2022-12-26 16:05:26 +00:00
|
|
|
const std = @import("std");
|
|
|
|
const util = @import("util");
|
2023-01-03 01:21:08 +00:00
|
|
|
const pkg = @import("../lib.zig");
|
|
|
|
const services = @import("../services.zig");
|
2023-01-04 19:03:23 +00:00
|
|
|
const invites = @import("./invites.zig");
|
2022-12-26 16:05:26 +00:00
|
|
|
|
|
|
|
const Uuid = util.Uuid;
|
|
|
|
const DateTime = util.DateTime;
|
2023-01-03 01:21:08 +00:00
|
|
|
const ApiContext = pkg.ApiContext;
|
2023-01-04 19:03:23 +00:00
|
|
|
const Invite = pkg.invites.Invite;
|
|
|
|
const Token = pkg.tokens.Token;
|
2022-12-26 16:05:26 +00:00
|
|
|
|
2023-01-04 19:03:23 +00:00
|
|
|
const RegistrationOptions = pkg.auth.RegistrationOptions;
|
2023-01-02 01:18:05 +00:00
|
|
|
|
2023-01-03 01:21:08 +00:00
|
|
|
const AccountCreateOptions = services.accounts.CreateOptions;
|
2023-01-02 01:18:05 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
pub fn register(
|
|
|
|
alloc: std.mem.Allocator,
|
|
|
|
ctx: ApiContext,
|
|
|
|
svcs: anytype,
|
|
|
|
username: []const u8,
|
|
|
|
password: []const u8,
|
|
|
|
opt: RegistrationOptions,
|
2023-01-04 19:03:23 +00:00
|
|
|
) !Uuid {
|
2023-01-03 01:17:42 +00:00
|
|
|
const tx = try svcs.beginTx();
|
|
|
|
errdefer tx.rollbackTx();
|
|
|
|
|
|
|
|
const maybe_invite = if (opt.invite_code) |code|
|
|
|
|
try tx.getInviteByCode(alloc, code, ctx.community.id)
|
|
|
|
else
|
|
|
|
null;
|
|
|
|
defer if (maybe_invite) |inv| util.deepFree(alloc, inv);
|
|
|
|
|
|
|
|
if (maybe_invite) |invite| {
|
|
|
|
if (!Uuid.eql(invite.community_id, ctx.community.id)) return error.WrongCommunity;
|
2023-01-04 19:03:23 +00:00
|
|
|
if (!invites.isValid(invite)) return error.InvalidInvite;
|
2023-01-03 01:17:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
const invite_kind = if (maybe_invite) |inv| inv.kind else .user;
|
|
|
|
|
|
|
|
if (ctx.community.kind == .admin) @panic("Unimplmented");
|
|
|
|
|
2023-01-04 19:03:23 +00:00
|
|
|
const account_id = try createLocalAccount(
|
2023-01-03 01:17:42 +00:00
|
|
|
alloc,
|
|
|
|
tx,
|
|
|
|
username,
|
|
|
|
password,
|
|
|
|
ctx.community.id,
|
|
|
|
.{
|
|
|
|
.invite_id = if (maybe_invite) |inv| @as(?Uuid, inv.id) else null,
|
|
|
|
.email = opt.email,
|
|
|
|
},
|
|
|
|
);
|
2022-12-26 16:05:26 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
switch (invite_kind) {
|
|
|
|
.user => {},
|
|
|
|
.system => @panic("System user invites unimplemented"),
|
|
|
|
.community_owner => {
|
2023-01-04 19:03:23 +00:00
|
|
|
try tx.transferCommunityOwnership(ctx.community.id, account_id);
|
2023-01-03 01:17:42 +00:00
|
|
|
},
|
|
|
|
}
|
2022-12-26 16:05:26 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
try tx.commitTx();
|
2023-01-04 19:03:23 +00:00
|
|
|
return account_id;
|
2023-01-03 01:17:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
pub fn createLocalAccount(
|
|
|
|
alloc: std.mem.Allocator,
|
|
|
|
svcs: anytype,
|
|
|
|
username: []const u8,
|
|
|
|
password: []const u8,
|
|
|
|
community_id: Uuid,
|
|
|
|
opt: AccountCreateOptions,
|
|
|
|
) !Uuid {
|
|
|
|
const tx = try svcs.beginTx();
|
|
|
|
errdefer tx.rollbackTx();
|
2023-01-02 01:18:05 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
const hash = try hashPassword(password, alloc);
|
|
|
|
defer alloc.free(hash);
|
2023-01-02 01:18:05 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
const id = try tx.createActor(alloc, username, community_id, false);
|
|
|
|
try tx.createAccount(alloc, id, hash, opt);
|
2023-01-02 01:18:05 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
try tx.commitTx();
|
2023-01-02 01:18:05 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
return id;
|
|
|
|
}
|
2023-01-02 01:18:05 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
pub fn verifyToken(alloc: std.mem.Allocator, ctx: ApiContext, svcs: anytype, token: []const u8) !Token.Info {
|
|
|
|
const hash = try hashToken(token, alloc);
|
|
|
|
defer alloc.free(hash);
|
2023-01-02 01:32:17 +00:00
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
const info = try svcs.getTokenByHash(alloc, hash, ctx.community.id);
|
|
|
|
defer util.deepFree(alloc, info);
|
2023-01-02 07:34:30 +00:00
|
|
|
|
2023-01-04 19:03:23 +00:00
|
|
|
return .{ .account_id = info.account_id, .issued_at = info.issued_at };
|
2022-12-26 16:05:26 +00:00
|
|
|
}
|
|
|
|
|
2023-01-03 01:17:42 +00:00
|
|
|
pub fn login(
|
|
|
|
alloc: std.mem.Allocator,
|
|
|
|
ctx: ApiContext,
|
|
|
|
svcs: anytype,
|
|
|
|
username: []const u8,
|
|
|
|
password: []const u8,
|
|
|
|
) !Token {
|
2023-01-02 20:38:42 +00:00
|
|
|
const community_id = ctx.community.id;
|
|
|
|
const credentials = try svcs.getCredentialsByUsername(
|
|
|
|
alloc,
|
|
|
|
username,
|
|
|
|
community_id,
|
|
|
|
);
|
|
|
|
defer util.deepFree(alloc, credentials);
|
|
|
|
|
|
|
|
try verifyPassword(credentials.password_hash, password, alloc);
|
|
|
|
|
|
|
|
const token = try generateToken(alloc);
|
|
|
|
errdefer util.deepFree(alloc, token);
|
|
|
|
const token_hash = hashToken(token, alloc) catch |err| switch (err) {
|
|
|
|
error.OutOfMemory => return error.OutOfMemory,
|
|
|
|
else => unreachable,
|
|
|
|
};
|
|
|
|
defer util.deepFree(alloc, token_hash);
|
|
|
|
|
|
|
|
const tx = try svcs.beginTx();
|
|
|
|
errdefer tx.rollbackTx();
|
|
|
|
|
|
|
|
// ensure that the password has not changed in the meantime
|
|
|
|
{
|
|
|
|
const updated_info = try tx.getCredentialsByUsername(
|
|
|
|
alloc,
|
|
|
|
username,
|
|
|
|
community_id,
|
|
|
|
);
|
|
|
|
defer util.deepFree(alloc, updated_info);
|
|
|
|
|
|
|
|
if (!std.mem.eql(u8, credentials.password_hash, updated_info.password_hash)) return error.InvalidLogin;
|
|
|
|
}
|
|
|
|
|
|
|
|
try tx.createToken(alloc, credentials.account_id, token_hash);
|
|
|
|
|
|
|
|
try tx.commitTx();
|
2023-01-03 01:17:42 +00:00
|
|
|
const info = try svcs.getTokenByHash(alloc, token_hash, community_id);
|
2023-01-02 20:38:42 +00:00
|
|
|
defer util.deepFree(alloc, info);
|
|
|
|
|
|
|
|
return .{
|
|
|
|
.value = token,
|
|
|
|
.info = .{
|
2023-01-04 19:03:23 +00:00
|
|
|
.account_id = info.account_id,
|
2023-01-02 20:38:42 +00:00
|
|
|
.issued_at = info.issued_at,
|
|
|
|
},
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
2023-01-02 00:28:36 +00:00
|
|
|
// We use scrypt, a password hashing algorithm that attempts to slow down
|
|
|
|
// GPU-based cracking approaches by using large amounts of memory, for
|
|
|
|
// password hashing.
|
|
|
|
// Attempting to calculate/verify a hash will use about 50mb of work space.
|
|
|
|
const scrypt = std.crypto.pwhash.scrypt;
|
|
|
|
const password_hash_len = 128;
|
|
|
|
fn verifyPassword(
|
|
|
|
hash: []const u8,
|
|
|
|
password: []const u8,
|
|
|
|
alloc: std.mem.Allocator,
|
|
|
|
) !void {
|
|
|
|
scrypt.strVerify(
|
|
|
|
hash,
|
|
|
|
password,
|
|
|
|
.{ .allocator = alloc },
|
|
|
|
) catch |err| return switch (err) {
|
|
|
|
error.PasswordVerificationFailed => error.InvalidLogin,
|
|
|
|
else => error.HashFailure,
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
2023-01-02 01:18:05 +00:00
|
|
|
fn hashPassword(password: []const u8, alloc: std.mem.Allocator) ![]const u8 {
|
|
|
|
const buf = try alloc.alloc(u8, password_hash_len);
|
|
|
|
errdefer alloc.free(buf);
|
|
|
|
return scrypt.strHash(
|
|
|
|
password,
|
|
|
|
.{
|
|
|
|
.allocator = alloc,
|
|
|
|
.params = scrypt.Params.interactive,
|
|
|
|
.encoding = .phc,
|
|
|
|
},
|
|
|
|
buf,
|
|
|
|
) catch error.HashFailure;
|
|
|
|
}
|
|
|
|
|
2023-01-02 00:28:36 +00:00
|
|
|
/// A raw token is a sequence of N random bytes, base64 encoded.
|
|
|
|
/// When the token is generated:
|
|
|
|
/// - The hash of the token is calculated by:
|
|
|
|
/// 1. Decoding the base64 text
|
|
|
|
/// 2. Calculating the SHA256 hash of this text
|
|
|
|
/// 3. Encoding the hash back as base64
|
|
|
|
/// - The b64 encoded hash is stored in the database
|
|
|
|
/// - The original token is returned to the user
|
|
|
|
/// * The user will treat it as opaque text
|
|
|
|
/// When the token is verified:
|
|
|
|
/// - The hash of the token is taken as shown above
|
|
|
|
/// - The database is scanned for a token matching this hash
|
|
|
|
/// - If none can be found, the token is invalid
|
|
|
|
const Sha256 = std.crypto.hash.sha2.Sha256;
|
|
|
|
const Base64Encoder = std.base64.standard.Encoder;
|
|
|
|
const Base64Decoder = std.base64.standard.Decoder;
|
|
|
|
const token_len = 12;
|
|
|
|
fn generateToken(alloc: std.mem.Allocator) ![]const u8 {
|
|
|
|
var token = std.mem.zeroes([token_len]u8);
|
|
|
|
std.crypto.random.bytes(&token);
|
|
|
|
|
|
|
|
const token_b64_len = Base64Encoder.calcSize(token.len);
|
|
|
|
const token_b64 = try alloc.alloc(u8, token_b64_len);
|
|
|
|
return Base64Encoder.encode(token_b64, &token);
|
|
|
|
}
|
|
|
|
|
|
|
|
fn hashToken(token_b64: []const u8, alloc: std.mem.Allocator) ![]const u8 {
|
|
|
|
const decoded_token_len = Base64Decoder.calcSizeForSlice(token_b64) catch return error.InvalidToken;
|
|
|
|
if (decoded_token_len != token_len) return error.InvalidToken;
|
|
|
|
|
|
|
|
var token = std.mem.zeroes([token_len]u8);
|
|
|
|
Base64Decoder.decode(&token, token_b64) catch return error.InvalidToken;
|
|
|
|
|
|
|
|
var hash = std.mem.zeroes([Sha256.digest_length]u8);
|
|
|
|
Sha256.hash(&token, &hash, .{});
|
|
|
|
|
|
|
|
const hash_b64_len = Base64Encoder.calcSize(hash.len);
|
|
|
|
const hash_b64 = try alloc.alloc(u8, hash_b64_len);
|
|
|
|
return Base64Encoder.encode(hash_b64, &hash);
|
|
|
|
}
|
2022-12-26 16:05:26 +00:00
|
|
|
const TestDb = struct {
|
|
|
|
tx_level: usize = 0,
|
|
|
|
rolled_back: bool = false,
|
|
|
|
committed: bool = false,
|
|
|
|
fn beginOrSavepoint(self: *TestDb) !*TestDb {
|
|
|
|
self.tx_level += 1;
|
|
|
|
return self;
|
|
|
|
}
|
|
|
|
|
|
|
|
fn rollback(self: *TestDb) void {
|
|
|
|
self.rolled_back = true;
|
|
|
|
self.tx_level -= 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
fn commitOrRelease(self: *TestDb) !void {
|
|
|
|
self.committed = true;
|
|
|
|
self.tx_level -= 1;
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
test "register" {
|
|
|
|
comptime var exp_code = "code";
|
|
|
|
comptime var exp_community = Uuid.parse("a210c035-c9e1-4361-82a2-aaeac8e40dc6") catch unreachable;
|
|
|
|
comptime var uid = Uuid.parse("6d951fcc-1c9f-497b-9c96-31dfb9873708") catch unreachable;
|
|
|
|
|
|
|
|
const MockSvc = struct {
|
|
|
|
const invites = struct {
|
|
|
|
fn getByCode(db: *TestDb, code: []const u8, community_id: Uuid, alloc: std.mem.Allocator) !Invite {
|
|
|
|
try std.testing.expectEqual(db.tx_level, 1);
|
|
|
|
try std.testing.expectEqualStrings(exp_code, code);
|
|
|
|
try std.testing.expectEqual(exp_community, community_id);
|
|
|
|
|
|
|
|
return try util.deepClone(alloc, Invite{
|
|
|
|
.id = Uuid.parse("eac18f43-4dcc-489f-9fb5-4c1633e7b4e0") catch unreachable,
|
|
|
|
|
|
|
|
.created_by = Uuid.parse("6d951fcc-1c9f-497b-9c96-31dfb9873708") catch unreachable,
|
|
|
|
.community_id = exp_community,
|
|
|
|
.name = "test invite",
|
|
|
|
.code = exp_code,
|
|
|
|
|
|
|
|
.kind = .user,
|
|
|
|
|
|
|
|
.created_at = DateTime.parse("2022-12-21T09:05:50Z") catch unreachable,
|
|
|
|
.times_used = 0,
|
|
|
|
|
|
|
|
.expires_at = null,
|
|
|
|
.max_uses = null,
|
|
|
|
});
|
|
|
|
}
|
|
|
|
};
|
|
|
|
const auth = struct {
|
|
|
|
fn register(
|
|
|
|
db: *TestDb,
|
|
|
|
username: []const u8,
|
|
|
|
password: []const u8,
|
|
|
|
community_id: Uuid,
|
2023-01-02 01:32:17 +00:00
|
|
|
_: AccountCreateOptions,
|
2022-12-26 16:05:26 +00:00
|
|
|
_: std.mem.Allocator,
|
|
|
|
) anyerror!Uuid {
|
|
|
|
try std.testing.expectEqual(db.tx_level, 1);
|
|
|
|
try std.testing.expectEqualStrings("root", username);
|
|
|
|
try std.testing.expectEqualStrings("password", password);
|
|
|
|
try std.testing.expectEqual(exp_community, community_id);
|
|
|
|
|
|
|
|
return uid;
|
|
|
|
}
|
|
|
|
};
|
|
|
|
const actors = struct {
|
2023-01-04 19:03:23 +00:00
|
|
|
fn get(_: *TestDb, id: Uuid, alloc: std.mem.Allocator) anyerror!pkg.Actor {
|
2022-12-26 16:05:26 +00:00
|
|
|
try std.testing.expectEqual(uid, id);
|
2023-01-04 19:03:23 +00:00
|
|
|
return try util.deepClone(alloc, std.mem.zeroInit(pkg.Actor, .{
|
2022-12-26 16:05:26 +00:00
|
|
|
.id = id,
|
|
|
|
.username = "root",
|
|
|
|
.host = "example.com",
|
|
|
|
.community_id = exp_community,
|
|
|
|
}));
|
|
|
|
}
|
|
|
|
};
|
|
|
|
const communities = struct {
|
|
|
|
fn transferOwnership(_: *TestDb, _: Uuid, _: Uuid) anyerror!void {}
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
var db = TestDb{};
|
2023-01-03 01:17:42 +00:00
|
|
|
|
|
|
|
_ = MockSvc;
|
|
|
|
util.deepFree(std.testing.allocator, try register(.{
|
2022-12-26 16:05:26 +00:00
|
|
|
.db = &db,
|
|
|
|
.allocator = std.testing.allocator,
|
|
|
|
.community = .{
|
|
|
|
.id = exp_community,
|
|
|
|
.kind = .local,
|
|
|
|
},
|
|
|
|
}, "root", "password", .{}));
|
|
|
|
try std.testing.expectEqual(false, db.rolled_back);
|
|
|
|
try std.testing.expectEqual(true, db.committed);
|
|
|
|
try std.testing.expectEqual(@as(usize, 0), db.tx_level);
|
|
|
|
}
|