mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

chore: upgrade Node.js runtime to v24 across codebase #419

Merged
jason.woltje merged 438 commits from fix/auth-frontend-remediation into main 2026-02-17 01:04:47 +00:00
Conversation 0 Commits 438 Files Changed 983 +743
2 changed files with 743 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit cf9a3dc526 - Show all commits

91
apps/api/prisma/migrations/20260207_add_auth_rls_policies/migration.sql Normal file
View File

@@ -0,0 +1,91 @@
-- Row-Level Security (RLS) for Auth Tables
-- This migration adds FORCE ROW LEVEL SECURITY and policies to accounts and sessions tables
-- to ensure users can only access their own authentication data.
--
-- Related: #350 - Add RLS policies to auth tables with FORCE enforcement
-- Design: docs/design/credential-security.md (Phase 1a)
-- =============================================================================
-- ENABLE FORCE RLS ON AUTH TABLES
-- =============================================================================
-- FORCE means the table owner (mosaic) is also subject to RLS policies.
-- This prevents Prisma (connecting as owner) from bypassing policies.
ALTER TABLE accounts ENABLE ROW LEVEL SECURITY;
ALTER TABLE accounts FORCE ROW LEVEL SECURITY;
ALTER TABLE sessions ENABLE ROW LEVEL SECURITY;
ALTER TABLE sessions FORCE ROW LEVEL SECURITY;
-- =============================================================================
-- ACCOUNTS TABLE POLICIES
-- =============================================================================
-- Owner bypass policy: Allow access to all rows ONLY when no RLS context is set
-- This is required for:
-- 1. Prisma migrations that run without RLS context
-- 2. BetterAuth internal operations during authentication flow (when no user context)
-- 3. Database maintenance operations
-- When RLS context IS set (current_user_id() returns non-NULL), this policy does not apply
--
-- NOTE: If connecting as a PostgreSQL superuser (like the default 'mosaic' role),
-- RLS policies are bypassed entirely. For full RLS enforcement, the application
-- should connect as a non-superuser role. See docs/design/credential-security.md
CREATE POLICY accounts_owner_bypass ON accounts
FOR ALL
USING (current_user_id() IS NULL);
-- User access policy: Users can only access their own accounts
-- Uses current_user_id() helper from migration 20260129221004_add_rls_policies
-- This policy applies to all operations: SELECT, INSERT, UPDATE, DELETE
CREATE POLICY accounts_user_access ON accounts
FOR ALL
USING (user_id = current_user_id());
-- =============================================================================
-- SESSIONS TABLE POLICIES
-- =============================================================================
-- Owner bypass policy: Allow access to all rows ONLY when no RLS context is set
-- See note on accounts_owner_bypass policy about superuser limitations
CREATE POLICY sessions_owner_bypass ON sessions
FOR ALL
USING (current_user_id() IS NULL);
-- User access policy: Users can only access their own sessions
CREATE POLICY sessions_user_access ON sessions
FOR ALL
USING (user_id = current_user_id());
-- =============================================================================
-- VERIFICATION TABLE ANALYSIS
-- =============================================================================
-- The verifications table does NOT need RLS policies because:
-- 1. It stores ephemeral verification tokens (email verification, password reset)
-- 2. It has no user_id column - only identifier (email) and value (token)
-- 3. Tokens are short-lived and accessed by token value, not user context
-- 4. BetterAuth manages access control through token validation, not RLS
-- 5. No cross-user data leakage risk since tokens are random and expire
--
-- Therefore, we intentionally do NOT add RLS to verifications table.
-- =============================================================================
-- IMPORTANT: SUPERUSER LIMITATION
-- =============================================================================
-- PostgreSQL superusers (including the default 'mosaic' role) ALWAYS bypass
-- Row-Level Security policies, even with FORCE ROW LEVEL SECURITY enabled.
-- This is a fundamental PostgreSQL security design.
--
-- For production deployments with full RLS enforcement, create a dedicated
-- non-superuser application role:
--
-- CREATE ROLE mosaic_app WITH LOGIN PASSWORD 'secure-password';
-- GRANT CONNECT ON DATABASE mosaic TO mosaic_app;
-- GRANT USAGE ON SCHEMA public TO mosaic_app;
-- GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO mosaic_app;
-- GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO mosaic_app;
--
-- Then update DATABASE_URL to connect as mosaic_app instead of mosaic.
-- The RLS policies will then be properly enforced for application queries.
--
-- See: https://www.postgresql.org/docs/current/ddl-rowsecurity.html

652
apps/api/src/auth/auth-rls.integration.spec.ts Normal file
View File

@@ -0,0 +1,652 @@
/**
* Auth Tables RLS Integration Tests
*
* Tests that RLS policies on accounts and sessions tables correctly
* enforce user-scoped access and prevent cross-user data leakage.
*
* Related: #350 - Add RLS policies to auth tables with FORCE enforcement
*/
import { describe, it, expect, beforeAll, afterAll } from "vitest";
import { PrismaClient, Prisma } from "@prisma/client";
import { randomUUID as uuid } from "crypto";
import { runWithRlsClient, getRlsClient } from "../prisma/rls-context.provider";
describe("Auth Tables RLS Policies", () => {
let prisma: PrismaClient;
const testData: {
users: string[];
accounts: string[];
sessions: string[];
} = {
users: [],
accounts: [],
sessions: [],
};
beforeAll(async () => {
prisma = new PrismaClient();
await prisma.$connect();
// RLS policies are bypassed for superusers
const [{ rolsuper }] = await prisma.$queryRaw<[{ rolsuper: boolean }]>`
SELECT rolsuper FROM pg_roles WHERE rolname = current_user
`;
if (rolsuper) {
throw new Error(
"Auth RLS integration tests require a non-superuser database role. " +
"See migration 20260207_add_auth_rls_policies for setup instructions."
);
}
});
afterAll(async () => {
// Clean up test data
if (testData.sessions.length > 0) {
await prisma.session.deleteMany({
where: { id: { in: testData.sessions } },
});
}
if (testData.accounts.length > 0) {
await prisma.account.deleteMany({
where: { id: { in: testData.accounts } },
});
}
if (testData.users.length > 0) {
await prisma.user.deleteMany({
where: { id: { in: testData.users } },
});
}
await prisma.$disconnect();
});
async function createTestUser(email: string): Promise<string> {
const userId = uuid();
await prisma.user.create({
data: {
id: userId,
email,
name: `Test User ${email}`,
authProviderId: `auth-${userId}`,
},
});
testData.users.push(userId);
return userId;
}
async function createTestAccount(userId: string, token: string): Promise<string> {
const accountId = uuid();
await prisma.account.create({
data: {
id: accountId,
userId,
accountId: `account-${accountId}`,
providerId: "test-provider",
accessToken: token,
},
});
testData.accounts.push(accountId);
return accountId;
}
async function createTestSession(userId: string): Promise<string> {
const sessionId = uuid();
await prisma.session.create({
data: {
id: sessionId,
userId,
token: `session-${sessionId}-${Date.now()}`,
expiresAt: new Date(Date.now() + 86400000),
},
});
testData.sessions.push(sessionId);
return sessionId;
}
describe("Account table RLS", () => {
it("should allow user to read their own accounts when RLS context is set", async () => {
const user1Id = await createTestUser("account-read-own@test.com");
const account1Id = await createTestAccount(user1Id, "user1-token");
// Use runWithRlsClient to set RLS context
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const accounts = await client.account.findMany({
where: { userId: user1Id },
});
return accounts;
});
});
expect(result).toHaveLength(1);
expect(result[0].id).toBe(account1Id);
expect(result[0].accessToken).toBe("user1-token");
});
it("should prevent user from reading other users accounts", async () => {
const user1Id = await createTestUser("account-read-self@test.com");
const user2Id = await createTestUser("account-read-other@test.com");
await createTestAccount(user1Id, "user1-token");
await createTestAccount(user2Id, "user2-token");
// Set RLS context for user1, try to read user2's accounts
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const accounts = await client.account.findMany({
where: { userId: user2Id },
});
return accounts;
});
});
// Should return empty array due to RLS policy
expect(result).toHaveLength(0);
});
it("should prevent direct access by ID to other users accounts", async () => {
const user1Id = await createTestUser("account-id-self@test.com");
const user2Id = await createTestUser("account-id-other@test.com");
await createTestAccount(user1Id, "user1-token");
const account2Id = await createTestAccount(user2Id, "user2-token");
// Set RLS context for user1, try to read user2's account by ID
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const account = await client.account.findUnique({
where: { id: account2Id },
});
return account;
});
});
// Should return null due to RLS policy
expect(result).toBeNull();
});
it("should allow user to create their own accounts", async () => {
const user1Id = await createTestUser("account-create-own@test.com");
// Set RLS context for user1, create their own account
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const newAccount = await client.account.create({
data: {
id: uuid(),
userId: user1Id,
accountId: "new-account",
providerId: "test-provider",
accessToken: "new-token",
},
});
testData.accounts.push(newAccount.id);
return newAccount;
});
});
expect(result).toBeDefined();
expect(result.userId).toBe(user1Id);
expect(result.accessToken).toBe("new-token");
});
it("should prevent user from creating accounts for other users", async () => {
const user1Id = await createTestUser("account-create-self@test.com");
const user2Id = await createTestUser("account-create-other@test.com");
// Set RLS context for user1, try to create an account for user2
await expect(
prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const newAccount = await client.account.create({
data: {
id: uuid(),
userId: user2Id, // Trying to create for user2 while logged in as user1
accountId: "hacked-account",
providerId: "test-provider",
accessToken: "hacked-token",
},
});
testData.accounts.push(newAccount.id);
return newAccount;
});
})
).rejects.toThrow();
});
it("should allow user to update their own accounts", async () => {
const user1Id = await createTestUser("account-update-own@test.com");
const account1Id = await createTestAccount(user1Id, "original-token");
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const updated = await client.account.update({
where: { id: account1Id },
data: { accessToken: "updated-token" },
});
return updated;
});
});
expect(result.accessToken).toBe("updated-token");
});
it("should prevent user from updating other users accounts", async () => {
const user1Id = await createTestUser("account-update-self@test.com");
const user2Id = await createTestUser("account-update-other@test.com");
await createTestAccount(user1Id, "user1-token");
const account2Id = await createTestAccount(user2Id, "user2-token");
// Set RLS context for user1, try to update user2's account
await expect(
prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
await client.account.update({
where: { id: account2Id },
data: { accessToken: "hacked-token" },
});
});
})
).rejects.toThrow();
});
it("should prevent user from deleting other users accounts", async () => {
const user1Id = await createTestUser("account-delete-self@test.com");
const user2Id = await createTestUser("account-delete-other@test.com");
await createTestAccount(user1Id, "user1-token");
const account2Id = await createTestAccount(user2Id, "user2-token");
// Set RLS context for user1, try to delete user2's account
await expect(
prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
await client.account.delete({
where: { id: account2Id },
});
});
})
).rejects.toThrow();
// Verify the record still exists and wasn't deleted
const stillExists = await prisma.account.findUnique({ where: { id: account2Id } });
expect(stillExists).not.toBeNull();
expect(stillExists?.userId).toBe(user2Id);
});
it("should allow user to delete their own accounts", async () => {
const user1Id = await createTestUser("account-delete-own@test.com");
const account1Id = await createTestAccount(user1Id, "user1-token");
// Set RLS context for user1, delete their own account
await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
await client.account.delete({
where: { id: account1Id },
});
});
});
// Verify the record was actually deleted
const deleted = await prisma.account.findUnique({ where: { id: account1Id } });
expect(deleted).toBeNull();
});
});
describe("Session table RLS", () => {
it("should allow user to read their own sessions when RLS context is set", async () => {
const user1Id = await createTestUser("session-read-own@test.com");
const session1Id = await createTestSession(user1Id);
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const sessions = await client.session.findMany({
where: { userId: user1Id },
});
return sessions;
});
});
expect(result).toHaveLength(1);
expect(result[0].id).toBe(session1Id);
});
it("should prevent user from reading other users sessions", async () => {
const user1Id = await createTestUser("session-read-self@test.com");
const user2Id = await createTestUser("session-read-other@test.com");
await createTestSession(user1Id);
await createTestSession(user2Id);
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const sessions = await client.session.findMany({
where: { userId: user2Id },
});
return sessions;
});
});
// Should return empty array due to RLS policy
expect(result).toHaveLength(0);
});
it("should prevent direct access by ID to other users sessions", async () => {
const user1Id = await createTestUser("session-id-self@test.com");
const user2Id = await createTestUser("session-id-other@test.com");
await createTestSession(user1Id);
const session2Id = await createTestSession(user2Id);
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const session = await client.session.findUnique({
where: { id: session2Id },
});
return session;
});
});
// Should return null due to RLS policy
expect(result).toBeNull();
});
it("should allow user to create their own sessions", async () => {
const user1Id = await createTestUser("session-create-own@test.com");
// Set RLS context for user1, create their own session
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const newSession = await client.session.create({
data: {
id: uuid(),
userId: user1Id,
token: `new-session-${Date.now()}`,
expiresAt: new Date(Date.now() + 86400000),
},
});
testData.sessions.push(newSession.id);
return newSession;
});
});
expect(result).toBeDefined();
expect(result.userId).toBe(user1Id);
expect(result.token).toContain("new-session");
});
it("should prevent user from creating sessions for other users", async () => {
const user1Id = await createTestUser("session-create-self@test.com");
const user2Id = await createTestUser("session-create-other@test.com");
// Set RLS context for user1, try to create a session for user2
await expect(
prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const newSession = await client.session.create({
data: {
id: uuid(),
userId: user2Id, // Trying to create for user2 while logged in as user1
token: `hacked-session-${Date.now()}`,
expiresAt: new Date(Date.now() + 86400000),
},
});
testData.sessions.push(newSession.id);
return newSession;
});
})
).rejects.toThrow();
});
it("should allow user to update their own sessions", async () => {
const user1Id = await createTestUser("session-update-own@test.com");
const session1Id = await createTestSession(user1Id);
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const updated = await client.session.update({
where: { id: session1Id },
data: { ipAddress: "192.168.1.1" },
});
return updated;
});
});
expect(result.ipAddress).toBe("192.168.1.1");
});
it("should prevent user from updating other users sessions", async () => {
const user1Id = await createTestUser("session-update-self@test.com");
const user2Id = await createTestUser("session-update-other@test.com");
await createTestSession(user1Id);
const session2Id = await createTestSession(user2Id);
await expect(
prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
await client.session.update({
where: { id: session2Id },
data: { ipAddress: "10.0.0.1" },
});
});
})
).rejects.toThrow();
});
it("should prevent user from deleting other users sessions", async () => {
const user1Id = await createTestUser("session-delete-self@test.com");
const user2Id = await createTestUser("session-delete-other@test.com");
await createTestSession(user1Id);
const session2Id = await createTestSession(user2Id);
await expect(
prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
await client.session.delete({
where: { id: session2Id },
});
});
})
).rejects.toThrow();
// Verify the record still exists and wasn't deleted
const stillExists = await prisma.session.findUnique({ where: { id: session2Id } });
expect(stillExists).not.toBeNull();
expect(stillExists?.userId).toBe(user2Id);
});
it("should allow user to delete their own sessions", async () => {
const user1Id = await createTestUser("session-delete-own@test.com");
const session1Id = await createTestSession(user1Id);
// Set RLS context for user1, delete their own session
await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
await client.session.delete({
where: { id: session1Id },
});
});
});
// Verify the record was actually deleted
const deleted = await prisma.session.findUnique({ where: { id: session1Id } });
expect(deleted).toBeNull();
});
});
describe("Owner bypass policy", () => {
it("should allow table owner to access all records without RLS context", async () => {
const user1Id = await createTestUser("owner-bypass-1@test.com");
const user2Id = await createTestUser("owner-bypass-2@test.com");
const account1Id = await createTestAccount(user1Id, "token1");
const account2Id = await createTestAccount(user2Id, "token2");
// Don't set RLS context - rely on owner bypass policy
const accounts = await prisma.account.findMany({
where: {
id: { in: [account1Id, account2Id] },
},
});
// Owner should see both accounts
expect(accounts).toHaveLength(2);
});
it("should allow migrations to work without RLS context", async () => {
const userId = await createTestUser("migration-test@test.com");
// This simulates a migration or BetterAuth internal operation
// that doesn't have RLS context set
const newAccount = await prisma.account.create({
data: {
id: uuid(),
userId,
accountId: "migration-test-account",
providerId: "test-migration",
},
});
expect(newAccount.id).toBeDefined();
// Clean up
await prisma.account.delete({
where: { id: newAccount.id },
});
});
});
describe("RLS context isolation", () => {
it("should enforce RLS when context is set, even for table owner", async () => {
const user1Id = await createTestUser("rls-enforce-1@test.com");
const user2Id = await createTestUser("rls-enforce-2@test.com");
const account1Id = await createTestAccount(user1Id, "token1");
const account2Id = await createTestAccount(user2Id, "token2");
// With RLS context set for user1, they should only see their own account
const result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
const accounts = await client.account.findMany({
where: {
id: { in: [account1Id, account2Id] },
},
});
return accounts;
});
});
// Should only see user1's account, not user2's
expect(result).toHaveLength(1);
expect(result[0].id).toBe(account1Id);
});
it("should allow different users to see only their own data in separate contexts", async () => {
const user1Id = await createTestUser("context-user1@test.com");
const user2Id = await createTestUser("context-user2@test.com");
const session1Id = await createTestSession(user1Id);
const session2Id = await createTestSession(user2Id);
// User1 context - query for both sessions, but RLS should only return user1's
const user1Result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user1Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
return client.session.findMany({
where: {
id: { in: [session1Id, session2Id] },
},
});
});
});
// User2 context - query for both sessions, but RLS should only return user2's
const user2Result = await prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_user_id', ${user2Id}::text, true)`;
return runWithRlsClient(tx, async () => {
const client = getRlsClient()!;
return client.session.findMany({
where: {
id: { in: [session1Id, session2Id] },
},
});
});
});
// Each user should only see their own session
expect(user1Result).toHaveLength(1);
expect(user1Result[0].id).toBe(session1Id);
expect(user2Result).toHaveLength(1);
expect(user2Result[0].id).toBe(session2Id);
});
});
});