온라인 인증 시도와 처리 비용 및 Kakao 응답 경계를 제한한다

2026-10-09 03:43:59 +09:00
parent 9dceaf8e4e
commit 3d9f7392df
12 changed files with 874 additions and 25 deletions
@@ -0,0 +1,238 @@
+import { constants, publicEncrypt, randomUUID } from 'node:crypto';
+import fastify, { type FastifyRequest } from 'fastify';
+import { fastifyTRPCPlugin } from '@trpc/server/adapters/fastify';
+import { createClient } from 'redis';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import { trpcJsonBodyHttpServerOptions } from '@sammo-ts/common';
+import { createGatewayApiContext } from '../src/context.js';
+import { appRouter } from '../src/router.js';
+import { AuthAttemptBudget, RedisAuthCounterStore } from '../src/auth/attemptBudget.js';
+import { createInMemoryUserRepository } from '../src/auth/inMemoryUserRepository.js';
+import { InMemoryGatewaySessionService } from '../src/auth/inMemorySessionService.js';
+import { createPasswordEnvelopeService } from '../src/auth/passwordEnvelope.js';
+
+const redisUrl = process.env.GATEWAY_AUTH_REDIS_TEST_URL;
+
+describe.skipIf(!redisUrl)('authentication budgets over real HTTP and Redis', () => {
+    const client = createClient({ url: redisUrl });
+    const prefix = `auth-budget-http-test:${randomUUID()}`;
+    const envelope = createPasswordEnvelopeService();
+    beforeAll(async () => {
+        await client.connect();
+    });
+    afterAll(async () => {
+        const keys: string[] = [];
+        for await (const page of client.scanIterator({ MATCH: `${prefix}:*`, COUNT: 100 })) keys.push(...page);
+        if (keys.length) await client.del(keys);
+        await client.quit();
+    });
+    const credential = (password: string) => {
+        const key = envelope.getPublicKey();
+        return {
+            keyId: key.keyId,
+            ciphertext: publicEncrypt(
+                { key: key.publicKeyPem, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' },
+                Buffer.from(password)
+            ).toString('base64'),
+        };
+    };
+    const fixture = async (available = true) => {
+        const users = createInMemoryUserRepository();
+        await users.createUser({ username: 'target-user', password: 'correct-password' });
+        await users.createUser({ username: 'other-user', password: 'correct-password' });
+        const requestIps = new Set<string>();
+        const peer = (request: FastifyRequest): string => {
+            requestIps.add(request.ip);
+            return request.ip;
+        };
+        const verify = vi.spyOn(users, 'verifyPassword');
+        const open = vi.fn(envelope.open);
+        const sessions = new InMemoryGatewaySessionService({ sessionTtlSeconds: 600, gameSessionTtlSeconds: 600 });
+        const authBudget = new AuthAttemptBudget(
+            new RedisAuthCounterStore(available ? client : client.duplicate()),
+            `${prefix}:${randomUUID()}`,
+            'synthetic-budget-key'
+        );
+        const app = fastify({ trustProxy: false });
+        await app.register(fastifyTRPCPlugin, {
+            prefix: '/trpc',
+            trpcOptions: {
+                router: appRouter,
+                ...trpcJsonBodyHttpServerOptions,
+                createContext: ({ req }: { req: FastifyRequest }) =>
+                    createGatewayApiContext({
+                        users,
+                        sessions,
+                        passwordEnvelope: { ...envelope, open },
+                        authBudget,
+                        requestIp: peer(req),
+                        requestHeaders: req.headers,
+                        flushPublisher: { publishUserFlush: async () => {} },
+                        gameTokenSecret: 'synthetic-game-key',
+                        gameSessionTtlSeconds: 600,
+                        kakaoClient: {} as never,
+                        oauthSessions: {} as never,
+                        publicBaseUrl: 'http://localhost',
+                        adminLocalAccountEnabled: true,
+                        localRegistrationEnabled: true,
+                        localAccountGraceDays: 7,
+                        profiles: {} as never,
+                        orchestrator: {} as never,
+                        profileStatus: {} as never,
+                        prisma: {} as never,
+                    }),
+            },
+        });
+        const address = await app.listen({ host: '127.0.0.1', port: 0 });
+        const post = (operation: string, input: unknown, headers: Record<string, string> = {}) =>
+            fetch(`${address}/trpc/${operation}`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', ...headers },
+                body: JSON.stringify(input),
+            });
+        return { app, address, post, users, sessions, verify, open, requestIps };
+    };
+
+    it('blocks an eleventh normalized account attempt before RSA/Argon2 despite spoofed forwarding headers', async () => {
+        const f = await fixture();
+        try {
+            for (let i = 0; i < 10; i++) {
+                const response = await f.post(
+                    'auth.login',
+                    { username: i % 2 ? ' TARGET-USER ' : 'target-user', credential: credential('wrong-password') },
+                    { 'x-forwarded-for': `198.51.100.${i + 1}` }
+                );
+                expect(response.status).toBe(401);
+            }
+            expect(f.requestIps.size).toBe(1);
+            expect(f.requestIps.has('127.0.0.1')).toBe(true);
+            expect(f.verify).toHaveBeenCalledTimes(10);
+            expect(f.open).toHaveBeenCalledTimes(10);
+            const denied = await f.post(
+                'auth.login',
+                { username: 'target-user', credential: credential('correct-password') },
+                { 'x-forwarded-for': '203.0.113.99' }
+            );
+            expect(denied.status).toBe(429);
+            expect(JSON.stringify(await denied.json())).not.toContain('stack');
+            expect(f.verify).toHaveBeenCalledTimes(10);
+            expect(f.open).toHaveBeenCalledTimes(10);
+            expect(
+                (await f.post('auth.login', { username: 'other-user', credential: credential('correct-password') }))
+                    .status
+            ).toBe(200);
+        } finally {
+            await f.app.close();
+        }
+    });
+
+    it('charges each operation in a tRPC batch instead of granting one budget per HTTP request', async () => {
+        const f = await fixture();
+        try {
+            const statuses: number[] = [];
+            for (let round = 0; round < 4; round++) {
+                const input = Object.fromEntries(
+                    Array.from({ length: 3 }, (_value, i) => [
+                        String(i),
+                        { username: 'target-user', credential: credential('wrong-password') },
+                    ])
+                );
+                const response = await f.post('auth.login,auth.login,auth.login?batch=1', input);
+                const body = (await response.json()) as Array<{ error: { data: { httpStatus: number } } }>;
+                statuses.push(...body.map((entry) => entry.error.data.httpStatus));
+            }
+            expect(statuses.filter((status) => status === 401)).toHaveLength(10);
+            expect(statuses.filter((status) => status === 429)).toHaveLength(2);
+            expect(f.verify).toHaveBeenCalledTimes(10);
+        } finally {
+            await f.app.close();
+        }
+    });
+
+    it('shares the password/deletion subject across sessions of the same authenticated actor', async () => {
+        const f = await fixture();
+        const user = await f.users.findByUsername('target-user');
+        try {
+            for (let i = 0; i < 10; i++) {
+                const session = await f.sessions.createSession(user!);
+                const response = await f.post(i % 2 ? 'account.changePassword' : 'account.scheduleDeletion', {
+                    sessionToken: session.sessionToken,
+                    currentCredential: credential('wrong-password'),
+                    newCredential: credential('new-password'),
+                });
+                expect(response.status).toBe(401);
+            }
+            const session = await f.sessions.createSession(user!);
+            expect(
+                (
+                    await f.post('account.scheduleDeletion', {
+                        sessionToken: session.sessionToken,
+                        currentCredential: credential('correct-password'),
+                    })
+                ).status
+            ).toBe(429);
+            expect(f.verify).toHaveBeenCalledTimes(10);
+            expect(f.open).toHaveBeenCalledTimes(10);
+            expect((await f.users.findById(user!.id))?.deleteAfter).toBeUndefined();
+        } finally {
+            await f.app.close();
+        }
+    });
+
+    it('fails closed on unavailable protection while keeping logout independent of its counters', async () => {
+        const f = await fixture(false);
+        try {
+            expect(
+                (await f.post('auth.login', { username: 'target-user', credential: credential('correct-password') }))
+                    .status
+            ).toBe(503);
+            expect(f.open).not.toHaveBeenCalled();
+            expect(f.verify).not.toHaveBeenCalled();
+            const user = await f.users.findByUsername('target-user');
+            const session = await f.sessions.createSession(user!);
+            expect((await f.post('auth.logout', { sessionToken: session.sessionToken })).status).toBe(200);
+            expect(await f.sessions.getSession(session.sessionToken)).toBeNull();
+            expect(
+                (await f.post('auth.login', { username: 123, credential: credential('correct-password') })).status
+            ).toBe(503);
+            const malformed = await fetch(`${f.address}/trpc/auth.login`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: '{',
+            });
+            expect(malformed.status).toBe(400);
+        } finally {
+            await f.app.close();
+        }
+    });
+
+    it('bounds parallel credential work and admits a subsequent request after all failures settle', async () => {
+        const f = await fixture();
+        let release!: () => void;
+        const waiting = new Promise<void>((resolve) => {
+            release = resolve;
+        });
+        f.verify.mockImplementation(async () => {
+            await waiting;
+            return false;
+        });
+        const input = { username: 'target-user', credential: credential('wrong-password') };
+        const pending = Array.from({ length: 4 }, () => f.post('auth.login', input));
+        try {
+            await vi.waitFor(() => expect(f.verify).toHaveBeenCalledTimes(4));
+            expect((await f.post('auth.login', input)).status).toBe(429);
+            expect(f.open).toHaveBeenCalledTimes(4);
+            release();
+            expect((await Promise.all(pending)).map((r) => r.status)).toEqual([401, 401, 401, 401]);
+            f.verify.mockRestore();
+            expect(
+                (await f.post('auth.login', { username: 'target-user', credential: credential('correct-password') }))
+                    .status
+            ).toBe(200);
+        } finally {
+            release();
+            await Promise.allSettled(pending);
+            await f.app.close();
+        }
+    });
+});