3 commits

Author	SHA1	Message	Date
ScreenTinker	c91b96ab91	SSO: refuse delegated proof names, release lapsed and deleted claims ... Third review pass. It confirmed the crash wrapper holds (~13,000 hostile requests, no fourth crash), the SSRF rewrite holds (77 vectors, every CIDR boundary proven), the rate-limiter rewrite closed the login brute-force bypass, and /sso/claim rejects every wrong token kind. It also found that two things I built yesterday did not do what they claimed. THE 8-HOUR LIMIT DID NOT BOUND SQUATTING Pressing Verify on an expired claim REISSUED it in place, renewing the clock — so one request per window held a domain forever, through the endpoint meant to enforce the limit. Worse, a renewal was not a new claim, so the operator was notified exactly once, on day zero: a tenant could sit on a company's domain for a year off a single stale alert. A lapsed claim is now RELEASED. Re-adding it is an ordinary new claim: new token, and the operator is told again. Squatting is not impossible; it is loud. A DELEGATED PROOF NAME COULD FORGE A DOMAIN A TXT lookup follows CNAMEs, and RFC 4592 means a wildcard `*.victim.com` synthesizes `_screentinker-verify.victim.com` too — so a wildcard CNAME let whoever controls its target prove a domain they do not own, turning an ordinary subdomain takeover into every `@victim.com` login. A reviewer did this against a real authoritative zone. The proof name is now refused if it is a CNAME, which is stricter than ACME's dns-01, and the comment that claimed wildcards "cannot be mistaken for a proof" — true only for wildcard TXT — has been corrected. MY VERIFY BUTTON REPORTED FAILURE ON SUCCESS `await load()` — the loader is `loadSso()`. The ReferenceError went into a bare catch, so a correct DNS proof showed "Could not verify that domain" and left the card stale. On the expired branch the admin kept publishing a token the server had already rotated. ALSO FIXED - deleting a provider stranded its verified domains (no FK, UNIQUE, never expires) so the domain was blocked for EVERY org forever with no in-product recovery, and its users could neither sign in nor reset. Delete now releases the domains and returns the accounts to local, in one transaction; a cascade FK backstops it. - isOrphanedFederated read absence-of-config as proof-of-deletion, so unsetting GOOGLE_CLIENT_ID made every Google account password-resettable instance-wide, and irreversibly. Restricted to org-provider slugs. - `email_domains: null` (not undefined) took the destructive branch and deleted every DNS proof an organization had. - unbounded domain lists: 400 domains sent 401 emails; now capped at 50, one digest per save, and /api/organizations is rate-limited at all for the first time. - login and register responses carried password_reset_hash and email_verify_hash — live account-takeover credentials handed to the browser. One sanitiser now. - trailing-dot hostname (`https://localhost./`) slipped the SSRF guard. - asyncRoute's own catch could throw and kill the process it exists to protect. - a legacy DB whose typed domains were never verified now says so LOUDLY at boot instead of silently locking every federated user out. TESTS Two of the previous round's tests passed against the code they were named after: one asserted UNIQUE against the test harness's own CREATE TABLE rather than the shipped schema, the other used two different domains so no ordering was exercised. Both replaced and confirmed load-bearing. Seven mutations now turn the suite red, including removing the CNAME refusal, the verified_at filter, and the expiry itself. 1598 tests pass. Delete-release, lapse-release and the leak fix verified against a running server. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bvjey4FNam49MN7ybjcq6A	2026-08-10 21:01:26 -05:00
ScreenTinker	9155370ae8	SSO: TXT only for domain proof, drop the CNAME form ... The CNAME alternative pointed at `<token>.verify.screentinker.com`. Making that work means operating a wildcard DNS zone that answers for every token ever issued — which this project does not have, so half the published instructions described a check that could never pass. Documenting a verification path that cannot succeed is worse than offering one form. TXT needs nothing outside the customer's own zone, and the dedicated `_`-prefixed name keeps it away from the apex where SPF and DMARC live. A wildcard `*.example.com` cannot be mistaken for a proof either way: it answers with its own value, never the token, so it lands in "exists but does not match". Also simplifies check() — one lookup, no Promise.allSettled, and NXDOMAIN is reported as "not published yet" rather than as an error. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bvjey4FNam49MN7ybjcq6A	2026-08-10 20:27:03 -05:00
ScreenTinker	d4b8d7dad4	SSO: prove domain ownership by DNS, and fix what the second review found ... A second review pass, run against the previous commit, found four blockers — two of them introduced by the fixes in that commit. It also confirmed the original account takeover is closed: a hostile IdP with real TLS, discovery, JWKS and RS256 driving the real routers now stops at domain_not_allowed, and all 16 bypass variants are refused. DOMAIN OWNERSHIP (the root cause, not the symptom) A claimed domain used to mean "nobody else claimed it". It now means the organization published a record in that domain's own DNS — TXT or CNAME, at a dedicated _screentinker-verify name rather than the apex, where an edit would sit beside SPF. - an unverified domain routes NOBODY and cannot be asserted; it reserves the name - an unverified claim LAPSES after 8 hours, so a domain cannot be held against its real owner, and lapsing rotates the token so a record left over from an abandoned attempt cannot satisfy a later claim - a verified domain never expires — re-proving on a timer would log a customer out over a DNS edit made months later - routing and confinement read the VERIFIED set only, never the typed column - configuring SSO now requires a verified email address - platform admins are emailed when a domain is claimed; nothing is ever sent to the claimed domain, which would let any tenant make this product email third parties Instance-wide providers are exempt from all of it: they are the operator's own configuration and keep the trust they have always had. BLOCKERS FROM THE REVIEW - two unauthenticated remote crashes, both one request, both "async handler throws before its try": `Cookie: st_oidc_tx=%` (unguarded decodeURIComponent) and the fail-closed secret added last commit, which turned a JWT_SECRET rotation into a permanent crash loop. Fixed the CLASS with asyncRoute() rather than the instances. - the SSRF guard was bypassable via IPv4-mapped IPv6 ([::ffff:127.0.0.1]) and also refused every host beginning "fc"/"fd" (fcm.googleapis.com). Addresses are now parsed and compared by RANGE. 42 cases verified. - the takeover fix had NO test — the test named after it asserted two struct fields and passed with the guard deleted. The decision is now a pure function and four mutations were confirmed to turn the suite red. - the PUT path never received the TOCTOU fix, so two orgs could end up holding one domain and forEmail handed routing to the attacker's older row. ALSO - linking compared slugs, so an org could never rotate its own IdP, and fell open on an empty auth_provider. It now asks which ORGANIZATION owns the slug. - an account stranded by a deleted provider can be reclaimed by password reset — proof of the mailbox, which is stronger than the IdP assertion that created it. - /sso/claim accepted a pre-TOTP mfa_pending token and returned the full user row; it now takes a purpose-built 120s claim token with a pinned algorithm and typ. - the rate limiter keyed on a caller-controlled path, so a trailing slash bought a fresh bucket — a real login brute-force bypass. - domain_not_allowed and account_exists_other_provider rendered as "please try again", advice that can never work. - malformed asserted addresses are refused rather than trimmed into shape. - dead config (microsoftTenantId defaulted to 'common', which the provider code now refuses) and the orphaned google-auth-library dependency removed. 1591 tests pass. Domain lifecycle verified end to end against a running server. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bvjey4FNam49MN7ybjcq6A	2026-08-10 19:23:46 -05:00