Fixed 267U.pre2

2026-07-26 18:25:37 +09:00
parent 50bfaeafdf
commit 317d00a284
1286 changed files with 80222 additions and 1 deletions
@@ -0,0 +1,125 @@
+import * as cbor from "cbor";
+import define from "../../../define.js";
+import { UserProfiles, UserSecurityKeys, AttestationChallenges, Users } from "../../../../../models/index.js";
+import config from "../../../../../config/index.js";
+import { procedures, hash } from "../../../2fa.js";
+import { publishMainStream } from "../../../../../services/stream.js";
+import { comparePassword } from "../../../../../misc/password.js";
+const rpIdHashReal = hash(Buffer.from(config.hostname, "utf-8"));
+export const meta = {
+    requireCredential: true,
+    secure: true
+};
+export const paramDef = {
+    type: "object",
+    properties: {
+        clientDataJSON: {
+            type: "string"
+        },
+        attestationObject: {
+            type: "string"
+        },
+        password: {
+            type: "string"
+        },
+        challengeId: {
+            type: "string"
+        },
+        name: {
+            type: "string",
+            minLength: 1,
+            maxLength: 30
+        }
+    },
+    required: [
+        "clientDataJSON",
+        "attestationObject",
+        "password",
+        "challengeId",
+        "name"
+    ]
+};
+export default define(meta, paramDef, async (ps, user)=>{
+    const profile = await UserProfiles.findOneByOrFail({
+        userId: user.id
+    });
+    // Compare password
+    const same = await comparePassword(ps.password, profile.password);
+    if (!same) {
+        throw new Error("incorrect password");
+    }
+    if (!profile.twoFactorEnabled) {
+        throw new Error("2fa not enabled");
+    }
+    const clientData = JSON.parse(ps.clientDataJSON);
+    if (clientData.type !== "webauthn.create") {
+        throw new Error("not a creation attestation");
+    }
+    if (clientData.origin !== `${config.scheme}://${config.host}`) {
+        throw new Error("origin mismatch");
+    }
+    const clientDataJSONHash = hash(Buffer.from(ps.clientDataJSON, "utf-8"));
+    const attestation = await cbor.decodeFirst(ps.attestationObject);
+    const rpIdHash = attestation.authData.slice(0, 32);
+    if (!rpIdHashReal.equals(rpIdHash)) {
+        throw new Error("rpIdHash mismatch");
+    }
+    const flags = attestation.authData[32];
+    if (!(flags & 1)) {
+        throw new Error("user not present");
+    }
+    const authData = Buffer.from(attestation.authData);
+    const credentialIdLength = authData.readUInt16BE(53);
+    const credentialId = authData.slice(55, 55 + credentialIdLength);
+    const publicKeyData = authData.slice(55 + credentialIdLength);
+    const publicKey = await cbor.decodeFirst(publicKeyData);
+    if (publicKey.get(3) !== -7) {
+        throw new Error("alg mismatch");
+    }
+    if (!procedures[attestation.fmt]) {
+        throw new Error("unsupported fmt");
+    }
+    const verificationData = procedures[attestation.fmt].verify({
+        attStmt: attestation.attStmt,
+        authenticatorData: authData,
+        clientDataHash: clientDataJSONHash,
+        credentialId,
+        publicKey,
+        rpIdHash
+    });
+    if (!verificationData.valid) throw new Error("signature invalid");
+    const attestationChallenge = await AttestationChallenges.findOneBy({
+        userId: user.id,
+        id: ps.challengeId,
+        registrationChallenge: true,
+        challenge: hash(clientData.challenge).toString("hex")
+    });
+    if (!attestationChallenge) {
+        throw new Error("non-existent challenge");
+    }
+    await AttestationChallenges.delete({
+        userId: user.id,
+        id: ps.challengeId
+    });
+    // Expired challenge (> 5min old)
+    if (new Date().getTime() - attestationChallenge.createdAt.getTime() >= 5 * 60 * 1000) {
+        throw new Error("expired challenge");
+    }
+    const credentialIdString = credentialId.toString("hex");
+    await UserSecurityKeys.insert({
+        userId: user.id,
+        id: credentialIdString,
+        lastUsed: new Date(),
+        name: ps.name,
+        publicKey: verificationData.publicKey.toString("hex")
+    });
+    // Publish meUpdated event
+    publishMainStream(user.id, "meUpdated", await Users.pack(user.id, user, {
+        detail: true,
+        includeSecrets: true
+    }));
+    return {
+        id: credentialIdString,
+        name: ps.name
+    };
+});