mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-06 17:08:10 +00:00
Anso
d882f223f4
* feat(api-tokens): switch to sen_sk_ prefixed opaque keys
Replace JWT-shaped API tokens with 56-char opaque keys of the form
`sen_sk_<43-char base62 random><6-char base62 checksum>` (256-bit
entropy, sha256-truncated checksum). Node-proxy tokens stay JWTs.
Why:
* The api_token path was already a sha256 DB lookup; the JWT signature
was wasted work and the 400d JWT ceiling vs DB expires_at was a
confusing dual bound.
* Opaque tokens carry a verifiable checksum so malformed/typoed values
are rejected before any SQLite lookup.
* `sen_sk_` prefix is recognizable to GitHub, TruffleHog, GitGuardian
and makes the on-wire shape visually distinct from node_proxy JWTs.
Changes:
* New `utils/apiTokenFormat.ts` (generate + checksum-verify, CSPRNG via
randomInt, timingSafeEqual on the checksum compare).
* `middleware/auth.ts` and `websocket/upgradeHandler.ts` route opaque
tokens before any jwt.verify; 401 messages unified to avoid a
token-existence oracle.
* `middleware/rateLimiters.ts` short-circuits opaque tokens in the
node_proxy detection and keys per-token via a non-reversible sha256
slice so each token keeps its own bucket without a DB hit.
* All six existing tests migrated from jwt.sign({scope:'api_token'})
to generateApiToken(); new format-only test suite covering prefix,
length, alphabet, checksum reject paths, and a 10k-iteration
collision/integrity loop.
* Docs (features/api-tokens.mdx, api-reference/overview.mdx) describe
the shape and drop the obsolete JWT-ceiling note.
* fix(api-tokens): clear CI lint and CodeQL false positives
* Drop unused TEST_USERNAME import in remote-console-session.test.ts;
the migration to generateApiToken() left it orphaned.
* Add a CodeQL barrier model so `generateApiToken`'s ReturnValue does
not flow into the `insufficient-password-hash` query. The function
emits 256-bit CSPRNG opaque keys; sha256 of the raw token is the
correct construction for high-entropy API tokens (bcrypt-class
hashes target low-entropy human passwords). CodeQL's name heuristic
was treating "Token" as a password source and flagging the standard
sha256 wrapping at all 9 call sites.
* ci(codeql): exclude js/insufficient-password-hash for token paths
The previous barrierModel data extension was a no-op for this rule: the
js/insufficient-password-hash query identifies its "password" sources via
SensitiveExpr's name heuristic ("token", "secret", "key" substrings),
which is upstream of the taint-tracking layer where barrierModel applies.
Verified by post-push re-analysis: 9 alerts still open, all undismissed.
Replace the dead extension with a path-scoped query-filter in
codeql-config.yml so the rule no longer fires on apiTokenFormat,
apiTokens, and the test directory. Real user-password hashing code
elsewhere in the repo (auth, users, setup routes) remains analyzed.
The 9 existing alerts on PR #1062 are dismissed via API as false
positives with a justification pointing at this config. Future runs
will not re-flag them because of the path filter.
42 lines
1.3 KiB
TypeScript
42 lines
1.3 KiB
TypeScript
import crypto from 'crypto';
|
|
import { generateApiToken } from '../../utils/apiTokenFormat';
|
|
import type { DatabaseService } from '../../services/DatabaseService';
|
|
|
|
type DbClass = typeof DatabaseService;
|
|
|
|
export interface CreateTestApiTokenOptions {
|
|
db: DbClass;
|
|
scope: 'read-only' | 'deploy-only' | 'full-admin';
|
|
userId: number;
|
|
name?: string;
|
|
expiresAt?: number | null;
|
|
}
|
|
|
|
/**
|
|
* Generate a `sen_sk_` API token and insert a backing row into `api_tokens`,
|
|
* mirroring what `routes/apiTokens.ts` does in production. Returns the raw
|
|
* token (only secret value the test sees; the DB stores its sha256).
|
|
*/
|
|
export function createTestApiToken(opts: CreateTestApiTokenOptions): string {
|
|
const raw = generateApiToken();
|
|
const tokenHash = crypto.createHash('sha256').update(raw).digest('hex');
|
|
opts.db.getInstance().addApiToken({
|
|
token_hash: tokenHash,
|
|
name: opts.name ?? `test-${opts.scope}-${Date.now()}-${Math.random().toString(36).slice(2)}`,
|
|
scope: opts.scope,
|
|
user_id: opts.userId,
|
|
created_at: Date.now(),
|
|
expires_at: opts.expiresAt ?? null,
|
|
});
|
|
return raw;
|
|
}
|
|
|
|
/**
|
|
* Produce a well-formed `sen_sk_` token that has no matching DB row. The
|
|
* auth layer should reject it at the row-lookup step — useful for asserting
|
|
* unbacked tokens are not honoured.
|
|
*/
|
|
export function unbackedApiToken(): string {
|
|
return generateApiToken();
|
|
}
|