2019-07-03 06:18:07 -05:00
|
|
|
import * as bcrypt from 'bcryptjs';
|
|
|
|
import { promisify } from 'util';
|
|
|
|
import * as cbor from 'cbor';
|
2021-08-19 07:55:45 -05:00
|
|
|
import define from '../../../define';
|
2019-07-03 06:18:07 -05:00
|
|
|
import {
|
|
|
|
UserProfiles,
|
|
|
|
UserSecurityKeys,
|
|
|
|
AttestationChallenges,
|
2021-12-09 08:58:30 -06:00
|
|
|
Users,
|
2021-08-19 07:55:45 -05:00
|
|
|
} from '@/models/index';
|
|
|
|
import config from '@/config/index';
|
|
|
|
import { procedures, hash } from '../../../2fa';
|
|
|
|
import { publishMainStream } from '@/services/stream';
|
2019-07-03 06:18:07 -05:00
|
|
|
|
2019-07-04 12:00:54 -05:00
|
|
|
const cborDecodeFirst = promisify(cbor.decodeFirst) as any;
|
2022-02-18 23:05:32 -06:00
|
|
|
const rpIdHashReal = hash(Buffer.from(config.hostname, 'utf-8'));
|
2019-07-03 06:18:07 -05:00
|
|
|
|
|
|
|
export const meta = {
|
2022-01-18 07:27:10 -06:00
|
|
|
requireCredential: true,
|
2019-07-03 06:18:07 -05:00
|
|
|
|
|
|
|
secure: true,
|
2022-02-18 23:05:32 -06:00
|
|
|
} as const;
|
2019-07-03 06:18:07 -05:00
|
|
|
|
2022-02-18 23:05:32 -06:00
|
|
|
const paramDef = {
|
|
|
|
type: 'object',
|
|
|
|
properties: {
|
|
|
|
clientDataJSON: { type: 'string' },
|
|
|
|
attestationObject: { type: 'string' },
|
|
|
|
password: { type: 'string' },
|
|
|
|
challengeId: { type: 'string' },
|
|
|
|
name: { type: 'string' },
|
2021-12-09 08:58:30 -06:00
|
|
|
},
|
2022-02-18 23:05:32 -06:00
|
|
|
required: ['clientDataJSON', 'attestationObject', 'password', 'challengeId', 'name'],
|
2022-01-18 07:27:10 -06:00
|
|
|
} as const;
|
2019-07-03 06:18:07 -05:00
|
|
|
|
2022-01-02 11:12:50 -06:00
|
|
|
// eslint-disable-next-line import/no-default-export
|
2022-02-18 23:05:32 -06:00
|
|
|
export default define(meta, paramDef, async (ps, user) => {
|
2021-02-13 00:33:38 -06:00
|
|
|
const profile = await UserProfiles.findOneOrFail(user.id);
|
2019-07-03 06:18:07 -05:00
|
|
|
|
|
|
|
// Compare password
|
|
|
|
const same = await bcrypt.compare(ps.password, profile.password!);
|
|
|
|
|
|
|
|
if (!same) {
|
|
|
|
throw new Error('incorrect password');
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!profile.twoFactorEnabled) {
|
|
|
|
throw new Error('2fa not enabled');
|
|
|
|
}
|
|
|
|
|
|
|
|
const clientData = JSON.parse(ps.clientDataJSON);
|
|
|
|
|
|
|
|
if (clientData.type != 'webauthn.create') {
|
|
|
|
throw new Error('not a creation attestation');
|
|
|
|
}
|
|
|
|
if (clientData.origin != config.scheme + '://' + config.host) {
|
|
|
|
throw new Error('origin mismatch');
|
|
|
|
}
|
|
|
|
|
|
|
|
const clientDataJSONHash = hash(Buffer.from(ps.clientDataJSON, 'utf-8'));
|
|
|
|
|
|
|
|
const attestation = await cborDecodeFirst(ps.attestationObject);
|
|
|
|
|
|
|
|
const rpIdHash = attestation.authData.slice(0, 32);
|
|
|
|
if (!rpIdHashReal.equals(rpIdHash)) {
|
|
|
|
throw new Error('rpIdHash mismatch');
|
|
|
|
}
|
|
|
|
|
|
|
|
const flags = attestation.authData[32];
|
|
|
|
|
2021-11-11 19:52:10 -06:00
|
|
|
// eslint:disable-next-line:no-bitwise
|
2019-07-03 06:18:07 -05:00
|
|
|
if (!(flags & 1)) {
|
|
|
|
throw new Error('user not present');
|
|
|
|
}
|
|
|
|
|
|
|
|
const authData = Buffer.from(attestation.authData);
|
|
|
|
const credentialIdLength = authData.readUInt16BE(53);
|
|
|
|
const credentialId = authData.slice(55, 55 + credentialIdLength);
|
|
|
|
const publicKeyData = authData.slice(55 + credentialIdLength);
|
|
|
|
const publicKey: Map<number, any> = await cborDecodeFirst(publicKeyData);
|
|
|
|
if (publicKey.get(3) != -7) {
|
|
|
|
throw new Error('alg mismatch');
|
|
|
|
}
|
|
|
|
|
2019-07-04 12:00:54 -05:00
|
|
|
if (!(procedures as any)[attestation.fmt]) {
|
2019-07-03 06:18:07 -05:00
|
|
|
throw new Error('unsupported fmt');
|
|
|
|
}
|
|
|
|
|
2019-07-04 12:00:54 -05:00
|
|
|
const verificationData = (procedures as any)[attestation.fmt].verify({
|
2019-07-03 06:18:07 -05:00
|
|
|
attStmt: attestation.attStmt,
|
|
|
|
authenticatorData: authData,
|
|
|
|
clientDataHash: clientDataJSONHash,
|
|
|
|
credentialId,
|
|
|
|
publicKey,
|
2021-12-09 08:58:30 -06:00
|
|
|
rpIdHash,
|
2019-07-03 06:18:07 -05:00
|
|
|
});
|
|
|
|
if (!verificationData.valid) throw new Error('signature invalid');
|
|
|
|
|
|
|
|
const attestationChallenge = await AttestationChallenges.findOne({
|
|
|
|
userId: user.id,
|
|
|
|
id: ps.challengeId,
|
|
|
|
registrationChallenge: true,
|
2021-12-09 08:58:30 -06:00
|
|
|
challenge: hash(clientData.challenge).toString('hex'),
|
2019-07-03 06:18:07 -05:00
|
|
|
});
|
|
|
|
|
|
|
|
if (!attestationChallenge) {
|
|
|
|
throw new Error('non-existent challenge');
|
|
|
|
}
|
|
|
|
|
|
|
|
await AttestationChallenges.delete({
|
|
|
|
userId: user.id,
|
2021-12-09 08:58:30 -06:00
|
|
|
id: ps.challengeId,
|
2019-07-03 06:18:07 -05:00
|
|
|
});
|
|
|
|
|
|
|
|
// Expired challenge (> 5min old)
|
|
|
|
if (
|
|
|
|
new Date().getTime() - attestationChallenge.createdAt.getTime() >=
|
|
|
|
5 * 60 * 1000
|
|
|
|
) {
|
|
|
|
throw new Error('expired challenge');
|
|
|
|
}
|
|
|
|
|
|
|
|
const credentialIdString = credentialId.toString('hex');
|
|
|
|
|
2022-01-25 09:51:26 -06:00
|
|
|
await UserSecurityKeys.insert({
|
2019-07-03 06:18:07 -05:00
|
|
|
userId: user.id,
|
|
|
|
id: credentialIdString,
|
|
|
|
lastUsed: new Date(),
|
|
|
|
name: ps.name,
|
2021-12-09 08:58:30 -06:00
|
|
|
publicKey: verificationData.publicKey.toString('hex'),
|
2019-07-03 06:18:07 -05:00
|
|
|
});
|
|
|
|
|
|
|
|
// Publish meUpdated event
|
|
|
|
publishMainStream(user.id, 'meUpdated', await Users.pack(user.id, user, {
|
|
|
|
detail: true,
|
2021-12-09 08:58:30 -06:00
|
|
|
includeSecrets: true,
|
2019-07-03 06:18:07 -05:00
|
|
|
}));
|
|
|
|
|
|
|
|
return {
|
|
|
|
id: credentialIdString,
|
2021-12-09 08:58:30 -06:00
|
|
|
name: ps.name,
|
2019-07-03 06:18:07 -05:00
|
|
|
};
|
|
|
|
});
|