fix: detect atomic passkey counter anomalies (Closes #641)

tests/test_dashboard_auth.py

@@ -170,6 +170,102 @@ async def test_enrolled_passkey_can_sign_in_without_the_operator_token(
     assert "correct horse battery staple" not in signed_in.text
 
 
+@pytest.mark.anyio
+async def test_stale_nonzero_passkey_counter_denies_sign_in_and_records_anomaly(
+    access_control, monkeypatch
+):
+    class StaleAuthentication:
+        new_sign_count = 4
+
+    monkeypatch.setattr(
+        main.passkeys,
+        "verify_authentication",
+        lambda **_kwargs: StaleAuthentication(),
+    )
+    await asyncio.to_thread(
+        main._passkey_store().register,
+        credential_id=b"phone-credential",
+        public_key=b"phone-public-key",
+        sign_count=4,
+        device_label="Phone",
+        management_id="phone-management-id",
+    )
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        options = await client.post("/api/v1/passkeys/authentication/options")
+        denied = await client.post(
+            "/api/v1/passkeys/authentication/verify",
+            json={
+                "challenge": options.json()["challenge"],
+                "credential": {"id": "cGhvbmUtY3JlZGVudGlhbA"},
+                "device_label": "Phone",
+                "action": "sign_in",
+                "target": "dashboard",
+            },
+        )
+
+    events = main._security_event_store().list(limit=10).events
+    assert denied.status_code == 401
+    assert "stackchain_session=" not in denied.headers.get("set-cookie", "")
+    assert [event.kind for event in events] == ["passkey_counter_anomaly"]
+    assert events[0].device_label == "Phone"
+    assert events[0].target == "sign_in:dashboard"
+
+
+@pytest.mark.anyio
+async def test_stale_nonzero_passkey_counter_denies_fresh_authorization(
+    access_control, monkeypatch
+):
+    class StaleAuthentication:
+        new_sign_count = 4
+
+    monkeypatch.setattr(
+        main.passkeys,
+        "verify_authentication",
+        lambda **_kwargs: StaleAuthentication(),
+    )
+    await asyncio.to_thread(
+        main._passkey_store().register,
+        credential_id=b"phone-credential",
+        public_key=b"phone-public-key",
+        sign_count=4,
+        device_label="Phone",
+        management_id="phone-management-id",
+    )
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        await client.post(
+            "/api/v1/session",
+            json={"access_token": "correct horse battery staple", "device_label": "Phone"},
+        )
+        headers = {
+            "Origin": "https://test",
+            "X-CSRF-Token": client.cookies["stackchain_csrf"],
+        }
+        options = await client.post(
+            "/api/v1/passkeys/authorization/options",
+            json={"action": "merge_pull", "target": "stackchain/dashboard#42"},
+            headers=headers,
+        )
+        denied = await client.post(
+            "/api/v1/passkeys/authorization/verify",
+            json={
+                "challenge": options.json()["challenge"],
+                "credential": {"id": "cGhvbmUtY3JlZGVudGlhbA"},
+                "action": "merge_pull",
+                "target": "stackchain/dashboard#42",
+            },
+            headers=headers,
+        )
+
+    events = main._security_event_store().list(limit=10).events
+    assert options.status_code == 200
+    assert denied.status_code == 401
+    assert "grant" not in denied.json()
+    assert events[0].kind == "passkey_counter_anomaly"
+    assert events[0].target == "merge_pull:stackchain/dashboard#42"
+
+
 @pytest.mark.anyio
 async def test_passkey_options_are_source_limited_before_challenge_generation(
     access_control, monkeypatch

tests/test_passkey_store.py

@@ -104,3 +104,44 @@ def test_existing_challenge_registry_is_migrated_without_losing_live_challenges(
         ).fetchall()
     assert "source_hash" in columns
     assert sorted(rows) == sorted([("existing",), (store._digest(b"new"),)])
+
+
+def test_passkey_counter_advancement_is_atomic_across_store_instances(tmp_path):
+    database = tmp_path / "passkeys.sqlite3"
+    first = PasskeyStore(database, clock=lambda: 1_000.0)
+    second = PasskeyStore(database, clock=lambda: 1_000.0)
+    first.register(
+        credential_id=b"phone-credential",
+        public_key=b"phone-public-key",
+        sign_count=4,
+        device_label="Phone",
+        management_id="phone-management-id",
+    )
+
+    assert first.advance_counter(b"phone-credential", expected=4, new=5) is True
+    assert second.advance_counter(b"phone-credential", expected=4, new=5) is False
+    assert first.get(b"phone-credential").sign_count == 5
+
+
+def test_passkey_counter_rejects_non_advancing_values_but_supports_counterless_devices(
+    tmp_path,
+):
+    store = PasskeyStore(tmp_path / "passkeys.sqlite3", clock=lambda: 1_000.0)
+    store.register(
+        credential_id=b"phone-credential",
+        public_key=b"phone-public-key",
+        sign_count=4,
+        device_label="Phone",
+        management_id="phone-management-id",
+    )
+    store.register(
+        credential_id=b"counterless-credential",
+        public_key=b"counterless-public-key",
+        sign_count=0,
+        device_label="Security key",
+        management_id="counterless-management-id",
+    )
+
+    assert store.advance_counter(b"phone-credential", expected=4, new=4) is False
+    assert store.advance_counter(b"phone-credential", expected=4, new=3) is False
+    assert store.advance_counter(b"counterless-credential", expected=0, new=0) is True

tests/test_security_center.py

@@ -47,3 +47,42 @@ const boundary={{
         "hidden": False,
         "focused": True,
     }
+
+
+def test_counter_anomaly_activity_gives_passkey_remediation_guidance():
+    harness = f"""
+const attachSecurityCenter=require({json.dumps(str(SECURITY_CENTER))});
+const element=()=>({{
+  hidden:true, disabled:false, textContent:'', children:[], className:'',
+  addEventListener(){{}}, focus(){{}}, replaceChildren(){{this.children=[];}},
+  append(...values){{this.children.push(...values);}},
+}});
+const ids={{
+  'active-devices':element(), 'active-devices-sheet':element(),
+  'active-devices-list':element(), 'active-devices-status':element(),
+  'enrolled-passkeys-list':element(), 'enrolled-passkeys-status':element(),
+  'enroll-passkey':element(), 'security-activity-list':element(),
+  'security-activity-status':element(), 'load-more-security-activity':element(),
+  'close-active-devices':element(),
+}};
+const root={{document:{{getElementById:id=>ids[id]||null,createElement:()=>element()}}}};
+const boundary={{
+  listActiveDevices:async()=>[], listPasskeys:async()=>[],
+  listSecurityEvents:async()=>({{events:[{{
+    kind:'passkey_counter_anomaly', device_label:'Phone', method:'passkey',
+    target:'sign_in:dashboard', status:'completed', created_at:1,
+  }}],authentication_alerts:[],next_cursor:null}}),
+}};
+(async()=>{{
+  await attachSecurityCenter({{root,boundary}}).open();
+  const row=ids['security-activity-list'].children[0];
+  console.log(JSON.stringify(row.children.map(child=>child.textContent)));
+}})().catch(error=>{{console.error(error);process.exit(1);}});
+"""
+    completed = subprocess.run(
+        ["node", "-e", harness], check=True, capture_output=True, text=True
+    )
+
+    title, detail = json.loads(completed.stdout)
+    assert title == "Passkey counter anomaly"
+    assert "Remove and re-enroll this passkey" in detail