feat(auth): Argon2id passwords, opaque tokens, TOTP and recovery codes
Password hashes are self-describing PHC strings, so the cost parameters can be raised later without locking anyone out: NeedsRehash reports which hashes to upgrade at the next login, when the plaintext is briefly at hand. Session, invite, reset and API tokens are stored only as SHA-256 hashes; the plaintext exists once, in the link or the reply. Unsalted is correct here and only here — the input is 256 bits of randomness that has to be found by value in a WHERE clause. feat(store): project roles with viewer/editor/owner and explicit denial Roles are strictly ordered so every check is "at least X". Access to a task is access to its project: being the assignee or the author confers nothing, or removing someone from a project would leave them holding tasks inside it. Checks take a Querier so they can run in the same transaction as the write they guard. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kristian Wind
co-authored by
Claude Opus 5
Claude Opus 5
parent
b6a44244c1
commit
b44db32bf7
@@ -0,0 +1,282 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/pquerna/otp"
|
||||
"github.com/pquerna/otp/totp"
|
||||
)
|
||||
|
||||
func TestPasswordRoundTrip(t *testing.T) {
|
||||
const password = "kaffe & rugbrød, tak!"
|
||||
|
||||
hash, err := HashPassword(password)
|
||||
if err != nil {
|
||||
t.Fatalf("hash: %v", err)
|
||||
}
|
||||
if err := VerifyPassword(hash, password); err != nil {
|
||||
t.Errorf("verify with the right password: %v", err)
|
||||
}
|
||||
if err := VerifyPassword(hash, password+"x"); err != ErrMismatch {
|
||||
t.Errorf("verify with a wrong password: %v, want ErrMismatch", err)
|
||||
}
|
||||
}
|
||||
|
||||
// The salt is per-hash, so the same password never produces the same stored value.
|
||||
// Without that, identical hashes in a leaked table tell an attacker which accounts
|
||||
// share a password.
|
||||
func TestSamePasswordHashesDifferently(t *testing.T) {
|
||||
a, err := HashPassword("hemmeligt")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
b, err := HashPassword("hemmeligt")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if a == b {
|
||||
t.Error("two hashes of one password are identical; the salt is not random")
|
||||
}
|
||||
// Both must still verify.
|
||||
for _, h := range []string{a, b} {
|
||||
if err := VerifyPassword(h, "hemmeligt"); err != nil {
|
||||
t.Errorf("verify: %v", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestPasswordHashFormat(t *testing.T) {
|
||||
hash, err := HashPassword("x")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !strings.HasPrefix(hash, "$argon2id$v=19$m=19456,t=2,p=1$") {
|
||||
t.Errorf("hash = %q; the parameters must be recorded in the string", hash)
|
||||
}
|
||||
if n := len(strings.Split(hash, "$")); n != 6 {
|
||||
t.Errorf("hash has %d $-separated fields, want 6", n)
|
||||
}
|
||||
}
|
||||
|
||||
// A stored hash that has been truncated, edited or produced by something else must
|
||||
// fail closed. The one thing it must never do is verify.
|
||||
func TestMalformedHashNeverVerifies(t *testing.T) {
|
||||
good, err := HashPassword("hemmeligt")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
broken := []string{
|
||||
"",
|
||||
"not a hash",
|
||||
"$argon2id$v=19$m=19456,t=2,p=1$onlyfourfields",
|
||||
"$argon2i$v=19$m=19456,t=2,p=1$c2FsdHNhbHRzYWx0$aGFzaA", // wrong variant
|
||||
"$argon2id$v=13$m=19456,t=2,p=1$c2FsdHNhbHRzYWx0$aGFzaA", // wrong version
|
||||
"$argon2id$v=19$m=0,t=0,p=0$c2FsdHNhbHRzYWx0$aGFzaA", // zero parameters
|
||||
"$argon2id$v=19$m=19456,t=2,p=1$!!!not-base64!!!$aGFzaA",
|
||||
"$argon2id$v=19$m=19456,t=2,p=1$c2FsdHNhbHRzYWx0$", // empty digest
|
||||
good[:len(good)-1], // digest truncated by one character
|
||||
good[:len(good)-8],
|
||||
}
|
||||
for _, h := range broken {
|
||||
t.Run(h, func(t *testing.T) {
|
||||
if err := VerifyPassword(h, "hemmeligt"); err == nil {
|
||||
t.Error("a malformed hash verified")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestNeedsRehash(t *testing.T) {
|
||||
current, err := HashPassword("x")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if NeedsRehash(current) {
|
||||
t.Error("a hash made with the current parameters wants rehashing")
|
||||
}
|
||||
|
||||
// A hash from when the parameters were weaker should be upgraded on next login.
|
||||
weak := encodeHash("x", []byte("0123456789abcdef"), 8*1024, 1, 1)
|
||||
if !NeedsRehash(weak) {
|
||||
t.Error("a hash with weaker parameters was not flagged for rehashing")
|
||||
}
|
||||
// It must still verify in the meantime, or the upgrade locks people out.
|
||||
if err := VerifyPassword(weak, "x"); err != nil {
|
||||
t.Errorf("an old-parameter hash no longer verifies: %v", err)
|
||||
}
|
||||
|
||||
if !NeedsRehash("garbage") {
|
||||
t.Error("an unreadable hash should be replaced")
|
||||
}
|
||||
}
|
||||
|
||||
func TestTokensAreUniqueAndOpaque(t *testing.T) {
|
||||
seen := map[string]bool{}
|
||||
for i := 0; i < 1000; i++ {
|
||||
tok, err := NewToken()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if seen[tok] {
|
||||
t.Fatal("NewToken returned a duplicate")
|
||||
}
|
||||
seen[tok] = true
|
||||
|
||||
if len(tok) < 40 {
|
||||
t.Fatalf("token %q is shorter than 256 bits of randomness", tok)
|
||||
}
|
||||
// URL-safe: these end up in emailed links.
|
||||
if strings.ContainsAny(tok, "+/= ") {
|
||||
t.Fatalf("token %q contains characters that need escaping in a URL", tok)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHashTokenIsStableAndDistinct(t *testing.T) {
|
||||
a, err := NewToken()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
b, err := NewToken()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if HashToken(a) != HashToken(a) {
|
||||
t.Error("HashToken is not deterministic; a stored token could never be found again")
|
||||
}
|
||||
if HashToken(a) == HashToken(b) {
|
||||
t.Error("two different tokens hash the same")
|
||||
}
|
||||
if strings.Contains(HashToken(a), a) {
|
||||
t.Error("the hash contains the token it is meant to protect")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPITokenIsRecognisable(t *testing.T) {
|
||||
tok, prefix, err := NewAPIToken()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !IsAPIToken(tok) {
|
||||
t.Errorf("token %q is not recognised as an API token", tok)
|
||||
}
|
||||
if !strings.HasPrefix(tok, prefix) {
|
||||
t.Errorf("prefix %q does not match token %q", prefix, tok)
|
||||
}
|
||||
if IsAPIToken("some-session-id") {
|
||||
t.Error("a session id was mistaken for an API token")
|
||||
}
|
||||
}
|
||||
|
||||
func TestTOTPRoundTrip(t *testing.T) {
|
||||
secret, uri, err := NewTOTPSecret("verdande", "kristian@example.com")
|
||||
if err != nil {
|
||||
t.Fatalf("generate: %v", err)
|
||||
}
|
||||
if _, err := DecodeTOTPSecret(secret); err != nil {
|
||||
t.Errorf("secret %q is not valid base32: %v", secret, err)
|
||||
}
|
||||
if !strings.HasPrefix(uri, "otpauth://totp/") {
|
||||
t.Errorf("uri = %q", uri)
|
||||
}
|
||||
|
||||
now := time.Date(2026, 3, 10, 10, 0, 0, 0, time.UTC)
|
||||
code := codeAt(t, secret, now)
|
||||
|
||||
if err := VerifyTOTP(secret, code, now); err != nil {
|
||||
t.Errorf("the current code was rejected: %v", err)
|
||||
}
|
||||
// Apps show the code in two groups; people paste it that way.
|
||||
if err := VerifyTOTP(secret, code[:3]+" "+code[3:], now); err != nil {
|
||||
t.Errorf("a code with a space in it was rejected: %v", err)
|
||||
}
|
||||
if err := VerifyTOTP(secret, "000000", now); err == nil {
|
||||
t.Error("a wrong code was accepted")
|
||||
}
|
||||
if err := VerifyTOTP("", code, now); err != ErrNoTOTPSecret {
|
||||
t.Errorf("verifying against an empty secret: %v, want ErrNoTOTPSecret", err)
|
||||
}
|
||||
}
|
||||
|
||||
// One step of tolerance either way covers a code entered as it rolls over and a
|
||||
// phone whose clock drifts. Two steps out must fail, or a stolen code lives too long.
|
||||
func TestTOTPWindow(t *testing.T) {
|
||||
secret, _, err := NewTOTPSecret("verdande", "k@example.com")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
now := time.Date(2026, 3, 10, 10, 0, 0, 0, time.UTC)
|
||||
code := codeAt(t, secret, now)
|
||||
|
||||
for _, delta := range []time.Duration{-30 * time.Second, 0, 30 * time.Second} {
|
||||
if err := VerifyTOTP(secret, code, now.Add(delta)); err != nil {
|
||||
t.Errorf("code rejected at %v offset: %v", delta, err)
|
||||
}
|
||||
}
|
||||
for _, delta := range []time.Duration{-90 * time.Second, 90 * time.Second} {
|
||||
if err := VerifyTOTP(secret, code, now.Add(delta)); err == nil {
|
||||
t.Errorf("code still accepted %v away from when it was issued", delta)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRecoveryCodes(t *testing.T) {
|
||||
codes, hashes, err := NewRecoveryCodes()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(codes) != len(hashes) || len(codes) == 0 {
|
||||
t.Fatalf("got %d codes and %d hashes", len(codes), len(hashes))
|
||||
}
|
||||
|
||||
seen := map[string]bool{}
|
||||
for _, c := range codes {
|
||||
if seen[c] {
|
||||
t.Error("duplicate recovery code")
|
||||
}
|
||||
seen[c] = true
|
||||
}
|
||||
|
||||
// Every code must match its own entry, and nothing else.
|
||||
for i, c := range codes {
|
||||
if got := MatchRecoveryCode(hashes, c); got != i {
|
||||
t.Errorf("code %d matched index %d", i, got)
|
||||
}
|
||||
}
|
||||
if got := MatchRecoveryCode(hashes, "AAAAA-AAAAA"); got != -1 {
|
||||
t.Errorf("an invented code matched index %d", got)
|
||||
}
|
||||
|
||||
// Transcription must be forgiven: read off a printout, typed back in.
|
||||
c := codes[0]
|
||||
for _, variant := range []string{
|
||||
strings.ToLower(c),
|
||||
strings.ReplaceAll(c, "-", ""),
|
||||
" " + c + " ",
|
||||
strings.ToLower(strings.ReplaceAll(c, "-", " ")),
|
||||
} {
|
||||
if got := MatchRecoveryCode(hashes, variant); got != 0 {
|
||||
t.Errorf("variant %q matched index %d, want 0", variant, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// codeAt produces the code an authenticator app would display at that moment,
|
||||
// using the same settings VerifyTOTP checks against.
|
||||
func codeAt(t *testing.T, secret string, now time.Time) string {
|
||||
t.Helper()
|
||||
code, err := totp.GenerateCodeCustom(secret, now, totp.ValidateOpts{
|
||||
Period: totpPeriod,
|
||||
Skew: totpSkew,
|
||||
Digits: totpDigits,
|
||||
Algorithm: otp.AlgorithmSHA1,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("generate code: %v", err)
|
||||
}
|
||||
return code
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
// Package auth holds password hashing, opaque tokens and TOTP — the parts of
|
||||
// verdande's own user system where getting the details wrong is not recoverable
|
||||
// by fixing them later.
|
||||
package auth
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/crypto/argon2"
|
||||
)
|
||||
|
||||
// Argon2id parameters, at OWASP's current recommendation for interactive logins:
|
||||
// 19 MiB of memory, two passes, no parallelism.
|
||||
//
|
||||
// Memory is the knob that matters — it is what makes a GPU attack expensive — but
|
||||
// it is also charged per concurrent login, and verdande runs on somebody's homelab
|
||||
// next to a game server. 19 MiB × a handful of simultaneous logins is affordable
|
||||
// there in a way that the 64 MiB variant is not.
|
||||
//
|
||||
// These are the parameters for *new* hashes only. Every hash records the parameters
|
||||
// it was made with, so raising these does not lock anyone out: existing passwords
|
||||
// keep verifying against their own settings, and NeedsRehash reports which ones
|
||||
// should be upgraded the next time their owner logs in and the plaintext is at hand.
|
||||
const (
|
||||
argonMemory = 19 * 1024 // KiB
|
||||
argonTime = 2
|
||||
argonThreads = 1
|
||||
argonKeyLen = 32
|
||||
saltLen = 16
|
||||
)
|
||||
|
||||
var (
|
||||
ErrInvalidHash = errors.New("auth: password hash is not in the expected format")
|
||||
ErrMismatch = errors.New("auth: password does not match")
|
||||
)
|
||||
|
||||
// HashPassword returns a PHC-format string that carries the algorithm, its
|
||||
// parameters and the salt alongside the digest, so it is self-describing:
|
||||
//
|
||||
// $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>
|
||||
func HashPassword(password string) (string, error) {
|
||||
salt := make([]byte, saltLen)
|
||||
if _, err := rand.Read(salt); err != nil {
|
||||
return "", fmt.Errorf("auth: read salt: %w", err)
|
||||
}
|
||||
return encodeHash(password, salt, argonMemory, argonTime, argonThreads), nil
|
||||
}
|
||||
|
||||
// VerifyPassword reports whether password produced encoded.
|
||||
//
|
||||
// It returns ErrMismatch for a wrong password and ErrInvalidHash for a stored value
|
||||
// that cannot be read at all. Callers must not tell those two apart to the user:
|
||||
// both mean "you are not logged in", and distinguishing them leaks which accounts
|
||||
// exist.
|
||||
func VerifyPassword(encoded, password string) error {
|
||||
params, salt, want, err := decodeHash(encoded)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
got := argon2.IDKey([]byte(password), salt, params.time, params.memory, params.threads, uint32(len(want)))
|
||||
// Constant time: a byte-by-byte comparison that returns early leaks how much of
|
||||
// a guess was right, one request at a time.
|
||||
if subtle.ConstantTimeCompare(got, want) != 1 {
|
||||
return ErrMismatch
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// NeedsRehash reports whether a stored hash was made with weaker parameters than
|
||||
// the ones in force now. Verifying a login is the only moment the plaintext exists,
|
||||
// so it is the only moment an upgrade is possible.
|
||||
func NeedsRehash(encoded string) bool {
|
||||
params, _, _, err := decodeHash(encoded)
|
||||
if err != nil {
|
||||
return true
|
||||
}
|
||||
return params.memory < argonMemory || params.time < argonTime
|
||||
}
|
||||
|
||||
type argonParams struct {
|
||||
memory uint32
|
||||
time uint32
|
||||
threads uint8
|
||||
}
|
||||
|
||||
func encodeHash(password string, salt []byte, memory, time uint32, threads uint8) string {
|
||||
sum := argon2.IDKey([]byte(password), salt, time, memory, threads, argonKeyLen)
|
||||
b64 := base64.RawStdEncoding
|
||||
return fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
|
||||
argon2.Version, memory, time, threads, b64.EncodeToString(salt), b64.EncodeToString(sum))
|
||||
}
|
||||
|
||||
func decodeHash(encoded string) (argonParams, []byte, []byte, error) {
|
||||
parts := strings.Split(encoded, "$")
|
||||
if len(parts) != 6 || parts[0] != "" || parts[1] != "argon2id" {
|
||||
return argonParams{}, nil, nil, ErrInvalidHash
|
||||
}
|
||||
|
||||
var version int
|
||||
if _, err := fmt.Sscanf(parts[2], "v=%d", &version); err != nil {
|
||||
return argonParams{}, nil, nil, ErrInvalidHash
|
||||
}
|
||||
if version != argon2.Version {
|
||||
// A hash from a different Argon2 version cannot be checked by this build.
|
||||
return argonParams{}, nil, nil, ErrInvalidHash
|
||||
}
|
||||
|
||||
var p argonParams
|
||||
if _, err := fmt.Sscanf(parts[3], "m=%d,t=%d,p=%d", &p.memory, &p.time, &p.threads); err != nil {
|
||||
return argonParams{}, nil, nil, ErrInvalidHash
|
||||
}
|
||||
if p.memory == 0 || p.time == 0 || p.threads == 0 {
|
||||
return argonParams{}, nil, nil, ErrInvalidHash
|
||||
}
|
||||
|
||||
b64 := base64.RawStdEncoding
|
||||
salt, err := b64.DecodeString(parts[4])
|
||||
if err != nil {
|
||||
return argonParams{}, nil, nil, ErrInvalidHash
|
||||
}
|
||||
sum, err := b64.DecodeString(parts[5])
|
||||
if err != nil || len(sum) == 0 {
|
||||
return argonParams{}, nil, nil, ErrInvalidHash
|
||||
}
|
||||
return p, salt, sum, nil
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"fmt"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// tokenBytes is 32 bytes — 256 bits — of randomness. These tokens sit in emailed
|
||||
// links and in scripts' config files, where they may live for a long time and be
|
||||
// guessed at without rate limiting, so they are sized to be unguessable rather than
|
||||
// convenient.
|
||||
const tokenBytes = 32
|
||||
|
||||
// NewToken returns a URL-safe random token. This is the only time the plaintext
|
||||
// exists: store HashToken(t), put t in the link, and never write it down anywhere
|
||||
// else. A database dump then contains nothing an attacker can present.
|
||||
func NewToken() (string, error) {
|
||||
b := make([]byte, tokenBytes)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return "", fmt.Errorf("auth: read random: %w", err)
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(b), nil
|
||||
}
|
||||
|
||||
// HashToken is the lookup key for a token.
|
||||
//
|
||||
// SHA-256 with no salt, deliberately — unlike a password, this has to be *found* by
|
||||
// its value in a WHERE clause, which a per-row salt makes impossible. That is safe
|
||||
// here only because the input is 256 bits of uniform randomness: there is no
|
||||
// dictionary to run against it and no work factor worth adding.
|
||||
func HashToken(token string) string {
|
||||
sum := sha256.Sum256([]byte(token))
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
|
||||
// apiTokenPrefix marks verdande's own tokens in logs and config files, and lets
|
||||
// secret scanners recognise one that has been committed by accident.
|
||||
const apiTokenPrefix = "vrd_"
|
||||
|
||||
// NewAPIToken returns a personal API token and the short prefix shown in the UI so
|
||||
// somebody can tell two of their tokens apart without being shown either in full.
|
||||
func NewAPIToken() (token, prefix string, err error) {
|
||||
raw, err := NewToken()
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
token = apiTokenPrefix + raw
|
||||
return token, token[:len(apiTokenPrefix)+6], nil
|
||||
}
|
||||
|
||||
// IsAPIToken reports whether a credential looks like one of verdande's API tokens
|
||||
// rather than a session id, so the two are never checked against the wrong table.
|
||||
func IsAPIToken(s string) bool { return strings.HasPrefix(s, apiTokenPrefix) }
|
||||
@@ -0,0 +1,136 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/base32"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/pquerna/otp"
|
||||
"github.com/pquerna/otp/totp"
|
||||
)
|
||||
|
||||
// TOTP settings: RFC 6238 defaults, which is what every authenticator app assumes
|
||||
// when a QR code does not say otherwise.
|
||||
const (
|
||||
totpDigits = otp.DigitsSix
|
||||
totpPeriod = 30 // seconds
|
||||
// A one-step window either side, so a code entered as it rolls over — or on a
|
||||
// phone whose clock is a few seconds out — is still accepted. Wider than this
|
||||
// starts meaningfully extending the life of a stolen code.
|
||||
totpSkew = 1
|
||||
)
|
||||
|
||||
var (
|
||||
ErrInvalidCode = errors.New("auth: verification code is not valid")
|
||||
ErrNoTOTPSecret = errors.New("auth: two-factor authentication is not set up")
|
||||
recoveryCodeLen = 10
|
||||
recoveryCodeSets = 8
|
||||
)
|
||||
|
||||
// NewTOTPSecret creates a secret for a user and the otpauth:// URI to render as a
|
||||
// QR code. Issuer and account are what the authenticator app shows in its list, so
|
||||
// they have to identify this verdande instance rather than just say "verdande" —
|
||||
// somebody self-hosting two of them needs to tell the entries apart.
|
||||
func NewTOTPSecret(issuer, account string) (secret, uri string, err error) {
|
||||
key, err := totp.Generate(totp.GenerateOpts{
|
||||
Issuer: issuer,
|
||||
AccountName: account,
|
||||
Period: totpPeriod,
|
||||
Digits: totpDigits,
|
||||
Algorithm: otp.AlgorithmSHA1, // what authenticator apps actually implement
|
||||
})
|
||||
if err != nil {
|
||||
return "", "", fmt.Errorf("auth: generate totp secret: %w", err)
|
||||
}
|
||||
return key.Secret(), key.URL(), nil
|
||||
}
|
||||
|
||||
// TOTPURI rebuilds the otpauth:// URI for an existing secret, for showing the QR
|
||||
// code again before enrolment is confirmed.
|
||||
func TOTPURI(secret, issuer, account string) string {
|
||||
v := url.Values{}
|
||||
v.Set("secret", secret)
|
||||
v.Set("issuer", issuer)
|
||||
v.Set("algorithm", "SHA1")
|
||||
v.Set("digits", "6")
|
||||
v.Set("period", fmt.Sprint(totpPeriod))
|
||||
return "otpauth://totp/" + url.PathEscape(issuer+":"+account) + "?" + v.Encode()
|
||||
}
|
||||
|
||||
// VerifyTOTP checks a code against a secret at the given moment.
|
||||
func VerifyTOTP(secret, code string, now time.Time) error {
|
||||
if secret == "" {
|
||||
return ErrNoTOTPSecret
|
||||
}
|
||||
// Authenticator apps display codes in groups ("123 456"); people paste what
|
||||
// they see.
|
||||
code = strings.ReplaceAll(strings.TrimSpace(code), " ", "")
|
||||
|
||||
ok, err := totp.ValidateCustom(code, secret, now, totp.ValidateOpts{
|
||||
Period: totpPeriod,
|
||||
Skew: totpSkew,
|
||||
Digits: totpDigits,
|
||||
Algorithm: otp.AlgorithmSHA1,
|
||||
})
|
||||
if err != nil || !ok {
|
||||
return ErrInvalidCode
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// NewRecoveryCodes returns single-use codes for someone who has lost their phone,
|
||||
// and the hashes to store. Without these, losing a device means losing the account,
|
||||
// and the only fix left is editing the database by hand.
|
||||
//
|
||||
// The plaintext is returned once, to be shown once. Only the hashes are stored.
|
||||
func NewRecoveryCodes() (codes []string, hashes []string, err error) {
|
||||
// Crockford-ish base32 without padding: unambiguous when read off a printout
|
||||
// and typed back in.
|
||||
const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
|
||||
for i := 0; i < recoveryCodeSets; i++ {
|
||||
b := make([]byte, recoveryCodeLen)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return nil, nil, fmt.Errorf("auth: read random: %w", err)
|
||||
}
|
||||
var sb strings.Builder
|
||||
for j, v := range b {
|
||||
if j == recoveryCodeLen/2 {
|
||||
sb.WriteByte('-')
|
||||
}
|
||||
sb.WriteByte(alphabet[int(v)%len(alphabet)])
|
||||
}
|
||||
code := sb.String()
|
||||
codes = append(codes, code)
|
||||
hashes = append(hashes, HashToken(normalizeRecoveryCode(code)))
|
||||
}
|
||||
return codes, hashes, nil
|
||||
}
|
||||
|
||||
// MatchRecoveryCode finds which stored hash a typed code corresponds to, or -1.
|
||||
// The caller must delete that hash: a recovery code works exactly once.
|
||||
func MatchRecoveryCode(hashes []string, code string) int {
|
||||
want := HashToken(normalizeRecoveryCode(code))
|
||||
for i, h := range hashes {
|
||||
if h == want {
|
||||
return i
|
||||
}
|
||||
}
|
||||
return -1
|
||||
}
|
||||
|
||||
// normalizeRecoveryCode forgives how the code was transcribed — case, the dash,
|
||||
// surrounding space — so a correct code is never rejected for its formatting.
|
||||
func normalizeRecoveryCode(code string) string {
|
||||
r := strings.NewReplacer("-", "", " ", "", "\t", "")
|
||||
return strings.ToUpper(r.Replace(strings.TrimSpace(code)))
|
||||
}
|
||||
|
||||
// DecodeTOTPSecret is used by tests and by the enrolment check to confirm a secret
|
||||
// is well-formed base32 before it is written to the database.
|
||||
func DecodeTOTPSecret(secret string) ([]byte, error) {
|
||||
return base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(strings.ToUpper(secret))
|
||||
}
|
||||
Reference in New Issue
Block a user