8614032956

Committed 09 Apr 2024 10:14AM UTC coverage: 93.032% (+0.2%) from 92.806%

Build # 8614032956

Build Type

Pull #1368

github

Committed by

iamacook

Commit Message

Reduce nonce validity period

Pull Request Pull Request #1368: Add `AuthController`

Run Details

1917 of 2324 branches covered (82.49%)

Branch coverage included in aggregate %.

65 of 66 new or added lines in 8 files covered. (98.48%)

1 existing line in 1 file now uncovered.

6641 of 6875 relevant lines covered (96.6%)

362.34 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

76.19

/src/domain/auth/auth.repository.ts

import { CacheRouter } from '@/datasources/cache/cache.router';
import { IAuthRepository } from '@/domain/auth/auth.repository.interface';
import { SiweMessage } from '@/domain/auth/entities/siwe-message.entity';
import { IAuthApi } from '@/domain/interfaces/auth-api.interface';
import { Inject, Injectable, UnauthorizedException } from '@nestjs/common';
import { Request } from 'express';
import { IConfigurationService } from '@/config/configuration.service.interface';
import {
  CacheService,
  ICacheService,
} from '@/datasources/cache/cache.service.interface';
import { AuthService } from '@/routes/auth/auth.service';
import { VerifyAuthMessageDto } from '@/routes/auth/entities/schemas/verify-auth-message.dto';
import { IJwtService } from '@/datasources/jwt/jwt.service.interface';

@Injectable()
export class AuthRepository implements IAuthRepository {
  private readonly nonceTtlInSeconds: number;

  constructor(
    @Inject(IAuthApi)
    private readonly authApi: IAuthApi,
    @Inject(IConfigurationService)
    private readonly configurationService: IConfigurationService,
    @Inject(CacheService) private readonly cacheService: ICacheService,
    @Inject(IJwtService)
    private readonly jwtService: IJwtService,
  ) {
    this.nonceTtlInSeconds = this.configurationService.getOrThrow(
      'auth.nonceTtlSeconds',
    );
  }

  /**
   * Generates a unique nonce and stores it in cache for later verification.
   *
   * @returns nonce - unique string to be signed
   */
  async generateNonce(): Promise<{ nonce: string }> {
    const nonce = this.authApi.generateNonce();

    // Store nonce for reference to verify/prevent replay attacks
    const cacheDir = CacheRouter.getAuthNonceCacheDir(nonce);
    await this.cacheService.set(cacheDir, nonce, this.nonceTtlInSeconds);

    return {
      nonce,
    };
  }

  /**
   * Verifies the validity of a signed message and returns an access token:
   *
   * 1. Ensure the message itself has not expired.
   * 2. Ensure the nonce was generated by us/is not a replay attack.
   * 3. Verify the signature of the message.
   * 4. Return an access token if all checks pass.
   *
   * @param args - DTO containing the message and signature to verify.
   *
   * The following adhere to JWT standard {@link https://datatracker.ietf.org/doc/html/rfc7519}
   *
   * @returns accessToken - JWT access token
   * @returns tokenType - token type ('Bearer') to be used in the `Authorization` header
   * @returns notBefore - epoch from when token is valid (if applicable, otherwise null)
   * @returns expiresIn - time in seconds until the token expires (if applicable, otherwise null)
   */
  async verify(args: VerifyAuthMessageDto): Promise<{
    accessToken: string;
    tokenType: string;
    notBefore: number | null;
    expiresIn: number | null;
  }> {
    const isAuthorized = await this.isAuthorized(args).catch(() => false);

    if (!isAuthorized) {
      throw new UnauthorizedException();
    }

    const dateWhenTokenIsValid = args.message.notBefore
      ? new Date(args.message.notBefore)
      : null;
    const dateWhenTokenExpires = args.message.expirationTime
      ? new Date(args.message.expirationTime)
      : null;

    const secondsUntilTokenIsValid = dateWhenTokenIsValid
      ? this.getSecondsUntil(dateWhenTokenIsValid)
      : null;
    const secondsUntilTokenExpires = dateWhenTokenExpires
      ? this.getSecondsUntil(dateWhenTokenExpires)
      : null;

    const accessToken = this.jwtService.sign(args.message, {
      ...(secondsUntilTokenIsValid !== null && {
        notBefore: secondsUntilTokenIsValid,
      }),
      ...(secondsUntilTokenExpires !== null && {
        expiresIn: secondsUntilTokenExpires,
      }),
    });

    return {
      tokenType: AuthService.AUTH_TOKEN_TOKEN_TYPE,
      accessToken,
      // Differing measurements match JWT standard {@link https://datatracker.ietf.org/doc/html/rfc7519}
      notBefore: dateWhenTokenIsValid?.getTime() ?? null,
      expiresIn: secondsUntilTokenExpires,
    };
  }

  /**
   * Verifies that a message is valid according to its expiration date,
   * signature and nonce.
   *
   * @param args.message - SiWe message in object form
   * @param args.signature - signature from signing the message
   *
   * @returns boolean - whether the message is valid
   */
  private async isAuthorized(args: {
    message: SiweMessage;
    signature: `0x${string}`;
  }): Promise<boolean> {
    const cacheDir = CacheRouter.getAuthNonceCacheDir(args.message.nonce);

    const isExpired =
      !!args.message.expirationTime &&
      new Date(args.message.expirationTime) < new Date();

    try {
      // Verification is not necessary, message has expired
      if (isExpired) {
        return false;
      }

      const [isValidSignature, cachedNonce] = await Promise.all([
        this.authApi.verifyMessage(args),
        await this.cacheService.get(cacheDir),
      ]);
      const isValidNonce = cachedNonce === args.message.nonce;

      return isValidSignature && isValidNonce;
    } catch {
      return false;
    } finally {
      await this.cacheService.deleteByKey(cacheDir.key);
    }
  }

  private getSecondsUntil(date: Date): number {
    return Math.floor((date.getTime() - Date.now()) / 1_000);
  }

  /**
   * Extracts the access token from the request.
   *
   * @param request - the express request object
   * @param tokenType - the type of token used in the Authorization header
   * @returns the access token, or null if not found
   */
  getAccessToken(request: Request, tokenType: string): string | null {
    const header = request.headers.authorization;

    if (typeof header !== 'string') {
      return null;
    }

    const [type, token] = header.split(' ');

    if (type !== tokenType || !token) {
      return null;
    }

    return token;
  }
}

1	import { CacheRouter } from '@/datasources/cache/cache.router';	92✔
2	import { IAuthRepository } from '@/domain/auth/auth.repository.interface';
3	import { SiweMessage } from '@/domain/auth/entities/siwe-message.entity';
4	import { IAuthApi } from '@/domain/interfaces/auth-api.interface';	92✔
5	import { Inject, Injectable, UnauthorizedException } from '@nestjs/common';	92✔
6	import { Request } from 'express';
7	import { IConfigurationService } from '@/config/configuration.service.interface';	92✔
8	import {	92✔
9	CacheService,
10	ICacheService,
11	} from '@/datasources/cache/cache.service.interface';
12	import { AuthService } from '@/routes/auth/auth.service';	92✔
13	import { VerifyAuthMessageDto } from '@/routes/auth/entities/schemas/verify-auth-message.dto';
14	import { IJwtService } from '@/datasources/jwt/jwt.service.interface';	92✔
15
16	@Injectable()
17	export class AuthRepository implements IAuthRepository {	92✔
18	private readonly nonceTtlInSeconds: number;
19
20	constructor(
21	@Inject(IAuthApi)
22	private readonly authApi: IAuthApi,	1,192✔
23	@Inject(IConfigurationService)
24	private readonly configurationService: IConfigurationService,	1,192✔
25	@Inject(CacheService) private readonly cacheService: ICacheService,	1,192✔
26	@Inject(IJwtService)
27	private readonly jwtService: IJwtService,	1,192✔
28	) {
29	this.nonceTtlInSeconds = this.configurationService.getOrThrow(	1,192✔
30	'auth.nonceTtlSeconds',
31	);
32	}
33
34	/**
35	* Generates a unique nonce and stores it in cache for later verification.
36	*
37	* @returns nonce - unique string to be signed
38	*/
39	async generateNonce(): Promise<{ nonce: string }> {
40	const nonce = this.authApi.generateNonce();	10✔
41
42	// Store nonce for reference to verify/prevent replay attacks
43	const cacheDir = CacheRouter.getAuthNonceCacheDir(nonce);	10✔
44	await this.cacheService.set(cacheDir, nonce, this.nonceTtlInSeconds);	10✔
45
46	return {	10✔
47	nonce,
48	};
49	}
50
51	/**
52	* Verifies the validity of a signed message and returns an access token:
53	*
54	* 1. Ensure the message itself has not expired.
55	* 2. Ensure the nonce was generated by us/is not a replay attack.
56	* 3. Verify the signature of the message.
57	* 4. Return an access token if all checks pass.
58	*
59	* @param args - DTO containing the message and signature to verify.
60	*
61	* The following adhere to JWT standard {@link https://datatracker.ietf.org/doc/html/rfc7519}
62	*
63	* @returns accessToken - JWT access token
64	* @returns tokenType - token type ('Bearer') to be used in the `Authorization` header
65	* @returns notBefore - epoch from when token is valid (if applicable, otherwise null)
66	* @returns expiresIn - time in seconds until the token expires (if applicable, otherwise null)
67	*/
68	async verify(args: VerifyAuthMessageDto): Promise<{
69	accessToken: string;
70	tokenType: string;
71	notBefore: number \| null;
72	expiresIn: number \| null;
73	}> {
74	const isAuthorized = await this.isAuthorized(args).catch(() => false);	10✔
75
76	if (!isAuthorized) {	10✔
77	throw new UnauthorizedException();	8✔
78	}
79
80	const dateWhenTokenIsValid = args.message.notBefore	2!
81	? new Date(args.message.notBefore)
82	: null;
83	const dateWhenTokenExpires = args.message.expirationTime	2!
84	? new Date(args.message.expirationTime)
85	: null;
86
87	const secondsUntilTokenIsValid = dateWhenTokenIsValid	2!
88	? this.getSecondsUntil(dateWhenTokenIsValid)
89	: null;
90	const secondsUntilTokenExpires = dateWhenTokenExpires	2!
91	? this.getSecondsUntil(dateWhenTokenExpires)
92	: null;
93
94	const accessToken = this.jwtService.sign(args.message, {	2✔
95	...(secondsUntilTokenIsValid !== null && {	2✔
96	notBefore: secondsUntilTokenIsValid,
97	}),
98	...(secondsUntilTokenExpires !== null && {	2✔
99	expiresIn: secondsUntilTokenExpires,
100	}),
101	});
102
103	return {	2✔
104	tokenType: AuthService.AUTH_TOKEN_TOKEN_TYPE,
105	accessToken,
106	// Differing measurements match JWT standard {@link https://datatracker.ietf.org/doc/html/rfc7519}
107	notBefore: dateWhenTokenIsValid?.getTime() ?? null,	6!
108	expiresIn: secondsUntilTokenExpires,
109	};
110	}
111
112	/**
113	* Verifies that a message is valid according to its expiration date,
114	* signature and nonce.
115	*
116	* @param args.message - SiWe message in object form
117	* @param args.signature - signature from signing the message
118	*
119	* @returns boolean - whether the message is valid
120	*/
121	private async isAuthorized(args: {
122	message: SiweMessage;
123	signature: `0x${string}`;
124	}): Promise<boolean> {
125	const cacheDir = CacheRouter.getAuthNonceCacheDir(args.message.nonce);	10✔
126
127	const isExpired =
128	!!args.message.expirationTime &&	10✔
129	new Date(args.message.expirationTime) < new Date();
130
131	try {	10✔
132	// Verification is not necessary, message has expired
133	if (isExpired) {	10✔
134	return false;	2✔
135	}
136
137	const [isValidSignature, cachedNonce] = await Promise.all([	8✔
138	this.authApi.verifyMessage(args),
139	await this.cacheService.get(cacheDir),
140	]);
141	const isValidNonce = cachedNonce === args.message.nonce;	8✔
142
143	return isValidSignature && isValidNonce;	8✔
144	} catch {
NEW 145	return false;	×
146	} finally {
147	await this.cacheService.deleteByKey(cacheDir.key);	10✔
148	}
149	}
150
151	private getSecondsUntil(date: Date): number {
152	return Math.floor((date.getTime() - Date.now()) / 1_000);	4✔
153	}
154
155	/**
156	* Extracts the access token from the request.
157	*
158	* @param request - the express request object
159	* @param tokenType - the type of token used in the Authorization header
160	* @returns the access token, or null if not found
161	*/
162	getAccessToken(request: Request, tokenType: string): string \| null {
163	const header = request.headers.authorization;	×
164
165	if (typeof header !== 'string') {	×
166	return null;	×
167	}
168
169	const [type, token] = header.split(' ');	×
170
171	if (type !== tokenType \|\| !token) {	×
172	return null;	×
173	}
174
175	return token;	×
176	}
177	}

safe-global / safe-client-gateway / 8614032956

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous