Restrict public web apps sessions to their own form session

Verify ownership at the single load chokepoint, FormSessionFactory: a
public session may only build a live session whose stored username and
domain match its HMAC-authenticated principal; otherwise throw
FormNotFoundException.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nospame

src/main/java/org/commcare/formplayer/application/FormSessionFactory.java

@@ -1,5 +1,7 @@
 package org.commcare.formplayer.application;
 
+import org.commcare.formplayer.beans.auth.HqUserDetailsBean;
+import org.commcare.formplayer.exceptions.FormNotFoundException;
 import org.commcare.formplayer.objects.SerializableFormSession;
 import org.commcare.formplayer.services.FormDefinitionService;
 import org.commcare.formplayer.services.FormplayerRemoteInstanceFetcher;
@@ -8,13 +10,18 @@
 import org.commcare.formplayer.services.RestoreFactory;
 import org.commcare.formplayer.services.VirtualDataInstanceService;
 import org.commcare.formplayer.session.FormSession;
+import org.commcare.formplayer.util.RequestUtils;
+import org.commcare.modern.database.TableBuilder;
 import org.commcare.session.CommCareSession;
 import org.javarosa.core.model.actions.FormSendCalloutHandler;
 import org.jetbrains.annotations.NotNull;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.lang.Nullable;
 import org.springframework.stereotype.Component;
 
+import java.util.Objects;
+import java.util.Optional;
+
 @Component
 public class FormSessionFactory {
 
@@ -47,6 +54,7 @@ public FormSession getFormSession(SerializableFormSession serializableFormSessio
     @NotNull
     public FormSession getFormSession(SerializableFormSession serializableFormSession,
             @Nullable CommCareSession commCareSession, @Nullable String windowWidth) throws Exception {
+        verifyPublicSessionOwnership(serializableFormSession);
         FormplayerRemoteInstanceFetcher formplayerRemoteInstanceFetcher = new FormplayerRemoteInstanceFetcher(
                 runnerService.getCaseSearchHelper(),
                 virtualDataInstanceService);
@@ -60,4 +68,24 @@ public FormSession getFormSession(SerializableFormSession serializableFormSessio
                 windowWidth
         );
     }
+
+    /**
+     * A public web apps session may only operate on the form session that its own one-time link
+     * created. The session stores the scrubbed authoritative username, so any session bound to a
+     * different user/domain is rejected. No-op for non-public sessions and non-request contexts.
+     *
+     * Package-private for testing.
+     */
+    void verifyPublicSessionOwnership(SerializableFormSession session) {
+        Optional<HqUserDetailsBean> userDetails = RequestUtils.getUserDetails();
+        if (userDetails.isEmpty() || !userDetails.get().isPublicSession()) {
+            return;
+        }
+        HqUserDetailsBean details = userDetails.get();
+        boolean owned = Objects.equals(session.getDomain(), details.getDomain())
+                && Objects.equals(session.getUsername(), TableBuilder.scrubName(details.getUsername()));
+        if (!owned) {
+            throw new FormNotFoundException(session.getId());
+        }
+    }
 }

src/test/java/org/commcare/formplayer/application/FormSessionFactoryTest.java

@@ -0,0 +1,95 @@
+package org.commcare.formplayer.application;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.when;
+
+import org.commcare.formplayer.beans.auth.HqUserDetailsBean;
+import org.commcare.formplayer.exceptions.FormNotFoundException;
+import org.commcare.formplayer.objects.SerializableFormSession;
+import org.commcare.formplayer.util.RequestUtils;
+import org.commcare.modern.database.TableBuilder;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+
+import java.util.Optional;
+
+/**
+ * Unit tests for {@link FormSessionFactory#verifyPublicSessionOwnership}: a public web apps session
+ * may only load the form session its own one-time link created, never another user's by id.
+ */
+public class FormSessionFactoryTest {
+
+    private final FormSessionFactory factory = new FormSessionFactory();
+
+    private HqUserDetailsBean publicBean(String username, String domain) {
+        HqUserDetailsBean bean = new HqUserDetailsBean(domain, new String[]{domain}, username,
+                false, new String[]{}, new String[]{});
+        bean.setPublicSession(true);
+        return bean;
+    }
+
+    private SerializableFormSession session(String username, String domain) {
+        SerializableFormSession session = mock(SerializableFormSession.class);
+        // Sessions persist the scrubbed username (see FormSession's new-session constructor).
+        when(session.getUsername()).thenReturn(TableBuilder.scrubName(username));
+        when(session.getDomain()).thenReturn(domain);
+        when(session.getId()).thenReturn("session-id");
+        return session;
+    }
+
+    @Test
+    public void publicSession_cannotLoadAnotherUsersFormSession() {
+        SerializableFormSession victimSession = session("victim@domain", "domain");
+        try (MockedStatic<RequestUtils> mocked = mockStatic(RequestUtils.class)) {
+            mocked.when(RequestUtils::getUserDetails)
+                    .thenReturn(Optional.of(publicBean("public_abc@domain", "domain")));
+            assertThrows(FormNotFoundException.class,
+                    () -> factory.verifyPublicSessionOwnership(victimSession));
+        }
+    }
+
+    @Test
+    public void publicSession_cannotLoadFormSessionInAnotherDomain() {
+        SerializableFormSession otherDomainSession = session("public_abc@other", "other");
+        try (MockedStatic<RequestUtils> mocked = mockStatic(RequestUtils.class)) {
+            mocked.when(RequestUtils::getUserDetails)
+                    .thenReturn(Optional.of(publicBean("public_abc@domain", "domain")));
+            assertThrows(FormNotFoundException.class,
+                    () -> factory.verifyPublicSessionOwnership(otherDomainSession));
+        }
+    }
+
+    @Test
+    public void publicSession_canLoadItsOwnFormSession() {
+        SerializableFormSession ownSession = session("public_abc@domain", "domain");
+        try (MockedStatic<RequestUtils> mocked = mockStatic(RequestUtils.class)) {
+            mocked.when(RequestUtils::getUserDetails)
+                    .thenReturn(Optional.of(publicBean("public_abc@domain", "domain")));
+            // Its own session passes the check (no exception).
+            factory.verifyPublicSessionOwnership(ownSession);
+        }
+    }
+
+    @Test
+    public void nonPublicSession_ownershipCheckIsSkipped() {
+        // A regular session is unaffected: the check only constrains public sessions.
+        SerializableFormSession anySession = session("someone-else@domain", "domain");
+        try (MockedStatic<RequestUtils> mocked = mockStatic(RequestUtils.class)) {
+            mocked.when(RequestUtils::getUserDetails)
+                    .thenReturn(Optional.of(new HqUserDetailsBean("domain", "user")));
+            factory.verifyPublicSessionOwnership(anySession);
+        }
+    }
+
+    @Test
+    public void noAuthenticatedUser_ownershipCheckIsSkipped() {
+        // Non-request / unauthenticated contexts (e.g. purge tasks) must not be blocked.
+        SerializableFormSession anySession = session("someone@domain", "domain");
+        try (MockedStatic<RequestUtils> mocked = mockStatic(RequestUtils.class)) {
+            mocked.when(RequestUtils::getUserDetails).thenReturn(Optional.empty());
+            factory.verifyPublicSessionOwnership(anySession);
+        }
+    }
+}