refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

* refactor(auth): replace dashboard sessions with stateless tokens * feat(auth): harden session issuance and distributed enforcement * fix(proxy): preserve trusted proxy compatibility defaults * refactor: address dashboard auth review feedback * refactor: remove classic frontend and flatten web app
2026-07-20 16:48:43 +08:00
parent 5a6c53d496
commit 31d70fca39
1605 changed files with 17511 additions and 147913 deletions
@@ -2,38 +2,48 @@ package model

 import (
 	"context"
+	"encoding/base64"
 	"errors"
 	"net"
 	"sync"
-	"sync/atomic"
 	"testing"
+	"time"

 	"github.com/QuantumNous/new-api/common"
 	"github.com/go-redis/redis/v8"
+	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
 )

-func TestHardDeleteUserPurgesAuthenticationDataWhenRedisFails(t *testing.T) {
+func TestHardDeleteUserFailsClosedWhenAuthFenceCannotPublish(t *testing.T) {
 	truncateTables(t)

-	user := User{Username: "hard-delete-user", Password: "password"}
+	user := User{Username: "hard-delete-user", Password: "password", TelegramId: "hard-delete-telegram"}
 	require.NoError(t, DB.Create(&user).Error)
+	require.NoError(t, DB.Transaction(func(tx *gorm.DB) error {
+		return ClaimExternalIdentityWithTx(tx, ExternalIdentityProviderTelegram, user.TelegramId, user.Id)
+	}))
 	require.NoError(t, DB.Create(&Token{UserId: user.Id, Key: "hard-delete-token"}).Error)
 	require.NoError(t, DB.Create(&TwoFA{UserId: user.Id, Secret: "secret", IsEnabled: true}).Error)
 	require.NoError(t, DB.Create(&TwoFABackupCode{UserId: user.Id, CodeHash: "hash"}).Error)
 	require.NoError(t, DB.Create(&PasskeyCredential{UserID: user.Id, CredentialID: "credential", PublicKey: "public-key"}).Error)
 	require.NoError(t, DB.Create(&UserOAuthBinding{UserId: user.Id, ProviderId: 1, ProviderUserId: "provider-user"}).Error)
+	require.NoError(t, DB.Create(&UserSession{
+		SID: "hard-delete-session", UserID: user.Id, Version: 1, UserAuthVersion: 1,
+		Status: UserSessionStatusActive, RefreshHash: "refresh-hash", LoginMethod: "password",
+		LastActiveAt: 1, ExpiresAt: 2,
+	}).Error)
+	require.NoError(t, DB.Create(&AuthFlow{
+		TokenHash: "hard-delete-auth-flow", Purpose: AuthFlowPurposeTwoFALogin,
+		UserId: user.Id, ExpiresAt: time.Now().Add(time.Minute),
+	}).Error)

 	oldRedisEnabled, oldRDB := common.RedisEnabled, common.RDB
 	common.RedisEnabled = true
-	var cacheInvalidatedAfterCommit atomic.Bool
 	common.RDB = redis.NewClient(&redis.Options{
 		Dialer: func(context.Context, string, string) (net.Conn, error) {
-			var count int64
-			if err := DB.Unscoped().Model(&User{}).Where("id = ?", user.Id).Count(&count).Error; err == nil && count == 0 {
-				cacheInvalidatedAfterCommit.Store(true)
-			}
 			return nil, errors.New("forced redis failure")
 		},
 		MaxRetries: -1,
@@ -43,8 +53,58 @@ func TestHardDeleteUserPurgesAuthenticationDataWhenRedisFails(t *testing.T) {
 		common.RedisEnabled, common.RDB = oldRedisEnabled, oldRDB
 	})

+	require.Error(t, HardDeleteUserById(user.Id))
+
+	var count int64
+	require.NoError(t, DB.Unscoped().Model(&User{}).Where("id = ?", user.Id).Count(&count).Error)
+	assert.EqualValues(t, 1, count)
+	for _, record := range []any{
+		&Token{},
+		&TwoFA{},
+		&TwoFABackupCode{},
+		&PasskeyCredential{},
+		&UserOAuthBinding{},
+		&UserSession{},
+		&AuthFlow{},
+		&ExternalIdentityClaim{},
+	} {
+		require.NoError(t, DB.Unscoped().Model(record).Where("user_id = ?", user.Id).Count(&count).Error)
+		assert.EqualValues(t, 1, count)
+	}
+}
+
+func TestHardDeleteUserPublishesTombstoneAndPurgesAuthenticationData(t *testing.T) {
+	truncateTables(t)
+	server := useUserCacheMiniRedis(t)
+
+	user := User{
+		Username: "hard-delete-success", Password: "password", AuthVersion: 1,
+		TelegramId: "hard-delete-success-telegram",
+	}
+	require.NoError(t, DB.Create(&user).Error)
+	require.NoError(t, DB.Transaction(func(tx *gorm.DB) error {
+		return ClaimExternalIdentityWithTx(tx, ExternalIdentityProviderTelegram, user.TelegramId, user.Id)
+	}))
+	require.NoError(t, DB.Create(&Token{UserId: user.Id, Key: "hard-delete-success-token"}).Error)
+	require.NoError(t, DB.Create(&TwoFA{UserId: user.Id, Secret: "secret", IsEnabled: true}).Error)
+	require.NoError(t, DB.Create(&TwoFABackupCode{UserId: user.Id, CodeHash: "hash"}).Error)
+	require.NoError(t, DB.Create(&PasskeyCredential{UserID: user.Id, CredentialID: "credential-success", PublicKey: "public-key"}).Error)
+	require.NoError(t, DB.Create(&UserOAuthBinding{UserId: user.Id, ProviderId: 1, ProviderUserId: "provider-user-success"}).Error)
+	require.NoError(t, DB.Create(&UserSession{
+		SID: "hard-delete-success-session", UserID: user.Id, Version: 1, UserAuthVersion: 1,
+		Status: UserSessionStatusActive, RefreshHash: "refresh-hash", LoginMethod: "password",
+		LastActiveAt: 1, ExpiresAt: 2,
+	}).Error)
+	require.NoError(t, DB.Create(&AuthFlow{
+		TokenHash: "hard-delete-success-flow", Purpose: AuthFlowPurposeTwoFALogin,
+		UserId: user.Id, ExpiresAt: time.Now().Add(time.Minute),
+	}).Error)
+	require.NoError(t, populateUserCache(user))
+	// Administrative hard deletion commonly targets an already soft-deleted
+	// user; the shared version increment must therefore query unscoped.
+	require.NoError(t, DB.Delete(&user).Error)
+
 	require.NoError(t, HardDeleteUserById(user.Id))
-	assert.True(t, cacheInvalidatedAfterCommit.Load())

 	var count int64
 	require.NoError(t, DB.Unscoped().Model(&User{}).Where("id = ?", user.Id).Count(&count).Error)
@@ -55,10 +115,18 @@ func TestHardDeleteUserPurgesAuthenticationDataWhenRedisFails(t *testing.T) {
 		&TwoFABackupCode{},
 		&PasskeyCredential{},
 		&UserOAuthBinding{},
+		&UserSession{},
+		&AuthFlow{},
+		&ExternalIdentityClaim{},
 	} {
 		require.NoError(t, DB.Unscoped().Model(record).Where("user_id = ?", user.Id).Count(&count).Error)
 		assert.Zero(t, count)
 	}
+	assert.False(t, server.Exists(getUserAuthFenceKey(user.Id)))
+	committed, err := common.RDB.Get(t.Context(), getUserAuthVersionKey(user.Id)).Result()
+	require.NoError(t, err)
+	assert.Equal(t, "2", committed)
+	assert.False(t, server.Exists(getUserCacheKey(user.Id)))
 }

 func TestIncrementFailedAttemptsCountsConcurrentFailures(t *testing.T) {
@@ -94,7 +162,10 @@ func TestValidateBackupCodeCanOnlySucceedOnce(t *testing.T) {
 	truncateTables(t)

 	const code = "ABCD-1234"
-	require.NoError(t, CreateBackupCodes(123, []string{code}))
+	user := User{Id: 123, Username: "backup-code-user", Password: "password", AuthVersion: 1}
+	require.NoError(t, DB.Create(&user).Error)
+	require.NoError(t, DB.Create(&TwoFA{UserId: user.Id, Secret: "secret", IsEnabled: false}).Error)
+	require.NoError(t, CreatePendingTwoFASetupBackupCodes(user.Id, []string{code}))

 	const attempts = 2
 	results := make(chan bool, attempts)
@@ -128,3 +199,117 @@ func TestValidateBackupCodeCanOnlySucceedOnce(t *testing.T) {
 	require.NoError(t, err)
 	assert.Zero(t, remaining)
 }
+
+func TestPendingTwoFASetupAPIsRejectEnabledFactor(t *testing.T) {
+	truncateTables(t)
+
+	user := User{Username: "enabled-twofa-guard", Password: "password", AuthVersion: 1}
+	require.NoError(t, DB.Create(&user).Error)
+	twoFA := TwoFA{UserId: user.Id, Secret: "secret", IsEnabled: true}
+	require.NoError(t, DB.Create(&twoFA).Error)
+
+	require.Error(t, CreatePendingTwoFASetupBackupCodes(user.Id, []string{"ABCD-1234"}))
+	require.Error(t, twoFA.DeletePendingTwoFASetup())
+
+	var stored TwoFA
+	require.NoError(t, DB.First(&stored, twoFA.Id).Error)
+	assert.True(t, stored.IsEnabled)
+	var backupCodeCount int64
+	require.NoError(t, DB.Model(&TwoFABackupCode{}).Where("user_id = ?", user.Id).Count(&backupCodeCount).Error)
+	assert.Zero(t, backupCodeCount)
+}
+
+func TestSecurityFactorMutationsAdvanceUserAuthVersion(t *testing.T) {
+	truncateTables(t)
+
+	user := User{
+		Username:    "security-factor-version-user",
+		Password:    "password",
+		Role:        common.RoleCommonUser,
+		Status:      common.UserStatusEnabled,
+		Group:       "default",
+		AuthVersion: 1,
+	}
+	require.NoError(t, DB.Create(&user).Error)
+	twoFA := TwoFA{UserId: user.Id, Secret: "secret", IsEnabled: false}
+	require.NoError(t, DB.Create(&twoFA).Error)
+
+	require.NoError(t, twoFA.EnableWithAuthVersion())
+	assertUserAuthVersion(t, user.Id, 2)
+	assert.ErrorIs(t, twoFA.EnableWithAuthVersion(), ErrTwoFAAlreadyEnabled)
+	assertUserAuthVersion(t, user.Id, 2)
+	require.NoError(t, ReplaceBackupCodesWithAuthVersion(user.Id, []string{"ABCD-1234"}))
+	assertUserAuthVersion(t, user.Id, 3)
+	require.NoError(t, DisableTwoFAWithAuthVersion(user.Id))
+	assertUserAuthVersion(t, user.Id, 4)
+
+	credential := &PasskeyCredential{UserID: user.Id, CredentialID: "credential-id", PublicKey: "public-key"}
+	require.NoError(t, UpsertPasskeyCredentialWithAuthVersion(credential))
+	assertUserAuthVersion(t, user.Id, 5)
+	require.NoError(t, DeletePasskeyByUserIDWithAuthVersion(user.Id))
+	assertUserAuthVersion(t, user.Id, 6)
+}
+
+func TestUpdatePasskeyAssertionStateCannotRewriteRegistrationIdentity(t *testing.T) {
+	truncateTables(t)
+
+	user := User{Username: "passkey-assertion-state", Password: "password", AuthVersion: 1}
+	require.NoError(t, DB.Create(&user).Error)
+	credentialID := []byte("stable-credential-id")
+	stored := PasskeyCredential{
+		UserID:          user.Id,
+		CredentialID:    base64.StdEncoding.EncodeToString(credentialID),
+		PublicKey:       "original-public-key",
+		AttestationType: "packed",
+		AAGUID:          "original-aaguid",
+		SignCount:       1,
+		Transports:      `["usb"]`,
+		Attachment:      "platform",
+	}
+	require.NoError(t, DB.Create(&stored).Error)
+	usedAt := time.Now().UTC().Truncate(time.Second)
+	validated := &webauthn.Credential{
+		ID:              credentialID,
+		PublicKey:       []byte("replacement-public-key"),
+		AttestationType: "none",
+		Flags: webauthn.CredentialFlags{
+			UserPresent:    true,
+			UserVerified:   true,
+			BackupEligible: true,
+			BackupState:    true,
+		},
+		Authenticator: webauthn.Authenticator{
+			AAGUID:       []byte("replacement-aaguid"),
+			SignCount:    8,
+			CloneWarning: true,
+		},
+	}
+	require.NoError(t, UpdatePasskeyAssertionState(user.Id, validated, usedAt))
+
+	var updated PasskeyCredential
+	require.NoError(t, DB.First(&updated, stored.ID).Error)
+	assert.Equal(t, stored.CredentialID, updated.CredentialID)
+	assert.Equal(t, stored.PublicKey, updated.PublicKey)
+	assert.Equal(t, stored.AttestationType, updated.AttestationType)
+	assert.Equal(t, stored.AAGUID, updated.AAGUID)
+	assert.Equal(t, stored.Transports, updated.Transports)
+	assert.Equal(t, stored.Attachment, updated.Attachment)
+	assert.EqualValues(t, 8, updated.SignCount)
+	assert.True(t, updated.CloneWarning)
+	assert.True(t, updated.UserPresent)
+	assert.True(t, updated.UserVerified)
+	assert.True(t, updated.BackupEligible)
+	assert.True(t, updated.BackupState)
+	require.NotNil(t, updated.LastUsedAt)
+	assert.Equal(t, usedAt.Unix(), updated.LastUsedAt.Unix())
+
+	validated.ID = []byte("another-credential")
+	assert.ErrorIs(t, UpdatePasskeyAssertionState(user.Id, validated, usedAt), ErrPasskeyNotFound)
+}
+
+func assertUserAuthVersion(t *testing.T, userID int, expected int64) {
+	t.Helper()
+	var version int64
+	require.NoError(t, DB.Model(&User{}).Where("id = ?", userID).Select("auth_version").Scan(&version).Error)
+	assert.Equal(t, expected, version)
+}