luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(19): CR-04 scope login lockout to username, add TTL auto-expiry + admin-reset unlock

Browse Source
This commit is contained in:
Lucas Berger
2026-06-17 20:20:43 -04:00
parent 6ef8e03f8c
commit b083cb7193
4 changed files with 108 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/admin.ts
+9 -2
View File
@@ -35,6 +35,7 @@ import {
CredentialValidationError,
} from '../broker/credentialSync.js';
import { hashPassword } from '../auth/localCredentials.js';
import { resetLoginAttempts } from './localAuth.js';
import { COLOR_PALETTE } from '../auth/user.js';
// Side-effect import: brings in the ContextVariableMap augmentation for c.get('user')
import '../auth/devBypass.js';
@@ -220,9 +221,10 @@ adminRouter.post(
const { newPassword } = c.req.valid('json');
// T-19-06: NEVER log newPassword or the request body
// Verify the target user has a local_credentials row (404 if not)
// Verify the target user has a local_credentials row (404 if not).
// Also read the username so we can clear any login lockout for it (CR-04).
const [credRow] = await db
.select({ id: localCredentials.id })
.select({ id: localCredentials.id, username: localCredentials.username })
.from(localCredentials)
.where(eq(localCredentials.userId, targetId))
.limit(1);
@@ -237,6 +239,11 @@ adminRouter.post(
.set({ passwordHash: hashPassword(newPassword) })
.where(eq(localCredentials.userId, targetId));
// CR-04: an admin password reset must immediately clear any rate-limit / lockout
// state for this username, so a locked-out member regains access at once rather than
// waiting for the TTL. The lockout is keyed on username (not member id).
resetLoginAttempts(credRow.username);
return c.json({ ok: true }, 200);
} catch (err) {
console.error(
apps/api/src/routes/localAuth.ts
+63 -26
View File
@@ -14,8 +14,16 @@
* - Dummy-hash timing defense: verifyPassword is always called, even for unknown usernames,
* to prevent timing-oracle username enumeration attacks (T-19-12 / RESEARCH Pitfall 2).
* - Same 401 body for wrong password AND unknown username — no field discrimination (T-19-12).
* - Per-IP in-memory rate-limiting: 5 failures → 429; 10 failures → 423 (T-19-11).
* - Lockout (423) cleared only by admin password reset — no self-service unlock.
* - Per-USERNAME in-memory rate-limiting: 5 failures → 429; 10 failures → 423 (T-19-11).
* - Lockout (423) auto-expires after LOCKOUT_TTL_MS (CR-04) so a single attacker cannot
* permanently deny login for the whole household, and no process restart is needed to
* recover. Admin password reset still clears it immediately (resetLoginAttempts).
*
* CR-04: the limiter is keyed on the submitted username, NOT the client IP. In this
* deployment all household traffic egresses the Pangolin tunnel with the same
* X-Forwarded-For first hop, so IP-keying made one bad actor (or one fat-fingered user)
* able to lock out every member, and X-Forwarded-For is attacker-spoofable. Username-keying
* scopes the lockout to the identity actually under attack and the TTL makes it self-healing.
*/
import { Hono } from 'hono';
@@ -52,22 +60,42 @@ const loginSchema = z.object({
});
// ---------------------------------------------------------------------------
// Per-IP rate-limiting state (in-memory Map — household scale, no Redis needed).
// Per-USERNAME rate-limiting state (in-memory Map — household scale, no Redis needed).
//
// State shape per IP: { count, lockedUntil (epoch ms), lockedOut (bool) }
// State shape per username: { count, lockedUntil (epoch ms), lockedOut (bool), lockedAt (epoch ms) }
// count >= RATE_WINDOW_FAILURES AND Date.now() < lockedUntil → 429
// count >= LOCKOUT_FAILURES → 423 (permanent until admin reset)
// count >= LOCKOUT_FAILURES → 423 (until LOCKOUT_TTL_MS elapses OR admin reset)
// Success → delete entry (clears counter)
//
// RATE_WINDOW_FAILURES: 5 failures → 60s cooldown (429)
// LOCKOUT_FAILURES: 10 failures → account locked (423)
// LOCKOUT_TTL_MS: 15 min after which a 423 lockout auto-expires (CR-04)
//
// CR-04: keyed on the validated username (not the client IP) so a lockout is scoped to
// the identity under attack, and self-heals after LOCKOUT_TTL_MS without a restart.
// ---------------------------------------------------------------------------
export const loginAttempts = new Map<string, { count: number; lockedUntil: number; lockedOut: boolean }>();
export const loginAttempts = new Map<
string,
{ count: number; lockedUntil: number; lockedOut: boolean; lockedAt: number }
>();
const RATE_WINDOW_FAILURES = 5;
const RATE_WINDOW_SECS = 60;
const LOCKOUT_FAILURES = 10;
const LOCKOUT_TTL_MS = 15 * 60 * 1000; // CR-04: 423 lockout auto-expires after 15 minutes
/**
* Immediately clear any rate-limit / lockout state for a username (CR-04).
*
* Called by the admin password-reset path so a reset is an instant unlock and the
* lockout is not "unrecoverable without a process restart". Safe to call for an
* unknown username (no-op). Normalizes the username the same way the login schema
* does (trim) so the key matches what the limiter stored.
*/
export function resetLoginAttempts(username: string): void {
loginAttempts.delete(username.trim());
}
// Pre-computed dummy hash used to run verifyPassword on unknown-username paths
// (timing defense — prevents timing-oracle username enumeration, RESEARCH Pitfall 2).
@@ -79,34 +107,42 @@ const DUMMY_HASH = hashPassword('dummy-constant-time-filler-xyzzy');
// ---------------------------------------------------------------------------
localAuthRouter.post('/local/login', zValidator('json', loginSchema, noEchoHook), async (c) => {
// Derive client IP from Pangolin-set X-Forwarded-For header; fall back to host header.
const ip = c.req.header('x-forwarded-for')?.split(',')[0]?.trim()
?? c.req.raw.headers.get('host')
?? 'unknown';
// CR-04: the rate-limit / lockout key is the validated, normalized username — NOT the
// client IP. zValidator has already run, so c.req.valid('json') is available here.
const { username, password } = c.req.valid('json');
const key = username; // loginSchema .trim()s the username; the map key matches resetLoginAttempts
const attempt = loginAttempts.get(ip);
const now = Date.now();
const attempt = loginAttempts.get(key);
// 423: account locked (>= LOCKOUT_FAILURES total failures, admin must reset)
// Check lockedOut FIRST — lockout takes precedence over rate window.
// 423: account locked (>= LOCKOUT_FAILURES failures). CR-04: the lockout auto-expires
// after LOCKOUT_TTL_MS so a single attacker cannot deny login indefinitely and no restart
// is required to recover. On expiry, drop the entry so the next attempt starts clean.
if (attempt?.lockedOut) {
return c.json({ error: 'Account locked' }, 423);
if (now - attempt.lockedAt >= LOCKOUT_TTL_MS) {
loginAttempts.delete(key);
} else {
return c.json({ error: 'Account locked' }, 423);
}
}
// Re-read after a possible expiry-delete above.
const live = loginAttempts.get(key);
// 429: rate window — >= RATE_WINDOW_FAILURES failures within the cooldown window.
// Increment the counter even on 429 so continued brute-force accumulates toward lockout.
if (attempt && attempt.count >= RATE_WINDOW_FAILURES && Date.now() < attempt.lockedUntil) {
attempt.count += 1;
attempt.lockedUntil = Date.now() + RATE_WINDOW_SECS * 1000;
attempt.lockedOut = attempt.count >= LOCKOUT_FAILURES;
loginAttempts.set(ip, attempt);
if (attempt.lockedOut) {
if (live && live.count >= RATE_WINDOW_FAILURES && now < live.lockedUntil) {
live.count += 1;
live.lockedUntil = now + RATE_WINDOW_SECS * 1000;
live.lockedOut = live.count >= LOCKOUT_FAILURES;
if (live.lockedOut) live.lockedAt = now;
loginAttempts.set(key, live);
if (live.lockedOut) {
return c.json({ error: 'Account locked' }, 423);
}
return c.json({ error: 'Too many attempts' }, 429);
}
const { username, password } = c.req.valid('json');
// Look up local_credentials by username
let cred: { userId: number; passwordHash: string } | undefined;
try {
@@ -129,18 +165,19 @@ localAuthRouter.post('/local/login', zValidator('json', loginSchema, noEchoHook)
: verifyPassword(DUMMY_HASH, password);
if (!valid || !cred) {
// Increment failure counter
const cur = loginAttempts.get(ip) ?? { count: 0, lockedUntil: 0, lockedOut: false };
// Increment failure counter (keyed on username)
const cur = loginAttempts.get(key) ?? { count: 0, lockedUntil: 0, lockedOut: false, lockedAt: 0 };
cur.count += 1;
cur.lockedUntil = Date.now() + RATE_WINDOW_SECS * 1000;
cur.lockedOut = cur.count >= LOCKOUT_FAILURES;
loginAttempts.set(ip, cur);
if (cur.lockedOut && cur.lockedAt === 0) cur.lockedAt = Date.now();
loginAttempts.set(key, cur);
// Same 401 body for wrong password AND unknown username — no field discrimination (T-19-12)
return c.json({ error: 'Invalid credentials' }, 401);
}
// Success: clear failure counter, issue the local-session JWT cookie, return ok
loginAttempts.delete(ip);
loginAttempts.delete(key);
try {
await issueLocalSessionCookie(c, cred.userId);
} catch (err) {