From 84e1863da26f1ef8db7a27652f08f7a35429215a Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Thu, 17 Sep 2020 07:28:55 +0000 Subject: [PATCH] update errors and iframe --- mockid/route.go | 87 ++++++++++++++---- public/hashcash.js | 79 ----------------- public/main.js | 213 +-------------------------------------------- public/pocketid.js | 118 ------------------------- public/request.js | 85 ------------------ 5 files changed, 72 insertions(+), 510 deletions(-) delete mode 100644 public/hashcash.js delete mode 100644 public/pocketid.js delete mode 100644 public/request.js diff --git a/mockid/route.go b/mockid/route.go index 09b5cb1..5c7536e 100644 --- a/mockid/route.go +++ b/mockid/route.go @@ -11,6 +11,7 @@ import ( "fmt" "io/ioutil" "log" + "net" "net/http" "os" "path/filepath" @@ -28,8 +29,30 @@ import ( ua "github.com/mileusna/useragent" ) +var errTokenNotVerified = apiError{"token has not been verified"} +var errUsedToken = apiError{"token has already been used"} +var errInvalidEmail = apiError{"invalid email address"} + +// API Errors +type serverError struct { + error string +} + +func (e serverError) Error() string { + return e.error +} + +type apiError struct { + error string +} + +func (e apiError) Error() string { + return e.error +} + type HTTPResponse struct { - Error string `json:"error"` + Error string `json:"error,omitempty"` + Code string `json:"code,omitempty"` Success bool `json:"success"` } @@ -135,13 +158,22 @@ func Route(jwksPrefix string, privkey keypairs.PrivateKey) http.Handler { return } + contact, err = lintEmail(contact) + if nil != err { + b, _ := json.Marshal(&HTTPResponse{ + Error: err.Error(), + Code: "E_USER", + }) + w.Write(b) + return + } + _, ok, err := contactKV.Load(contact) if nil != err { fmt.Fprintf(os.Stderr, "meta: error loading contact: %s\n", err.Error()) http.Error(w, "Internal Server Error", http.StatusInternalServerError) return } - if ok { b, _ := json.Marshal(&HTTPResponse{ Success: true, @@ -152,6 +184,7 @@ func Route(jwksPrefix string, privkey keypairs.PrivateKey) http.Handler { b, _ := json.Marshal(&HTTPResponse{ Error: "not found", + Code: "E_USER", }) w.Write(b) }) @@ -217,6 +250,13 @@ func Route(jwksPrefix string, privkey keypairs.PrivateKey) http.Handler { otp, err = consumeOTPReceipt("TODO", receipt, agent, addr) } if nil != err { + if errTokenNotVerified == err { + b, _ := json.Marshal(&HTTPResponse{ + Error: err.Error(), + }) + w.Write(b) + return + } // TODO propagate error types http.Error(w, "Bad Request", http.StatusBadRequest) fmt.Fprintf(w, "%s", err) @@ -821,7 +861,7 @@ func newOTP(email string, agent string, addr string) (id string, secret []byte, // keep it secret, keep it safe os.FileMode(0600), ); nil != err { - return "", nil, errors.New("database connection failed when writing verification token") + return "", nil, serverError{"database connection failed when writing verification token"} } return receipt, secret, nil } @@ -847,12 +887,12 @@ func checkOTP(hash, email, agent, addr string, consume otpConsumer) (*OTP, error tokfile := filepath.Join(tokenPrefix, hash+".tok.txt") b, err := ioutil.ReadFile(tokfile) if nil != err { - return nil, errors.New("database connection failed when reading verification token") + return nil, serverError{"database connection failed when reading verification token"} } otp := OTP{} if err := json.Unmarshal(b, &otp); nil != err { - return nil, errors.New("database verification token parse failed") + return nil, serverError{"database verification token parse failed"} } if 0 == subtle.ConstantTimeCompare([]byte(otp.Email), []byte(email)) { @@ -862,7 +902,7 @@ func checkOTP(hash, email, agent, addr string, consume otpConsumer) (*OTP, error if consume.secret { if !otp.SecretUsed.IsZero() { - return nil, errors.New("token has already been used") + return nil, errUsedToken } otp.SecretUsed = time.Now() if addr != otp.ReceiptIP { @@ -874,10 +914,10 @@ func checkOTP(hash, email, agent, addr string, consume otpConsumer) (*OTP, error } } else if consume.receipt { if otp.SecretUsed.IsZero() { - return nil, errors.New("token has not been verified") + return nil, errTokenNotVerified } if !otp.ReceiptUsed.IsZero() { - return nil, errors.New("token has already been used") + return nil, errUsedToken } otp.ReceiptUsed = time.Now() } @@ -890,24 +930,38 @@ func checkOTP(hash, email, agent, addr string, consume otpConsumer) (*OTP, error // keep it secret, keep it safe os.FileMode(0600), ); nil != err { - return nil, errors.New("database connection failed when consuming token") + return nil, serverError{"database connection failed when consuming token"} } } - fmt.Println("THE TOKEN IS GOOD. GOOD!!") - return &otp, nil } +func lintEmail(email string) (string, error) { + // TODO check DNS for MX records + parts := strings.Split(email, "@") + domain := parts[1] + if 2 != len(parts) || strings.Contains(email, " \t\n") { + return "", errInvalidEmail + } + mxs, err := net.LookupMX(domain) + if len(mxs) < 1 || nil != err { + // TODO it possible in some cases that this + // could be a network error + return "", errInvalidEmail + } + return strings.ToLower(email), nil +} + func startVerification(baseURL, contact, agent, addr string) (receipt string, err error) { email := strings.Replace(strings.TrimPrefix(contact, "mailto:"), " ", "+", -1) if "" == email { return "", errors.New("missing contact:[\"mailto:me@example.com\"]") } - // TODO check DNS for MX records - if !strings.Contains(email, "@") || strings.Contains(email, " \t\n") { - return "", errors.New("invalid email address") + email, err = lintEmail(email) + if nil != err { + return "", err } // TODO expect JWK in JWS/JWT @@ -922,9 +976,10 @@ func startVerification(baseURL, contact, agent, addr string) (receipt string, er subject := "Verify New Account" // TODO go tpl // TODO determine OS and Browser from user agent + page := "pocket/iframe.html" text := fmt.Sprintf( - "It looks like you just tried to register a new Pocket ID account.\n\n Verify account: %s#/verify/%s\n\n%s on %s %s from %s\n\nNot you? Just ignore this message.", - baseURL, base64.RawURLEncoding.EncodeToString(secret), ua.Name, ua.OS, ua.Device, addr, + "It looks like you just tried to register a new Pocket ID account.\n\n Verify account: %s/%s#/verify/%s\n\n%s on %s %s from %s\n\nNot you? Just ignore this message.", + baseURL, page, base64.RawURLEncoding.EncodeToString(secret), ua.Name, ua.OS, ua.Device, addr, ) fmt.Println("email:", text) if !strings.Contains(contact, "+noreply") { diff --git a/public/hashcash.js b/public/hashcash.js deleted file mode 100644 index 751cd48..0000000 --- a/public/hashcash.js +++ /dev/null @@ -1,79 +0,0 @@ -'use strict'; -/*global crypto*/ - -var Hashcash = module.exports; - -var textEncoder = new TextEncoder(); -Hashcash.solve = async function solveHc(hc) { - var solution = 0; - var parts = hc.split(':').slice(0, 6); - if (parts.length < 6) { - throw new Error('invalid Hashcash-Challenge: ' + hc); - } - - var bits = parseInt(parts[1], 10) || -1; - if (bits > 10 || bits < 0) { - throw new Error('bad bit values'); - } - console.log('bits:', bits); - hc = parts.join(':') + ':'; - async function next() { - var answer = hc + int52ToBase64(solution); - var u8 = textEncoder.encode(answer); - // REALLY SLOW due to async tasks and C++ context switch - var hash = await crypto.subtle.digest('SHA-256', u8); - hash = new Uint8Array(hash); - if (checkHc(hash, bits)) { - return answer; - } - solution += 1; - return next(); - } - - return next(); -}; - -function int52ToBase64(n) { - var hex = n.toString(16); - if (hex.length % 2) { - hex = '0' + hex; - } - - var bin = []; - var i = 0; - var d; - var b; - while (i < hex.length) { - d = parseInt(hex.slice(i, i + 2), 16); - b = String.fromCharCode(d); - bin.push(b); - i += 2; - } - - return btoa(bin.join('')).replace(/=/g, ''); -} - -function checkHc(hash, bits) { - var n = Math.floor(bits / 8); - var m = bits % 8; - var i; - if (m > 0) { - n += 1; - } - - for (i = 0; i < n && i < hash.length; i += 1) { - if (bits > 8) { - bits -= 8; - if (0 !== hash[i]) { - return false; - } - continue; - } - - if (0 !== hash[i] >> (8 - bits)) { - return false; - } - - return true; - } -} diff --git a/public/main.js b/public/main.js index c2afdde..b072671 100644 --- a/public/main.js +++ b/public/main.js @@ -1,214 +1,3 @@ 'use strict'; -var request = require('./request.js'); -var PocketId = require('./pocketid.js'); -var state = {}; -var auths = clearAuths(); - -function $$(sel, el) { - if (el) { - return el.querySelectorAll(sel) || []; - } - return document.body.querySelectorAll(sel) || []; -} - -function $(sel, el) { - if (el) { - return el.querySelector(sel); - } - return document.body.querySelector(sel); -} - -function clearAuths() { - var _auths = { - google: { - promise: null, - idToken: '' - } - }; - _auths.google.promise = new Promise(function (res, rej) { - _auths.google.resolve = res; - _auths.google.reject = rej; - }); - return _auths; -} - -window.onSignIn = async function onSignIn(googleUser) { - // Useful data for your client-side scripts: - var profile = googleUser.getBasicProfile(); - // Don't send this directly to your server! - console.log('ID: ' + profile.getId()); - console.log('Full Name: ' + profile.getName()); - console.log('Given Name: ' + profile.getGivenName()); - console.log('Family Name: ' + profile.getFamilyName()); - console.log('Image URL: ' + profile.getImageUrl()); - console.log('Email: ' + profile.getEmail()); - - // The ID token you need to pass to your backend: - auths.google.idToken = googleUser.getAuthResponse().id_token; - console.log('ID Token: ' + auths.google.idToken); - auths.google.resolve(auths.google.idToken); -}; - -function setFlow(cont, flow) { - $$(cont).forEach(function (el) { - el.hidden = true; - }); - console.log(flow); - $(flow).hidden = false; -} - -async function unlock() { - var key; - try { - key = await PocketId.unlock(function () { - setFlow('.authn-container', '.authn-unlock'); - return new Promise(function (resolve, reject) { - window.unlocker = { resolve: resolve, reject: reject }; - }); - }); - } catch (e) { - console.error( - "Had a key, but couldn't unlock it. TODO: Just send email?" - ); - console.error(e); - return; - } - - setFlow('.authn-container', '.authn-loading'); - - if (key) { - genTokenWithKey(key); - return; - await PocketId.createIdToken({ key: key }); - } - - PocketId.signIdToken(id_token).then(function (resp) { - console.log('Response:'); - console.log(resp); - }); -} - -function genTokenWithKey() { - // TODO: generate token - // TODO: check if the key is still considered valid - // TODO: generate new key and authorize -} - -(async function () { - var loc = window.location; - - console.log('/new-hashcash?'); - var resp = await request({ - method: 'POST', - url: loc.protocol + '//' + loc.hostname + '/api/new-hashcash' - }); - console.log(resp); - - console.log('/test-hashcash?'); - resp = await request({ - method: 'POST', - url: loc.protocol + '//' + loc.hostname + '/api/test-hashcash' - }); - console.log(resp); -})(); - -setFlow('.authn-container', '.authn-email'); - -$('.authn-email form').addEventListener('submit', function (ev) { - ev.preventDefault(); - ev.stopPropagation(); - state.email = $('.authn-email [name=username]').value; - - setFlow('.authn-container', '.authn-loading'); - return PocketId.auth - .meta({ email: state.email }) - .catch(function (err) { - window.alert('Error: ' + err.message); - }) - .then(function (resp) { - // if the user exists, go to the continue screen - // otherwise go to the new user screen - console.log('meta:', resp); - if (!resp.body.success) { - // This is a completely new user - setFlow('.authn-container', '.authn-new-user'); - return; - } - // The user exists, but this is a new device - setFlow('.authn-container', '.authn-existing'); - }); -}); - -function verifyNewDevice() { - return PocketId.auth - .verify({ scheme: 'mailto:', email: state.email }) - .catch(function (err) { - window.alert('Error: ' + err.message); - }) - .then(function (resp) { - console.log(resp); - localStorage.setItem( - 'pocketid', // + state.email, - JSON.stringify({ - receipt: resp.body.receipt, - email: state.email, - createdAt: new Date().toISOString() - }) - ); - window.alert("Go check yo' email!"); - return PocketId.auth - .consume({ - email: state.email, - receipt: resp.body.receipt - }) - .then(function (resp) { - // this should have a token we can inspect - // and return to the calling application. - console.log(resp); - window.alert('all set!'); - }); - }); -} - -$('.authn-existing form').addEventListener('submit', function (ev) { - ev.preventDefault(); - ev.stopPropagation(); - - setFlow('.authn-container', '.authn-loading'); - verifyNewDevice(); -}); - -$('.authn-new-user form').addEventListener('submit', function (ev) { - ev.preventDefault(); - ev.stopPropagation(); - - // We don't need to worry about checking if the key exists - // even if it does, the account has been deactivated - - setFlow('.authn-container', '.authn-loading'); - verifyNewDevice(); -}); - -var route = window.location.hash.split('/').slice(1); -console.log('route:', route); -switch (route[0]) { - case 'verify': - var pstate = JSON.parse(localStorage.getItem('pocketid') || '{}'); - PocketId.auth - .consume({ - receipt: pstate.receipt, - secret: route[1] - }) - .then(function (resp) { - console.log('token for this device to save:', resp); - window.alert('goodness!'); - }) - .catch(function (e) { - console.error(e); - window.alert('network error, try again'); - }); - break; - default: - // do nothing -} +require('./pocket/consumer.js'); diff --git a/public/pocketid.js b/public/pocketid.js deleted file mode 100644 index 7b54dde..0000000 --- a/public/pocketid.js +++ /dev/null @@ -1,118 +0,0 @@ -'use strict'; - -var Keypairs = require('@root/keypairs'); -var PocketId = module.exports; -var request = require('./request.js'); - -var keyJson = window.localStorage.getItem('private.jwk.json'); - -PocketId.signIdToken = async function (idToken) { - var pair = await Keypairs.parseOrGenerate({ key: keyJson }); - var jwt = await Keypairs.signJwt({ - jwk: pair.private, - iss: window.location.protocol + '//' + window.location.hostname, - exp: '15m', - claims: { - contact: ['google:' + idToken] - } - }); - return jwt; -}; - -PocketId.auth = {}; -PocketId.auth.meta = async function ({ email }) { - var loc = window.location; - var body = await request({ - method: 'GET', - url: - loc.protocol + - '//' + - loc.hostname + - '/api/authn/meta?contact=' + - 'mailto:' + - email - }); - return body; -}; - -PocketId.auth.verify = async function ({ scheme, email }) { - if (!scheme) { - scheme = 'mailto:'; - } - - var loc = window.location; - var body = await request({ - method: 'GET', - url: - loc.protocol + - '//' + - loc.hostname + - '/api/authn/verify?contact=' + - scheme + - email - }); - - return body; -}; - -PocketId.auth.consume = async function ({ - email = '', - receipt = '', - secret = '', - count = 0 -}) { - var loc = window.location; - var resp = await request({ - method: 'GET', - url: - loc.protocol + - '//' + - loc.hostname + - '/api/authn/consume?contact=' + - (email ? 'mailto:' + email : '') + - '&receipt=' + - receipt + - '&secret=' + - secret - }); - - if (resp.body.success) { - // There should be a token here - // (or the pubkey should have been given beforehand) - return resp.body; - } - - if (resp.body.error) { - // TODO special errors are hard failures - } - - if (count > 600) { - throw new Error('abandoned login'); - } - - return timeout(5000).then(function () { - console.log('check otp again'); - return PocketId.auth.consume({ - email, - secret, - receipt, - count: count || 0 - }); - }); -}; - -async function timeout(ms) { - return new Promise(function (resolve) { - setTimeout(resolve, ms); - }); -} - -var textEncoder = new TextEncoder(); -PocketId.genKey = async function ({ email }) { - // Ideally we'd use PBKDF2 or better but... web standards... - // TODO put a random salt - var emailU8 = textEncoder.encode(email); - var salt = await crypto.subtle.digest('SHA-256', emailU8); - var u8 = textEncoder.encode(answer); - var hash = await crypto.subtle.digest('SHA-256', u8); -}; diff --git a/public/request.js b/public/request.js deleted file mode 100644 index c9a23d5..0000000 --- a/public/request.js +++ /dev/null @@ -1,85 +0,0 @@ -'use strict'; - -var Hashcash = require('./hashcash.js'); -var _sites = {}; - -module.exports = async function (opts) { - if (!opts.headers) { - opts.headers = {}; - } - - if (opts.json) { - if (true === opts.json) { - opts.body = JSON.stringify(opts.body); - } else { - opts.body = JSON.stringify(opts.json); - } - if (!opts.headers['Content-Type'] && !opts.headers['content-type']) { - opts.headers['Content-Type'] = 'application/json'; - } - } - - if (!opts.mode) { - opts.mode = 'cors'; - } - - var url = new URL(opts.url); - if (!_sites[url.hostname]) { - _sites[url.hostname] = { nonces: [] }; - } - - var site = _sites[url.hostname]; - var hc = site.hashcashChallenge; - if (hc) { - delete site.hashcashChallenge; - site.hashcash = await Hashcash.solve(hc); - } - if (site.hashcash) { - opts.headers.Hashcash = site.hashcash; - } - - var response = await window.fetch(opts.url, opts); - var headerNames = response.headers.keys(); - var hs = {}; - var h; - while (true) { - h = headerNames.next(); - if (h.done) { - break; - } - hs[h.value] = response.headers.get(h.value); - } - - var body; - if (hs['content-type'].includes('application/json')) { - body = await response.json(); - } else { - body = await response.text(); - try { - body = JSON.parse(body); - } catch (e) { - // ignore - } - } - var resp = {}; - - resp.body = body; - resp.headers = hs; - resp.toJSON = function () { - return { - headers: hs, - body: body - }; - }; - - if (resp.headers['hashcash-challenge']) { - _sites[url.hostname].hashcashChallenge = - resp.headers['hashcash-challenge']; - } - if (resp.headers.nonce) { - site.nonces.push(resp.headers.nonce); - } - - console.log(resp); - return resp; -};