[grade=B] fix(auth): use host-only session cookies on custom TLDs

Codex: urn:ump:7c22nwh67kot23f6czg5ax7e47hu2r7vowjpz3q6z63o73ti67vq
2026-07-24 05:15:08 -07:00
parent 872923dba2
commit 75f835641f
2 changed files with 77 additions and 21 deletions
@@ -0,0 +1,64 @@
+'use strict';
+
+const configureMiddleware = require('../src/utilities/middleware');
+
+function buildSession() {
+  const app = {
+    param: jest.fn(),
+    set: jest.fn(),
+    use: jest.fn(),
+  };
+
+  return configureMiddleware(app, {
+    siteConfig: { dashboardHost: 'status.sami', tld: '.sami' },
+    totpConfig: { enabled: true, sessionDuration: '24h' },
+    tailscaleConfig: { enabled: false, requireAuth: false },
+    metrics: { recordRequest: jest.fn() },
+    auditLogger: { middleware: () => (_req, _res, next) => next() },
+    authManager: { verifyJWT: jest.fn(), verifyAPIKey: jest.fn() },
+    log: { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() },
+    cryptoUtils: { loadOrCreateKey: () => Buffer.alloc(32, 7) },
+    isValidContainerId: () => true,
+    isTailscaleIP: () => false,
+    getTailscaleStatus: async () => null,
+  });
+}
+
+function captureCookie(setCookie) {
+  const headers = {};
+  setCookie({ setHeader: (name, value) => { headers[name.toLowerCase()] = value; } }, '24h');
+  return headers['set-cookie'];
+}
+
+describe('TOTP session cookie scope', () => {
+  test('primary login cookie is host-only for custom TLD deployments', () => {
+    const session = buildSession();
+    const cookie = captureCookie(session.setSessionCookie);
+
+    expect(cookie).toContain('dashcaddy_session=');
+    expect(cookie).toContain('HttpOnly');
+    expect(cookie).toContain('Secure');
+    expect(cookie).toContain('SameSite=Lax');
+    expect(cookie).not.toMatch(/(?:^|;)\s*Domain=/i);
+  });
+
+  test('SSO exchange uses the same host-only cookie contract', () => {
+    const session = buildSession();
+    const cookie = captureCookie(session.setHostOnlySessionCookie);
+
+    expect(cookie).toContain('dashcaddy_session=');
+    expect(cookie).not.toMatch(/(?:^|;)\s*Domain=/i);
+  });
+
+  test('logout clears the host-only secure cookie', () => {
+    const session = buildSession();
+    const headers = {};
+    session.clearSessionCookie({
+      setHeader: (name, value) => { headers[name.toLowerCase()] = value; },
+    });
+
+    expect(headers['set-cookie']).toContain('Max-Age=0');
+    expect(headers['set-cookie']).toContain('Secure');
+    expect(headers['set-cookie']).not.toMatch(/(?:^|;)\s*Domain=/i);
+  });
+});