AJ ONeal
5 months ago
5 changed files with 72 additions and 510 deletions
Split View
Diff Options
-
+71 -16mockid/route.go
-
+0 -79public/hashcash.js
-
+1 -212public/main.js
-
+0 -118public/pocketid.js
-
+0 -85public/request.js
+ 71
- 16
mockid/route.go
View File
+ 0
- 79
public/hashcash.js
View File
| @ -1,79 +0,0 @@ | |||
| 'use strict'; | |||
| /*global crypto*/ | |||
| var Hashcash = module.exports; | |||
| var textEncoder = new TextEncoder(); | |||
| Hashcash.solve = async function solveHc(hc) { | |||
| var solution = 0; | |||
| var parts = hc.split(':').slice(0, 6); | |||
| if (parts.length < 6) { | |||
| throw new Error('invalid Hashcash-Challenge: ' + hc); | |||
| } | |||
| var bits = parseInt(parts[1], 10) || -1; | |||
| if (bits > 10 || bits < 0) { | |||
| throw new Error('bad bit values'); | |||
| } | |||
| console.log('bits:', bits); | |||
| hc = parts.join(':') + ':'; | |||
| async function next() { | |||
| var answer = hc + int52ToBase64(solution); | |||
| var u8 = textEncoder.encode(answer); | |||
| // REALLY SLOW due to async tasks and C++ context switch | |||
| var hash = await crypto.subtle.digest('SHA-256', u8); | |||
| hash = new Uint8Array(hash); | |||
| if (checkHc(hash, bits)) { | |||
| return answer; | |||
| } | |||
| solution += 1; | |||
| return next(); | |||
| } | |||
| return next(); | |||
| }; | |||
| function int52ToBase64(n) { | |||
| var hex = n.toString(16); | |||
| if (hex.length % 2) { | |||
| hex = '0' + hex; | |||
| } | |||
| var bin = []; | |||
| var i = 0; | |||
| var d; | |||
| var b; | |||
| while (i < hex.length) { | |||
| d = parseInt(hex.slice(i, i + 2), 16); | |||
| b = String.fromCharCode(d); | |||
| bin.push(b); | |||
| i += 2; | |||
| } | |||
| return btoa(bin.join('')).replace(/=/g, ''); | |||
| } | |||
| function checkHc(hash, bits) { | |||
| var n = Math.floor(bits / 8); | |||
| var m = bits % 8; | |||
| var i; | |||
| if (m > 0) { | |||
| n += 1; | |||
| } | |||
| for (i = 0; i < n && i < hash.length; i += 1) { | |||
| if (bits > 8) { | |||
| bits -= 8; | |||
| if (0 !== hash[i]) { | |||
| return false; | |||
| } | |||
| continue; | |||
| } | |||
| if (0 !== hash[i] >> (8 - bits)) { | |||
| return false; | |||
| } | |||
| return true; | |||
| } | |||
| } | |||
+ 1
- 212
public/main.js
View File
| @ -1,214 +1,3 @@ | |||
| 'use strict'; | |||
| var request = require('./request.js'); | |||
| var PocketId = require('./pocketid.js'); | |||
| var state = {}; | |||
| var auths = clearAuths(); | |||
| function $$(sel, el) { | |||
| if (el) { | |||
| return el.querySelectorAll(sel) || []; | |||
| } | |||
| return document.body.querySelectorAll(sel) || []; | |||
| } | |||
| function $(sel, el) { | |||
| if (el) { | |||
| return el.querySelector(sel); | |||
| } | |||
| return document.body.querySelector(sel); | |||
| } | |||
| function clearAuths() { | |||
| var _auths = { | |||
| google: { | |||
| promise: null, | |||
| idToken: '' | |||
| } | |||
| }; | |||
| _auths.google.promise = new Promise(function (res, rej) { | |||
| _auths.google.resolve = res; | |||
| _auths.google.reject = rej; | |||
| }); | |||
| return _auths; | |||
| } | |||
| window.onSignIn = async function onSignIn(googleUser) { | |||
| // Useful data for your client-side scripts: | |||
| var profile = googleUser.getBasicProfile(); | |||
| // Don't send this directly to your server! | |||
| console.log('ID: ' + profile.getId()); | |||
| console.log('Full Name: ' + profile.getName()); | |||
| console.log('Given Name: ' + profile.getGivenName()); | |||
| console.log('Family Name: ' + profile.getFamilyName()); | |||
| console.log('Image URL: ' + profile.getImageUrl()); | |||
| console.log('Email: ' + profile.getEmail()); | |||
| // The ID token you need to pass to your backend: | |||
| auths.google.idToken = googleUser.getAuthResponse().id_token; | |||
| console.log('ID Token: ' + auths.google.idToken); | |||
| auths.google.resolve(auths.google.idToken); | |||
| }; | |||
| function setFlow(cont, flow) { | |||
| $$(cont).forEach(function (el) { | |||
| el.hidden = true; | |||
| }); | |||
| console.log(flow); | |||
| $(flow).hidden = false; | |||
| } | |||
| async function unlock() { | |||
| var key; | |||
| try { | |||
| key = await PocketId.unlock(function () { | |||
| setFlow('.authn-container', '.authn-unlock'); | |||
| return new Promise(function (resolve, reject) { | |||
| window.unlocker = { resolve: resolve, reject: reject }; | |||
| }); | |||
| }); | |||
| } catch (e) { | |||
| console.error( | |||
| "Had a key, but couldn't unlock it. TODO: Just send email?" | |||
| ); | |||
| console.error(e); | |||
| return; | |||
| } | |||
| setFlow('.authn-container', '.authn-loading'); | |||
| if (key) { | |||
| genTokenWithKey(key); | |||
| return; | |||
| await PocketId.createIdToken({ key: key }); | |||
| } | |||
| PocketId.signIdToken(id_token).then(function (resp) { | |||
| console.log('Response:'); | |||
| console.log(resp); | |||
| }); | |||
| } | |||
| function genTokenWithKey() { | |||
| // TODO: generate token | |||
| // TODO: check if the key is still considered valid | |||
| // TODO: generate new key and authorize | |||
| } | |||
| (async function () { | |||
| var loc = window.location; | |||
| console.log('/new-hashcash?'); | |||
| var resp = await request({ | |||
| method: 'POST', | |||
| url: loc.protocol + '//' + loc.hostname + '/api/new-hashcash' | |||
| }); | |||
| console.log(resp); | |||
| console.log('/test-hashcash?'); | |||
| resp = await request({ | |||
| method: 'POST', | |||
| url: loc.protocol + '//' + loc.hostname + '/api/test-hashcash' | |||
| }); | |||
| console.log(resp); | |||
| })(); | |||
| setFlow('.authn-container', '.authn-email'); | |||
| $('.authn-email form').addEventListener('submit', function (ev) { | |||
| ev.preventDefault(); | |||
| ev.stopPropagation(); | |||
| state.email = $('.authn-email [name=username]').value; | |||
| setFlow('.authn-container', '.authn-loading'); | |||
| return PocketId.auth | |||
| .meta({ email: state.email }) | |||
| .catch(function (err) { | |||
| window.alert('Error: ' + err.message); | |||
| }) | |||
| .then(function (resp) { | |||
| // if the user exists, go to the continue screen | |||
| // otherwise go to the new user screen | |||
| console.log('meta:', resp); | |||
| if (!resp.body.success) { | |||
| // This is a completely new user | |||
| setFlow('.authn-container', '.authn-new-user'); | |||
| return; | |||
| } | |||
| // The user exists, but this is a new device | |||
| setFlow('.authn-container', '.authn-existing'); | |||
| }); | |||
| }); | |||
| function verifyNewDevice() { | |||
| return PocketId.auth | |||
| .verify({ scheme: 'mailto:', email: state.email }) | |||
| .catch(function (err) { | |||
| window.alert('Error: ' + err.message); | |||
| }) | |||
| .then(function (resp) { | |||
| console.log(resp); | |||
| localStorage.setItem( | |||
| 'pocketid', // + state.email, | |||
| JSON.stringify({ | |||
| receipt: resp.body.receipt, | |||
| email: state.email, | |||
| createdAt: new Date().toISOString() | |||
| }) | |||
| ); | |||
| window.alert("Go check yo' email!"); | |||
| return PocketId.auth | |||
| .consume({ | |||
| email: state.email, | |||
| receipt: resp.body.receipt | |||
| }) | |||
| .then(function (resp) { | |||
| // this should have a token we can inspect | |||
| // and return to the calling application. | |||
| console.log(resp); | |||
| window.alert('all set!'); | |||
| }); | |||
| }); | |||
| } | |||
| $('.authn-existing form').addEventListener('submit', function (ev) { | |||
| ev.preventDefault(); | |||
| ev.stopPropagation(); | |||
| setFlow('.authn-container', '.authn-loading'); | |||
| verifyNewDevice(); | |||
| }); | |||
| $('.authn-new-user form').addEventListener('submit', function (ev) { | |||
| ev.preventDefault(); | |||
| ev.stopPropagation(); | |||
| // We don't need to worry about checking if the key exists | |||
| // even if it does, the account has been deactivated | |||
| setFlow('.authn-container', '.authn-loading'); | |||
| verifyNewDevice(); | |||
| }); | |||
| var route = window.location.hash.split('/').slice(1); | |||
| console.log('route:', route); | |||
| switch (route[0]) { | |||
| case 'verify': | |||
| var pstate = JSON.parse(localStorage.getItem('pocketid') || '{}'); | |||
| PocketId.auth | |||
| .consume({ | |||
| receipt: pstate.receipt, | |||
| secret: route[1] | |||
| }) | |||
| .then(function (resp) { | |||
| console.log('token for this device to save:', resp); | |||
| window.alert('goodness!'); | |||
| }) | |||
| .catch(function (e) { | |||
| console.error(e); | |||
| window.alert('network error, try again'); | |||
| }); | |||
| break; | |||
| default: | |||
| // do nothing | |||
| } | |||
| require('./pocket/consumer.js'); | |||
+ 0
- 118
public/pocketid.js
View File
| @ -1,118 +0,0 @@ | |||
| 'use strict'; | |||
| var Keypairs = require('@root/keypairs'); | |||
| var PocketId = module.exports; | |||
| var request = require('./request.js'); | |||
| var keyJson = window.localStorage.getItem('private.jwk.json'); | |||
| PocketId.signIdToken = async function (idToken) { | |||
| var pair = await Keypairs.parseOrGenerate({ key: keyJson }); | |||
| var jwt = await Keypairs.signJwt({ | |||
| jwk: pair.private, | |||
| iss: window.location.protocol + '//' + window.location.hostname, | |||
| exp: '15m', | |||
| claims: { | |||
| contact: ['google:' + idToken] | |||
| } | |||
| }); | |||
| return jwt; | |||
| }; | |||
| PocketId.auth = {}; | |||
| PocketId.auth.meta = async function ({ email }) { | |||
| var loc = window.location; | |||
| var body = await request({ | |||
| method: 'GET', | |||
| url: | |||
| loc.protocol + | |||
| '//' + | |||
| loc.hostname + | |||
| '/api/authn/meta?contact=' + | |||
| 'mailto:' + | |||
| }); | |||
| return body; | |||
| }; | |||
| PocketId.auth.verify = async function ({ scheme, email }) { | |||
| if (!scheme) { | |||
| scheme = 'mailto:'; | |||
| } | |||
| var loc = window.location; | |||
| var body = await request({ | |||
| method: 'GET', | |||
| url: | |||
| loc.protocol + | |||
| '//' + | |||
| loc.hostname + | |||
| '/api/authn/verify?contact=' + | |||
| scheme + | |||
| }); | |||
| return body; | |||
| }; | |||
| PocketId.auth.consume = async function ({ | |||
| email = '', | |||
| receipt = '', | |||
| secret = '', | |||
| count = 0 | |||
| }) { | |||
| var loc = window.location; | |||
| var resp = await request({ | |||
| method: 'GET', | |||
| url: | |||
| loc.protocol + | |||
| '//' + | |||
| loc.hostname + | |||
| '/api/authn/consume?contact=' + | |||
| (email ? 'mailto:' + email : '') + | |||
| '&receipt=' + | |||
| receipt + | |||
| '&secret=' + | |||
| secret | |||
| }); | |||
| if (resp.body.success) { | |||
| // There should be a token here | |||
| // (or the pubkey should have been given beforehand) | |||
| return resp.body; | |||
| } | |||
| if (resp.body.error) { | |||
| // TODO special errors are hard failures | |||
| } | |||
| if (count > 600) { | |||
| throw new Error('abandoned login'); | |||
| } | |||
| return timeout(5000).then(function () { | |||
| console.log('check otp again'); | |||
| return PocketId.auth.consume({ | |||
| email, | |||
| secret, | |||
| receipt, | |||
| count: count || 0 | |||
| }); | |||
| }); | |||
| }; | |||
| async function timeout(ms) { | |||
| return new Promise(function (resolve) { | |||
| setTimeout(resolve, ms); | |||
| }); | |||
| } | |||
| var textEncoder = new TextEncoder(); | |||
| PocketId.genKey = async function ({ email }) { | |||
| // Ideally we'd use PBKDF2 or better but... web standards... | |||
| // TODO put a random salt | |||
| var emailU8 = textEncoder.encode(email); | |||
| var salt = await crypto.subtle.digest('SHA-256', emailU8); | |||
| var u8 = textEncoder.encode(answer); | |||
| var hash = await crypto.subtle.digest('SHA-256', u8); | |||
| }; | |||
+ 0
- 85
public/request.js
View File
| @ -1,85 +0,0 @@ | |||
| 'use strict'; | |||
| var Hashcash = require('./hashcash.js'); | |||
| var _sites = {}; | |||
| module.exports = async function (opts) { | |||
| if (!opts.headers) { | |||
| opts.headers = {}; | |||
| } | |||
| if (opts.json) { | |||
| if (true === opts.json) { | |||
| opts.body = JSON.stringify(opts.body); | |||
| } else { | |||
| opts.body = JSON.stringify(opts.json); | |||
| } | |||
| if (!opts.headers['Content-Type'] && !opts.headers['content-type']) { | |||
| opts.headers['Content-Type'] = 'application/json'; | |||
| } | |||
| } | |||
| if (!opts.mode) { | |||
| opts.mode = 'cors'; | |||
| } | |||
| var url = new URL(opts.url); | |||
| if (!_sites[url.hostname]) { | |||
| _sites[url.hostname] = { nonces: [] }; | |||
| } | |||
| var site = _sites[url.hostname]; | |||
| var hc = site.hashcashChallenge; | |||
| if (hc) { | |||
| delete site.hashcashChallenge; | |||
| site.hashcash = await Hashcash.solve(hc); | |||
| } | |||
| if (site.hashcash) { | |||
| opts.headers.Hashcash = site.hashcash; | |||
| } | |||
| var response = await window.fetch(opts.url, opts); | |||
| var headerNames = response.headers.keys(); | |||
| var hs = {}; | |||
| var h; | |||
| while (true) { | |||
| h = headerNames.next(); | |||
| if (h.done) { | |||
| break; | |||
| } | |||
| hs[h.value] = response.headers.get(h.value); | |||
| } | |||
| var body; | |||
| if (hs['content-type'].includes('application/json')) { | |||
| body = await response.json(); | |||
| } else { | |||
| body = await response.text(); | |||
| try { | |||
| body = JSON.parse(body); | |||
| } catch (e) { | |||
| // ignore | |||
| } | |||
| } | |||
| var resp = {}; | |||
| resp.body = body; | |||
| resp.headers = hs; | |||
| resp.toJSON = function () { | |||
| return { | |||
| headers: hs, | |||
| body: body | |||
| }; | |||
| }; | |||
| if (resp.headers['hashcash-challenge']) { | |||
| _sites[url.hostname].hashcashChallenge = | |||
| resp.headers['hashcash-challenge']; | |||
| } | |||
| if (resp.headers.nonce) { | |||
| site.nonces.push(resp.headers.nonce); | |||
| } | |||
| console.log(resp); | |||
| return resp; | |||
| }; | |||