Take a token, never a password, outside DAV

Anyone could host a copy of a front end on a server of their own,
collect a person's password there, and replay it as HTTP Basic against
JMAP or the API. Cross-origin rules don't stop that, since a server
isn't a browser, and neither does client registration, since Basic
never goes through OAuth (contract C-23).

JMAP (session, API, upload, download, event source, WebSocket), /api,
/auth/introspect, /auth/userinfo and authenticated /auth/register now
refuse an Authorization: Basic header before looking at the password,
with a 401 whose only challenge is Bearer. A wrong password gets the
same answer as the right one. CalDAV and CardDAV keep Basic, and their
401s still offer it. The sign-in page's /api/auth takes the password in
its body and is unaffected, as is the token endpoint's client
authentication.

Bootstrap and recovery mode accept Basic everywhere, as they keep
permissive CORS. INBUXA_HTTP_BASIC_AUTH=all puts it back everywhere;
dav is the default, and any other value logs a warning and keeps it.
Test builds accept Basic everywhere, since the integration suites sign
in with passwords, and legacy_protocols.py sets the variable.

Tested: unit tests for the paths, and tests/e2e/http_basic_auth.py
against the debug build, 26 checks, including both front ends' sign-in
path and a refused unregistered redirect for an ordinary account.

tests/e2e/http_basic_auth.py

@@ -0,0 +1,294 @@
+#!/usr/bin/env python3
+"""Local end-to-end check of contract C-23: outside DAV, HTTP sign-in is a
+token, never a password.
+
+Run it with `python3 tests/e2e/http_basic_auth.py` after
+`cargo build -p inbuxa`. Needs Docker. Working state goes under target/e2e.
+
+Boots the debug binary and checks that:
+- in bootstrap mode, Basic works on JMAP (as permissive CORS does, C-16);
+- after setup, Basic is refused on JMAP, the API, userinfo and introspection,
+  with a 401 that offers only Bearer, and the password isn't checked;
+- DAV still takes Basic, and its 401 still offers it;
+- a token from the sign-in endpoint (`/api/auth`, the password in the body)
+  and the token endpoint works on JMAP: the path the front ends use, and the
+  one ihasmail-inbuxa's password check relies on;
+- INBUXA_HTTP_BASIC_AUTH=all puts Basic back everywhere, an unknown value
+  keeps the default with a warning, and recovery mode accepts Basic.
+
+Passwords are generated into files under target/e2e and never printed.
+Everything is removed afterwards unless KEEP=1.
+"""
+
+import base64, hashlib, json, os, secrets, shutil, subprocess, sys, time, urllib.error, urllib.parse, urllib.request
+
+ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+DIR = f"{ROOT}/target/e2e"
+NAME = "inbuxa-basic-auth"
+PORT = 18180
+HTTP = f"http://127.0.0.1:{PORT}"
+ADMIN_URL = "http://admin.basic.test"
+REDIRECT = f"{ADMIN_URL}/oauth/callback"
+WEBMAIL_URL = "http://webmail.basic.test"
+WEBMAIL_REDIRECT = f"{WEBMAIL_URL}/api/auth/callback"
+
+failures = []
+WEBMAIL_SECRET = secrets.token_urlsafe(24)
+
+
+def check(cond, what):
+    print(("ok   " if cond else "FAIL ") + what)
+    if not cond:
+        failures.append(what)
+
+
+def secret_file(name, value=None):
+    path = f"{DIR}/secrets/{name}"
+    if value is None:
+        value = secrets.token_urlsafe(24)
+    with open(path, "w") as f:
+        f.write(value)
+    os.chmod(path, 0o600)
+    return value
+
+
+def docker(*args, check_rc=True):
+    return subprocess.run(["docker", *args], capture_output=True, text=True, check=check_rc)
+
+
+def start(env=None):
+    args = ["run", "-d", "--name", NAME, "--user", f"{os.getuid()}:{os.getgid()}",
+            "--entrypoint", "/usr/local/bin/inbuxa",
+            "-v", f"{ROOT}/target/debug/inbuxa:/usr/local/bin/inbuxa:ro",
+            "-v", f"{DIR}/etc-basic:/etc/inbuxa", "-v", f"{DIR}/data-basic:/var/lib/inbuxa",
+            "-p", f"127.0.0.1:{PORT}:8080",
+            # A debug build's workers need more than the default stack.
+            "-e", "RUST_MIN_STACK=16777216",
+            # Registers inbuxa-admin and ihasmail-inbuxa (C-6).
+            "-e", f"INBUXA_ADMIN_URL={ADMIN_URL}", "-e", f"INBUXA_WEBMAIL_URL={WEBMAIL_URL}"]
+    env_file = f"{DIR}/secrets/basic-env"
+    with open(env_file, "w") as f:
+        f.write(f"INBUXA_WEBMAIL_CLIENT_SECRET={WEBMAIL_SECRET}\n")
+        for key, value in (env or {}).items():
+            f.write(f"{key}={value}\n")
+    os.chmod(env_file, 0o600)
+    args += ["--env-file", env_file, "stalwartlabs/stalwart:v0.16.22", "--config", "/etc/inbuxa/config.json"]
+    docker(*args)
+    for _ in range(120):
+        try:
+            urllib.request.urlopen(f"{HTTP}/.well-known/jmap", timeout=2)
+        except urllib.error.HTTPError:
+            return
+        except Exception:
+            time.sleep(1)
+            continue
+        return
+    sys.exit("server didn't come up: " + docker("logs", "--tail", "40", NAME, check_rc=False).stderr)
+
+
+def stop():
+    docker("rm", "-f", NAME, check_rc=False)
+
+
+def restart(env=None):
+    stop()
+    start(env)
+
+
+def basic(user, password):
+    return "Basic " + base64.b64encode(f"{user}:{password}".encode()).decode()
+
+
+def request(path, authorization=None, method="GET", body=None, content_type=None, headers=None):
+    """(status, headers, body) for a request, whatever the status."""
+    req = urllib.request.Request(f"{HTTP}{path}", data=body, method=method)
+    if authorization:
+        req.add_header("Authorization", authorization)
+    if content_type:
+        req.add_header("Content-Type", content_type)
+    for key, value in (headers or {}).items():
+        req.add_header(key, value)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            return resp.status, resp.headers, resp.read()
+    except urllib.error.HTTPError as err:
+        return err.code, err.headers, err.read()
+
+
+def challenges(headers):
+    return sorted(value.split(" ", 1)[0] for value in headers.get_all("WWW-Authenticate") or [])
+
+
+def jmap(authorization, calls):
+    body = json.dumps({"using": ["urn:ietf:params:jmap:core", "urn:inbuxa:jmap:registry"],
+                       "methodCalls": calls}).encode()
+    status, _, raw = request("/jmap/", authorization, "POST", body, "application/json")
+    if status != 200:
+        sys.exit(f"JMAP call failed: {status}")
+    return json.loads(raw)["methodResponses"]
+
+
+def sign_in(user, password, client_id, redirect_uri, verifier):
+    """What the sign-in endpoint answers, the password in the request body."""
+    challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
+    status, _, raw = request("/api/auth", method="POST", content_type="application/json", body=json.dumps({
+        "type": "authCode", "accountName": user, "accountSecret": password,
+        "clientId": client_id, "redirectUri": redirect_uri,
+        "codeChallenge": challenge, "codeChallengeMethod": "S256"}).encode())
+    return json.loads(raw) if status == 200 else {"type": status}
+
+
+def token(user, password):
+    """An access token the way a front end gets one: the sign-in endpoint, then
+    the token endpoint, with PKCE."""
+    verifier = secrets.token_urlsafe(48)
+    answer = sign_in(user, password, "inbuxa-admin", REDIRECT, verifier)
+    if answer.get("type") != "authenticated":
+        return None, answer.get("type") or status
+    status, _, raw = request("/auth/token", method="POST", content_type="application/x-www-form-urlencoded",
+                             body=urllib.parse.urlencode({
+                                 "grant_type": "authorization_code", "client_id": "inbuxa-admin",
+                                 "code": answer["client_code"], "redirect_uri": REDIRECT,
+                                 "code_verifier": verifier}).encode())
+    if status != 200:
+        return None, status
+    return json.loads(raw)["access_token"], "authenticated"
+
+
+def propfind(path, authorization):
+    return request(path, authorization, "PROPFIND", b'<?xml version="1.0"?><propfind xmlns="DAV:"><prop><resourcetype/></prop></propfind>',
+                   "application/xml", {"Depth": "0"})
+
+
+def main():
+    stop()
+    for sub in ("etc-basic", "data-basic"):
+        shutil.rmtree(f"{DIR}/{sub}", ignore_errors=True)
+    for sub in ("etc-basic", "data-basic", "secrets"):
+        os.makedirs(f"{DIR}/{sub}", exist_ok=True)
+    os.chmod(f"{DIR}/secrets", 0o700)
+
+    # Bootstrap mode: Basic works on JMAP, as it must for the setup wizard.
+    recovery = secret_file("basic-recovery")
+    start({"INBUXA_RECOVERY_ADMIN": f"admin:{recovery}"})
+    status, _, _ = request("/jmap/session", basic("admin", recovery))
+    check(status == 200, "bootstrap mode: Basic works on JMAP")
+    got = jmap(basic("admin", recovery), [["x:Bootstrap/get", {"ids": None}, "0"]])
+    singleton = got[0][1]["list"][0]["id"]
+    res = jmap(basic("admin", recovery), [["x:Bootstrap/set", {"update": {singleton: {
+        "serverHostname": "mail.basic.test", "defaultDomain": "basic.test",
+        "requestTlsCertificate": False}}}, "0"]])
+    updated = res[0][1].get("updated", {}).get(singleton)
+    check(bool(updated), "bootstrap completed")
+    if not updated:
+        sys.exit(json.dumps(res))
+    admin, admin_pw = updated["username"], secret_file("basic-admin", updated["secret"])
+
+    # After setup, the default: Basic on DAV only. What follows needs a
+    # tracer to stdout, to read warnings back, and an account without
+    # administrator rights, which skip client checks (OAuthClientOverride).
+    # Both are made with a token, since Basic no longer reaches JMAP.
+    restart()
+    admin_token, how = token(admin, admin_pw)
+    if not admin_token:
+        sys.exit(f"no token for the administrator: {how}")
+    domain = jmap(f"Bearer {admin_token}", [["x:Domain/get", {"ids": None}, "0"]])[0][1]["list"][0]["id"]
+    user, user_pw = "[email protected]", secret_file("basic-user")
+    res = jmap(f"Bearer {admin_token}", [
+        ["x:Tracer/set", {"create": {"t": {"@type": "Stdout", "level": "info", "buffered": False, "ansi": False}}}, "0"],
+        ["x:Account/set", {"create": {"a": {"@type": "User", "name": "u", "domainId": domain,
+                                            "credentials": {"0": {"@type": "Password", "secret": user_pw}}}}}, "1"]])
+    if not (res[0][1].get("created") or {}).get("t") or not (res[1][1].get("created") or {}).get("a"):
+        sys.exit("setup failed: " + json.dumps(res))
+    restart()
+    right, wrong = basic(admin, admin_pw), basic(admin, "not-the-password")
+    status, headers, _ = request("/jmap/session", right)
+    check(status == 401, "Basic with the right password is refused on /jmap/session")
+    check(challenges(headers) == ["Bearer"], f"that 401 offers only Bearer ({challenges(headers)})")
+    status, _, _ = request("/jmap/", right, "POST", b'{"using":[],"methodCalls":[]}', "application/json")
+    check(status == 401, "Basic is refused on a JMAP API call")
+    status, headers, _ = request("/jmap/", None, "POST", b'{"using":[],"methodCalls":[]}', "application/json")
+    check(status == 401 and challenges(headers) == ["Bearer"],
+          f"an unauthenticated JMAP call's 401 offers only Bearer ({challenges(headers)})")
+    for path in ("/api/account", "/auth/userinfo"):
+        status, headers, _ = request(path, right)
+        check(status == 401 and challenges(headers) == ["Bearer"], f"Basic is refused on {path}")
+    status, _, _ = request("/auth/introspect", right, "POST", b"token=x", "application/x-www-form-urlencoded")
+    check(status == 401, "Basic is refused on /auth/introspect")
+
+    # Refused before the password is looked at, so the answer is the same
+    # either way and can't be used to guess one.
+    status_right, headers_right, body_right = request("/jmap/session", right)
+    status_wrong, headers_wrong, body_wrong = request("/jmap/session", wrong)
+    check((status_wrong, challenges(headers_wrong), body_wrong) == (status_right, challenges(headers_right), body_right),
+          "a wrong password over Basic gets exactly the same answer as the right one")
+
+    # DAV keeps Basic.
+    status, _, _ = propfind(f"/dav/card/{admin}/", right)
+    check(status == 207, f"Basic works on CardDAV ({status})")
+    status, _, _ = propfind(f"/dav/cal/{admin}/", right)
+    check(status == 207, f"Basic works on CalDAV ({status})")
+    status, headers, _ = propfind(f"/dav/card/{admin}/", None)
+    check(status == 401 and "Basic" in challenges(headers),
+          f"DAV's 401 still offers Basic ({challenges(headers)})")
+
+    # The front ends' path: the sign-in endpoint and a token.
+    access, how = token(admin, admin_pw)
+    check(access is not None, f"the sign-in endpoint takes the password in its body ({how})")
+    _, how_wrong = token(admin, "not-the-password")
+    check(how_wrong == "failure", f"and says failure for a wrong one ({how_wrong})")
+    if access:
+        status, _, _ = request("/jmap/session", f"Bearer {access}")
+        check(status == 200, "a token works on /jmap/session")
+        status, _, _ = request("/api/account", f"Bearer {access}")
+        check(status == 200, f"a token works on /api/account ({status})")
+
+    # ihasmail-inbuxa's password check before an app password: its own client,
+    # its registered redirect URI, a verifier it throws away.
+    for password, want in ((user_pw, "authenticated"), ("not-the-password", "failure")):
+        got = sign_in(user, password, "ihasmail-inbuxa", WEBMAIL_REDIRECT, secrets.token_urlsafe(48))
+        check(got.get("type") == want, f"the webmail's password check answers {want} ({got.get('type')})")
+    got = sign_in(user, user_pw, "ihasmail-inbuxa", "https://evil.example/cb", secrets.token_urlsafe(48))
+    check(got.get("type") != "authenticated", f"but not to a redirect URI it didn't register ({got.get('type')})")
+
+    # The operator's switch.
+    restart({"INBUXA_HTTP_BASIC_AUTH": "all"})
+    status, _, _ = request("/jmap/session", right)
+    check(status == 200, "INBUXA_HTTP_BASIC_AUTH=all: Basic works on JMAP again")
+    status, headers, _ = request("/jmap/", None, "POST", b'{"using":[],"methodCalls":[]}', "application/json")
+    check("Basic" in challenges(headers), f"and JMAP's 401 offers it again ({challenges(headers)})")
+
+    restart({"INBUXA_HTTP_BASIC_AUTH": "sometimes"})
+    status, _, _ = request("/jmap/session", right)
+    check(status == 401, "an unknown INBUXA_HTTP_BASIC_AUTH keeps Basic refused")
+    logs = docker("logs", NAME, check_rc=False)
+    check("INBUXA_HTTP_BASIC_AUTH" in logs.stdout + logs.stderr, "and says so in the log")
+
+    restart({"INBUXA_HTTP_BASIC_AUTH": "dav"})
+    status, _, _ = request("/jmap/session", right)
+    check(status == 401, "INBUXA_HTTP_BASIC_AUTH=dav is the default")
+
+    # Recovery mode accepts Basic, for the recovery administrator.
+    restart({"INBUXA_RECOVERY_MODE": "1", "INBUXA_RECOVERY_ADMIN": f"admin:{recovery}"})
+    status, _, _ = request("/jmap/session", basic("admin", recovery))
+    check(status == 200, "recovery mode: Basic works on JMAP")
+
+    if os.environ.get("KEEP") != "1":
+        stop()
+        for sub in ("etc-basic", "data-basic"):
+            shutil.rmtree(f"{DIR}/{sub}", ignore_errors=True)
+        for name in ("basic-recovery", "basic-admin", "basic-user", "basic-env"):
+            try:
+                os.remove(f"{DIR}/secrets/{name}")
+            except FileNotFoundError:
+                pass
+
+    print()
+    if failures:
+        print(f"{len(failures)} failed")
+        sys.exit(1)
+    print("all passed")
+
+
+if __name__ == "__main__":
+    main()

tests/e2e/legacy_protocols.py

@@ -90,7 +90,9 @@ def start(env_file=None):
             "-p", f"127.0.0.1:{PORTS['submissions']}:465",
             "-p", f"127.0.0.1:{PORTS['imap']}:993",
             "-p", f"127.0.0.1:{PORTS['pop3']}:995",
-            "-p", f"127.0.0.1:{PORTS['smtp']}:25"]
+            "-p", f"127.0.0.1:{PORTS['smtp']}:25",
+            # This script signs in with passwords over JMAP (contract C-23).
+            "-e", "INBUXA_HTTP_BASIC_AUTH=all"]
     if env_file:
         args += ["--env-file", env_file]
     args += ["stalwartlabs/stalwart:v0.16.22", "--config", "/etc/inbuxa/config.json"]