vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Blame · forge/identity/passkey.go

Line attribution on main · 701 line(s)

View file History

6c84d387 Keenan Nemetz 16d ago	1	package identity
	2
	3	// Passkeys and enrollment invites.
	4	//
	5	// A passkey is the browser counterpart of an SSH key: the authenticator holds
	6	// the private half, Vole stores the public half, and a successful assertion
62576fa8 Keenan Nemetz 14d ago	7	// resolves to the same account name the SSH handshake produces. An account
6c84d387 Keenan Nemetz 16d ago	8	// created without an SSH key starts with an invite instead; the invite is a
	9	// one-time bearer secret, stored only as a hash, that lets the account holder
	10	// register their first passkey.
	11	//
	12	// Invites are deliberately short-lived and single-use. Losing every passkey is
	13	// recovered by an administrator issuing another invite out of band, not by an
	14	// email reset flow.
	15
	16	import (
	17	"crypto/rand"
	18	"crypto/sha256"
	19	"database/sql"
	20	"encoding/base64"
	21	"encoding/hex"
	22	"encoding/json"
	23	"errors"
	24	"fmt"
	25	"sort"
	26	"strings"
	27	"time"
5b814e99 Keenan Nemetz 14d ago	28
d37d301f Keenan Nemetz 21h ago	29	"rodent.software/vole/forge/access"
6c84d387 Keenan Nemetz 16d ago	30	)
	31
	32	const (
	33	// DefaultInviteTTL is how long an enrollment link stays usable. Long enough
	34	// for an administrator to hand it over; short enough that a leaked link is
	35	// not an indefinite key to the account.
	36	DefaultInviteTTL = 72 * time.Hour
	37
	38	inviteTokenBytes = 32
25343521 Keenan Nemetz 3d ago	39
	40	// MaxCredentialLabel bounds the name a person gives a passkey. The label is
	41	// shown on the account page and stored beside the credential, so it is a
	42	// label, not prose.
	43	MaxCredentialLabel = 128
	44
	45	// Credential fields come from the authenticator and a client, so each is
	46	// bounded before it reaches a ceremony or the roster. A value that is not a
	47	// passkey shape is refused rather than stored at whatever size the client
	48	// chose.
	49	maxCredentialTransports = 16
	50	maxCredentialTransport = 32
	51	maxCredentialAttachment = 32
	52	maxCredentialAttestation = 64
6c84d387 Keenan Nemetz 16d ago	53	)
	54
	55	var (
	56	// ErrInviteInvalid covers missing, expired, used and superseded invites. It
	57	// is deliberately one error so a page cannot be used to probe which links
	58	// once existed.
	59	ErrInviteInvalid = errors.New("identity: invite is invalid or expired")
	60	// ErrCredentialNotFound covers unknown and retired-account credentials.
	61	ErrCredentialNotFound = errors.New("identity: no such passkey")
	62	)
	63
	64	// Credential is the public half of a passkey. The field names follow the
	65	// WebAuthn credential shape so the server's ceremony code can convert without a
	66	// second vocabulary.
	67	type Credential struct {
	68	ID []byte
	69	PublicKey []byte
	70	AttestationType string
	71	Transport []string
	72	Flags CredentialFlags
	73	Authenticator Authenticator
	74	Label string
	75	Created time.Time
	76	LastUsed time.Time
	77	}
	78
	79	type CredentialFlags struct {
	80	UserPresent bool
	81	UserVerified bool
	82	BackupEligible bool
	83	BackupState bool
	84	}
	85
	86	type Authenticator struct {
	87	AAGUID []byte
	88	SignCount uint32
	89	CloneWarning bool
	90	Attachment string
	91	}
	92
	93	// Invite is returned once, when it is created. The Token is the plaintext part
	94	// of the enrollment URL; the database only has its hash.
	95	type Invite struct {
	96	Token string
	97	Expires time.Time
	98	}
	99
f920a9f1 Keenan Nemetz 16d ago	100	// CreatePasskey creates a self-registered account and its first passkey in one
62576fa8 Keenan Nemetz 14d ago	101	// transaction. The name is fixed when the ceremony begins; the row is only
	102	// written when the authenticator has actually produced a credential, so an
	103	// abandoned registration reserves no name.
	104	func (s Store) CreatePasskey(name string, cred Credential, actor string) (Account, error) {
5b814e99 Keenan Nemetz 14d ago	105	return s.CreatePasskeyWithRole(name, access.None, cred, actor)
	106	}
	107
	108	// CreatePasskeyWithRole is self-registration with an instance-wide role. The
	109	// role is chosen by instance policy, never by the person registering.
	110	func (s Store) CreatePasskeyWithRole(name string, role access.Role, cred Credential, actor string) (Account, error) {
f920a9f1 Keenan Nemetz 16d ago	111	if err := ValidateName(name); err != nil {
	112	return nil, err
	113	}
	114	if err := validateCredential(cred); err != nil {
	115	return nil, err
	116	}
	117	now := time.Now().UTC()
5b814e99 Keenan Nemetz 14d ago	118	err := s.mutate("identity.create", actor, name, name+" passkey role="+role.String(), func(tx *sql.Tx) error {
29a795b9 Keenan Nemetz 7d ago	119	// A passkey is a browser credential, and a bot has no browser sign-in.
29a795b9 Keenan Nemetz 7d ago	120	if err := createAccount(tx, name, KindPerson, role, now, nil, nil); err != nil {
f920a9f1 Keenan Nemetz 16d ago	121	return err
f920a9f1 Keenan Nemetz 16d ago	122	}
62576fa8 Keenan Nemetz 14d ago	123	return insertCredential(tx, name, cred, now)
f920a9f1 Keenan Nemetz 16d ago	124	})
	125	if err != nil {
	126	return nil, err
	127	}
62576fa8 Keenan Nemetz 14d ago	128	return s.Find(name)
f920a9f1 Keenan Nemetz 16d ago	129	}
f920a9f1 Keenan Nemetz 16d ago	130
6c84d387 Keenan Nemetz 16d ago	131	// CreateWithInvite creates an account with no SSH key and an enrollment invite
	132	// in the same transaction. This is how a browser-only account — somebody who
	133	// files issues but does not push — comes into existence.
62576fa8 Keenan Nemetz 14d ago	134	func (s Store) CreateWithInvite(name, actor string, ttl time.Duration) (Account, *Invite, error) {
5b814e99 Keenan Nemetz 14d ago	135	return s.CreateWithInviteRole(name, access.None, actor, ttl)
	136	}
	137
	138	// CreateWithInviteRole creates an account with an instance-wide role and an
	139	// enrollment invite in the same transaction. This is how an invited
	140	// contributor comes into existence without being added to every repository.
	141	func (s Store) CreateWithInviteRole(name string, role access.Role, actor string, ttl time.Duration) (Account, *Invite, error) {
6c84d387 Keenan Nemetz 16d ago	142	if err := ValidateName(name); err != nil {
	143	return nil, nil, err
	144	}
	145	now := time.Now().UTC()
	146	token, tokenHash, err := newInviteToken()
	147	if err != nil {
	148	return nil, nil, err
	149	}
	150	inv := &Invite{Token: token, Expires: now.Add(inviteTTL(ttl))}
	151	pending := &pendingInvite{tokenHash: tokenHash, expires: inv.Expires, createdBy: actor}
5b814e99 Keenan Nemetz 14d ago	152	err = s.mutate("identity.create", actor, name, name+" invite role="+role.String(), func(tx *sql.Tx) error {
29a795b9 Keenan Nemetz 7d ago	153	return createAccount(tx, name, KindPerson, role, now, nil, pending)
6c84d387 Keenan Nemetz 16d ago	154	})
	155	if err != nil {
	156	return nil, nil, err
	157	}
62576fa8 Keenan Nemetz 14d ago	158	a, err := s.Find(name)
6c84d387 Keenan Nemetz 16d ago	159	if err != nil {
	160	return nil, nil, err
	161	}
	162	return a, inv, nil
	163	}
	164
	165	// Invite issues a fresh enrollment link for an existing account and supersedes
	166	// any unused link that came before it.
62576fa8 Keenan Nemetz 14d ago	167	func (s Store) Invite(name, actor string, ttl time.Duration) (Invite, error) {
6c84d387 Keenan Nemetz 16d ago	168	now := time.Now().UTC()
	169	token, tokenHash, err := newInviteToken()
	170	if err != nil {
	171	return nil, err
	172	}
	173	inv := &Invite{Token: token, Expires: now.Add(inviteTTL(ttl))}
	174	pending := &pendingInvite{tokenHash: tokenHash, expires: inv.Expires, createdBy: actor}
62576fa8 Keenan Nemetz 14d ago	175	err = s.mutate("identity.invite", actor, name, "expires "+inv.Expires.Format(time.RFC3339), func(tx *sql.Tx) error {
62576fa8 Keenan Nemetz 14d ago	176	a, err := findTx(tx, name)
6c84d387 Keenan Nemetz 16d ago	177	if err != nil {
	178	return err
	179	}
	180	if !a.Active() {
	181	return fmt.Errorf("identity: %s is retired", a.Name)
	182	}
29a795b9 Keenan Nemetz 7d ago	183	// A bot has no browser sign-in, so an enrollment link would be a credential
	184	// nobody can use and a secret in the roster for no reason.
	185	if a.Bot() {
	186	return fmt.Errorf("identity: %s is a bot account; it signs in with a key, not a browser", a.Name)
	187	}
6c84d387 Keenan Nemetz 16d ago	188	// One live link per account. Marking the old ones used rather than
6c84d387 Keenan Nemetz 16d ago	189	// deleting them leaves an audit trail without leaving a usable secret.
62576fa8 Keenan Nemetz 14d ago	190	if _, err := tx.Exec(`UPDATE user_invites SET used_at=? WHERE user_name=? AND used_at IS NULL`, now.Unix(), a.Name); err != nil {
6c84d387 Keenan Nemetz 16d ago	191	return fmt.Errorf("identity: replace invite: %w", err)
6c84d387 Keenan Nemetz 16d ago	192	}
62576fa8 Keenan Nemetz 14d ago	193	return insertInvite(tx, a.Name, pending, now)
6c84d387 Keenan Nemetz 16d ago	194	})
	195	if err != nil {
	196	return nil, err
	197	}
	198	return inv, nil
	199	}
	200
	201	// InviteAccount validates an enrollment token without consuming it. The invite
	202	// page uses this to show whose account is being claimed; nothing is changed
	203	// until the passkey ceremony succeeds.
	204	func (s Store) InviteAccount(token string) (Account, error) {
	205	token = strings.TrimSpace(token)
	206	if token == "" {
	207	return nil, ErrInviteInvalid
	208	}
	209	var a Account
	210	var created int64
	211	err := s.db.QueryRow(`
62576fa8 Keenan Nemetz 14d ago	212	SELECT u.name, u.status, u.created
62576fa8 Keenan Nemetz 14d ago	213	FROM user_invites i JOIN users u ON u.name = i.user_name
6c84d387 Keenan Nemetz 16d ago	214	WHERE i.token_hash = ? AND i.used_at IS NULL AND i.expires > ? AND u.status = 'active'`,
6c84d387 Keenan Nemetz 16d ago	215	hashToken(token), time.Now().UTC().Unix()).
62576fa8 Keenan Nemetz 14d ago	216	Scan(&a.Name, &a.Status, &created)
6c84d387 Keenan Nemetz 16d ago	217	if errors.Is(err, sql.ErrNoRows) {
	218	return nil, ErrInviteInvalid
	219	}
	220	if err != nil {
	221	return nil, fmt.Errorf("identity: read invite: %w", err)
	222	}
	223	a.Created = time.Unix(created, 0).UTC()
	224	return &a, nil
	225	}
	226
	227	// AcceptInvite consumes an enrollment token and attaches the first passkey. The
	228	// conditional update and the credential insert are one transaction, so two
	229	// browsers racing on the same link cannot both claim the account.
	230	func (s Store) AcceptInvite(token string, cred Credential, actor string) (Account, error) {
	231	if err := validateCredential(cred); err != nil {
	232	return nil, err
	233	}
	234	// Resolve once for the audit line; the transaction checks everything again.
	235	account, err := s.InviteAccount(token)
	236	if err != nil {
	237	return nil, err
	238	}
29a795b9 Keenan Nemetz 7d ago	239	if account.Bot() {
	240	// No link should exist for a bot; refuse rather than spend one if one does.
	241	return nil, fmt.Errorf("identity: %s is a bot account; it signs in with a key, not a browser", account.Name)
	242	}
6c84d387 Keenan Nemetz 16d ago	243	token = strings.TrimSpace(token)
6c84d387 Keenan Nemetz 16d ago	244	now := time.Now().UTC()
62576fa8 Keenan Nemetz 14d ago	245	accountName := account.Name
	246	err = s.mutate("identity.credential-add", actor, accountName, "invite", func(tx *sql.Tx) error {
	247	var userName string
6c84d387 Keenan Nemetz 16d ago	248	var expires int64
	249	var used sql.NullInt64
	250	err := tx.QueryRow(`
62576fa8 Keenan Nemetz 14d ago	251	SELECT i.user_name, i.expires, i.used_at
62576fa8 Keenan Nemetz 14d ago	252	FROM user_invites i JOIN users u ON u.name = i.user_name
6c84d387 Keenan Nemetz 16d ago	253	WHERE i.token_hash = ? AND u.status = 'active'`, hashToken(token)).
62576fa8 Keenan Nemetz 14d ago	254	Scan(&userName, &expires, &used)
6c84d387 Keenan Nemetz 16d ago	255	if errors.Is(err, sql.ErrNoRows) {
	256	return ErrInviteInvalid
	257	}
	258	if err != nil {
	259	return fmt.Errorf("identity: read invite: %w", err)
	260	}
	261	if used.Valid \|\| expires <= now.Unix() {
	262	return ErrInviteInvalid
	263	}
	264	res, err := tx.Exec(`UPDATE user_invites SET used_at=? WHERE token_hash=? AND used_at IS NULL`, now.Unix(), hashToken(token))
	265	if err != nil {
	266	return fmt.Errorf("identity: consume invite: %w", err)
	267	}
	268	n, err := res.RowsAffected()
	269	if err != nil {
	270	return err
	271	}
	272	if n != 1 {
	273	return ErrInviteInvalid
	274	}
	275	// A second live link for the same account must not survive the first
	276	// successful enrollment.
62576fa8 Keenan Nemetz 14d ago	277	if _, err := tx.Exec(`UPDATE user_invites SET used_at=? WHERE user_name=? AND used_at IS NULL`, now.Unix(), userName); err != nil {
6c84d387 Keenan Nemetz 16d ago	278	return fmt.Errorf("identity: close sibling invites: %w", err)
6c84d387 Keenan Nemetz 16d ago	279	}
62576fa8 Keenan Nemetz 14d ago	280	if err := insertCredential(tx, userName, cred, now); err != nil {
6c84d387 Keenan Nemetz 16d ago	281	return err
6c84d387 Keenan Nemetz 16d ago	282	}
62576fa8 Keenan Nemetz 14d ago	283	accountName = userName
6c84d387 Keenan Nemetz 16d ago	284	return nil
	285	})
	286	if err != nil {
	287	return nil, err
	288	}
62576fa8 Keenan Nemetz 14d ago	289	return s.Find(accountName)
6c84d387 Keenan Nemetz 16d ago	290	}
	291
	292	// AddCredential attaches another passkey to an account that is already logged
	293	// in or already has an SSH key.
62576fa8 Keenan Nemetz 14d ago	294	func (s *Store) AddCredential(name string, cred Credential, actor string) error {
6c84d387 Keenan Nemetz 16d ago	295	if err := validateCredential(cred); err != nil {
	296	return err
	297	}
	298	now := time.Now().UTC()
62576fa8 Keenan Nemetz 14d ago	299	return s.mutate("identity.credential-add", actor, name, strings.TrimSpace(cred.Label), func(tx *sql.Tx) error {
62576fa8 Keenan Nemetz 14d ago	300	a, err := findTx(tx, name)
6c84d387 Keenan Nemetz 16d ago	301	if err != nil {
	302	return err
	303	}
29a795b9 Keenan Nemetz 7d ago	304	if a.Bot() {
	305	return fmt.Errorf("identity: %s is a bot account; it has no browser sign-in", a.Name)
	306	}
6c84d387 Keenan Nemetz 16d ago	307	if !a.Active() {
	308	return fmt.Errorf("identity: %s is retired", a.Name)
	309	}
62576fa8 Keenan Nemetz 14d ago	310	return insertCredential(tx, a.Name, cred, now)
6c84d387 Keenan Nemetz 16d ago	311	})
	312	}
	313
	314	// Credentials lists an account's passkeys. Retired accounts are included so the
	315	// operator can still see what was registered.
62576fa8 Keenan Nemetz 14d ago	316	func (s *Store) Credentials(name string) ([]Credential, error) {
62576fa8 Keenan Nemetz 14d ago	317	a, err := s.Find(name)
6c84d387 Keenan Nemetz 16d ago	318	if err != nil {
	319	return nil, err
	320	}
62576fa8 Keenan Nemetz 14d ago	321	return s.credentialsFor(a.Name)
6c84d387 Keenan Nemetz 16d ago	322	}
	323
	324	// FindCredential resolves a credential id to its account. A retired account's
	325	// credential behaves as if it no longer exists.
	326	func (s Store) FindCredential(credentialID []byte) (Credential, *Account, error) {
62576fa8 Keenan Nemetz 14d ago	327	cred, accountName, err := s.credentialByID(credentialID)
6c84d387 Keenan Nemetz 16d ago	328	if err != nil {
	329	return nil, nil, err
	330	}
62576fa8 Keenan Nemetz 14d ago	331	a, err := s.Find(accountName)
6c84d387 Keenan Nemetz 16d ago	332	if err != nil \|\| !a.Active() {
	333	return nil, nil, ErrCredentialNotFound
	334	}
	335	return cred, a, nil
	336	}
	337
	338	// UpdateCredential records an assertion counter and the time the key was last
	339	// used. Counter policy belongs to the ceremony: this layer stores what it is
	340	// given so an authenticator that always reports zero is not locked out.
	341	func (s *Store) UpdateCredential(credentialID []byte, signCount uint32, lastUsed time.Time) error {
	342	if len(credentialID) == 0 {
	343	return ErrCredentialNotFound
	344	}
	345	res, err := s.db.Exec(`UPDATE user_credentials SET sign_count=?, last_used=? WHERE credential_id=?`,
	346	int64(signCount), unixOrZero(lastUsed), credentialIDString(credentialID))
	347	if err != nil {
	348	return fmt.Errorf("identity: update passkey: %w", err)
	349	}
	350	n, err := res.RowsAffected()
	351	if err != nil {
	352	return err
	353	}
	354	if n == 0 {
	355	return ErrCredentialNotFound
	356	}
	357	return nil
	358	}
	359
	360	// RemoveCredential revokes one passkey. Sessions created by that passkey are
	361	// removed by the foreign key in sessions.
62576fa8 Keenan Nemetz 14d ago	362	func (s *Store) RemoveCredential(name string, credentialID []byte, actor string) error {
6c84d387 Keenan Nemetz 16d ago	363	if len(credentialID) == 0 {
	364	return ErrCredentialNotFound
	365	}
62576fa8 Keenan Nemetz 14d ago	366	return s.mutate("identity.credential-remove", actor, name, credentialIDString(credentialID), func(tx *sql.Tx) error {
62576fa8 Keenan Nemetz 14d ago	367	a, err := findTx(tx, name)
6c84d387 Keenan Nemetz 16d ago	368	if err != nil {
	369	return err
	370	}
7d7718fa Keenan Nemetz 6h ago	371	// The sessions table has a cascading foreign key, and this says the same thing
	372	// on purpose: a passkey that is gone cannot keep a browser session alive,
	373	// including the one the person is using at this moment.
	374	if _, err := tx.Exec(`DELETE FROM sessions WHERE credential_id=?`,
	375	credentialIDString(credentialID)); err != nil {
	376	return fmt.Errorf("identity: end the sessions of a removed passkey: %w", err)
	377	}
62576fa8 Keenan Nemetz 14d ago	378	res, err := tx.Exec(`DELETE FROM user_credentials WHERE credential_id=? AND user_name=?`,
62576fa8 Keenan Nemetz 14d ago	379	credentialIDString(credentialID), a.Name)
6c84d387 Keenan Nemetz 16d ago	380	if err != nil {
	381	return fmt.Errorf("identity: remove passkey: %w", err)
	382	}
	383	n, err := res.RowsAffected()
	384	if err != nil {
	385	return err
	386	}
	387	if n == 0 {
	388	return ErrCredentialNotFound
	389	}
	390	return nil
	391	})
	392	}
	393
7d7718fa Keenan Nemetz 6h ago	394	// RenameCredential changes the label on one of an account's passkeys. A label is
	395	// display text, not identity: the credential id is what authenticates, so a rename
	396	// cannot affect signing in, and an empty label is allowed and means "no label".
	397	func (s *Store) RenameCredential(name string, credentialID []byte, label, actor string) error {
	398	if len(credentialID) == 0 {
	399	return ErrCredentialNotFound
	400	}
	401	label = strings.TrimSpace(label)
	402	if err := ValidateCredentialLabel(label); err != nil {
	403	return err
	404	}
	405	return s.mutate("identity.credential-rename", actor, name,
	406	credentialIDString(credentialID)+" "+label, func(tx *sql.Tx) error {
	407	a, err := findTx(tx, name)
	408	if err != nil {
	409	return err
	410	}
	411	res, err := tx.Exec(`UPDATE user_credentials SET label=? WHERE credential_id=? AND user_name=?`,
	412	label, credentialIDString(credentialID), a.Name)
	413	if err != nil {
	414	return fmt.Errorf("identity: rename passkey: %w", err)
	415	}
	416	n, err := res.RowsAffected()
	417	if err != nil {
	418	return err
	419	}
	420	if n == 0 {
	421	return ErrCredentialNotFound
	422	}
	423	return nil
	424	})
	425	}
	426
6c84d387 Keenan Nemetz 16d ago	427	// ---------- internal ----------
	428
	429	func inviteTTL(ttl time.Duration) time.Duration {
	430	if ttl <= 0 {
	431	return DefaultInviteTTL
	432	}
	433	return ttl
	434	}
	435
	436	func newInviteToken() (token, hash string, err error) {
	437	b := make([]byte, inviteTokenBytes)
	438	if _, err := rand.Read(b); err != nil {
	439	return "", "", fmt.Errorf("identity: invite token: %w", err)
	440	}
	441	token = base64.RawURLEncoding.EncodeToString(b)
	442	return token, hashToken(token), nil
	443	}
	444
	445	func hashToken(token string) string {
	446	sum := sha256.Sum256([]byte(token))
	447	return hex.EncodeToString(sum[:])
	448	}
	449
	450	func validateCredential(c Credential) error {
25343521 Keenan Nemetz 3d ago	451	if err := ValidateCredentialLabel(c.Label); err != nil {
	452	return err
	453	}
6c84d387 Keenan Nemetz 16d ago	454	switch {
	455	case len(c.ID) == 0:
	456	return errors.New("identity: passkey id is empty")
	457	case len(c.ID) > 2048:
	458	return errors.New("identity: passkey id is too long")
	459	case len(c.PublicKey) == 0:
	460	return errors.New("identity: passkey public key is empty")
	461	case len(c.PublicKey) > 8192:
	462	return errors.New("identity: passkey public key is too long")
25343521 Keenan Nemetz 3d ago	463	case len(c.AttestationType) > maxCredentialAttestation:
	464	return fmt.Errorf("identity: passkey attestation type is too long")
	465	case len(c.Transport) > maxCredentialTransports:
	466	return fmt.Errorf("identity: passkey has %d transports, limit %d", len(c.Transport), maxCredentialTransports)
	467	case len(c.Authenticator.Attachment) > maxCredentialAttachment:
	468	return fmt.Errorf("identity: passkey attachment is too long")
6c84d387 Keenan Nemetz 16d ago	469	case len(c.Authenticator.AAGUID) > 256:
	470	return errors.New("identity: passkey AAGUID is too long")
	471	}
25343521 Keenan Nemetz 3d ago	472	for _, transport := range c.Transport {
	473	if len(transport) > maxCredentialTransport {
	474	return fmt.Errorf("identity: passkey transport is %d bytes, limit %d", len(transport), maxCredentialTransport)
	475	}
	476	}
	477	return nil
	478	}
	479
	480	// ValidateCredentialLabel checks the label before a ceremony stores it. A label
	481	// is display text, not prose, so it is capped where it is accepted rather than
	482	// only when the finished credential is written.
	483	func ValidateCredentialLabel(label string) error {
	484	label = strings.TrimSpace(label)
	485	if len(label) > MaxCredentialLabel {
	486	return fmt.Errorf("identity: passkey label is %d bytes, limit %d", len(label), MaxCredentialLabel)
	487	}
6c84d387 Keenan Nemetz 16d ago	488	return nil
	489	}
	490
62576fa8 Keenan Nemetz 14d ago	491	func insertCredential(tx *sql.Tx, name string, cred Credential, now time.Time) error {
6c84d387 Keenan Nemetz 16d ago	492	id := credentialIDString(cred.ID)
6c84d387 Keenan Nemetz 16d ago	493	var existing string
62576fa8 Keenan Nemetz 14d ago	494	err := tx.QueryRow(`SELECT user_name FROM user_credentials WHERE credential_id=?`, id).Scan(&existing)
6c84d387 Keenan Nemetz 16d ago	495	if err == nil {
	496	return errors.New("identity: that passkey is already registered")
	497	}
	498	if !errors.Is(err, sql.ErrNoRows) {
	499	return fmt.Errorf("identity: read passkey: %w", err)
	500	}
	501	transports, err := json.Marshal(cred.Transport)
	502	if err != nil {
	503	return fmt.Errorf("identity: passkey transports: %w", err)
	504	}
	505	created := cred.Created
	506	if created.IsZero() {
	507	created = now
	508	}
	509	_, err = tx.Exec(`INSERT INTO user_credentials(
62576fa8 Keenan Nemetz 14d ago	510	credential_id, user_name, public_key, attestation_type, transports, flags, aaguid,
6c84d387 Keenan Nemetz 16d ago	511	sign_count, clone_warning, attachment, label, created, last_used)
6c84d387 Keenan Nemetz 16d ago	512	VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)`,
62576fa8 Keenan Nemetz 14d ago	513	id, name, cred.PublicKey, cred.AttestationType, string(transports),
6c84d387 Keenan Nemetz 16d ago	514	flagsValue(cred.Flags), cred.Authenticator.AAGUID, int64(cred.Authenticator.SignCount),
	515	boolValue(cred.Authenticator.CloneWarning), cred.Authenticator.Attachment,
	516	strings.TrimSpace(cred.Label), created.Unix(), unixOrZero(cred.LastUsed))
	517	if err != nil {
	518	return fmt.Errorf("identity: add passkey: %w", err)
	519	}
	520	return nil
	521	}
	522
	523	const credentialColumns = `credential_id, public_key, attestation_type, transports, flags, aaguid,
	524	sign_count, clone_warning, attachment, label, created, last_used`
	525
	526	func scanCredential(scan func(dest ...any) error) (Credential, error) {
	527	var (
	528	cred Credential
	529	id, transports string
	530	flags int64
	531	aaguid []byte
	532	signCount int64
	533	cloneWarning int64
	534	created, last int64
	535	credentialLabel string
	536	)
	537	if err := scan(&id, &cred.PublicKey, &cred.AttestationType, &transports, &flags, &aaguid,
	538	&signCount, &cloneWarning, &cred.Authenticator.Attachment, &credentialLabel, &created, &last); err != nil {
	539	return Credential{}, err
	540	}
	541	rawID, err := ParseCredentialID(id)
	542	if err != nil {
	543	return Credential{}, fmt.Errorf("identity: stored passkey id: %w", err)
	544	}
	545	if transports != "" {
	546	if err := json.Unmarshal([]byte(transports), &cred.Transport); err != nil {
	547	return Credential{}, fmt.Errorf("identity: stored passkey transports: %w", err)
	548	}
	549	}
	550	cred.ID = rawID
	551	cred.Flags = flagsFrom(flags)
	552	cred.Authenticator.AAGUID = aaguid
	553	cred.Authenticator.SignCount = uint32(signCount)
	554	cred.Authenticator.CloneWarning = cloneWarning != 0
	555	cred.Label = credentialLabel
	556	cred.Created = time.Unix(created, 0).UTC()
	557	if last > 0 {
	558	cred.LastUsed = time.Unix(last, 0).UTC()
	559	}
	560	return cred, nil
	561	}
	562
62576fa8 Keenan Nemetz 14d ago	563	func (s *Store) credentialsFor(name string) ([]Credential, error) {
62576fa8 Keenan Nemetz 14d ago	564	rows, err := s.db.Query(`SELECT `+credentialColumns+` FROM user_credentials WHERE user_name=? ORDER BY created, credential_id`, name)
6c84d387 Keenan Nemetz 16d ago	565	if err != nil {
	566	return nil, fmt.Errorf("identity: read passkeys: %w", err)
	567	}
	568	defer rows.Close()
	569	var out []Credential
	570	for rows.Next() {
	571	cred, err := scanCredential(rows.Scan)
	572	if err != nil {
	573	return nil, fmt.Errorf("identity: read passkeys: %w", err)
	574	}
	575	out = append(out, cred)
	576	}
	577	if err := rows.Err(); err != nil {
	578	return nil, err
	579	}
	580	sort.Slice(out, func(i, j int) bool { return out[i].Created.Before(out[j].Created) })
	581	return out, nil
	582	}
	583
	584	func (s Store) credentialByID(credentialID []byte) (Credential, string, error) {
	585	if len(credentialID) == 0 {
	586	return nil, "", ErrCredentialNotFound
	587	}
62576fa8 Keenan Nemetz 14d ago	588	var accountName string
6c84d387 Keenan Nemetz 16d ago	589	var cred Credential
	590	// Scan the credential columns and the owner in one row, so a credential
	591	// cannot disappear between two queries.
62576fa8 Keenan Nemetz 14d ago	592	row := s.db.QueryRow(`SELECT `+credentialColumns+`, user_name FROM user_credentials WHERE credential_id=?`,
6c84d387 Keenan Nemetz 16d ago	593	credentialIDString(credentialID))
	594	var (
	595	id, transports, label string
	596	flags int64
	597	aaguid []byte
	598	signCount int64
	599	cloneWarning int64
	600	created, last int64
	601	)
	602	err := row.Scan(&id, &cred.PublicKey, &cred.AttestationType, &transports, &flags, &aaguid,
62576fa8 Keenan Nemetz 14d ago	603	&signCount, &cloneWarning, &cred.Authenticator.Attachment, &label, &created, &last, &accountName)
6c84d387 Keenan Nemetz 16d ago	604	if errors.Is(err, sql.ErrNoRows) {
	605	return nil, "", ErrCredentialNotFound
	606	}
	607	if err != nil {
	608	return nil, "", fmt.Errorf("identity: read passkey: %w", err)
	609	}
	610	rawID, err := ParseCredentialID(id)
	611	if err != nil {
	612	return nil, "", fmt.Errorf("identity: stored passkey id: %w", err)
	613	}
	614	if transports != "" {
	615	if err := json.Unmarshal([]byte(transports), &cred.Transport); err != nil {
	616	return nil, "", fmt.Errorf("identity: stored passkey transports: %w", err)
	617	}
	618	}
	619	cred.ID = rawID
	620	cred.Flags = flagsFrom(flags)
	621	cred.Authenticator.AAGUID = aaguid
	622	cred.Authenticator.SignCount = uint32(signCount)
	623	cred.Authenticator.CloneWarning = cloneWarning != 0
	624	cred.Label = label
	625	cred.Created = time.Unix(created, 0).UTC()
	626	if last > 0 {
	627	cred.LastUsed = time.Unix(last, 0).UTC()
	628	}
62576fa8 Keenan Nemetz 14d ago	629	return &cred, accountName, nil
6c84d387 Keenan Nemetz 16d ago	630	}
	631
	632	// CredentialIDString renders a credential id the way the CLI and URLs carry it.
	633	func CredentialIDString(id []byte) string { return credentialIDString(id) }
	634
	635	func credentialIDString(id []byte) string {
	636	return base64.RawURLEncoding.EncodeToString(id)
	637	}
	638
	639	// ParseCredentialID accepts the unpadded base64url form Vole prints, and the
	640	// padded form people paste from other tools.
	641	func ParseCredentialID(s string) ([]byte, error) {
	642	s = strings.TrimSpace(s)
	643	if s == "" {
	644	return nil, errors.New("empty credential id")
	645	}
	646	if b, err := base64.RawURLEncoding.DecodeString(s); err == nil {
	647	return b, nil
	648	}
	649	b, err := base64.URLEncoding.DecodeString(s)
	650	if err != nil {
	651	return nil, errors.New("credential id is not base64url")
	652	}
	653	return b, nil
	654	}
	655
	656	const (
	657	flagUserPresent = 1 << iota
	658	flagUserVerified
	659	flagBackupEligible
	660	flagBackupState
	661	)
	662
	663	func flagsValue(f CredentialFlags) int64 {
	664	var v int64
	665	if f.UserPresent {
	666	v \|= flagUserPresent
	667	}
	668	if f.UserVerified {
	669	v \|= flagUserVerified
	670	}
	671	if f.BackupEligible {
	672	v \|= flagBackupEligible
	673	}
	674	if f.BackupState {
	675	v \|= flagBackupState
	676	}
	677	return v
	678	}
	679
	680	func flagsFrom(v int64) CredentialFlags {
	681	return CredentialFlags{
	682	UserPresent: v&flagUserPresent != 0,
	683	UserVerified: v&flagUserVerified != 0,
	684	BackupEligible: v&flagBackupEligible != 0,
	685	BackupState: v&flagBackupState != 0,
	686	}
	687	}
	688
	689	func boolValue(b bool) int64 {
	690	if b {
	691	return 1
	692	}
	693	return 0
694	}
695
696	func unixOrZero(t time.Time) int64 {
697	if t.IsZero() {
698	return 0
699	}
700	return t.Unix()
701	}