fix: passcode limit attempts (#1275)

Author: cimigree

docs/EndToEndTests/Passcode.md

@@ -48,6 +48,8 @@ Passcode/ security e2e tests test the user's interactions with the security butt
 - When phone is turned off and back on, when reopening CoMapeo, passcode is required
 - Number keyboard is displayed and letters can't be entered
 - An error is displayed if the wrong passcode is entered
+- If a wrong passcode is entered five times, a lockout time of 1 minutes is enforced
+- After that 1 minute, someone can log in with the correct passcode
 
 ### Special Considerations
 

messages/en.json

@@ -366,6 +366,9 @@
   "constants.red": {
     "message": "Red"
   },
+  "hooks.usePasscodeLockout.lockoutMessage": {
+    "message": "Try again in {minutes, plural, one {# minute} other {# minutes}}"
+  },
   "projectInfoCard.coordinator": {
     "message": "You are a coordinator on this project."
   },
@@ -704,7 +707,7 @@
     "message": "Enter your passcode"
   },
   "screens.EnterPassword.wrongPass": {
-    "message": "Incorrect passcode, please try again"
+    "message": "Incorrect Passcode"
   },
   "screens.Exchange.WifiCard.noWifi": {
     "message": "No Wi-Fi"

src/frontend/contexts/AuthContext.tsx

@@ -4,8 +4,9 @@ const {FlagSecureModule} = NativeModules;
 
 import {useIsShareDialogOpen} from '../hooks/share';
 import {DEFAULT_OBSCURE_CODE} from '../lib/security';
-import {useSecurityState} from './SecurityStoreContext';
+import {useSecurityState, useSecurityActions} from './SecurityStoreContext';
 import {useIsAudioPermissionModalOpen} from '../hooks/useAudioPermissionTracker';
+import {getLockoutThreshold} from '../lib/security';
 
 export type AuthState = 'unauthenticated' | 'authenticated' | 'obscured';
 
@@ -30,7 +31,9 @@ export const useAuthContext = () => {
 };
 
 export const AuthProvider = ({children}: {children: React.ReactNode}) => {
-  const {passcode, obscureCodeEnabled} = useSecurityState();
+  const {passcode, obscureCodeEnabled, lockUntil} = useSecurityState();
+  const {incrementAndGetAttempts, resetFailedAttempts, setLockUntil} =
+    useSecurityActions();
   const [authState, setAuthState] = React.useState<AuthState>(
     passcode === null ? 'authenticated' : 'unauthenticated',
   );
@@ -73,19 +76,39 @@ export const AuthProvider = ({children}: {children: React.ReactNode}) => {
     (passcodeValue, validateOnly = false) => {
       if (validateOnly) return passcodeValue === passcode;
 
+      const isLockedOut = Date.now() < lockUntil;
+      if (isLockedOut) {
+        throw new Error('LOCKED_OUT');
+      }
+
       if (obscureCodeEnabled && passcodeValue === DEFAULT_OBSCURE_CODE) {
         setAuthState('obscured');
+        resetFailedAttempts();
         return true;
       }
 
       if (passcodeValue === passcode) {
         setAuthState('authenticated');
+        resetFailedAttempts();
         return true;
       }
 
+      const attempts = incrementAndGetAttempts();
+      const minutes = getLockoutThreshold(attempts);
+      if (minutes) {
+        setLockUntil(Date.now() + minutes * 60 * 1000);
+      }
       throw new Error('Incorrect Passcode');
     },
-    [passcode, obscureCodeEnabled],
+    [
+      passcode,
+      obscureCodeEnabled,
+      incrementAndGetAttempts,
+      resetFailedAttempts,
+      setLockUntil,
+      lockUntil,
+      setAuthState,
+    ],
   );
 
   const contextValue: AuthContextType = React.useMemo(

src/frontend/contexts/SecurityStoreContext.test.tsx

@@ -31,6 +31,8 @@ test('initial state', () => {
   expect(stateHook.result.current).toStrictEqual({
     passcode: null,
     obscureCodeEnabled: false,
+    failedAttempts: 0,
+    lockUntil: 0,
   });
 });
 
@@ -64,6 +66,8 @@ test('passcode cannot be set to invalid value', () => {
   expect(stateHook.result.current).toStrictEqual({
     passcode: null,
     obscureCodeEnabled: false,
+    failedAttempts: 0,
+    lockUntil: 0,
   });
 });
 
@@ -86,6 +90,8 @@ test('obscure code cannot be set when passcode is not set', () => {
   expect(stateHook.result.current).toStrictEqual({
     passcode: null,
     obscureCodeEnabled: false,
+    failedAttempts: 0,
+    lockUntil: 0,
   });
 });
 
@@ -108,6 +114,8 @@ test('obscure code has expected value when enabled', () => {
   expect(stateHook.result.current).toStrictEqual({
     passcode: '12345',
     obscureCodeEnabled: false,
+    failedAttempts: 0,
+    lockUntil: 0,
   });
 
   act(() => {
@@ -117,6 +125,8 @@ test('obscure code has expected value when enabled', () => {
   expect(stateHook.result.current).toStrictEqual({
     passcode: '12345',
     obscureCodeEnabled: true,
+    failedAttempts: 0,
+    lockUntil: 0,
   });
 });
 
@@ -140,6 +150,8 @@ test('obscure code is unset when passcode is unset', () => {
   expect(stateHook.result.current).toStrictEqual({
     passcode: '12345',
     obscureCodeEnabled: true,
+    failedAttempts: 0,
+    lockUntil: 0,
   });
 
   act(() => {
@@ -149,5 +161,37 @@ test('obscure code is unset when passcode is unset', () => {
   expect(stateHook.result.current).toStrictEqual({
     passcode: null,
     obscureCodeEnabled: false,
+    failedAttempts: 0,
+    lockUntil: 0,
   });
 });
+test('increments attempts and sets lockout', () => {
+  const store = createSecurityStore();
+  const wrapper = createWrapper(store);
+  const actionsHook = renderHook(() => useSecurityActions(), {wrapper});
+  const stateHook = renderHook(() => useSecurityState(), {wrapper});
+
+  act(() => {
+    actionsHook.result.current.incrementAndGetAttempts();
+    actionsHook.result.current.incrementAndGetAttempts();
+    actionsHook.result.current.setLockUntil(123456789);
+  });
+
+  expect(stateHook.result.current.failedAttempts).toBe(2);
+  expect(stateHook.result.current.lockUntil).toBe(123456789);
+});
+test('resets attempts and lockout', () => {
+  const store = createSecurityStore();
+  const wrapper = createWrapper(store);
+  const actionsHook = renderHook(() => useSecurityActions(), {wrapper});
+  const stateHook = renderHook(() => useSecurityState(), {wrapper});
+
+  act(() => {
+    actionsHook.result.current.incrementAndGetAttempts();
+    actionsHook.result.current.setLockUntil(999999);
+    actionsHook.result.current.resetFailedAttempts();
+  });
+
+  expect(stateHook.result.current.failedAttempts).toBe(0);
+  expect(stateHook.result.current.lockUntil).toBe(0);
+});

src/frontend/contexts/SecurityStoreContext.tsx

@@ -14,10 +14,14 @@ const SecurityStateSchema = v.variant('passcode', [
   v.object({
     passcode: PasscodeSchema,
     obscureCodeEnabled: v.boolean(),
+    failedAttempts: v.number(),
+    lockUntil: v.number(),
   }),
   v.object({
     passcode: v.null(),
     obscureCodeEnabled: v.literal(false),
+    failedAttempts: v.literal(0),
+    lockUntil: v.literal(0),
   }),
 ]);
 
@@ -30,6 +34,8 @@ function createInitialState(): SecurityState {
   return {
     passcode: null,
     obscureCodeEnabled: false,
+    failedAttempts: 0,
+    lockUntil: 0,
   };
 }
 
@@ -64,7 +70,12 @@ export function createSecurityStore({persist} = {persist: false}) {
     setPasscode: (passcode: string | null) => {
       // Obscure code needs to be unset when passcode is unset
       if (passcode === null) {
-        store.setState({passcode, obscureCodeEnabled: false});
+        store.setState({
+          passcode: null,
+          obscureCodeEnabled: false,
+          failedAttempts: 0,
+          lockUntil: 0,
+        });
         return;
       }
 
@@ -82,6 +93,19 @@ export function createSecurityStore({persist} = {persist: false}) {
 
       store.setState({obscureCodeEnabled: enable});
     },
+    incrementAndGetAttempts: () => {
+      const current = store.getState().failedAttempts + 1;
+      store.setState({failedAttempts: current});
+      return current;
+    },
+
+    resetFailedAttempts: () => {
+      store.setState({failedAttempts: 0, lockUntil: 0});
+    },
+
+    setLockUntil: (lockUntil: number) => {
+      store.setState({lockUntil});
+    },
   };
 
   return {

src/frontend/hooks/usePasscodeLockout.ts

@@ -0,0 +1,42 @@
+import {useEffect, useState} from 'react';
+import {
+  useSecurityActions,
+  useSecurityState,
+} from '../contexts/SecurityStoreContext';
+import {getRemainingLockoutMinutes} from '../lib/security';
+import {defineMessages, useIntl} from 'react-intl';
+
+const m = defineMessages({
+  lockoutMessage: {
+    id: 'hooks.usePasscodeLockout.lockoutMessage',
+    defaultMessage:
+      'Try again in {minutes, plural, one {# minute} other {# minutes}}',
+  },
+});
+
+export function usePasscodeLockout() {
+  const {lockUntil} = useSecurityState();
+  const {setLockUntil} = useSecurityActions();
+  const [minutes, setMinutes] = useState(0);
+  const {formatMessage} = useIntl();
+
+  useEffect(() => {
+    let timeout: NodeJS.Timeout | null = null;
+    if (lockUntil) {
+      const calcMinutes = getRemainingLockoutMinutes(lockUntil);
+      setMinutes(calcMinutes);
+      timeout = setTimeout(() => {
+        setLockUntil(0);
+      }, calcMinutes * 60_000);
+    }
+
+    return () => {
+      if (timeout) clearTimeout(timeout);
+    };
+  }, [lockUntil, setLockUntil]);
+
+  return {
+    isLockedOut: !!lockUntil,
+    message: formatMessage(m.lockoutMessage, {minutes}),
+  };
+}

src/frontend/images/ClockOutlined.svg

@@ -1,6 +1,11 @@
 import {is} from 'valibot';
 
-import {DEFAULT_OBSCURE_CODE, PasscodeSchema} from './security';
+import {
+  DEFAULT_OBSCURE_CODE,
+  PasscodeSchema,
+  getRemainingLockoutMinutes,
+  getLockoutThreshold,
+} from './security';
 
 test('DEFAULT_OBSCURE_CODE has expected value', () => {
   expect(DEFAULT_OBSCURE_CODE).toBe('00000');
@@ -22,3 +27,34 @@ describe('PasscodeSchema', () => {
     expect(is(PasscodeSchema, '123.4')).toBe(false);
   });
 });
+
+describe('getRemainingLockoutMinutes', () => {
+  test('returns 0 when lockUntil is 0', () => {
+    expect(getRemainingLockoutMinutes(0)).toBe(0);
+  });
+
+  test('returns rounded-up minutes if in future', () => {
+    const future = Date.now() + 2.3 * 60 * 1000;
+    expect(getRemainingLockoutMinutes(future)).toBe(3);
+  });
+
+  test('returns 0 if lockUntil is in the past', () => {
+    const past = Date.now() - 60 * 1000;
+    expect(getRemainingLockoutMinutes(past)).toBe(0);
+  });
+});
+
+describe('getLockoutThreshold', () => {
+  test.each([
+    [1, 0],
+    [4, 0],
+    [5, 1],
+    [6, 0],
+    [7, 3],
+    [8, 5],
+    [9, 5],
+    [20, 5],
+  ])('returns expected minutes for %i attempts', (attempts, expected) => {
+    expect(getLockoutThreshold(attempts)).toBe(expected);
+  });
+});

src/frontend/lib/security.test.ts

@@ -8,3 +8,17 @@ export const PasscodeSchema = pipe(
   digits(),
   notValue(DEFAULT_OBSCURE_CODE, 'Passcode is reserved'),
 );
+
+export function getRemainingLockoutMinutes(lockUntil: number): number {
+  if (!lockUntil) return 0;
+  const msRemaining = lockUntil - Date.now();
+  return msRemaining > 0 ? Math.ceil(msRemaining / 60000) : 0;
+}
+
+export function getLockoutThreshold(attempts: number): number | null {
+  if (attempts === 5) return 1;
+  if (attempts === 7) return 3;
+  if (attempts >= 8) return 5;
+
+  return 0;
+}