this repo has no description
lewis.moe
1#[allow(deprecated)]
2use aes_gcm::{Aes256Gcm, KeyInit, Nonce, aead::Aead};
3use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
4use hkdf::Hkdf;
5use p256::ecdsa::SigningKey;
6use sha2::{Digest, Sha256};
7use std::sync::OnceLock;
8
9static CONFIG: OnceLock<AuthConfig> = OnceLock::new();
10
11pub const ENCRYPTION_VERSION: i32 = 1;
12
13pub struct AuthConfig {
14 jwt_secret: String,
15 dpop_secret: String,
16 #[allow(dead_code)]
17 signing_key: SigningKey,
18 pub signing_key_id: String,
19 pub signing_key_x: String,
20 pub signing_key_y: String,
21 key_encryption_key: [u8; 32],
22 device_cookie_key: [u8; 32],
23}
24
25impl AuthConfig {
26 pub fn init() -> &'static Self {
27 CONFIG.get_or_init(|| {
28 let jwt_secret = std::env::var("JWT_SECRET").unwrap_or_else(|_| {
29 if cfg!(test) || std::env::var("TRANQUIL_PDS_ALLOW_INSECURE_SECRETS").is_ok() {
30 "test-jwt-secret-not-for-production".to_string()
31 } else {
32 panic!(
33 "JWT_SECRET environment variable must be set in production. \
34 Set TRANQUIL_PDS_ALLOW_INSECURE_SECRETS=1 for development/testing."
35 );
36 }
37 });
38
39 let dpop_secret = std::env::var("DPOP_SECRET").unwrap_or_else(|_| {
40 if cfg!(test) || std::env::var("TRANQUIL_PDS_ALLOW_INSECURE_SECRETS").is_ok() {
41 "test-dpop-secret-not-for-production".to_string()
42 } else {
43 panic!(
44 "DPOP_SECRET environment variable must be set in production. \
45 Set TRANQUIL_PDS_ALLOW_INSECURE_SECRETS=1 for development/testing."
46 );
47 }
48 });
49
50 if jwt_secret.len() < 32
51 && std::env::var("TRANQUIL_PDS_ALLOW_INSECURE_SECRETS").is_err()
52 {
53 panic!("JWT_SECRET must be at least 32 characters");
54 }
55
56 if dpop_secret.len() < 32
57 && std::env::var("TRANQUIL_PDS_ALLOW_INSECURE_SECRETS").is_err()
58 {
59 panic!("DPOP_SECRET must be at least 32 characters");
60 }
61
62 let mut hasher = Sha256::new();
63 hasher.update(b"oauth-signing-key-derivation:");
64 hasher.update(jwt_secret.as_bytes());
65 let seed = hasher.finalize();
66
67 let signing_key = SigningKey::from_slice(&seed).unwrap_or_else(|e| {
68 panic!(
69 "Failed to create signing key from seed: {}. This is a bug.",
70 e
71 )
72 });
73
74 let verifying_key = signing_key.verifying_key();
75 let point = verifying_key.to_encoded_point(false);
76
77 let signing_key_x = URL_SAFE_NO_PAD.encode(
78 point
79 .x()
80 .expect("EC point missing X coordinate - this should never happen"),
81 );
82 let signing_key_y = URL_SAFE_NO_PAD.encode(
83 point
84 .y()
85 .expect("EC point missing Y coordinate - this should never happen"),
86 );
87
88 let mut kid_hasher = Sha256::new();
89 kid_hasher.update(signing_key_x.as_bytes());
90 kid_hasher.update(signing_key_y.as_bytes());
91 let kid_hash = kid_hasher.finalize();
92 let signing_key_id = URL_SAFE_NO_PAD.encode(&kid_hash[..8]);
93
94 let master_key = std::env::var("MASTER_KEY").unwrap_or_else(|_| {
95 if cfg!(test) || std::env::var("TRANQUIL_PDS_ALLOW_INSECURE_SECRETS").is_ok() {
96 "test-master-key-not-for-production".to_string()
97 } else {
98 panic!(
99 "MASTER_KEY environment variable must be set in production. \
100 Set TRANQUIL_PDS_ALLOW_INSECURE_SECRETS=1 for development/testing."
101 );
102 }
103 });
104
105 if master_key.len() < 32
106 && std::env::var("TRANQUIL_PDS_ALLOW_INSECURE_SECRETS").is_err()
107 {
108 panic!("MASTER_KEY must be at least 32 characters");
109 }
110
111 let hk = Hkdf::<Sha256>::new(None, master_key.as_bytes());
112 let mut key_encryption_key = [0u8; 32];
113 hk.expand(b"tranquil-pds-user-key-encryption", &mut key_encryption_key)
114 .expect("HKDF expansion failed");
115
116 let mut device_cookie_key = [0u8; 32];
117 hk.expand(b"tranquil-pds-device-cookie-signing", &mut device_cookie_key)
118 .expect("HKDF expansion failed");
119
120 AuthConfig {
121 jwt_secret,
122 dpop_secret,
123 signing_key,
124 signing_key_id,
125 signing_key_x,
126 signing_key_y,
127 key_encryption_key,
128 device_cookie_key,
129 }
130 })
131 }
132
133 pub fn get() -> &'static Self {
134 CONFIG
135 .get()
136 .expect("AuthConfig not initialized - call AuthConfig::init() first")
137 }
138
139 pub fn jwt_secret(&self) -> &str {
140 &self.jwt_secret
141 }
142
143 pub fn dpop_secret(&self) -> &str {
144 &self.dpop_secret
145 }
146
147 pub fn sign_device_cookie(&self, device_id: &str) -> String {
148 use hmac::Mac;
149 type HmacSha256 = hmac::Hmac<Sha256>;
150
151 let timestamp = std::time::SystemTime::now()
152 .duration_since(std::time::UNIX_EPOCH)
153 .unwrap_or_default()
154 .as_secs();
155
156 let message = format!("{}:{}", device_id, timestamp);
157 let mut mac = <HmacSha256 as Mac>::new_from_slice(&self.device_cookie_key)
158 .expect("HMAC key size is valid");
159 mac.update(message.as_bytes());
160 let signature = URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes());
161
162 format!("{}.{}.{}", device_id, timestamp, signature)
163 }
164
165 pub fn verify_device_cookie(&self, cookie_value: &str) -> Option<String> {
166 use hmac::Mac;
167 type HmacSha256 = hmac::Hmac<Sha256>;
168
169 let parts: Vec<&str> = cookie_value.splitn(3, '.').collect();
170 if parts.len() != 3 {
171 return None;
172 }
173
174 let device_id = parts[0];
175 let timestamp_str = parts[1];
176 let provided_signature = parts[2];
177
178 let timestamp: u64 = timestamp_str.parse().ok()?;
179
180 let now = std::time::SystemTime::now()
181 .duration_since(std::time::UNIX_EPOCH)
182 .unwrap_or_default()
183 .as_secs();
184
185 let max_age_days = 400;
186 if now.saturating_sub(timestamp) > max_age_days * 24 * 60 * 60 {
187 return None;
188 }
189
190 let message = format!("{}:{}", device_id, timestamp);
191 let mut mac = <HmacSha256 as Mac>::new_from_slice(&self.device_cookie_key)
192 .expect("HMAC key size is valid");
193 mac.update(message.as_bytes());
194 let expected_signature = URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes());
195
196 use subtle::ConstantTimeEq;
197 if provided_signature
198 .as_bytes()
199 .ct_eq(expected_signature.as_bytes())
200 .into()
201 {
202 Some(device_id.to_string())
203 } else {
204 None
205 }
206 }
207
208 pub fn encrypt_user_key(&self, plaintext: &[u8]) -> Result<Vec<u8>, String> {
209 use rand::RngCore;
210
211 let cipher = Aes256Gcm::new_from_slice(&self.key_encryption_key)
212 .map_err(|e| format!("Failed to create cipher: {}", e))?;
213
214 let mut nonce_bytes = [0u8; 12];
215 rand::thread_rng().fill_bytes(&mut nonce_bytes);
216
217 #[allow(deprecated)]
218 let nonce = Nonce::from_slice(&nonce_bytes);
219
220 let ciphertext = cipher
221 .encrypt(nonce, plaintext)
222 .map_err(|e| format!("Encryption failed: {}", e))?;
223
224 let mut result = Vec::with_capacity(12 + ciphertext.len());
225 result.extend_from_slice(&nonce_bytes);
226 result.extend_from_slice(&ciphertext);
227
228 Ok(result)
229 }
230
231 pub fn decrypt_user_key(&self, encrypted: &[u8]) -> Result<Vec<u8>, String> {
232 if encrypted.len() < 12 {
233 return Err("Encrypted data too short".to_string());
234 }
235
236 let cipher = Aes256Gcm::new_from_slice(&self.key_encryption_key)
237 .map_err(|e| format!("Failed to create cipher: {}", e))?;
238
239 #[allow(deprecated)]
240 let nonce = Nonce::from_slice(&encrypted[..12]);
241 let ciphertext = &encrypted[12..];
242
243 cipher
244 .decrypt(nonce, ciphertext)
245 .map_err(|e| format!("Decryption failed: {}", e))
246 }
247}
248
249pub fn encrypt_key(plaintext: &[u8]) -> Result<Vec<u8>, String> {
250 AuthConfig::get().encrypt_user_key(plaintext)
251}
252
253pub fn decrypt_key(encrypted: &[u8], version: Option<i32>) -> Result<Vec<u8>, String> {
254 match version.unwrap_or(0) {
255 0 => Ok(encrypted.to_vec()),
256 1 => AuthConfig::get().decrypt_user_key(encrypted),
257 v => Err(format!("Unknown encryption version: {}", v)),
258 }
259}