nilix/quartzgun
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

use TTL with LastSeen instead of hard expiry time

Browse source
This commit is contained in:
Iris Lightshard 2022-08-02 20:46:34 -06:00
parent 48dbb967f3
commit 92f0f035a9
Signed by: Iris Lightshard
GPG key ID: 3B7FBC22144E6398
5 changed files with 36 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
auth/auth.go
View file

@ -17,7 +17,7 @@ type User struct {
}
type UserStore interface {
InitiateSession(user string, password string) (string, error)
InitiateSession(user string, password string, ttl int) (string, error)
ValidateUser(user string, sessionId string) (bool, error)
EndSession(user string) error
AddUser(user string, password string) error
@ -27,13 +27,13 @@ type UserStore interface {
GetLastTimeSeen(user string) (time.Time, error)
SetData(user string, key string, value interface{}) error
GetData(user string, key string) (interface{}, error)
GrantToken(user, password, scope string, minutes int) (string, error)
GrantToken(user, password string, ttl int) (string, error)
ValidateToken(token string) (bool, error)
ValidateTokenWithScopes(token string, scopes map[string]string) (bool, error)
}
func Login(user string, password string, userStore UserStore, w http.ResponseWriter, t int) error {
session, loginErr := userStore.InitiateSession(user, password)
session, loginErr := userStore.InitiateSession(user, password, t)
if loginErr == nil {
cookie.StoreToken("user", user, w, t)
cookie.StoreToken("session", session, w, t)

4
cookie/cookie.go
View file

@ -18,11 +18,11 @@ func GenToken(length int) string {
return string(b)
}
func StoreToken(field string, token string, w http.ResponseWriter, hrs int) {
func StoreToken(field string, token string, w http.ResponseWriter, ttl int) {
cookie := http.Cookie{
Name: field,
Value: token,
Expires: time.Now().Add(time.Duration(hrs) * time.Hour),
Expires: time.Now().Add(time.Duration(ttl) * time.Minute),
}
http.SetCookie(w, &cookie)

45
indentalUserDB/indentalUserDB.go
View file

@ -9,6 +9,7 @@ import (
"nilfm.cc/git/quartzgun/cookie"
"os"
"strings"
"strconv"
"time"
)
@ -36,7 +37,7 @@ func CreateIndentalUserDB(filePath string) *IndentalUserDB {
}
}
func (self *IndentalUserDB) InitiateSession(user string, password string) (string, error) {
func (self *IndentalUserDB) InitiateSession(user string, password string, ttl int) (string, error) {
if _, exists := self.Users[user]; !exists {
return "", errors.New("User not in DB")
}
@ -47,30 +48,25 @@ func (self *IndentalUserDB) InitiateSession(user string, password string) (strin
self.Users[user].Session = sessionId
self.Users[user].LoginTime = time.Now()
self.Users[user].LastSeen = time.Now()
self.SetData(user, "token_expiry", strconv.Itoa(ttl))
writeDB(self.Basis, self.Users)
return sessionId, nil
}
func (self *IndentalUserDB) GrantToken(user, password, scope string, minutes int) (string, error) {
func (self *IndentalUserDB) GrantToken(user, password string, ttl int) (string, error) {
if _, exists := self.Users[user]; !exists {
return "", errors.New("User not in DB")
}
if bcrypt.CompareHashAndPassword([]byte(self.Users[user].Pass), []byte(password)) != nil {
return "", errors.New("Incorrect password")
}
s, err := self.GetData(user, "scope")
if err == nil && s == scope {
sessionId := cookie.GenToken(64)
self.Users[user].Session = sessionId
self.Users[user].LoginTime = time.Now()
self.Users[user].LastSeen = time.Now()
self.SetData(user, "token_expiry", time.Now().Add(time.Minute*time.Duration(minutes)).Format(timeFmt))
writeDB(self.Basis, self.Users)
return base64.StdEncoding.EncodeToString([]byte(user + "\n" + sessionId)), nil
}
return "", errors.New("Incorrect scope for this user")
sessionId := cookie.GenToken(64)
self.Users[user].Session = sessionId
self.Users[user].LoginTime = time.Now()
self.Users[user].LastSeen = time.Now()
self.SetData(user, "token_expiry", strconv.Itoa(ttl))
writeDB(self.Basis, self.Users)
return base64.StdEncoding.EncodeToString([]byte(user + "\n" + sessionId)), nil
}
func (self *IndentalUserDB) ValidateUser(user string, sessionId string) (bool, error) {
@ -79,10 +75,18 @@ func (self *IndentalUserDB) ValidateUser(user string, sessionId string) (bool, e
}
validated := self.Users[user].Session == sessionId
expiry, err3 := self.GetData(user, "token_expiry")
expiryInt, err4 := strconv.ParseInt(expiry.(string), 10, 64)
expiryTime := self.Users[user].LastSeen.Add(time.Minute * time.Duration(expiryInt))
if validated {
if err3 == nil && err4 == nil && time.Now().After(expiryTime) {
self.EndSession(user)
return true, errors.New("Cookie or token expired")
} else {
self.Users[user].LastSeen = time.Now()
writeDB(self.Basis, self.Users)
}
}
return validated, nil
}
@ -92,14 +96,7 @@ func (self *IndentalUserDB) ValidateToken(token string) (bool, error) {
if err == nil {
parts := strings.Split(string(data), "\n")
if len(parts) == 2 {
expiry, err3 := self.GetData(parts[0], "token_expiry")
expiryTime, err4 := time.Parse(timeFmt, expiry.(string))
if err3 == nil && err4 == nil && time.Now().After(expiryTime) {
self.EndSession(parts[0])
return false, errors.New("token has expired")
} else {
return self.ValidateUser(parts[0], parts[1])
}
return self.ValidateUser(parts[0], parts[1])
}
}
return false, errors.New("Token was not in a valid format: b64(USER\nSESSION)")
@ -212,7 +209,7 @@ func (self *IndentalUserDB) GetData(user string, key string) (interface{}, error
}
data, exists := self.Users[user].Data[key]
if !exists {
return nil, errors.New("No data key for user")
return nil, errors.New("Key not found in user data")
}
return data, nil

15
middleware/middleware.go
View file

@ -29,6 +29,8 @@ func Protected(next http.Handler, method string, userStore auth.UserStore, login
req.Method = method
next.ServeHTTP(w, req)
return
} else if err != nil && err.Error() == "Cookie or token expired"{
auth.Logout(user, userStore, w)
}
}
}
@ -60,14 +62,14 @@ func Bunt(next string, userStore auth.UserStore, denied string) http.Handler {
return http.HandlerFunc(handlerFunc)
}
func Authorize(next string, userStore auth.UserStore, denied string) http.Handler {
func Authorize(next string, userStore auth.UserStore, denied string, ttl int) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
err := auth.Login(
req.FormValue("user"),
req.FormValue("password"),
userStore,
w,
24*7*52)
ttl)
if err == nil {
req.Method = http.MethodGet
fmt.Printf("logged in as %s\n", req.FormValue("user"))
@ -82,17 +84,16 @@ func Authorize(next string, userStore auth.UserStore, denied string) http.Handle
return http.HandlerFunc(handlerFunc)
}
func Provision(userStore auth.UserStore, minutes int) http.Handler {
func Provision(userStore auth.UserStore, ttl int) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
user, password, ok := req.BasicAuth()
scope := req.FormValue("scope")
if ok && scope != "" {
token, err := userStore.GrantToken(user, password, scope, minutes)
if ok {
token, err := userStore.GrantToken(user, password, ttl)
if err == nil {
token := TokenPayload{
access_token: token,
token_type: "bearer",
expires_in: minutes,
expires_in: ttl,
}
util.AddContextValue(req, "token", token)
renderer.JSON("token").ServeHTTP(w, req)

4
quartzgun_test.go
View file

@ -34,7 +34,7 @@ func ApiSomething(next http.Handler) http.Handler {
func TestMain(m *testing.M) {
udb := indentalUserDB.CreateIndentalUserDB("testData/userDB.ndtl")
udb.AddUser("nilix", "questing")
sesh, _ := udb.InitiateSession("nilix", "questing")
sesh, _ := udb.InitiateSession("nilix", "questing", 60)
fmt.Printf("%s // %s\n", sesh, sesh)
rtr := &router.Router{
@ -47,7 +47,7 @@ func TestMain(m *testing.M) {
rtr.Get("/login", renderer.Template(
"testData/templates/login.html"))
rtr.Post("/login", middleware.Authorize("/", udb, "/login?tryagain=1"))
rtr.Post("/login", middleware.Authorize("/", udb, "/login?tryagain=1", 120))
rtr.Get("/", middleware.Protected(
renderer.Template(