authn.rs 97.6%

40 of 41 lines run, 2 of 6 functions · run #16 on main · run missed

//! Authenticating a request (spec §8.5): a signature by a known key over the
//! method, the body, a time within five minutes and a nonce not seen in
//! that window, from a key the owner delegates to now, and, when the agent
//! is bound to a Unix user, from that user. What it returns becomes the
//! `auth` of every event the request causes.

use crate::event::{Auth, Method};
use crate::principals::{Principal, Principals};
use crate::proof::{Proof, WINDOW_MS};
use std::collections::HashMap;
use std::sync::Mutex;

/// Why a request was refused.
#[derive(Debug, PartialEq, Eq, thiserror::Error)]
pub enum Refusal {
    #[error("the request is not signed")]
    Unsigned,
    #[error("the signature is for {0}, not this request")]
    WrongMethod(String),
    #[error("the request's time is {0} s from the server's: check the clock")]
    Stale(i64),
    #[error("the request's nonce was used before: a replay")]
    Replay,
    #[error("{0}")]
    NotAPrincipal(String),
    #[error("{0}")]
    BadSignature(String),
    /// The key is bound to another Unix user (logged as `guard.impersonation`).
    #[error("agent {agent}'s key is bound to uid {bound}, used from uid {from}")]
    WrongUid { agent: String, bound: u32, from: u32 },
}

/// The outcome: who, and the `auth` for their events.
#[derive(Clone, Debug)]
pub struct Caller {
    pub principal: Principal,
    pub auth: Auth,
    /// The agent asked for its uid to be learnt and has none yet: the
    /// caller records `agent.uid_bound` with this uid.
    pub learn_uid: Option<u32>,
}

/// Remembers nonces for the window.
#[derive(Debug, Default)]
pub struct Authenticator {
    nonces: Mutex<HashMap<[u8; 16], u64>>,
}

impl Authenticator {
    pub fn authenticate(
        &self,
        principals: &Principals,
        proof: Option<&Proof>,
        method: &str,
        body: &[u8],
        now_ms: u64,
        peer_uid: Option<u32>,
    ) -> Result<Caller, Refusal> {
        let proof = proof.ok_or(Refusal::Unsigned)?;
        if proof.method != method {
            return Err(Refusal::WrongMethod(proof.method.clone()));
        }
        let skew = proof.time_ms as i64 - now_ms as i64;
        if skew.unsigned_abs() > WINDOW_MS {
            return Err(Refusal::Stale(skew / 1000));
        }
        let key = oxy_core::hash::ObjectRef(proof.key());
        let principal = principals.principal(&key, now_ms).map_err(Refusal::NotAPrincipal)?;
        let identity = principals.identity(&key).ok_or_else(|| Refusal::NotAPrincipal("an unknown key".into()))?;
        proof.verify(identity, Some(body)).map_err(Refusal::BadSignature)?;
        let mut learn_uid = None;
        if let Principal::Agent { name, uid, learn_uid: learn, .. } = &principal {
            match (uid, peer_uid) {
                (Some(bound), Some(from)) if *bound != from => return Err(Refusal::WrongUid { agent: name.clone(), bound: *bound, from }),
                (None, Some(from)) if *learn => learn_uid = Some(from),
                _ => {}
            }
        }
        {
            let mut seen = self.nonces.lock().unwrap();
            seen.retain(|_, t| now_ms.saturating_sub(*t) <= 2 * WINDOW_MS);
            if seen.insert(proof.nonce, now_ms).is_some() {
                return Err(Refusal::Replay);
            }
        }
        Ok(Caller {
            principal,
            auth: Auth { key: Some(proof.key()), method: Method::Signature, assurance: 2, proof: Some(proof.encode()) },
            learn_uid,
        })
    }
}

1		//! Authenticating a request (spec §8.5): a signature by a known key over the
2		//! method, the body, a time within five minutes and a nonce not seen in
3		//! that window, from a key the owner delegates to now, and, when the agent
4		//! is bound to a Unix user, from that user. What it returns becomes the
5		//! `auth` of every event the request causes.
6
7		use crate::event::{Auth, Method};
8		use crate::principals::{Principal, Principals};
9		use crate::proof::{Proof, WINDOW_MS};
10		use std::collections::HashMap;
11		use std::sync::Mutex;
12
13		/// Why a request was refused.
14		#[derive(Debug, PartialEq, Eq, thiserror::Error)]
15		pub enum Refusal {
16		#[error("the request is not signed")]
17		Unsigned,
18		#[error("the signature is for {0}, not this request")]
19		WrongMethod(String),
20		#[error("the request's time is {0} s from the server's: check the clock")]
21		Stale(i64),
22		#[error("the request's nonce was used before: a replay")]
23		Replay,
24		#[error("{0}")]
25		NotAPrincipal(String),
26		#[error("{0}")]
27		BadSignature(String),
28		/// The key is bound to another Unix user (logged as `guard.impersonation`).
29		#[error("agent {agent}'s key is bound to uid {bound}, used from uid {from}")]
30		WrongUid { agent: String, bound: u32, from: u32 },
31		}
32
33		/// The outcome: who, and the `auth` for their events.
34		#[derive(Clone, Debug)]
35		pub struct Caller {
36		pub principal: Principal,
37		pub auth: Auth,
38		/// The agent asked for its uid to be learnt and has none yet: the
39		/// caller records `agent.uid_bound` with this uid.
40		pub learn_uid: Option<u32>,
41		}
42
43		/// Remembers nonces for the window.
44		#[derive(Debug, Default)]
45		pub struct Authenticator {
46		nonces: Mutex<HashMap<[u8; 16], u64>>,
47		}
48
49		impl Authenticator {
50	84×	pub fn authenticate(
51	84×	&self,
52	84×	principals: &Principals,
53	84×	proof: Option<&Proof>,
54	84×	method: &str,
55	84×	body: &[u8],
56	84×	now_ms: u64,
57	84×	peer_uid: Option<u32>,
58	84×	) -> Result<Caller, Refusal> {
59	84×	let proof = proof.ok_or(Refusal::Unsigned)?;
60	81×	if proof.method != method {
61	1×	return Err(Refusal::WrongMethod(proof.method.clone()));
62	80×	}
63	80×	let skew = proof.time_ms as i64 - now_ms as i64;
64	80×	if skew.unsigned_abs() > WINDOW_MS {
65	1×	return Err(Refusal::Stale(skew / 1000));
66	79×	}
67	79×	let key = oxy_core::hash::ObjectRef(proof.key());
68	79×	let principal = principals.principal(&key, now_ms).map_err(Refusal::NotAPrincipal)?;
69	77×	let identity = principals.identity(&key).ok_or_else(\|\| Refusal::NotAPrincipal("an unknown key".into()))?;
70	77×	proof.verify(identity, Some(body)).map_err(Refusal::BadSignature)?;
71	76×	let mut learn_uid = None;
72	76×	if let Principal::Agent { name, uid, learn_uid: learn, .. } = &principal {
73	63×	match (uid, peer_uid) {
74	3×	(Some(bound), Some(from)) if bound != from => return Err(Refusal::WrongUid { agent: name.clone(), bound: bound, from }),
75	1×	(None, Some(from)) if *learn => learn_uid = Some(from),
76	60×	_ => {}
77		}
78	13×	}
79		{
80	74×	let mut seen = self.nonces.lock().unwrap();
81	481×	seen.retain(\|_, t\| now_ms.saturating_sub(t) <= 2 WINDOW_MS);
82	74×	if seen.insert(proof.nonce, now_ms).is_some() {
83	1×	return Err(Refusal::Replay);
84	73×	}
85		}
86	73×	Ok(Caller {
87	73×	principal,
88	73×	auth: Auth { key: Some(proof.key()), method: Method::Signature, assurance: 2, proof: Some(proof.encode()) },
89	73×	learn_uid,
90	73×	})
91	84×	}
92		}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/spectra-core/src/authn.rs 97.6%

Keyboard