Test minimal MFA and existing organization API access

apps/cloud/src/account/org-api-key-revoke.node.test.ts

@@ -168,7 +168,7 @@ const stubAutumn = Layer.succeed(AutumnService)({
  * single org-owned key. Revoked ids land in `revoked` so "no delete happened"
  * is assertable, not merely inferred from the error.
  */
-const providerWith = (accountId: string) => {
+const providerWith = (accountId: string, adminVerified = true) => {
   const revoked: string[] = [];
   const stubApiKeys = Layer.succeed(ApiKeyService)({
     validate: () => Effect.die("revoke test does not validate keys"),
@@ -196,7 +196,7 @@ const providerWith = (accountId: string) => {
             stubDirectory,
             stubApiKeys,
             stubAutumn,
-            Layer.succeed(AccountCaller)({ session: session(accountId) }),
+            Layer.succeed(AccountCaller)({ session: session(accountId), adminVerified }),
           ),
         ),
       ),
@@ -219,6 +219,17 @@ describe("revokeOrgApiKey · provider boundary", () => {
     }),
   );
 
+  it.effect("an admin without MFA cannot revoke an organization key", () =>
+    Effect.gen(function* () {
+      const { provider, revoked } = providerWith(ADMIN, false);
+      const account = yield* provider;
+      expect(yield* Effect.flip(account.revokeOrgApiKey(orgHeaders, ORG_KEY))).toBeInstanceOf(
+        AccountForbidden,
+      );
+      expect(revoked).toEqual([]);
+    }),
+  );
+
   it.effect("a plain member is forbidden, and nothing is revoked", () =>
     Effect.gen(function* () {
       const { provider, revoked } = providerWith(MEMBER);

apps/cloud/src/auth/admin-mfa-proof.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect } from "effect";
+import { SignJWT } from "jose";
+import { readAdminMfaProof, signAdminMfaProof } from "./admin-mfa-proof";
+
+const secret = "a-test-only-cookie-password-of-32-characters";
+const identity = { userId: "user_test", sessionId: "session_test" };
+const now = 1_800_000_000_000;
+const proof = {
+  mode: "challenge" as const,
+  factorId: "factor_test",
+  challengeId: "challenge_test",
+  exp: now / 1000 + 900,
+};
+const signed = signAdminMfaProof(secret, identity, "verified", proof, now);
+
+describe("admin verification cookie", () => {
+  it.effect("accepts a valid proof for the same user and session", () =>
+    Effect.gen(function* () {
+      const token = yield* signed;
+      expect(yield* readAdminMfaProof(secret, identity, "verified", token, now)).toEqual(proof);
+    }),
+  );
+
+  it.effect("refuses missing, modified, and unsigned cookies", () =>
+    Effect.gen(function* () {
+      const token = yield* signed;
+      const parts = token.split(".");
+      const unsigned = `${btoa('{"alg":"none"}')}.${parts[1]}.`;
+      for (const value of [
+        undefined,
+        "",
+        "bad.cookie",
+        `${token.slice(0, 50)}x${token.slice(51)}`,
+        unsigned,
+      ]) {
+        expect(yield* readAdminMfaProof(secret, identity, "verified", value, now)).toBeNull();
+      }
+    }),
+  );
+
+  it.effect("refuses another session, another user, and another signing key", () =>
+    Effect.gen(function* () {
+      const token = yield* signed;
+      for (const other of [
+        { ...identity, userId: "other" },
+        { ...identity, sessionId: "other" },
+      ]) {
+        expect(yield* readAdminMfaProof(secret, other, "verified", token, now)).toBeNull();
+      }
+      expect(
+        yield* readAdminMfaProof(`${secret}-rotated`, identity, "verified", token, now),
+      ).toBeNull();
+    }),
+  );
+
+  it.effect("cannot promote an unfinished challenge to verified access", () =>
+    Effect.gen(function* () {
+      const token = yield* signAdminMfaProof(
+        secret,
+        identity,
+        "challenge",
+        { ...proof, mode: "enroll", exp: now / 1000 + 300 },
+        now,
+      );
+      expect(yield* readAdminMfaProof(secret, identity, "verified", token, now)).toBeNull();
+      expect(
+        yield* readAdminMfaProof(secret, identity, "challenge", token, now + 299_000),
+      ).not.toBeNull();
+      expect(
+        yield* readAdminMfaProof(secret, identity, "challenge", token, now + 300_000),
+      ).toBeNull();
+    }),
+  );
+
+  it.effect("expires at fifteen minutes and refuses a future-issued cookie", () =>
+    Effect.gen(function* () {
+      const token = yield* signed;
+      expect(
+        yield* readAdminMfaProof(secret, identity, "verified", token, now + 899_000),
+      ).not.toBeNull();
+      expect(
+        yield* readAdminMfaProof(secret, identity, "verified", token, now + 900_000),
+      ).toBeNull();
+      expect(
+        yield* readAdminMfaProof(secret, identity, "verified", token, now - 10_000),
+      ).toBeNull();
+    }),
+  );
+
+  it.effect("caps token age even when the supplied expiration is longer", () =>
+    Effect.gen(function* () {
+      const token = yield* signAdminMfaProof(
+        secret,
+        identity,
+        "verified",
+        { ...proof, exp: now / 1000 + 86400 },
+        now,
+      );
+      expect(yield* readAdminMfaProof(secret, identity, "verified", token, now)).toBeNull();
+      expect(
+        yield* readAdminMfaProof(secret, identity, "verified", token, now + 901_000),
+      ).toBeNull();
+    }),
+  );
+
+  it.effect("rejects a signed cookie with missing issued-at or another algorithm", () =>
+    Effect.gen(function* () {
+      for (const algorithm of ["HS256", "HS384"]) {
+        const jwt = new SignJWT({ ...proof })
+          .setProtectedHeader({ alg: algorithm })
+          .setIssuer("executor:admin-mfa:verified")
+          .setSubject(identity.userId)
+          .setAudience(identity.sessionId);
+        // HS256 lacks iat; HS384 is otherwise valid but outside the allowlist.
+        if (algorithm === "HS384") jwt.setIssuedAt(now / 1000);
+        const token = yield* Effect.promise(() => jwt.sign(new TextEncoder().encode(secret)));
+        expect(yield* readAdminMfaProof(secret, identity, "verified", token, now)).toBeNull();
+      }
+    }),
+  );
+});