226 lines
7.2 KiB
Go
226 lines
7.2 KiB
Go
package auth
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"time"
|
|
|
|
"git.mstar.dev/mstar/goutils/other"
|
|
"github.com/go-webauthn/webauthn/protocol"
|
|
"github.com/go-webauthn/webauthn/webauthn"
|
|
"gorm.io/gorm/clause"
|
|
|
|
"git.mstar.dev/mstar/linstrom/storage-new/dbgen"
|
|
"git.mstar.dev/mstar/linstrom/storage-new/models"
|
|
)
|
|
|
|
// TODO: Check if passkey encryption is viable
|
|
// Check if encryption for passkey info data is viable to implement
|
|
// and if we should do it.
|
|
// Encrypting it would probably require making a custom wrapper struct,
|
|
// if even possible. Reason being that login completion still requires to update
|
|
// the data post-creation, including matching on unique and stable elements
|
|
// of said data
|
|
|
|
// Start the login process via passkey for a given username.
|
|
// Returns the credential options the passkey needs to sign
|
|
func (a *Authenticator) StartPasskeyLogin(
|
|
username string,
|
|
) (*protocol.CredentialAssertion, uint64, error) {
|
|
if ok, err := a.canUsernameLogin(username); !ok {
|
|
return nil, 0, other.Error("auth", "user may not login", err)
|
|
}
|
|
acc, err := dbgen.User.Where(dbgen.User.Username.Eq(username)).First()
|
|
if err != nil {
|
|
return nil, 0, other.Error("auth", "failed to acquire user for login", err)
|
|
}
|
|
wrappedAcc := fakeUser{acc}
|
|
options, session, err := a.webauthn.BeginLogin(&wrappedAcc)
|
|
if err != nil {
|
|
return nil, 0, other.Error("auth", "failed to initiate passkey login", err)
|
|
}
|
|
pkeySession := models.LoginProcessToken{
|
|
User: *acc,
|
|
UserId: acc.ID,
|
|
ExpiresAt: time.Now().Add(time.Minute * 3),
|
|
Token: string(other.Must(json.Marshal(session))),
|
|
Name: "",
|
|
}
|
|
err = dbgen.LoginProcessToken.Clauses(clause.OnConflict{UpdateAll: true}).Create(&pkeySession)
|
|
if err != nil {
|
|
return nil, 0, other.Error("auth", "failed to create login process token", err)
|
|
}
|
|
return options, pkeySession.ID, nil
|
|
}
|
|
|
|
// Complete a passkey login request
|
|
// Takes the username logging in as well as the raw request containing the passkey response
|
|
func (a *Authenticator) CompletePasskeyLogin(
|
|
username string,
|
|
sessionId uint64,
|
|
response *http.Request,
|
|
) (accessToken string, err error) {
|
|
// Get user in question
|
|
acc, err := dbgen.User.Where(dbgen.User.Username.Eq(username)).First()
|
|
if err != nil {
|
|
return "", other.Error("auth", "failed to get user for passkey login completion", err)
|
|
}
|
|
// Get latest login token data
|
|
loginToken, err := dbgen.LoginProcessToken.Where(dbgen.LoginProcessToken.ID.Eq(sessionId)).
|
|
First()
|
|
if err != nil {
|
|
return "", other.Error(
|
|
"auth",
|
|
"failed to get user's login token for passkey login completion",
|
|
err,
|
|
)
|
|
}
|
|
// Check if that token has expired
|
|
if loginToken.ExpiresAt.Before(time.Now()) {
|
|
return "", ErrProcessTimeout
|
|
}
|
|
var pkeySession webauthn.SessionData
|
|
err = json.Unmarshal([]byte(loginToken.Token), &pkeySession)
|
|
if err != nil {
|
|
return "", other.Error("auth", "failed to unmarshal passkey session for user", err)
|
|
}
|
|
// Hand data to webauthn for completion
|
|
newSession, err := a.webauthn.FinishLogin(&fakeUser{acc}, pkeySession, response)
|
|
if err != nil {
|
|
return "", other.Error("auth", "passkey completion failed", err)
|
|
}
|
|
jsonSessionId, err := json.Marshal(newSession.ID)
|
|
if err != nil {
|
|
return "", other.Error("auth", "failed to marshal session", err)
|
|
}
|
|
jsonSession, err := json.Marshal(newSession.ID)
|
|
if err != nil {
|
|
return "", other.Error("auth", "failed to marshal session", err)
|
|
}
|
|
// Update credentials
|
|
// WARN: I am not sure if this will work
|
|
// Using the ID of the passkey session *should* be unique enough to identify the correct one
|
|
// Of course, even then, there's still the problem of matching as
|
|
// I can't yet guarantee that the parsed json content for the ID would be the same
|
|
_, err = dbgen.UserAuthMethod.Where(dbgen.UserAuthMethod.Token.Like("%"+string(jsonSessionId)+"%")).
|
|
Update(dbgen.UserAuthMethod.Token, jsonSession)
|
|
if err != nil {
|
|
return "", other.Error("auth", "failed to update credentials", err)
|
|
}
|
|
// And delete the login token
|
|
_, err = dbgen.LoginProcessToken.Where(dbgen.LoginProcessToken.UserId.Eq(acc.ID)).
|
|
Delete(loginToken)
|
|
if err != nil {
|
|
return "", other.Error("auth", "failed to delete login process", err)
|
|
}
|
|
dbAccessToken := models.AccessToken{
|
|
User: *acc,
|
|
UserId: acc.ID,
|
|
ExpiresAt: calcAccessExpirationTimestamp(),
|
|
}
|
|
err = dbgen.AccessToken.Omit(dbgen.AccessToken.Token).Create(&dbAccessToken)
|
|
if err != nil {
|
|
return "", other.Error("auth", "failed to generate access token", err)
|
|
}
|
|
|
|
return dbAccessToken.Token, nil
|
|
}
|
|
|
|
// Start the process of registrating a passkey to an account
|
|
func (a *Authenticator) StartPasskeyRegistration(
|
|
username string,
|
|
) (*protocol.CredentialAssertion, error) {
|
|
// p.l.Infof("begin registration")
|
|
//
|
|
// // can we actually do not use the username at all?
|
|
// username, err := getUsername(r)
|
|
//
|
|
// if err != nil {
|
|
// p.l.Errorf("can't get username: %s", err.Error())
|
|
// JSONResponse(w, fmt.Sprintf("can't get username: %s", err.Error()), http.StatusBadRequest)
|
|
//
|
|
// return
|
|
// }
|
|
//
|
|
// user := p.userStore.GetOrCreateUser(username)
|
|
//
|
|
// options, session, err := p.webAuthn.BeginRegistration(user)
|
|
//
|
|
// if err != nil {
|
|
// msg := fmt.Sprintf("can't begin registration: %s", err.Error())
|
|
// p.l.Errorf(msg)
|
|
// JSONResponse(w, msg, http.StatusBadRequest)
|
|
//
|
|
// return
|
|
// }
|
|
//
|
|
// // Make a session key and store the sessionData values
|
|
// t, err := p.sessionStore.GenSessionID()
|
|
//
|
|
// if err != nil {
|
|
// p.l.Errorf("can't generate session id: %s", err.Error())
|
|
// JSONResponse(
|
|
// w,
|
|
// fmt.Sprintf("can't generate session id: %s", err.Error()),
|
|
// http.StatusInternalServerError,
|
|
// )
|
|
//
|
|
// return
|
|
// }
|
|
//
|
|
// p.sessionStore.SaveSession(t, session)
|
|
// p.setSessionCookie(w, t)
|
|
//
|
|
// // return the options generated with the session key
|
|
// // options.publicKey contain our registration options
|
|
// JSONResponse(w, options, http.StatusOK)
|
|
|
|
panic("Not implemented") // TODO: Implement me
|
|
}
|
|
|
|
func (a *Authenticator) CompletePasskeyRegistration(username string) error {
|
|
// // Get the session key from cookie
|
|
// sid, err := r.Cookie(p.cookieSettings.Name)
|
|
//
|
|
// if err != nil {
|
|
// p.l.Errorf("can't get session id: %s", err.Error())
|
|
// JSONResponse(w, fmt.Sprintf("can't get session id: %s", err.Error()), http.StatusBadRequest)
|
|
//
|
|
// return
|
|
// }
|
|
//
|
|
// // Get the session data stored from the function above
|
|
// session, ok := p.sessionStore.GetSession(sid.Value)
|
|
//
|
|
// if !ok {
|
|
// p.l.Errorf("can't get session data")
|
|
// JSONResponse(w, "can't get session data", http.StatusBadRequest)
|
|
//
|
|
// return
|
|
// }
|
|
//
|
|
// user := p.userStore.GetUserByWebAuthnId(session.UserID) // Get the user
|
|
//
|
|
// credential, err := p.webAuthn.FinishRegistration(user, *session, r)
|
|
//
|
|
// if err != nil {
|
|
// msg := fmt.Sprintf("can't finish registration: %s", err.Error())
|
|
// p.l.Errorf(msg)
|
|
//
|
|
// p.deleteSessionCookie(w)
|
|
// JSONResponse(w, msg, http.StatusBadRequest)
|
|
//
|
|
// return
|
|
// }
|
|
//
|
|
// // If creation was successful, store the credential object
|
|
// user.PutCredential(*credential)
|
|
// p.userStore.SaveUser(user)
|
|
//
|
|
// p.sessionStore.DeleteSession(sid.Value)
|
|
// p.deleteSessionCookie(w)
|
|
//
|
|
// p.l.Infof("finish registration")
|
|
// JSONResponse(w, "Registration Success", http.StatusOK)
|
|
panic("Not implemented") // TODO: Implement me
|
|
}
|