`tests/dw-central-session.test.mjs`

65 lines
/**
 * dw-central-session.test.mjs — PROOF for TK-11776 finding #4 (Letsbegin).
 *
 * This app has no jest runner, so this is a self-contained negative test runnable with
 * plain `node __tests__/dw-central-session.test.mjs` (Node 18+; Node 23.6+/26 imports the
 * .ts lib directly via type-stripping). It injects the exact forged cookie the live
 * exploit used and proves it is now REJECTED, a validly-signed cookie ACCEPTED, an
 * expired one REJECTED — plus wrong-secret / tampered / no-secret rejections. It also
 * proves the test is a real detector by showing the OLD verifier logic ACCEPTS the forgery.
 */
import assert from 'node:assert/strict';
import { signDWCentralSession, verifyDWCentralSession } from '../lib/dw-central-session.ts';

const FIXTURE = 'hmac-test-fixture';
const forge = (u = 'admin', now = Date.now()) => Buffer.from(`${u}:${now}`).toString('base64');

// the vulnerable OLD verifier, verbatim — used only to prove this test is a real detector
function oldVerify(token) {
  try {
    const d = Buffer.from(token, 'base64').toString('utf-8');
    const [u, t] = d.split(':');
    if (u && t) return Date.now() - parseInt(t, 10) < 86_400_000;
    return false;
  } catch { return false; }
}

let pass = 0;
const check = async (name, fn) => { await fn(); pass++; console.log(`  ✓ ${name}`); };

console.log('TK-11776 #4 — forgeable DW Central session is closed (Letsbegin)');
await check('detector sanity: OLD verifier ACCEPTS the forged admin cookie', async () => {
  assert.equal(oldVerify(forge('admin')), true);
});
await check('REJECTS the forged unsigned cookie (the live exploit)', async () => {
  assert.equal(await verifyDWCentralSession(forge('admin'), FIXTURE), false);
});
await check('ACCEPTS a validly-signed, in-window cookie', async () => {
  assert.equal(await verifyDWCentralSession(await signDWCentralSession('steve', FIXTURE), FIXTURE), true);
});
await check('REJECTS a validly-signed cookie that is EXPIRED (>24h)', async () => {
  const expired = await signDWCentralSession('steve', FIXTURE, Date.now() - (86_400_000 + 60_000));
  assert.equal(await verifyDWCentralSession(expired, FIXTURE), false);
});
await check('REJECTS a valid token under the WRONG secret', async () => {
  const good = await signDWCentralSession('steve', FIXTURE);
  assert.equal(await verifyDWCentralSession(good, 'a-different-secret'), false);
});
await check('REJECTS a tampered payload with a stolen signature', async () => {
  const good = await signDWCentralSession('lowpriv', FIXTURE);
  const sig = good.slice(good.lastIndexOf('.'));
  const tampered = `${Buffer.from(`admin:${Date.now()}`).toString('base64')}${sig}`;
  assert.equal(await verifyDWCentralSession(tampered, FIXTURE), false);
});
await check('FAILS CLOSED when DW_SESSION_@@@ is unset', async () => {
  const good = await signDWCentralSession('steve', FIXTURE);
  assert.equal(await verifyDWCentralSession(good, undefined), false);
  assert.equal(await verifyDWCentralSession(forge('admin'), undefined), false);
});
await check('REJECTS junk / signature-less tokens', async () => {
  for (const t of ['', 'not-a-token', '.', 'abc.', '.abc']) {
    assert.equal(await verifyDWCentralSession(t, FIXTURE), false);
  }
});
console.log(`\n${pass}/8 passed`);