Approved
'); + return; + } + if (request.method === 'POST' && request.url === `/api/desktop/pairings/${pairingId}/poll`) { + const body = await readJson(request); + if (body.deviceSecret !== deviceSecret || !approved || !binding) throw new Error('pairing not approved'); + if (mode === 'cancel' || mode === 'expiry') { + response.writeHead(202, cors); + response.end('{"status":"pending","interval":1}'); + return; + } + response.writeHead(200, cors); + response.end(JSON.stringify({ + status: 'provisional', token, tokenType: 'Bearer', activationTicket, + activationExpiresAt: new Date(Date.now() + 60_000).toISOString(), + instanceId: binding.instanceId, + origin: binding.origin, + scope: binding.scope, + credentialGeneration: binding.credentialGeneration, + })); + return; + } + if (request.method === 'POST' && request.url === `/api/desktop/pairings/${pairingId}/activate`) { + const body = await readJson(request); + if (body.deviceSecret !== deviceSecret || body.activationTicket !== activationTicket) { + throw new Error('activation binding rejected'); + } + active = true; + response.writeHead(200, cors); + response.end(JSON.stringify({ + status: 'active', receipt, activatedAt: new Date().toISOString(), expiresAt: null, + })); + return; + } + if (request.method === 'DELETE' && request.url === '/api/desktop/tokens/current') { + active = false; + response.writeHead(204, cors); + response.end(); + return; + } + if (request.method === 'GET' && request.url === '/api/auth/user' + && active && record.authorization === `Bearer ${token}`) { + response.writeHead(200, cors); + response.end(JSON.stringify({ + id: 'packaged-owner', login: 'packaged-owner', username: 'packaged-owner', + displayName: 'Packaged Owner', email: null, avatarUrl: null, + role: 'admin', permissions: [], authorizationSource: 'bootstrap', + })); + return; + } + if (request.method === 'GET' && record.authorization === `Bearer ${token}`) { + response.writeHead(200, cors); + response.end('{}'); + return; + } + } catch { + response.writeHead(400, cors); + response.end('{"code":"INVALID_SMOKE_REQUEST"}'); + return; + } + response.writeHead(401, cors); + response.end('{"code":"INVALID_INSTANCE_TOKEN"}'); + }); + const io = new SocketIOServer(server, { + path: '/socket.io/', + transports: ['websocket'], + cors: { origin: DESKTOP_RENDERER_ORIGIN, credentials: false }, + }); + io.of('/').use((socket, next) => { + const scopes = new URL(socket.handshake.url, 'http://fixture.invalid') + .searchParams.getAll(DESKTOP_TRANSPORT_SCOPE_QUERY); + requests.push({ + method: 'SOCKET.IO', + url: socket.handshake.url, + authorization: socket.handshake.headers.authorization ?? null, + origin: socket.handshake.headers.origin ?? null, + transportScope: scopes[0] ?? null, + socketAuthScope: socket.handshake.auth?.[DESKTOP_TRANSPORT_SCOPE_QUERY] ?? null, + socketIo: true, + }); + if (!active || socket.handshake.headers.authorization !== `Bearer ${token}` + || scopes.length !== 1 || socket.handshake.auth?.[DESKTOP_TRANSPORT_SCOPE_QUERY] !== scopes[0]) { + const error = new Error('INVALID_INSTANCE_TOKEN'); + error.data = { code: 'INVALID_INSTANCE_TOKEN' }; + next(error); + return; + } + next(); + }); + server.listen(0, '127.0.0.1'); + await once(server, 'listening'); + const address = server.address(); + if (!address || typeof address === 'string') throw new Error('Packaged journey fixture did not bind'); + endpoint = `http://127.0.0.1:${address.port}`; + const close = createIdempotentJourneyFixtureClose({ + closeSocketServer: () => io.close(), + closeHttpServer: () => new Promise((resolveClose, rejectClose) => { + server.close(error => error ? rejectClose(error) : resolveClose()); + }), + }); + return { + endpoint, + requests, + secrets: [deviceSecret, activationTicket, token], + close, + }; +}; + +const directoryContainsPlaintext = async (root, needles) => { + const visit = async path => { + const entries = await readdir(path, { withFileTypes: true }); + for (const entry of entries) { + const child = join(path, entry.name); + if (entry.isDirectory()) { + if (await visit(child)) return true; + } else if (entry.isFile()) { + const contents = await readFile(child); + if (needles.some(needle => contents.includes(Buffer.from(needle)))) return true; + } + } + return false; + }; + return visit(root); +}; + if (process.platform === 'win32') { try { packagedConnectPhase = 'staged-contract'; @@ -219,6 +482,7 @@ const protectWindowsEntries = entries => { let canonicalTemp; let fixture; let generatedFixtureLeaf; +let journeyFixture; let outcome = { ok: false, category: 'fixture-setup', capture: 'complete', records: [] }; let failurePhase = 'fixture-setup'; try { @@ -263,11 +527,13 @@ try { || relative(canonicalTemp, configRoot) !== join(generatedFixtureLeaf, 'config')) { throw new Error('Connect smoke fixture escaped its fixed root'); } + if (process.platform !== 'win32') journeyFixture = await createPackagedJourneyFixture(); failurePhase = 'package-validation'; await assertPackageAuthority(); const treeKillerPath = await windowsTreeKiller(); const sensitiveNeedles = [ ...secrets, fixture, configRoot, stackRoot, identity, + ...(journeyFixture?.secrets ?? []), ...packagedConnectArtifactSensitiveNeedles({ platform: process.platform, artifactRoot, @@ -284,39 +550,108 @@ try { PROPR_CONNECTOR_TOKEN: secrets[1], PROPR_RELAY_TOKEN: secrets[2], GITHUB_TOKEN: secrets[3], + ...(journeyFixture ? { + PROPR_DESKTOP_CONNECT_JOURNEY_ENDPOINT: journeyFixture.endpoint, + } : {}), }; delete childEnvironment.PROPR_DESKTOP_CONNECT_STAGING_PARENT; delete childEnvironment.PROPR_DESKTOP_CONNECT_STAGING_LEAF; + const launchArguments = createPackagedConnectLaunchArguments({ + platform: process.platform, + userDataPath, + }); const spawnLifecycleProcess = (executable, args, options) => { if (executable !== binaryPath) return spawn(executable, args, options); - const child = spawn(binaryPath, ['--disable-gpu', `--user-data-dir=${userDataPath}`], { - ...options, - env: childEnvironment, + const child = spawnPackagedConnectBinary({ + binaryPath, + launchArguments: args, + options: { + ...options, + env: options.env, + }, + spawn, }); return child; }; failurePhase = 'lifecycle-internal'; - outcome = await runPackagedConnectLifecycle({ - binaryPath, - args: ['--disable-gpu', `--user-data-dir=${userDataPath}`], - platform: process.platform, - arch: process.arch, - authorityMechanism: authorityMechanism(), - sensitiveNeedles, - treeKillerPath, - env: childEnvironment, - spawn: spawnLifecycleProcess, - }); + const runPhase = async phase => await runPackagedConnectLifecycle({ + binaryPath, + args: launchArguments, + platform: process.platform, + arch: process.arch, + authorityMechanism: authorityMechanism(), + sensitiveNeedles, + treeKillerPath, + env: { + ...childEnvironment, + ...(journeyFixture ? { PROPR_DESKTOP_CONNECT_JOURNEY_PHASE: phase } : {}), + }, + spawn: spawnLifecycleProcess, + }); + outcome = await runPhase('pair'); + if (outcome.ok && journeyFixture) { + outcome = await runPhase('reprobe'); + if (outcome.ok) { + const applicationRequests = journeyFixture.requests.filter(request => request.method !== 'OPTIONS'); + const discoveries = applicationRequests.filter(request => request.url === '/api/desktop/discovery'); + const bootstrap = applicationRequests.filter(request => + request.url === '/api/desktop/pairings' + || /^\/api\/desktop\/pairings\/[^/]+\/(?:poll|activate)$/u.test(request.url ?? '') + || /\/browser$/u.test(request.url ?? '')); + const pairingStarts = bootstrap.filter(request => request.url === '/api/desktop/pairings'); + const pairingBrowsers = bootstrap.filter(request => /\/browser$/u.test(request.url ?? '')); + const pairingPolls = bootstrap.filter(request => /\/poll$/u.test(request.url ?? '')); + const pairingActivations = bootstrap.filter(request => /\/activate$/u.test(request.url ?? '')); + const authenticatedRest = applicationRequests.filter(request => + request.socketIo === false + && request.url === '/api/auth/user' + && request.authorization === `Bearer ${journeyFixture.secrets[2]}`); + const authenticatedSockets = applicationRequests.filter(request => + request.socketIo === true + && request.authorization === `Bearer ${journeyFixture.secrets[2]}` + && request.transportScope !== null + && request.socketAuthScope === request.transportScope); + const socketScopes = new Set(authenticatedSockets.map(request => + new URL(request.url, 'http://fixture.invalid').searchParams.get(DESKTOP_TRANSPORT_SCOPE_QUERY))); + const restScopes = new Set(authenticatedRest.map(request => request.transportScope)); + const firstBearer = applicationRequests.findIndex(request => request.authorization !== null); + const firstIdentity = applicationRequests.findIndex(request => request.url === '/api/desktop/discovery'); + const plaintextPersisted = await directoryContainsPlaintext(userDataPath, journeyFixture.secrets); + if (discoveries.length !== 8 + || discoveries.some(request => request.authorization !== null) + || pairingStarts.length !== 3 + || pairingBrowsers.length !== 3 + || pairingPolls.length !== 1 + || pairingActivations.length !== 1 + || bootstrap.some(request => request.authorization !== null) + || authenticatedRest.length < 2 + || authenticatedSockets.length < 2 + || restScopes.size !== 1 + || !restScopes.has(null) + || socketScopes.has(null) + || socketScopes.size < 2 + || plaintextPersisted + || firstIdentity < 0 + || firstBearer <= firstIdentity) { + outcome = { ok: false, category: 'journey-evidence', capture: 'complete', records: [] }; + } + } + } } catch { outcome = { ok: false, category: failurePhase, capture: 'complete', records: [] }; } finally { let cleanup = { ok: true }; + if (journeyFixture) { + try { await journeyFixture.close(); } + catch { cleanup = { ok: false, category: 'fixture-cleanup-failed' }; } + } if (fixture && canonicalTemp && generatedFixtureLeaf) { - cleanup = await removeAuthorizedConnectFixture({ + const directoryCleanup = await removeAuthorizedConnectFixture({ fixture, canonicalTemporaryParent: canonicalTemp, generatedLeaf: generatedFixtureLeaf, }); + if (!directoryCleanup.ok) cleanup = directoryCleanup; } if (!cleanup.ok) { outcome = preservePrimaryWithCleanup(outcome, cleanup); diff --git a/apps/desktop/scripts/windows-packaged-connect-staging.test.mjs b/apps/desktop/scripts/windows-packaged-connect-staging.test.mjs index 862c7fa79..9baa63f5b 100644 --- a/apps/desktop/scripts/windows-packaged-connect-staging.test.mjs +++ b/apps/desktop/scripts/windows-packaged-connect-staging.test.mjs @@ -1262,7 +1262,7 @@ test('the workflow stages before alternate credentials and the harness preflight ); const preflight = harness.indexOf('const staged = await validateWindowsStagedPackage'); - const spawn = harness.indexOf("const child = spawn(binaryPath, ['--disable-gpu'"); + const spawn = harness.indexOf('const child = spawnPackagedConnectBinary'); assert.ok(preflight >= 0 && preflight < spawn, 'ordinary-user package preflight must complete before spawn'); assert.equal((harness.match(/await validateWindowsStagedPackage\(/gu) ?? []).length, 1); assert.equal((harness.match(/await runPackagedConnectLifecycle\(/gu) ?? []).length, 1); diff --git a/apps/desktop/src/credential-service.pairing-browser.test.ts b/apps/desktop/src/credential-service.pairing-browser.test.ts index 1177d5915..e732d32cc 100644 --- a/apps/desktop/src/credential-service.pairing-browser.test.ts +++ b/apps/desktop/src/credential-service.pairing-browser.test.ts @@ -3,7 +3,11 @@ import { mkdtemp, rm } from 'node:fs/promises'; import { tmpdir } from 'node:os'; import { join } from 'node:path'; import { afterEach, describe, it } from 'node:test'; -import { PROPR_API_COMPATIBILITY, PROPR_UI_COMPATIBILITY } from '@propr/shared'; +import { + DESKTOP_TRANSPORT_SCOPE_HEADER, + PROPR_API_COMPATIBILITY, + PROPR_UI_COMPATIBILITY, +} from '@propr/shared'; import { DesktopCredentialService, type DesktopPairingBrowserRequest } from './credential-service'; import { openApprovedDesktopPairingUrl } from './pairing-browser'; import { ProfileStore, type EncryptionProvider } from './profile-store'; @@ -12,6 +16,7 @@ const pairingId = `dpr_${'A'.repeat(22)}`; const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); const origin = 'https://api.example.test'; const approvalUrl = `${origin}/api/desktop/pairings/${pairingId}/browser`; +const instanceToken = `propr_it_${'T'.repeat(43)}`; const temporaryDirectories: string[] = []; const services: DesktopCredentialService[] = []; @@ -26,8 +31,30 @@ const json = (body: unknown, status = 200): Response => new Response(JSON.string status, headers: { 'Content-Type': 'application/json' }, }); +const discovery = { + schemaVersion: 1 as const, + product: 'ProPR', + version: '0.8.15', + apiCompatibility: PROPR_API_COMPATIBILITY, + uiCompatibility: PROPR_UI_COMPATIBILITY, + canonicalEndpoint: null, + publicInstanceIdentity: '123e4567-e89b-42d3-a456-426614174000', + desktopAuthentication: { + protocolVersion: 2 as const, + browserPairing: true, + instanceBearerTokens: true, + socketIoBearerAuthentication: true, + }, +}; + +interface PairingProofOptions { + beforeProvisional?(): void; + onRequest?(request: { url: string; authorization: string | null }): void; +} + const createService = async ( openPairingBrowser: (request: DesktopPairingBrowserRequest) => Promise