@pgpm/totp 0.21.0 → 0.22.0

package/Makefile

@@ -1,5 +1,5 @@
 EXTENSION = pgpm-totp
-DATA = sql/pgpm-totp--0.15.3.sql
+DATA = sql/pgpm-totp--0.15.5.sql
 
 PG_CONFIG = pg_config
 PGXS := $(shell $(PG_CONFIG) --pgxs)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpm/totp",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Time-based One-Time Password (TOTP) authentication",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "contributors": [
@@ -21,11 +21,11 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@pgpm/base32": "0.21.0",
-    "@pgpm/verify": "0.21.0"
+    "@pgpm/base32": "0.22.0",
+    "@pgpm/verify": "0.22.0"
   },
   "devDependencies": {
-    "pgpm": "^4.2.3"
+    "pgpm": "^4.23.2"
   },
   "repository": {
     "type": "git",
@@ -35,5 +35,5 @@
   "bugs": {
     "url": "https://github.com/constructive-io/pgpm-modules/issues"
   },
-  "gitHead": "f79dd69a3f7bac456bbd4474262b0ccbdb3e66a3"
+  "gitHead": "96ae0195a8b3a3dd056808c344f0e3c31a199e5e"
 }

package/sql/pgpm-totp--0.15.5.sql

@@ -0,0 +1,217 @@
+\echo Use "CREATE EXTENSION pgpm-totp" to load this file. \quit
+CREATE SCHEMA totp;
+
+CREATE FUNCTION totp.urlencode(
+  in_str text
+) RETURNS text AS $EOFCODE$
+DECLARE
+  _i int4;
+  _temp varchar;
+  _ascii int4;
+  _result text := '';
+BEGIN
+  FOR _i IN 1..length(in_str)
+  LOOP
+    _temp := substr(in_str, _i, 1);
+    IF _temp ~ '[0-9a-zA-Z:/@._?#-]+' THEN
+      _result := _result || _temp;
+    ELSE
+      _ascii := ascii(_temp);
+      IF _ascii > x'07ff'::int4 THEN
+        RAISE exception 'won''t deal with 3 (or more) byte sequences.';
+      END IF;
+      IF _ascii <= x'07f'::int4 THEN
+        _temp := '%' || to_hex(_ascii);
+      ELSE
+        _temp := '%' || to_hex((_ascii & x'03f'::int4) + x'80'::int4);
+        _ascii := _ascii >> 6;
+        _temp := '%' || to_hex((_ascii & x'01f'::int4) + x'c0'::int4) || _temp;
+      END IF;
+      _result := _result || upper(_temp);
+    END IF;
+  END LOOP;
+  RETURN _result;
+END;
+$EOFCODE$ LANGUAGE plpgsql STRICT IMMUTABLE;
+
+CREATE FUNCTION totp.pad_secret(
+  input bytea,
+  len int
+) RETURNS bytea AS $EOFCODE$
+DECLARE 
+  output bytea;
+  orig_length int = octet_length(input);
+BEGIN
+  IF (orig_length = len) THEN 
+    RETURN input;
+  END IF;
+
+  -- create blank bytea size of new length
+  output = lpad('', len, 'x')::bytea;
+
+  FOR i IN 0 .. len-1 LOOP
+    output = set_byte(output, i, get_byte(input, i % orig_length));
+  END LOOP;
+
+  RETURN output;
+END;
+$EOFCODE$ LANGUAGE plpgsql IMMUTABLE;
+
+CREATE FUNCTION totp.base32_to_hex(
+  input text
+) RETURNS text AS $EOFCODE$
+DECLARE 
+  output text[];
+  decoded text = base32.decode(input);
+  len int = character_length(decoded);
+  hx text;
+BEGIN
+
+  FOR i IN 1 .. len LOOP
+    hx = to_hex(ascii(substring(decoded from i for 1)))::text;
+    IF (character_length(hx) = 1) THEN 
+        -- if it is odd number of digits, pad a 0 so it can later 
+    		hx = '0' || hx;	
+    END IF;
+    output = array_append(output, hx);
+  END LOOP;
+
+  RETURN array_to_string(output, '');
+END;
+$EOFCODE$ LANGUAGE plpgsql IMMUTABLE;
+
+CREATE FUNCTION totp.hotp(
+  key bytea,
+  c int,
+  digits int DEFAULT 6,
+  hash text DEFAULT 'sha1'
+) RETURNS text AS $EOFCODE$
+DECLARE
+    c BYTEA := '\x' || LPAD(TO_HEX(c), 16, '0');
+    mac BYTEA := HMAC(c, key, hash);
+    trunc_offset INT := GET_BYTE(mac, length(mac) - 1) % 16;
+    result TEXT := SUBSTRING(SET_BIT(SUBSTRING(mac FROM 1 + trunc_offset FOR 4), 7, 0)::TEXT, 2)::BIT(32)::INT % (10 ^ digits)::INT;
+BEGIN
+    RETURN LPAD(result, digits, '0');
+END;
+$EOFCODE$ LANGUAGE plpgsql IMMUTABLE;
+
+CREATE FUNCTION totp.generate(
+  secret text,
+  period int DEFAULT 30,
+  digits int DEFAULT 6,
+  time_from timestamptz DEFAULT now(),
+  hash text DEFAULT 'sha1',
+  encoding text DEFAULT 'base32',
+  clock_offset int DEFAULT 0
+) RETURNS text AS $EOFCODE$
+DECLARE
+    c int := FLOOR(EXTRACT(EPOCH FROM time_from) / period)::int + clock_offset;
+    key bytea;
+BEGIN
+
+  IF (encoding = 'base32') THEN 
+    key = ( '\x' || totp.base32_to_hex(secret) )::bytea;
+  ELSE 
+    key = secret::bytea;
+  END IF;
+
+  RETURN totp.hotp(key, c, digits, hash);
+END;
+$EOFCODE$ LANGUAGE plpgsql STABLE;
+
+CREATE FUNCTION totp.timing_safe_equals(
+  a bytea,
+  b bytea
+) RETURNS boolean AS $EOFCODE$
+DECLARE
+  la int := length(a);
+  lb int := length(b);
+  maxlen int := GREATEST(la, lb);
+  i int;
+  diff int := la # lb;
+  ca int;
+  cb int;
+BEGIN
+  FOR i IN 0..(maxlen - 1) LOOP
+    ca := CASE WHEN i < la THEN get_byte(a, i) ELSE 0 END;
+    cb := CASE WHEN i < lb THEN get_byte(b, i) ELSE 0 END;
+    diff := diff | (ca # cb);
+  END LOOP;
+  RETURN diff = 0;
+END;
+$EOFCODE$ LANGUAGE plpgsql IMMUTABLE STRICT;
+
+CREATE FUNCTION totp.timing_safe_equals(
+  a text,
+  b text
+) RETURNS boolean AS $EOFCODE$
+-- Verify uses timing-safe equality to avoid leaking mismatch position via timing; do not use direct '=' here.
+-- See HN discussion for background: https://news.ycombinator.com/item?id=26260667
+
+  SELECT totp.timing_safe_equals(convert_to(a, 'UTF8'), convert_to(b, 'UTF8'));
+$EOFCODE$ LANGUAGE sql IMMUTABLE STRICT;
+
+CREATE FUNCTION totp.verify(
+  secret text,
+  check_totp text,
+  period int DEFAULT 30,
+  digits int DEFAULT 6,
+  time_from timestamptz DEFAULT now(),
+  hash text DEFAULT 'sha1',
+  encoding text DEFAULT 'base32',
+  clock_offset int DEFAULT 0
+) RETURNS boolean AS $EOFCODE$
+  SELECT totp.timing_safe_equals(
+    totp.generate(
+      secret,
+      period,
+      digits,
+      time_from,
+      hash,
+      encoding,
+      clock_offset
+    ),
+    check_totp
+  );
+$EOFCODE$ LANGUAGE sql;
+
+CREATE FUNCTION totp.url(
+  email text,
+  totp_secret text,
+  totp_interval int,
+  totp_issuer text
+) RETURNS text AS $EOFCODE$
+  SELECT
+    concat('otpauth://totp/', totp.urlencode (email), '?secret=', totp.urlencode (totp_secret), '&period=', totp.urlencode (totp_interval::text), '&issuer=', totp.urlencode (totp_issuer));
+$EOFCODE$ LANGUAGE sql STRICT IMMUTABLE;
+
+CREATE FUNCTION totp.random_base32(
+  _length int DEFAULT 20
+) RETURNS text LANGUAGE sql AS $EOFCODE$
+  SELECT
+    string_agg(
+      ('{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,2,3,4,5,6,7}'::text[])
+      [ (get_byte(b, i) % 32) + 1 ],
+      ''
+    )
+  FROM (SELECT gen_random_bytes(_length) AS b) t,
+       LATERAL generate_series(0, _length - 1) g(i);
+$EOFCODE$;
+
+CREATE FUNCTION totp.generate_secret(
+  hash text DEFAULT 'sha1'
+) RETURNS bytea AS $EOFCODE$
+BEGIN
+    -- See https://tools.ietf.org/html/rfc4868#section-2.1.2
+    -- The optimal key length for HMAC is the block size of the algorithm
+    CASE
+          WHEN hash = 'sha1'   THEN RETURN totp.random_base32(20); -- = 160 bits
+          WHEN hash = 'sha256' THEN RETURN totp.random_base32(32); -- = 256 bits
+          WHEN hash = 'sha512' THEN RETURN totp.random_base32(64); -- = 512 bits
+          ELSE
+            RAISE EXCEPTION 'Unsupported hash algorithm for OTP (see RFC6238/4226).';
+            RETURN NULL;
+    END CASE;
+END;
+$EOFCODE$ LANGUAGE plpgsql VOLATILE;