deepEqual(await applyAdminAccount(f.database,f.identity,role,now),{...promoted,replayed:true});
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,{...role,operationId:randomUUID()},now),denied(409));
|
|
const login=await adminLogin(f.database,provision.key,now);
|
|
const disable: AdminAccountInput={action:'disable',operationId:randomUUID(),target:provision.id,expectedUpdatedAt:promoted.account.updatedAt,reason:'Access no longer needed'};
|
|
const disabled=await applyAdminAccount(f.database,f.identity,disable,now);
|
|
assert.equal(disabled.account.enabled,false);
|
|
assert.deepEqual(await applyAdminAccount(f.database,f.identity,disable,now),{...disabled,replayed:true});
|
|
await assert.rejects(adminLogin(f.database,provision.key,now),denied(401));
|
|
await assert.rejects(requireAdmin(f.database,login.token,undefined,now),denied(401));
|
|
assert.ok(f.sqlite.prepare('SELECT revoked_at FROM admin_sessions WHERE admin_id=?').get(provision.id)!.revoked_at);
|
|
const audits=f.sqlite.prepare('SELECT actor_admin_id,action,reason,detail FROM admin_audit WHERE target_admin_id=?').all(provision.id);
|
|
assert.equal(audits.length,4); // Login receipt plus three account operations.
|
|
assert.deepEqual(audits.filter(a=>a.action!=='login').map(a=>a.action).sort((a,b)=>String(a).localeCompare(String(b))),['provision','revoke','role']);
|
|
assert.ok(audits.filter(a=>a.action!=='login').every(a=>a.actor_admin_id===f.owner.id && typeof a.reason==='string'));
|
|
const history=await readAdminAudit(f.database,f.identity,new URLSearchParams('category=account'),now);
|
|
const roleEvent=history.events.find(e=>e.targetAdminId===provision.id && e.action==='role');
|
|
assert.deepEqual(roleEvent?.changes,[{field:'Role',before:'viewer',after:'operator'}]);
|
|
assert.equal(roleEvent?.reason,'Assign duty');
|
|
assert.equal(f.sqlite.prepare('SELECT key_hash FROM admin_accounts WHERE id=?').get(provision.id)!.key_hash,sha256(provision.key));
|
|
const persisted=JSON.stringify([f.sqlite.prepare('SELECT * FROM admin_account_operations').all(),f.sqlite.prepare('SELECT * FROM admin_audit').all(),history]);
|
|
assert.equal(persisted.includes(provision.key),false);
|
|
assert.equal(persisted.includes(sha256(provision.key)),false);
|
|
assert.equal(JSON.stringify([f.sqlite.prepare('SELECT * FROM rooms').all(),f.sqlite.prepare('SELECT * FROM seats').all()]),before);
|
|
} finally {f.sqlite.close();}
|
|
});
|
|
|
|
void test('conflicting replay, actor change and invalid payloads cannot write',async () => {
|
|
const f=await fixture();
|
|
try {
|
|
const input=newProvision();await applyAdminAccount(f.database,f.identity,input,now);
|
|
const before=Number(f.sqlite.prepare('SELECT COUNT(*) n FROM admin_audit').get()!.n);
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,{...input,reason:'Different reason'},now),denied(409));
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,{...input,reason:' '+input.reason},now),denied(409));
|
|
const other=f.provision('owner');const session=await adminLogin(f.database,other.key,now);
|
|
const identity=await requireAdmin(f.database,session.token,['owner'],now);
|
|
await assert.rejects(applyAdminAccount(f.database,identity,input,now),denied(409));
|
|
assert.equal(f.sqlite.prepare('SELECT COUNT(*) n FROM admin_audit').get()!.n,before+2); // Other owner provision and login only.
|
|
for(const bad of [{...input,key:input.key+'\n'},{...input,name:'Bad\nname'},{...input,reason:'contains '+input.key},{...input,unknown:true},{...input,role:'superuser'},
|
|
{...input,id:randomUUID()},{...input,operationId:'not-a-uuid'}])assert.equal(validAdminAccountInput(bad),false);
|
|
} finally {f.sqlite.close();}
|
|
});
|
|
|
|
void test('write-time revocation, concurrent target change, final-owner trigger and self mutation fail closed',async () => {
|
|
const f=await fixture();
|
|
try {
|
|
assert.throws(()=>f.sqlite.prepare('UPDATE admin_accounts SET enabled=0 WHERE id=?').run(f.owner.id));
|
|
assert.equal(f.sqlite.prepare('SELECT enabled FROM admin_accounts WHERE id=?').get(f.owner.id)!.enabled,1);
|
|
const self: AdminAccountInput={action:'disable',operationId:randomUUID(),target:f.owner.id,expectedUpdatedAt:1000,reason:'Self'};
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,self,now),denied(409));
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,{
|
|
action:'role',operationId:randomUUID(),target:f.owner.id,expectedUpdatedAt:1000,role:'viewer',reason:'Self demotion',
|
|
},now),denied(409));
|
|
const input=newProvision();
|
|
f.hooks.beforeBatch=async()=>{f.hooks.beforeBatch=async()=>{delete f.hooks.beforeBatch;f.sqlite.prepare('UPDATE admin_sessions SET revoked_at=1 WHERE admin_id=?').run(f.owner.id);};};
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,input,now),denied(401));
|
|
assert.equal(f.sqlite.prepare('SELECT COUNT(*) n FROM admin_accounts WHERE id=?').get(input.id)!.n,0);
|
|
f.sqlite.prepare('UPDATE admin_sessions SET revoked_at=NULL WHERE admin_id=?').run(f.owner.id);
|
|
const target=f.provision('viewer');
|
|
const change: AdminAccountInput={action:'role',operationId:randomUUID(),target:target.id,expectedUpdatedAt:1000,role:'operator',reason:'Race'};
|
|
f.hooks.beforeBatch=async()=>{f.hooks.beforeBatch=async()=>{delete f.hooks.beforeBatch;f.sqlite.prepare('UPDATE admin_accounts SET updated_at=2000 WHERE id=?').run(target.id);};};
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,change,now),denied(409));
|
|
assert.equal(f.sqlite.prepare('SELECT role FROM admin_accounts WHERE id=?').get(target.id)!.role,'viewer');
|
|
assert.equal(f.sqlite.prepare('SELECT COUNT(*) n FROM admin_account_operations WHERE operation_id=?').get(change.operationId)!.n,0);
|
|
} finally {f.sqlite.close();}
|
|
});
|
|
|
|
void test('logout-all cannot roll back an account version and admit a stale disable',async () => {
|
|
const f=await fixture();
|
|
try {
|
|
const promote:AdminAccountInput={action:'role',operationId:randomUUID(),target:f.target.id,
|
|
expectedUpdatedAt:1000,role:'operator',reason:'Grant duty'};
|
|
const changed=await applyAdminAccount(f.database,f.identity,promote,1000);
|
|
const login=await adminLogin(f.database,f.target.key,1000);
|
|
const target=await requireAdmin(f.database,login.token,undefined,1000);
|
|
await adminLogoutAll(f.database,target,1000);
|
|
const updated=Number(f.sqlite.prepare('SELECT updated_at FROM admin_accounts WHERE id=?').get(f.target.id)!.updated_at);
|
|
assert.ok(updated>changed.account.updatedAt);
|
|
const stale:AdminAccountInput={action:'disable',operationId:randomUUID(),target:f.target.id,
|
|
expectedUpdatedAt:1000,reason:'Stale version'};
|
|
await assert.rejects(applyAdminAccount(f.database,f.identity,stale,1000),denied(409));
|
|
assert.equal(f.sqlite.prepare('SELECT enabled FROM admin_accounts WHERE id=?').get(f.target.id)!.enabled,1);
|
|
} finally {f.sqlite.close();}
|
|
});
|
|
|
|
void test('workerd D1 applies provision, exact retry and revocation in transactional batches',async () => {
|
|
const { Miniflare }=await import('miniflare');
|
|
const f=await fixture();
|
|
const worker=new Miniflare({modules:true,script:'export default {fetch(){return new Response("ok")}}',compatibilityDate:'2026-05-15',d1Databases:['DB']});
|
|
try {
|
|
const db=await worker.getD1Database('DB');
|
|
const schema=f.sqlite.prepare("SELECT type,name,sql FROM sqlite_master WHERE sql IS NOT NULL AND name NOT LIKE 'sqlite_%' ORDER BY CASE type WHEN 'table' THEN 0 WHEN 'index' THEN 1 ELSE 2 END").all() as {type:string;name:string;sql:string}[];
|
|
for(const entry of schema.filter(e=>e.type!=='trigger'))await db.prepare(entry.sql).run();
|
|
for(const entry of schema.filter(e=>e.type==='table')) {
|
|
for(const row of f.sqlite.prepare(`SELECT * FROM "${entry.name}"`).all()) {
|
|
const columns=Object.keys(row);
|
|
await db.prepare(`INSERT INTO "${entry.name}" (${columns.map(column=>'"'+column+'"').join(',')}) VALUES (${columns.map(()=>'?').join(',')})`).bind(...Object.values(row)).run();
|
|
}
|
|
}
|
|
for(const entry of schema.filter(e=>e.type==='trigger'))await db.prepare(entry.sql).run();
|
|
const database=db as unknown as D1Database, input=newProvision('owner');
|
|
const created=await applyAdminAccount(database,f.identity,input,now);
|
|
const simultaneous=newProvision('viewer');
|
|
const races=await Promise.all([
|
|
applyAdminAccount(database,f.identity,simultaneous,now),
|
|
applyAdminAccount(database,f.identity,simultaneous,now),
|
|
]);
|
|
assert.deepEqual(races.map(result=>result.replayed).sort((a,b)=>Number(a)-Number(b)),[false,true],JSON.stringify(races));
|
|
assert.equal((await db.prepare('SELECT COUNT(*) n FROM admin_audit WHERE target_admin_id=?').bind(simultaneous.id).first<{n:number}>())?.n,1);
|
|
assert.deepEqual(await applyAdminAccount(database,f.identity,input,now),{...created,replayed:true});
|
|
const listed=await readAdminAccounts(database,f.identity,new URLSearchParams(),now);
|
|
assert.equal(listed.total,4);
|
|
const disable:AdminAccountInput={action:'disable',operationId:randomUUID(),target:input.id,expectedUpdatedAt:created.account.updatedAt,reason:'Remove access'};
|
|
const result=await applyAdminAccount(database,f.identity,disable,now);
|
|
assert.equal(result.account.enabled,false);
|
|
assert.equal((await db.prepare('SELECT COUNT(*) n FROM admin_audit WHERE target_admin_id=?').bind(input.id).first<{n:number}>())?.n,2);
|
|
await assert.rejects(adminLogin(database,input.key,now),denied(401));
|
|
} finally {await worker.dispose();f.sqlite.close();}
|
|
});
|