andyburke/autonomous.contact
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: login sessions

Browse source
This commit is contained in:
Andy Burke 2025-07-04 14:51:49 -07:00
parent dc91d0ab8c
commit cf46450f5f
11 changed files with 179 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

1
deno.json
View file

@ -35,6 +35,7 @@
"@andyburke/fsdb": "jsr:@andyburke/fsdb@^0.9.0",
"@andyburke/lurid": "jsr:@andyburke/lurid@^0.2.0",
"@andyburke/serverus": "jsr:@andyburke/serverus@^0.7.1",
"@da/bcrypt": "jsr:@da/bcrypt@^1.0.1",
"@std/assert": "jsr:@std/assert@^1.0.13",
"@std/encoding": "jsr:@std/encoding@^1.0.10",
"@std/http": "jsr:@std/http@^1.0.19",

5
deno.lock generated
View file

@ -7,6 +7,7 @@
"jsr:@andyburke/lurid@0.2": "0.2.0",
"jsr:@andyburke/serverus@*": "0.7.1",
"jsr:@andyburke/serverus@~0.7.1": "0.7.1",
"jsr:@da/bcrypt@^1.0.1": "1.0.1",
"jsr:@std/assert@*": "1.0.13",
"jsr:@std/assert@^1.0.13": "1.0.13",
"jsr:@std/async@^1.0.13": "1.0.13",
@ -64,6 +65,9 @@
"jsr:@std/path@^1.0.8"
]
},
"@da/bcrypt@1.0.1": {
"integrity": "d2172d3acbcff52e0465557a1a48b1ff1c92df08c90712dae5372255a8c45eb3"
},
"@std/assert@1.0.13": {
"integrity": "ae0d31e41919b12c656c742b22522c32fb26ed0cba32975cb0de2a273cb68b29",
"dependencies": [
@ -205,6 +209,7 @@
"jsr:@andyburke/fsdb@0.9",
"jsr:@andyburke/lurid@0.2",
"jsr:@andyburke/serverus@~0.7.1",
"jsr:@da/bcrypt@^1.0.1",
"jsr:@std/assert@^1.0.13",
"jsr:@std/encoding@^1.0.10",
"jsr:@std/http@^1.0.19",

13
public/api/auth/index.ts
View file

@ -1,15 +1,14 @@
import { PASSWORD_ENTRIES } from '../../../models/password_entry.ts';
import { USER, USERS } from '../../../models/user.ts';
import { generateSecret } from 'jsr:@stdext/crypto/utils';
import { encodeBase32 } from 'jsr:@std/encoding';
import { verify } from 'jsr:@stdext/crypto/hash';
import lurid from 'jsr:@andyburke/lurid';
import { SESSION, SESSIONS } from '../../../models/session.ts';
import { TOTP_ENTRIES } from '../../../models/totp_entry.ts';
import { verifyTotp } from 'jsr:@stdext/crypto/totp';
import { encodeBase64 } from 'jsr:@std/encoding/base64';
import parse_body from '../../../utils/bodyparser.ts';
import { SESSION_ID_TOKEN, SESSION_SECRET_TOKEN } from '../../../utils/prechecks.ts';
import * as bcrypt from 'jsr:@da/bcrypt';
import { verifyTotp } from '../../../utils/totp.ts';
const DEFAULT_SESSION_TIME: number = 60 * 60 * 1_000; // 1 Hour
@ -78,7 +77,8 @@ export async function POST(req: Request, meta: Record<string, any>): Promise<Res
});
}
const verified = verify('bcrypt', `${password_hash}${password_entry.salt}`, password_entry.hash);
const verified = await bcrypt.compare(`${password_hash}${password_entry.salt}`, password_entry.hash);
if (!verified) {
return Response.json({
error: {
@ -158,15 +158,18 @@ export type SESSION_INFO = {
expires: string | undefined;
};
const session_secret_buffer = new Uint8Array(20);
export async function create_new_session(session_settings: SESSION_INFO): Promise<SESSION_RESULT> {
const now = new Date().toISOString();
const expires: string = session_settings.expires ??
new Date(new Date(now).valueOf() + DEFAULT_SESSION_TIME).toISOString();
crypto.getRandomValues(session_secret_buffer);
const session: SESSION = {
id: lurid(),
user_id: session_settings.user.id,
secret: encodeBase32(generateSecret()),
secret: encodeBase32(session_secret_buffer),
timestamps: {
created: now,
expires,

7
public/api/users/index.ts
View file

@ -1,13 +1,12 @@
import { PASSWORD_ENTRIES, PASSWORD_ENTRY } from '../../../models/password_entry.ts';
import { USER, USERS } from '../../../models/user.ts';
import { generateSecret } from 'jsr:@stdext/crypto/utils';
import { hash } from 'jsr:@stdext/crypto/hash';
import lurid from 'jsr:@andyburke/lurid';
import { encodeBase64 } from 'jsr:@std/encoding';
import parse_body from '../../../utils/bodyparser.ts';
import { create_new_session, SESSION_RESULT } from '../auth/index.ts';
import { get_session, get_user, PRECHECK_TABLE, require_user } from '../../../utils/prechecks.ts';
import * as CANNED_RESPONSES from '../../../utils/canned_responses.ts';
import * as bcrypt from 'jsr:@da/bcrypt';
// TODO: figure out a better solution for doling out permissions
const DEFAULT_USER_PERMISSIONS: string[] = [
@ -107,8 +106,8 @@ export async function POST(req: Request, meta: Record<string, any>): Promise<Res
await USERS.create(user);
const salt = generateSecret();
const hashed_password_value = hash('bcrypt', `${password_hash}${salt}`);
const salt = await bcrypt.genSalt();
const hashed_password_value = await bcrypt.hash(password_hash, salt);
const password_entry: PASSWORD_ENTRY = {
user_id: user.id,

1
public/index.html
View file

@ -27,6 +27,7 @@
/* check if we are logged in */
(async () => {
try {
console.log( 'hi');
const session_response = await api.fetch("/users/me");
if (!session_response.ok) {

22
public/js/smartforms.js
View file

@ -1,6 +1,6 @@
document.addEventListener("DOMContentLoaded", () => {
/* make all forms semi-smart */
const forms = document.querySelectorAll("form");
const forms = document.querySelectorAll("form[data-smart]");
for (const form of forms) {
const script = form.querySelector("script");
@ -21,17 +21,27 @@ document.addEventListener("DOMContentLoaded", () => {
}
const url = form.action;
const method = form.dataset.method ?? "POST";
console.dir({
method,
form,
});
try {
// TODO: send session header
const response = await fetch(url, {
method: "POST",
const options = {
method,
headers: {
Accept: "application/json",
"Content-Type": "application/json",
},
body: JSON.stringify(body),
});
};
if (["POST", "PUT", "PATCH"].includes(method)) {
options.headers["Content-Type"] = "application/json";
options.body = JSON.stringify(body);
}
const response = await fetch(url, options);
if (!response.ok) {
const error_body = await response.json();

4
public/signup_login_wall.html
View file

@ -102,6 +102,8 @@
</label>
<div class="tab-content">
<form
data-smart="true"
data-method="POST"
id="login-form"
action="/api/auth"
onreply="(user)=>{ document.body.dataset.user = JSON.stringify( user ); }"
@ -142,7 +144,7 @@
<div class="label">Sign Up</div>
</label>
<div class="tab-content">
<form id="signup-form" action="/api/users">
<form data-smart="true" data-method="POST" id="signup-form" action="/api/users">
<script>
{
const form = document.currentScript.closest("form");

17
public/tabs/talk.html
View file

@ -288,7 +288,7 @@
`/rooms/${room_id}/events?type=chat&limit=100&sort=newest`,
);
if (!events_response.ok) {
const error = await room_response.json();
const error = await events_response.json();
alert(error.message ?? JSON.stringify(error));
return;
}
@ -327,6 +327,11 @@
window.addEventListener("locationchange", update_chat_rooms);
function check_for_room_in_url() {
const user_json = document.body.dataset.user;
if (!user_json) {
return;
}
const hash = window.location.hash;
const talk_in_url = hash.indexOf("#/talk") === 0;
if (!talk_in_url) {
@ -503,16 +508,6 @@
`<li id="room-selector-${new_room.id}" class="room"><a href="#/room/${new_room.id}">${new_room.name}</a></li>`,
);
const room_selectors = document.querySelectorAll("li.room");
for (const room_selector of room_selectors) {
room_selector.classList.remove("active");
}
const new_room_selector = document.getElementById(
`room-selector-${new_room.id}`,
);
new_room_selector.classList.add("active");
window.location.hash = `/talk/room/${new_room.id}`;
});
});

19
public/tabs/user.html
View file

@ -53,5 +53,24 @@
<div class="username-container">
<span class="username" data-bind-user_username></span>
</div>
<form data-smart="true" action="/api/auth" method="DELETE">
<script>
{
const form = document.currentScript.closest("form");
form.on_response = (response) => {
if (!response.ok) {
alert("error logging out!");
return;
}
delete document.body.dataset.user;
delete document.body.dataset.perms;
window.location = "/";
};
}
</script>
<button class="primary">Log Out</button>
</form>
</div>
</div>

3
utils/prechecks.ts
View file

@ -22,6 +22,9 @@ export async function get_session(request: Request, meta: Record<string, any>):
meta.valid_totp = meta.valid_session && meta.session && meta.request_totp
? await verifyTotp(meta.request_totp, meta.session.secret)
: false;
console.dir({
meta
});
}
export async function get_user(request: Request, meta: Record<string, any>): Promise<undefined> {

114
utils/totp.ts Normal file
View file

@ -0,0 +1,114 @@
// https://jsr.io/@stdext/crypto/0.1.0/hotp.ts
// https://jsr.io/@stdext/crypto/0.1.0/totp.ts
import { decodeBase32 } from 'jsr:@std/encoding@^1';
/** Converts a counter value to a DataView.
*
* @ignore
*/
export function counterToBuffer(counter: number): DataView {
const buffer = new DataView(new ArrayBuffer(8));
buffer.setBigUint64(0, BigInt(counter), false);
return buffer;
}
/** Generates a HMAC-SHA1 hash of the specified key and counter.
*
* @ignore
*/
export async function generateHmacSha1(
key: Uint8Array,
data: BufferSource
): Promise<Uint8Array> {
const importedKey = await crypto.subtle.importKey(
'raw',
key,
{ name: 'HMAC', hash: 'SHA-1' },
false,
['sign']
);
const signedData = await crypto.subtle.sign(
'HMAC',
importedKey,
data
);
return new Uint8Array(signedData);
}
/** Truncates the HMAC value to a 6-digit HOTP value.
*
* @ignore
*/
export function truncate(value: Uint8Array, length: number): string {
const offset = value[19] & 0xf;
const code = (value[offset] & 0x7f) << 24 |
(value[offset + 1] & 0xff) << 16 |
(value[offset + 2] & 0xff) << 8 |
(value[offset + 3] & 0xff);
const digits = code % Math.pow(10, length);
return digits.toString().padStart(length, '0');
}
/** Generates a HMAC-based one-time password (HOTP) using the specified key and counter.
*
* @param key a secret key used to generate the HOTP. Can be a string in base32 encoding or a Uint8Array.
* @param counter a counter value used to generate the HOTP.
* @returns a 6-digit HOTP value.
*/
export async function generateHotp(
key: string | Uint8Array,
counter: number
): Promise<string> {
const parsedKey = typeof key === 'string' ? decodeBase32(key) : key;
const buffer = counterToBuffer(counter);
const hmac = await generateHmacSha1(parsedKey, buffer);
return truncate(hmac, 6);
}
/** Verifies a HMAC-based one-time password (HOTP) using the specified key and counter.
*
* @param otp the one-time password to verify.
* @param key a secret key used to generate the HOTP. Can be a string in base32 encoding or a Uint8Array.
* @param counter a counter value used to generate the HOTP.
*/
export async function verifyHotp(
otp: string,
key: string | Uint8Array,
counter: number
): Promise<boolean> {
return otp === await generateHotp(key, counter);
}
/** Generate a TOTP value from a key and a time.
*
* @param key a secret key used to generate the HOTP. Can be a string in base32 encoding or a Uint8Array.
* @param t0 the initial time to use for the counter.
* @returns the TOTP value.
*/
export function generateTotp(
key: string | Uint8Array,
t0: number = 0,
t: number = Date.now()
): Promise<string> {
const counter = Math.floor((t - t0) / 30000);
return generateHotp(key, counter);
}
/** Verifies a TOTP value from a key and a time.
*
* @param otp the one-time password to verify.
* @param key a secret key used to generate the HOTP. Can be a string in base32 encoding or a Uint8Array.
* @param t0 the initial time to use for the counter.
*/
export async function verifyTotp(
otp: string,
key: string | Uint8Array,
t0: number = 0,
t: number = Date.now()
): Promise<boolean> {
return otp === await generateTotp(key, t0, t);
}