Raphaël Roumezin
2 days ago
committed by
GitHub
GitHub
22 changed files with 811 additions and 57 deletions
@ -0,0 +1 @@ |
|||||
|
DROP TABLE webauthn_credentials; |
||||
@ -0,0 +1,10 @@ |
|||||
|
CREATE TABLE webauthn_credentials ( |
||||
|
uuid VARCHAR(40) NOT NULL PRIMARY KEY, |
||||
|
user_uuid VARCHAR(40) NOT NULL REFERENCES users(uuid), |
||||
|
name TEXT NOT NULL, |
||||
|
credential TEXT NOT NULL, |
||||
|
supports_prf BOOLEAN NOT NULL DEFAULT 0, |
||||
|
encrypted_user_key TEXT, |
||||
|
encrypted_public_key TEXT, |
||||
|
encrypted_private_key TEXT |
||||
|
); |
||||
@ -0,0 +1 @@ |
|||||
|
DROP TABLE webauthn_credentials; |
||||
@ -0,0 +1,10 @@ |
|||||
|
CREATE TABLE webauthn_credentials ( |
||||
|
uuid VARCHAR(40) NOT NULL PRIMARY KEY, |
||||
|
user_uuid VARCHAR(40) NOT NULL REFERENCES users(uuid), |
||||
|
name TEXT NOT NULL, |
||||
|
credential TEXT NOT NULL, |
||||
|
supports_prf BOOLEAN NOT NULL DEFAULT FALSE, |
||||
|
encrypted_user_key TEXT, |
||||
|
encrypted_public_key TEXT, |
||||
|
encrypted_private_key TEXT |
||||
|
); |
||||
@ -0,0 +1 @@ |
|||||
|
DROP TABLE webauthn_credentials; |
||||
@ -0,0 +1,10 @@ |
|||||
|
CREATE TABLE webauthn_credentials ( |
||||
|
uuid TEXT NOT NULL PRIMARY KEY, |
||||
|
user_uuid TEXT NOT NULL REFERENCES users(uuid), |
||||
|
name TEXT NOT NULL, |
||||
|
credential TEXT NOT NULL, |
||||
|
supports_prf BOOLEAN NOT NULL DEFAULT 0, |
||||
|
encrypted_user_key TEXT, |
||||
|
encrypted_public_key TEXT, |
||||
|
encrypted_private_key TEXT |
||||
|
); |
||||
@ -0,0 +1,286 @@ |
|||||
|
use std::sync::LazyLock; |
||||
|
|
||||
|
use rocket::{http::Status, serde::json::Json}; |
||||
|
use serde_json::Value; |
||||
|
use webauthn_rs::{ |
||||
|
Webauthn, WebauthnBuilder, |
||||
|
prelude::{Passkey, PasskeyRegistration}, |
||||
|
}; |
||||
|
use webauthn_rs_proto::{COSEAlgorithm, UserVerificationPolicy, options::PubKeyCredParams}; |
||||
|
|
||||
|
use crate::{ |
||||
|
CONFIG, |
||||
|
api::{ApiResult, JsonResult, PasswordOrOtpData, core::two_factor::webauthn::RegisterPublicKeyCredentialCopy}, |
||||
|
auth::Headers, |
||||
|
db::{ |
||||
|
DbConn, |
||||
|
models::{TwoFactor, TwoFactorType, WebauthnCredential, WebauthnCredentialId, WebauthnCredentialPrfStatus}, |
||||
|
}, |
||||
|
}; |
||||
|
|
||||
|
pub static WEBAUTHN_PASSWORDLESS: LazyLock<Webauthn> = LazyLock::new(|| { |
||||
|
let domain = CONFIG.domain(); |
||||
|
let domain_origin = CONFIG.domain_origin(); |
||||
|
let rp_id = url::Url::parse(&domain).map(|u| u.domain().map(str::to_owned)).ok().flatten().unwrap_or_default(); |
||||
|
let rp_origin = url::Url::parse(&domain_origin).unwrap(); |
||||
|
|
||||
|
let mut webauthn = WebauthnBuilder::new(&rp_id, &rp_origin) |
||||
|
.expect("Creating WebauthnBuilder failed") |
||||
|
.rp_name(&domain) |
||||
|
.timeout(tokio::time::Duration::from_mins(1)); |
||||
|
|
||||
|
for origin in [ |
||||
|
"chrome-extension://nngceckbapebfimnlniiiahkandclblb", // Chrome Web Store
|
||||
|
"chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh", // Edge Add-ons
|
||||
|
] { |
||||
|
let origin = url::Url::parse(origin).expect("origin should parse"); |
||||
|
webauthn = webauthn.append_allowed_origin(&origin); |
||||
|
} |
||||
|
|
||||
|
webauthn.build().expect("Building Webauthn failed") |
||||
|
}); |
||||
|
|
||||
|
pub fn routes() -> Vec<rocket::Route> { |
||||
|
routes![get_webauthn, post_webauthn, post_webauthn_attestation_options, post_webauthn_delete] |
||||
|
} |
||||
|
|
||||
|
pub fn webauthn_prf_option(wac: &WebauthnCredential, pascal_case: bool) -> Option<Value> { |
||||
|
if !matches!(wac.get_prf_status(), WebauthnCredentialPrfStatus::Enabled) { |
||||
|
return None; |
||||
|
} |
||||
|
|
||||
|
let passkey: Passkey = serde_json::from_str(&wac.credential).ok()?; |
||||
|
|
||||
|
if pascal_case { |
||||
|
Some(json!({ |
||||
|
"CredentialId": passkey.cred_id().to_owned(), |
||||
|
"Transports": [], |
||||
|
"EncryptedPrivateKey": wac.encrypted_private_key.as_ref()?, |
||||
|
"EncryptedUserKey": wac.encrypted_user_key.as_ref()?, |
||||
|
})) |
||||
|
} else { |
||||
|
Some(json!({ |
||||
|
"credentialId": passkey.cred_id().to_owned(), |
||||
|
"transports": [], |
||||
|
"encryptedPrivateKey": wac.encrypted_private_key.as_ref()?, |
||||
|
"encryptedUserKey": wac.encrypted_user_key.as_ref()?, |
||||
|
})) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
#[get("/webauthn")] |
||||
|
async fn get_webauthn(headers: Headers, conn: DbConn) -> JsonResult { |
||||
|
if !CONFIG.passkey_login_allowed() { |
||||
|
// The web vault will query this endpoint whether passkey login is allowed or not, so we should return an empty list instead of an error.
|
||||
|
return Ok(Json(json!({ |
||||
|
"object": "list", |
||||
|
"data": [], |
||||
|
"continuationToken": null |
||||
|
}))); |
||||
|
} |
||||
|
|
||||
|
let user = headers.user; |
||||
|
|
||||
|
let data: Vec<WebauthnCredential> = WebauthnCredential::find_all_by_user(&user.uuid, &conn).await; |
||||
|
let data = data |
||||
|
.into_iter() |
||||
|
.map(|wac| { |
||||
|
json!({ |
||||
|
"id": wac.uuid, |
||||
|
"name": wac.name, |
||||
|
"prfStatus": wac.get_prf_status() as u8, |
||||
|
"encryptedUserKey": wac.encrypted_user_key, |
||||
|
"encryptedPublicKey": wac.encrypted_public_key, |
||||
|
"object": "webauthnCredential", |
||||
|
}) |
||||
|
}) |
||||
|
.collect::<Value>(); |
||||
|
|
||||
|
Ok(Json(json!({ |
||||
|
"object": "list", |
||||
|
"data": data, |
||||
|
"continuationToken": null |
||||
|
}))) |
||||
|
} |
||||
|
|
||||
|
#[post("/webauthn/attestation-options", data = "<data>")] |
||||
|
async fn post_webauthn_attestation_options( |
||||
|
data: Json<PasswordOrOtpData>, |
||||
|
headers: Headers, |
||||
|
conn: DbConn, |
||||
|
) -> JsonResult { |
||||
|
if !CONFIG.passkey_login_allowed() { |
||||
|
err!("Passkey login is not allowed") |
||||
|
} |
||||
|
|
||||
|
let data: PasswordOrOtpData = data.into_inner(); |
||||
|
let user = headers.user; |
||||
|
|
||||
|
data.validate(&user, false, &conn).await?; |
||||
|
|
||||
|
let all_creds: Vec<WebauthnCredential> = WebauthnCredential::find_all_by_user(&user.uuid, &conn).await; |
||||
|
let existing_cred_ids: Vec<_> = all_creds |
||||
|
.into_iter() |
||||
|
.filter_map(|wac| { |
||||
|
let passkey: Passkey = serde_json::from_str(&wac.credential).ok()?; |
||||
|
Some(passkey.cred_id().to_owned()) |
||||
|
}) |
||||
|
.collect(); |
||||
|
|
||||
|
let user_uuid = uuid::Uuid::parse_str(&user.uuid).expect("Failed to parse user UUID"); |
||||
|
|
||||
|
let (mut challenge, state) = WEBAUTHN_PASSWORDLESS.start_passkey_registration( |
||||
|
user_uuid, |
||||
|
&user.email, |
||||
|
user.display_name(), |
||||
|
Some(existing_cred_ids), |
||||
|
)?; |
||||
|
|
||||
|
// For passkey login, we need discoverable credentials (resident keys).
|
||||
|
// start_passkey_registration() defaults to require_resident_key=false, but passkey login
|
||||
|
// requires the credential to be discoverable (resident) so the authenticator can find it
|
||||
|
// without the server providing allowCredentials.
|
||||
|
if let Some(asc) = challenge.public_key.authenticator_selection.as_mut() { |
||||
|
asc.user_verification = UserVerificationPolicy::Discouraged_DO_NOT_USE; |
||||
|
asc.require_resident_key = true; |
||||
|
asc.resident_key = Some(webauthn_rs_proto::ResidentKeyRequirement::Required); |
||||
|
} |
||||
|
|
||||
|
// Safely clear the extensions field to match Bitwarden behavior
|
||||
|
if let Some(exts) = challenge.public_key.extensions.as_mut() { |
||||
|
exts.cred_props = None; |
||||
|
exts.uvm = None; |
||||
|
exts.cred_protect = None; |
||||
|
exts.hmac_create_secret = None; |
||||
|
exts.min_pin_length = None; |
||||
|
} |
||||
|
|
||||
|
// Set algorithms list to {ES,RS,PS}{256,384,512},EDDSA to match Bitwarden behavior
|
||||
|
challenge.public_key.pub_key_cred_params = vec![ |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::ES256 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::ES384 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::ES512 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::RS256 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::RS384 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::RS512 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::PS256 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::PS384 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::PS512 as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
PubKeyCredParams { |
||||
|
alg: COSEAlgorithm::EDDSA as i64, |
||||
|
type_: "public-key".to_owned(), |
||||
|
}, |
||||
|
]; |
||||
|
|
||||
|
// Persist the registration state in the database (same pattern as 2FA webauthn)
|
||||
|
TwoFactor::new(user.uuid, TwoFactorType::WebauthnPasskeyRegisterChallenge, serde_json::to_string(&state)?) |
||||
|
.save(&conn) |
||||
|
.await?; |
||||
|
|
||||
|
let mut options = serde_json::to_value(challenge.public_key)?; |
||||
|
options["status"] = "ok".into(); |
||||
|
options["errorMessage"] = "".into(); |
||||
|
|
||||
|
Ok(Json(json!({ |
||||
|
"options": options, |
||||
|
"object": "webauthnCredentialCreateOptions" |
||||
|
}))) |
||||
|
} |
||||
|
|
||||
|
#[derive(Debug, Deserialize)] |
||||
|
#[serde(rename_all = "camelCase")] |
||||
|
struct WebAuthnLoginCredentialCreateRequest { |
||||
|
device_response: RegisterPublicKeyCredentialCopy, |
||||
|
name: String, |
||||
|
supports_prf: bool, |
||||
|
encrypted_user_key: Option<String>, |
||||
|
encrypted_public_key: Option<String>, |
||||
|
encrypted_private_key: Option<String>, |
||||
|
} |
||||
|
|
||||
|
#[post("/webauthn", data = "<data>")] |
||||
|
async fn post_webauthn( |
||||
|
data: Json<WebAuthnLoginCredentialCreateRequest>, |
||||
|
headers: Headers, |
||||
|
conn: DbConn, |
||||
|
) -> ApiResult<Status> { |
||||
|
if !CONFIG.passkey_login_allowed() { |
||||
|
err!("Passkey login is not allowed") |
||||
|
} |
||||
|
|
||||
|
let data: WebAuthnLoginCredentialCreateRequest = data.into_inner(); |
||||
|
let user = headers.user; |
||||
|
|
||||
|
// Retrieve and delete the saved challenge state from the database
|
||||
|
let type_ = TwoFactorType::WebauthnPasskeyRegisterChallenge as i32; |
||||
|
let credential = if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await { |
||||
|
let state: PasskeyRegistration = serde_json::from_str(&tf.data)?; |
||||
|
tf.delete(&conn).await?; |
||||
|
WEBAUTHN_PASSWORDLESS.finish_passkey_registration(&data.device_response.into(), &state)? |
||||
|
} else { |
||||
|
err!("No registration challenge found. Please try again.") |
||||
|
}; |
||||
|
|
||||
|
WebauthnCredential::new( |
||||
|
user.uuid, |
||||
|
data.name, |
||||
|
serde_json::to_string(&credential)?, |
||||
|
data.supports_prf, |
||||
|
data.encrypted_user_key, |
||||
|
data.encrypted_public_key, |
||||
|
data.encrypted_private_key, |
||||
|
) |
||||
|
.save(&conn) |
||||
|
.await?; |
||||
|
|
||||
|
Ok(Status::Ok) |
||||
|
} |
||||
|
|
||||
|
#[post("/webauthn/<uuid>/delete", data = "<data>")] |
||||
|
async fn post_webauthn_delete( |
||||
|
data: Json<PasswordOrOtpData>, |
||||
|
uuid: &str, |
||||
|
headers: Headers, |
||||
|
conn: DbConn, |
||||
|
) -> ApiResult<Status> { |
||||
|
if !CONFIG.passkey_login_allowed() { |
||||
|
err!("Passkey login is not allowed") |
||||
|
} |
||||
|
|
||||
|
let data: PasswordOrOtpData = data.into_inner(); |
||||
|
let user = headers.user; |
||||
|
|
||||
|
data.validate(&user, false, &conn).await?; |
||||
|
|
||||
|
WebauthnCredential::delete_by_uuid_and_user(&WebauthnCredentialId::from(uuid.to_owned()), &user.uuid, &conn) |
||||
|
.await?; |
||||
|
|
||||
|
Ok(Status::Ok) |
||||
|
} |
||||
@ -0,0 +1,153 @@ |
|||||
|
use derive_more::{AsRef, Deref, Display, From}; |
||||
|
use diesel::prelude::*; |
||||
|
use macros::UuidFromParam; |
||||
|
|
||||
|
use crate::api::EmptyResult; |
||||
|
use crate::db::DbConn; |
||||
|
use crate::db::schema::webauthn_credentials; |
||||
|
use crate::error::MapResult; |
||||
|
|
||||
|
use super::UserId; |
||||
|
|
||||
|
#[derive(num_derive::FromPrimitive, Serialize)] |
||||
|
pub enum WebauthnCredentialPrfStatus { |
||||
|
Enabled = 0, |
||||
|
Disabled = 1, |
||||
|
NotSupported = 2, |
||||
|
} |
||||
|
|
||||
|
#[derive(Debug, Identifiable, Queryable, Insertable, AsChangeset)] |
||||
|
#[diesel(table_name = webauthn_credentials)] |
||||
|
#[diesel(treat_none_as_null = true)] |
||||
|
#[diesel(primary_key(uuid))] |
||||
|
pub struct WebauthnCredential { |
||||
|
pub uuid: WebauthnCredentialId, |
||||
|
pub user_uuid: UserId, |
||||
|
pub name: String, |
||||
|
pub credential: String, |
||||
|
pub supports_prf: bool, |
||||
|
pub encrypted_user_key: Option<String>, |
||||
|
pub encrypted_public_key: Option<String>, |
||||
|
pub encrypted_private_key: Option<String>, |
||||
|
} |
||||
|
|
||||
|
/// Local methods
|
||||
|
impl WebauthnCredential { |
||||
|
pub fn new( |
||||
|
user_uuid: UserId, |
||||
|
name: String, |
||||
|
credential: String, |
||||
|
supports_prf: bool, |
||||
|
encrypted_user_key: Option<String>, |
||||
|
encrypted_public_key: Option<String>, |
||||
|
encrypted_private_key: Option<String>, |
||||
|
) -> Self { |
||||
|
Self { |
||||
|
uuid: WebauthnCredentialId(crate::util::get_uuid()), |
||||
|
user_uuid, |
||||
|
name, |
||||
|
credential, |
||||
|
supports_prf, |
||||
|
encrypted_user_key, |
||||
|
encrypted_public_key, |
||||
|
encrypted_private_key, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn get_prf_status(&self) -> WebauthnCredentialPrfStatus { |
||||
|
if self.supports_prf { |
||||
|
if self.encrypted_user_key.is_some() |
||||
|
&& self.encrypted_public_key.is_some() |
||||
|
&& self.encrypted_private_key.is_some() |
||||
|
{ |
||||
|
WebauthnCredentialPrfStatus::Enabled |
||||
|
} else { |
||||
|
WebauthnCredentialPrfStatus::Disabled |
||||
|
} |
||||
|
} else { |
||||
|
WebauthnCredentialPrfStatus::NotSupported |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// Database methods
|
||||
|
impl WebauthnCredential { |
||||
|
pub async fn save(&self, conn: &DbConn) -> EmptyResult { |
||||
|
db_run! { conn: { |
||||
|
diesel::insert_into(webauthn_credentials::table) |
||||
|
.values(self) |
||||
|
.execute(conn) |
||||
|
.map_res("Error saving webauthn_credential") |
||||
|
}} |
||||
|
} |
||||
|
|
||||
|
pub async fn find_all_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> { |
||||
|
db_run! { conn: { |
||||
|
webauthn_credentials::table |
||||
|
.filter(webauthn_credentials::user_uuid.eq(user_uuid)) |
||||
|
.load::<Self>(conn) |
||||
|
.unwrap_or_default() |
||||
|
}} |
||||
|
} |
||||
|
|
||||
|
pub async fn delete_by_uuid_and_user( |
||||
|
uuid: &WebauthnCredentialId, |
||||
|
user_uuid: &UserId, |
||||
|
conn: &DbConn, |
||||
|
) -> EmptyResult { |
||||
|
db_run! { conn: { |
||||
|
diesel::delete( |
||||
|
webauthn_credentials::table |
||||
|
.filter(webauthn_credentials::uuid.eq(uuid)) |
||||
|
.filter(webauthn_credentials::user_uuid.eq(user_uuid)), |
||||
|
) |
||||
|
.execute(conn) |
||||
|
.map_res("Error removing webauthn_credential") |
||||
|
}} |
||||
|
} |
||||
|
|
||||
|
pub async fn update_credential_by_uuid( |
||||
|
uuid: &WebauthnCredentialId, |
||||
|
credential: String, |
||||
|
conn: &DbConn, |
||||
|
) -> EmptyResult { |
||||
|
db_run! { conn: { |
||||
|
diesel::update( |
||||
|
webauthn_credentials::table |
||||
|
.filter(webauthn_credentials::uuid.eq(uuid)), |
||||
|
) |
||||
|
.set(webauthn_credentials::credential.eq(credential)) |
||||
|
.execute(conn) |
||||
|
.map_res("Error updating credential for webauthn_credential") |
||||
|
}} |
||||
|
} |
||||
|
|
||||
|
pub async fn delete_all_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult { |
||||
|
db_run! { conn: { |
||||
|
diesel::delete( |
||||
|
webauthn_credentials::table |
||||
|
.filter(webauthn_credentials::user_uuid.eq(user_uuid)), |
||||
|
) |
||||
|
.execute(conn) |
||||
|
.map_res("Error deleting all webauthn_credentials for user") |
||||
|
}} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
#[derive(
|
||||
|
Clone, |
||||
|
Debug, |
||||
|
AsRef, |
||||
|
Deref, |
||||
|
DieselNewType, |
||||
|
Display, |
||||
|
From, |
||||
|
FromForm, |
||||
|
Hash, |
||||
|
PartialEq, |
||||
|
Eq, |
||||
|
Serialize, |
||||
|
Deserialize, |
||||
|
UuidFromParam, |
||||
|
)] |
||||
|
pub struct WebauthnCredentialId(String); |
||||
Loading…
Reference in new issue