Keep server data in an encrypted database, and harden every part

Storage. The server keeps its data in SQLite (a file in the data directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or -database). Every row, the KDBX versions included, is sealed with AES-256-GCM under a key derived from the master key and named by an HMAC. The master key is required to start and a different one is refused. A data directory from 0.10 or earlier is imported on first start. Several servers may share one PostgreSQL database. Go goes to 1.26 for the pure-Go drivers (modernc.org/sqlite, jackc/pgx). Hardening, after an audit of the server, both clients and the deployment: - Single sign-on approves a device only after an explicit Approve in the browser that started it, bound by a cookie and PKCE; identities are never linked by username, by verified email only when allowed, never to admins. - Sign-in attempts are limited per address and per account, passwords are checked outside the store lock with uniform timing, one-time codes work once, and starting two-factor needs the password. - Merge vaults bound KDF parameters, payload size and XML shape, check pushes before storing them, and run at most two merges at once. A version is written in the same transaction as its metadata. - Tokens in URLs only on the event stream, which ends on revocation; CSP, frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases without access; new trusted_proxies. - Clients open only the server's approval page, keep case-variant and retired file names apart, never overwrite a save made during a pull, require https except locally, send the stream token in a header, bound their reads and escape notifications and terminal output. - The .deb creates the master key, systemd is sandboxed further, nginx sets modern TLS and HSTS, and CI deploys from main only. Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-02 15:38:32 +01:00
parent f8f634fbf7
commit 4ffc434b1b
77 changed files with 4192 additions and 776 deletions
@@ -10,7 +10,6 @@ import (

 	"cc.tiredsysadmin.keeporg/internal/secret"
 	"cc.tiredsysadmin.keeporg/internal/store"
-	"cc.tiredsysadmin.keeporg/internal/totp"
 )

 // MinPasswordLen is the shortest password the server will store.
@@ -19,33 +18,31 @@ const MinPasswordLen = 10
 // deviceTTL bounds how long a pending device login stays open.
 const deviceTTL = 10 * time.Minute

+// maxPendingDevices bounds the device logins anyone can open without an
+// account. Each is a row in the state, which every write copies.
+const maxPendingDevices = 500
+
+// errBusy means too many device logins are pending.
+var errBusy = errors.New("too many sign-ins are pending; try again in a few minutes")
+
+// pruneDevices drops expired device logins and reports whether there is
+// room for another.
+func pruneDevices(st *store.State) bool {
+	now := time.Now()
+	for k, d := range st.Devices {
+		if now.After(d.ExpiresAt) {
+			delete(st.Devices, k)
+		}
+	}
+	return len(st.Devices) < maxPendingDevices
+}
+
 var (
 	errBadCredentials = errors.New("bad credentials")
 	errTOTPRequired   = errors.New("totp required")
 	errTOTPInvalid    = errors.New("totp invalid")
 )

-// checkPassword validates a username, password and second factor against the
-// state. It is the one place password login is decided.
-func checkPassword(st *store.State, username, password, code string) (*store.User, error) {
-	u := st.UserByName(username)
-	if u == nil || u.Disabled || u.PassHash == "" {
-		return nil, errBadCredentials
-	}
-	if !secret.Verify(u.PassHash, password) {
-		return nil, errBadCredentials
-	}
-	if u.TOTPConfirmed {
-		if strings.TrimSpace(code) == "" {
-			return nil, errTOTPRequired
-		}
-		if !totp.Check(u.TOTPSecret, code, time.Now()) {
-			return nil, errTOTPInvalid
-		}
-	}
-	return u, nil
-}
-
 type loginRequest struct {
 	Username string `json:"username"`
 	Password string `json:"password"`
@@ -78,15 +75,14 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	var resp loginResponse
-	err := s.st.Update(func(st *store.State) error {
-		u, err := checkPassword(st, req.Username, req.Password, req.TOTP)
-		if err != nil {
-			return err
-		}
-		sess := s.newSession(st, u.ID, req.Label)
+	err := s.signIn(r, req.Username, req.Password, req.TOTP, func(st *store.State, u *store.User) error {
+		sess := s.newSession(st, u.ID, clampLabel(req.Label))
 		resp = loginResponse{Token: sess.Token, ExpiresAt: sess.ExpiresAt, User: view(u)}
 		return nil
 	})
+	if writeThrottled(w, err) {
+		return
+	}
 	switch {
 	case errors.Is(err, errTOTPRequired):
 		fail(w, http.StatusUnauthorized, "totp_required", "second factor required")
@@ -151,19 +147,31 @@ func (s *Server) handleDeviceStart(w http.ResponseWriter, r *http.Request) {
 			"return_url must use the "+returnScheme+": scheme")
 		return
 	}
+	if wait := s.limits.take("start:" + s.clientIP(r)); wait > 0 {
+		writeThrottled(w, &errThrottled{RetryAfter: wait})
+		return
+	}
 	d := &store.DeviceAuth{
 		DeviceCode: secret.Token(),
 		UserCode:   secret.UserCode(),
-		Label:      req.Label,
+		Label:      clampLabel(req.Label),
 		ReturnURL:  req.ReturnURL,
 		CreatedAt:  time.Now(),
 		ExpiresAt:  time.Now().Add(deviceTTL),
 	}
 	if err := s.st.Update(func(st *store.State) error {
+		if !pruneDevices(st) {
+			return errBusy
+		}
 		st.Devices[d.DeviceCode] = d
 		return nil
 	}); err != nil {
-		fail(w, http.StatusInternalServerError, "internal", err.Error())
+		if errors.Is(err, errBusy) {
+			fail(w, http.StatusServiceUnavailable, "busy", err.Error())
+			return
+		}
+		s.log.Printf("device start: %v", err)
+		fail(w, http.StatusInternalServerError, "internal", "could not start the sign-in")
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{
@@ -237,20 +245,20 @@ func (s *Server) handleDeviceApprove(w http.ResponseWriter, r *http.Request) {
 	}
 	code := strings.ToUpper(strings.TrimSpace(r.FormValue("code")))
 	var returnURL string
-	err := s.st.Update(func(st *store.State) error {
-		d := st.DeviceByUserCode(code)
-		if d == nil || time.Now().After(d.ExpiresAt) {
-			return errors.New("unknown or expired code")
-		}
-		returnURL = d.ReturnURL
-		u, err := checkPassword(st, r.FormValue("username"), r.FormValue("password"), r.FormValue("totp"))
-		if err != nil {
-			return err
-		}
-		d.SessionToken = s.newSession(st, u.ID, d.Label).Token
-		return nil
-	})
+	err := s.signIn(r, r.FormValue("username"), r.FormValue("password"), r.FormValue("totp"),
+		func(st *store.State, u *store.User) error {
+			d := st.DeviceByUserCode(code)
+			if d == nil || time.Now().After(d.ExpiresAt) || d.SessionToken != "" {
+				return errors.New("unknown or expired code")
+			}
+			returnURL = d.ReturnURL
+			d.SessionToken = s.newSession(st, u.ID, d.Label).Token
+			return nil
+		})
+	var throttled *errThrottled
 	switch {
+	case errors.As(err, &throttled):
+		s.renderDevice(w, code, throttled.Error())
 	case errors.Is(err, errTOTPRequired):
 		s.renderDevice(w, code, "This account requires a one-time code.")
 	case errors.Is(err, errTOTPInvalid):
@@ -280,28 +288,27 @@ func validReturnURL(raw string) bool {
 // session, the second factor is required when one is enrolled, and every
 // other session of that user is revoked, because a password change is what
 // someone does when they think a session is no longer theirs.
-func changePassword(st *store.State, username, current, totpCode, next, keepToken string) error {
-	u, err := checkPassword(st, username, current, totpCode)
-	if err != nil {
-		return err
-	}
+func (s *Server) changePassword(r *http.Request, u *store.User, current, code, next, keepToken string) error {
 	if len(next) < MinPasswordLen {
 		return fmt.Errorf("the new password must be at least %d characters", MinPasswordLen)
 	}
 	if next == current {
 		return errors.New("the new password is the same as the old one")
 	}
+	// Hashed before the write, for the same reason verify checks outside it.
 	hash, err := secret.Hash(next)
 	if err != nil {
 		return err
 	}
-	u.PassHash = hash
-	for token, sess := range st.Sessions {
-		if sess.UserID == u.ID && token != keepToken {
-			delete(st.Sessions, token)
+	return s.reconfirm(r, u, current, code, func(st *store.State, u *store.User) error {
+		u.PassHash = hash
+		for token, sess := range st.Sessions {
+			if sess.UserID == u.ID && token != keepToken {
+				delete(st.Sessions, token)
+			}
 		}
-	}
-	return nil
+		return nil
+	})
 }

 func (s *Server) handleChangePassword(w http.ResponseWriter, r *http.Request, u *store.User) {
@@ -313,17 +320,17 @@ func (s *Server) handleChangePassword(w http.ResponseWriter, r *http.Request, u
 	if !readJSON(w, r, &req) {
 		return
 	}
-	err := s.st.Update(func(st *store.State) error {
-		return changePassword(st, u.Username, req.CurrentPassword, req.TOTP,
-			req.NewPassword, bearer(r))
-	})
+	err := s.changePassword(r, u, req.CurrentPassword, req.TOTP, req.NewPassword, bearer(r))
+	if writeThrottled(w, err) {
+		return
+	}
 	switch {
 	case errors.Is(err, errTOTPRequired):
 		fail(w, http.StatusUnauthorized, "totp_required", "second factor required")
-	case errors.Is(err, errTOTPInvalid):
-		fail(w, http.StatusUnauthorized, "totp_invalid", "second factor rejected")
-	case errors.Is(err, errBadCredentials):
-		fail(w, http.StatusUnauthorized, "bad_credentials", "the current password is wrong")
+	case errors.Is(err, errBadCredentials), errors.Is(err, errReauth):
+		fail(w, http.StatusUnauthorized, "bad_credentials", "the current password or one-time code is wrong")
+	case errors.Is(err, errNoPassword):
+		fail(w, http.StatusUnauthorized, "bad_credentials", err.Error())
 	case err != nil:
 		fail(w, http.StatusBadRequest, "bad_request", err.Error())
 	default: