major: kestrel is now a tak server (#6)

## Added

- CoT (Cursor on Target) server on port 8089 enabling ATAK/iTAK device connectivity
- Support for TAK stream protocol and traditional XML CoT messages
- TLS/SSL support with automatic fallback to plain TCP
- Username/password authentication for CoT connections
- Real-time device position tracking with TTL-based expiration (90s default)
- API endpoints: `/api/cot/config`, `/api/cot/server-package`, `/api/cot/truststore`, `/api/me/cot-password`
- TAK Server section in Settings with QR code for iTAK setup
- ATAK password management in Account page for OIDC users
- CoT device markers on map showing real-time positions
- Comprehensive documentation in `docs/` directory
- Environment variables: `COT_PORT`, `COT_TTL_MS`, `COT_REQUIRE_AUTH`, `COT_SSL_CERT`, `COT_SSL_KEY`, `COT_DEBUG`
- Dependencies: `fast-xml-parser`, `jszip`, `qrcode`

## Changed

- Authentication system supports CoT password management for OIDC users
- Database schema includes `cot_password_hash` field
- Test suite refactored to follow functional design principles

## Removed

- Consolidated utility modules: `authConfig.js`, `authSkipPaths.js`, `bootstrap.js`, `poiConstants.js`, `session.js`

## Security

- XML entity expansion protection in CoT parser
- Enhanced input validation and SQL injection prevention
- Authentication timeout to prevent hanging connections

## Breaking Changes

- Port 8089 must be exposed for CoT server. Update firewall rules and Docker/Kubernetes configurations.

## Migration Notes

- OIDC users must set ATAK password via Account settings before connecting
- Docker: expose port 8089 (`-p 8089:8089`)
- Kubernetes: update Helm values to expose port 8089

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #6

test/unit/oidc.spec.js

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { describe, it, expect } from 'vitest'
 import {
   constantTimeCompare,
   validateRedirectPath,
@@ -6,120 +6,166 @@ import {
   getCodeChallenge,
   getOidcRedirectUri,
   getOidcConfig,
+  buildAuthorizeUrl,
+  exchangeCode,
 } from '../../server/utils/oidc.js'
+import { withTemporaryEnv } from '../helpers/env.js'
 
 describe('oidc', () => {
   describe('constantTimeCompare', () => {
-    it('returns true for equal strings', () => {
-      expect(constantTimeCompare('abc', 'abc')).toBe(true)
-    })
-    it('returns false for different strings', () => {
-      expect(constantTimeCompare('abc', 'abd')).toBe(false)
-    })
-    it('returns false for different length', () => {
-      expect(constantTimeCompare('ab', 'abc')).toBe(false)
-    })
-    it('returns false for non-strings', () => {
-      expect(constantTimeCompare('a', 1)).toBe(false)
+    it.each([
+      [['abc', 'abc'], true],
+      [['abc', 'abd'], false],
+      [['ab', 'abc'], false],
+      [['a', 1], false],
+    ])('compares %j -> %s', ([a, b], expected) => {
+      expect(constantTimeCompare(a, b)).toBe(expected)
     })
   })
 
   describe('validateRedirectPath', () => {
-    it('returns path for valid same-origin path', () => {
-      expect(validateRedirectPath('/')).toBe('/')
-      expect(validateRedirectPath('/feeds')).toBe('/feeds')
-      expect(validateRedirectPath('/feeds?foo=1')).toBe('/feeds?foo=1')
-    })
-    it('returns / for path starting with //', () => {
-      expect(validateRedirectPath('//evil.com')).toBe('/')
-    })
-    it('returns / for non-string or empty', () => {
-      expect(validateRedirectPath('')).toBe('/')
-      expect(validateRedirectPath(null)).toBe('/')
-    })
-    it('returns / for path containing //', () => {
-      expect(validateRedirectPath('/foo//bar')).toBe('/')
+    it.each([
+      ['/', '/'],
+      ['/feeds', '/feeds'],
+      ['/feeds?foo=1', '/feeds?foo=1'],
+      ['//evil.com', '/'],
+      ['', '/'],
+      [null, '/'],
+      ['/foo//bar', '/'],
+    ])('validates %s -> %s', (input, expected) => {
+      expect(validateRedirectPath(input)).toBe(expected)
     })
   })
 
   describe('createOidcParams', () => {
     it('returns state, nonce, and codeVerifier', () => {
-      const p = createOidcParams()
-      expect(p).toHaveProperty('state')
-      expect(p).toHaveProperty('nonce')
-      expect(p).toHaveProperty('codeVerifier')
-      expect(typeof p.state).toBe('string')
-      expect(typeof p.nonce).toBe('string')
-      expect(typeof p.codeVerifier).toBe('string')
+      const params = createOidcParams()
+      expect(params).toMatchObject({
+        state: expect.any(String),
+        nonce: expect.any(String),
+        codeVerifier: expect.any(String),
+      })
     })
   })
 
   describe('getCodeChallenge', () => {
     it('returns a string for a verifier', async () => {
-      const p = createOidcParams()
-      const challenge = await getCodeChallenge(p.codeVerifier)
-      expect(typeof challenge).toBe('string')
-      expect(challenge.length).toBeGreaterThan(0)
+      const { codeVerifier } = createOidcParams()
+      const challenge = await getCodeChallenge(codeVerifier)
+      expect(challenge).toMatch(/^[\w-]+$/)
     })
   })
 
   describe('getOidcRedirectUri', () => {
-    const origEnv = process.env
-
-    afterEach(() => {
-      process.env = origEnv
+    it('returns URL ending with callback path when env is default', () => {
+      withTemporaryEnv(
+        {
+          OIDC_REDIRECT_URI: undefined,
+          OPENID_REDIRECT_URI: undefined,
+          NUXT_APP_URL: undefined,
+          APP_URL: undefined,
+        },
+        () => {
+          expect(getOidcRedirectUri()).toMatch(/\/api\/auth\/oidc\/callback$/)
+        },
+      )
     })
 
-    it('returns a URL ending with callback path when env is default', () => {
-      delete process.env.OIDC_REDIRECT_URI
-      delete process.env.OPENID_REDIRECT_URI
-      delete process.env.NUXT_APP_URL
-      delete process.env.APP_URL
-      const uri = getOidcRedirectUri()
-      expect(uri).toMatch(/\/api\/auth\/oidc\/callback$/)
-    })
-
-    it('returns explicit OIDC_REDIRECT_URI when set', () => {
-      process.env.OIDC_REDIRECT_URI = '  https://app.example.com/oidc/cb  '
-      const uri = getOidcRedirectUri()
-      expect(uri).toBe('https://app.example.com/oidc/cb')
-    })
-
-    it('returns URL from NUXT_APP_URL when set and no explicit redirect', () => {
-      delete process.env.OIDC_REDIRECT_URI
-      delete process.env.OPENID_REDIRECT_URI
-      process.env.NUXT_APP_URL = 'https://myapp.example.com/'
-      const uri = getOidcRedirectUri()
-      expect(uri).toBe('https://myapp.example.com/api/auth/oidc/callback')
-    })
-
-    it('returns URL from APP_URL when set and no NUXT_APP_URL', () => {
-      delete process.env.OIDC_REDIRECT_URI
-      delete process.env.OPENID_REDIRECT_URI
-      delete process.env.NUXT_APP_URL
-      process.env.APP_URL = 'https://app.example.com'
-      const uri = getOidcRedirectUri()
-      expect(uri).toBe('https://app.example.com/api/auth/oidc/callback')
+    it.each([
+      [{ OIDC_REDIRECT_URI: '  https://app.example.com/oidc/cb  ' }, 'https://app.example.com/oidc/cb'],
+      [
+        { OIDC_REDIRECT_URI: undefined, OPENID_REDIRECT_URI: undefined, NUXT_APP_URL: 'https://myapp.example.com/' },
+        'https://myapp.example.com/api/auth/oidc/callback',
+      ],
+      [
+        {
+          OIDC_REDIRECT_URI: undefined,
+          OPENID_REDIRECT_URI: undefined,
+          NUXT_APP_URL: undefined,
+          APP_URL: 'https://app.example.com',
+        },
+        'https://app.example.com/api/auth/oidc/callback',
+      ],
+    ])('returns correct URI for env: %j', (env, expected) => {
+      withTemporaryEnv(env, () => {
+        expect(getOidcRedirectUri()).toBe(expected)
+      })
     })
   })
 
   describe('getOidcConfig', () => {
-    const origEnv = process.env
+    it.each([
+      [{ OIDC_ISSUER: undefined, OIDC_CLIENT_ID: undefined, OIDC_CLIENT_SECRET: undefined }],
+      [{ OIDC_ISSUER: 'https://idp.example.com', OIDC_CLIENT_ID: 'client', OIDC_CLIENT_SECRET: undefined }],
+    ])('returns null when OIDC vars missing or incomplete: %j', async (env) => {
+      withTemporaryEnv(env, async () => {
+        expect(await getOidcConfig()).toBeNull()
+      })
+    })
+  })
 
-    beforeEach(() => {
-      process.env = { ...origEnv }
+  describe('buildAuthorizeUrl', () => {
+    it('is a function that accepts config and params', () => {
+      expect(buildAuthorizeUrl).toBeInstanceOf(Function)
+      expect(buildAuthorizeUrl.length).toBe(2)
     })
 
-    afterEach(() => {
-      process.env = origEnv
+    it('calls oidc.buildAuthorizationUrl with valid config', async () => {
+      withTemporaryEnv(
+        {
+          OIDC_ISSUER: 'https://accounts.google.com',
+          OIDC_CLIENT_ID: 'test-client',
+          OIDC_CLIENT_SECRET: 'test-secret',
+        },
+        async () => {
+          try {
+            const config = await getOidcConfig()
+            if (config) {
+              const result = buildAuthorizeUrl(config, createOidcParams())
+              expect(result).toBeDefined()
+            }
+          }
+          catch {
+            // Discovery failures are acceptable
+          }
+        },
+      )
     })
+  })
 
-    it('returns null when OIDC env vars missing', async () => {
-      delete process.env.OIDC_ISSUER
-      delete process.env.OIDC_CLIENT_ID
-      delete process.env.OIDC_CLIENT_SECRET
-      const config = await getOidcConfig()
-      expect(config).toBeNull()
+  describe('getOidcConfig caching', () => {
+    it('caches config when called multiple times with same issuer', async () => {
+      withTemporaryEnv(
+        {
+          OIDC_ISSUER: 'https://accounts.google.com',
+          OIDC_CLIENT_ID: 'test-client',
+          OIDC_CLIENT_SECRET: 'test-secret',
+        },
+        async () => {
+          try {
+            const config1 = await getOidcConfig()
+            if (config1) {
+              const config2 = await getOidcConfig()
+              expect(config2).toBeDefined()
+            }
+          }
+          catch {
+            // Network/discovery failures are acceptable
+          }
+        },
+      )
+    })
+  })
+
+  describe('exchangeCode', () => {
+    it('rejects when grant fails', async () => {
+      await expect(
+        exchangeCode({}, 'https://app/api/auth/oidc/callback?code=abc&state=s', {
+          state: 's',
+          nonce: 'n',
+          codeVerifier: 'v',
+        }),
+      ).rejects.toBeDefined()
     })
   })
 })