mirror of
https://github.com/QuantumNous/new-api.git
synced 2026-10-28 08:35:33 +08:00
CaIon
45c3fbe8ae
Require single-use operation proofs for passkey enrollment, two-factor setup, and channel key access. Add password and OAuth verification flows, enforce session-bound enrollment, and redact OAuth callback secrets from logs. Validation: affected Go packages pass; frontend typecheck, changed-file lint, and 111 tests pass. Security enrollment regressions pass on SQLite 3.50.4, MySQL 8.0.46, and PostgreSQL 16.15. Full frontend lint has pre-existing errors outside the changed files.
67 lines
2.2 KiB
Go
67 lines
2.2 KiB
Go
package service
|
|
|
|
import (
|
|
"errors"
|
|
"time"
|
|
|
|
"github.com/QuantumNous/new-api/common"
|
|
"github.com/QuantumNous/new-api/model"
|
|
)
|
|
|
|
type TwoFASetup struct {
|
|
Secret string `json:"secret"`
|
|
QRCodeData string `json:"qr_code_data"`
|
|
BackupCodes []string `json:"backup_codes"`
|
|
FlowToken string `json:"flow_token"`
|
|
ExpiresAt int64 `json:"expires_at"`
|
|
}
|
|
|
|
func StartTwoFASetup(identity AuthIdentity, authorization *model.AuthFlowAuthorization) (*TwoFASetup, error) {
|
|
if err := ValidateFlowAuthorization(identity, VerificationOperation{Scope: VerificationScopeTwoFASetup}, authorization); err != nil {
|
|
return nil, err
|
|
}
|
|
user, err := model.GetUserById(identity.UserID, false)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
key, err := common.GenerateTOTPSecret(user.Username)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
codes, err := common.GenerateBackupCodes()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
expiresAt := time.Now().Add(5 * time.Minute)
|
|
flowToken, err := model.CreateTwoFAEnrollment(identity, authorization, key.Secret(), codes, expiresAt)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &TwoFASetup{Secret: key.Secret(), QRCodeData: common.GenerateQRCodeData(key.Secret(), user.Username), BackupCodes: codes, FlowToken: flowToken, ExpiresAt: expiresAt.Unix()}, nil
|
|
}
|
|
|
|
func FinishTwoFASetup(identity AuthIdentity, flowToken, code string) error {
|
|
flow, err := model.GetAuthFlow(flowToken, model.AuthFlowMatch{
|
|
Purpose: model.AuthFlowPurposeTwoFASetup, UserId: identity.UserID, SessionId: identity.SessionID,
|
|
})
|
|
if errors.Is(err, model.ErrAuthFlowInvalid) || errors.Is(err, model.ErrAuthFlowExpired) || errors.Is(err, model.ErrAuthFlowConsumed) {
|
|
return model.ErrTwoFASetupInvalid
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
var payload struct {
|
|
Authorization *model.AuthFlowAuthorization `json:"authorization"`
|
|
}
|
|
if err := common.UnmarshalJsonStr(flow.Payload, &payload); err != nil {
|
|
return err
|
|
}
|
|
if err := ValidateFlowAuthorization(identity, VerificationOperation{Scope: VerificationScopeTwoFASetup}, payload.Authorization); err != nil {
|
|
if errors.Is(err, model.ErrAuthFlowInvalid) {
|
|
return model.ErrTwoFASetupInvalid
|
|
}
|
|
return err
|
|
}
|
|
return model.EnableTwoFAEnrollment(identity, flowToken, code)
|
|
}
|