diff --git a/backend/internal/handler/auth_oauth_pending_flow_test.go b/backend/internal/handler/auth_oauth_pending_flow_test.go index 635a56132f..53360036a2 100644 --- a/backend/internal/handler/auth_oauth_pending_flow_test.go +++ b/backend/internal/handler/auth_oauth_pending_flow_test.go @@ -1374,6 +1374,58 @@ func TestCreateOIDCOAuthAccountExistingEmailNormalizesLegacySpacingAndCase(t *te require.Equal(t, "owner@example.com", storedSession.ResolvedEmail) } +func TestCreateOIDCOAuthAccountRejectsEmailOutsideRegistrationSuffixWhitelist(t *testing.T) { + handler, client := newOAuthPendingFlowTestHandlerWithDependencies(t, oauthPendingFlowTestHandlerOptions{ + emailVerifyEnabled: true, + emailCache: &oauthPendingFlowEmailCacheStub{ + verificationCodes: map[string]*service.VerificationCodeData{ + "foo@gmail.com": { + Code: "135790", + CreatedAt: time.Now().UTC(), + ExpiresAt: time.Now().UTC().Add(15 * time.Minute), + }, + }, + }, + settingValues: map[string]string{ + service.SettingKeyRegistrationEmailSuffixWhitelist: `["@qq.com"]`, + }, + }) + ctx := context.Background() + + session, err := client.PendingAuthSession.Create(). + SetSessionToken("suffix-whitelist-session-token"). + SetIntent("login"). + SetProviderType("oidc"). + SetProviderKey("https://issuer.example"). + SetProviderSubject("oidc-suffix-whitelist-123"). + SetBrowserSessionKey("suffix-whitelist-browser-session-key"). + SetUpstreamIdentityClaims(map[string]any{ + "username": "oidc_user", + }). + SetExpiresAt(time.Now().UTC().Add(10 * time.Minute)). + Save(ctx) + require.NoError(t, err) + + body := bytes.NewBufferString(`{"email":"foo@gmail.com","verify_code":"135790","password":"secret-123"}`) + recorder := httptest.NewRecorder() + ginCtx, _ := gin.CreateTestContext(recorder) + req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/oauth/oidc/create-account", body) + req.Header.Set("Content-Type", "application/json") + req.AddCookie(&http.Cookie{Name: oauthPendingSessionCookieName, Value: encodeCookieValue(session.SessionToken)}) + req.AddCookie(&http.Cookie{Name: oauthPendingBrowserCookieName, Value: encodeCookieValue("suffix-whitelist-browser-session-key")}) + ginCtx.Request = req + + handler.CreateOIDCOAuthAccount(ginCtx) + + require.Equal(t, http.StatusBadRequest, recorder.Code) + payload := decodeJSONBody(t, recorder) + require.Equal(t, "EMAIL_SUFFIX_NOT_ALLOWED", payload["reason"]) + + count, err := client.User.Query().Where(dbuser.EmailEQ("foo@gmail.com")).Count(ctx) + require.NoError(t, err) + require.Zero(t, count) +} + func TestSendPendingOAuthVerifyCodeExistingEmailReturnsBindLoginState(t *testing.T) { handler, client := newOAuthPendingFlowTestHandlerWithEmailVerification(t, false, "owner@example.com", "135790") ctx := context.Background() diff --git a/backend/internal/service/auth_email_binding.go b/backend/internal/service/auth_email_binding.go index 84f61d7801..fdfb6f70af 100644 --- a/backend/internal/service/auth_email_binding.go +++ b/backend/internal/service/auth_email_binding.go @@ -40,6 +40,9 @@ func (s *AuthService) BindEmailIdentity( if err := s.VerifyOAuthEmailCode(ctx, normalizedEmail, verifyCode); err != nil { return nil, err } + if err := s.validateRegistrationEmailPolicy(ctx, normalizedEmail); err != nil { + return nil, err + } currentUser, err := s.userRepo.GetByID(ctx, userID) if err != nil { @@ -106,6 +109,9 @@ func (s *AuthService) SendEmailIdentityBindCode(ctx context.Context, userID int6 if isReservedEmail(normalizedEmail) { return ErrEmailReserved } + if err := s.validateRegistrationEmailPolicy(ctx, normalizedEmail); err != nil { + return err + } if s.emailService == nil { return ErrServiceUnavailable } diff --git a/backend/internal/service/auth_service_email_bind_test.go b/backend/internal/service/auth_service_email_bind_test.go index 28bb0a3b8e..74ad5b2f09 100644 --- a/backend/internal/service/auth_service_email_bind_test.go +++ b/backend/internal/service/auth_service_email_bind_test.go @@ -494,6 +494,141 @@ func TestAuthServiceBindEmailIdentity_RevokesExistingAccessAndRefreshTokens(t *t require.True(t, errors.Is(err, service.ErrTokenRevoked) || errors.Is(err, service.ErrRefreshTokenInvalid)) } +func TestAuthServiceEmailIdentityBinding_RejectsEmailOutsideRegistrationSuffixWhitelist(t *testing.T) { + ctx := context.Background() + cache := &emailBindCacheStub{ + data: &service.VerificationCodeData{ + Code: "123456", + CreatedAt: time.Now().UTC(), + ExpiresAt: time.Now().UTC().Add(10 * time.Minute), + }, + } + svc, _, client := newAuthServiceForEmailBind(t, map[string]string{ + service.SettingKeyRegistrationEmailSuffixWhitelist: `["@qq.com"]`, + }, cache, nil) + + user := createEmailBindTestUser(t, client, "legacy-user"+service.OIDCConnectSyntheticEmailDomain, "legacy-user", "old-hash") + + err := svc.SendEmailIdentityBindCode(ctx, user.ID, "intruder@gmail.com") + require.ErrorIs(t, err, service.ErrEmailSuffixNotAllowed) + require.Empty(t, cache.setEmails) + + updatedUser, err := svc.BindEmailIdentity(ctx, user.ID, "intruder@gmail.com", "123456", "new-password") + require.ErrorIs(t, err, service.ErrEmailSuffixNotAllowed) + require.Nil(t, updatedUser) + + storedUser, err := client.User.Get(ctx, user.ID) + require.NoError(t, err) + require.Equal(t, "legacy-user"+service.OIDCConnectSyntheticEmailDomain, storedUser.Email) +} + +func TestAuthServiceBindEmailIdentity_AllowsEmailInsideRegistrationSuffixWhitelist(t *testing.T) { + ctx := context.Background() + cache := &emailBindCacheStub{ + data: &service.VerificationCodeData{ + Code: "123456", + CreatedAt: time.Now().UTC(), + ExpiresAt: time.Now().UTC().Add(10 * time.Minute), + }, + } + svc, _, client := newAuthServiceForEmailBind(t, map[string]string{ + service.SettingKeyRegistrationEmailSuffixWhitelist: `["@qq.com"]`, + }, cache, nil) + + user := createEmailBindTestUser(t, client, "legacy-qq"+service.LinuxDoConnectSyntheticEmailDomain, "legacy-qq", "old-hash") + + updatedUser, err := svc.BindEmailIdentity(ctx, user.ID, " Member@QQ.com ", "123456", "new-password") + require.NoError(t, err) + require.NotNil(t, updatedUser) + require.Equal(t, "member@qq.com", updatedUser.Email) + + storedUser, err := client.User.Get(ctx, user.ID) + require.NoError(t, err) + require.Equal(t, "member@qq.com", storedUser.Email) +} + +func TestAuthServiceBindEmailIdentity_RegistrationSuffixWhitelistWildcard(t *testing.T) { + ctx := context.Background() + + t.Run("allows wildcard suffix", func(t *testing.T) { + cache := &emailBindCacheStub{ + data: &service.VerificationCodeData{ + Code: "123456", + CreatedAt: time.Now().UTC(), + ExpiresAt: time.Now().UTC().Add(10 * time.Minute), + }, + } + svc, _, client := newAuthServiceForEmailBind(t, map[string]string{ + service.SettingKeyRegistrationEmailSuffixWhitelist: `["*.edu.cn"]`, + }, cache, nil) + user := createEmailBindTestUser(t, client, "legacy-student"+service.OIDCConnectSyntheticEmailDomain, "legacy-student", "old-hash") + + updatedUser, err := svc.BindEmailIdentity(ctx, user.ID, "student@cs.edu.cn", "123456", "new-password") + require.NoError(t, err) + require.NotNil(t, updatedUser) + require.Equal(t, "student@cs.edu.cn", updatedUser.Email) + }) + + t.Run("rejects outside wildcard suffix", func(t *testing.T) { + cache := &emailBindCacheStub{ + data: &service.VerificationCodeData{ + Code: "123456", + CreatedAt: time.Now().UTC(), + ExpiresAt: time.Now().UTC().Add(10 * time.Minute), + }, + } + svc, _, client := newAuthServiceForEmailBind(t, map[string]string{ + service.SettingKeyRegistrationEmailSuffixWhitelist: `["*.edu.cn"]`, + }, cache, nil) + user := createEmailBindTestUser(t, client, "legacy-wildcard"+service.OIDCConnectSyntheticEmailDomain, "legacy-wildcard", "old-hash") + + updatedUser, err := svc.BindEmailIdentity(ctx, user.ID, "foo@gmail.com", "123456", "new-password") + require.ErrorIs(t, err, service.ErrEmailSuffixNotAllowed) + require.Nil(t, updatedUser) + + storedUser, err := client.User.Get(ctx, user.ID) + require.NoError(t, err) + require.Equal(t, "legacy-wildcard"+service.OIDCConnectSyntheticEmailDomain, storedUser.Email) + }) +} + +func TestAuthServiceBindEmailIdentity_AllowsAnyEmailWhenRegistrationSuffixWhitelistEmpty(t *testing.T) { + ctx := context.Background() + cache := &emailBindCacheStub{ + data: &service.VerificationCodeData{ + Code: "123456", + CreatedAt: time.Now().UTC(), + ExpiresAt: time.Now().UTC().Add(10 * time.Minute), + }, + } + svc, _, client := newAuthServiceForEmailBind(t, map[string]string{ + service.SettingKeyRegistrationEmailSuffixWhitelist: "[]", + }, cache, nil) + + user := createEmailBindTestUser(t, client, "legacy-empty"+service.LinuxDoConnectSyntheticEmailDomain, "legacy-empty", "old-hash") + + updatedUser, err := svc.BindEmailIdentity(ctx, user.ID, "anyone@gmail.com", "123456", "new-password") + require.NoError(t, err) + require.NotNil(t, updatedUser) + require.Equal(t, "anyone@gmail.com", updatedUser.Email) +} + +func createEmailBindTestUser(t *testing.T, client *dbent.Client, email, username, passwordHash string) *dbent.User { + t.Helper() + + user, err := client.User.Create(). + SetEmail(email). + SetUsername(username). + SetPasswordHash(passwordHash). + SetBalance(1). + SetConcurrency(1). + SetRole(service.RoleUser). + SetStatus(service.StatusActive). + Save(context.Background()) + require.NoError(t, err) + return user +} + type emailBindSettingRepoStub struct { values map[string]string } @@ -536,8 +671,9 @@ func (s *emailBindSettingRepoStub) Delete(context.Context, string) error { } type emailBindCacheStub struct { - data *service.VerificationCodeData - err error + data *service.VerificationCodeData + err error + setEmails []string } func (s *emailBindCacheStub) GetVerificationCode(context.Context, string) (*service.VerificationCodeData, error) { @@ -547,7 +683,8 @@ func (s *emailBindCacheStub) GetVerificationCode(context.Context, string) (*serv return s.data, nil } -func (s *emailBindCacheStub) SetVerificationCode(context.Context, string, *service.VerificationCodeData, time.Duration) error { +func (s *emailBindCacheStub) SetVerificationCode(_ context.Context, email string, _ *service.VerificationCodeData, _ time.Duration) error { + s.setEmails = append(s.setEmails, email) return nil }