initial commit

2026-08-16 21:18:45 -05:00
commit 1e05a01bcf
122 changed files with 29178 additions and 0 deletions
@@ -0,0 +1,176 @@
+// Package auth handles administrator credentials, API tokens, CSRF protection
+// and the HTTP middleware that enforces them.
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"runtime"
+	"strings"
+	"unicode"
+
+	"golang.org/x/crypto/argon2"
+)
+
+// Argon2id parameters.
+//
+// 64 MiB with three passes is the interactive profile from the Argon2 RFC:
+// costly enough that an offline attack on a stolen hash is expensive, cheap
+// enough that a login takes well under a second on the small machines this
+// server is meant to run on.
+const (
+	argonTime    = 3
+	argonMemory  = 64 * 1024 // KiB
+	argonKeyLen  = 32
+	argonSaltLen = 16
+)
+
+func argonThreads() uint8 {
+	n := runtime.NumCPU()
+	if n > 4 {
+		n = 4
+	}
+	if n < 1 {
+		n = 1
+	}
+	return uint8(n)
+}
+
+// ErrInvalidHash is returned when a stored hash cannot be parsed.
+var ErrInvalidHash = errors.New("stored password hash is malformed")
+
+// HashPassword derives an Argon2id hash in the standard PHC string format, so
+// the parameters travel with the hash and can be raised later without
+// invalidating existing credentials.
+func HashPassword(password string) (string, error) {
+	if password == "" {
+		return "", errors.New("password must not be empty")
+	}
+	salt := make([]byte, argonSaltLen)
+	if _, err := rand.Read(salt); err != nil {
+		return "", fmt.Errorf("generate password salt: %w", err)
+	}
+	threads := argonThreads()
+	key := argon2.IDKey([]byte(password), salt, argonTime, argonMemory, threads, argonKeyLen)
+
+	return fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
+		argon2.Version, argonMemory, argonTime, threads,
+		base64.RawStdEncoding.EncodeToString(salt),
+		base64.RawStdEncoding.EncodeToString(key),
+	), nil
+}
+
+// VerifyPassword checks a password against a stored PHC hash in constant time.
+func VerifyPassword(encoded, password string) (bool, error) {
+	parts := strings.Split(encoded, "$")
+	if len(parts) != 6 || parts[1] != "argon2id" {
+		return false, ErrInvalidHash
+	}
+
+	var version int
+	if _, err := fmt.Sscanf(parts[2], "v=%d", &version); err != nil {
+		return false, ErrInvalidHash
+	}
+	if version != argon2.Version {
+		return false, fmt.Errorf("%w: unsupported Argon2 version %d", ErrInvalidHash, version)
+	}
+
+	var memory, time uint32
+	var threads uint8
+	if _, err := fmt.Sscanf(parts[3], "m=%d,t=%d,p=%d", &memory, &time, &threads); err != nil {
+		return false, ErrInvalidHash
+	}
+
+	salt, err := base64.RawStdEncoding.Strict().DecodeString(parts[4])
+	if err != nil {
+		return false, ErrInvalidHash
+	}
+	want, err := base64.RawStdEncoding.Strict().DecodeString(parts[5])
+	if err != nil {
+		return false, ErrInvalidHash
+	}
+
+	got := argon2.IDKey([]byte(password), salt, time, memory, threads, uint32(len(want)))
+	return subtle.ConstantTimeCompare(got, want) == 1, nil
+}
+
+// NeedsRehash reports whether a stored hash uses weaker parameters than the
+// current policy, so it can be upgraded on the next successful login.
+func NeedsRehash(encoded string) bool {
+	parts := strings.Split(encoded, "$")
+	if len(parts) != 6 || parts[1] != "argon2id" {
+		return true
+	}
+	var memory, time uint32
+	var threads uint8
+	if _, err := fmt.Sscanf(parts[3], "m=%d,t=%d,p=%d", &memory, &time, &threads); err != nil {
+		return true
+	}
+	return memory < argonMemory || time < argonTime
+}
+
+// passwordAlphabet avoids characters that are easy to confuse when a generated
+// password is read off a terminal and typed into a browser.
+const passwordAlphabet = "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789"
+
+// GeneratePassword returns a cryptographically random password.
+func GeneratePassword(length int) (string, error) {
+	if length < 12 {
+		length = 12
+	}
+	buf := make([]byte, length)
+	if _, err := rand.Read(buf); err != nil {
+		return "", fmt.Errorf("generate password: %w", err)
+	}
+	out := make([]byte, length)
+	for i, b := range buf {
+		out[i] = passwordAlphabet[int(b)%len(passwordAlphabet)]
+	}
+	return string(out), nil
+}
+
+// MinPasswordLength is the shortest password the UI will accept.
+const MinPasswordLength = 12
+
+// ValidatePassword enforces a modest password policy. It follows current NIST
+// guidance: length carries the weight, and arbitrary composition rules are
+// avoided in favour of rejecting obviously weak choices.
+func ValidatePassword(password string) error {
+	if len(password) < MinPasswordLength {
+		return fmt.Errorf("password must be at least %d characters", MinPasswordLength)
+	}
+	if len(password) > 1024 {
+		return errors.New("password must be at most 1024 characters")
+	}
+	for _, r := range password {
+		if unicode.IsControl(r) {
+			return errors.New("password must not contain control characters")
+		}
+	}
+	lower := strings.ToLower(password)
+	for _, weak := range []string{"password", "12345678", "qwerty", "vibedns", "changeme", "vibedns"} {
+		if strings.Contains(lower, weak) {
+			return fmt.Errorf("password must not contain the common string %q", weak)
+		}
+	}
+	if isSingleRepeatedRune(password) {
+		return errors.New("password must not be a single repeated character")
+	}
+	return nil
+}
+
+func isSingleRepeatedRune(s string) bool {
+	if s == "" {
+		return false
+	}
+	first := rune(s[0])
+	for _, r := range s {
+		if r != first {
+			return false
+		}
+	}
+	return true
+}