From 0c77de93b4fdf5948d77ecb414b0fbff2a3a3523 Mon Sep 17 00:00:00 2001 From: Ajay Ghanwat Date: Wed, 26 Aug 2026 19:17:48 +0530 Subject: [PATCH] fix(auth): expire stale MFA forms before accepting codes --- bun.lock | 2 +- packages/auth/assets/client/auth.js | 39 ++++++++++++++++--- .../auth/components/TwoFactorChallenge.wrn | 11 +++++- packages/auth/package.json | 2 +- packages/auth/src/engine.ts | 6 +++ packages/auth/src/types.ts | 2 + packages/auth/test/engine.test.ts | 1 + packages/auth/test/mfa-runtime.test.ts | 30 +++++++++++++- 8 files changed, 82 insertions(+), 11 deletions(-) diff --git a/bun.lock b/bun.lock index e5bfbdfe..cdf7d437 100644 --- a/bun.lock +++ b/bun.lock @@ -235,7 +235,7 @@ }, "packages/auth": { "name": "@wrnexus/auth", - "version": "0.8.22", + "version": "0.8.23", "dependencies": { "@wrnexus/authz": "workspace:*", "@wrnexus/captcha": "workspace:*", diff --git a/packages/auth/assets/client/auth.js b/packages/auth/assets/client/auth.js index 1744ac3f..1ee18894 100644 --- a/packages/auth/assets/client/auth.js +++ b/packages/auth/assets/client/auth.js @@ -413,7 +413,32 @@ const pending = new Map(); let expired = false; let disposed = false; + let expiryTimer; + const expiresAt = Number(saved?.mfaExpiresAt); + const expire = () => { + if (disposed) return; + expired = true; + window.clearTimeout(expiryTimer); + sessionStorage.removeItem(MFA_STORAGE_KEY); + if (tokenInput) tokenInput.value = ""; + form?.querySelectorAll("input, button").forEach((control) => { + control.disabled = true; + }); + setMessage( + status, + "Your sign-in request has expired. Sign in again to get a fresh verification request.", + true, + ); + const restart = element.querySelector("[data-auth-mfa-restart]"); + if (restart) restart.hidden = false; + }; + const checkExpiry = () => { + // Old stored challenges have no verifiable deadline: require fresh sign-in. + if (saved?.mfaToken && (!Number.isFinite(expiresAt) || expiresAt <= Date.now())) expire(); + return expired; + }; const restoreToken = () => { + checkExpiry(); if (!expired && tokenInput && !tokenInput.value && saved?.mfaToken) tokenInput.value = String(saved.mfaToken); }; @@ -433,6 +458,7 @@ const sendCode = async (selected) => { if (disposed || expired || !isOtp(selected)) return; restoreToken(); + if (expired) return; if (!tokenInput?.value) { setMessage(status, "Sign-in verification has expired. Start again.", true); const restart = element.querySelector("[data-auth-mfa-restart]"); @@ -476,10 +502,11 @@ ); } finally { pending.delete(selected); - if (!disposed && method() === selected) setFormBusy(form, false); + if (!disposed && !expired && method() === selected) setFormBusy(form, false); } }; const updateMethod = () => { + if (checkExpiry()) return; const selected = method(); setFormBusy(form, false); if (challengeInput) challengeInput.value = ""; @@ -524,13 +551,12 @@ }; const onError = (event) => { if (event.target !== form || event.detail?.code !== "mfa-transaction-expired") return; - expired = true; - sessionStorage.removeItem(MFA_STORAGE_KEY); - if (tokenInput) tokenInput.value = ""; - const restart = element.querySelector("[data-auth-mfa-restart]"); - if (restart) restart.hidden = false; + expire(); }; updateMethod(); + if (!expired && Number.isFinite(expiresAt)) { + expiryTimer = window.setTimeout(expire, Math.max(0, expiresAt - Date.now())); + } // Capture native change before the shared Radio emits its component output. form?.addEventListener("change", onMethodChange, true); form?.addEventListener("submit", onSubmit, true); @@ -538,6 +564,7 @@ element.addEventListener("wrn:error", onError); flowCleanups.set(element, () => { disposed = true; + window.clearTimeout(expiryTimer); form?.removeEventListener("change", onMethodChange, true); form?.removeEventListener("submit", onSubmit, true); element.removeEventListener("wrn:success", onSuccess); diff --git a/packages/auth/components/TwoFactorChallenge.wrn b/packages/auth/components/TwoFactorChallenge.wrn index 89503234..51529f4f 100644 --- a/packages/auth/components/TwoFactorChallenge.wrn +++ b/packages/auth/components/TwoFactorChallenge.wrn @@ -51,8 +51,15 @@ component TwoFactorChallenge { + `; + window.eval(readFileSync(new URL("../assets/client/auth.js", import.meta.url), "utf8")); + (window as any).WRNexusAuth.mount(window.document); + expect(window.document.querySelector("button")!.disabled).toBe(true); + expect(window.document.querySelector("[data-auth-mfa-restart]")!.hidden).toBe( + false, + ); + expect(window.document.querySelector("[data-auth-mfa-status]")!.textContent).toContain( + "Sign in again", + ); + expect(window.sessionStorage.getItem("wrnexus.auth.mfa")).toBeNull(); + } finally { + await window.happyDOM.close(); + } + } +}); + test("selecting delivery radios sends once, ignores stale responses, and never sends for local methods", async () => { const window = new Window({ url: "https://sso.example.test/mfa" }); try { window.sessionStorage.setItem( "wrnexus.auth.mfa", - JSON.stringify({ mfaToken: "synthetic-test-challenge" }), + JSON.stringify({ mfaToken: "synthetic-test-challenge", mfaExpiresAt: Date.now() + 300_000 }), ); window.document.body.innerHTML = `
@@ -63,6 +90,7 @@ test("MFA radios preserve allowed methods and restore continuation without reviv "wrnexus.auth.mfa", JSON.stringify({ mfaToken: "synthetic-test-challenge", + mfaExpiresAt: Date.now() + 300_000, requires: { mfa: ["totp"] }, }), );