mod.rs 96.5%

83 of 86 lines run, 26 of 30 functions · run #539 on main · run missed

//! Authentication and authorisation (hub spec §5, §15.3): passwords,
//! session cookies, CSRF tokens, TOTP, personal access tokens, roles, and
//! the viewer extractor pages use.

pub mod phone;
pub mod roles;
pub mod totp;
pub mod viewer;

pub use roles::{Access, Role};
pub use viewer::{Viewer, ViewerAccount};

use argon2::password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString};
use argon2::Argon2;
use rand::RngCore;
use std::path::Path;
use subtle::ConstantTimeEq;

/// The key that signs cookies and CSRF tokens, kept in `<data>/keys/cookie.key`.
#[derive(Clone)]
pub struct CookieKey([u8; 32]);

impl CookieKey {
    pub fn load_or_create(keys: &Path) -> anyhow::Result<CookieKey> {
        std::fs::create_dir_all(keys)?;
        let path = keys.join("cookie.key");
        if let Ok(bytes) = std::fs::read(&path) {
            if bytes.len() == 32 {
                return Ok(CookieKey(bytes.try_into().unwrap()));
            }
        }
        let mut k = [0u8; 32];
        rand::rngs::OsRng.fill_bytes(&mut k);
        std::fs::write(&path, k)?;
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;
        }
        Ok(CookieKey(k))
    }

    /// Keyed BLAKE3 over `message`, as hex.
    pub fn mac(&self, message: &[u8]) -> String {
        hex::encode(blake3::keyed_hash(&self.0, message).as_bytes())
    }
}

/// Constant-time equality of two hex MACs.
pub fn mac_equal(a: &str, b: &str) -> bool {
    a.len() == b.len() && a.as_bytes().ct_eq(b.as_bytes()).into()
}

pub fn hash_password(password: &str) -> anyhow::Result<String> {
    let salt = SaltString::generate(&mut rand::rngs::OsRng);
    Ok(Argon2::default().hash_password(password.as_bytes(), &salt).map_err(|e| anyhow::anyhow!("{e}"))?.to_string())
}

pub fn verify_password(hash: &str, password: &str) -> bool {
    match PasswordHash::new(hash) {
        Ok(parsed) => Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok(),
        Err(_) => false,
    }
}

/// A password policy that is honest rather than theatrical: length only.
pub fn password_ok(password: &str) -> Result<(), &'static str> {
    if password.chars().count() < 10 {
        return Err("a password is at least 10 characters");
    }
    if password.len() > 256 {
        return Err("a password is at most 256 bytes");
    }
    Ok(())
}

pub fn random_hex(bytes: usize) -> String {
    let mut b = vec![0u8; bytes];
    rand::rngs::OsRng.fill_bytes(&mut b);
    hex::encode(b)
}

/// A personal access token: `oxyhub_` plus 32 random bytes as hex. Stored
/// as its BLAKE3 hash.
pub fn new_token() -> (String, String) {
    let secret = format!("oxyhub_{}", random_hex(32));
    (secret.clone(), token_hash(&secret))
}

pub fn token_hash(secret: &str) -> String {
    hex::encode(blake3::hash(secret.as_bytes()).as_bytes())
}

/// A new session id for the cookie (oxygenhub#223): random, and kept on
/// the server only as its [`token_hash`].
pub fn new_session_id() -> String {
    random_hex(32)
}

/// Proof, for the code step of a sign-in with two-factor authentication,
/// that `username` gave the right password: `UNTIL.MAC`, good until `until`
/// (ms) and void as soon as the account's session salt changes (a new
/// password, or everyone signed out), so the code step need not ask for
/// the password again.
pub fn pending_login(key: &CookieKey, username: &str, session_salt: &str, until: i64) -> String {
    format!("{until}.{}", key.mac(format!("pending-login:{username}:{session_salt}:{until}").as_bytes()))
}

/// Whether `token` is a [`pending_login`] for this account still in time.
pub fn pending_login_ok(key: &CookieKey, username: &str, session_salt: &str, token: &str, now: i64) -> bool {
    let Some((until, _)) = token.split_once('.') else { return false };
    let Ok(until) = until.parse::<i64>() else { return false };
    until > now && mac_equal(token, &pending_login(key, username, session_salt, until))
}

/// The CSRF token bound to a session value.
pub fn csrf_token(key: &CookieKey, session_value: &str) -> String {
    key.mac(format!("csrf:{session_value}").as_bytes())
}

pub const SESSION_COOKIE: &str = "oxyhub";

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn passwords_and_tokens() {
        let h = hash_password("correct horse battery").unwrap();
        assert!(verify_password(&h, "correct horse battery"));
        assert!(!verify_password(&h, "wrong"));
        assert!(!verify_password("garbage", "x"));
        assert!(password_ok("short").is_err());
        let (secret, hash) = new_token();
        assert!(secret.starts_with("oxyhub_"));
        assert_eq!(token_hash(&secret), hash);
        assert!(mac_equal("ab", "ab") && !mac_equal("ab", "ac") && !mac_equal("a", "ab"));
    }

    #[test]
    fn cookie_key_persists() {
        let dir = tempfile::tempdir().unwrap();
        let a = CookieKey::load_or_create(dir.path()).unwrap();
        let b = CookieKey::load_or_create(dir.path()).unwrap();
        assert_eq!(a.mac(b"x"), b.mac(b"x"));
        let v = new_session_id();
        assert_eq!(v.len(), 64);
        assert_ne!(v, new_session_id());
        assert_ne!(csrf_token(&a, &v), csrf_token(&a, "other"));
    }
}

1		//! Authentication and authorisation (hub spec §5, §15.3): passwords,
2		//! session cookies, CSRF tokens, TOTP, personal access tokens, roles, and
3		//! the viewer extractor pages use.
4
5		pub mod phone;
6		pub mod roles;
7		pub mod totp;
8		pub mod viewer;
9
10		pub use roles::{Access, Role};
11		pub use viewer::{Viewer, ViewerAccount};
12
13		use argon2::password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString};
14		use argon2::Argon2;
15		use rand::RngCore;
16		use std::path::Path;
17		use subtle::ConstantTimeEq;
18
19		/// The key that signs cookies and CSRF tokens, kept in `<data>/keys/cookie.key`.
20		#[derive(Clone)]
21		pub struct CookieKey([u8; 32]);
22
23		impl CookieKey {
24	209×	pub fn load_or_create(keys: &Path) -> anyhow::Result<CookieKey> {
25	209×	std::fs::create_dir_all(keys)?;
26	209×	let path = keys.join("cookie.key");
27	209×	if let Ok(bytes) = std::fs::read(&path) {
28	1×	if bytes.len() == 32 {
29	1×	return Ok(CookieKey(bytes.try_into().unwrap()));
30	0×	}
31	208×	}
32	208×	let mut k = [0u8; 32];
33	208×	rand::rngs::OsRng.fill_bytes(&mut k);
34	208×	std::fs::write(&path, k)?;
35		#[cfg(unix)]
36		{
37		use std::os::unix::fs::PermissionsExt;
38	208×	std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;
39		}
40	208×	Ok(CookieKey(k))
41	209×	}
42
43		/// Keyed BLAKE3 over `message`, as hex.
44	1425×	pub fn mac(&self, message: &[u8]) -> String {
45	1425×	hex::encode(blake3::keyed_hash(&self.0, message).as_bytes())
46	1425×	}
47		}
48
49		/// Constant-time equality of two hex MACs.
50	2074×	pub fn mac_equal(a: &str, b: &str) -> bool {
51	2074×	a.len() == b.len() && a.as_bytes().ct_eq(b.as_bytes()).into()
52	2074×	}
53
54	140×	pub fn hash_password(password: &str) -> anyhow::Result<String> {
55	140×	let salt = SaltString::generate(&mut rand::rngs::OsRng);
56	140×	Ok(Argon2::default().hash_password(password.as_bytes(), &salt).map_err(\|e\| anyhow::anyhow!("{e}"))?.to_string())
57	140×	}
58
59	23×	pub fn verify_password(hash: &str, password: &str) -> bool {
60	23×	match PasswordHash::new(hash) {
61	22×	Ok(parsed) => Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok(),
62	1×	Err(_) => false,
63		}
64	23×	}
65
66		/// A password policy that is honest rather than theatrical: length only.
67	143×	pub fn password_ok(password: &str) -> Result<(), &'static str> {
68	143×	if password.chars().count() < 10 {
69	2×	return Err("a password is at least 10 characters");
70	141×	}
71	141×	if password.len() > 256 {
72	0×	return Err("a password is at most 256 bytes");
73	141×	}
74	141×	Ok(())
75	143×	}
76
77	950×	pub fn random_hex(bytes: usize) -> String {
78	950×	let mut b = vec![0u8; bytes];
79	950×	rand::rngs::OsRng.fill_bytes(&mut b);
80	950×	hex::encode(b)
81	950×	}
82
83		/// A personal access token: `oxyhub_` plus 32 random bytes as hex. Stored
84		/// as its BLAKE3 hash.
85	54×	pub fn new_token() -> (String, String) {
86	54×	let secret = format!("oxyhub_{}", random_hex(32));
87	54×	(secret.clone(), token_hash(&secret))
88	54×	}
89
90	4146×	pub fn token_hash(secret: &str) -> String {
91	4146×	hex::encode(blake3::hash(secret.as_bytes()).as_bytes())
92	4146×	}
93
94		/// A new session id for the cookie (oxygenhub#223): random, and kept on
95		/// the server only as its [`token_hash`].
96	150×	pub fn new_session_id() -> String {
97	150×	random_hex(32)
98	150×	}
99
100		/// Proof, for the code step of a sign-in with two-factor authentication,
101		/// that `username` gave the right password: `UNTIL.MAC`, good until `until`
102		/// (ms) and void as soon as the account's session salt changes (a new
103		/// password, or everyone signed out), so the code step need not ask for
104		/// the password again.
105	33×	pub fn pending_login(key: &CookieKey, username: &str, session_salt: &str, until: i64) -> String {
106	33×	format!("{until}.{}", key.mac(format!("pending-login:{username}:{session_salt}:{until}").as_bytes()))
107	33×	}
108
109		/// Whether `token` is a [`pending_login`] for this account still in time.
110	9×	pub fn pending_login_ok(key: &CookieKey, username: &str, session_salt: &str, token: &str, now: i64) -> bool {
111	9×	let Some((until, _)) = token.split_once('.') else { return false };
112	9×	let Ok(until) = until.parse::<i64>() else { return false };
113	9×	until > now && mac_equal(token, &pending_login(key, username, session_salt, until))
114	9×	}
115
116		/// The CSRF token bound to a session value.
117	1309×	pub fn csrf_token(key: &CookieKey, session_value: &str) -> String {
118	1309×	key.mac(format!("csrf:{session_value}").as_bytes())
119	1309×	}
120
121		pub const SESSION_COOKIE: &str = "oxyhub";
122
123		#[cfg(test)]
124		mod tests {
125		use super::*;
126
127		#[test]
128	1×	fn passwords_and_tokens() {
129	1×	let h = hash_password("correct horse battery").unwrap();
130	1×	assert!(verify_password(&h, "correct horse battery"));
131	1×	assert!(!verify_password(&h, "wrong"));
132	1×	assert!(!verify_password("garbage", "x"));
133	1×	assert!(password_ok("short").is_err());
134	1×	let (secret, hash) = new_token();
135	1×	assert!(secret.starts_with("oxyhub_"));
136	1×	assert_eq!(token_hash(&secret), hash);
137	1×	assert!(mac_equal("ab", "ab") && !mac_equal("ab", "ac") && !mac_equal("a", "ab"));
138	1×	}
139
140		#[test]
141	1×	fn cookie_key_persists() {
142	1×	let dir = tempfile::tempdir().unwrap();
143	1×	let a = CookieKey::load_or_create(dir.path()).unwrap();
144	1×	let b = CookieKey::load_or_create(dir.path()).unwrap();
145	1×	assert_eq!(a.mac(b"x"), b.mac(b"x"));
146	1×	let v = new_session_id();
147	1×	assert_eq!(v.len(), 64);
148	1×	assert_ne!(v, new_session_id());
149	1×	assert_ne!(csrf_token(&a, &v), csrf_token(&a, "other"));
150	1×	}
151		}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/hub/src/auth/mod.rs 96.5%

Keyboard