This commit is contained in:
@@ -0,0 +1,616 @@
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package authwebauthn
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gamertan.com/web/internal/webauthnvendored/protocol"
|
||||
"gamertan.com/web/internal/webauthnvendored/protocol/webauthncose"
|
||||
wa "gamertan.com/web/internal/webauthnvendored/webauthn"
|
||||
|
||||
"gamertan.com/web/auth"
|
||||
)
|
||||
|
||||
const (
|
||||
defaultEnrollmentLifetime = 15 * time.Minute
|
||||
defaultRegistrationTTL = 5 * time.Minute
|
||||
defaultLoginTTL = 2 * time.Minute
|
||||
defaultApprovalTTL = 90 * time.Second
|
||||
maxCredentialLabelBytes = 80
|
||||
maxResponseBytes = 128 << 10
|
||||
)
|
||||
|
||||
var accountNamePattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]{2,63}$`)
|
||||
|
||||
type Config struct {
|
||||
RPID string
|
||||
RPDisplayName string
|
||||
Origin string
|
||||
EnrollmentLifetime time.Duration
|
||||
RegistrationTTL time.Duration
|
||||
LoginTTL time.Duration
|
||||
ApprovalTTL time.Duration
|
||||
SessionLifetime time.Duration
|
||||
RequiredCredentialCount int
|
||||
Random io.Reader
|
||||
Now func() time.Time
|
||||
}
|
||||
|
||||
type Service struct {
|
||||
repository Repository
|
||||
auth *auth.Service
|
||||
webAuthn *wa.WebAuthn
|
||||
random io.Reader
|
||||
now func() time.Time
|
||||
config Config
|
||||
}
|
||||
|
||||
type BootstrapInput struct {
|
||||
Username, Email, DisplayName string
|
||||
}
|
||||
|
||||
func New(repository Repository, authService *auth.Service, config Config) (*Service, error) {
|
||||
if repository == nil || authService == nil {
|
||||
return nil, errors.New("authwebauthn: repository and auth service are required")
|
||||
}
|
||||
if err := validateOrigin(config.RPID, config.Origin); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if strings.TrimSpace(config.RPDisplayName) == "" || len(config.RPDisplayName) > 80 {
|
||||
return nil, errors.New("authwebauthn: relying-party display name is invalid")
|
||||
}
|
||||
if config.Random == nil {
|
||||
config.Random = rand.Reader
|
||||
}
|
||||
if config.Now == nil {
|
||||
config.Now = time.Now
|
||||
}
|
||||
if config.EnrollmentLifetime == 0 {
|
||||
config.EnrollmentLifetime = defaultEnrollmentLifetime
|
||||
}
|
||||
if config.RegistrationTTL == 0 {
|
||||
config.RegistrationTTL = defaultRegistrationTTL
|
||||
}
|
||||
if config.LoginTTL == 0 {
|
||||
config.LoginTTL = defaultLoginTTL
|
||||
}
|
||||
if config.ApprovalTTL == 0 {
|
||||
config.ApprovalTTL = defaultApprovalTTL
|
||||
}
|
||||
if config.SessionLifetime == 0 {
|
||||
config.SessionLifetime = 12 * time.Hour
|
||||
}
|
||||
if config.RequiredCredentialCount == 0 {
|
||||
config.RequiredCredentialCount = 2
|
||||
}
|
||||
if config.EnrollmentLifetime < time.Minute || config.EnrollmentLifetime > time.Hour ||
|
||||
config.RegistrationTTL < time.Minute || config.RegistrationTTL > 10*time.Minute ||
|
||||
config.LoginTTL < time.Minute || config.LoginTTL > 5*time.Minute ||
|
||||
config.ApprovalTTL < 30*time.Second || config.ApprovalTTL > 2*time.Minute ||
|
||||
config.SessionLifetime < 5*time.Minute || config.SessionLifetime > 30*24*time.Hour ||
|
||||
config.RequiredCredentialCount < 1 || config.RequiredCredentialCount > 8 {
|
||||
return nil, errors.New("authwebauthn: lifetime or credential-count policy is invalid")
|
||||
}
|
||||
webAuthn, err := wa.New(&wa.Config{
|
||||
RPID: config.RPID,
|
||||
RPDisplayName: config.RPDisplayName,
|
||||
RPOrigins: []string{config.Origin},
|
||||
RPAllowCrossOrigin: false,
|
||||
AttestationPreference: protocol.PreferNoAttestation,
|
||||
AuthenticatorSelection: protocol.AuthenticatorSelection{
|
||||
ResidentKey: protocol.ResidentKeyRequirementRequired,
|
||||
RequireResidentKey: protocol.ResidentKeyRequired(),
|
||||
UserVerification: protocol.VerificationRequired,
|
||||
},
|
||||
Timeouts: wa.TimeoutsConfig{
|
||||
Login: wa.TimeoutConfig{Timeout: config.LoginTTL, TimeoutUVD: config.LoginTTL},
|
||||
Registration: wa.TimeoutConfig{Timeout: config.RegistrationTTL, TimeoutUVD: config.RegistrationTTL},
|
||||
},
|
||||
})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("authwebauthn: configure verifier: %w", err)
|
||||
}
|
||||
return &Service{repository: repository, auth: authService, webAuthn: webAuthn, random: config.Random, now: config.Now, config: config}, nil
|
||||
}
|
||||
|
||||
func (service *Service) Bootstrap(ctx context.Context, input BootstrapInput) (auth.User, string, error) {
|
||||
username := strings.TrimSpace(input.Username)
|
||||
email := strings.TrimSpace(input.Email)
|
||||
displayName := strings.TrimSpace(input.DisplayName)
|
||||
if !accountNamePattern.MatchString(username) || email == "" || len(email) > 320 || !strings.Contains(email, "@") || displayName == "" || len(displayName) > 128 {
|
||||
return auth.User{}, "", errors.New("authwebauthn: invalid user")
|
||||
}
|
||||
userID, err := service.randomToken(18)
|
||||
if err != nil {
|
||||
return auth.User{}, "", err
|
||||
}
|
||||
token, enrollment, err := service.newEnrollment(userID)
|
||||
if err != nil {
|
||||
return auth.User{}, "", err
|
||||
}
|
||||
now := service.now().UTC()
|
||||
user := auth.User{ID: userID, Username: username, Email: email, DisplayName: displayName, Status: "active", CreatedAt: now, UpdatedAt: now}
|
||||
audit, err := service.audit("", "auth.passkey.bootstrap", "user", userID, "A local administrator created a passkey-only account and one-time enrollment token.")
|
||||
if err != nil {
|
||||
return auth.User{}, "", err
|
||||
}
|
||||
if err = service.repository.CreatePasskeyUser(ctx, user, enrollment, audit); err != nil {
|
||||
return auth.User{}, "", err
|
||||
}
|
||||
return user, token, nil
|
||||
}
|
||||
|
||||
func (service *Service) Recover(ctx context.Context, identifier, reason string) (auth.User, string, error) {
|
||||
identifier = strings.TrimSpace(identifier)
|
||||
reason = strings.TrimSpace(reason)
|
||||
if identifier == "" || len(identifier) > 320 || reason == "" || len(reason) > 240 || strings.ContainsAny(reason, "\x00\r\n") {
|
||||
return auth.User{}, "", errors.New("authwebauthn: recovery identifier and bounded reason are required")
|
||||
}
|
||||
user, err := service.repository.UserByIdentifier(ctx, identifier)
|
||||
if err != nil {
|
||||
return auth.User{}, "", err
|
||||
}
|
||||
if user.Status != "active" {
|
||||
return auth.User{}, "", auth.ErrInactiveUser
|
||||
}
|
||||
token, enrollment, err := service.newEnrollment(user.ID)
|
||||
if err != nil {
|
||||
return auth.User{}, "", err
|
||||
}
|
||||
audit, err := service.audit("", "auth.passkey.recovery", "user", user.ID, "A local administrator revoked sessions and issued a one-time passkey enrollment token. Reason: "+reason)
|
||||
if err != nil {
|
||||
return auth.User{}, "", err
|
||||
}
|
||||
user, err = service.repository.RecoverUser(ctx, identifier, enrollment, audit)
|
||||
if err != nil {
|
||||
return auth.User{}, "", err
|
||||
}
|
||||
return user, token, nil
|
||||
}
|
||||
|
||||
func (service *Service) BeginEnrollment(ctx context.Context, enrollmentToken, label string) (BeginResult, error) {
|
||||
digest, err := tokenDigest(enrollmentToken)
|
||||
if err != nil {
|
||||
return BeginResult{}, ErrEnrollmentNotFound
|
||||
}
|
||||
user, err := service.repository.ConsumeEnrollmentToken(ctx, digest, service.now().UTC())
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
return service.beginRegistration(ctx, user, label)
|
||||
}
|
||||
|
||||
func (service *Service) BeginRegistration(ctx context.Context, userID, label string) (BeginResult, error) {
|
||||
user, err := service.repository.UserByID(ctx, strings.TrimSpace(userID))
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
return service.beginRegistration(ctx, user, label)
|
||||
}
|
||||
|
||||
func (service *Service) beginRegistration(ctx context.Context, user auth.User, label string) (BeginResult, error) {
|
||||
label, err := credentialLabel(label)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
adapter, err := service.user(ctx, user)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
challenge, err := service.randomBytes(32)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
creation, session, err := service.webAuthn.BeginRegistration(adapter,
|
||||
func(options *protocol.PublicKeyCredentialCreationOptions) { options.Challenge = challenge },
|
||||
wa.WithCredentialParameters([]protocol.CredentialParameter{{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgES256}}),
|
||||
wa.WithResidentKeyRequirement(protocol.ResidentKeyRequirementRequired),
|
||||
wa.WithConveyancePreference(protocol.PreferNoAttestation),
|
||||
)
|
||||
if err != nil {
|
||||
return BeginResult{}, fmt.Errorf("authwebauthn: begin registration: %w", err)
|
||||
}
|
||||
return service.storeCeremony(ctx, CeremonyRegistration, user.ID, label, session, [32]byte{}, creation.Response, service.config.RegistrationTTL)
|
||||
}
|
||||
|
||||
func (service *Service) FinishRegistration(ctx context.Context, ceremonyToken string, response []byte) (Credential, error) {
|
||||
ceremony, err := service.takeCeremony(ctx, ceremonyToken, CeremonyRegistration)
|
||||
if err != nil {
|
||||
return Credential{}, err
|
||||
}
|
||||
if len(response) == 0 || len(response) > maxResponseBytes {
|
||||
return Credential{}, errors.New("authwebauthn: registration response is invalid")
|
||||
}
|
||||
user, err := service.repository.UserByID(ctx, ceremony.UserID)
|
||||
if err != nil {
|
||||
return Credential{}, err
|
||||
}
|
||||
adapter, err := service.user(ctx, user)
|
||||
if err != nil {
|
||||
return Credential{}, err
|
||||
}
|
||||
session, err := decodeSession(ceremony.SessionData)
|
||||
if err != nil {
|
||||
return Credential{}, err
|
||||
}
|
||||
parsed, err := protocol.ParseCredentialCreationResponseBytes(response)
|
||||
if err != nil {
|
||||
return Credential{}, errors.New("authwebauthn: registration response is invalid")
|
||||
}
|
||||
verified, err := service.webAuthn.CreateCredential(adapter, session, parsed)
|
||||
if err != nil {
|
||||
return Credential{}, fmt.Errorf("authwebauthn: verify registration: %w", err)
|
||||
}
|
||||
if verified.Attestation.PublicKeyAlgorithm != int64(webauthncose.AlgES256) {
|
||||
return Credential{}, ErrUnsupportedCredential
|
||||
}
|
||||
encoded, err := json.Marshal(verified)
|
||||
if err != nil {
|
||||
return Credential{}, err
|
||||
}
|
||||
now := service.now().UTC()
|
||||
record := Credential{ID: append([]byte(nil), verified.ID...), UserID: user.ID, Label: ceremony.Label, Data: encoded, CreatedAt: now}
|
||||
audit, err := service.audit(user.ID, "auth.passkey.add", "passkey", base64.RawURLEncoding.EncodeToString(verified.ID), "A passkey was enrolled.")
|
||||
if err != nil {
|
||||
return Credential{}, err
|
||||
}
|
||||
if err = service.repository.SaveCredential(ctx, record, audit); err != nil {
|
||||
return Credential{}, err
|
||||
}
|
||||
return record, nil
|
||||
}
|
||||
|
||||
func (service *Service) BeginLogin(ctx context.Context) (BeginResult, error) {
|
||||
challenge, err := service.randomBytes(32)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
assertion, session, err := service.webAuthn.BeginDiscoverableLogin(
|
||||
wa.WithChallenge(challenge),
|
||||
wa.WithUserVerification(protocol.VerificationRequired),
|
||||
)
|
||||
if err != nil {
|
||||
return BeginResult{}, fmt.Errorf("authwebauthn: begin login: %w", err)
|
||||
}
|
||||
return service.storeCeremony(ctx, CeremonyLogin, "", "", session, [32]byte{}, assertion.Response, service.config.LoginTTL)
|
||||
}
|
||||
|
||||
func (service *Service) FinishLogin(ctx context.Context, ceremonyToken string, response []byte) (Authentication, error) {
|
||||
ceremony, err := service.takeCeremony(ctx, ceremonyToken, CeremonyLogin)
|
||||
if err != nil {
|
||||
return Authentication{}, err
|
||||
}
|
||||
if len(response) == 0 || len(response) > maxResponseBytes {
|
||||
return Authentication{}, errors.New("authwebauthn: login response is invalid")
|
||||
}
|
||||
session, err := decodeSession(ceremony.SessionData)
|
||||
if err != nil {
|
||||
return Authentication{}, err
|
||||
}
|
||||
parsed, err := protocol.ParseCredentialRequestResponseBytes(response)
|
||||
if err != nil {
|
||||
return Authentication{}, errors.New("authwebauthn: login response is invalid")
|
||||
}
|
||||
var loaded *passkeyUser
|
||||
user, verified, err := service.webAuthn.ValidatePasskeyLogin(func(rawID, userHandle []byte) (wa.User, error) {
|
||||
account, lookupErr := service.repository.UserByCredentialID(ctx, rawID)
|
||||
if lookupErr != nil || account.ID != string(userHandle) {
|
||||
return nil, ErrCredentialNotFound
|
||||
}
|
||||
loaded, lookupErr = service.user(ctx, account)
|
||||
return loaded, lookupErr
|
||||
}, session, parsed)
|
||||
if err != nil || loaded == nil || user == nil {
|
||||
return Authentication{}, errors.New("authwebauthn: authentication failed")
|
||||
}
|
||||
if err = service.persistUsedCredential(ctx, loaded.account.ID, verified); err != nil {
|
||||
return Authentication{}, err
|
||||
}
|
||||
token, principal, err := service.auth.IssueSession(ctx, loaded.account.ID, service.config.SessionLifetime)
|
||||
if err != nil {
|
||||
return Authentication{}, err
|
||||
}
|
||||
return Authentication{SessionToken: token, Principal: principal, CredentialID: append([]byte(nil), verified.ID...), CloneWarning: verified.Authenticator.CloneWarning}, nil
|
||||
}
|
||||
|
||||
func (service *Service) BeginApproval(ctx context.Context, userID string, binding []byte) (BeginResult, error) {
|
||||
if len(binding) < 32 || len(binding) > 32<<10 {
|
||||
return BeginResult{}, errors.New("authwebauthn: operation binding is invalid")
|
||||
}
|
||||
if err := service.RequireReady(ctx, userID); err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
account, err := service.repository.UserByID(ctx, userID)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
adapter, err := service.user(ctx, account)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
challenge, err := service.randomBytes(32)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
assertion, session, err := service.webAuthn.BeginLogin(adapter, wa.WithChallenge(challenge), wa.WithUserVerification(protocol.VerificationRequired))
|
||||
if err != nil {
|
||||
return BeginResult{}, fmt.Errorf("authwebauthn: begin approval: %w", err)
|
||||
}
|
||||
return service.storeCeremony(ctx, CeremonyApproval, account.ID, "", session, BindingDigest(binding), assertion.Response, service.config.ApprovalTTL)
|
||||
}
|
||||
|
||||
func (service *Service) FinishApproval(ctx context.Context, ceremonyToken string, binding, response []byte) (Approval, error) {
|
||||
ceremony, err := service.takeCeremony(ctx, ceremonyToken, CeremonyApproval)
|
||||
if err != nil {
|
||||
return Approval{}, err
|
||||
}
|
||||
if BindingDigest(binding) != ceremony.BindingDigest {
|
||||
return Approval{}, ErrOperationBinding
|
||||
}
|
||||
if len(response) == 0 || len(response) > maxResponseBytes {
|
||||
return Approval{}, errors.New("authwebauthn: approval response is invalid")
|
||||
}
|
||||
account, err := service.repository.UserByID(ctx, ceremony.UserID)
|
||||
if err != nil {
|
||||
return Approval{}, err
|
||||
}
|
||||
adapter, err := service.user(ctx, account)
|
||||
if err != nil {
|
||||
return Approval{}, err
|
||||
}
|
||||
session, err := decodeSession(ceremony.SessionData)
|
||||
if err != nil {
|
||||
return Approval{}, err
|
||||
}
|
||||
parsed, err := protocol.ParseCredentialRequestResponseBytes(response)
|
||||
if err != nil {
|
||||
return Approval{}, errors.New("authwebauthn: approval response is invalid")
|
||||
}
|
||||
verified, err := service.webAuthn.ValidateLogin(adapter, session, parsed)
|
||||
if err != nil {
|
||||
return Approval{}, errors.New("authwebauthn: approval failed")
|
||||
}
|
||||
if err = service.persistUsedCredential(ctx, account.ID, verified); err != nil {
|
||||
return Approval{}, err
|
||||
}
|
||||
return Approval{User: account, CredentialID: append([]byte(nil), verified.ID...), BindingDigest: ceremony.BindingDigest, CloneWarning: verified.Authenticator.CloneWarning, ApprovedAt: service.now().UTC()}, nil
|
||||
}
|
||||
|
||||
func (service *Service) RequireReady(ctx context.Context, userID string) error {
|
||||
count, err := service.repository.CredentialCount(ctx, userID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if count < service.config.RequiredCredentialCount {
|
||||
return ErrPasskeyReadiness
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RequiredCredentialCount reports the configured operational credential
|
||||
// floor. Applications can use it to explain rotation policy without
|
||||
// duplicating security configuration.
|
||||
func (service *Service) RequiredCredentialCount() int {
|
||||
return service.config.RequiredCredentialCount
|
||||
}
|
||||
|
||||
// CredentialSummaries returns bounded account-owner metadata without exposing
|
||||
// stored credential documents.
|
||||
func (service *Service) CredentialSummaries(ctx context.Context, userID string) ([]CredentialSummary, error) {
|
||||
records, err := service.repository.CredentialsByUserID(ctx, userID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
summaries := make([]CredentialSummary, 0, len(records))
|
||||
for _, record := range records {
|
||||
summaries = append(summaries, CredentialSummary{
|
||||
ID: append([]byte(nil), record.ID...),
|
||||
Label: record.Label,
|
||||
CreatedAt: record.CreatedAt,
|
||||
LastUsedAt: record.LastUsedAt,
|
||||
})
|
||||
}
|
||||
return summaries, nil
|
||||
}
|
||||
|
||||
func (service *Service) BeginCredentialRemoval(ctx context.Context, userID string, credentialID []byte) (BeginResult, error) {
|
||||
if len(credentialID) < 16 || len(credentialID) > 1024 {
|
||||
return BeginResult{}, ErrCredentialNotFound
|
||||
}
|
||||
records, err := service.repository.CredentialsByUserID(ctx, userID)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
found := false
|
||||
for _, record := range records {
|
||||
if bytes.Equal(record.ID, credentialID) {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
return BeginResult{}, ErrCredentialNotFound
|
||||
}
|
||||
if len(records) <= service.config.RequiredCredentialCount {
|
||||
return BeginResult{}, ErrCredentialFloor
|
||||
}
|
||||
return service.BeginApproval(ctx, userID, credentialRemovalBinding(userID, credentialID))
|
||||
}
|
||||
|
||||
func (service *Service) FinishCredentialRemoval(ctx context.Context, ceremonyToken, userID string, credentialID, response []byte) error {
|
||||
binding := credentialRemovalBinding(userID, credentialID)
|
||||
approval, err := service.FinishApproval(ctx, ceremonyToken, binding, response)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if approval.User.ID != userID || approval.BindingDigest != BindingDigest(binding) {
|
||||
return ErrOperationBinding
|
||||
}
|
||||
audit, err := service.audit(userID, "auth.passkey.remove", "passkey", base64.RawURLEncoding.EncodeToString(credentialID), "A passkey was removed after fresh authentication.")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return service.repository.DeleteCredential(ctx, userID, credentialID, service.config.RequiredCredentialCount, audit)
|
||||
}
|
||||
|
||||
func (service *Service) storeCeremony(ctx context.Context, kind, userID, label string, session *wa.SessionData, binding [32]byte, publicKey any, ttl time.Duration) (BeginResult, error) {
|
||||
token, err := service.randomToken(32)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
digest := sha256.Sum256([]byte(token))
|
||||
now := service.now().UTC()
|
||||
session.Expires = now.Add(ttl)
|
||||
sessionJSON, err := json.Marshal(session)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
publicJSON, err := json.Marshal(publicKey)
|
||||
if err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
ceremony := Ceremony{Digest: digest, Kind: kind, UserID: userID, Label: label, SessionData: sessionJSON, BindingDigest: binding, CreatedAt: now, ExpiresAt: now.Add(ttl)}
|
||||
if err = service.repository.CreateCeremony(ctx, ceremony); err != nil {
|
||||
return BeginResult{}, err
|
||||
}
|
||||
return BeginResult{CeremonyToken: token, PublicKey: publicJSON, ExpiresAt: ceremony.ExpiresAt}, nil
|
||||
}
|
||||
|
||||
func (service *Service) takeCeremony(ctx context.Context, token, kind string) (Ceremony, error) {
|
||||
digest, err := tokenDigest(token)
|
||||
if err != nil {
|
||||
return Ceremony{}, ErrCeremonyNotFound
|
||||
}
|
||||
ceremony, err := service.repository.TakeCeremony(ctx, digest, service.now().UTC())
|
||||
if err != nil {
|
||||
return Ceremony{}, err
|
||||
}
|
||||
if ceremony.Kind != kind {
|
||||
return Ceremony{}, ErrCeremonyNotFound
|
||||
}
|
||||
return ceremony, nil
|
||||
}
|
||||
|
||||
func (service *Service) user(ctx context.Context, account auth.User) (*passkeyUser, error) {
|
||||
if account.Status != "active" {
|
||||
return nil, auth.ErrInactiveUser
|
||||
}
|
||||
records, err := service.repository.CredentialsByUserID(ctx, account.ID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
credentials := make([]wa.Credential, 0, len(records))
|
||||
for _, record := range records {
|
||||
var credential wa.Credential
|
||||
if err = json.Unmarshal(record.Data, &credential); err != nil || len(credential.ID) == 0 {
|
||||
return nil, errors.New("authwebauthn: stored credential is invalid")
|
||||
}
|
||||
credentials = append(credentials, credential)
|
||||
}
|
||||
return &passkeyUser{account: account, credentials: credentials}, nil
|
||||
}
|
||||
|
||||
func (service *Service) persistUsedCredential(ctx context.Context, userID string, credential *wa.Credential) error {
|
||||
encoded, err := json.Marshal(credential)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return service.repository.UpdateCredential(ctx, Credential{ID: append([]byte(nil), credential.ID...), UserID: userID, Data: encoded, LastUsedAt: service.now().UTC()})
|
||||
}
|
||||
|
||||
func (service *Service) newEnrollment(userID string) (string, EnrollmentToken, error) {
|
||||
token, err := service.randomToken(32)
|
||||
if err != nil {
|
||||
return "", EnrollmentToken{}, err
|
||||
}
|
||||
now := service.now().UTC()
|
||||
return token, EnrollmentToken{Digest: sha256.Sum256([]byte(token)), UserID: userID, CreatedAt: now, ExpiresAt: now.Add(service.config.EnrollmentLifetime)}, nil
|
||||
}
|
||||
|
||||
func (service *Service) audit(actor, action, resourceType, resourceID, summary string) (auth.AuditEvent, error) {
|
||||
id, err := service.randomToken(18)
|
||||
if err != nil {
|
||||
return auth.AuditEvent{}, err
|
||||
}
|
||||
return auth.AuditEvent{ID: id, ActorUserID: actor, Action: action, ResourceType: resourceType, ResourceID: resourceID, Summary: summary, CreatedAt: service.now().UTC()}, nil
|
||||
}
|
||||
|
||||
func (service *Service) randomToken(size int) (string, error) {
|
||||
value, err := service.randomBytes(size)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(value), nil
|
||||
}
|
||||
|
||||
func (service *Service) randomBytes(size int) ([]byte, error) {
|
||||
value := make([]byte, size)
|
||||
if _, err := io.ReadFull(service.random, value); err != nil {
|
||||
return nil, fmt.Errorf("authwebauthn: secure randomness unavailable: %w", err)
|
||||
}
|
||||
return value, nil
|
||||
}
|
||||
|
||||
func tokenDigest(token string) ([32]byte, error) {
|
||||
if len(token) < 32 || len(token) > 128 {
|
||||
return [32]byte{}, errors.New("invalid token")
|
||||
}
|
||||
if _, err := base64.RawURLEncoding.DecodeString(token); err != nil {
|
||||
return [32]byte{}, errors.New("invalid token")
|
||||
}
|
||||
return sha256.Sum256([]byte(token)), nil
|
||||
}
|
||||
|
||||
func decodeSession(value []byte) (wa.SessionData, error) {
|
||||
var session wa.SessionData
|
||||
if len(value) == 0 || len(value) > 64<<10 || json.Unmarshal(value, &session) != nil {
|
||||
return wa.SessionData{}, errors.New("authwebauthn: stored ceremony is invalid")
|
||||
}
|
||||
return session, nil
|
||||
}
|
||||
|
||||
func credentialLabel(value string) (string, error) {
|
||||
value = strings.TrimSpace(value)
|
||||
if value == "" || len(value) > maxCredentialLabelBytes || strings.ContainsAny(value, "\x00\r\n") {
|
||||
return "", errors.New("authwebauthn: credential label is invalid")
|
||||
}
|
||||
return value, nil
|
||||
}
|
||||
|
||||
func credentialRemovalBinding(userID string, credentialID []byte) []byte {
|
||||
return []byte("gamertan-web/passkey-remove/v1\x00" + userID + "\x00" + base64.RawURLEncoding.EncodeToString(credentialID))
|
||||
}
|
||||
|
||||
func validateOrigin(rpID, rawOrigin string) error {
|
||||
if strings.TrimSpace(rpID) == "" || strings.TrimSpace(rawOrigin) == "" {
|
||||
return errors.New("authwebauthn: relying-party ID and origin are required")
|
||||
}
|
||||
origin, err := url.Parse(rawOrigin)
|
||||
if err != nil || origin.Scheme != "https" || origin.Hostname() != rpID || origin.Port() != "" || origin.User != nil || origin.Path != "" || origin.RawQuery != "" || origin.Fragment != "" {
|
||||
return errors.New("authwebauthn: origin must be the exact HTTPS relying-party origin")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
type passkeyUser struct {
|
||||
account auth.User
|
||||
credentials []wa.Credential
|
||||
}
|
||||
|
||||
func (user *passkeyUser) WebAuthnID() []byte { return []byte(user.account.ID) }
|
||||
func (user *passkeyUser) WebAuthnName() string { return user.account.Username }
|
||||
func (user *passkeyUser) WebAuthnDisplayName() string { return user.account.DisplayName }
|
||||
func (user *passkeyUser) WebAuthnCredentials() []wa.Credential { return user.credentials }
|
||||
Reference in New Issue
Block a user