rubydb 0.1.0

data/lib/rubydb/security/authentication.rb

@@ -0,0 +1,302 @@
+# frozen_string_literal: true
+
+require "digest"
+require "securerandom"
+require "time"
+require "base64"
+require "openssl"
+
+module RubyDB
+  module Security
+    # Authentication - Handles user authentication
+    class Authentication
+      attr_reader :stats
+
+      # Authentication methods
+      METHOD_NONE = :none
+      METHOD_PASSWORD = :password
+      METHOD_MD5 = :md5
+      METHOD_SCRAM_SHA256 = :scram_sha256
+      METHOD_TOKEN = :token
+      METHOD_CERTIFICATE = :certificate
+
+      def initialize(config = {})
+        @config = config
+        @method = config[:method] || METHOD_PASSWORD
+        @session_timeout = config[:session_timeout] || 3600
+        @max_attempts = config[:max_attempts] || 5
+        @lockout_duration = config[:lockout_duration] || 900
+        @user_store = config[:user_store] || {}
+        @sessions = {}
+        @failed_attempts = {}
+        @locked_users = {}
+        @tokens = {}
+        @stats = {
+          authentications: 0,
+          successful: 0,
+          failed: 0,
+          lockouts: 0,
+          active_sessions: 0,
+          token_issued: 0,
+          token_validated: 0
+        }
+        @lock = Mutex.new
+      end
+
+      def authenticate(credentials)
+        @lock.synchronize do
+          @stats[:authentications] += 1
+          username = credentials[:username]
+          password = credentials[:password]
+
+          # Check if user is locked out
+          if locked_out?(username)
+            @stats[:failed] += 1
+            return { success: false, error: "User is locked out" }
+          end
+
+          # Find user
+          user = find_user(username)
+          unless user
+            record_failed_attempt(username)
+            @stats[:failed] += 1
+            return { success: false, error: "Invalid credentials" }
+          end
+
+          # Authenticate based on method
+          authenticated = case @method
+          when METHOD_NONE
+            true
+          when METHOD_PASSWORD
+            authenticate_password(user, password)
+          when METHOD_MD5
+            authenticate_md5(user, password, credentials[:salt])
+          when METHOD_SCRAM_SHA256
+            authenticate_scram(user, credentials[:scram_data])
+          when METHOD_TOKEN
+            authenticate_token(user, credentials[:token])
+          when METHOD_CERTIFICATE
+            authenticate_certificate(user, credentials[:certificate])
+          else
+            authenticate_password(user, password)
+          end
+
+          if authenticated
+            # Create session
+            session = create_session(user)
+            @stats[:successful] += 1
+            @failed_attempts.delete(username)
+
+            {
+              success: true,
+              user: user,
+              session: session,
+              token: session[:token]
+            }
+          else
+            record_failed_attempt(username)
+            @stats[:failed] += 1
+            { success: false, error: "Invalid credentials" }
+          end
+        end
+      end
+
+      def validate_session(token)
+        @lock.synchronize do
+          @stats[:token_validated] += 1
+
+          session = @sessions[token]
+          return false unless session
+
+          # Check if session expired
+          if Time.now - session[:created_at] > @session_timeout
+            @sessions.delete(token)
+            return false
+          end
+
+          # Update last activity
+          session[:last_activity] = Time.now
+          true
+        end
+      end
+
+      def invalidate_session(token)
+        @lock.synchronize do
+          @sessions.delete(token)
+        end
+      end
+
+      def invalidate_all_sessions(username)
+        @lock.synchronize do
+          @sessions.delete_if { |_, s| s[:username] == username }
+        end
+      end
+
+      def create_token(username, expires_in = 3600)
+        @lock.synchronize do
+          @stats[:token_issued] += 1
+          token = generate_token(username)
+          @tokens[token] = {
+            username: username,
+            created_at: Time.now,
+            expires_at: Time.now + expires_in
+          }
+          token
+        end
+      end
+
+      def validate_token(token)
+        @lock.synchronize do
+          token_data = @tokens[token]
+          return false unless token_data
+
+          if Time.now > token_data[:expires_at]
+            @tokens.delete(token)
+            return false
+          end
+
+          token_data[:username]
+        end
+      end
+
+      def revoke_token(token)
+        @lock.synchronize do
+          @tokens.delete(token)
+        end
+      end
+
+      def stats
+        @lock.synchronize do
+          @stats.merge({
+            method: @method,
+            session_timeout: @session_timeout,
+            active_sessions: @sessions.size,
+            locked_users: @locked_users.size,
+            tokens: @tokens.size
+          })
+        end
+      end
+
+      private
+
+      def find_user(username)
+        @user_store[username]
+      end
+
+      def authenticate_password(user, password)
+        return false unless user && password
+        user.password_hash == hash_password(password, user.salt)
+      end
+
+      def authenticate_md5(user, password, salt)
+        return false unless user && password
+        expected = Digest::MD5.hexdigest(password + salt)
+        expected == user.password_hash
+      end
+
+      def authenticate_scram(user, scram_data)
+        return false unless user && scram_data
+        verify_scram_response(user, scram_data)
+      end
+
+      def authenticate_token(user, token)
+        return false unless user && token
+        user.token == token
+      end
+
+      def authenticate_certificate(user, certificate)
+        return false unless user && certificate
+        user.certificate == certificate
+      end
+
+      def create_session(user)
+        token = generate_token(user.username)
+        session = {
+          username: user.username,
+          created_at: Time.now,
+          last_activity: Time.now,
+          token: token,
+          user: user
+        }
+        @sessions[token] = session
+        @stats[:active_sessions] = @sessions.size
+        session
+      end
+
+      def generate_token(username)
+        "#{username}_#{Time.now.to_i}_#{SecureRandom.hex(16)}"
+      end
+
+      def hash_password(password, salt)
+        Digest::SHA256.hexdigest(salt + password)
+      end
+
+      def record_failed_attempt(username)
+        @failed_attempts[username] ||= 0
+        @failed_attempts[username] += 1
+
+        if @failed_attempts[username] >= @max_attempts
+          @locked_users[username] = Time.now + @lockout_duration
+          @stats[:lockouts] += 1
+        end
+      end
+
+      def locked_out?(username)
+        lock_expiry = @locked_users[username]
+        return false unless lock_expiry
+
+        if Time.now > lock_expiry
+          @locked_users.delete(username)
+          @failed_attempts.delete(username)
+          return false
+        end
+
+        true
+      end
+
+      def verify_scram_response(user, scram_data)
+        return false unless scram_data.is_a?(Hash)
+
+        value = ->(key) { scram_data[key] || scram_data[key.to_s] }
+        client_first = value.call(:client_first_bare)
+        server_first = value.call(:server_first)
+        client_final = value.call(:client_final_without_proof)
+        proof = value.call(:proof)
+        return false if [client_first, server_first, client_final, proof].any?(&:nil?)
+
+        metadata = user.metadata || {}
+        salt_value = metadata[:scram_salt] || metadata["scram_salt"]
+        iterations = Integer(metadata[:scram_iterations] || metadata["scram_iterations"] || 120_000)
+        stored_value = metadata[:scram_stored_key] || metadata["scram_stored_key"]
+        server_value = metadata[:scram_server_key] || metadata["scram_server_key"]
+        return false unless salt_value && stored_value && server_value
+
+        salt = salt_value.is_a?(String) ? Base64.decode64(salt_value) : salt_value
+        stored_key = decode_scram_value(stored_value)
+        server_key = decode_scram_value(server_value)
+        auth_message = [client_first, server_first, client_final].join(",")
+        signature = OpenSSL::HMAC.digest("SHA256", stored_key, auth_message)
+        proof_bytes = Base64.decode64(proof.to_s)
+        client_key = proof_bytes.bytes.each_with_index.map { |byte, index| byte ^ signature.getbyte(index) }.pack("C*")
+        secure_compare(Digest::SHA256.digest(client_key), stored_key)
+      rescue ArgumentError, TypeError
+        false
+      end
+
+      def decode_scram_value(value)
+        return value if value.is_a?(String) && value.bytesize == 32 && value !~ /\A[A-Za-z0-9+\/=]+\z/
+
+        decoded = Base64.decode64(value.to_s)
+        decoded.bytesize == 32 ? decoded : value.to_s
+      end
+
+      def secure_compare(left, right)
+        return false unless left.bytesize == right.bytesize
+
+        result = 0
+        left.bytes.each_with_index { |byte, index| result |= byte ^ right.getbyte(index) }
+        result.zero?
+      end
+    end
+  end
+end

data/lib/rubydb/security/authorization.rb

@@ -0,0 +1,282 @@
+# frozen_string_literal: true
+
+module RubyDB
+  module Security
+    # Authorization - Handles permission checking
+    class Authorization
+      attr_reader :stats
+
+      # Permission actions
+      ACTION_SELECT = :select
+      ACTION_INSERT = :insert
+      ACTION_UPDATE = :update
+      ACTION_DELETE = :delete
+      ACTION_CREATE = :create
+      ACTION_DROP = :drop
+      ACTION_ALTER = :alter
+      ACTION_INDEX = :index
+      ACTION_GRANT = :grant
+      ACTION_REVOKE = :revoke
+      ACTION_EXECUTE = :execute
+      ACTION_CONNECT = :connect
+      ACTION_USAGE = :usage
+
+      # Object types
+      OBJECT_TABLE = :table
+      OBJECT_VIEW = :view
+      OBJECT_INDEX = :index
+      OBJECT_DATABASE = :database
+      OBJECT_SCHEMA = :schema
+      OBJECT_FUNCTION = :function
+      OBJECT_SEQUENCE = :sequence
+      OBJECT_TRIGGER = :trigger
+
+      def initialize(config = {})
+        @config = config
+        @default_deny = config[:default_deny] || true
+        @permissions = {}
+        @roles = {}
+        @user_roles = {}
+        @grant_options = {}
+        @stats = {
+          checks: 0,
+          granted: 0,
+          denied: 0,
+          role_checks: 0,
+          cache_hits: 0,
+          cache_misses: 0
+        }
+        @cache = {}
+        @cache_size = config[:cache_size] || 10000
+        @lock = Mutex.new
+      end
+
+      def authorize(user, action, object, object_type = OBJECT_TABLE)
+        @lock.synchronize do
+          @stats[:checks] += 1
+
+          # Check cache
+          cache_key = "#{user.username}:#{action}:#{object}:#{object_type}"
+          if @cache.key?(cache_key)
+            @stats[:cache_hits] += 1
+            return @cache[cache_key]
+          end
+
+          @stats[:cache_misses] += 1
+
+          # Check if user is superuser
+          if user.superuser?
+            @cache[cache_key] = true
+            @stats[:granted] += 1
+            return true
+          end
+
+          # Check user permissions directly
+          if check_user_permission(user, action, object, object_type)
+            @cache[cache_key] = true
+            @stats[:granted] += 1
+            return true
+          end
+
+          # Check role permissions
+          roles = get_user_roles(user)
+          roles.each do |role|
+            if check_role_permission(role, action, object, object_type)
+              @cache[cache_key] = true
+              @stats[:granted] += 1
+              return true
+            end
+          end
+
+          # Check if permission is granted to PUBLIC
+          if check_public_permission(action, object, object_type)
+            @cache[cache_key] = true
+            @stats[:granted] += 1
+            return true
+          end
+
+          # Default deny
+          @cache[cache_key] = false if @cache.size < @cache_size
+          @stats[:denied] += 1
+          false
+        end
+      end
+
+      def grant_permission(user, action, object, object_type = OBJECT_TABLE, options = {})
+        @lock.synchronize do
+          key = permission_key(action, object, object_type)
+          @permissions[key] ||= { users: [], roles: [], public: false }
+
+          if options[:grantor]
+            @grant_options[key] ||= {}
+            @grant_options[key][:grantor] = options[:grantor]
+          end
+
+          if options[:grant_option]
+            @grant_options[key] ||= {}
+            @grant_options[key][:grant_option] = true
+          end
+
+          if options[:role]
+            @permissions[key][:roles] << options[:role]
+          elsif options[:public]
+            @permissions[key][:public] = true
+          else
+            @permissions[key][:users] << user.username
+          end
+
+          invalidate_cache
+          true
+        end
+      end
+
+      def revoke_permission(user, action, object, object_type = OBJECT_TABLE, options = {})
+        @lock.synchronize do
+          key = permission_key(action, object, object_type)
+          perms = @permissions[key]
+          return false unless perms
+
+          if options[:role]
+            perms[:roles].delete(options[:role])
+          elsif options[:public]
+            perms[:public] = false
+          else
+            perms[:users].delete(user.username)
+          end
+
+          @permissions.delete(key) if perms[:users].empty? && perms[:roles].empty? && !perms[:public]
+          invalidate_cache
+          true
+        end
+      end
+
+      def add_role(role_name, parent_role = nil)
+        @lock.synchronize do
+          @roles[role_name] ||= { name: role_name, parent: parent_role }
+          if parent_role
+            @roles[parent_role] ||= { name: parent_role, parent: nil }
+          end
+          true
+        end
+      end
+
+      def remove_role(role_name)
+        @lock.synchronize do
+          @roles.delete(role_name)
+          @user_roles.each do |user, roles|
+            roles.delete(role_name)
+          end
+          invalidate_cache
+          true
+        end
+      end
+
+      def assign_role(user, role_name)
+        @lock.synchronize do
+          @user_roles[user.username] ||= []
+          @user_roles[user.username] << role_name unless @user_roles[user.username].include?(role_name)
+          invalidate_cache
+          true
+        end
+      end
+
+      def revoke_role(user, role_name)
+        @lock.synchronize do
+          return false unless @user_roles[user.username]
+          @user_roles[user.username].delete(role_name)
+          invalidate_cache
+          true
+        end
+      end
+
+      def get_user_roles(user)
+        @lock.synchronize do
+          @stats[:role_checks] += 1
+          roles = @user_roles[user.username] || []
+          # Get parent roles recursively
+          all_roles = []
+          roles.each do |role|
+            all_roles << role
+            all_roles.concat(get_parent_roles(role))
+          end
+          all_roles.uniq
+        end
+      end
+
+      def permissions_for_user(user)
+        @lock.synchronize do
+          result = []
+          @permissions.each do |key, perms|
+            if perms[:users].include?(user.username)
+              result << key
+            elsif perms[:public]
+              result << key
+            elsif (perms[:roles] & get_user_roles(user)).any?
+              result << key
+            end
+          end
+          result
+        end
+      end
+
+      def clear_cache
+        @lock.synchronize do
+          @cache.clear
+        end
+      end
+
+      def stats
+        @lock.synchronize do
+          @stats.merge({
+            permissions: @permissions.size,
+            roles: @roles.size,
+            user_roles: @user_roles.size,
+            cache_size: @cache.size,
+            default_deny: @default_deny
+          })
+        end
+      end
+
+      private
+
+      def permission_key(action, object, object_type)
+        "#{action}:#{object_type}:#{object}"
+      end
+
+      def check_user_permission(user, action, object, object_type)
+        key = permission_key(action, object, object_type)
+        perms = @permissions[key]
+        return false unless perms
+        perms[:users].include?(user.username)
+      end
+
+      def check_role_permission(role, action, object, object_type)
+        key = permission_key(action, object, object_type)
+        perms = @permissions[key]
+        return false unless perms
+        perms[:roles].include?(role[:name])
+      end
+
+      def check_public_permission(action, object, object_type)
+        key = permission_key(action, object, object_type)
+        perms = @permissions[key]
+        return false unless perms
+        perms[:public]
+      end
+
+      def get_parent_roles(role_name)
+        roles = []
+        current = @roles[role_name]
+        while current && current[:parent]
+          roles << current[:parent]
+          current = @roles[current[:parent]]
+        end
+        roles
+      end
+
+      def invalidate_cache
+        @cache.clear if @cache.size > @cache_size
+      end
+    end
+  end
+end