julien
758d723744
## Summary
Mounts `express-session` + `connect-redis` at bootstrap on top of the shared `ioredis` client, with **AES-256-GCM applied to the full JSON payload before it lands in Redis** (per ADR-0010). The configured middleware is exposed as a NestJS provider (`SESSION_MIDDLEWARE`) and `main.ts` mounts it through `app.get(...)` so it sits on the same Redis connection the rest of the BFF uses — no second client at the bootstrap layer.
Envelope is versioned (`v1.<iv>.<tag>.<ciphertext>`, all base64url) so the algorithm / key derivation can rotate without a flag-day re-encryption. Tamper / wrong-key / unknown-version all raise `SessionDecryptError`; for now the failure is logged via Pino with `event: session.decrypt_failed` — the first-class audit event lands with ADR-0013.
Scope is intentionally **infrastructure only**:
- middleware mounted on every request, `req.session` available downstream
- session id = `crypto.randomBytes(32).toString('base64url')` (256 bits per ADR-0010)
- cookie name: `__Host-portal_session` in production, `portal_session` in dev (the `__Host-` prefix mandates `Secure`, which dev HTTP can't satisfy)
- `httpOnly + sameSite=lax + path=/`; `resave:false`, `saveUninitialized:false`, `rolling:true`
- cookie `maxAge` follows `SESSION_IDLE_TIMEOUT_SECONDS` (default 1800)
- encryption-at-rest active end-to-end
Out of scope, landing in follow-ups: `/auth/callback` populating `req.session.user`, `/me`, `/auth/logout`, the absolute-timeout interceptor, and the `user_sessions:{userId}` secondary index.
## Notable shape choices (ADR-0010 amended in the same commit)
**Full-payload encryption vs. just the `tokens` field.** The first draft of ADR-0010 scoped at-rest encryption to a `tokens` sub-field. The session also carries claims (`oid`, `tid`, `preferred_username`, …) that qualify as PII under GDPR — for an APF-Handicap portal handling health-adjacent data this matters. Encrypting the envelope is strictly stronger and removes the need to classify fields one by one. The ADR text is updated to match.
**`ioredis` + adapter vs. switching the BFF to `node-redis`.** `connect-redis` v9 was rewritten for `node-redis` v4 and no longer accepts `ioredis` directly. Two reasonable paths:
1. **Adapter (chosen)** — keep the shared `ioredis` client; shim the six commands `connect-redis` actually calls (`get`, `set` with `{expiration:{type:'EX',value}}`, `expire`, `del`, `mGet`, `scanIterator`) to the node-redis shape. Smallest blast radius — RedisModule, OBO cache (ADR-0014), future pub/sub all stay on a single Redis library.
2. **Switch RedisModule to `node-redis`** — clean alignment with `connect-redis`'s expectations, but touches every Redis consumer and would itself require an ADR amendment.
The adapter is reversible: if we ever decide to standardise on `node-redis`, deleting one file removes it. Happy to switch if you'd rather take that path.
## Env vars
- `SESSION_ENCRYPTION_KEY` — **mandatory**, AES-256-GCM key (32 bytes after base64url decode). New `assertSessionEncryptionKey()` validator wired in `main.ts` alongside the other pre-flight checks.
- `SESSION_IDLE_TIMEOUT_SECONDS` — optional, default `1800`.
- `SESSION_ABSOLUTE_TIMEOUT_SECONDS` — optional, default `43200` (consumed by the absolute-timeout interceptor in a follow-up).
`.env.example` updated; the three variables are promoted from the "future vars" block to the active section.
## Test plan
- [x] `pnpm nx test portal-bff` — **99/99 pass** (was 62 before this PR; +37 new specs across the 5 new files).
- [x] `pnpm nx build portal-bff` — clean webpack build.
- [x] `pnpm nx lint portal-bff` — clean.
- [x] Prettier-clean for all PR source files.
- [ ] Local smoke test once the next PR wires `/auth/callback` → `req.session.user`; this PR has no user-visible behaviour to exercise on its own.
---------
Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #110
83 lines
3.0 KiB
TypeScript
83 lines
3.0 KiB
TypeScript
import { randomBytes } from 'node:crypto';
|
|
import { SessionDecryptError, decrypt, encrypt } from './session-crypto';
|
|
|
|
const KEY = randomBytes(32);
|
|
const OTHER_KEY = randomBytes(32);
|
|
const PLAINTEXT = JSON.stringify({ user: { oid: 'abc', tid: 'def' }, createdAt: 1714000000000 });
|
|
|
|
describe('session-crypto', () => {
|
|
it('round-trips a payload', () => {
|
|
const ciphertext = encrypt(PLAINTEXT, KEY);
|
|
expect(decrypt(ciphertext, KEY)).toBe(PLAINTEXT);
|
|
});
|
|
|
|
it('produces the v1 envelope shape', () => {
|
|
const ciphertext = encrypt(PLAINTEXT, KEY);
|
|
const parts = ciphertext.split('.');
|
|
expect(parts).toHaveLength(4);
|
|
expect(parts[0]).toBe('v1');
|
|
});
|
|
|
|
it('uses a fresh IV per encryption', () => {
|
|
const a = encrypt(PLAINTEXT, KEY);
|
|
const b = encrypt(PLAINTEXT, KEY);
|
|
expect(a).not.toBe(b);
|
|
// Same plaintext + key + different IV ⇒ different ciphertexts but
|
|
// both decrypt back to the same value.
|
|
expect(decrypt(a, KEY)).toBe(PLAINTEXT);
|
|
expect(decrypt(b, KEY)).toBe(PLAINTEXT);
|
|
});
|
|
|
|
it('rejects ciphertext encrypted under a different key', () => {
|
|
const ciphertext = encrypt(PLAINTEXT, KEY);
|
|
expect(() => decrypt(ciphertext, OTHER_KEY)).toThrow(SessionDecryptError);
|
|
});
|
|
|
|
it('rejects tampered ciphertext (auth tag verification)', () => {
|
|
const ciphertext = encrypt(PLAINTEXT, KEY);
|
|
const parts = ciphertext.split('.');
|
|
// Flip a byte in the ciphertext segment.
|
|
const ct = Buffer.from(parts[3] as string, 'base64url');
|
|
ct[0] = (ct[0] ?? 0) ^ 0xff;
|
|
parts[3] = ct.toString('base64url');
|
|
const tampered = parts.join('.');
|
|
expect(() => decrypt(tampered, KEY)).toThrow(SessionDecryptError);
|
|
});
|
|
|
|
it('rejects a tampered auth tag', () => {
|
|
const ciphertext = encrypt(PLAINTEXT, KEY);
|
|
const parts = ciphertext.split('.');
|
|
const tag = Buffer.from(parts[2] as string, 'base64url');
|
|
tag[0] = (tag[0] ?? 0) ^ 0xff;
|
|
parts[2] = tag.toString('base64url');
|
|
const tampered = parts.join('.');
|
|
expect(() => decrypt(tampered, KEY)).toThrow(SessionDecryptError);
|
|
});
|
|
|
|
it('rejects an unknown version', () => {
|
|
const ciphertext = encrypt(PLAINTEXT, KEY);
|
|
const parts = ciphertext.split('.');
|
|
parts[0] = 'v999';
|
|
expect(() => decrypt(parts.join('.'), KEY)).toThrow(/unsupported version "v999"/);
|
|
});
|
|
|
|
it('rejects a malformed envelope (wrong segment count)', () => {
|
|
expect(() => decrypt('not-even-close', KEY)).toThrow(/malformed envelope/);
|
|
expect(() => decrypt('v1.a.b', KEY)).toThrow(/malformed envelope/);
|
|
});
|
|
|
|
it('rejects an IV of the wrong length', () => {
|
|
const ciphertext = encrypt(PLAINTEXT, KEY);
|
|
const parts = ciphertext.split('.');
|
|
parts[1] = Buffer.alloc(8).toString('base64url');
|
|
expect(() => decrypt(parts.join('.'), KEY)).toThrow(/iv length 8/);
|
|
});
|
|
|
|
it('rejects a tag of the wrong length', () => {
|
|
const ciphertext = encrypt(PLAINTEXT, KEY);
|
|
const parts = ciphertext.split('.');
|
|
parts[2] = Buffer.alloc(8).toString('base64url');
|
|
expect(() => decrypt(parts.join('.'), KEY)).toThrow(/tag length 8/);
|
|
});
|
|
});
|