@feltdb/core 0.4.11 → 0.4.13

package/dist/create/server-source/crates/feltdb-server/src/sessions.rs

@@ -0,0 +1,156 @@
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::{
+    collections::HashSet,
+    fs,
+    path::PathBuf,
+    sync::{Arc, RwLock},
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct HumanSession {
+    pub version: u32,
+    pub id: String,
+    pub user_id: String,
+    pub identity: String,
+    pub tenant_id: String,
+    pub issued_at: u64,
+    pub expires_at: u64,
+    pub auth_method: String,
+}
+
+#[derive(Clone)]
+pub struct SessionVerifier {
+    secret: Arc<[u8]>,
+    revoked_path: PathBuf,
+    revoked: Arc<RwLock<HashSet<String>>>,
+}
+
+fn hmac(secret: &[u8], message: &[u8]) -> [u8; 32] {
+    let mut key = [0u8; 64];
+    if secret.len() > 64 {
+        key[..32].copy_from_slice(&Sha256::digest(secret));
+    } else {
+        key[..secret.len()].copy_from_slice(secret);
+    }
+    let mut inner_pad = [0x36u8; 64];
+    let mut outer_pad = [0x5cu8; 64];
+    for index in 0..64 {
+        inner_pad[index] ^= key[index];
+        outer_pad[index] ^= key[index];
+    }
+    let inner = Sha256::new()
+        .chain_update(inner_pad)
+        .chain_update(message)
+        .finalize();
+    Sha256::new()
+        .chain_update(outer_pad)
+        .chain_update(inner)
+        .finalize()
+        .into()
+}
+fn constant_time_equal(left: &[u8], right: &[u8]) -> bool {
+    if left.len() != right.len() {
+        return false;
+    }
+    left.iter()
+        .zip(right)
+        .fold(0u8, |difference, (left, right)| difference | (left ^ right))
+        == 0
+}
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+impl SessionVerifier {
+    pub fn load(
+        secret: impl Into<Vec<u8>>,
+        revoked_path: impl Into<PathBuf>,
+    ) -> Result<Self, String> {
+        let secret = secret.into();
+        if secret.len() < 32 {
+            return Err("FELTDB_SESSION_SECRET must contain at least 32 bytes".into());
+        }
+        let revoked_path = revoked_path.into();
+        let revoked = if revoked_path.exists() {
+            serde_json::from_slice(&fs::read(&revoked_path).map_err(|error| error.to_string())?)
+                .map_err(|error| error.to_string())?
+        } else {
+            HashSet::new()
+        };
+        Ok(Self {
+            secret: secret.into(),
+            revoked_path,
+            revoked: Arc::new(RwLock::new(revoked)),
+        })
+    }
+    pub fn verify(&self, token: &str) -> Option<HumanSession> {
+        let (payload, supplied) = token.split_once('.')?;
+        let supplied = URL_SAFE_NO_PAD.decode(supplied).ok()?;
+        if !constant_time_equal(&hmac(&self.secret, payload.as_bytes()), &supplied) {
+            return None;
+        }
+        let session: HumanSession =
+            serde_json::from_slice(&URL_SAFE_NO_PAD.decode(payload).ok()?).ok()?;
+        if session.version != 2
+            || session.expires_at <= now()
+            || self.revoked.read().ok()?.contains(&session.id)
+        {
+            return None;
+        }
+        Some(session)
+    }
+    pub fn revoke(&self, session_id: &str) -> Result<(), String> {
+        let mut revoked = self
+            .revoked
+            .write()
+            .map_err(|_| "session revocation lock poisoned")?;
+        revoked.insert(session_id.into());
+        if let Some(parent) = self.revoked_path.parent() {
+            fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+        }
+        fs::write(
+            &self.revoked_path,
+            serde_json::to_vec(&*revoked).map_err(|error| error.to_string())?,
+        )
+        .map_err(|error| error.to_string())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn token(secret: &[u8], session: &HumanSession) -> String {
+        let payload = URL_SAFE_NO_PAD.encode(serde_json::to_vec(session).unwrap());
+        format!(
+            "{payload}.{}",
+            URL_SAFE_NO_PAD.encode(hmac(secret, payload.as_bytes()))
+        )
+    }
+    #[test]
+    fn verifies_expires_and_revokes_sessions() {
+        let secret = b"01234567890123456789012345678901";
+        let path = std::env::temp_dir().join(format!("feltdb-revoked-{}.json", now()));
+        let verifier = SessionVerifier::load(secret.to_vec(), path).unwrap();
+        let session = HumanSession {
+            version: 2,
+            id: "session_1".into(),
+            user_id: "user_1".into(),
+            identity: "user@example.com".into(),
+            tenant_id: "tenant_1".into(),
+            issued_at: now(),
+            expires_at: now() + 60,
+            auth_method: "password".into(),
+        };
+        let signed = token(secret, &session);
+        assert_eq!(verifier.verify(&signed).unwrap().user_id, "user_1");
+        verifier.revoke("session_1").unwrap();
+        assert!(verifier.verify(&signed).is_none());
+    }
+}