fix(security): audit remediation 2026-09-01: api_keys identity, viewer gates, OAuth binding, XSS, MFA gate (#2155)
* fix(security): bind api_keys to the caller, lock hash-as-bearer RPCs and provider token tables Security audit 2026-09-01, critical items. - api_keys INSERT requires user_id = auth.uid() again (an admin could forge a key for any co-member and act as them in every company they belong to); SELECT is own-keys-or-admin; a BEFORE trigger freezes the identity and credential columns against user-session UPDATEs. - rotate_mcp_refresh_token and validate_and_increment_api_key become service_role only: they match rows by a presented SHA-256, so a hash readable by co-members was a bearer credential. - validate_and_increment_api_key fails closed when the key's user is no longer a member of the key's company. - provider_consent_tokens and provider_otc: the DELETE policies collapsed to "caller has any team row" (correlated subquery on a non-existent team_members.company_id). All member policies dropped; service_role only, matching every existing code path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): role gates, ownership guards and posting integrity in the database Security audit 2026-09-01, high items at the database layer. - One table-level guard, enforce_company_writer_role(), blocks the read-only viewer role on 55 company-scoped tables including through the 15 membership-only SECURITY DEFINER writers. Keyed on the JWT role claim so it fires inside definer bodies; no-op for service_role and trigger cascades. - company_members user_id/company_id immutable from user sessions; invitations can never grant owner; team_members gains a transition guard (admins keep non-owner role moves); companies team_id and archiving are owner-only and team attachment needs team membership. - Direct statements (current_user = authenticated) can no longer insert posted headers, add lines under posted verifikat, or post a draft with a voucher number the sequence never issued. Sanctioned RPCs run as the definer and are untouched; the engine's own draft-then-post shapes still pass. - create_document_version refuses viewers and foreign storage paths; validate_version_chain needs membership and loses anon EXECUTE; match_documents / match_booking_templates lose anon; cron maintenance RPCs become service_role only; the production-only seed_asset_categories is dropped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * build: pin tsx as an exact devDependency instead of fetching it with npx at build time prebuild ran "npx tsx" with no lockfile entry, so every Vercel, Docker and CI build downloaded tsx@latest and its transitive tree from the registry with no integrity check, inside the build environment. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): refuse the viewer role on API-key and MCP write paths The v1 wrapper and the MCP company routing checked company membership but never role, and both run as service role, so a read-only viewer holding an API key could post vouchers and change settings through the API. Mutating methods and non-read scopes now return 403 ROLE_READ_ONLY for viewers on v1; MCP write tools refuse viewers the same way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): stop serving uploaded SVG, XML and HTML as executable content on the app origin Uploads persisted the browser-declared mime type and the inline proxy served it verbatim, sandboxing only text/html; the storage proxy forwarded the uploader's Content-Type. Any writer, or any Peppol sender, could plant a scripted SVG or XHTML that executed on app.gnubok.se. - inline route: allow-list of natively safe types (PDF, raster images) served as before; everything else gets the opaque sandbox CSP. - storage proxy: octet-stream + attachment + sandbox unless the DB mime for the key is on the allow-list. - document-service: the stored mime is the magic-byte validated type. - logo upload: magic-byte validation, SVG refused. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): byrå brand logo upload decides the type by magic bytes and drops SVG Same pattern as the company logo route: the logos bucket is public, so a scripted SVG (or anything declared as an image) must never land there. The upload pickers stop advertising SVG. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind Enable Banking, Stripe and WooCommerce callbacks to the initiating user The callbacks resolved the pending row by oauth_state alone, so a victim who completed an attacker-initiated consent had their bank account, merchant account or store attached to the attacker's company. requireFlowInitiator() now requires the cookie session of the user who started the flow: no session redirects to login with the callback URL preserved, a different user is refused and nothing is exchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): guard tenant-controlled outbound fetches and surface the disabled rate limiter WooCommerce and Shopify syncs fetched a member-editable store URL with plain fetch() and redirect following under the service role, and the invoice PDF renderer fetched company_settings.logo_url unguarded. All three go through a new safeFetch() (public-IP validation via url-guard, https only, redirect: 'manual', body size cap) and re-normalise the stored host at use time. checkRateLimit() keeps failing open on hosted but logs one error per process when Upstash is not configured and exports isRateLimiterConfigured(). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): decide the API MFA gate from server-authenticated factors, not the session cookie getAuthenticatorAssuranceLevel() without arguments derives nextLevel from session.user.factors, which comes from the unsigned sb-*-auth-token cookie. Deleting factors from the cookie made an enrolled account look like it had nothing to step up to, on every /api route and in requireAuth. Both gates now read factors from the getUser() result or listFactors() and the level from the verified JWT claim, and fail closed on errors. Page-branch gate hardened the same way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind Fortnox/Visma, Gmail and Skatteverket callbacks to the initiating user The arcim-migration callback exchanged the provider code onto whatever consent the one-time state named, with no check of who completed the flow and no org-number comparison, so a phished Fortnox admin handed their ledger to the attacker's company. provider_otc now records the initiating user (migration 20260902100000); the callback requires that session and, after the exchange, refuses a provider company whose org number differs from the consent's company. The Gmail and Skatteverket callbacks enforce the same initiator check. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): BankID signup confirms the email before linking the identity Signup created an email-confirmed, MFA-exempt account for any address the caller typed and returned a magic link, so an attacker could pre-register a victim's email and keep a permanent BankID login into the account the victim later adopted. The user is now created unconfirmed, the identity carries email_verified_at NULL (migration 20260902101000), bankid_linked is not set until the mailed confirmation is clicked, and BankID login of a pending identity is refused with the confirmation re-sent. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind MCP OAuth redirect URIs to the consenting user and cap scopes A user-registered redirect URI was allowlisted globally, the consent page named no client, and all scopes were pre-checked, so one phishing link handed an attacker a full-scope key for the victim's company. Registered URIs now resolve only for the registrant or a colleague sharing a company; the consent page shows the client identity and redirect host; non-built-in clients default to read-only pre-checks; scopes are capped by the user's role (viewer: read only) at consent and at /token. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(auth): client follow-ups for BankID confirmation, callback mismatch copy and decision log - register client handles the new confirmation_sent response from BankID signup with the existing inbox screen instead of calling verifyOtp. - BankID login surfaces the email_unconfirmed explanation. - WooCommerce settings map woocommerce_error=wrong_user to its own copy. - Logo help text no longer advertises SVG. - DECISIONS.md records the audit remediation choices. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(mcp-oauth): literal SoD columns in the api_keys insert so the phantom-column scanner resolves them Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(logo): type the upload fixtures as Uint8Array<ArrayBuffer> so they are valid BlobParts Fixes the typecheck ratchet on PR #2155 and ratchets the baseline down by the one legacy error the change removed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Fable 5.1
Jakob Wennberg
Claude Fable 5.1
Jakob Wennberg
parent
6e8d76a9cb
commit
18cbc4c30a
@@ -1,6 +1,6 @@
|
||||
import { randomUUID } from 'node:crypto'
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { insertAuthUser, insertCompany } from './fixtures'
|
||||
import { insertAuthUser, insertCompany, insertCompanyMember } from './fixtures'
|
||||
import { getPool } from './setup'
|
||||
|
||||
/**
|
||||
@@ -28,6 +28,7 @@ describe('api_keys.unattended_commit_limit (pg)', () => {
|
||||
async function seedKey(limit: number | null = null) {
|
||||
const userId = await insertAuthUser()
|
||||
const companyId = await insertCompany({ createdBy: userId })
|
||||
await insertCompanyMember({ companyId, userId, role: 'owner' })
|
||||
const apiKeyId = randomUUID()
|
||||
const keyHash = randomUUID().replaceAll('-', '')
|
||||
await getPool().query(
|
||||
@@ -42,6 +43,7 @@ describe('api_keys.unattended_commit_limit (pg)', () => {
|
||||
it('defaults to NULL so pre-existing keys stay unlimited', async () => {
|
||||
const userId = await insertAuthUser()
|
||||
const companyId = await insertCompany({ createdBy: userId })
|
||||
await insertCompanyMember({ companyId, userId, role: 'owner' })
|
||||
// Deliberately omits the column instead of storing an explicit NULL: this
|
||||
// test exists to pin the DATABASE DEFAULT, and passing NULL in would keep
|
||||
// it green even if the default changed to a positive ceiling, which is the
|
||||
@@ -59,6 +61,7 @@ describe('api_keys.unattended_commit_limit (pg)', () => {
|
||||
it('rejects a zero or negative ceiling with the CHECK constraint', async () => {
|
||||
const userId = await insertAuthUser()
|
||||
const companyId = await insertCompany({ createdBy: userId })
|
||||
await insertCompanyMember({ companyId, userId, role: 'owner' })
|
||||
|
||||
for (const bad of [0, -1]) {
|
||||
await expect(
|
||||
|
||||
@@ -86,8 +86,13 @@ describe('set_committed_at trusted-writer preservation', () => {
|
||||
const { entryId, userId } = await seedBackdatedDraft()
|
||||
const before = Date.now()
|
||||
const committedAt = await withUserContext(userId, async (client) => {
|
||||
// Direct draft -> posted flips from a user session must carry a
|
||||
// sequence-issued voucher number (20260902093000); take one inline.
|
||||
const updated = await client.query(
|
||||
`UPDATE public.journal_entries SET status = 'posted' WHERE id = $1 RETURNING id`,
|
||||
`UPDATE public.journal_entries
|
||||
SET status = 'posted',
|
||||
voucher_number = public.next_voucher_number(company_id, fiscal_period_id, voucher_series)
|
||||
WHERE id = $1 RETURNING id`,
|
||||
[entryId],
|
||||
)
|
||||
// RLS must actually let the member's UPDATE through; 0 rows would make
|
||||
@@ -231,8 +236,13 @@ describe('committed_at override audit trail', () => {
|
||||
it('writes no override row when an authenticated member posts (stamp path)', async () => {
|
||||
const { entryId, userId } = await seedBackdatedDraft()
|
||||
await withUserContext(userId, async (client) => {
|
||||
// Direct draft -> posted flips from a user session must carry a
|
||||
// sequence-issued voucher number (20260902093000); take one inline.
|
||||
const updated = await client.query(
|
||||
`UPDATE public.journal_entries SET status = 'posted' WHERE id = $1 RETURNING id`,
|
||||
`UPDATE public.journal_entries
|
||||
SET status = 'posted',
|
||||
voucher_number = public.next_voucher_number(company_id, fiscal_period_id, voucher_series)
|
||||
WHERE id = $1 RETURNING id`,
|
||||
[entryId],
|
||||
)
|
||||
expect(updated.rowCount).toBe(1)
|
||||
|
||||
@@ -0,0 +1,248 @@
|
||||
import { createHash, randomUUID } from 'node:crypto'
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { getPool, runAsServiceRole, withUserContext } from './setup'
|
||||
import { insertAuthUser, insertCompany, insertCompanyMember } from './fixtures'
|
||||
|
||||
/**
|
||||
* Migration 20260902090000: the critical items of the 2026-09-01 security
|
||||
* audit.
|
||||
*
|
||||
* - api_keys INSERT binds user_id to the caller again (an admin could forge
|
||||
* a key for any co-member and act as them everywhere).
|
||||
* - api_keys SELECT is own-keys-or-admin (viewers could read every hash).
|
||||
* - identity/credential columns are frozen against JWT-session UPDATEs.
|
||||
* - rotate_mcp_refresh_token / validate_and_increment_api_key are
|
||||
* service_role only (hash-as-bearer takeover).
|
||||
* - validate_and_increment_api_key fails closed once the key's user is no
|
||||
* longer a member of the key's company.
|
||||
* - provider_consent_tokens / provider_otc are service_role only (the DELETE
|
||||
* policy had collapsed to "caller has any team row").
|
||||
*/
|
||||
|
||||
function sha256(s: string): string {
|
||||
return createHash('sha256').update(s).digest('hex')
|
||||
}
|
||||
|
||||
async function seedCompanyWithAdmin() {
|
||||
const owner = await insertAuthUser()
|
||||
const companyId = await insertCompany({ createdBy: owner })
|
||||
await insertCompanyMember({ companyId, userId: owner, role: 'owner' })
|
||||
const admin = await insertAuthUser()
|
||||
await insertCompanyMember({ companyId, userId: admin, role: 'admin' })
|
||||
return { owner, admin, companyId }
|
||||
}
|
||||
|
||||
describe('security audit: api_keys identity binding (pg)', () => {
|
||||
it('lets an admin mint a key for themselves', async () => {
|
||||
const { admin, companyId } = await seedCompanyWithAdmin()
|
||||
await withUserContext(admin, async (client) => {
|
||||
const res = await client.query<{ id: string }>(
|
||||
`INSERT INTO public.api_keys (user_id, company_id, key_hash, key_prefix, name, scopes)
|
||||
VALUES ($1, $2, $3, 'gnubok_sk_aaaaaaaa', 'own', ARRAY['companies:read'])
|
||||
RETURNING id`,
|
||||
[admin, companyId, sha256(randomUUID())],
|
||||
)
|
||||
expect(res.rows).toHaveLength(1)
|
||||
})
|
||||
})
|
||||
|
||||
it('refuses an admin minting a key that impersonates a co-member', async () => {
|
||||
const { owner, admin, companyId } = await seedCompanyWithAdmin()
|
||||
await expect(
|
||||
withUserContext(admin, (client) =>
|
||||
client.query(
|
||||
`INSERT INTO public.api_keys (user_id, company_id, key_hash, key_prefix, name, scopes)
|
||||
VALUES ($1, $2, $3, 'gnubok_sk_bbbbbbbb', 'forged', ARRAY['bookkeeping:write'])`,
|
||||
[owner, companyId, sha256(randomUUID())],
|
||||
),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
})
|
||||
|
||||
it('refuses a JWT session rewriting identity or credential columns', async () => {
|
||||
const { owner, admin, companyId } = await seedCompanyWithAdmin()
|
||||
const { rows } = await getPool().query<{ id: string }>(
|
||||
`INSERT INTO public.api_keys (user_id, company_id, key_hash, key_prefix, name, scopes)
|
||||
VALUES ($1, $2, $3, 'gnubok_sk_cccccccc', 'victim', ARRAY['companies:read'])
|
||||
RETURNING id`,
|
||||
[owner, companyId, sha256(randomUUID())],
|
||||
)
|
||||
const keyId = rows[0]!.id
|
||||
|
||||
for (const set of [
|
||||
`user_id = '${admin}'`,
|
||||
`key_hash = '${sha256('attacker')}'`,
|
||||
`refresh_token_hash = '${sha256('rt')}'`,
|
||||
`mode = 'test'`,
|
||||
]) {
|
||||
await expect(
|
||||
withUserContext(admin, (client) =>
|
||||
client.query(`UPDATE public.api_keys SET ${set} WHERE id = $1`, [keyId]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
}
|
||||
|
||||
// Revoking stays possible for admins: that is the settings route's job.
|
||||
await withUserContext(admin, async (client) => {
|
||||
const res = await client.query(
|
||||
`UPDATE public.api_keys SET revoked_at = now() WHERE id = $1 RETURNING id`,
|
||||
[keyId],
|
||||
)
|
||||
expect(res.rows).toHaveLength(1)
|
||||
})
|
||||
})
|
||||
|
||||
it('hides other members keys from non-admins and shows them to admins', async () => {
|
||||
const { owner, admin, companyId } = await seedCompanyWithAdmin()
|
||||
const viewer = await insertAuthUser()
|
||||
await insertCompanyMember({ companyId, userId: viewer, role: 'viewer' })
|
||||
await getPool().query(
|
||||
`INSERT INTO public.api_keys (user_id, company_id, key_hash, key_prefix, name, scopes)
|
||||
VALUES ($1, $2, $3, 'gnubok_sk_dddddddd', 'owner key', ARRAY['companies:read'])`,
|
||||
[owner, companyId, sha256(randomUUID())],
|
||||
)
|
||||
|
||||
await withUserContext(viewer, async (client) => {
|
||||
const res = await client.query(
|
||||
`SELECT id FROM public.api_keys WHERE company_id = $1`,
|
||||
[companyId],
|
||||
)
|
||||
expect(res.rows).toHaveLength(0)
|
||||
})
|
||||
await withUserContext(admin, async (client) => {
|
||||
const res = await client.query(
|
||||
`SELECT id FROM public.api_keys WHERE company_id = $1`,
|
||||
[companyId],
|
||||
)
|
||||
expect(res.rows.length).toBeGreaterThanOrEqual(1)
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('security audit: hash-as-bearer RPCs (pg)', () => {
|
||||
it('denies EXECUTE on rotate_mcp_refresh_token and validate_and_increment_api_key to anon and authenticated', async () => {
|
||||
const { rows } = await getPool().query<{ fn: string; anon: boolean; auth: boolean; svc: boolean }>(
|
||||
`SELECT p.proname AS fn,
|
||||
has_function_privilege('anon', p.oid, 'execute') AS anon,
|
||||
has_function_privilege('authenticated', p.oid, 'execute') AS auth,
|
||||
has_function_privilege('service_role', p.oid, 'execute') AS svc
|
||||
FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
|
||||
WHERE n.nspname = 'public'
|
||||
AND p.proname IN ('rotate_mcp_refresh_token', 'validate_and_increment_api_key')`,
|
||||
)
|
||||
expect(rows).toHaveLength(2)
|
||||
for (const r of rows) {
|
||||
expect(r.anon, r.fn).toBe(false)
|
||||
expect(r.auth, r.fn).toBe(false)
|
||||
expect(r.svc, r.fn).toBe(true)
|
||||
}
|
||||
})
|
||||
|
||||
it('validate_and_increment_api_key returns no row once the key user left the company', async () => {
|
||||
const { owner, companyId } = await seedCompanyWithAdmin()
|
||||
const key = `gnubok_sk_${randomUUID()}`
|
||||
await getPool().query(
|
||||
`INSERT INTO public.api_keys (user_id, company_id, key_hash, key_prefix, name, scopes)
|
||||
VALUES ($1, $2, $3, 'gnubok_sk_eeeeeeee', 'k', ARRAY['companies:read'])`,
|
||||
[owner, companyId, sha256(key)],
|
||||
)
|
||||
|
||||
const live = await runAsServiceRole((client) =>
|
||||
client.query(`SELECT * FROM public.validate_and_increment_api_key($1)`, [sha256(key)]),
|
||||
)
|
||||
expect(live.rows).toHaveLength(1)
|
||||
|
||||
await getPool().query(
|
||||
`DELETE FROM public.company_members WHERE company_id = $1 AND user_id = $2`,
|
||||
[companyId, owner],
|
||||
)
|
||||
const stale = await runAsServiceRole((client) =>
|
||||
client.query(`SELECT * FROM public.validate_and_increment_api_key($1)`, [sha256(key)]),
|
||||
)
|
||||
expect(stale.rows).toHaveLength(0)
|
||||
})
|
||||
|
||||
it('keeps validating company-less (lazy-bind) keys', async () => {
|
||||
const user = await insertAuthUser()
|
||||
const key = `gnubok_sk_${randomUUID()}`
|
||||
await getPool().query(
|
||||
`INSERT INTO public.api_keys (user_id, company_id, key_hash, key_prefix, name, scopes)
|
||||
VALUES ($1, NULL, $2, 'gnubok_sk_ffffffff', 'unbound', ARRAY['companies:read'])`,
|
||||
[user, sha256(key)],
|
||||
)
|
||||
const res = await runAsServiceRole((client) =>
|
||||
client.query(`SELECT * FROM public.validate_and_increment_api_key($1)`, [sha256(key)]),
|
||||
)
|
||||
expect(res.rows).toHaveLength(1)
|
||||
})
|
||||
})
|
||||
|
||||
describe('security audit: provider token tables are service_role only (pg)', () => {
|
||||
async function seedConsentWithToken() {
|
||||
const { owner, companyId } = await seedCompanyWithAdmin()
|
||||
const consent = await getPool().query<{ id: string }>(
|
||||
`INSERT INTO public.provider_consents (company_id, name, status, provider)
|
||||
VALUES ($1, 'Fortnox', 1, 'fortnox') RETURNING id`,
|
||||
[companyId],
|
||||
)
|
||||
const consentId = consent.rows[0]!.id
|
||||
await getPool().query(
|
||||
`INSERT INTO public.provider_consent_tokens (consent_id, provider, access_token, refresh_token, token_expires_at)
|
||||
VALUES ($1, 'fortnox', 'access-secret', 'refresh-secret', now() + interval '1 hour')`,
|
||||
[consentId],
|
||||
)
|
||||
return { owner, companyId, consentId }
|
||||
}
|
||||
|
||||
it('an unrelated user with a team row can no longer delete anyone tokens', async () => {
|
||||
const { consentId } = await seedConsentWithToken()
|
||||
const outsider = await insertAuthUser()
|
||||
const team = await getPool().query<{ id: string }>(
|
||||
`INSERT INTO public.teams (name, created_by) VALUES ('Personal', $1) RETURNING id`,
|
||||
[outsider],
|
||||
)
|
||||
await getPool().query(
|
||||
`INSERT INTO public.team_members (team_id, user_id, role) VALUES ($1, $2, 'owner')`,
|
||||
[team.rows[0]!.id, outsider],
|
||||
)
|
||||
|
||||
await expect(
|
||||
withUserContext(outsider, (client) =>
|
||||
client.query(`DELETE FROM public.provider_consent_tokens WHERE consent_id = $1`, [consentId]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
|
||||
const { rows } = await getPool().query(
|
||||
`SELECT 1 FROM public.provider_consent_tokens WHERE consent_id = $1`,
|
||||
[consentId],
|
||||
)
|
||||
expect(rows).toHaveLength(1)
|
||||
})
|
||||
|
||||
it('a company member cannot read the plaintext tokens of their own company', async () => {
|
||||
const { owner, consentId } = await seedConsentWithToken()
|
||||
await expect(
|
||||
withUserContext(owner, (client) =>
|
||||
client.query(`SELECT access_token FROM public.provider_consent_tokens WHERE consent_id = $1`, [
|
||||
consentId,
|
||||
]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
})
|
||||
|
||||
it('the service role still reads and deletes them', async () => {
|
||||
const { consentId } = await seedConsentWithToken()
|
||||
const read = await runAsServiceRole((client) =>
|
||||
client.query(`SELECT access_token FROM public.provider_consent_tokens WHERE consent_id = $1`, [
|
||||
consentId,
|
||||
]),
|
||||
)
|
||||
expect(read.rows).toHaveLength(1)
|
||||
const del = await runAsServiceRole((client) =>
|
||||
client.query(`DELETE FROM public.provider_consent_tokens WHERE consent_id = $1 RETURNING consent_id`, [
|
||||
consentId,
|
||||
]),
|
||||
)
|
||||
expect(del.rows).toHaveLength(1)
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,425 @@
|
||||
import { randomUUID } from 'node:crypto'
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { getPool, withUserContext } from './setup'
|
||||
import {
|
||||
insertAuthUser,
|
||||
insertBalancedLines,
|
||||
insertCompany,
|
||||
insertCompanyMember,
|
||||
insertDraftJournalEntry,
|
||||
insertPostedJournalEntry,
|
||||
seedCompany,
|
||||
} from './fixtures'
|
||||
|
||||
/**
|
||||
* Migration 20260902093000: the high items of the 2026-09-01 security audit.
|
||||
*
|
||||
* A. viewer role cannot write, including through membership-only
|
||||
* SECURITY DEFINER RPCs (table-level guard).
|
||||
* B. admin cannot seize the owner seat (company_members.user_id, invitation
|
||||
* role owner, team_members self-promotion); companies.team_id/archived_at
|
||||
* are owner-only and team attachment needs team membership.
|
||||
* C. direct statements cannot insert posted headers, add lines under posted
|
||||
* headers, or post a draft with a voucher number the sequence never
|
||||
* issued; the engine's own direct shapes still work.
|
||||
* D. create_document_version refuses viewers and foreign storage paths;
|
||||
* validate_version_chain needs membership; leftover grants tightened.
|
||||
*/
|
||||
|
||||
async function seedWithRoles() {
|
||||
const seeded = await seedCompany()
|
||||
const admin = await insertAuthUser()
|
||||
await insertCompanyMember({ companyId: seeded.companyId, userId: admin, role: 'admin' })
|
||||
const member = await insertAuthUser()
|
||||
await insertCompanyMember({ companyId: seeded.companyId, userId: member, role: 'member' })
|
||||
const viewer = await insertAuthUser()
|
||||
await insertCompanyMember({ companyId: seeded.companyId, userId: viewer, role: 'viewer' })
|
||||
return { ...seeded, owner: seeded.userId, admin, member, viewer }
|
||||
}
|
||||
|
||||
describe('A. viewer role cannot write (pg)', () => {
|
||||
it('blocks a viewer inserting into a membership-only table and lets a member through', async () => {
|
||||
const { companyId, member, viewer } = await seedWithRoles()
|
||||
await expect(
|
||||
withUserContext(viewer, (c) =>
|
||||
c.query(
|
||||
`INSERT INTO public.employees (company_id, user_id, first_name, last_name, personnummer, personnummer_last4, employment_type, employment_start, employment_degree, salary_type)
|
||||
VALUES ($1, $2, 'Eva', 'Viewer', '199001011234', '1234', 'employee', '2026-01-01', 100, 'monthly')`,
|
||||
[companyId, viewer],
|
||||
),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
|
||||
await withUserContext(member, async (c) => {
|
||||
const res = await c.query(
|
||||
`INSERT INTO public.employees (company_id, user_id, first_name, last_name, personnummer, personnummer_last4, employment_type, employment_start, employment_degree, salary_type)
|
||||
VALUES ($1, $2, 'Max', 'Member', '199001011235', '1235', 'employee', '2026-01-01', 100, 'monthly') RETURNING id`,
|
||||
[companyId, member],
|
||||
)
|
||||
expect(res.rows).toHaveLength(1)
|
||||
})
|
||||
})
|
||||
|
||||
it('blocks a viewer burning voucher numbers through next_voucher_number (SECURITY DEFINER)', async () => {
|
||||
const { companyId, fiscalPeriodId, member, viewer } = await seedWithRoles()
|
||||
await expect(
|
||||
withUserContext(viewer, (c) =>
|
||||
c.query(`SELECT public.next_voucher_number($1, $2, 'A')`, [companyId, fiscalPeriodId]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
|
||||
await withUserContext(member, async (c) => {
|
||||
const res = await c.query<{ n: number }>(
|
||||
`SELECT public.next_voucher_number($1, $2, 'A') AS n`,
|
||||
[companyId, fiscalPeriodId],
|
||||
)
|
||||
expect(res.rows[0]!.n).toBe(1)
|
||||
})
|
||||
})
|
||||
|
||||
it('blocks a viewer posting through import_sie_journal_entries', async () => {
|
||||
const { companyId, fiscalPeriodId, viewer } = await seedWithRoles()
|
||||
await expect(
|
||||
withUserContext(viewer, (c) =>
|
||||
c.query(`SELECT public.import_sie_journal_entries($1, $2, $3, $4::jsonb)`, [
|
||||
companyId,
|
||||
viewer,
|
||||
fiscalPeriodId,
|
||||
JSON.stringify([
|
||||
{
|
||||
date: '2026-06-01',
|
||||
description: 'viewer',
|
||||
sourceType: 'import',
|
||||
series: 'A',
|
||||
lines: [
|
||||
{ account_number: '1930', debit_amount: 100, credit_amount: 0 },
|
||||
{ account_number: '3001', debit_amount: 0, credit_amount: 100 },
|
||||
],
|
||||
},
|
||||
]),
|
||||
]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
})
|
||||
})
|
||||
|
||||
describe('B. admin cannot seize ownership (pg)', () => {
|
||||
it('refuses re-pointing a membership row to another user', async () => {
|
||||
const { companyId, owner, admin } = await seedWithRoles()
|
||||
const accomplice = await insertAuthUser()
|
||||
await expect(
|
||||
withUserContext(admin, (c) =>
|
||||
c.query(`UPDATE public.company_members SET user_id = $1 WHERE company_id = $2 AND user_id = $3`, [
|
||||
accomplice,
|
||||
companyId,
|
||||
owner,
|
||||
]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
})
|
||||
|
||||
it('still lets the owner change a member role', async () => {
|
||||
const { companyId, owner, member } = await seedWithRoles()
|
||||
await withUserContext(owner, async (c) => {
|
||||
const res = await c.query(
|
||||
`UPDATE public.company_members SET role = 'admin' WHERE company_id = $1 AND user_id = $2 RETURNING role`,
|
||||
[companyId, member],
|
||||
)
|
||||
expect(res.rows[0]).toMatchObject({ role: 'admin' })
|
||||
})
|
||||
})
|
||||
|
||||
it('refuses invitations that grant owner, allows member', async () => {
|
||||
const { companyId, admin } = await seedWithRoles()
|
||||
const tokenHash = randomUUID().replace(/-/g, '')
|
||||
await expect(
|
||||
withUserContext(admin, (c) =>
|
||||
c.query(
|
||||
`INSERT INTO public.company_invitations (company_id, email, role, token_hash, invited_by, expires_at)
|
||||
VALUES ($1, 'x@example.com', 'owner', $2, $3, now() + interval '7 days')`,
|
||||
[companyId, tokenHash, admin],
|
||||
),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
await withUserContext(admin, async (c) => {
|
||||
const res = await c.query(
|
||||
`INSERT INTO public.company_invitations (company_id, email, role, token_hash, invited_by, expires_at)
|
||||
VALUES ($1, 'y@example.com', 'member', $2, $3, now() + interval '7 days') RETURNING id`,
|
||||
[companyId, tokenHash + 'b', admin],
|
||||
)
|
||||
expect(res.rows).toHaveLength(1)
|
||||
})
|
||||
})
|
||||
|
||||
it('team admin cannot promote themselves; owner can; first owner self-insert still works', async () => {
|
||||
const founder = await insertAuthUser()
|
||||
const team = await getPool().query<{ id: string }>(
|
||||
`INSERT INTO public.teams (name, created_by) VALUES ('Byrå', $1) RETURNING id`,
|
||||
[founder],
|
||||
)
|
||||
const teamId = team.rows[0]!.id
|
||||
await getPool().query(`INSERT INTO public.team_members (team_id, user_id, role) VALUES ($1, $2, 'owner')`, [
|
||||
teamId,
|
||||
founder,
|
||||
])
|
||||
const teamAdmin = await insertAuthUser()
|
||||
await getPool().query(`INSERT INTO public.team_members (team_id, user_id, role) VALUES ($1, $2, 'admin')`, [
|
||||
teamId,
|
||||
teamAdmin,
|
||||
])
|
||||
|
||||
await expect(
|
||||
withUserContext(teamAdmin, (c) =>
|
||||
c.query(`UPDATE public.team_members SET role = 'owner' WHERE team_id = $1 AND user_id = $2`, [
|
||||
teamId,
|
||||
teamAdmin,
|
||||
]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
|
||||
await withUserContext(founder, async (c) => {
|
||||
const res = await c.query(
|
||||
`UPDATE public.team_members SET role = 'owner' WHERE team_id = $1 AND user_id = $2 RETURNING role`,
|
||||
[teamId, teamAdmin],
|
||||
)
|
||||
expect(res.rows[0]).toMatchObject({ role: 'owner' })
|
||||
})
|
||||
|
||||
// The very first owner of a fresh team is self-inserted by the definer RPC.
|
||||
const newcomer = await insertAuthUser()
|
||||
await withUserContext(newcomer, async (c) => {
|
||||
const res = await c.query<{ id: string }>(`SELECT public.create_team_with_owner('Ny byrå') AS id`)
|
||||
const mine = await c.query<{ role: string }>(
|
||||
`SELECT role FROM public.team_members WHERE team_id = $1 AND user_id = $2`,
|
||||
[res.rows[0]!.id, newcomer],
|
||||
)
|
||||
expect(mine.rows[0]).toMatchObject({ role: 'owner' })
|
||||
})
|
||||
})
|
||||
|
||||
it('companies: admin cannot archive or re-team; owner can only attach own team', async () => {
|
||||
const { companyId, owner, admin } = await seedWithRoles()
|
||||
const foreignTeam = await getPool().query<{ id: string }>(
|
||||
`INSERT INTO public.teams (name, created_by) VALUES ('Other byrå', $1) RETURNING id`,
|
||||
[await insertAuthUser()],
|
||||
)
|
||||
await expect(
|
||||
withUserContext(admin, (c) =>
|
||||
c.query(`UPDATE public.companies SET archived_at = now() WHERE id = $1`, [companyId]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
await expect(
|
||||
withUserContext(admin, (c) =>
|
||||
c.query(`UPDATE public.companies SET team_id = $1 WHERE id = $2`, [foreignTeam.rows[0]!.id, companyId]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
await expect(
|
||||
withUserContext(owner, (c) =>
|
||||
c.query(`UPDATE public.companies SET team_id = $1 WHERE id = $2`, [foreignTeam.rows[0]!.id, companyId]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
|
||||
const own = await getPool().query<{ id: string }>(
|
||||
`INSERT INTO public.teams (name, created_by) VALUES ('Egen', $1) RETURNING id`,
|
||||
[owner],
|
||||
)
|
||||
const ownTeam = own.rows[0]!.id
|
||||
await getPool().query(`INSERT INTO public.team_members (team_id, user_id, role) VALUES ($1, $2, 'owner')`, [
|
||||
ownTeam,
|
||||
owner,
|
||||
])
|
||||
await withUserContext(owner, async (c) => {
|
||||
const res = await c.query(`UPDATE public.companies SET team_id = $1 WHERE id = $2 RETURNING team_id`, [
|
||||
ownTeam,
|
||||
companyId,
|
||||
])
|
||||
expect(res.rows[0]).toMatchObject({ team_id: ownTeam })
|
||||
})
|
||||
})
|
||||
|
||||
it('companies_insert refuses attaching a new company to a foreign team', async () => {
|
||||
const user = await insertAuthUser()
|
||||
const foreignTeam = await getPool().query<{ id: string }>(
|
||||
`INSERT INTO public.teams (name, created_by) VALUES ('Victim byrå', $1) RETURNING id`,
|
||||
[await insertAuthUser()],
|
||||
)
|
||||
await expect(
|
||||
withUserContext(user, (c) =>
|
||||
c.query(
|
||||
`INSERT INTO public.companies (name, entity_type, created_by, team_id) VALUES ('Bogus AB', 'aktiebolag', $1, $2)`,
|
||||
[user, foreignTeam.rows[0]!.id],
|
||||
),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
})
|
||||
})
|
||||
|
||||
describe('C. posting integrity for direct statements (pg)', () => {
|
||||
it('refuses a direct posted header insert, accepts a draft', async () => {
|
||||
const { companyId, fiscalPeriodId, member } = await seedWithRoles()
|
||||
await expect(
|
||||
withUserContext(member, (c) =>
|
||||
c.query(
|
||||
`INSERT INTO public.journal_entries (user_id, company_id, fiscal_period_id, voucher_number, voucher_series, entry_date, description, source_type, status)
|
||||
VALUES ($1, $2, $3, 4711, 'A', '2026-06-01', 'direct', 'manual', 'posted')`,
|
||||
[member, companyId, fiscalPeriodId],
|
||||
),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
|
||||
await withUserContext(member, async (c) => {
|
||||
const res = await c.query(
|
||||
`INSERT INTO public.journal_entries (user_id, company_id, fiscal_period_id, voucher_number, voucher_series, entry_date, description, source_type, status)
|
||||
VALUES ($1, $2, $3, 0, 'A', '2026-06-01', 'draft', 'manual', 'draft') RETURNING id`,
|
||||
[member, companyId, fiscalPeriodId],
|
||||
)
|
||||
expect(res.rows).toHaveLength(1)
|
||||
})
|
||||
})
|
||||
|
||||
it('refuses adding lines to a posted verifikat from a user session', async () => {
|
||||
const { userId, companyId, fiscalPeriodId } = await seedCompany()
|
||||
const posted = await insertPostedJournalEntry({ userId, companyId, fiscalPeriodId, voucherNumber: 1 })
|
||||
await expect(
|
||||
withUserContext(userId, (c) =>
|
||||
c.query(
|
||||
`INSERT INTO public.journal_entry_lines (journal_entry_id, account_number, debit_amount, credit_amount)
|
||||
VALUES ($1, '1930', 500, 0)`,
|
||||
[posted],
|
||||
),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
})
|
||||
|
||||
it('refuses posting a draft with a voucher number the sequence never issued', async () => {
|
||||
const { userId, companyId, fiscalPeriodId } = await seedCompany()
|
||||
const draft = await insertDraftJournalEntry({ userId, companyId, fiscalPeriodId, voucherNumber: 999 })
|
||||
await insertBalancedLines(draft)
|
||||
await expect(
|
||||
withUserContext(userId, (c) =>
|
||||
c.query(`UPDATE public.journal_entries SET status = 'posted' WHERE id = $1`, [draft]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
})
|
||||
|
||||
it('keeps the engine reversal shape: sequence-issued number, lines while draft, then post', async () => {
|
||||
const { userId, companyId, fiscalPeriodId } = await seedCompany()
|
||||
await withUserContext(userId, async (c) => {
|
||||
const n = await c.query<{ n: number }>(`SELECT public.next_voucher_number($1, $2, 'A') AS n`, [
|
||||
companyId,
|
||||
fiscalPeriodId,
|
||||
])
|
||||
const header = await c.query<{ id: string }>(
|
||||
`INSERT INTO public.journal_entries (user_id, company_id, fiscal_period_id, voucher_number, voucher_series, entry_date, description, source_type, status)
|
||||
VALUES ($1, $2, $3, $4, 'A', '2026-06-01', 'reversal', 'manual', 'draft') RETURNING id`,
|
||||
[userId, companyId, fiscalPeriodId, n.rows[0]!.n],
|
||||
)
|
||||
const id = header.rows[0]!.id
|
||||
await c.query(
|
||||
`INSERT INTO public.journal_entry_lines (journal_entry_id, account_number, debit_amount, credit_amount)
|
||||
VALUES ($1, '1930', 100, 0), ($1, '3001', 0, 100)`,
|
||||
[id],
|
||||
)
|
||||
const posted = await c.query(
|
||||
`UPDATE public.journal_entries SET status = 'posted' WHERE id = $1 RETURNING status`,
|
||||
[id],
|
||||
)
|
||||
expect(posted.rows[0]).toMatchObject({ status: 'posted' })
|
||||
})
|
||||
})
|
||||
|
||||
it('commit_journal_entry (SECURITY DEFINER) still posts drafts for members', async () => {
|
||||
const { userId, companyId, fiscalPeriodId } = await seedCompany()
|
||||
const draft = await insertDraftJournalEntry({ userId, companyId, fiscalPeriodId })
|
||||
await insertBalancedLines(draft)
|
||||
await withUserContext(userId, async (c) => {
|
||||
const res = await c.query<{ n: number }>(`SELECT public.commit_journal_entry($1, $2) AS n`, [
|
||||
companyId,
|
||||
draft,
|
||||
])
|
||||
expect(res.rows[0]!.n).toBeGreaterThan(0)
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('D. document RPCs and leftover grants (pg)', () => {
|
||||
async function seedDocument() {
|
||||
const { companyId, owner, viewer, member } = await seedWithRoles()
|
||||
const doc = await getPool().query<{ id: string }>(
|
||||
`INSERT INTO public.document_attachments
|
||||
(user_id, company_id, storage_path, file_name, file_size_bytes, mime_type, sha256_hash, version, is_current_version, uploaded_by)
|
||||
VALUES ($1, $2, $3, 'faktura.pdf', 10, 'application/pdf', repeat('a', 64), 1, true, $1)
|
||||
RETURNING id`,
|
||||
[owner, companyId, `documents/${companyId}/${owner}/1.pdf`],
|
||||
)
|
||||
return { companyId, owner, viewer, member, docId: doc.rows[0]!.id }
|
||||
}
|
||||
|
||||
it('create_document_version refuses viewers and foreign storage paths', async () => {
|
||||
const { companyId, viewer, member, docId } = await seedDocument()
|
||||
await expect(
|
||||
withUserContext(viewer, (c) =>
|
||||
c.query(`SELECT public.create_document_version($1, $2, $3, 'v2.pdf', 11, 'application/pdf', repeat('b', 64))`, [
|
||||
viewer,
|
||||
docId,
|
||||
`documents/${companyId}/${viewer}/2.pdf`,
|
||||
]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
|
||||
await expect(
|
||||
withUserContext(member, (c) =>
|
||||
c.query(`SELECT public.create_document_version($1, $2, $3, 'v2.pdf', 11, 'application/pdf', repeat('c', 64))`, [
|
||||
member,
|
||||
docId,
|
||||
`documents/${randomUUID()}/x/2.pdf`,
|
||||
]),
|
||||
),
|
||||
).rejects.toMatchObject({ code: '42501' })
|
||||
|
||||
await withUserContext(member, async (c) => {
|
||||
const res = await c.query<{ id: string }>(
|
||||
`SELECT public.create_document_version($1, $2, $3, 'v2.pdf', 11, 'application/pdf', repeat('d', 64)) AS id`,
|
||||
[member, docId, `documents/${companyId}/${member}/2.pdf`],
|
||||
)
|
||||
expect(res.rows[0]!.id).toBeTruthy()
|
||||
})
|
||||
})
|
||||
|
||||
it('validate_version_chain answers not found to non-members and is not anon-callable', async () => {
|
||||
const { docId, owner } = await seedDocument()
|
||||
const outsider = await insertAuthUser()
|
||||
await expect(
|
||||
withUserContext(outsider, (c) => c.query(`SELECT * FROM public.validate_version_chain($1)`, [docId])),
|
||||
).rejects.toMatchObject({ code: 'P0001' })
|
||||
await withUserContext(owner, async (c) => {
|
||||
const res = await c.query(`SELECT * FROM public.validate_version_chain($1)`, [docId])
|
||||
expect(res.rows).toHaveLength(1)
|
||||
})
|
||||
const { rows } = await getPool().query<{ anon: boolean }>(
|
||||
`SELECT has_function_privilege('anon', 'public.validate_version_chain(uuid)', 'execute') AS anon`,
|
||||
)
|
||||
expect(rows[0]!.anon).toBe(false)
|
||||
})
|
||||
|
||||
it('tightens the leftover grants', async () => {
|
||||
const { rows } = await getPool().query<{ fn: string; anon: boolean; auth: boolean }>(
|
||||
`SELECT p.proname AS fn,
|
||||
has_function_privilege('anon', p.oid, 'execute') AS anon,
|
||||
has_function_privilege('authenticated', p.oid, 'execute') AS auth
|
||||
FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
|
||||
WHERE n.nspname = 'public'
|
||||
AND p.proname IN ('match_documents', 'match_booking_templates',
|
||||
'update_overdue_supplier_invoices', 'redact_expired_invoice_delivery_pii')`,
|
||||
)
|
||||
const byName = Object.fromEntries(rows.map((r) => [r.fn, r]))
|
||||
expect(byName.match_documents!.anon).toBe(false)
|
||||
expect(byName.match_booking_templates!.anon).toBe(false)
|
||||
expect(byName.update_overdue_supplier_invoices!.auth).toBe(false)
|
||||
expect(byName.redact_expired_invoice_delivery_pii!.auth).toBe(false)
|
||||
const dropped = await getPool().query(
|
||||
`SELECT 1 FROM pg_proc WHERE proname = 'seed_asset_categories'`,
|
||||
)
|
||||
expect(dropped.rows).toHaveLength(0)
|
||||
})
|
||||
})
|
||||
Reference in New Issue
Block a user