fix(auth): harden subject delegation and cookies

Author: TheodoreSpeaks

apps/sim/lib/auth/internal.test.ts

@@ -2,9 +2,11 @@
  * @vitest-environment node
  */
 
+import { serializePrincipal } from '@sim/auth/principal'
 import { resetEnvMock } from '@sim/testing'
-import { decodeJwt } from 'jose'
+import { decodeJwt, SignJWT } from 'jose'
 import { afterAll, describe, expect, it, vi } from 'vitest'
+import { env } from '@/lib/core/config/env'
 
 vi.unmock('@/lib/auth/internal')
 
@@ -135,7 +137,32 @@ describe('internal executor delegation claims', () => {
     })
   })
 
-  it('rejects laundering actorless or external principals into a Sim user subject', async () => {
+  it('round-trips an authenticated chat subject without inventing a Sim user', async () => {
+    const token = await generateInternalDelegationToken({
+      workflowId: 'workflow-1',
+      principal: {
+        kind: 'system',
+        serviceId: 'chat',
+        workspaceId: 'workspace-1',
+        workflowId: 'workflow-1',
+        subject: { kind: 'authenticated_email', email: 'person@example.com' },
+      },
+    })
+
+    await expect(verifyInternalDelegationToken(token)).resolves.toMatchObject({
+      workflowId: 'workflow-1',
+      principal: {
+        kind: 'system',
+        serviceId: 'chat',
+        workspaceId: 'workspace-1',
+        workflowId: 'workflow-1',
+        subject: { kind: 'authenticated_email', email: 'person@example.com' },
+      },
+    })
+    expect(decodeJwt(token).sub).toBeUndefined()
+  })
+
+  it('rejects laundering actorless or non-Sim principals into a Sim user subject', async () => {
     await expect(
       generateInternalDelegationToken({
         subjectUserId: 'billing-owner',
@@ -167,7 +194,49 @@ describe('internal executor delegation claims', () => {
           },
         },
       })
-    ).rejects.toThrow('External workflow subjects cannot be represented as Sim users')
+    ).rejects.toThrow('Non-Sim workflow subjects cannot be represented as Sim users')
+
+    await expect(
+      generateInternalDelegationToken({
+        subjectUserId: 'unrelated-user',
+        workflowId: 'workflow-1',
+        principal: {
+          kind: 'system',
+          serviceId: 'chat',
+          workspaceId: 'workspace-1',
+          workflowId: 'workflow-1',
+          subject: { kind: 'authenticated_email', email: 'person@example.com' },
+        },
+      })
+    ).rejects.toThrow('Non-Sim workflow subjects cannot be represented as Sim users')
+  })
+
+  it('rejects a signed delegation that pairs a non-Sim principal with a Sim user subject', async () => {
+    const issuedAt = Math.floor(Date.now() / 1000)
+    const token = await new SignJWT({
+      type: 'internal_delegation',
+      serviceId: 'executor',
+      workflowId: 'workflow-1',
+      principal: serializePrincipal({
+        kind: 'system',
+        serviceId: 'chat',
+        workspaceId: 'workspace-1',
+        workflowId: 'workflow-1',
+        subject: { kind: 'authenticated_email', email: 'person@example.com' },
+      }),
+    })
+      .setProtectedHeader({ alg: 'HS256' })
+      .setJti('delegation-1')
+      .setSubject('unrelated-user')
+      .setIssuedAt(issuedAt)
+      .setExpirationTime(issuedAt + 5 * 60)
+      .setIssuer('sim-internal')
+      .setAudience('sim-api')
+      .sign(new TextEncoder().encode(env.INTERNAL_API_SECRET))
+
+    await expect(verifyInternalDelegationToken(token)).rejects.toBeInstanceOf(
+      InvalidInternalDelegationTokenError
+    )
   })
 
   it('derives issued-at and expiry from one timestamp', async () => {

apps/sim/lib/auth/internal.ts

@@ -107,8 +107,8 @@ export async function generateInternalDelegationToken(
     ? requireNonEmptyDelegationClaim(input.subjectUserId, 'subjectUserId')
     : undefined
   const principalSubject = input.principal ? resolvePrincipalSubject(input.principal) : null
-  if (principalSubject?.kind === 'external_user' && suppliedSubjectUserId) {
-    throw new Error('External workflow subjects cannot be represented as Sim users')
+  if (principalSubject && principalSubject.kind !== 'sim_user' && suppliedSubjectUserId) {
+    throw new Error('Non-Sim workflow subjects cannot be represented as Sim users')
   }
   if (!principalSubject && input.principal && suppliedSubjectUserId) {
     throw new Error('Actorless workflow principals cannot be represented as Sim users')
@@ -204,7 +204,7 @@ export async function verifyInternalDelegationToken(
   if (
     (!principal && !subjectUserId) ||
     (principalSubject?.kind === 'sim_user' && principalSubject.userId !== subjectUserId) ||
-    (principalSubject?.kind === 'external_user' && subjectUserId) ||
+    (principalSubject && principalSubject.kind !== 'sim_user' && subjectUserId) ||
     (principal && !principalSubject && subjectUserId)
   ) {
     throw new InvalidInternalDelegationTokenError()

apps/sim/lib/core/security/deployment.test.ts

@@ -1,8 +1,12 @@
 /**
  * @vitest-environment node
  */
+
+import { sha256Hex } from '@sim/security/hash'
+import { hmacSha256Hex } from '@sim/security/hmac'
 import type { NextResponse } from 'next/server'
 import { describe, expect, it, vi } from 'vitest'
+import { env } from '@/lib/core/config/env'
 import {
   isEmailAllowed,
   readDeploymentAuthToken,
@@ -20,6 +24,17 @@ function mintDeploymentAuthToken(
   return set.mock.calls[0][0].value
 }
 
+function mintLegacyDeploymentAuthToken(
+  deploymentId: string,
+  authType: string,
+  encryptedPassword?: string
+): string {
+  const passwordSlot = encryptedPassword ? sha256Hex(encryptedPassword).slice(0, 8) : ''
+  const payload = `${deploymentId}:${authType}:${Date.now()}:${passwordSlot}`
+  const signature = hmacSha256Hex(payload, env.BETTER_AUTH_SECRET)
+  return Buffer.from(`${payload}:${signature}`).toString('base64')
+}
+
 describe('deployment auth tokens', () => {
   it('round-trips the normalized email proven by OTP authentication', () => {
     const token = mintDeploymentAuthToken('chat-1', 'email', ' Person@Example.com ')
@@ -35,6 +50,18 @@ describe('deployment auth tokens', () => {
     expect(readDeploymentAuthToken(token, 'chat-1', 'password')).toEqual({})
   })
 
+  it('accepts a valid legacy password token without inventing identity', () => {
+    const token = mintLegacyDeploymentAuthToken('chat-1', 'password', 'encrypted-password')
+
+    expect(readDeploymentAuthToken(token, 'chat-1', 'password', 'encrypted-password')).toEqual({})
+  })
+
+  it('rejects a legacy email token that cannot prove an email identity', () => {
+    const token = mintLegacyDeploymentAuthToken('chat-1', 'email')
+
+    expect(readDeploymentAuthToken(token, 'chat-1', 'email')).toBeNull()
+  })
+
   it('rejects a token outside its bound deployment and authentication type', () => {
     const token = mintDeploymentAuthToken('chat-1', 'email', 'person@example.com')
 

apps/sim/lib/core/security/deployment.ts

@@ -67,8 +67,8 @@ export function readDeploymentAuthToken(
     if (!safeCompare(sig, signPayload(payload))) return null
 
     const parts = payload.split(':')
-    if (parts.length !== 5) return null
-    const [storedId, storedType, timestamp, storedPwSlot, storedEmailSlot] = parts
+    if (parts.length !== 4 && parts.length !== 5) return null
+    const [storedId, storedType, timestamp, storedPwSlot, storedEmailSlot = ''] = parts
 
     if (storedId !== deploymentId || storedType !== authType) return null
     if (storedPwSlot !== passwordSlot(encryptedPassword)) return null