fix: always hide password and reset token + token fixes

Author: mychidarko

src/Auth/User.php

@@ -48,6 +48,12 @@ class User
      */
     protected array $tokens = [];
 
+    /**
+     * Expiry used when tokens are lazily minted
+     * @var int
+     */
+    protected $tokenLifetime;
+
     /**
      * All errors caught
      * @var array{
@@ -103,8 +109,7 @@ public function __construct($data, $session = true)
             ? strtotime($sessionLifetime)
             : (time() + intval($sessionLifetime));
 
-        $this->tokens['access'] = $this->generateToken($sessionLifetime);
-        $this->tokens['refresh'] = $this->generateToken($sessionLifetime + 259200);
+        $this->tokenLifetime = $sessionLifetime;
 
         if (function_exists('crash')) {
             crash()->context(['user' => array_filter([
@@ -299,10 +304,12 @@ public function resetPassword(string $newPassword): bool
      */
     public function getAuthInfo(): object
     {
+        $tokens = $this->tokens();
+
         $dataToReturn = (object) [
             'user' => $this->get(),
-            'accessToken' => $this->tokens['access'] ?? null,
-            'refreshToken' => $this->tokens['refresh'] ?? null,
+            'accessToken' => $tokens['access'] ?? null,
+            'refreshToken' => $tokens['refresh'] ?? null,
         ];
 
         if (count($this->roles)) {
@@ -325,6 +332,11 @@ public function getAuthInfo(): object
      */
     public function tokens(): array
     {
+        if (!isset($this->tokens['access'])) {
+            $this->tokens['access'] = $this->generateToken($this->tokenLifetime);
+            $this->tokens['refresh'] = $this->generateToken($this->tokenLifetime + 259200);
+        }
+
         return $this->tokens;
     }
 
@@ -420,10 +432,10 @@ public function get()
         $hidden = array_merge(Config::get('hidden'), [Config::get('roles.key')]);
         $passwordKey = Config::get('password.key');
 
+        unset($userData[$passwordKey], $userData['remember_token']);
+
         if (count($hidden) > 0) {
             foreach ($hidden as $item) {
-                // array_key_exists, not isset: a present-but-null column
-                // (like the roles column before first assign) must hide too
                 if (array_key_exists($item, $userData)) {
                     unset($userData[$item]);
                 }

tests/tokens.test.php

@@ -112,3 +112,44 @@
 
     expect($user->get())->not->toHaveKey(Config::get('roles.key'));
 });
+
+test('the password hash never leaks from get(), whatever hidden says', function () {
+    // following the old docs (literal 'password') with a custom
+    // password.key put the bcrypt hash in the session and Inertia props
+    Config::set(['password.key' => 'pass', 'hidden' => ['password', 'remember_token']]);
+
+    $user = new \Leaf\Auth\User([
+        'id' => 1,
+        'email' => 'leak-check@example.com',
+        'pass' => '$2y$10$fakehashfakehashfakehash',
+        'remember_token' => 'session-equivalent-secret',
+    ], false);
+
+    expect($user->get())->not->toHaveKey('pass')
+        ->and($user->get())->not->toHaveKey('remember_token');
+
+    Config::set(['password.key' => 'password', 'hidden' => ['field.id', 'field.password', 'remember_token']]);
+});
+
+test('session-only users need no token secret until tokens are read', function () {
+    Config::set(['token.secret' => null]);
+    unset($_ENV['APP_KEY'], $_ENV['AUTH_TOKEN_SECRET']);
+
+    // constructing a user must not mint JWTs — session apps never read them
+    $user = new \Leaf\Auth\User(['id' => 5, 'email' => 'lazy@example.com'], false);
+
+    expect($user->get())->toHaveKey('email');
+
+    // reading tokens is the moment the secret becomes required
+    expect(fn () => $user->tokens())
+        ->toThrow(RuntimeException::class, 'No auth token secret');
+});
+
+test('middleware redirect targets are configurable', function () {
+    expect(Config::get('redirect.login'))->toBe('/auth/login')
+        ->and(Config::get('redirect.guest'))->toBe('/dashboard');
+
+    Config::set(['redirect.guest' => '/']);
+    expect(Config::get('redirect.guest'))->toBe('/');
+    Config::set(['redirect.guest' => '/dashboard']);
+});