Add an Account page for sign-in methods and signed-in devices
/web/account, offered to everyone, lists every browser and client signed in as you, with when each was last used, and signs any of them out, or all but the current one. It sets up, replaces and removes the second factor, and holds the password form, moved from the vault page. Administrators can sign a user out everywhere from the People page. The API gains GET and DELETE /api/v1/auth/sessions and DELETE /api/v1/auth/totp. Sessions are named by a digest of their token, never the token, and record when they were last used. Replacing or removing an active second factor now needs the password and a current code. Server version 0.10.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Reactorcoremeltdown
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
318bd68908
commit
f8f634fbf7
@@ -0,0 +1,316 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"net/http"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"cc.tiredsysadmin.keeporg/internal/store"
|
||||
"cc.tiredsysadmin.keeporg/internal/totp"
|
||||
)
|
||||
|
||||
// A person's own account: the sessions it holds on each device, and its
|
||||
// second factor. As with administration, every change is a function over the
|
||||
// state taking the caller, and the JSON handlers below and the settings page
|
||||
// in webaccount.go are both thin wrappers over them.
|
||||
|
||||
var (
|
||||
// errNoSuchSession is a session that does not exist or is not the
|
||||
// caller's; the two are not told apart.
|
||||
errNoSuchSession = errors.New("no such session")
|
||||
// errNoPassword is an account that signs in only through single
|
||||
// sign-on. Its second factor belongs at the identity provider, and there
|
||||
// is no password to change.
|
||||
errNoPassword = errors.New("this account signs in through single sign-on and has no password here")
|
||||
// errReauth asks for the password and, once enrolled, the one-time code,
|
||||
// before a change that would weaken how the account signs in. A live
|
||||
// session is what an unlocked laptop leaves lying around.
|
||||
errReauth = errors.New("confirm with your password and one-time code")
|
||||
)
|
||||
|
||||
// sessionID is a session's public name: a one-way digest of its token, so a
|
||||
// page or a response can point at a session without carrying the bearer
|
||||
// token that would sign in as it.
|
||||
func sessionID(token string) string {
|
||||
sum := sha256.Sum256([]byte(token))
|
||||
return hex.EncodeToString(sum[:8])
|
||||
}
|
||||
|
||||
// sessionView is one signed-in device as its owner sees it.
|
||||
type sessionView struct {
|
||||
ID string `json:"id"`
|
||||
Label string `json:"label"`
|
||||
Browser bool `json:"browser"`
|
||||
Current bool `json:"current"`
|
||||
CreatedAt time.Time `json:"created_at"`
|
||||
LastSeenAt time.Time `json:"last_seen_at"`
|
||||
ExpiresAt time.Time `json:"expires_at"`
|
||||
}
|
||||
|
||||
// sessionsOf lists a user's live sessions, the caller's own first and the
|
||||
// rest by most recent use.
|
||||
func sessionsOf(st *store.State, userID, current string) []sessionView {
|
||||
out := []sessionView{}
|
||||
now := time.Now()
|
||||
for token, sess := range st.Sessions {
|
||||
if sess.UserID != userID || now.After(sess.ExpiresAt) {
|
||||
continue
|
||||
}
|
||||
seen := sess.LastSeenAt
|
||||
if seen.IsZero() {
|
||||
seen = sess.CreatedAt
|
||||
}
|
||||
out = append(out, sessionView{
|
||||
ID: sessionID(token), Label: sess.Label, Browser: sess.IsBrowser(),
|
||||
Current: token == current, CreatedAt: sess.CreatedAt,
|
||||
LastSeenAt: seen, ExpiresAt: sess.ExpiresAt,
|
||||
})
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool {
|
||||
if out[i].Current != out[j].Current {
|
||||
return out[i].Current
|
||||
}
|
||||
return out[i].LastSeenAt.After(out[j].LastSeenAt)
|
||||
})
|
||||
return out
|
||||
}
|
||||
|
||||
// revokeSession signs one of the caller's sessions out. The device holding
|
||||
// it is refused from its next request on.
|
||||
func revokeSession(st *store.State, userID, id string) error {
|
||||
for token, sess := range st.Sessions {
|
||||
if sess.UserID == userID && sessionID(token) == id {
|
||||
delete(st.Sessions, token)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
return errNoSuchSession
|
||||
}
|
||||
|
||||
// revokeOtherSessions signs out every session of the caller but keep, and
|
||||
// says how many went.
|
||||
func revokeOtherSessions(st *store.State, userID, keep string) int {
|
||||
n := 0
|
||||
for token, sess := range st.Sessions {
|
||||
if sess.UserID == userID && token != keep {
|
||||
delete(st.Sessions, token)
|
||||
n++
|
||||
}
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
// reauth checks the caller's password, and their one-time code when one is
|
||||
// enrolled, for a change that weakens or replaces how the account signs in.
|
||||
func reauth(st *store.State, u *store.User, password, code string) error {
|
||||
if u.PassHash == "" {
|
||||
return errNoPassword
|
||||
}
|
||||
if password == "" {
|
||||
return errReauth
|
||||
}
|
||||
_, err := checkPassword(st, u.Username, password, code)
|
||||
return err
|
||||
}
|
||||
|
||||
// beginTOTP starts enrolling a second factor and returns its secret. Until
|
||||
// confirmTOTP sees a code from it, the account signs in as before. Replacing
|
||||
// a factor that is already active needs the password and the current code,
|
||||
// because a new secret disarms the old one.
|
||||
func beginTOTP(st *store.State, userID, password, code string) (string, error) {
|
||||
u := st.Users[userID]
|
||||
if u == nil {
|
||||
return "", errNoSuchSession
|
||||
}
|
||||
if u.PassHash == "" {
|
||||
return "", errNoPassword
|
||||
}
|
||||
if u.TOTPConfirmed {
|
||||
if err := reauth(st, u, password, code); err != nil {
|
||||
return "", err
|
||||
}
|
||||
}
|
||||
u.TOTPSecret, u.TOTPConfirmed = totp.NewSecret(), false
|
||||
return u.TOTPSecret, nil
|
||||
}
|
||||
|
||||
// confirmTOTP turns the second factor on, once a code from it checks out.
|
||||
func confirmTOTP(st *store.State, userID, code string) error {
|
||||
u := st.Users[userID]
|
||||
if u == nil || u.TOTPSecret == "" {
|
||||
return errors.New("start setting up a second factor first")
|
||||
}
|
||||
if u.TOTPConfirmed {
|
||||
return errors.New("the second factor is already on")
|
||||
}
|
||||
if !totp.Check(u.TOTPSecret, code, time.Now()) {
|
||||
return errTOTPInvalid
|
||||
}
|
||||
u.TOTPConfirmed = true
|
||||
return nil
|
||||
}
|
||||
|
||||
// cancelTOTP abandons an enrolment that was never confirmed.
|
||||
func cancelTOTP(st *store.State, userID string) {
|
||||
if u := st.Users[userID]; u != nil && !u.TOTPConfirmed {
|
||||
u.TOTPSecret = ""
|
||||
}
|
||||
}
|
||||
|
||||
// disableTOTP turns the second factor off, behind the password and a
|
||||
// current code.
|
||||
func disableTOTP(st *store.State, userID, password, code string) error {
|
||||
u := st.Users[userID]
|
||||
if u == nil {
|
||||
return errNoSuchSession
|
||||
}
|
||||
if !u.TOTPConfirmed {
|
||||
return errors.New("no second factor is on")
|
||||
}
|
||||
if err := reauth(st, u, password, code); err != nil {
|
||||
return err
|
||||
}
|
||||
u.TOTPSecret, u.TOTPConfirmed = "", false
|
||||
return nil
|
||||
}
|
||||
|
||||
// failAccount maps an account error onto a response. Re-authentication
|
||||
// failures are 403, not 401: a client that drops its token on 401 must not
|
||||
// sign itself out over a mistyped password.
|
||||
func failAccount(w http.ResponseWriter, err error) {
|
||||
switch {
|
||||
case errors.Is(err, errNoSuchSession):
|
||||
fail(w, http.StatusNotFound, "not_found", err.Error())
|
||||
case errors.Is(err, errReauth), errors.Is(err, errTOTPRequired):
|
||||
fail(w, http.StatusForbidden, "reauth_required", errReauth.Error())
|
||||
case errors.Is(err, errTOTPInvalid):
|
||||
fail(w, http.StatusForbidden, "totp_invalid", "the one-time code was rejected")
|
||||
case errors.Is(err, errBadCredentials):
|
||||
fail(w, http.StatusForbidden, "bad_credentials", "the password is wrong")
|
||||
case errors.Is(err, errNoPassword):
|
||||
fail(w, http.StatusConflict, "no_password", err.Error())
|
||||
default:
|
||||
fail(w, http.StatusBadRequest, "bad_request", err.Error())
|
||||
}
|
||||
}
|
||||
|
||||
// ---- API ----
|
||||
|
||||
func (s *Server) handleListSessions(w http.ResponseWriter, r *http.Request, u *store.User) {
|
||||
var out []sessionView
|
||||
s.st.Read(func(st *store.State) { out = sessionsOf(st, u.ID, bearer(r)) })
|
||||
writeJSON(w, http.StatusOK, map[string]any{"sessions": out})
|
||||
}
|
||||
|
||||
func (s *Server) handleRevokeSession(w http.ResponseWriter, r *http.Request, u *store.User) {
|
||||
if err := s.st.Update(func(st *store.State) error {
|
||||
return revokeSession(st, u.ID, r.PathValue("id"))
|
||||
}); err != nil {
|
||||
failAccount(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, map[string]string{"status": "revoked"})
|
||||
}
|
||||
|
||||
func (s *Server) handleRevokeOtherSessions(w http.ResponseWriter, r *http.Request, u *store.User) {
|
||||
var n int
|
||||
if err := s.st.Update(func(st *store.State) error {
|
||||
n = revokeOtherSessions(st, u.ID, bearer(r))
|
||||
return nil
|
||||
}); err != nil {
|
||||
fail(w, http.StatusInternalServerError, "internal", err.Error())
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, map[string]int{"revoked": n})
|
||||
}
|
||||
|
||||
// reauthRequest is the body of a change that may need re-authentication.
|
||||
// It is optional where nothing is enrolled yet.
|
||||
type reauthRequest struct {
|
||||
Password string `json:"password"`
|
||||
TOTP string `json:"totp"`
|
||||
}
|
||||
|
||||
func (s *Server) handleTOTPEnroll(w http.ResponseWriter, r *http.Request, u *store.User) {
|
||||
var req reauthRequest
|
||||
if r.ContentLength > 0 && !readJSON(w, r, &req) {
|
||||
return
|
||||
}
|
||||
var sec string
|
||||
if err := s.st.Update(func(st *store.State) error {
|
||||
var err error
|
||||
sec, err = beginTOTP(st, u.ID, req.Password, req.TOTP)
|
||||
return err
|
||||
}); err != nil {
|
||||
failAccount(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, map[string]string{
|
||||
"secret": sec,
|
||||
"uri": totp.URI("KeepOrg", u.Username, sec),
|
||||
})
|
||||
}
|
||||
|
||||
func (s *Server) handleTOTPConfirm(w http.ResponseWriter, r *http.Request, u *store.User) {
|
||||
var req struct {
|
||||
Code string `json:"code"`
|
||||
}
|
||||
if !readJSON(w, r, &req) {
|
||||
return
|
||||
}
|
||||
if err := s.st.Update(func(st *store.State) error {
|
||||
return confirmTOTP(st, u.ID, req.Code)
|
||||
}); err != nil {
|
||||
if errors.Is(err, errTOTPInvalid) {
|
||||
fail(w, http.StatusBadRequest, "totp_invalid", "code rejected")
|
||||
return
|
||||
}
|
||||
failAccount(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, map[string]bool{"totp_enabled": true})
|
||||
}
|
||||
|
||||
func (s *Server) handleTOTPDisable(w http.ResponseWriter, r *http.Request, u *store.User) {
|
||||
var req reauthRequest
|
||||
if !readJSON(w, r, &req) {
|
||||
return
|
||||
}
|
||||
if err := s.st.Update(func(st *store.State) error {
|
||||
return disableTOTP(st, u.ID, req.Password, req.TOTP)
|
||||
}); err != nil {
|
||||
failAccount(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, map[string]bool{"totp_enabled": false})
|
||||
}
|
||||
|
||||
// browserLabel names a browser session from its User-Agent, as "Firefox on
|
||||
// macOS". It is a label for a person to recognise, not a fingerprint, so a
|
||||
// handful of substrings is enough.
|
||||
func browserLabel(ua string) string {
|
||||
browser := "Browser"
|
||||
for _, b := range []struct{ token, name string }{
|
||||
{"Edg/", "Edge"}, {"OPR/", "Opera"}, {"Firefox/", "Firefox"},
|
||||
{"Chrome/", "Chrome"}, {"Safari/", "Safari"},
|
||||
} {
|
||||
if strings.Contains(ua, b.token) {
|
||||
browser = b.name
|
||||
break
|
||||
}
|
||||
}
|
||||
for _, o := range []struct{ token, name string }{
|
||||
{"Android", "Android"}, {"iPhone", "iOS"}, {"iPad", "iPadOS"},
|
||||
{"CrOS", "ChromeOS"}, {"Mac OS X", "macOS"}, {"Windows", "Windows"},
|
||||
{"Linux", "Linux"}, {"BSD", "BSD"},
|
||||
} {
|
||||
if strings.Contains(ua, o.token) {
|
||||
return browser + " on " + o.name
|
||||
}
|
||||
}
|
||||
return browser
|
||||
}
|
||||
Reference in New Issue
Block a user