Fixed 267U.pre2
This commit is contained in:
@@ -0,0 +1,46 @@
|
||||
import { publishMainStream } from "../../../../../services/stream.js";
|
||||
import * as OTPAuth from "otpauth";
|
||||
import define from "../../../define.js";
|
||||
import { Users, UserProfiles } from "../../../../../models/index.js";
|
||||
export const meta = {
|
||||
requireCredential: true,
|
||||
secure: true
|
||||
};
|
||||
export const paramDef = {
|
||||
type: "object",
|
||||
properties: {
|
||||
token: {
|
||||
type: "string"
|
||||
}
|
||||
},
|
||||
required: [
|
||||
"token"
|
||||
]
|
||||
};
|
||||
export default define(meta, paramDef, async (ps, user)=>{
|
||||
const token = ps.token.replace(/\s/g, "");
|
||||
const profile = await UserProfiles.findOneByOrFail({
|
||||
userId: user.id
|
||||
});
|
||||
if (profile.twoFactorTempSecret == null) {
|
||||
throw new Error("二段階認証の設定が開始されていません");
|
||||
}
|
||||
const delta = OTPAuth.TOTP.validate({
|
||||
secret: OTPAuth.Secret.fromBase32(profile.twoFactorTempSecret),
|
||||
digits: 6,
|
||||
token,
|
||||
window: 1
|
||||
});
|
||||
if (delta === null) {
|
||||
throw new Error("not verified");
|
||||
}
|
||||
await UserProfiles.update(user.id, {
|
||||
twoFactorSecret: profile.twoFactorTempSecret,
|
||||
twoFactorEnabled: true
|
||||
});
|
||||
const iObj = await Users.pack(user.id, user, {
|
||||
detail: true,
|
||||
includeSecrets: true
|
||||
});
|
||||
publishMainStream(user.id, "meUpdated", iObj);
|
||||
});
|
||||
@@ -0,0 +1,125 @@
|
||||
import * as cbor from "cbor";
|
||||
import define from "../../../define.js";
|
||||
import { UserProfiles, UserSecurityKeys, AttestationChallenges, Users } from "../../../../../models/index.js";
|
||||
import config from "../../../../../config/index.js";
|
||||
import { procedures, hash } from "../../../2fa.js";
|
||||
import { publishMainStream } from "../../../../../services/stream.js";
|
||||
import { comparePassword } from "../../../../../misc/password.js";
|
||||
const rpIdHashReal = hash(Buffer.from(config.hostname, "utf-8"));
|
||||
export const meta = {
|
||||
requireCredential: true,
|
||||
secure: true
|
||||
};
|
||||
export const paramDef = {
|
||||
type: "object",
|
||||
properties: {
|
||||
clientDataJSON: {
|
||||
type: "string"
|
||||
},
|
||||
attestationObject: {
|
||||
type: "string"
|
||||
},
|
||||
password: {
|
||||
type: "string"
|
||||
},
|
||||
challengeId: {
|
||||
type: "string"
|
||||
},
|
||||
name: {
|
||||
type: "string",
|
||||
minLength: 1,
|
||||
maxLength: 30
|
||||
}
|
||||
},
|
||||
required: [
|
||||
"clientDataJSON",
|
||||
"attestationObject",
|
||||
"password",
|
||||
"challengeId",
|
||||
"name"
|
||||
]
|
||||
};
|
||||
export default define(meta, paramDef, async (ps, user)=>{
|
||||
const profile = await UserProfiles.findOneByOrFail({
|
||||
userId: user.id
|
||||
});
|
||||
// Compare password
|
||||
const same = await comparePassword(ps.password, profile.password);
|
||||
if (!same) {
|
||||
throw new Error("incorrect password");
|
||||
}
|
||||
if (!profile.twoFactorEnabled) {
|
||||
throw new Error("2fa not enabled");
|
||||
}
|
||||
const clientData = JSON.parse(ps.clientDataJSON);
|
||||
if (clientData.type !== "webauthn.create") {
|
||||
throw new Error("not a creation attestation");
|
||||
}
|
||||
if (clientData.origin !== `${config.scheme}://${config.host}`) {
|
||||
throw new Error("origin mismatch");
|
||||
}
|
||||
const clientDataJSONHash = hash(Buffer.from(ps.clientDataJSON, "utf-8"));
|
||||
const attestation = await cbor.decodeFirst(ps.attestationObject);
|
||||
const rpIdHash = attestation.authData.slice(0, 32);
|
||||
if (!rpIdHashReal.equals(rpIdHash)) {
|
||||
throw new Error("rpIdHash mismatch");
|
||||
}
|
||||
const flags = attestation.authData[32];
|
||||
if (!(flags & 1)) {
|
||||
throw new Error("user not present");
|
||||
}
|
||||
const authData = Buffer.from(attestation.authData);
|
||||
const credentialIdLength = authData.readUInt16BE(53);
|
||||
const credentialId = authData.slice(55, 55 + credentialIdLength);
|
||||
const publicKeyData = authData.slice(55 + credentialIdLength);
|
||||
const publicKey = await cbor.decodeFirst(publicKeyData);
|
||||
if (publicKey.get(3) !== -7) {
|
||||
throw new Error("alg mismatch");
|
||||
}
|
||||
if (!procedures[attestation.fmt]) {
|
||||
throw new Error("unsupported fmt");
|
||||
}
|
||||
const verificationData = procedures[attestation.fmt].verify({
|
||||
attStmt: attestation.attStmt,
|
||||
authenticatorData: authData,
|
||||
clientDataHash: clientDataJSONHash,
|
||||
credentialId,
|
||||
publicKey,
|
||||
rpIdHash
|
||||
});
|
||||
if (!verificationData.valid) throw new Error("signature invalid");
|
||||
const attestationChallenge = await AttestationChallenges.findOneBy({
|
||||
userId: user.id,
|
||||
id: ps.challengeId,
|
||||
registrationChallenge: true,
|
||||
challenge: hash(clientData.challenge).toString("hex")
|
||||
});
|
||||
if (!attestationChallenge) {
|
||||
throw new Error("non-existent challenge");
|
||||
}
|
||||
await AttestationChallenges.delete({
|
||||
userId: user.id,
|
||||
id: ps.challengeId
|
||||
});
|
||||
// Expired challenge (> 5min old)
|
||||
if (new Date().getTime() - attestationChallenge.createdAt.getTime() >= 5 * 60 * 1000) {
|
||||
throw new Error("expired challenge");
|
||||
}
|
||||
const credentialIdString = credentialId.toString("hex");
|
||||
await UserSecurityKeys.insert({
|
||||
userId: user.id,
|
||||
id: credentialIdString,
|
||||
lastUsed: new Date(),
|
||||
name: ps.name,
|
||||
publicKey: verificationData.publicKey.toString("hex")
|
||||
});
|
||||
// Publish meUpdated event
|
||||
publishMainStream(user.id, "meUpdated", await Users.pack(user.id, user, {
|
||||
detail: true,
|
||||
includeSecrets: true
|
||||
}));
|
||||
return {
|
||||
id: credentialIdString,
|
||||
name: ps.name
|
||||
};
|
||||
});
|
||||
@@ -0,0 +1,55 @@
|
||||
import define from "../../../define.js";
|
||||
import { Users, UserProfiles, UserSecurityKeys } from "../../../../../models/index.js";
|
||||
import { publishMainStream } from "../../../../../services/stream.js";
|
||||
import { ApiError } from "../../../error.js";
|
||||
export const meta = {
|
||||
requireCredential: true,
|
||||
secure: true,
|
||||
errors: {
|
||||
noKey: {
|
||||
message: "No security key.",
|
||||
code: "NO_SECURITY_KEY",
|
||||
id: "f9c54d7f-d4c2-4d3c-9a8g-a70daac86512"
|
||||
}
|
||||
}
|
||||
};
|
||||
export const paramDef = {
|
||||
type: "object",
|
||||
properties: {
|
||||
value: {
|
||||
type: "boolean"
|
||||
}
|
||||
},
|
||||
required: [
|
||||
"value"
|
||||
]
|
||||
};
|
||||
export default define(meta, paramDef, async (ps, user)=>{
|
||||
if (ps.value === true) {
|
||||
// セキュリティキーがなければパスワードレスを有効にはできない
|
||||
const keyCount = await UserSecurityKeys.count({
|
||||
where: {
|
||||
userId: user.id
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
lastUsed: true
|
||||
}
|
||||
});
|
||||
if (keyCount === 0) {
|
||||
await UserProfiles.update(user.id, {
|
||||
usePasswordLessLogin: false
|
||||
});
|
||||
throw new ApiError(meta.errors.noKey);
|
||||
}
|
||||
}
|
||||
await UserProfiles.update(user.id, {
|
||||
usePasswordLessLogin: ps.value
|
||||
});
|
||||
const iObj = await Users.pack(user.id, user, {
|
||||
detail: true,
|
||||
includeSecrets: true
|
||||
});
|
||||
publishMainStream(user.id, "meUpdated", iObj);
|
||||
});
|
||||
@@ -0,0 +1,51 @@
|
||||
import define from "../../../define.js";
|
||||
import { UserProfiles, AttestationChallenges } from "../../../../../models/index.js";
|
||||
import { promisify } from "node:util";
|
||||
import * as crypto from "node:crypto";
|
||||
import { genId } from "../../../../../misc/gen-id.js";
|
||||
import { hash } from "../../../2fa.js";
|
||||
import { comparePassword } from "../../../../../misc/password.js";
|
||||
const randomBytes = promisify(crypto.randomBytes);
|
||||
export const meta = {
|
||||
requireCredential: true,
|
||||
secure: true
|
||||
};
|
||||
export const paramDef = {
|
||||
type: "object",
|
||||
properties: {
|
||||
password: {
|
||||
type: "string"
|
||||
}
|
||||
},
|
||||
required: [
|
||||
"password"
|
||||
]
|
||||
};
|
||||
export default define(meta, paramDef, async (ps, user)=>{
|
||||
const profile = await UserProfiles.findOneByOrFail({
|
||||
userId: user.id
|
||||
});
|
||||
// Compare password
|
||||
const same = await comparePassword(ps.password, profile.password);
|
||||
if (!same) {
|
||||
throw new Error("incorrect password");
|
||||
}
|
||||
// if (!profile.twoFactorEnabled) {
|
||||
// throw new Error("2fa not enabled");
|
||||
// }
|
||||
// 32 byte challenge
|
||||
const entropy = await randomBytes(32);
|
||||
const challenge = entropy.toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
|
||||
const challengeId = genId();
|
||||
await AttestationChallenges.insert({
|
||||
userId: user.id,
|
||||
id: challengeId,
|
||||
challenge: hash(Buffer.from(challenge, "utf-8")).toString("hex"),
|
||||
createdAt: new Date(),
|
||||
registrationChallenge: true
|
||||
});
|
||||
return {
|
||||
challengeId,
|
||||
challenge
|
||||
};
|
||||
});
|
||||
@@ -0,0 +1,52 @@
|
||||
import * as OTPAuth from "otpauth";
|
||||
import * as QRCode from "qrcode";
|
||||
import config from "../../../../../config/index.js";
|
||||
import { UserProfiles } from "../../../../../models/index.js";
|
||||
import define from "../../../define.js";
|
||||
import { comparePassword } from "../../../../../misc/password.js";
|
||||
export const meta = {
|
||||
requireCredential: true,
|
||||
secure: true
|
||||
};
|
||||
export const paramDef = {
|
||||
type: "object",
|
||||
properties: {
|
||||
password: {
|
||||
type: "string"
|
||||
}
|
||||
},
|
||||
required: [
|
||||
"password"
|
||||
]
|
||||
};
|
||||
export default define(meta, paramDef, async (ps, user)=>{
|
||||
const profile = await UserProfiles.findOneByOrFail({
|
||||
userId: user.id
|
||||
});
|
||||
// Compare password
|
||||
const same = await comparePassword(ps.password, profile.password);
|
||||
if (!same) {
|
||||
throw new Error("incorrect password");
|
||||
}
|
||||
// Generate user's secret key
|
||||
const secret = new OTPAuth.Secret();
|
||||
await UserProfiles.update(user.id, {
|
||||
twoFactorTempSecret: secret.base32
|
||||
});
|
||||
// Get the data URL of the authenticator URL
|
||||
const totp = new OTPAuth.TOTP({
|
||||
secret,
|
||||
digits: 6,
|
||||
label: user.username,
|
||||
issuer: config.host
|
||||
});
|
||||
const url = totp.toString();
|
||||
const qr = await QRCode.toDataURL(url);
|
||||
return {
|
||||
qr,
|
||||
url,
|
||||
secret: secret.base32,
|
||||
label: user.username,
|
||||
issuer: config.host
|
||||
};
|
||||
});
|
||||
@@ -0,0 +1,60 @@
|
||||
import { comparePassword } from "../../../../../misc/password.js";
|
||||
import define from "../../../define.js";
|
||||
import { UserProfiles, UserSecurityKeys, Users } from "../../../../../models/index.js";
|
||||
import { publishMainStream } from "../../../../../services/stream.js";
|
||||
export const meta = {
|
||||
requireCredential: true,
|
||||
secure: true
|
||||
};
|
||||
export const paramDef = {
|
||||
type: "object",
|
||||
properties: {
|
||||
password: {
|
||||
type: "string"
|
||||
},
|
||||
credentialId: {
|
||||
type: "string"
|
||||
}
|
||||
},
|
||||
required: [
|
||||
"password",
|
||||
"credentialId"
|
||||
]
|
||||
};
|
||||
export default define(meta, paramDef, async (ps, user)=>{
|
||||
const profile = await UserProfiles.findOneByOrFail({
|
||||
userId: user.id
|
||||
});
|
||||
// Compare password
|
||||
const same = await comparePassword(ps.password, profile.password);
|
||||
if (!same) {
|
||||
throw new Error("incorrect password");
|
||||
}
|
||||
// Make sure we only delete the user's own creds
|
||||
await UserSecurityKeys.delete({
|
||||
userId: user.id,
|
||||
id: ps.credentialId
|
||||
});
|
||||
// 使われているキーがなくなったらパスワードレスログインをやめる
|
||||
const keyCount = await UserSecurityKeys.count({
|
||||
where: {
|
||||
userId: user.id
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
lastUsed: true
|
||||
}
|
||||
});
|
||||
if (keyCount === 0) {
|
||||
await UserProfiles.update(me.id, {
|
||||
usePasswordLessLogin: false
|
||||
});
|
||||
}
|
||||
// Publish meUpdated event
|
||||
publishMainStream(user.id, "meUpdated", await Users.pack(user.id, user, {
|
||||
detail: true,
|
||||
includeSecrets: true
|
||||
}));
|
||||
return {};
|
||||
});
|
||||
@@ -0,0 +1,39 @@
|
||||
import { publishMainStream } from "../../../../../services/stream.js";
|
||||
import define from "../../../define.js";
|
||||
import { Users, UserProfiles } from "../../../../../models/index.js";
|
||||
import { comparePassword } from "../../../../../misc/password.js";
|
||||
export const meta = {
|
||||
requireCredential: true,
|
||||
secure: true
|
||||
};
|
||||
export const paramDef = {
|
||||
type: "object",
|
||||
properties: {
|
||||
password: {
|
||||
type: "string"
|
||||
}
|
||||
},
|
||||
required: [
|
||||
"password"
|
||||
]
|
||||
};
|
||||
export default define(meta, paramDef, async (ps, user)=>{
|
||||
const profile = await UserProfiles.findOneByOrFail({
|
||||
userId: user.id
|
||||
});
|
||||
// Compare password
|
||||
const same = await comparePassword(ps.password, profile.password);
|
||||
if (!same) {
|
||||
throw new Error("incorrect password");
|
||||
}
|
||||
await UserProfiles.update(user.id, {
|
||||
twoFactorSecret: null,
|
||||
twoFactorEnabled: false,
|
||||
usePasswordLessLogin: false
|
||||
});
|
||||
const iObj = await Users.pack(user.id, user, {
|
||||
detail: true,
|
||||
includeSecrets: true
|
||||
});
|
||||
publishMainStream(user.id, "meUpdated", iObj);
|
||||
});
|
||||
@@ -0,0 +1,56 @@
|
||||
import { publishMainStream } from "../../../../../services/stream.js";
|
||||
import define from "../../../define.js";
|
||||
import { Users, UserSecurityKeys } from "../../../../../models/index.js";
|
||||
import { ApiError } from "../../../error.js";
|
||||
export const meta = {
|
||||
requireCredential: true,
|
||||
secure: true,
|
||||
errors: {
|
||||
noSuchKey: {
|
||||
message: "No such key.",
|
||||
code: "NO_SUCH_KEY",
|
||||
id: "f9c5467f-d492-4d3c-9a8g-a70dacc86512"
|
||||
},
|
||||
accessDenied: {
|
||||
message: "You do not have edit privilege of the channel.",
|
||||
code: "ACCESS_DENIED",
|
||||
id: "1fb7cb09-d46a-4fff-b8df-057708cce513"
|
||||
}
|
||||
}
|
||||
};
|
||||
export const paramDef = {
|
||||
type: "object",
|
||||
properties: {
|
||||
name: {
|
||||
type: "string",
|
||||
minLength: 1,
|
||||
maxLength: 30
|
||||
},
|
||||
credentialId: {
|
||||
type: "string"
|
||||
}
|
||||
},
|
||||
required: [
|
||||
"name",
|
||||
"credentialId"
|
||||
]
|
||||
};
|
||||
export default define(meta, paramDef, async (ps, user)=>{
|
||||
const key = await UserSecurityKeys.findOneBy({
|
||||
id: ps.credentialId
|
||||
});
|
||||
if (key == null) {
|
||||
throw new ApiError(meta.errors.noSuchKey);
|
||||
}
|
||||
if (key.userId !== user.id) {
|
||||
throw new ApiError(meta.errors.accessDenied);
|
||||
}
|
||||
await UserSecurityKeys.update(key.id, {
|
||||
name: ps.name
|
||||
});
|
||||
const iObj = await Users.pack(user.id, user, {
|
||||
detail: true,
|
||||
includeSecrets: true
|
||||
});
|
||||
publishMainStream(user.id, "meUpdated", iObj);
|
||||
});
|
||||
Reference in New Issue
Block a user