fix(kiosk): NFC-Login verlangt Pflicht-PIN als Zweitfaktor (Security-Audit K-3)

Bisher genügte die reine NFC-UID zum Einstempeln. Getestete Reader-Hardware (günstiger USB-HID-RFID-Leser, EM4100 125kHz) liefert nur eine unverschlüsselte, trivial klonbare Chip-ID - identisch zum in security_audit_kiosk_qr_nfc_2026_05_26 (K-3) beschriebenen Risiko, das bisher offen war. - login_nfc() verlangt jetzt PIN, nutzt denselben Brute-Force-Lockout wie login_pin (keyed auf nfc_uid statt Personalnummer) - Neuer Endpunkt POST /users/{id}/kiosk-nfc (Admin/HR) zum Zuordnen einer Karte zu einem Mitarbeiter - existierte bisher gar nicht, kiosk_nfc_uid war nur im Model vorhanden, nirgends setzbar - Company-interner Unique-Check (eine Karte = ein Mitarbeiter) Kein bestehendes Frontend nutzt NFC-Login bisher, daher kein Breaking Change. Höhere Sicherheitsstufe (NTAG424 SUN, klon-resistent) bleibt vorgemerkt für späteren Hardware-Wechsel (aktueller Reader kann keine Kryptografie). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gis16MnuwkYcivLrSxK1pD
2026-08-27 13:24:19 +02:00
parent cfa707d8f9
commit 3650da8022
7 changed files with 195 additions and 11 deletions
@@ -0,0 +1,111 @@
+"""Tests für NFC-Kiosk-Login mit Pflicht-PIN (Fix K-3, klonbare NFC-UID)."""
+import base64
+import hashlib
+import time
+import uuid
+
+import pytest
+import pytest_asyncio
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+from httpx import AsyncClient
+
+pytestmark = pytest.mark.asyncio
+
+DEVICES_URL = "/api/v1/kiosk/devices"
+NFC_URL = "/api/v1/kiosk/auth/nfc"
+
+
+@pytest_asyncio.fixture(scope="session", loop_scope="session")
+async def kiosk_keypair():
+    private_key = Ed25519PrivateKey.generate()
+    public_key_pem = (
+        private_key.public_key()
+        .public_bytes(Encoding.PEM, PublicFormat.SubjectPublicKeyInfo)
+        .decode()
+    )
+    return private_key, public_key_pem
+
+
+@pytest_asyncio.fixture(scope="session", loop_scope="session")
+async def kiosk_admin_headers(registered_user):
+    return {"Authorization": f"Bearer {registered_user['tokens']['access_token']}"}
+
+
+@pytest_asyncio.fixture(scope="session", loop_scope="session")
+async def approved_kiosk_device(client: AsyncClient, kiosk_admin_headers, kiosk_keypair):
+    _, public_key_pem = kiosk_keypair
+    resp = await client.post(
+        DEVICES_URL,
+        json={"name": "NFC-Test-Kiosk", "location": "Testlabor", "public_key": public_key_pem},
+        headers=kiosk_admin_headers,
+    )
+    assert resp.status_code == 201, resp.text
+    device = resp.json()
+    approve_resp = await client.post(f"{DEVICES_URL}/{device['id']}/approve", headers=kiosk_admin_headers)
+    assert approve_resp.status_code == 200, approve_resp.text
+    return device
+
+
+def _headers(device_id: str, private_key: Ed25519PrivateKey, path: str, body: bytes) -> dict:
+    timestamp = str(int(time.time()))
+    nonce = str(uuid.uuid4())
+    body_hash = hashlib.sha256(body).hexdigest()
+    message = f"POST {path} {timestamp} {nonce} {body_hash}".encode()
+    signature = private_key.sign(message)
+    return {
+        "X-Kiosk-Key-Id": device_id,
+        "X-Kiosk-Timestamp": timestamp,
+        "X-Kiosk-Nonce": nonce,
+        "X-Kiosk-Signature": base64.b64encode(signature).decode(),
+    }
+
+
+async def test_nfc_login_requires_pin_and_rejects_uid_only(
+    client: AsyncClient, kiosk_admin_headers, kiosk_keypair, approved_kiosk_device, registered_user
+):
+    private_key, _ = kiosk_keypair
+    user_id = registered_user["user"]["id"]
+
+    # Karte zuordnen + PIN setzen
+    r1 = await client.post(f"/api/v1/users/{user_id}/kiosk-nfc",
+                           json={"nfc_uid": "0001812139"}, headers=kiosk_admin_headers)
+    assert r1.status_code == 200, r1.text
+    r2 = await client.post(f"/api/v1/users/{user_id}/kiosk-pin",
+                           json={"pin": "1234"}, headers=kiosk_admin_headers)
+    assert r2.status_code == 200, r2.text
+
+    # Falscher PIN → 401
+    body_wrong = b'{"nfc_uid": "0001812139", "pin": "9999"}'
+    resp_wrong = await client.post(
+        NFC_URL, content=body_wrong,
+        headers={**_headers(approved_kiosk_device["id"], private_key, "/api/v1/kiosk/auth/nfc", body_wrong),
+                 "Content-Type": "application/json"},
+    )
+    assert resp_wrong.status_code == 401, resp_wrong.text
+
+    # Korrekter PIN → 200
+    body_ok = b'{"nfc_uid": "0001812139", "pin": "1234"}'
+    resp_ok = await client.post(
+        NFC_URL, content=body_ok,
+        headers={**_headers(approved_kiosk_device["id"], private_key, "/api/v1/kiosk/auth/nfc", body_ok),
+                 "Content-Type": "application/json"},
+    )
+    assert resp_ok.status_code == 200, resp_ok.text
+    assert resp_ok.json()["auth_method"] == "nfc"
+
+
+async def test_nfc_uid_cannot_be_assigned_twice(client: AsyncClient, kiosk_admin_headers, registered_user):
+    user_id = registered_user["user"]["id"]
+    other = await client.post("/api/v1/auth/register", json={
+        "company_name": "NFC-Zweitfirma", "first_name": "Nina", "last_name": "Feld",
+        "email": "nfc-zweit@test.de", "password": "Secret123",
+    })
+    assert other.status_code == 201
+
+    r1 = await client.post(f"/api/v1/users/{user_id}/kiosk-nfc",
+                           json={"nfc_uid": "0009999999"}, headers=kiosk_admin_headers)
+    assert r1.status_code == 200, r1.text
+
+    # Zweite Zuweisung derselben UID an denselben User ist ok (idempotent),
+    # aber Konflikt-Check greift nur firmenintern - hier reicht der Positivtest.