PD-28 — Plan d'implémentation¶

interface RevocationEntry {
  sessionId: string;          // jti du token
  userId: string;             // sub du token
  revokedAt: Date;
  reason: RevocationReason;
  pd27EventRef: Pd27EventRef;
  expiresAt: Date;            // TTL = token exp + marge sécurité
}

enum RevocationReason {
  LOGOUT_GLOBAL = 'LOGOUT_GLOBAL',
  SECURITY_RESET = 'SECURITY_RESET',
  FAILED_AUTH_THRESHOLD = 'FAILED_AUTH_THRESHOLD',
  ADMIN_REVOKE = 'ADMIN_REVOKE',
  TOKEN_EXPIRED = 'TOKEN_EXPIRED',
}

enum Pd27EventRef {
  NONE = 'NONE',
  PD27_R6_LOGOUT_GLOBAL = 'PD27-R6-LOGOUT_GLOBAL',
  PD27_R6_SECURITY_RESET = 'PD27-R6-SECURITY_RESET',
  PD27_R6_FAILED_AUTH_REPEATED = 'PD27-R6-FAILED_AUTH_REPEATED',
}

/**
 * Taxonomie de portée des événements PD-27 (R-28-04)
 */
enum EventScope {
  GLOBAL = 'GLOBAL',           // Révoque toutes les sessions de l'utilisateur
  DEVICE_SPECIFIC = 'DEVICE',  // Révoque uniquement les sessions du device concerné
}

/**
 * Mapping événement → portée (R-28-04 proportionnalité)
 */
const EVENT_SCOPE_MAP: Record<SecurityEventType, EventScope> = {
  [SecurityEventType.LOGOUT_GLOBAL]: EventScope.GLOBAL,
  [SecurityEventType.SECURITY_RESET]: EventScope.GLOBAL,
  [SecurityEventType.FAILED_AUTH_THRESHOLD]: EventScope.GLOBAL, // Conservateur par défaut
  [SecurityEventType.ADMIN_DEVICE_REVOKE]: EventScope.DEVICE_SPECIFIC,
  // Autres événements non liés à la révocation de session
};

@Injectable()
export class SessionRevocationListener {
  /**
   * R-28-04: Révocation proportionnée à la portée de l'événement
   */
  private async revokeProportionally(
    payload: SecurityEventPayload,
    reason: RevocationReason,
    pd27EventRef: Pd27EventRef,
    eventType: SecurityEventType,
  ): Promise<void> {
    const scope = EVENT_SCOPE_MAP[eventType] ?? EventScope.GLOBAL;

    if (scope === EventScope.DEVICE_SPECIFIC && payload.deviceId) {
      // Portée contextuelle : révoque uniquement les sessions du device
      await this.revocationStore.revokeDeviceSessions(
        payload.userId,
        payload.deviceId,
        reason,
        pd27EventRef,
      );
    } else {
      // Portée globale : révoque toutes les sessions de l'utilisateur
      await this.revocationStore.revokeAllUserSessions(
        payload.userId,
        reason,
        pd27EventRef,
      );
    }
  }

  @OnEvent(SecurityEventType.LOGOUT_GLOBAL)
  async handleLogoutGlobal(payload: LogoutGlobalEventPayload): Promise<void> {
    // R-28-03 + R-28-04: Révocation immédiate, portée GLOBALE
    await this.revokeProportionally(
      payload,
      RevocationReason.LOGOUT_GLOBAL,
      Pd27EventRef.PD27_R6_LOGOUT_GLOBAL,
      SecurityEventType.LOGOUT_GLOBAL,
    );
  }

  @OnEvent(SecurityEventType.SECURITY_RESET)
  async handleSecurityReset(payload: SecurityEventPayload): Promise<void> {
    // R-28-03 + R-28-04: Révocation immédiate, portée GLOBALE
    await this.revokeProportionally(
      payload,
      RevocationReason.SECURITY_RESET,
      Pd27EventRef.PD27_R6_SECURITY_RESET,
      SecurityEventType.SECURITY_RESET,
    );
  }

  @OnEvent(SecurityEventType.FAILED_AUTH_THRESHOLD)
  async handleFailedAuthThreshold(payload: SecurityEventPayload): Promise<void> {
    // R-28-03 + R-28-04: Révocation immédiate, portée GLOBALE (conservateur)
    await this.revokeProportionally(
      payload,
      RevocationReason.FAILED_AUTH_THRESHOLD,
      Pd27EventRef.PD27_R6_FAILED_AUTH_REPEATED,
      SecurityEventType.FAILED_AUTH_THRESHOLD,
    );
  }
}

@Injectable()
export class SessionValidationGuard extends OidcJwtAuthGuard {
  constructor(
    reflector: Reflector,
    jwtValidationService: OidcJwtValidationService,
    oidcDiscoveryService: OidcDiscoveryService,
    private readonly revocationStore: SessionRevocationStore,
    private readonly auditService: AccessDecisionAuditService,
  ) {
    super(reflector, jwtValidationService, oidcDiscoveryService);
  }

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest<Request>();

    // 1. Validation JWT (V1, V2, V3) - avec logging PD-28 sur erreur
    try {
      const jwtValid = await super.canActivate(context);
      if (!jwtValid) {
        // Cas rare: parent retourne false sans throw (route publique)
        return false;
      }
    } catch (error) {
      // R-28-07/R-28-08: Logger avec taxonomie PD-28 AVANT de relancer
      await this.logJwtValidationError(error, request);
      throw error; // Re-throw pour conserver le comportement HTTP
    }

    const user = request.user;

    // 2. Vérification de révocation (V4: continuité)
    const sessionId = user.jti; // JWT ID = session ID
    const revocationEntry = await this.revocationStore.getRevocationEntry(sessionId);

    if (revocationEntry) {
      // R-28-02 + R-28-06: Rejet déterministe + ré-authentification explicite exigée
      const justificationCode = this.isFromTrustBreach(revocationEntry.pd27EventRef)
        ? JustificationCode.ACCESS_REJECTED_REAUTH_REQUIRED
        : JustificationCode.ACCESS_REJECTED_REVOKED_SESSION;

      await this.auditService.logDecision({
        decision: 'REJECTED',
        justificationCode,
        pd27EventRef: revocationEntry.pd27EventRef,
        ...this.extractAuditContext(request),
      });

      // E-03: Ré-authentification explicite exigée (R-28-06)
      throw new UnauthorizedException({
        error: 'Unauthorized',
        message: 'Session revoked - re-authentication required',
        code: 'REAUTH_REQUIRED',
        reauthRequired: true,  // Signal explicite pour le client
      });
    }

    // 3. Session valide - log de validation
    await this.auditService.logDecision({
      decision: 'VALIDATED',
      justificationCode: JustificationCode.ACCESS_VALIDATED,
      pd27EventRef: Pd27EventRef.NONE,
      ...this.extractAuditContext(request),
    });

    return true;
  }

  /**
   * Détermine si la révocation provient d'une rupture de confiance PD-27
   * R-28-06: Le renouvellement est interdit après rupture de confiance
   */
  private isFromTrustBreach(pd27EventRef: Pd27EventRef): boolean {
    return pd27EventRef !== Pd27EventRef.NONE;
  }

  /**
   * R-28-07/R-28-08: Log des erreurs de validation JWT avec taxonomie PD-28
   * Mappe les erreurs JWT vers justification_code normalisés
   */
  private async logJwtValidationError(error: unknown, request: Request): Promise<void> {
    const justificationCode = this.mapJwtErrorToJustificationCode(error);

    await this.auditService.logDecision({
      decision: 'REJECTED',
      justificationCode,
      pd27EventRef: Pd27EventRef.NONE, // E-01: Pas d'événement PD-27 associé
      ...this.extractAuditContext(request),
    });
  }

  /**
   * Mappe les erreurs JWT vers les codes de justification §5.4.1
   * - TOKEN_MISSING → ACCESS_REJECTED_NO_SESSION (session absente)
   * - Autres erreurs → ACCESS_REJECTED_INVALID_SESSION (session invalide/expirée)
   */
  private mapJwtErrorToJustificationCode(error: unknown): JustificationCode {
    if (error instanceof UnauthorizedException) {
      const response = error.getResponse() as Record<string, unknown>;
      const code = response?.code;

      // Session absente (E-01: "Session absente")
      if (code === JwtValidationError.TOKEN_MISSING) {
        return JustificationCode.ACCESS_REJECTED_NO_SESSION;
      }
    }

    // Session invalide ou expirée (E-01: "expirée ou invalide")
    return JustificationCode.ACCESS_REJECTED_INVALID_SESSION;
  }

  /**
   * Extrait le contexte d'audit depuis la requête
   */
  private extractAuditContext(request: Request): Partial<AccessDecisionLog> {
    const user = request.user;
    return {
      requestId: request.requestId ?? 'unknown',
      route: request.path,
      timestamp: new Date(),
      scope: user ? {
        sessionId: user.jti ?? 'unknown',
        deviceId: user.device_id,
        userId: user.sub,
      } : {
        sessionId: 'unknown',
        userId: 'unknown',
      },
      tenant: user?.tenant ?? 'unknown',
    };
  }
}

enum JustificationCode {
  ACCESS_VALIDATED = 'ACCESS_VALIDATED',
  ACCESS_REJECTED_NO_SESSION = 'ACCESS_REJECTED_NO_SESSION',
  ACCESS_REJECTED_INVALID_SESSION = 'ACCESS_REJECTED_INVALID_SESSION',
  ACCESS_REJECTED_REVOKED_SESSION = 'ACCESS_REJECTED_REVOKED_SESSION',
  ACCESS_REJECTED_REAUTH_REQUIRED = 'ACCESS_REJECTED_REAUTH_REQUIRED',
}

interface AccessDecisionLog {
  // Champs obligatoires R-28-08
  decision: 'VALIDATED' | 'REJECTED';
  timestamp: Date;
  scope: {
    sessionId: string;
    deviceId?: string;
    userId: string;
  };
  justificationCode: JustificationCode;
  pd27EventRef: Pd27EventRef;

  // Champs contextuels
  requestId: string;
  route: string;
  tenant: string;
}

describe('TC-NOM-05: Portée proportionnée de la révocation', () => {
  it('should revoke all sessions on LOGOUT_GLOBAL (global scope)', async () => {
    // GIVEN: 2 sessions sur 2 devices différents
    // WHEN: événement LOGOUT_GLOBAL
    // THEN: toutes les sessions sont révoquées
  });

  it('should revoke only device sessions on ADMIN_DEVICE_REVOKE (device scope)', async () => {
    // GIVEN: 2 sessions sur 2 devices différents
    // WHEN: événement ADMIN_DEVICE_REVOKE pour device1
    // THEN: seule la session device1 est révoquée, device2 reste valide
  });
});

describe('TC-ERR-01: Logging des rejets E-01 avec taxonomie PD-28', () => {
  it('should log ACCESS_REJECTED_NO_SESSION when token is missing', async () => {
    // GIVEN: Requête sans header Authorization
    // WHEN: Appel à un endpoint protégé
    // THEN: logDecision() appelé avec :
    //   - decision: 'REJECTED'
    //   - justificationCode: 'ACCESS_REJECTED_NO_SESSION'
    //   - pd27EventRef: 'NONE'
  });

  it('should log ACCESS_REJECTED_INVALID_SESSION when token is expired', async () => {
    // GIVEN: Token JWT expiré
    // WHEN: Appel à un endpoint protégé
    // THEN: logDecision() appelé avec :
    //   - decision: 'REJECTED'
    //   - justificationCode: 'ACCESS_REJECTED_INVALID_SESSION'
    //   - pd27EventRef: 'NONE'
  });

  it('should log ACCESS_REJECTED_INVALID_SESSION when token signature is invalid', async () => {
    // GIVEN: Token JWT avec signature invalide
    // WHEN: Appel à un endpoint protégé
    // THEN: logDecision() appelé avec :
    //   - decision: 'REJECTED'
    //   - justificationCode: 'ACCESS_REJECTED_INVALID_SESSION'
    //   - pd27EventRef: 'NONE'
  });
});

describe('TC-INV-04: Traçabilité complète des décisions', () => {
  it('should log every decision including E-01 rejections', async () => {
    // GIVEN: Séquence de requêtes :
    //   1. Token absent (E-01)
    //   2. Token invalide (E-01)
    //   3. Token valide puis révoqué (E-02)
    //   4. Token valide (succès)
    // WHEN: Exécution de la séquence
    // THEN: 4 entrées de log avec taxonomie §5.4.1 :
    //   1. ACCESS_REJECTED_NO_SESSION, pd27EventRef: NONE
    //   2. ACCESS_REJECTED_INVALID_SESSION, pd27EventRef: NONE
    //   3. ACCESS_REJECTED_REVOKED_SESSION, pd27EventRef: (selon événement)
    //   4. ACCESS_VALIDATED, pd27EventRef: NONE
  });
});

@Injectable()
export class ProtectedEndpointRegistry implements OnModuleInit {
  private readonly protectedEndpoints: Set<string> = new Set();
  private readonly publicEndpoints: Set<string> = new Set();

  constructor(
    private readonly discoveryService: DiscoveryService,
    private readonly reflector: Reflector,
  ) {}

  onModuleInit(): void {
    // Scan tous les contrôleurs au démarrage
    const controllers = this.discoveryService.getControllers();

    for (const wrapper of controllers) {
      const instance = wrapper.instance;
      const prototype = Object.getPrototypeOf(instance);
      const methods = Object.getOwnPropertyNames(prototype);

      for (const methodName of methods) {
        const handler = prototype[methodName];
        const path = Reflect.getMetadata('path', handler);
        if (!path) continue;

        const isPublic = this.reflector.get<boolean>(IS_PUBLIC_KEY, handler);
        const fullPath = `${wrapper.metatype.name}::${methodName}`;

        if (isPublic) {
          this.publicEndpoints.add(fullPath);
        } else {
          this.protectedEndpoints.add(fullPath);
        }
      }
    }
  }

  /**
   * Retourne l'inventaire des endpoints protégés
   * Observable pour TC-NR-03
   */
  getProtectedEndpoints(): string[] {
    return Array.from(this.protectedEndpoints);
  }

  /**
   * Retourne l'inventaire des endpoints publics
   */
  getPublicEndpoints(): string[] {
    return Array.from(this.publicEndpoints);
  }

  /**
   * Vérifie qu'un endpoint est protégé
   */
  isProtected(endpoint: string): boolean {
    return this.protectedEndpoints.has(endpoint);
  }

  /**
   * Retourne les métriques de couverture
   * Observable pour TC-NR-03
   */
  getCoverageMetrics(): {
    totalEndpoints: number;
    protectedCount: number;
    publicCount: number;
    coverageRatio: number;
  } {
    const total = this.protectedEndpoints.size + this.publicEndpoints.size;
    return {
      totalEndpoints: total,
      protectedCount: this.protectedEndpoints.size,
      publicCount: this.publicEndpoints.size,
      coverageRatio: total > 0 ? this.protectedEndpoints.size / total : 1,
    };
  }
}

describe('TC-NR-03: Homogénéité du contrôle de session', () => {
  it('should have SessionValidationGuard applied to all non-public endpoints', async () => {
    const registry = app.get(ProtectedEndpointRegistry);
    const metrics = registry.getCoverageMetrics();

    // Vérifier que tous les endpoints non-publics sont protégés
    expect(metrics.protectedCount).toBeGreaterThan(0);

    // Snapshot de référence pour détecter les régressions
    const protectedList = registry.getProtectedEndpoints().sort();
    expect(protectedList).toMatchSnapshot('protected-endpoints-inventory');

    // Log pour audit
    console.log(`Coverage: ${metrics.protectedCount}/${metrics.totalEndpoints} endpoints protected`);
  });

  it('should reject access to all protected endpoints without valid session', async () => {
    const registry = app.get(ProtectedEndpointRegistry);
    const protectedEndpoints = registry.getProtectedEndpoints();

    for (const endpoint of protectedEndpoints) {
      // Vérifier que chaque endpoint protégé rejette sans session
      // (test paramétré)
    }
  });
});