feat(auth): OIDC SSO for admin users — phase 1 (#798)

Authorization-code + PKCE against a single configurable IdP via openid-client v5, with JIT provisioning. Verified end-to-end against a real Keycloak 26 (realm + confidential client + verified-email user): settings → discovery test → login button → Keycloak → dashboard. Backend: - migration 162: admin_users.auth_provider ('local' default) + external_subject, composite unique index - oidcService: settings-driven config (client secret AES-256-GCM at rest, mfaService pattern, OIDC_ENCRYPTION_KEY fallback JWT_SECRET), cached discovery, sub-based identity binding — email linking of existing admins only with email_verified=true; JIT behind oidc_autoprovision with configurable default role and an unusable random password hash - GET /api/auth/admin/sso/login + /callback: state/nonce/PKCE verifier cross the redirect in a 10-min signed httpOnly SameSite=Lax cookie; the callback reuses the local login's session establishment (completeAdminLogin split into establishAdminSession + JSON wrapper) so SSO sessions are identical downstream; every failure lands on /admin/login?sso_error=<key> as a translated toast - dedicated /admin/settings/sso GET/PUT/test endpoints (secret write-only, redacted to a set-flag; registered ABOVE the generic /:type matcher which would shadow them); oidc_client_secret added to the reserved keys stripped from generic settings upserts - public settings expose only oidc_enabled + oidc_button_label for the login page Frontend: - Settings → Single Sign-On (OIDC) tab: issuer/client/secret, scopes, autoprovision + default role, button label, enable toggle, redirect URI copy box, server-side discovery test - login page: SSO button (custom label) when enabled; sso_error query param surfaced as translated toasts; EN+DE i18n Tests: 11 integration cases against an in-process mock IdP (real discovery/JWKS/PKCE/ID-token validation) — JIT on/off, sub-vs-email binding, unverified-email rejection, deactivated admin, missing/forged state cookie, nonce tamper, secret encryption round-trip, disabled 404. MFA is delegated to the IdP on the SSO path; local login stays available as break-glass. Role-claim mapping and logout-to-IdP follow in phase 2/3.
2026-07-16 08:54:26 +02:00
parent f0cdcddb92
commit ed5fc5ad5c
17 changed files with 1507 additions and 18 deletions
@@ -0,0 +1,226 @@
+/**
+ * OIDC SSO integration tests (#798, phase 1).
+ *
+ * Full-stack over a mock in-process IdP (mockOidcProvider): supertest drives
+ * the real /admin/sso/login and /admin/sso/callback routes on a fresh-SQLite
+ * database, openid-client does genuine discovery/JWKS/PKCE/ID-token
+ * validation against the mock issuer. Pins:
+ *
+ *   - happy path: JIT provisioning creates an admin and sets the session cookie
+ *   - JIT off → not_provisioned redirect, no row created
+ *   - repeat login matches by sub, not email (email change ≠ new account)
+ *   - verified-email one-time link onto an existing local admin
+ *   - unverified email must NOT link (falls through to JIT/or error)
+ *   - deactivated admin → inactive redirect
+ *   - missing/forged state cookie → state redirect
+ *   - nonce tamper from the IdP → idp redirect
+ *   - settings endpoints: secret write-only, generic /general upsert cannot
+ *     clobber oidc_client_secret
+ */
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb } = require('./helpers/crmDb');
+const { MockOidcProvider } = require('./helpers/mockOidcProvider');
+
+describe('OIDC SSO (#798)', () => {
+  let db;
+  let cleanup;
+  let app;
+  let idp;
+  let oidcService;
+
+  const agentCookies = {};
+
+  beforeAll(async () => {
+    process.env.JWT_SECRET = process.env.JWT_SECRET || 'oidc-test-secret';
+    ({ db, cleanup } = await bootCrmDb());
+
+    idp = new MockOidcProvider();
+    const issuer = await idp.start();
+
+    // Require AFTER bootCrmDb so services share this db instance.
+    oidcService = require('../../src/services/oidcService');
+    await oidcService.saveOidcSettings({
+      oidc_enabled: true,
+      oidc_issuer_url: issuer,
+      oidc_client_id: idp.clientId,
+      oidc_client_secret: idp.clientSecret,
+      oidc_autoprovision: true,
+      oidc_default_role: 'viewer',
+    });
+
+    const authRouter = require('../../src/routes/auth');
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/auth', authRouter);
+  }, 120000);
+
+  afterAll(async () => {
+    if (idp) await idp.stop();
+    if (cleanup) await cleanup();
+  });
+
+  /** Drive login → IdP → callback like a browser; returns the callback response. */
+  async function ssoRoundTrip({ mutateState } = {}) {
+    const loginRes = await request(app).get('/api/auth/admin/sso/login').expect(302);
+    const idpUrl = loginRes.headers.location;
+    expect(idpUrl.startsWith(idp.issuer)).toBe(true);
+
+    let stateCookie = (loginRes.headers['set-cookie'] || [])
+      .find((c) => c.startsWith('oidc_state='));
+    expect(stateCookie).toBeTruthy();
+    stateCookie = stateCookie.split(';')[0];
+    if (mutateState === 'drop') stateCookie = null;
+    if (mutateState === 'forge') {
+      stateCookie = `oidc_state=${jwt.sign({ type: 'oidc_state', s: 'x', n: 'y', cv: 'z' }, 'wrong-secret', { issuer: 'picpeak-auth' })}`;
+    }
+
+    // "Browser" follows the redirect to the IdP, which instantly bounces back.
+    const idpRes = await fetch(idpUrl, { redirect: 'manual' });
+    expect(idpRes.status).toBe(302);
+    const back = new URL(idpRes.headers.get('location'));
+
+    let cb = request(app).get(`${back.pathname}?${back.searchParams.toString()}`);
+    if (stateCookie) cb = cb.set('Cookie', stateCookie);
+    return cb.expect(302);
+  }
+
+  it('JIT-provisions an unknown user and establishes an admin session', async () => {
+    idp.setNextUser({ sub: 'sub-jit-1', email: '[email protected]', email_verified: true });
+    const res = await ssoRoundTrip();
+
+    expect(res.headers.location).toBe('/admin/dashboard');
+    const adminCookie = (res.headers['set-cookie'] || []).find((c) => c.startsWith('admin_token='));
+    expect(adminCookie).toBeTruthy();
+
+    const row = await db('admin_users').where({ email: '[email protected]' }).first();
+    expect(row).toBeTruthy();
+    expect(row.auth_provider).toBe('oidc');
+    expect(row.external_subject).toBe('sub-jit-1');
+
+    const role = await db('roles').where('id', row.role_id).first();
+    expect(role.name).toBe('viewer');
+
+    // The session JWT must be a normal admin token.
+    const token = adminCookie.split(';')[0].replace('admin_token=', '');
+    const decoded = jwt.verify(decodeURIComponent(token), process.env.JWT_SECRET, { issuer: 'picpeak-auth' });
+    expect(decoded.type).toBe('admin');
+    expect(decoded.id).toBe(row.id);
+    agentCookies.jitAdminId = row.id;
+  });
+
+  it('matches repeat logins by sub even when the email changed at the IdP', async () => {
+    idp.setNextUser({ sub: 'sub-jit-1', email: '[email protected]', email_verified: true });
+    const res = await ssoRoundTrip();
+    expect(res.headers.location).toBe('/admin/dashboard');
+
+    // No second row — resolved via external_subject.
+    expect(await db('admin_users').where({ email: '[email protected]' }).first()).toBeFalsy();
+    const byId = await db('admin_users').where({ id: agentCookies.jitAdminId }).first();
+    expect(byId.external_subject).toBe('sub-jit-1');
+  });
+
+  it('links an existing local admin one-time via VERIFIED email and stamps the sub', async () => {
+    const role = await db('roles').where({ name: 'admin' }).first();
+    const [localId] = await db('admin_users').insert({
+      username: 'local-admin',
+      email: '[email protected]',
+      password_hash: await bcrypt.hash('LocalPass123', 4),
+      role_id: role.id,
+      is_active: 1,
+      auth_provider: 'local',
+      created_at: new Date(),
+      updated_at: new Date(),
+    }).returning('id').then((r) => [r[0]?.id || r[0]]);
+
+    idp.setNextUser({ sub: 'sub-local-1', email: '[email protected]', email_verified: true });
+    const res = await ssoRoundTrip();
+    expect(res.headers.location).toBe('/admin/dashboard');
+
+    const row = await db('admin_users').where({ id: localId }).first();
+    expect(row.external_subject).toBe('sub-local-1');
+    expect(row.auth_provider).toBe('local'); // password keeps working
+  });
+
+  it('does NOT link by unverified email — provisions a separate account instead', async () => {
+    const role = await db('roles').where({ name: 'admin' }).first();
+    await db('admin_users').insert({
+      username: 'victim-admin',
+      email: '[email protected]',
+      password_hash: await bcrypt.hash('VictimPass123', 4),
+      role_id: role.id,
+      is_active: 1,
+      auth_provider: 'local',
+      created_at: new Date(),
+      updated_at: new Date(),
+    });
+
+    idp.setNextUser({ sub: 'sub-attacker', email: '[email protected]', email_verified: false });
+    // JIT would need this email but the victim row owns it (unique) — the
+    // insert fails and the flow must land on an error, never on the
+    // victim's session.
+    const res = await ssoRoundTrip();
+    expect(res.headers.location).toMatch(/sso_error=/);
+
+    const victim = await db('admin_users').where({ email: '[email protected]' }).first();
+    expect(victim.external_subject).toBeNull();
+  });
+
+  it('refuses a deactivated admin with sso_error=inactive', async () => {
+    await db('admin_users').where({ id: agentCookies.jitAdminId }).update({ is_active: 0 });
+    idp.setNextUser({ sub: 'sub-jit-1', email: '[email protected]', email_verified: true });
+    const res = await ssoRoundTrip();
+    expect(res.headers.location).toBe('/admin/login?sso_error=inactive');
+    await db('admin_users').where({ id: agentCookies.jitAdminId }).update({ is_active: 1 });
+  });
+
+  it('rejects a callback without the state cookie', async () => {
+    const res = await ssoRoundTrip({ mutateState: 'drop' });
+    expect(res.headers.location).toBe('/admin/login?sso_error=state');
+  });
+
+  it('rejects a forged state cookie (wrong signing key)', async () => {
+    const res = await ssoRoundTrip({ mutateState: 'forge' });
+    expect(res.headers.location).toBe('/admin/login?sso_error=state');
+  });
+
+  it('rejects an ID token whose nonce does not match', async () => {
+    idp.tamperNonce = true;
+    idp.setNextUser({ sub: 'sub-nonce', email: '[email protected]', email_verified: true });
+    const res = await ssoRoundTrip();
+    idp.tamperNonce = false;
+    expect(res.headers.location).toBe('/admin/login?sso_error=idp');
+    expect(await db('admin_users').where({ email: '[email protected]' }).first()).toBeFalsy();
+  });
+
+  it('blocks JIT with sso_error=not_provisioned when autoprovision is off', async () => {
+    await oidcService.saveOidcSettings({ oidc_autoprovision: false });
+    idp.setNextUser({ sub: 'sub-new-user', email: '[email protected]', email_verified: true });
+    const res = await ssoRoundTrip();
+    expect(res.headers.location).toBe('/admin/login?sso_error=not_provisioned');
+    expect(await db('admin_users').where({ email: '[email protected]' }).first()).toBeFalsy();
+    await oidcService.saveOidcSettings({ oidc_autoprovision: true });
+  });
+
+  it('stores the client secret encrypted and survives a config round-trip', async () => {
+    const row = await db('app_settings').where({ setting_key: 'oidc_client_secret' }).first();
+    const stored = JSON.parse(row.setting_value);
+    expect(stored).not.toContain(idp.clientSecret);
+    expect(oidcService.decryptSecret(stored)).toBe(idp.clientSecret);
+
+    const cfg = await oidcService.getOidcConfig();
+    expect(cfg.clientSecret).toBe(idp.clientSecret);
+  });
+
+  it('returns 404 from /sso/login when SSO is disabled', async () => {
+    await oidcService.saveOidcSettings({ oidc_enabled: false });
+    await request(app).get('/api/auth/admin/sso/login').expect(404);
+    await oidcService.saveOidcSettings({ oidc_enabled: true });
+  });
+});