fix(security): audit remediation 2026-09-01: api_keys identity, viewer gates, OAuth binding, XSS, MFA gate (#2155)

* fix(security): bind api_keys to the caller, lock hash-as-bearer RPCs and provider token tables Security audit 2026-09-01, critical items. - api_keys INSERT requires user_id = auth.uid() again (an admin could forge a key for any co-member and act as them in every company they belong to); SELECT is own-keys-or-admin; a BEFORE trigger freezes the identity and credential columns against user-session UPDATEs. - rotate_mcp_refresh_token and validate_and_increment_api_key become service_role only: they match rows by a presented SHA-256, so a hash readable by co-members was a bearer credential. - validate_and_increment_api_key fails closed when the key's user is no longer a member of the key's company. - provider_consent_tokens and provider_otc: the DELETE policies collapsed to "caller has any team row" (correlated subquery on a non-existent team_members.company_id). All member policies dropped; service_role only, matching every existing code path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): role gates, ownership guards and posting integrity in the database Security audit 2026-09-01, high items at the database layer. - One table-level guard, enforce_company_writer_role(), blocks the read-only viewer role on 55 company-scoped tables including through the 15 membership-only SECURITY DEFINER writers. Keyed on the JWT role claim so it fires inside definer bodies; no-op for service_role and trigger cascades. - company_members user_id/company_id immutable from user sessions; invitations can never grant owner; team_members gains a transition guard (admins keep non-owner role moves); companies team_id and archiving are owner-only and team attachment needs team membership. - Direct statements (current_user = authenticated) can no longer insert posted headers, add lines under posted verifikat, or post a draft with a voucher number the sequence never issued. Sanctioned RPCs run as the definer and are untouched; the engine's own draft-then-post shapes still pass. - create_document_version refuses viewers and foreign storage paths; validate_version_chain needs membership and loses anon EXECUTE; match_documents / match_booking_templates lose anon; cron maintenance RPCs become service_role only; the production-only seed_asset_categories is dropped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * build: pin tsx as an exact devDependency instead of fetching it with npx at build time prebuild ran "npx tsx" with no lockfile entry, so every Vercel, Docker and CI build downloaded tsx@latest and its transitive tree from the registry with no integrity check, inside the build environment. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): refuse the viewer role on API-key and MCP write paths The v1 wrapper and the MCP company routing checked company membership but never role, and both run as service role, so a read-only viewer holding an API key could post vouchers and change settings through the API. Mutating methods and non-read scopes now return 403 ROLE_READ_ONLY for viewers on v1; MCP write tools refuse viewers the same way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): stop serving uploaded SVG, XML and HTML as executable content on the app origin Uploads persisted the browser-declared mime type and the inline proxy served it verbatim, sandboxing only text/html; the storage proxy forwarded the uploader's Content-Type. Any writer, or any Peppol sender, could plant a scripted SVG or XHTML that executed on app.gnubok.se. - inline route: allow-list of natively safe types (PDF, raster images) served as before; everything else gets the opaque sandbox CSP. - storage proxy: octet-stream + attachment + sandbox unless the DB mime for the key is on the allow-list. - document-service: the stored mime is the magic-byte validated type. - logo upload: magic-byte validation, SVG refused. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): byrå brand logo upload decides the type by magic bytes and drops SVG Same pattern as the company logo route: the logos bucket is public, so a scripted SVG (or anything declared as an image) must never land there. The upload pickers stop advertising SVG. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind Enable Banking, Stripe and WooCommerce callbacks to the initiating user The callbacks resolved the pending row by oauth_state alone, so a victim who completed an attacker-initiated consent had their bank account, merchant account or store attached to the attacker's company. requireFlowInitiator() now requires the cookie session of the user who started the flow: no session redirects to login with the callback URL preserved, a different user is refused and nothing is exchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): guard tenant-controlled outbound fetches and surface the disabled rate limiter WooCommerce and Shopify syncs fetched a member-editable store URL with plain fetch() and redirect following under the service role, and the invoice PDF renderer fetched company_settings.logo_url unguarded. All three go through a new safeFetch() (public-IP validation via url-guard, https only, redirect: 'manual', body size cap) and re-normalise the stored host at use time. checkRateLimit() keeps failing open on hosted but logs one error per process when Upstash is not configured and exports isRateLimiterConfigured(). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): decide the API MFA gate from server-authenticated factors, not the session cookie getAuthenticatorAssuranceLevel() without arguments derives nextLevel from session.user.factors, which comes from the unsigned sb-*-auth-token cookie. Deleting factors from the cookie made an enrolled account look like it had nothing to step up to, on every /api route and in requireAuth. Both gates now read factors from the getUser() result or listFactors() and the level from the verified JWT claim, and fail closed on errors. Page-branch gate hardened the same way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind Fortnox/Visma, Gmail and Skatteverket callbacks to the initiating user The arcim-migration callback exchanged the provider code onto whatever consent the one-time state named, with no check of who completed the flow and no org-number comparison, so a phished Fortnox admin handed their ledger to the attacker's company. provider_otc now records the initiating user (migration 20260902100000); the callback requires that session and, after the exchange, refuses a provider company whose org number differs from the consent's company. The Gmail and Skatteverket callbacks enforce the same initiator check. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): BankID signup confirms the email before linking the identity Signup created an email-confirmed, MFA-exempt account for any address the caller typed and returned a magic link, so an attacker could pre-register a victim's email and keep a permanent BankID login into the account the victim later adopted. The user is now created unconfirmed, the identity carries email_verified_at NULL (migration 20260902101000), bankid_linked is not set until the mailed confirmation is clicked, and BankID login of a pending identity is refused with the confirmation re-sent. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind MCP OAuth redirect URIs to the consenting user and cap scopes A user-registered redirect URI was allowlisted globally, the consent page named no client, and all scopes were pre-checked, so one phishing link handed an attacker a full-scope key for the victim's company. Registered URIs now resolve only for the registrant or a colleague sharing a company; the consent page shows the client identity and redirect host; non-built-in clients default to read-only pre-checks; scopes are capped by the user's role (viewer: read only) at consent and at /token. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(auth): client follow-ups for BankID confirmation, callback mismatch copy and decision log - register client handles the new confirmation_sent response from BankID signup with the existing inbox screen instead of calling verifyOtp. - BankID login surfaces the email_unconfirmed explanation. - WooCommerce settings map woocommerce_error=wrong_user to its own copy. - Logo help text no longer advertises SVG. - DECISIONS.md records the audit remediation choices. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(mcp-oauth): literal SoD columns in the api_keys insert so the phantom-column scanner resolves them Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(logo): type the upload fixtures as Uint8Array<ArrayBuffer> so they are valid BlobParts Fixes the typecheck ratchet on PR #2155 and ratchets the baseline down by the one legacy error the change removed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 11:38:30 +02:00
parent 6e8d76a9cb
commit 18cbc4c30a
92 changed files with 10355 additions and 657 deletions
@@ -1,5 +1,13 @@
-import { describe, it, expect, vi } from 'vitest'
-import { isBuiltInRedirectUri, isAllowedRedirectUri } from '../oauth-allowlist'
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import {
+  builtInRedirectProvider,
+  capScopesForRole,
+  isAllowedRedirectUri,
+  isBuiltInRedirectUri,
+  lookupCompanyRole,
+  resolveRedirectUri,
+} from '../oauth-allowlist'
+import { ALL_SCOPES, type ApiKeyScope } from '../scope-catalog'
 import type { SupabaseClient } from '@supabase/supabase-js'

 describe('isBuiltInRedirectUri', () => {
@@ -23,45 +31,244 @@ describe('isBuiltInRedirectUri', () => {
  })
 })

-function makeFakeSupabase(rows: Array<{ id: string }>): SupabaseClient {
-  // Chainable thenable that resolves to { data, error } when awaited via
-  // .maybeSingle(). Matches the shape isAllowedRedirectUri actually invokes.
-  const chain = {
-    from() { return chain },
-    select() { return chain },
-    eq() { return chain },
-    is() { return chain },
-    limit() { return chain },
-    async maybeSingle() {
-      return { data: rows[0] ?? null, error: null }
-    },
-  }
-  return chain as unknown as SupabaseClient
+describe('builtInRedirectProvider', () => {
+  it.each([
+    ['https://claude.ai/api/oauth/callback', 'claude'],
+    ['https://claude.com/api/oauth/callback', 'claude'],
+    ['https://chatgpt.com/connector/oauth/abc123', 'chatgpt'],
+    ['https://chatgpt.com/connector_platform_oauth_redirect', 'chatgpt'],
+    ['http://localhost:3000/cb', 'local'],
+    ['http://127.0.0.1:8080/cb', 'local'],
+    ['https://claude-login.example/cb', null],
+    ['', null],
+  ])('maps %s to %s', (uri, expected) => {
+    expect(builtInRedirectProvider(uri)).toBe(expected)
+  })
+})
+
+type Row = Record<string, unknown>
+
+/**
+ * Minimal PostgREST-shaped fake over in-memory tables: eq/is filters are
+ * applied, everything else is a no-op, and the chain resolves to the filtered
+ * rows (all rows when awaited, first row via maybeSingle). `failTable` makes
+ * every query against that table return a DB error.
+ */
+function fakeClient(tables: Record<string, Row[]>, failTable?: string) {
+  const from = vi.fn((table: string) => {
+    const filters: [string, unknown][] = []
+    const run = () =>
+      (tables[table] ?? []).filter((row) =>
+        filters.every(([col, val]) => (val === null ? row[col] == null : row[col] === val)),
+      )
+    const result = () =>
+      table === failTable
+        ? { data: null, error: { message: 'db down' } }
+        : { data: run(), error: null }
+    const chain: Record<string, unknown> = {}
+    for (const method of ['select', 'order', 'range', 'limit']) chain[method] = () => chain
+    chain.eq = (col: string, val: unknown) => {
+      filters.push([col, val])
+      return chain
+    }
+    chain.is = (col: string, val: unknown) => {
+      filters.push([col, val])
+      return chain
+    }
+    chain.maybeSingle = async () => {
+      const r = result()
+      return { data: Array.isArray(r.data) ? (r.data[0] ?? null) : null, error: r.error }
+    }
+    chain.then = (resolve: (v: unknown) => void) => resolve(result())
+    return chain
+  })
+  return { from } as unknown as SupabaseClient & { from: ReturnType<typeof vi.fn> }
 }

-describe('isAllowedRedirectUri', () => {
-  it('short-circuits to true for built-in patterns without touching the DB', async () => {
+const REGISTRATIONS: Row[] = [
+  { id: 'reg-1', user_id: 'user-2', client_name: 'Byråns bot', redirect_uri: 'https://app.example.com/cb', revoked_at: null },
+  { id: 'reg-2', user_id: 'user-9', client_name: 'Evil', redirect_uri: 'https://evil.example/cb', revoked_at: null },
+  { id: 'reg-3', user_id: 'user-1', client_name: 'Min egen app', redirect_uri: 'https://mine.example/cb', revoked_at: null },
+  { id: 'reg-4', user_id: 'user-1', client_name: 'Gammal app', redirect_uri: 'https://old.example/cb', revoked_at: '2026-01-01T00:00:00Z' },
+]
+
+const MEMBERSHIPS: Row[] = [
+  { id: 'm1', user_id: 'user-1', company_id: 'company-1', role: 'owner' },
+  { id: 'm2', user_id: 'user-2', company_id: 'company-1', role: 'member' },
+  { id: 'm3', user_id: 'user-2', company_id: 'company-2', role: 'owner' },
+  { id: 'm4', user_id: 'user-9', company_id: 'company-9', role: 'owner' },
+]
+
+const DB = { oauth_client_registrations: REGISTRATIONS, company_members: MEMBERSHIPS }
+
+describe('resolveRedirectUri', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('short-circuits to the built-in provider without touching the DB', async () => {
    const sb = {
      from: vi.fn(() => {
        throw new Error('should not be called')
      }),
    } as unknown as SupabaseClient
-    expect(await isAllowedRedirectUri('https://claude.ai/api/cb', sb)).toBe(true)
-    expect(await isAllowedRedirectUri('http://localhost:3000/cb', sb)).toBe(true)
+    expect(await resolveRedirectUri('https://claude.ai/api/cb', sb, { consentingUserId: 'user-1' })).toEqual({
+      allowed: true,
+      kind: 'built_in',
+      provider: 'claude',
+    })
+    expect(await resolveRedirectUri('http://localhost:3000/cb', sb)).toEqual({
+      allowed: true,
+      kind: 'built_in',
+      provider: 'local',
+    })
  })

-  it('returns true when the DB has a registration for the URI', async () => {
-    const sb = makeFakeSupabase([{ id: 'reg-1' }])
-    expect(await isAllowedRedirectUri('https://myapp.example.com/cb', sb)).toBe(true)
+  it("accepts the consenting user's own registration", async () => {
+    const result = await resolveRedirectUri('https://mine.example/cb', fakeClient(DB), {
+      consentingUserId: 'user-1',
+    })
+    expect(result).toEqual({
+      allowed: true,
+      kind: 'registered',
+      clientName: 'Min egen app',
+      registeredByConsentingUser: true,
+    })
  })

-  it('returns false when no registration exists', async () => {
-    const sb = makeFakeSupabase([])
-    expect(await isAllowedRedirectUri('https://evil.com/cb', sb)).toBe(false)
+  it('accepts a registration by a colleague who shares a company', async () => {
+    const result = await resolveRedirectUri('https://app.example.com/cb', fakeClient(DB), {
+      consentingUserId: 'user-1',
+    })
+    expect(result).toEqual({
+      allowed: true,
+      kind: 'registered',
+      clientName: 'Byråns bot',
+      registeredByConsentingUser: false,
+    })
  })

-  it('returns false for empty / non-string inputs', async () => {
-    expect(await isAllowedRedirectUri('')).toBe(false)
-    expect(await isAllowedRedirectUri(undefined as unknown as string)).toBe(false)
+  it('rejects a registration by an unrelated user', async () => {
+    // user-9 is a real member of the instance, just not of any company user-1
+    // belongs to: their registration must not be a valid target for user-1.
+    const result = await resolveRedirectUri('https://evil.example/cb', fakeClient(DB), {
+      consentingUserId: 'user-1',
+    })
+    expect(result).toEqual({ allowed: false })
+  })
+
+  it('accepts any active registration when no consenting user is given (anonymous /register)', async () => {
+    const result = await resolveRedirectUri('https://evil.example/cb', fakeClient(DB))
+    expect(result).toEqual({
+      allowed: true,
+      kind: 'registered',
+      clientName: 'Evil',
+      registeredByConsentingUser: false,
+    })
+  })
+
+  it('rejects a revoked registration, even the user’s own', async () => {
+    const result = await resolveRedirectUri('https://old.example/cb', fakeClient(DB), {
+      consentingUserId: 'user-1',
+    })
+    expect(result).toEqual({ allowed: false })
+  })
+
+  it('rejects an unknown URI', async () => {
+    expect(await resolveRedirectUri('https://nowhere.example/cb', fakeClient(DB))).toEqual({ allowed: false })
+  })
+
+  it('fails closed when the registration lookup errors', async () => {
+    const result = await resolveRedirectUri(
+      'https://mine.example/cb',
+      fakeClient(DB, 'oauth_client_registrations'),
+      { consentingUserId: 'user-1' },
+    )
+    expect(result).toEqual({ allowed: false })
+  })
+
+  it('fails closed when the shared-company check errors', async () => {
+    const result = await resolveRedirectUri('https://app.example.com/cb', fakeClient(DB, 'company_members'), {
+      consentingUserId: 'user-1',
+    })
+    expect(result).toEqual({ allowed: false })
+  })
+
+  it('fails closed when no client is given and none can be constructed', async () => {
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '')
+    vi.stubEnv('SUPABASE_SERVICE_ROLE_KEY', '')
+    expect(await resolveRedirectUri('https://mine.example/cb', undefined, { consentingUserId: 'user-1' })).toEqual({
+      allowed: false,
+    })
+  })
+
+  it('returns not allowed for empty / non-string inputs', async () => {
+    expect(await resolveRedirectUri('')).toEqual({ allowed: false })
+    expect(await resolveRedirectUri(undefined as unknown as string)).toEqual({ allowed: false })
+  })
+})
+
+describe('isAllowedRedirectUri', () => {
+  it('is the boolean view of resolveRedirectUri', async () => {
+    expect(await isAllowedRedirectUri('https://claude.ai/api/cb')).toBe(true)
+    expect(await isAllowedRedirectUri('https://mine.example/cb', fakeClient(DB), { consentingUserId: 'user-1' })).toBe(true)
+    expect(await isAllowedRedirectUri('https://evil.example/cb', fakeClient(DB), { consentingUserId: 'user-1' })).toBe(false)
+    expect(await isAllowedRedirectUri('https://evil.example/cb', fakeClient(DB))).toBe(true)
+    expect(await isAllowedRedirectUri('', fakeClient(DB))).toBe(false)
+  })
+})
+
+describe('capScopesForRole', () => {
+  const mixed: ApiKeyScope[] = [
+    'transactions:read',
+    'transactions:write',
+    'pending_operations:approve',
+    'webhooks:manage',
+    'reconciliation:signoff',
+    'reports:read',
+  ]
+
+  it('keeps every scope for owner, admin and member', () => {
+    for (const role of ['owner', 'admin', 'member']) {
+      expect(capScopesForRole(mixed, role)).toEqual(mixed)
+    }
+  })
+
+  it('caps a viewer to :read scopes only', () => {
+    expect(capScopesForRole(mixed, 'viewer')).toEqual(['transactions:read', 'reports:read'])
+  })
+
+  it('caps an unknown role and a missing membership to :read scopes', () => {
+    expect(capScopesForRole(mixed, 'superuser')).toEqual(['transactions:read', 'reports:read'])
+    expect(capScopesForRole(mixed, null)).toEqual(['transactions:read', 'reports:read'])
+  })
+
+  it('leaves no write-kind scope in a capped set for the full catalogue', () => {
+    const capped = capScopesForRole(ALL_SCOPES, 'viewer')
+    expect(capped.length).toBeGreaterThan(0)
+    expect(capped.every((s) => s.endsWith(':read'))).toBe(true)
+    expect(capped).not.toContain('pending_operations:approve')
+  })
+
+  it('returns a copy, never the caller’s array', () => {
+    const result = capScopesForRole(mixed, 'owner')
+    expect(result).not.toBe(mixed)
+  })
+})
+
+describe('lookupCompanyRole', () => {
+  it('returns the role for an existing membership', async () => {
+    expect(await lookupCompanyRole(fakeClient(DB), 'user-2', 'company-1')).toEqual({ role: 'member', error: null })
+    expect(await lookupCompanyRole(fakeClient(DB), 'user-2', 'company-2')).toEqual({ role: 'owner', error: null })
+  })
+
+  it('returns a null role when no membership row exists', async () => {
+    expect(await lookupCompanyRole(fakeClient(DB), 'user-9', 'company-1')).toEqual({ role: null, error: null })
+  })
+
+  it('surfaces a query error instead of guessing', async () => {
+    const result = await lookupCompanyRole(fakeClient(DB, 'company_members'), 'user-1', 'company-1')
+    expect(result.role).toBeNull()
+    expect(result.error).toBe('db down')
  })
 })
@@ -0,0 +1,148 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+vi.mock('@/lib/supabase/server', () => ({
+  createClient: vi.fn(),
+}))
+
+import { createClient } from '@/lib/supabase/server'
+import {
+  requireFlowInitiator,
+  buildLoginRedirect,
+  redactUserId,
+  FLOW_INITIATOR_MISMATCH_MESSAGE,
+} from '../oauth-flow-binding'
+
+const CALLBACK_URL =
+  'https://app.example.se/api/extensions/stripe/callback?code=ac_123&state=state-1'
+
+function mockSession(getUser: ReturnType<typeof vi.fn>) {
+  vi.mocked(createClient).mockResolvedValue({ auth: { getUser } } as never)
+  return getUser
+}
+
+function sessionWith(userId: string | null, error: unknown = null) {
+  return mockSession(
+    vi.fn().mockResolvedValue({
+      data: { user: userId ? { id: userId } : null },
+      error,
+    }),
+  )
+}
+
+describe('requireFlowInitiator', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubEnv('NEXT_PUBLIC_APP_URL', 'https://app.example.se')
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('passes when the cookie session belongs to the initiator', async () => {
+    const getUser = sessionWith('user-1')
+
+    const result = await requireFlowInitiator(new Request(CALLBACK_URL), 'user-1')
+
+    expect(result).toEqual({ ok: true, userId: 'user-1' })
+    expect(getUser).toHaveBeenCalledTimes(1)
+  })
+
+  it('refuses with a 403 envelope when a different user completes the flow', async () => {
+    sessionWith('user-2')
+
+    const result = await requireFlowInitiator(new Request(CALLBACK_URL), 'user-1', {
+      flow: 'stripe.callback',
+    })
+
+    expect(result.ok).toBe(false)
+    if (result.ok) throw new Error('unreachable')
+    expect(result.reason).toBe('mismatch')
+    if (result.reason !== 'mismatch') throw new Error('unreachable')
+    expect(result.sessionUserId).toBe('user-2')
+    expect(result.response.status).toBe(403)
+    const body = await result.response.json()
+    expect(body.error.code).toBe('OAUTH_FLOW_INITIATOR_MISMATCH')
+    expect(body.error.message).toBe(FLOW_INITIATOR_MISMATCH_MESSAGE)
+    expect(typeof body.error.message_en).toBe('string')
+  })
+
+  it('sends an anonymous browser to /login with the callback URL as next', async () => {
+    sessionWith(null)
+
+    const result = await requireFlowInitiator(new Request(CALLBACK_URL), 'user-1')
+
+    expect(result.ok).toBe(false)
+    if (result.ok) throw new Error('unreachable')
+    expect(result.reason).toBe('no_session')
+    expect(result.response.status).toBe(307)
+    const location = new URL(result.response.headers.get('location') ?? '')
+    expect(location.origin).toBe('https://app.example.se')
+    expect(location.pathname).toBe('/login')
+    // Same-origin relative path + query, the only shape the login page's
+    // safeReturnTo accepts, so signing in resumes the very same callback.
+    expect(location.searchParams.get('next')).toBe(
+      '/api/extensions/stripe/callback?code=ac_123&state=state-1',
+    )
+  })
+
+  it('treats a getUser error as no session (fail closed)', async () => {
+    sessionWith(null, { message: 'invalid JWT' })
+
+    const result = await requireFlowInitiator(new Request(CALLBACK_URL), 'user-1')
+
+    expect(result.ok).toBe(false)
+    if (result.ok) throw new Error('unreachable')
+    expect(result.reason).toBe('no_session')
+  })
+
+  it('treats a thrown client error as no session instead of finalizing on a guess', async () => {
+    vi.mocked(createClient).mockRejectedValue(new Error('cookies() outside request scope'))
+
+    const result = await requireFlowInitiator(new Request(CALLBACK_URL), 'user-1')
+
+    expect(result.ok).toBe(false)
+    if (result.ok) throw new Error('unreachable')
+    expect(result.reason).toBe('no_session')
+    expect(result.response.headers.get('location')).toContain('/login?next=')
+  })
+
+  it('never passes on an empty expected id even when someone is signed in', async () => {
+    sessionWith('user-2')
+
+    const result = await requireFlowInitiator(new Request(CALLBACK_URL), '')
+
+    expect(result.ok).toBe(false)
+  })
+})
+
+describe('buildLoginRedirect', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('falls back to the request origin when NEXT_PUBLIC_APP_URL is unset', () => {
+    vi.stubEnv('NEXT_PUBLIC_APP_URL', '')
+
+    const response = buildLoginRedirect(
+      new Request('http://localhost:3000/api/extensions/woocommerce/return?success=1&user_id=abc'),
+    )
+
+    expect(response.headers.get('location')).toBe(
+      'http://localhost:3000/login?next=' +
+        encodeURIComponent('/api/extensions/woocommerce/return?success=1&user_id=abc'),
+    )
+  })
+})
+
+describe('redactUserId', () => {
+  it('keeps only a correlation prefix of a uuid', () => {
+    expect(redactUserId('123e4567-e89b-12d3-a456-426614174000')).toBe('123e4567...')
+  })
+
+  it('handles short and missing ids', () => {
+    expect(redactUserId('user-1')).toBe('user-1')
+    expect(redactUserId(null)).toBe('(none)')
+    expect(redactUserId(undefined)).toBe('(none)')
+  })
+})
@@ -0,0 +1,155 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  logError: vi.fn(),
+  logWarn: vi.fn(),
+  logInfo: vi.fn(),
+  redisCtor: vi.fn(),
+  ratelimitCtor: vi.fn(),
+  limit: vi.fn(),
+}))
+
+vi.mock('@/lib/logger', () => ({
+  createLogger: () => ({
+    error: mocks.logError,
+    warn: mocks.logWarn,
+    info: mocks.logInfo,
+    child: () => ({ error: mocks.logError, warn: mocks.logWarn, info: mocks.logInfo }),
+  }),
+}))
+
+vi.mock('@upstash/redis', () => ({
+  Redis: class Redis {
+    constructor(cfg: unknown) {
+      mocks.redisCtor(cfg)
+    }
+  },
+}))
+
+vi.mock('@upstash/ratelimit', () => ({
+  Ratelimit: class Ratelimit {
+    static slidingWindow = vi.fn((max: number, window: string) => ({ max, window }))
+    limit = mocks.limit
+    constructor(cfg: unknown) {
+      mocks.ratelimitCtor(cfg)
+    }
+  },
+}))
+
+// The "report once per process" flag is module state, so every test gets a
+// fresh module instance instead of a test-only reset export.
+async function loadModule() {
+  vi.resetModules()
+  return import('@/lib/auth/rate-limit-http')
+}
+
+const OPTS = { prefix: 'test', identifier: 'ip:1', maxRequests: 5, windowMs: 60_000 }
+
+describe('checkRateLimit', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', '')
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', '')
+    vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', '')
+    vi.stubEnv('NODE_ENV', 'production')
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  describe('Redis not configured', () => {
+    it('fails open on a hosted production deployment but logs one error with the alert flag', async () => {
+      const { checkRateLimit } = await loadModule()
+
+      expect(await checkRateLimit(OPTS)).toEqual({ ok: true })
+      expect(await checkRateLimit({ ...OPTS, identifier: 'ip:2' })).toEqual({ ok: true })
+      expect(await checkRateLimit({ ...OPTS, prefix: 'other' })).toEqual({ ok: true })
+
+      expect(mocks.logError).toHaveBeenCalledTimes(1)
+      const [message, ctx] = mocks.logError.mock.calls[0]
+      expect(message).toMatch(/UPSTASH_REDIS_REST_URL/)
+      expect(message).toMatch(/failing open/)
+      expect(ctx).toMatchObject({ alert: true })
+      expect(mocks.redisCtor).not.toHaveBeenCalled()
+    })
+
+    it('stays quiet on a self-hosted deployment (Redis is optional there)', async () => {
+      vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'true')
+      const { checkRateLimit } = await loadModule()
+
+      expect(await checkRateLimit(OPTS)).toEqual({ ok: true })
+      expect(mocks.logError).not.toHaveBeenCalled()
+    })
+
+    it('stays quiet outside production (local dev and tests are not deployments)', async () => {
+      vi.stubEnv('NODE_ENV', 'development')
+      const { checkRateLimit } = await loadModule()
+
+      expect(await checkRateLimit(OPTS)).toEqual({ ok: true })
+      expect(mocks.logError).not.toHaveBeenCalled()
+    })
+
+    it('reports the limiter as not configured', async () => {
+      const { isRateLimiterConfigured } = await loadModule()
+      expect(isRateLimiterConfigured()).toBe(false)
+
+      vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.example')
+      expect(isRateLimiterConfigured()).toBe(false)
+
+      vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'tok')
+      expect(isRateLimiterConfigured()).toBe(true)
+    })
+  })
+
+  describe('Redis configured', () => {
+    beforeEach(() => {
+      vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.example')
+      vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'tok')
+    })
+
+    it('allows the request when the sliding window has room and logs nothing', async () => {
+      mocks.limit.mockResolvedValue({ success: true, reset: Date.now() + 1000, limit: 5, remaining: 4 })
+      const { checkRateLimit } = await loadModule()
+
+      expect(await checkRateLimit(OPTS)).toEqual({ ok: true })
+      expect(mocks.limit).toHaveBeenCalledWith('ip:1')
+      expect(mocks.redisCtor).toHaveBeenCalledWith({ url: 'https://redis.example', token: 'tok' })
+      expect(mocks.ratelimitCtor).toHaveBeenCalledWith(
+        expect.objectContaining({ prefix: 'test', analytics: false }),
+      )
+      expect(mocks.logError).not.toHaveBeenCalled()
+    })
+
+    it('returns a Swedish 429 with Retry-After and X-RateLimit headers when blocked', async () => {
+      const reset = Date.now() + 30_000
+      mocks.limit.mockResolvedValue({ success: false, reset, limit: 5, remaining: 0 })
+      const { checkRateLimit } = await loadModule()
+
+      const result = await checkRateLimit(OPTS)
+      expect(result.ok).toBe(false)
+      expect(result.response?.status).toBe(429)
+      expect(await result.response?.json()).toEqual({
+        error: 'För många förfrågningar. Försök igen om en stund.',
+      })
+      const retryAfter = Number(result.response?.headers.get('Retry-After'))
+      expect(retryAfter).toBeGreaterThanOrEqual(29)
+      expect(retryAfter).toBeLessThanOrEqual(31)
+      expect(result.response?.headers.get('X-RateLimit-Limit')).toBe('5')
+      expect(result.response?.headers.get('X-RateLimit-Remaining')).toBe('0')
+      expect(result.response?.headers.get('X-RateLimit-Reset')).toBe(String(Math.ceil(reset / 1000)))
+    })
+
+    it('reuses one limiter per prefix/limit/window triple', async () => {
+      mocks.limit.mockResolvedValue({ success: true, reset: 0, limit: 5, remaining: 4 })
+      const { checkRateLimit } = await loadModule()
+
+      await checkRateLimit(OPTS)
+      await checkRateLimit({ ...OPTS, identifier: 'ip:9' })
+      await checkRateLimit({ ...OPTS, maxRequests: 50 })
+
+      expect(mocks.ratelimitCtor).toHaveBeenCalledTimes(2)
+      expect(mocks.redisCtor).toHaveBeenCalledTimes(1)
+    })
+  })
+})
@@ -31,6 +31,22 @@ const MOCK_USER = {
  created_at: '2026-01-01T00:00:00Z',
 }

+const VERIFIED_TOTP = { id: 'f1', status: 'verified', factor_type: 'totp' }
+const UNVERIFIED_TOTP = { id: 'f2', status: 'unverified', factor_type: 'totp' }
+
+/** listFactors() payload: `all` carries everything, the typed arrays only verified ones. */
+function factorList(...factors: Array<typeof VERIFIED_TOTP>) {
+  return {
+    data: {
+      all: factors,
+      totp: factors.filter((f) => f.status === 'verified'),
+      phone: [],
+      webauthn: [],
+    },
+    error: null,
+  }
+}
+
 type MockAuth = Record<string, unknown>

 function useSupabase(auth: MockAuth) {
@@ -39,6 +55,11 @@ function useSupabase(auth: MockAuth) {
  return supabase
 }

+function enableMfa() {
+  vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
+  vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', '')
+}
+
 describe('requireAuth', () => {
  beforeEach(() => {
    vi.clearAllMocks()
@@ -142,53 +163,179 @@ describe('requireAuth', () => {
    expect(getUser).not.toHaveBeenCalled()
  })

-  it('returns 403 when MFA is required and AAL2 is not verified', async () => {
-    vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
-    vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', '')
-    const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
-    const getAuthenticatorAssuranceLevel = vi.fn().mockResolvedValue({
-      data: { currentLevel: 'aal1', nextLevel: 'aal2' },
-      error: null,
+  describe('MFA gate', () => {
+    beforeEach(() => {
+      enableMfa()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
    })
-    useSupabase({ getClaims, mfa: { getAuthenticatorAssuranceLevel } })

-    const result = await requireAuth()
-
-    expect(result.user).toBeNull()
-    expect(result.error?.status).toBe(403)
-    const body = await result.error?.json()
-    expect(body).toEqual({ error: 'MFA verification required' })
-  })
-
-  it('skips the MFA check for bankid_linked users', async () => {
-    vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
-    vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', '')
-    const claims = { ...CLAIMS, app_metadata: { provider: 'email', bankid_linked: true } }
-    const getClaims = vi.fn().mockResolvedValue({ data: { claims }, error: null })
-    const getAuthenticatorAssuranceLevel = vi.fn()
-    useSupabase({ getClaims, mfa: { getAuthenticatorAssuranceLevel } })
-
-    const result = await requireAuth()
-
-    expect(result.error).toBeNull()
-    expect(result.user?.id).toBe('user-1')
-    expect(getAuthenticatorAssuranceLevel).not.toHaveBeenCalled()
-  })
-
-  it('passes when MFA is required and the session is already AAL2', async () => {
-    vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
-    vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', '')
-    const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
-    const getAuthenticatorAssuranceLevel = vi.fn().mockResolvedValue({
-      data: { currentLevel: 'aal2', nextLevel: 'aal2' },
-      error: null,
+    afterEach(() => {
+      vi.restoreAllMocks()
    })
-    useSupabase({ getClaims, mfa: { getAuthenticatorAssuranceLevel } })

-    const result = await requireAuth()
+    it('returns 403 for an AAL1 session when the auth server reports a verified factor', async () => {
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
+      const listFactors = vi.fn().mockResolvedValue(factorList(VERIFIED_TOTP))
+      useSupabase({ getClaims, mfa: { listFactors } })

-    expect(result.error).toBeNull()
-    expect(result.user?.id).toBe('user-1')
-    expect(getAuthenticatorAssuranceLevel).toHaveBeenCalledTimes(1)
+      const result = await requireAuth()
+
+      expect(result.user).toBeNull()
+      expect(result.error?.status).toBe(403)
+      const body = await result.error?.json()
+      expect(body).toEqual({ error: 'MFA verification required' })
+      expect(listFactors).toHaveBeenCalledTimes(1)
+    })
+
+    it('never consults the cookie-derived assurance level', async () => {
+      // The attack: the sb-*-auth-token cookie is unsigned JSON, so the
+      // password holder strips `user.factors` and the local
+      // getAuthenticatorAssuranceLevel() reports nextLevel aal1 ("no MFA
+      // enrolled"). The gate must decide on the server's answer instead.
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
+      const getAuthenticatorAssuranceLevel = vi.fn().mockResolvedValue({
+        data: { currentLevel: 'aal1', nextLevel: 'aal1' },
+        error: null,
+      })
+      const listFactors = vi.fn().mockResolvedValue(factorList(VERIFIED_TOTP))
+      useSupabase({ getClaims, mfa: { getAuthenticatorAssuranceLevel, listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error?.status).toBe(403)
+      expect(getAuthenticatorAssuranceLevel).not.toHaveBeenCalled()
+    })
+
+    it('passes an AAL2 session on the verified claims alone (no listFactors round trip)', async () => {
+      const claims = { ...CLAIMS, aal: 'aal2' }
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims }, error: null })
+      const listFactors = vi.fn()
+      const getAuthenticatorAssuranceLevel = vi.fn()
+      useSupabase({ getClaims, mfa: { listFactors, getAuthenticatorAssuranceLevel } })
+
+      const result = await requireAuth()
+
+      expect(result.error).toBeNull()
+      expect(result.user?.id).toBe('user-1')
+      expect(listFactors).not.toHaveBeenCalled()
+      expect(getAuthenticatorAssuranceLevel).not.toHaveBeenCalled()
+    })
+
+    it('passes an AAL1 session when the auth server reports no verified factor', async () => {
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
+      const listFactors = vi.fn().mockResolvedValue(factorList())
+      useSupabase({ getClaims, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error).toBeNull()
+      expect(result.user?.id).toBe('user-1')
+      expect(listFactors).toHaveBeenCalledTimes(1)
+    })
+
+    it('does not count an unverified (enrolment in progress) factor as a step-up target', async () => {
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
+      const listFactors = vi.fn().mockResolvedValue(factorList(UNVERIFIED_TOTP))
+      useSupabase({ getClaims, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error).toBeNull()
+    })
+
+    it('reads a verified phone factor from the typed array when `all` is absent', async () => {
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
+      const listFactors = vi.fn().mockResolvedValue({
+        data: { phone: [{ id: 'p1', status: 'verified', factor_type: 'phone' }] },
+        error: null,
+      })
+      useSupabase({ getClaims, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error?.status).toBe(403)
+    })
+
+    it('treats a session whose verified claims carry no aal as not assured', async () => {
+      const { aal: _aal, ...claims } = CLAIMS
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims }, error: null })
+      const listFactors = vi.fn().mockResolvedValue(factorList(VERIFIED_TOTP))
+      useSupabase({ getClaims, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error?.status).toBe(403)
+    })
+
+    it('fails closed when listFactors returns an error', async () => {
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
+      const listFactors = vi.fn().mockResolvedValue({
+        data: null,
+        error: { name: 'AuthApiError', message: 'upstream unavailable' },
+      })
+      useSupabase({ getClaims, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error?.status).toBe(403)
+    })
+
+    it('fails closed when listFactors throws', async () => {
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
+      const listFactors = vi.fn().mockRejectedValue(new Error('network down'))
+      useSupabase({ getClaims, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error?.status).toBe(403)
+    })
+
+    it('fails closed when the client exposes no mfa API at all', async () => {
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims: CLAIMS }, error: null })
+      useSupabase({ getClaims })
+
+      const result = await requireAuth()
+
+      expect(result.error?.status).toBe(403)
+    })
+
+    it('asks listFactors on the getUser fallback path and refuses a verified factor', async () => {
+      // No verified claims exist here (getClaims failed), so the level is
+      // unknown: a verified factor means the session must be refused.
+      const getClaims = vi.fn().mockRejectedValue(new Error('jwks fetch failed'))
+      const getUser = vi.fn().mockResolvedValue({ data: { user: MOCK_USER }, error: null })
+      const listFactors = vi.fn().mockResolvedValue(factorList(VERIFIED_TOTP))
+      useSupabase({ getClaims, getUser, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error?.status).toBe(403)
+      expect(listFactors).toHaveBeenCalledTimes(1)
+    })
+
+    it('passes a factor-less user on the getUser fallback path', async () => {
+      const getUser = vi.fn().mockResolvedValue({ data: { user: MOCK_USER }, error: null })
+      const listFactors = vi.fn().mockResolvedValue(factorList())
+      useSupabase({ getUser, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error).toBeNull()
+      expect(result.user?.id).toBe('user-1')
+      expect(listFactors).toHaveBeenCalledTimes(1)
+    })
+
+    it('skips the MFA check for bankid_linked users', async () => {
+      const claims = { ...CLAIMS, app_metadata: { provider: 'email', bankid_linked: true } }
+      const getClaims = vi.fn().mockResolvedValue({ data: { claims }, error: null })
+      const listFactors = vi.fn()
+      useSupabase({ getClaims, mfa: { listFactors } })
+
+      const result = await requireAuth()
+
+      expect(result.error).toBeNull()
+      expect(result.user?.id).toBe('user-1')
+      expect(listFactors).not.toHaveBeenCalled()
+    })
  })
 })