pixie-lab-dibs 0.1.0__py3-none-any.whl

dibs/_users.py

@@ -0,0 +1,251 @@
+# SPDX-FileCopyrightText: Simon A. F. Lund <os@safl.dk>
+#
+# SPDX-License-Identifier: BSD-3-Clause
+
+"""Users, their login tokens, and the one-time login challenges.
+
+A user registers a name and an SSH public key, an admin approves them
+(``dibs admin approve``), and the user then logs in by signing a
+one-time challenge with that key to get a token. Tokens are
+stored as SHA-256 hashes, so a copy of the database does not hand out
+working tokens. A token does not expire; it lasts until the user logs
+out, an admin revokes it, or the user is removed.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import hashlib
+import re
+import secrets
+import sqlite3
+import threading
+from collections.abc import Generator
+from dataclasses import dataclass
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+
+from dibs._sshsig import parse_pubkey, verify
+
+_WRITE_LOCK = threading.Lock()
+
+# Lowercase, like machine names, and safe to write as an
+# ``allowed_signers`` principal (no spaces, quotes or commas).
+USER_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9._-]{0,31}$")
+
+CHALLENGE_TTL = timedelta(seconds=60)
+
+_SCHEMA = """
+CREATE TABLE IF NOT EXISTS users (
+    name           TEXT PRIMARY KEY,
+    pubkey         TEXT NOT NULL,
+    fingerprint    TEXT NOT NULL,
+    status         TEXT NOT NULL,
+    registered_at  TEXT NOT NULL,
+    approved_at    TEXT NOT NULL DEFAULT ''
+);
+CREATE TABLE IF NOT EXISTS user_tokens (
+    token_sha256   TEXT PRIMARY KEY,
+    user           TEXT NOT NULL,
+    created_at     TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS login_challenges (
+    nonce          TEXT PRIMARY KEY,
+    user           TEXT NOT NULL,
+    expires_at     TEXT NOT NULL
+);
+"""
+
+PENDING = "pending"
+APPROVED = "approved"
+
+
+class DuplicateUser(ValueError):
+    pass
+
+
+class NotApproved(PermissionError):
+    pass
+
+
+class LoginFailed(PermissionError):
+    pass
+
+
+@dataclass
+class User:
+    name: str
+    pubkey: str
+    fingerprint: str
+    status: str
+    registered_at: str
+    approved_at: str
+    tokens: int = 0
+
+
+def validate_user_name(raw: str) -> str:
+    name = (raw or "").strip().lower()
+    if not USER_NAME_RE.match(name):
+        raise ValueError(
+            f"user name {name!r} must be a-z / 0-9 / . _ -, start with a letter or digit, "
+            "and be at most 32 chars"
+        )
+    return name
+
+
+def login_message(name: str, nonce: str) -> str:
+    """What the client signs: the purpose and the user as well as the
+    nonce, so the signed text says what it authorises. Moving a login
+    between users is already ruled out by each challenge belonging to
+    one user (see :meth:`UsersStore.login`)."""
+    return f"dibs-login {name} {nonce}"
+
+
+def _ts(at: datetime) -> str:
+    return at.strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _hash(token: str) -> str:
+    return hashlib.sha256(token.encode()).hexdigest()
+
+
+class UsersStore:
+    def __init__(self, db_path: Path) -> None:
+        self.db_path = Path(db_path)
+        with self._conn() as conn:
+            conn.executescript(_SCHEMA)
+
+    @contextlib.contextmanager
+    def _conn(self) -> Generator[sqlite3.Connection]:
+        conn = sqlite3.connect(str(self.db_path))
+        conn.execute("PRAGMA busy_timeout = 5000")
+        conn.row_factory = sqlite3.Row
+        try:
+            yield conn
+            conn.commit()
+        finally:
+            conn.close()
+
+    def _user(self, conn: sqlite3.Connection, name: str) -> User | None:
+        row = conn.execute("SELECT * FROM users WHERE name = ?", (name,)).fetchone()
+        if row is None:
+            return None
+        tokens = conn.execute(
+            "SELECT COUNT(*) FROM user_tokens WHERE user = ?", (name,)
+        ).fetchone()[0]
+        return User(**dict(row), tokens=tokens)
+
+    def get(self, name: str) -> User | None:
+        with self._conn() as conn:
+            return self._user(conn, (name or "").strip().lower())
+
+    def list_users(self) -> list[User]:
+        with self._conn() as conn:
+            names = [r[0] for r in conn.execute("SELECT name FROM users ORDER BY name")]
+            return [u for u in (self._user(conn, n) for n in names) if u is not None]
+
+    def register(self, name: str, pubkey: str, *, now: datetime | None = None) -> User:
+        """Add a pending user. Raises :class:`DuplicateUser` when the
+        name is taken, pending or not."""
+        name = validate_user_name(name)
+        key, fingerprint = parse_pubkey(pubkey)
+        at = _ts(now or datetime.now(UTC))
+        with _WRITE_LOCK, self._conn() as conn:
+            if conn.execute("SELECT 1 FROM users WHERE name = ?", (name,)).fetchone():
+                raise DuplicateUser(f"user {name!r} is already registered")
+            conn.execute(
+                "INSERT INTO users (name, pubkey, fingerprint, status, registered_at) "
+                "VALUES (?, ?, ?, ?, ?)",
+                (name, key, fingerprint, PENDING, at),
+            )
+            user = self._user(conn, name)
+        assert user is not None
+        return user
+
+    def approve(self, name: str, *, now: datetime | None = None) -> User:
+        at = _ts(now or datetime.now(UTC))
+        with _WRITE_LOCK, self._conn() as conn:
+            cur = conn.execute(
+                "UPDATE users SET status = ?, approved_at = ? WHERE name = ? AND status = ?",
+                (APPROVED, at, name, PENDING),
+            )
+            if cur.rowcount == 0:
+                raise LookupError(f"no pending user {name!r}")
+            user = self._user(conn, name)
+        assert user is not None
+        return user
+
+    def remove(self, name: str) -> bool:
+        """Delete a user, pending or approved, with all their tokens."""
+        with _WRITE_LOCK, self._conn() as conn:
+            conn.execute("DELETE FROM user_tokens WHERE user = ?", (name,))
+            conn.execute("DELETE FROM login_challenges WHERE user = ?", (name,))
+            return conn.execute("DELETE FROM users WHERE name = ?", (name,)).rowcount > 0
+
+    def revoke_tokens(self, name: str) -> int:
+        with _WRITE_LOCK, self._conn() as conn:
+            return conn.execute("DELETE FROM user_tokens WHERE user = ?", (name,)).rowcount
+
+    def challenge(self, name: str, *, now: datetime | None = None) -> tuple[str, str]:
+        """``(nonce, message)`` for an approved user to sign. Raises
+        :class:`LookupError` for an unknown user, :class:`NotApproved`
+        for a pending one."""
+        name = validate_user_name(name)
+        at = now or datetime.now(UTC)
+        nonce = secrets.token_urlsafe(32)
+        with _WRITE_LOCK, self._conn() as conn:
+            user = self._user(conn, name)
+            if user is None:
+                raise LookupError(f"no user {name!r}; register first")
+            if user.status != APPROVED:
+                raise NotApproved(f"user {name!r} is waiting for admin approval")
+            conn.execute("DELETE FROM login_challenges WHERE expires_at <= ?", (_ts(at),))
+            conn.execute(
+                "INSERT INTO login_challenges (nonce, user, expires_at) VALUES (?, ?, ?)",
+                (nonce, name, _ts(at + CHALLENGE_TTL)),
+            )
+        return nonce, login_message(name, nonce)
+
+    def login(self, name: str, nonce: str, signature: str, *, now: datetime | None = None) -> str:
+        """Check ``signature`` over the challenge and return a new token.
+        The challenge is used up by the attempt, good or bad, so a
+        captured signature cannot be replayed. Raises
+        :class:`LoginFailed` with a reason the caller may show."""
+        name = validate_user_name(name)
+        at = _ts(now or datetime.now(UTC))
+        with _WRITE_LOCK, self._conn() as conn:
+            row = conn.execute(
+                "DELETE FROM login_challenges WHERE nonce = ? AND user = ? RETURNING expires_at",
+                (nonce, name),
+            ).fetchone()
+            user = self._user(conn, name)
+        if row is None or row["expires_at"] <= at:
+            raise LoginFailed("challenge unknown, used or expired; log in again")
+        if user is None or user.status != APPROVED:
+            raise LoginFailed(f"user {name!r} is not approved")
+        message = login_message(name, nonce)
+        if not verify(principal=name, key=user.pubkey, message=message, signature=signature):
+            raise LoginFailed(f"signature does not match the key registered for {name!r}")
+        token = "dibs_" + secrets.token_urlsafe(32)
+        with _WRITE_LOCK, self._conn() as conn:
+            conn.execute(
+                "INSERT INTO user_tokens (token_sha256, user, created_at) VALUES (?, ?, ?)",
+                (_hash(token), name, at),
+            )
+        return token
+
+    def user_for_token(self, token: str) -> str | None:
+        if not token:
+            return None
+        with self._conn() as conn:
+            row = conn.execute(
+                "SELECT t.user FROM user_tokens t JOIN users u ON u.name = t.user "
+                "WHERE t.token_sha256 = ? AND u.status = ?",
+                (_hash(token), APPROVED),
+            ).fetchone()
+        return row[0] if row else None
+
+    def logout(self, token: str) -> bool:
+        with _WRITE_LOCK, self._conn() as conn:
+            cur = conn.execute("DELETE FROM user_tokens WHERE token_sha256 = ?", (_hash(token),))
+            return cur.rowcount > 0

dibs/app.py

@@ -0,0 +1,344 @@
+# SPDX-FileCopyrightText: Simon A. F. Lund <os@safl.dk>
+#
+# SPDX-License-Identifier: BSD-3-Clause
+
+"""The dibs server: things, claims, users, and the login hook.
+
+Reads are open to anyone who can reach the server. Claiming and
+releasing take a user's bearer token, which ``/auth/login`` hands out
+for a signature by the user's registered SSH key. Approving users is
+not an HTTP route at all: it is ``dibs admin approve`` on the server
+host, so dibs has no admin password to share or leak.
+
+Claims, takeovers and logins are logged to the ``dibs`` logger, which
+the systemd unit sends to the journal.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import html
+import logging
+from collections.abc import AsyncGenerator, Callable
+from contextlib import asynccontextmanager
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+from fastapi import Depends, FastAPI, HTTPException, Request
+from fastapi.responses import HTMLResponse, PlainTextResponse, Response
+from pydantic import BaseModel, Field
+
+import dibs
+from dibs._sources import Config, PixieSource, load_config, sync
+from dibs._store import Claim, ClaimConflict, Store, Thing, sentence
+from dibs._users import DuplicateUser, LoginFailed, NotApproved, UsersStore
+
+log = logging.getLogger("dibs")
+
+
+class ClaimBody(BaseModel):
+    things: list[str] = Field(..., min_length=1)
+    purpose: str
+    assisted_by: str = Field(default="", description="Agent:model, as in an Assisted-by trailer")
+    expires_in: int | None = Field(default=None, description="Seconds; null never expires")
+    force: bool = False
+
+
+class ReleaseBody(BaseModel):
+    things: list[str] = Field(default_factory=list)
+    assisted_by: str = ""
+    mine: bool = Field(default=False, description="Every live claim you hold through assisted_by")
+    force: bool = False
+
+
+class RegisterBody(BaseModel):
+    user: str
+    pubkey: str
+
+
+class ChallengeBody(BaseModel):
+    user: str
+
+
+class LoginBody(BaseModel):
+    user: str
+    nonce: str
+    signature: str
+
+
+def _bearer(request: Request) -> str:
+    scheme, _, token = request.headers.get("authorization", "").partition(" ")
+    return token.strip() if scheme.lower() == "bearer" else ""
+
+
+def current_user(request: Request) -> str:
+    """Dependency: the user a bearer token belongs to, else 401."""
+    user = request.app.state.users.user_for_token(_bearer(request))
+    if user is None:
+        raise HTTPException(status_code=401, detail="not logged in; run: dibs login <user>")
+    return str(user)
+
+
+def _view(name: str, thing: Thing | None, claim: Claim | None, now: datetime) -> dict[str, Any]:
+    """One thing as the API shows it. A claim on a thing no source lists
+    any more still shows, with ``source`` ``gone``, so it can be released."""
+    out: dict[str, Any] = {
+        "name": name,
+        "kind": thing.kind if thing else "unknown",
+        "source": thing.source if thing else "gone",
+        "sentence": sentence(name, claim, now),
+    }
+    if thing and thing.attrs:
+        out["attrs"] = thing.attrs
+    if claim is not None and claim.is_live(now):
+        out["claim"] = claim.to_dict()
+    return out
+
+
+def _conflict(exc: ClaimConflict) -> HTTPException:
+    return HTTPException(
+        status_code=409, detail={"message": "claimed by someone else", "claimed": exc.sentences}
+    )
+
+
+def create_app(
+    config_path: Path,
+    data_dir: Path,
+    *,
+    pixie_sources: list[PixieSource] | None = None,
+    background_sync: bool = True,
+) -> FastAPI:
+    data_dir.mkdir(parents=True, exist_ok=True)
+    store = Store(data_dir / "dibs.db")
+    users = UsersStore(data_dir / "dibs.db")
+    config = load_config(config_path)
+    pixies = pixie_sources if pixie_sources is not None else [PixieSource(u) for u in config.pixies]
+
+    def sync_now() -> None:
+        sync(store, config, pixies)
+
+    @asynccontextmanager
+    async def lifespan(_app: FastAPI) -> AsyncGenerator[None]:
+        sync_now()
+        task = asyncio.create_task(_sync_loop(config, sync_now)) if background_sync else None
+        try:
+            yield
+        finally:
+            if task is not None:
+                task.cancel()
+
+    app = FastAPI(title="dibs", version=dibs.__version__, lifespan=lifespan)
+    app.state.store = store
+    app.state.users = users
+    app.state.config = config
+    app.state.pixies = {p.id: p for p in pixies}
+    app.state.sync = sync_now
+
+    def resolve(names: list[str]) -> list[str]:
+        known = {t.name for t in store.list_things()}
+        wanted = [n.strip().lower() for n in names]
+        unknown = [n for n in wanted if n not in known]
+        if unknown:
+            raise HTTPException(status_code=404, detail=f"no such thing: {', '.join(unknown)}")
+        return wanted
+
+    @app.get("/healthz")
+    def healthz() -> dict[str, str]:
+        return {"status": "ok", "version": dibs.__version__}
+
+    @app.get("/things")
+    def list_things() -> dict[str, list[dict[str, Any]]]:
+        now = datetime.now(UTC)
+        things = {t.name: t for t in store.list_things()}
+        claims = store.list_claims()
+        names = sorted(set(things) | {n for n, c in claims.items() if c.is_live(now)})
+        return {"things": [_view(n, things.get(n), claims.get(n), now) for n in names]}
+
+    @app.get("/things/{name}")
+    def get_thing(name: str) -> dict[str, Any]:
+        now = datetime.now(UTC)
+        thing = store.get_thing(name)
+        claim = store.get_claim(name.strip().lower())
+        if thing is None and claim is None:
+            raise HTTPException(status_code=404, detail=f"no such thing: {name}")
+        out = _view(name.strip().lower(), thing, claim, now)
+        if thing is not None and thing.source in app.state.pixies:
+            info = app.state.pixies[thing.source].info(thing.name)
+            if info is not None:
+                out["pixie"] = info
+        return out
+
+    @app.get("/things/{name}/claim", response_class=PlainTextResponse)
+    def thing_claim_text(name: str) -> PlainTextResponse:
+        name = name.strip().lower()
+        if store.get_thing(name) is None:
+            raise HTTPException(status_code=404, detail=f"no such thing: {name}")
+        return PlainTextResponse(sentence(name, store.get_claim(name), datetime.now(UTC)) + "\n")
+
+    @app.get("/claim", response_class=PlainTextResponse)
+    def claim_for_host(mac: str = "", host: str = "") -> PlainTextResponse:
+        """The claim sentence for the machine asking, found by any of its
+        MACs (comma-separated) or else its hostname. For the login hook."""
+        thing = store.thing_by_mac(mac.split(",")) or (store.get_thing(host) if host else None)
+        if thing is None:
+            raise HTTPException(status_code=404, detail="not a thing dibs knows")
+        text = sentence(thing.name, store.get_claim(thing.name), datetime.now(UTC))
+        return PlainTextResponse(text + "\n")
+
+    @app.post("/claims")
+    def claim(body: ClaimBody, user: str = Depends(current_user)) -> dict[str, Any]:
+        names = resolve(body.things)
+        now = datetime.now(UTC)
+        try:
+            pairs = store.claim(
+                names,
+                holder=user,
+                purpose=body.purpose,
+                assisted_by=body.assisted_by,
+                expires_in=body.expires_in,
+                force=body.force,
+                now=now,
+            )
+        except ClaimConflict as exc:
+            raise _conflict(exc) from exc
+        except ValueError as exc:
+            raise HTTPException(status_code=422, detail=str(exc)) from exc
+        for before, after in pairs:
+            if before is not None and before.holder != after.holder:
+                log.warning("%s took %s from %s", user, after.thing, before.holder)
+            log.info("%s", sentence(after.thing, after, now))
+        things = {t.name: t for t in store.list_things()}
+        return {"things": [_view(a.thing, things.get(a.thing), a, now) for _, a in pairs]}
+
+    @app.post("/claims/release")
+    def release(body: ReleaseBody, user: str = Depends(current_user)) -> dict[str, Any]:
+        now = datetime.now(UTC)
+        if body.mine == bool(body.things):
+            raise HTTPException(status_code=422, detail="name things to release, or set mine")
+        if body.mine:
+            names = [c.thing for c in store.claimed_by(user, body.assisted_by, now=now)]
+        else:
+            names = [n.strip().lower() for n in body.things]
+        try:
+            released = store.release(names, holder=user, force=body.force, now=now)
+        except ClaimConflict as exc:
+            raise _conflict(exc) from exc
+        things = {t.name: t for t in store.list_things()}
+        for c in released:
+            log.info("%s released %s (held by %s)", user, c.thing, c.holder)
+        return {"things": [_view(c.thing, things.get(c.thing), None, now) for c in released]}
+
+    @app.post("/auth/register", status_code=202)
+    def register(body: RegisterBody) -> dict[str, str]:
+        try:
+            u = users.register(body.user, body.pubkey)
+        except DuplicateUser as exc:
+            raise HTTPException(status_code=409, detail=str(exc)) from exc
+        except ValueError as exc:
+            raise HTTPException(status_code=422, detail=str(exc)) from exc
+        log.info(
+            "%s registered with key %s; approve with: dibs admin approve %s",
+            u.name,
+            u.fingerprint,
+            u.name,
+        )
+        return {"user": u.name, "status": u.status, "fingerprint": u.fingerprint}
+
+    @app.post("/auth/challenge")
+    def challenge(body: ChallengeBody) -> dict[str, str]:
+        try:
+            nonce, message = users.challenge(body.user)
+        except NotApproved as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+        except LookupError as exc:
+            raise HTTPException(status_code=404, detail=str(exc)) from exc
+        except ValueError as exc:
+            raise HTTPException(status_code=422, detail=str(exc)) from exc
+        return {"nonce": nonce, "message": message}
+
+    @app.post("/auth/login")
+    def login(body: LoginBody) -> dict[str, str]:
+        try:
+            token = users.login(body.user, body.nonce, body.signature)
+        except LoginFailed as exc:
+            raise HTTPException(status_code=401, detail=str(exc)) from exc
+        except ValueError as exc:
+            raise HTTPException(status_code=422, detail=str(exc)) from exc
+        name = body.user.strip().lower()
+        log.info("%s logged in", name)
+        return {"user": name, "token": token}
+
+    @app.post("/auth/logout", status_code=204)
+    def logout(request: Request) -> Response:
+        users.logout(_bearer(request))
+        return Response(status_code=204)
+
+    @app.get("/auth/whoami")
+    def whoami(user: str = Depends(current_user)) -> dict[str, str]:
+        return {"user": user}
+
+    @app.get("/login.sh", response_class=PlainTextResponse)
+    def login_hook(request: Request) -> PlainTextResponse:
+        """A ``profile.d`` snippet that prints this machine's claim at
+        login. It points back at whichever dibs URL fetched it."""
+        return PlainTextResponse(LOGIN_HOOK.format(base=str(request.base_url)))
+
+    @app.get("/", response_class=HTMLResponse)
+    def index() -> HTMLResponse:
+        rows = list_things()["things"]
+        body = "\n".join(
+            f"<tr><td>{html.escape(r['name'])}</td><td>{html.escape(r['kind'])}</td>"
+            f"<td>{html.escape(r['sentence'])}</td></tr>"
+            for r in rows
+        )
+        return HTMLResponse(PAGE.format(version=dibs.__version__, rows=body))
+
+    return app
+
+
+async def _sync_loop(config: Config, sync_now: Callable[[], None]) -> None:
+    while True:
+        await asyncio.sleep(config.sync_interval)
+        try:
+            await asyncio.to_thread(sync_now)
+        except Exception:  # keep syncing; one bad round must not stop the loop
+            log.exception("sync failed")
+
+
+# Sourced from /etc/profile.d by login shells on the machine. It must
+# never slow down or break a login: interactive shells only, one request
+# with a short timeout, and silence when dibs is unreachable.
+LOGIN_HOOK = """\
+# dibs claim notice, from {base}login.sh
+case $- in *i*)
+    if command -v curl >/dev/null 2>&1; then
+        _dibs_macs=$(cat /sys/class/net/*/address 2>/dev/null \\
+            | grep -v '^00:00:00:00:00:00$' | tr '\\n' ',')
+        _dibs_line=$(curl -fsS --connect-timeout 1 --max-time 2 -G \\
+            --data-urlencode "mac=$_dibs_macs" --data-urlencode "host=$(hostname -s)" \\
+            "{base}claim" 2>/dev/null) && printf '*** %s ***\\n' "$_dibs_line"
+        unset _dibs_macs _dibs_line
+    fi
+    ;;
+esac
+"""
+
+PAGE = """<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>dibs</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>
+body {{ font-family: system-ui, sans-serif; margin: 2rem auto; max-width: 60rem; padding: 0 1rem; }}
+table {{ border-collapse: collapse; width: 100%; }}
+td, th {{ text-align: left; padding: .4rem .6rem; border-bottom: 1px solid #ddd; }}
+</style></head><body>
+<h1>dibs</h1>
+<p>Who is using which thing. Claim one with
+<code>dibs claim &lt;name&gt; --for &lt;purpose&gt;</code>.</p>
+<table><thead><tr><th>Name</th><th>Kind</th><th>Claim</th></tr></thead>
+<tbody>
+{rows}
+</tbody></table>
+<p><small>dibs {version}</small></p>
+</body></html>
+"""