A phone as the second factor: Keystore keys approve sign-ins by the number the browser shows, and the sudo step asks a stale session again before sensitive changes (closes #356) a22e4aec2e28

-- Phones as a second factor (oxygenhub#356): a phone's Keystore key, kept

-- with the sign-in it made (gone when that token is revoked); the

-- approvals it is asked for, each a number to match; and when each

-- browser session last proved a second factor, for the sudo step.

CREATE TABLE authenticators (

    token_id     BIGINT PRIMARY KEY REFERENCES tokens(id) ON DELETE CASCADE,

    account_id   BIGINT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    name         TEXT NOT NULL,

    public_key   TEXT NOT NULL,

    created_ms   BIGINT NOT NULL,

    last_used_ms BIGINT NOT NULL DEFAULT 0

);

CREATE INDEX authenticators_by_account ON authenticators (account_id);

CREATE TABLE approvals (

    id          TEXT PRIMARY KEY,

    account_id  BIGINT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    kind        TEXT NOT NULL,

    what        TEXT NOT NULL,

    number      BIGINT NOT NULL,

    choices     TEXT NOT NULL,

    session_id  BIGINT,

    created_ms  BIGINT NOT NULL,

    expires_ms  BIGINT NOT NULL,

    state       TEXT NOT NULL DEFAULT 'pending',

    decided_ms  BIGINT NOT NULL DEFAULT 0,

    decided_by  BIGINT

);

CREATE INDEX approvals_by_account ON approvals (account_id, state);

ALTER TABLE sessions ADD COLUMN second_factor_ms BIGINT NOT NULL DEFAULT 0;

-- Phones as a second factor (oxygenhub#356): a phone's Keystore key, kept

-- with the sign-in it made (gone when that token is revoked); the

-- approvals it is asked for, each a number to match; and when each

-- browser session last proved a second factor, for the sudo step.

CREATE TABLE authenticators (

    token_id     INTEGER PRIMARY KEY REFERENCES tokens(id) ON DELETE CASCADE,

    account_id   INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    name         TEXT NOT NULL,

    public_key   TEXT NOT NULL,

    created_ms   INTEGER NOT NULL,

    last_used_ms INTEGER NOT NULL DEFAULT 0

);

CREATE INDEX authenticators_by_account ON authenticators (account_id);

CREATE TABLE approvals (

    id          TEXT PRIMARY KEY,

    account_id  INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    kind        TEXT NOT NULL,

    what        TEXT NOT NULL,

    number      INTEGER NOT NULL,

    choices     TEXT NOT NULL,

    session_id  INTEGER,

    created_ms  INTEGER NOT NULL,

    expires_ms  INTEGER NOT NULL,

    state       TEXT NOT NULL DEFAULT 'pending',

    decided_ms  INTEGER NOT NULL DEFAULT 0,

    decided_by  INTEGER

);

CREATE INDEX approvals_by_account ON approvals (account_id, state);

ALTER TABLE sessions ADD COLUMN second_factor_ms INTEGER NOT NULL DEFAULT 0;

//! A phone as a second factor over the API (oxygenhub#356): register this

//! phone's Keystore key, list and remove phones, and answer the approvals

//! a browser asks for. Agents' tokens can do none of it.

use super::{caller, ApiError, Caller};

use crate::auth::{phone, totp};

use crate::db::{self, accounts, approvals};

use crate::Shared;

use axum::extract::{Path, State};

use axum::http::{HeaderMap, StatusCode};

use axum::Json;

use hub_api::{ApprovalAnswer, Authenticator, NewAuthenticator, PendingApproval};

/// The caller as a person's phone: its account and the token it signed in with.

fn phone_of(c: &Caller) -> Result<(&accounts::Account, i64), ApiError> {

    let account = c.require("user:read")?;

    if c.agent {

        return Err(ApiError(StatusCode::FORBIDDEN, "an agent cannot be a second factor".into()));

    }

    let Some(id) = c.token_id else {

        return Err(ApiError(StatusCode::UNAUTHORIZED, "a phone uses the token it signed in with".into()));

    };

    Ok((account, id))

}

/// `POST /api/v1/user/authenticators`: this phone as a second factor. It

/// needs the account's current authenticator-app code, so a token alone

/// cannot add one, and the app code stays the way in when the phone is lost.

pub async fn add(

    State(app): State<Shared>,

    headers: HeaderMap,

    Json(r): Json<NewAuthenticator>,

) -> Result<(StatusCode, Json<Authenticator>), ApiError> {

    let c = caller(&app, &headers).await?;

    let (account, id) = phone_of(&c)?;

    let Some(secret) = account.totp_secret.as_deref() else {

        return Err(ApiError(

            StatusCode::CONFLICT,

            "set up an authenticator app first (Settings › Security on the hub): it stays the way in if this phone is lost".into(),

        ));

    };

    if !totp::verify(secret, r.code.trim(), (db::now_ms() / 1000) as u64) {

        accounts::audit(&app.db, Some(account), "2fa.phone_add_failed", &c.token, "wrong code").await.ok();

        return Err(ApiError(StatusCode::FORBIDDEN, "that code is not right".into()));

    }

    let Some(point) = phone::public_point(&r.public_key) else {

        return Err(ApiError(StatusCode::BAD_REQUEST, "public_key is a P-256 key: hex of its SubjectPublicKeyInfo".into()));

    };

    approvals::add_authenticator(&app.db, id, account.id, &c.token, &point).await?;

    accounts::audit(&app.db, Some(account), "2fa.phone_added", &c.token, "").await.ok();

    let a = approvals::authenticator(&app.db, id).await?.expect("just added");

    Ok((StatusCode::CREATED, Json(Authenticator { id, name: a.name, created_ms: a.created_ms, last_used_ms: a.last_used_ms, this: true })))

}

/// `GET /api/v1/user/authenticators`: the account's phones.

pub async fn list(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Authenticator>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let account = c.require("user:read")?;

    let this = c.token_id;

    Ok(Json(

        approvals::authenticators(&app.db, account.id)

            .await?

            .into_iter()

            .map(|a| Authenticator {

                this: Some(a.token_id) == this,

                id: a.token_id,

                name: a.name,

                created_ms: a.created_ms,

                last_used_ms: a.last_used_ms,

            })

            .collect(),

    ))

}

/// `DELETE /api/v1/user/authenticators`: this phone stops being a second factor.

pub async fn remove(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let (account, id) = phone_of(&c)?;

    if approvals::remove_authenticator(&app.db, account.id, id).await? {

        accounts::audit(&app.db, Some(account), "2fa.phone_removed", &c.token, "").await.ok();

    }

    Ok(StatusCode::NO_CONTENT)

}

/// `GET /api/v1/user/approvals`: what waits for this phone's answer.

pub async fn pending(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<PendingApproval>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (account, id) = phone_of(&c)?;

    if approvals::authenticator(&app.db, id).await?.is_none() {

        return Ok(Json(Vec::new()));

    }

    Ok(Json(

        approvals::pending(&app.db, account.id, db::now_ms())

            .await?

            .into_iter()

            .map(|a| PendingApproval {

                choices: a.choices.split(',').filter_map(|n| n.parse().ok()).collect(),

                id: a.id,

                kind: a.kind,

                what: a.what,

                created_ms: a.created_ms,

                expires_ms: a.expires_ms,

            })

            .collect(),

    ))

}

/// `POST /api/v1/user/approvals/{id}`: this phone's answer. Approving takes

/// the number the browser shows and the phone key's signature; a wrong

/// number denies it, as a guess should.

pub async fn answer(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path(approval): Path<String>,

    Json(r): Json<ApprovalAnswer>,

) -> Result<Json<serde_json::Value>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (account, id) = phone_of(&c)?;

    let Some(key) = approvals::authenticator(&app.db, id).await?.filter(|a| a.account_id == account.id) else {

        return Err(ApiError(StatusCode::FORBIDDEN, "this phone is not a second factor of the account".into()));

    };

    let now = db::now_ms();

    let Some(a) = approvals::get(&app.db, &approval).await?.filter(|a| a.account_id == account.id) else {

        return Err(ApiError(StatusCode::NOT_FOUND, "no such approval".into()));

    };

    if a.state != "pending" || a.expires_ms <= now {

        return Err(ApiError(StatusCode::CONFLICT, "that approval was answered already, or ran out of time".into()));

    }

    let state = if !r.approve {

        "denied"

    } else {

        let Ok(sig) = hex::decode(r.signature.trim()) else {

            return Err(ApiError(StatusCode::BAD_REQUEST, "signature is hex".into()));

        };

        if !phone::verify(&key.public_key, &phone::message(&a.id, r.number, true), &sig) {

            accounts::audit(&app.db, Some(account), "2fa.bad_signature", &c.token, &a.kind).await.ok();

            return Err(ApiError(StatusCode::FORBIDDEN, "the signature is not this phone's".into()));

        }

        if r.number == a.number {

            "approved"

        } else {

            "denied"

        }

    };

    if !approvals::decide(&app.db, &a.id, state, id, now).await? {

        return Err(ApiError(StatusCode::CONFLICT, "that approval was answered already, or ran out of time".into()));

    }

    if state == "approved" {

        if let Some(session) = a.session_id.filter(|_| a.kind == "stepup") {

            db::sessions::mark_second_factor(&app.db, session, now).await?;

        }

    }

    let detail = if r.approve && state == "denied" { format!("{}: wrong number", a.kind) } else { a.kind.clone() };

    accounts::audit(&app.db, Some(account), &format!("2fa.{state}"), &c.token, &detail).await.ok();

    Ok(Json(serde_json::json!({ "state": state })))

}

//! The phone as a second factor (oxygenhub#356): a P-256 key made in the

//! phone's Keystore, usable only after a fingerprint, face or the device

//! PIN, signs each approval; the browser shows one number and the phone

//! offers three, so a tap without reading approves nothing.

use crate::db::{self, accounts::Account, approvals};

use crate::Shared;

use rand::{seq::SliceRandom, Rng, RngCore};

use ring::signature::{UnparsedPublicKey, ECDSA_P256_SHA256_ASN1};

/// How long a phone has to answer.

pub const APPROVAL_MS: i64 = 2 * 60_000;

/// How long a proved second factor lets a session past the sudo step.

pub const FRESH_MS: i64 = 15 * 60_000;

/// The DER header of a P-256 SubjectPublicKeyInfo (what Android's

/// `PublicKey.getEncoded()` gives), before the 65-byte point.

const P256_SPKI: [u8; 26] = [

    0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01,

    0x07, 0x03, 0x42, 0x00,

];

/// A phone's public key, given as hex of its SubjectPublicKeyInfo or of

/// the bare uncompressed point: the point, as hex. None when it is

/// neither, or not on the curve.

pub fn public_point(hex_key: &str) -> Option<String> {

    let bytes = hex::decode(hex_key.trim()).ok()?;

    let point = match bytes.len() {

        91 if bytes[..26] == P256_SPKI => &bytes[26..],

        65 => &bytes[..],

        _ => return None,

    };

    if point[0] != 0x04 {

        return None;

    }

    // ring checks that the point is on the curve when it verifies, so a

    // bad key only ever fails to verify.

    Some(hex::encode(point))

}

/// What the phone signs to answer approval `id`.

pub fn message(id: &str, number: i64, approve: bool) -> Vec<u8> {

    format!("oxygenhub approval v1\n{id}\n{number}\n{}", if approve { "approve" } else { "deny" }).into_bytes()

}

/// Whether `signature` (DER, as ECDSA gives it) is the phone's over `msg`.

pub fn verify(point_hex: &str, msg: &[u8], signature: &[u8]) -> bool {

    let Ok(point) = hex::decode(point_hex) else { return false };

    UnparsedPublicKey::new(&ECDSA_P256_SHA256_ASN1, point).verify(msg, signature).is_ok()

}

/// Three different two-digit numbers in a random order, and the one the

/// browser shows.

pub fn numbers() -> (i64, [i64; 3]) {

    let mut rng = rand::thread_rng();

    let mut all: Vec<i64> = (10..100).collect();

    all.shuffle(&mut rng);

    let choices = [all[0], all[1], all[2]];

    (choices[rng.gen_range(0..3)], choices)

}

fn new_id() -> String {

    let mut b = [0u8; 16];

    rand::rngs::OsRng.fill_bytes(&mut b);

    hex::encode(b)

}

/// Ask the account's phones to approve `what`: recorded, and sent as an

/// alert where alerts are on (the app also looks when it opens). For a

/// step-up, `session_id` is the browser session it makes fresh.

pub async fn ask(app: &Shared, account: &Account, kind: &str, what: &str, session_id: Option<i64>) -> sqlx::Result<approvals::Approval> {

    let id = new_id();

    let (number, choices) = numbers();

    let choices = choices.iter().map(|n| n.to_string()).collect::<Vec<_>>().join(",");

    let what: String = what.chars().take(200).collect();

    approvals::create(

        &app.db,

        approvals::NewApproval {

            id: &id,

            account_id: account.id,

            kind,

            what: &what,

            number,

            choices: &choices,

            session_id,

            expires_ms: db::now_ms() + APPROVAL_MS,

        },

    )

    .await?;

    crate::push::send(app, account.id, crate::push::Alert { kind: "approval".into(), title: what, url: format!("/approvals/{id}") });

    Ok(approvals::get(&app.db, &id).await?.expect("just made"))

}

#[cfg(test)]

mod tests {

    use super::*;

    use ring::rand::SystemRandom;

    use ring::signature::{EcdsaKeyPair, KeyPair, ECDSA_P256_SHA256_ASN1_SIGNING};

    #[test]

    fn a_phone_signature_verifies_and_nothing_else_does() {

        let rng = SystemRandom::new();

        let pkcs8 = EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, &rng).unwrap();

        let pair = EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, pkcs8.as_ref(), &rng).unwrap();

        let point = hex::encode(pair.public_key().as_ref());

        let spki = format!("{}{point}", hex::encode(P256_SPKI));

        assert_eq!(public_point(&spki).as_deref(), Some(point.as_str()), "the Keystore's encoding");

        assert_eq!(public_point(&point).as_deref(), Some(point.as_str()), "a bare point");

        assert_eq!(public_point("00ff"), None);

        let m = message("ab", 47, true);

        let sig = pair.sign(&rng, &m).unwrap();

        assert!(verify(&point, &m, sig.as_ref()));

        assert!(!verify(&point, &message("ab", 48, true), sig.as_ref()), "another number");

        assert!(!verify(&point, &message("ab", 47, false), sig.as_ref()), "a denial is not an approval");

        assert!(!verify(&point, &message("ac", 47, true), sig.as_ref()), "another approval");

    }

    #[test]

    fn three_different_numbers_one_shown() {

        for _ in 0..200 {

            let (n, c) = numbers();

            assert!(c.contains(&n));

            assert!(c[0] != c[1] && c[1] != c[2] && c[0] != c[2]);

            assert!(c.iter().all(|x| (10..100).contains(x)));

        }

    }

}

//! Phones as a second factor (oxygenhub#356): their keys, and the

//! approvals they are asked for.

use super::{now_ms, Pool};

use sqlx::FromRow;

/// A phone that approves for its account: the Keystore key of the sign-in

/// (token) it made, as an uncompressed P-256 point in hex.

#[derive(Clone, Debug, FromRow)]

pub struct Authenticator {

    pub token_id: i64,

    pub account_id: i64,

    pub name: String,

    pub public_key: String,

    pub created_ms: i64,

    pub last_used_ms: i64,

}

const AUTH_COLUMNS: &str = "token_id, account_id, name, public_key, created_ms, last_used_ms";

/// Register (or replace) the key of the phone signed in with `token_id`.

pub async fn add_authenticator(pool: &Pool, token_id: i64, account_id: i64, name: &str, public_key: &str) -> sqlx::Result<()> {

    sqlx::query(

        "INSERT INTO authenticators (token_id, account_id, name, public_key, created_ms) VALUES ($1, $2, $3, $4, $5) \

         ON CONFLICT (token_id) DO UPDATE SET name = excluded.name, public_key = excluded.public_key, created_ms = excluded.created_ms",

    )

    .bind(token_id)

    .bind(account_id)

    .bind(name)

    .bind(public_key)

    .bind(now_ms())

    .execute(pool)

    .await?;

    Ok(())

}

pub async fn authenticators(pool: &Pool, account_id: i64) -> sqlx::Result<Vec<Authenticator>> {

    sqlx::query_as(&format!("SELECT {AUTH_COLUMNS} FROM authenticators WHERE account_id = $1 ORDER BY created_ms"))

        .bind(account_id)

        .fetch_all(pool)

        .await

}

pub async fn authenticator(pool: &Pool, token_id: i64) -> sqlx::Result<Option<Authenticator>> {

    sqlx::query_as(&format!("SELECT {AUTH_COLUMNS} FROM authenticators WHERE token_id = $1")).bind(token_id).fetch_optional(pool).await

}

/// Remove one of the account's phones; false when it had none by that id.

pub async fn remove_authenticator(pool: &Pool, account_id: i64, token_id: i64) -> sqlx::Result<bool> {

    Ok(sqlx::query("DELETE FROM authenticators WHERE account_id = $1 AND token_id = $2")

        .bind(account_id)

        .bind(token_id)

        .execute(pool)

        .await?

        .rows_affected()

        > 0)

}

/// An approval asked of the account's phones: what for, the number the

/// page shows among the three the phone offers, and what became of it.

#[derive(Clone, Debug, FromRow)]

pub struct Approval {

    pub id: String,

    pub account_id: i64,

    /// `signin` or `stepup`.

    pub kind: String,

    pub what: String,

    pub number: i64,

    /// The three numbers the phone offers, comma-separated.

    pub choices: String,

    /// For a step-up: the browser session it makes fresh.

    pub session_id: Option<i64>,

    pub created_ms: i64,

    pub expires_ms: i64,

    /// `pending`, `approved`, `denied`, or `used` once a sign-in took it.

    pub state: String,

    pub decided_ms: i64,

    pub decided_by: Option<i64>,

}

const COLUMNS: &str = "id, account_id, kind, what, number, choices, session_id, created_ms, expires_ms, state, decided_ms, decided_by";

pub struct NewApproval<'a> {

    pub id: &'a str,

    pub account_id: i64,

    pub kind: &'a str,

    pub what: &'a str,

    pub number: i64,

    pub choices: &'a str,

    pub session_id: Option<i64>,

    pub expires_ms: i64,

}

pub async fn create(pool: &Pool, a: NewApproval<'_>) -> sqlx::Result<()> {

    sqlx::query(

        "INSERT INTO approvals (id, account_id, kind, what, number, choices, session_id, created_ms, expires_ms) \

         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",

    )

    .bind(a.id)

    .bind(a.account_id)

    .bind(a.kind)

    .bind(a.what)

    .bind(a.number)

    .bind(a.choices)

    .bind(a.session_id)

    .bind(now_ms())

    .bind(a.expires_ms)

    .execute(pool)

    .await?;

    Ok(())

}

pub async fn get(pool: &Pool, id: &str) -> sqlx::Result<Option<Approval>> {

    sqlx::query_as(&format!("SELECT {COLUMNS} FROM approvals WHERE id = $1")).bind(id).fetch_optional(pool).await

}

/// The account's approvals still waiting at `now`, newest first.

pub async fn pending(pool: &Pool, account_id: i64, now: i64) -> sqlx::Result<Vec<Approval>> {

    sqlx::query_as(&format!(

        "SELECT {COLUMNS} FROM approvals WHERE account_id = $1 AND state = 'pending' AND expires_ms > $2 ORDER BY created_ms DESC"

    ))

    .bind(account_id)

    .bind(now)

    .fetch_all(pool)

    .await

}

/// Decide a pending approval, once: false when it was no longer pending

/// or had expired.

pub async fn decide(pool: &Pool, id: &str, state: &str, by: i64, now: i64) -> sqlx::Result<bool> {

    let done = sqlx::query(

        "UPDATE approvals SET state = $1, decided_ms = $2, decided_by = $3 WHERE id = $4 AND state = 'pending' AND expires_ms > $2",

    )

    .bind(state)

    .bind(now)

    .bind(by)

    .bind(id)

    .execute(pool)

    .await?

    .rows_affected()

        > 0;

    if done && state == "approved" {

        sqlx::query("UPDATE authenticators SET last_used_ms = $1 WHERE token_id = $2").bind(now).bind(by).execute(pool).await?;

    }

    Ok(done)

}

/// Take an approved sign-in approval for the sign-in it was made for,

/// once: false when it is not approved, or was taken already.

pub async fn take(pool: &Pool, id: &str, account_id: i64) -> sqlx::Result<bool> {

    Ok(sqlx::query("UPDATE approvals SET state = 'used' WHERE id = $1 AND account_id = $2 AND state = 'approved' AND kind = 'signin'")

        .bind(id)

        .bind(account_id)

        .execute(pool)

        .await?

        .rows_affected()

        > 0)

}

/// Approvals that ended a day ago or more are of no further use.

pub async fn sweep(pool: &Pool, now: i64) -> sqlx::Result<u64> {

    Ok(sqlx::query("DELETE FROM approvals WHERE expires_ms < $1").bind(now - 86_400_000).execute(pool).await?.rows_affected())

}

//! The sudo step (oxygenhub#356): before a sensitive change (a password,

//! two-factor settings, keys and tokens, secrets, a repository's deletion

//! or transfer, the site's administration), a session that has not proved

//! a second factor for a while proves one again: a phone's approval, a code

//! from the authenticator app, or the password when the account has no

//! second factor. Signing in counts as proof.

use super::{Error, Page, Shell};

use crate::auth::{self, phone, totp, Viewer};

use crate::db::{self, accounts};

use crate::throttle::{self, Key};

use crate::Shared;

use askama::Template;

use axum::extract::{Form, Path, Query, State};

use axum::http::{header, Method, StatusCode};

use axum::response::{IntoResponse, Redirect, Response};

use serde::Deserialize;

/// Whether a request changes something the sudo step guards. Only

/// changes are guarded: reading a page never asks.

pub fn sensitive(method: &Method, path: &str) -> bool {

    if method == Method::GET || method == Method::HEAD {

        return false;

    }

    let p = path.trim_end_matches('/');

    if p.starts_with("/admin") {

        return true;

    }

    if matches!(

        p,

        "/settings/password"

            | "/settings/security/totp/disable"

            | "/settings/keys/upload"

            | "/settings/keys/unlink"

            | "/settings/tokens"

            | "/settings/backups"

    ) || p.starts_with("/settings/security/phones/")

        || p.starts_with("/settings/security/disconnect/")

        || (p.starts_with("/settings/tokens/") && p.ends_with("/agent"))

    {

        return true;

    }

    let parts: Vec<&str> = p.trim_start_matches('/').split('/').collect();

    match parts.as_slice() {

        ["orgs", _, "settings", what] => matches!(*what, "secrets" | "storage" | "hooks" | "backups"),

        [owner, _, "settings", what] if !matches!(*owner, "settings" | "admin" | "orgs") => {

            matches!(*what, "delete" | "transfer" | "secrets" | "hooks" | "push-protection" | "secret-bypass" | "backup" | "collaborators")

        }

        _ => false,

    }

}

/// The middleware: a guarded change from a session whose proof is older

/// than [`phone::FRESH_MS`] goes to the sudo page instead, which comes back

/// to the page it was sent from.

pub async fn gate(State(app): State<Shared>, req: axum::extract::Request, next: axum::middleware::Next) -> Response {

    if !sensitive(req.method(), req.uri().path()) {

        return next.run(req).await;

    }

    let Some(value) = auth::viewer::cookie(req.headers(), auth::SESSION_COOKIE) else { return next.run(req).await };

    let Some((_, session)) = auth::viewer::resolve(&app, &value).await else { return next.run(req).await };

    if db::now_ms() - session.second_factor_ms < phone::FRESH_MS {

        return next.run(req).await;

    }

    let base = app.config.base_url().trim_end_matches('/').to_string();

    let back = req

        .headers()

        .get(header::REFERER)

        .and_then(|v| v.to_str().ok())

        .and_then(|r| r.strip_prefix(&base))

        .filter(|p| p.starts_with('/') && !p.starts_with("//"))

        .unwrap_or("/settings/security")

        .to_string();

    Redirect::to(&format!("/sudo?next={}", super::settings::urlencode(&back))).into_response()

}

#[derive(Template)]

#[template(path = "sudo.html")]

pub struct SudoPage {

    shell: Shell,

    next: String,

    error: Option<String>,

    /// The account has a phone that approves.

    phones: bool,

    /// The account has an authenticator app.

    totp: bool,

    /// Neither: the password stands in.

    password: bool,

    /// Waiting for the phone: the approval and its number.

    approval: Option<(String, i64)>,

}

#[derive(Deserialize)]

pub struct NextQuery {

    #[serde(default)]

    next: String,

}

fn safe_next(next: &str) -> String {

    if next.starts_with('/') && !next.starts_with("//") {

        next.to_string()

    } else {

        "/".into()

    }

}

async fn page(

    app: &Shared,

    viewer: &Viewer,

    next: &str,

    error: Option<String>,

    approval: Option<(String, i64)>,

) -> Result<Response, Error> {

    let shell = Shell::new(app, "/sudo", viewer);

    let Some(me) = viewer.account() else {

        return Ok(Redirect::to(&format!("/login?next={}", super::settings::urlencode(next))).into_response());

    };

    let totp = me.totp_secret.is_some();

    let phones = totp && !db::approvals::authenticators(&app.db, me.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.is_empty();

    let password = !totp && !me.password_hash.is_empty();

    Ok(Page(SudoPage { shell, next: safe_next(next), error, phones, totp, password, approval }).into_response())

}

/// `GET /sudo?next=`: prove it is you, then carry on.

pub async fn show(State(app): State<Shared>, viewer: Viewer, Query(q): Query<NextQuery>) -> Result<Response, Error> {

    page(&app, &viewer, &q.next, None, None).await

}

#[derive(Deserialize)]

pub struct SudoForm {

    #[serde(rename = "_csrf")]

    csrf: String,

    #[serde(default)]

    next: String,

    #[serde(default)]

    code: String,

    #[serde(default)]

    password: String,

}

/// `POST /sudo`: a code from the authenticator app (or a recovery code),

/// or the password for an account without one.

pub async fn confirm(State(app): State<Shared>, viewer: Viewer, Form(f): Form<SudoForm>) -> Result<Response, Error> {

    let Some(me) = viewer.0.clone() else { return Ok(Redirect::to("/login").into_response()) };

    let shell = Shell::new(&app, "/sudo", &viewer);

    if !viewer.csrf_ok(&f.csrf) {

        return page(&app, &viewer, &f.next, Some("That form had expired: try again.".into()), None).await;

    }

    let now = db::now_ms();

    let keys = [Key::account("sudo", &me.account.username)];

    let wait = app.throttle.lock().unwrap().wait(&keys, now);

    if let Some(wait) = wait {

        return page(&app, &viewer, &f.next, Some(throttle::message(wait)), None).await;

    }

    let ok = match &me.account.totp_secret {

        Some(secret) => {

            totp::verify(secret, f.code.trim(), (now / 1000) as u64)

                || match totp::use_recovery_code(&me.account.recovery_codes, f.code.trim()) {

                    Some(rest) => {

                        accounts::set_totp(&app.db, me.account.id, Some(secret), &rest)

                            .await

                            .map_err(|e| Error::from_db(shell.clone(), e))?;

                        true

                    }

                    None => false,

                }

        }

        None => !me.account.password_hash.is_empty() && auth::verify_password(&me.account.password_hash, &f.password),

    };

    if !ok {

        app.throttle.lock().unwrap().failed(&keys, now);

        accounts::audit(&app.db, Some(&me.account), "sudo.failed", &me.account.username, "").await.ok();

        let what = if me.account.totp_secret.is_some() { "That code is not right." } else { "That password is not right." };

        return page(&app, &viewer, &f.next, Some(what.into()), None).await;

    }

    app.throttle.lock().unwrap().cleared(&keys[0]);

    db::sessions::mark_second_factor(&app.db, me.session_id, now).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(

        &app.db,

        Some(&me.account),

        "sudo",

        &me.account.username,

        if me.account.totp_secret.is_some() { "code" } else { "password" },

    )

    .await

    .ok();

    Ok(Redirect::to(&safe_next(&f.next)).into_response())

}

#[derive(Deserialize)]

pub struct PhoneForm {

    #[serde(rename = "_csrf")]

    csrf: String,

    #[serde(default)]

    next: String,

}

/// `POST /sudo/phone`: ask the account's phones; the page waits for one.

pub async fn ask_phone(

    State(app): State<Shared>,

    viewer: Viewer,

    headers: axum::http::HeaderMap,

    Form(f): Form<PhoneForm>,

) -> Result<Response, Error> {

    let Some(me) = viewer.0.clone() else { return Ok(Redirect::to("/login").into_response()) };

    let shell = Shell::new(&app, "/sudo", &viewer);

    if !viewer.csrf_ok(&f.csrf) {

        return page(&app, &viewer, &f.next, Some("That form had expired: try again.".into()), None).await;

    }

    let agent = headers.get(header::USER_AGENT).and_then(|v| v.to_str().ok()).unwrap_or("");

    let what = format!("Confirm a change from {}", super::settings::browser_of(agent));

    let a = phone::ask(&app, &me.account, "stepup", &what, Some(me.session_id)).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    page(&app, &viewer, &f.next, None, Some((a.id, a.number))).await

}

/// `GET /sudo/approval/{id}`: what became of this session's approval.

pub async fn approval_state(State(app): State<Shared>, viewer: Viewer, Path(id): Path<String>) -> Response {

    let found = match viewer.0.as_ref() {

        Some(me) => {

            db::approvals::get(&app.db, &id).await.ok().flatten().filter(|a| a.session_id == Some(me.session_id) && a.kind == "stepup")

        }

        None => None,

    };

    match found {

        Some(a) => {

            let state = if a.state == "pending" && a.expires_ms <= db::now_ms() { "expired".to_string() } else { a.state };

            axum::Json(serde_json::json!({ "state": state })).into_response()

        }

        None => (StatusCode::NOT_FOUND, axum::Json(serde_json::json!({ "state": "unknown" }))).into_response(),

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn only_changes_that_matter_are_guarded() {

        let post = Method::POST;

        for p in [

            "/settings/password",

            "/settings/security/totp/disable",

            "/settings/security/phones/3/remove",

            "/settings/tokens",

            "/settings/tokens/4/agent",

            "/settings/keys/upload",

            "/admin/mail",

            "/admin/runners/7/state",

            "/orgs/acme/settings/secrets",

            "/andy/demo/settings/delete",

            "/andy/demo/settings/transfer",

            "/andy/demo/settings/secrets",

            "/andy/demo/settings/collaborators",

        ] {

            assert!(sensitive(&post, p), "{p}");

        }

        for p in [

            "/settings",

            "/settings/appearance",

            "/settings/security/totp/begin",

            "/settings/tokens/4/delete",

            "/andy/demo/issues/new",

            "/andy/demo/settings/topics",

            "/login",

            "/sudo",

        ] {

            assert!(!sensitive(&post, p), "{p}");

        }

        assert!(!sensitive(&Method::GET, "/admin/mail"), "reading never asks");

    }

}

{% extends "base.html" %}

{% block title %}Confirm it is you{% endblock %}

{% block content %}

<div class="head"><h1>Confirm it is you</h1></div>

<p class="mute">This change needs a fresh proof that it is you. It lasts 15 minutes; then go back and make the change again.</p>

{% if let Some(e) = error %}<p class="error">{{ e }}</p>{% endif %}

{% if let Some((id, number)) = approval %}

<section class="card-box">

  <div class="approve-wait pad" data-approval-poll="/sudo/approval/{{ id }}" data-approval-next="{{ next }}" aria-live="polite">

    <p>Open OxygenHub on your phone and pick</p>

    <p class="approve-number" aria-label="the number {{ number }}">{{ number }}</p>

    <p class="small mute" data-approval-status>Waiting for your phone…</p>

  </div>

</section>

{% else %}

{% if phones %}<section class="card-box">

  <form class="pad sec-form sec-split" method="post" action="/sudo/phone">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <input type="hidden" name="next" value="{{ next }}">

    <p>Approve on your phone, with your fingerprint, face or PIN.</p>

    <button type="submit">APPROVE ON MY PHONE</button>

  </form>

</section>{% endif %}

{% endif %}

<section class="card-box">

  <form class="pad sec-form" method="post" action="/sudo">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <input type="hidden" name="next" value="{{ next }}">

    {% if totp %}

    <div class="sec-row"><label for="code">{% if phones %}Or a code{% else %}A code{% endif %} from your authenticator app, or a recovery code</label><input type="text" id="code" name="code" inputmode="numeric" autocomplete="one-time-code"{% if !phones %} autofocus{% endif %} required><button type="submit">CONFIRM</button></div>

    {% else if password %}

    <div class="sec-row"><label for="password">Your password</label><input type="password" id="password" name="password" autocomplete="current-password" autofocus required><button type="submit">CONFIRM</button></div>

    <p class="small mute">With two-factor authentication on (Settings › Security), a code or your phone confirms instead.</p>

    {% else %}

    <p>Your account signs in through another service and has no password here: sign out and sign in again to confirm.</p>

    {% endif %}

  </form>

</section>

<p class="small"><a href="{{ next }}">Go back</a></p>

{% endblock %}

## Unreleased

- **Added: your phone as the second factor, and the sudo step (#356).** With two-factor sign-in on, the OxygenHub app can add the phone as a second factor (its Keystore key, opened by your fingerprint, face or PIN; adding it needs a current app code). Signing in then shows a two-digit number and waits: the phone offers three, you pick the one shown and confirm, and the browser carries on, with "Use a code instead" always there. A wrong number is a no. Before sensitive changes (password, two-factor settings, keys, tokens, secrets, webhooks, collaborators, deleting or transferring a repository, anything under Administration) a session that has not proved a second factor in 15 minutes is asked again at `/sudo`: the phone, a code, or the password for an account without two-factor. Settings › Security lists the phones; turning app codes off removes them. API: `/api/v1/user/authenticators`, `/api/v1/user/approvals`; migration 0104.

  /* Waiting for a phone's approval (oxygenhub#356): at sign-in the page

     posts its proof of the password and signs in once the phone approves;

     at the sudo step it asks with the session and goes back where it came

     from. A no, or too long a wait, says so and stops. */

  (function () {

    var box = document.querySelector("[data-approval-poll]");

    if (!box) return;

    var status = box.querySelector("[data-approval-status]");

    var form = box.closest("form");

    var url = box.getAttribute("data-approval-poll");

    var said = {

      denied: "Your phone said no, or a different number was picked. Sign in again, or use a code.",

      expired: "That took too long. Start again, or use a code.",

      unknown: "That approval is gone. Start again."

    };

    var tries = 0;

    function ask() {

      var req;

      if (form) {

        var body = new URLSearchParams();

        ["username", "pending", "approval"].forEach(function (n) {

          var el = form.querySelector('input[name="' + n + '"]');

          if (el) body.set(n, el.value);

        });

        req = fetch(url, { method: "POST", credentials: "same-origin", body: body });

      } else {

        req = fetch(url, { credentials: "same-origin", headers: { accept: "application/json" } });

      }

      req.then(function (r) { return r.json(); }).then(function (j) {

        var state = j && j.state;

        box.setAttribute("data-state", state || "");

        if (state === "approved") {

          if (status) status.textContent = "Approved. Carrying on…";

          if (form) form.submit(); else location.href = box.getAttribute("data-approval-next") || "/";

        } else if (said[state] || state === "used") {

          if (status) status.textContent = said[state] || said.unknown;

        } else if (++tries < 75) {

          setTimeout(ask, 2000);

        }

      }).catch(function () { if (++tries < 75) setTimeout(ask, 4000); });

    }

    setTimeout(ask, 1500);

  })();

/// `POST /user/authenticators` (oxygenhub#356): this phone as a second

/// factor. `public_key` is hex of the Keystore key's SubjectPublicKeyInfo

/// (or its bare uncompressed P-256 point); `code` is the account's current

/// authenticator-app code, which adding a phone needs.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct NewAuthenticator {

    pub public_key: String,

    pub code: String,

}

/// A phone that approves sign-ins and sensitive actions for its account.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct Authenticator {

    /// The sign-in (token) it belongs to: signing that phone out removes it.

    pub id: i64,

    pub name: String,

    pub created_ms: i64,

    /// When it last approved something; 0 for never.

    pub last_used_ms: i64,

    /// The caller's own phone.

    #[serde(default)]

    pub this: bool,

}

/// An approval waiting for the caller's phone (`GET /user/approvals`).

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct PendingApproval {

    pub id: String,

    /// `signin` or `stepup`.

    pub kind: String,

    /// What it is for: "Sign in from Firefox on Linux, 203.0.113.9".

    pub what: String,

    /// The three numbers to offer; the browser shows one of them.

    pub choices: Vec<i64>,

    pub created_ms: i64,

    pub expires_ms: i64,

}

/// `POST /user/approvals/{id}`: the phone's answer. To approve, `number`

/// is the one picked and `signature` the hex DER ECDSA signature, by the

/// phone's key, over `oxygenhub approval v1\n{id}\n{number}\napprove`.

/// A denial needs neither.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct ApprovalAnswer {

    pub approve: bool,

    #[serde(default)]

    pub number: i64,

    #[serde(default)]

    pub signature: String,

}

        ("NewAuthenticator", schemars::schema_for!(NewAuthenticator)),

        ("Authenticator", schemars::schema_for!(Authenticator)),

        ("PendingApproval", schemars::schema_for!(PendingApproval)),

        ("ApprovalAnswer", schemars::schema_for!(ApprovalAnswer)),

mod approvals;

        .route("/user/authenticators", get(approvals::list).post(approvals::add).delete(approvals::remove))

        .route("/user/approvals", get(approvals::pending))

        .route("/user/approvals/{id}", post(approvals::answer))

pub mod phone;

pub mod approvals;

    /// When it last proved a second factor, or signed in (oxygenhub#356):

    /// the sudo step asks again once this is older than its window.

    pub second_factor_ms: i64,

const COLUMNS: &str = "id, account_id, salt, created_ms, seen_ms, address, agent, second_factor_ms";

    // Signing in is as fresh as proof gets (oxygenhub#356).

    sqlx::query_scalar(

        "INSERT INTO sessions (account_id, hash, salt, created_ms, seen_ms, second_factor_ms) VALUES ($1, $2, $3, $4, $5, $6) RETURNING id",

    )

    .bind(account_id)

    .bind(hash)

    .bind(salt)

    .bind(now)

    .bind(now)

    .bind(now)

    .fetch_one(pool)

    .await

}

/// The session proved a second factor (or the password, for an account

/// without one) at `now`: the sudo step lets it through for a while.

pub async fn mark_second_factor(pool: &Pool, session_id: i64, now: i64) -> sqlx::Result<()> {

    sqlx::query("UPDATE sessions SET second_factor_ms = $1 WHERE id = $2").bind(now).bind(session_id).execute(pool).await?;

    Ok(())

}

pub async fn by_id(pool: &Pool, id: i64) -> sqlx::Result<Option<Session>> {

    sqlx::query_as(&format!("SELECT {COLUMNS} FROM sessions WHERE id = $1")).bind(id).fetch_optional(pool).await

        let s = Session {

            id: 1,

            account_id: 1,

            salt: "a".into(),

            created_ms: t0,

            seen_ms: t0,

            address: String::new(),

            agent: String::new(),

            second_factor_ms: t0,

        };

mod sudo;

        .route("/login/approval", post(session::approval_state))

        .route("/sudo", get(sudo::show).post(sudo::confirm))

        .route("/sudo/phone", post(sudo::ask_phone))

        .route("/sudo/approval/{id}", get(sudo::approval_state))

        .route("/settings/security/phones/{id}/remove", post(settings::phone_remove))

        .layer(axum::middleware::from_fn_with_state(app.clone(), sudo::gate))

    /// Waiting for the phone (oxygenhub#356): the approval and the number

    /// to pick on it.

    approval: Option<(String, i64)>,

    /// The account has a phone that approves, so the code step offers it.

    phones: bool,

        approval: None,

        phones: false,

    /// The approval the phone gave this sign-in (oxygenhub#356).

    #[serde(default)]

    approval: String,

    /// Asked for the code rather than the phone.

    #[serde(default)]

    use_code: String,

    let phones = match &account {

        Some(a) if a.totp_secret.is_some() => {

            !db::approvals::authenticators(&app.db, a.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.is_empty()

        }

        _ => false,

    };

            error: (!msg.is_empty()).then(|| msg.into()),

            approval: None,

            phones,

            // The phone, when the account has one (oxygenhub#356): an

            // approval it gave this sign-in, or a new one to ask for.

            if !f.use_code.is_empty() {

                return Ok(fail("", Some(username)));

            }

            if !f.approval.is_empty() {

                if !db::approvals::take(&app.db, &f.approval, account.id).await.map_err(|e| Error::from_db(shell.clone(), e))? {

                    return Ok(fail("Your phone has not approved this sign-in. Try again, or use a code.", Some(username)));

                }

                app.throttle.lock().unwrap().cleared(&keys[0]);

                accounts::audit(&app.db, Some(&account), "login", &username, "approved on a phone").await.ok();

                return Ok(signed_in(&app, &account, &next).await);

            }

            if phones {

                let agent = headers.get(header::USER_AGENT).and_then(|v| v.to_str().ok()).unwrap_or("");

                let from = if addr.is_empty() { String::new() } else { format!(", {addr}") };

                let what = format!("Sign in from {}{from}", super::settings::browser_of(agent));

                let a =

                    crate::auth::phone::ask(&app, &account, "signin", &what, None).await.map_err(|e| Error::from_db(shell.clone(), e))?;

                return Ok(Page(LoginPage {

                    shell: shell.clone(),

                    error: None,

                    next: next.clone(),

                    totp_for: Some(username),

                    pending: pending.clone(),

                    reset: false,

                    providers: vec![],

                    approval: Some((a.id, a.number)),

                    phones,

                })

                .into_response());

            }

}

#[derive(Deserialize)]

pub struct ApprovalPoll {

    username: String,

    pending: String,

    approval: String,

}

/// `POST /login/approval` (oxygenhub#356): what became of a sign-in's

/// approval, for the page waiting on the phone. Only the sign-in that

/// proved the password may ask.

pub async fn approval_state(State(app): State<Shared>, Form(f): Form<ApprovalPoll>) -> Response {

    let now = db::now_ms();

    let state = async {

        let account = accounts::account_by_name(&app.db, f.username.trim()).await.ok()??;

        if !auth::pending_login_ok(&app.cookie_key, &account.username, &account.session_salt, &f.pending, now) {

            return None;

        }

        let a = db::approvals::get(&app.db, &f.approval).await.ok()??;

        if a.account_id != account.id || a.kind != "signin" {

            return None;

        }

        Some(if a.state == "pending" && a.expires_ms <= now { "expired".to_string() } else { a.state })

    }

    .await;

    match state {

        Some(s) => axum::Json(serde_json::json!({ "state": s })).into_response(),

        None => (axum::http::StatusCode::NOT_FOUND, axum::Json(serde_json::json!({ "state": "unknown" }))).into_response(),

    }

    /// Phones that approve as a second factor (oxygenhub#356).

    phones: Vec<crate::db::approvals::Authenticator>,

    let phones = crate::db::approvals::authenticators(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    Ok(Page(SecurityPage {

        shell,

        me: me.account,

        notice: q.notice,

        error: q.error,

        enrol: None,

        recovery: vec![],

        connected,

        sessions,

        phones,

    }))

        phones: vec![],

            phones: vec![],

        phones: vec![],

            phones: vec![],