servnest/fn/auth.php

199 lines
6.0 KiB
PHP

<?php declare(strict_types=1);
const USERNAME_REGEX = '^.{1,1024}$';
const PASSWORD_REGEX = '^(?=.*[\p{Ll}])(?=.*[\p{Lu}])(?=.*[\p{N}]).{8,1024}|.{10,1024}$';
const PLACEHOLDER_USERNAME = 'lain';
const PLACEHOLDER_PASSWORD = '••••••••••••••••••••••••';
// Password storage security
const ALGO_PASSWORD = PASSWORD_ARGON2ID;
const OPTIONS_PASSWORD = [
'memory_cost' => 65536,
'time_cost' => 4,
'threads' => 64,
];
function checkUsernameFormat(string $username): void {
if (preg_match('/' . USERNAME_REGEX . '/Du', $username) !== 1)
output(403, 'Username malformed.');
}
function checkPasswordFormat(string $password): void {
if (preg_match('/' . PASSWORD_REGEX . '/Du', $password) !== 1)
output(403, 'Password malformed.');
}
function hashUsername(string $username): string {
return base64_encode(sodium_crypto_pwhash(32, $username, hex2bin(query('select', 'params', ['name' => 'username_salt'], ['value'])[0]), 2**10, 2**14, SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13));
}
function hashPassword(string $password): string {
return password_hash($password, ALGO_PASSWORD, OPTIONS_PASSWORD);
}
function usernameExists(string $username): bool {
return isset(query('select', 'users', ['username' => $username], ['id'])[0]);
}
function checkPassword(string $id, string $password): bool {
return password_verify($password, query('select', 'users', ['id' => $id], ['password'])[0]);
}
function outdatedPasswordHash(string $id): bool {
return password_needs_rehash(query('select', 'users', ['id' => $id], ['password'])[0], ALGO_PASSWORD, OPTIONS_PASSWORD);
}
function changePassword(string $id, string $password): void {
DB->prepare('UPDATE users SET password = :password WHERE id = :id')
->execute([':password' => hashPassword($password), ':id' => $id]);
}
function stopSession(): void {
if (session_status() === PHP_SESSION_ACTIVE)
session_destroy();
}
function logout(): never {
stopSession();
header('Clear-Site-Data: "*"');
redir();
}
function setupDisplayUsername(string $display_username): void {
$nonce = random_bytes(24);
$key = sodium_crypto_aead_xchacha20poly1305_ietf_keygen();
$cyphertext = sodium_crypto_aead_xchacha20poly1305_ietf_encrypt(
htmlspecialchars($display_username),
'',
$nonce,
$key
);
$_SESSION['display-username-nonce'] = $nonce;
setcookie(
'display-username-decryption-key',
base64_encode($key),
[
'expires' => time() + 432000,
'path' => CONF['common']['prefix'] . '/',
'secure' => true,
'httponly' => true,
'samesite' => 'Strict'
]
);
$_SESSION['display-username-cyphertext'] = $cyphertext;
}
function authDeleteUser(string $user_id): void {
$user_services = explode(',', query('select', 'users', ['id' => $user_id], ['services'])[0]);
foreach (SERVICES_USER as $service)
if (in_array($service, $user_services, true) AND CONF['common']['services'][$service] !== 'enabled')
output(503, sprintf(_('Your account can\'t be deleted because the %s service is currently unavailable.'), '<em>' . PAGES[$service]['index']['title'] . '</em>'));
if (in_array('reg', $user_services, true))
foreach (query('select', 'registry', ['username' => $user_id], ['domain']) as $domain)
regDeleteDomain($domain, $user_id);
if (in_array('ns', $user_services, true))
foreach (query('select', 'zones', ['username' => $user_id], ['zone']) as $zone)
nsDeleteZone($zone, $user_id);
if (in_array('ht', $user_services, true)) {
foreach (query('select', 'sites', ['username' => $user_id]) as $site)
htDeleteSite($site['address'], $site['type'], $user_id);
exescape([
CONF['ht']['sudo_path'],
'-u',
CONF['ht']['tor_user'],
'--',
CONF['ht']['rm_path'],
'-r',
'--',
CONF['ht']['tor_keys_path'] . '/' . $user_id,
], result_code: $code);
if ($code !== 0)
output(500, 'Can\'t remove Tor keys directory.');
removeDirectory(CONF['ht']['tor_config_path'] . '/' . $user_id);
exescape([
CONF['ht']['sudo_path'],
'-u',
CONF['ht']['sftpgo_user'],
'--',
CONF['ht']['rm_path'],
'-r',
'--',
CONF['ht']['ht_path'] . '/fs/' . $user_id
], result_code: $code);
if ($code !== 0)
output(500, 'Can\'t remove user\'s directory.');
query('delete', 'ssh-keys', ['username' => $user_id]);
}
query('delete', 'users', ['id' => $user_id]);
}
function rateLimit(): void {
if ((PAGE_METADATA['tokens_account_cost'] ?? 0) > 0)
rateLimitAccount(PAGE_METADATA['tokens_account_cost']);
if ((PAGE_METADATA['tokens_instance_cost'] ?? 0) > 0)
rateLimitInstance(PAGE_METADATA['tokens_instance_cost']);
}
const MAX_ACCOUNT_TOKENS = 86400;
function rateLimitAccount(int $requestedTokens): int {
// Get
$userData = query('select', 'users', ['id' => $_SESSION['id']]);
$tokens = $userData[0]['bucket_tokens'];
$bucketLastUpdate = $userData[0]['bucket_last_update'];
// Compute
$tokens = min(MAX_ACCOUNT_TOKENS, $tokens + (time() - $bucketLastUpdate));
if ($requestedTokens > 0) {
if ($requestedTokens > $tokens)
output(453, _('Account rate limit reached, try again later.'));
$tokens -= $requestedTokens;
// Update
DB->prepare('UPDATE users SET bucket_tokens = :bucket_tokens, bucket_last_update = :bucket_last_update WHERE id = :id')
->execute([
':bucket_tokens' => $tokens,
':bucket_last_update' => time(),
':id' => $_SESSION['id']
]);
}
return $tokens;
}
function rateLimitInstance(int $requestedTokens): void {
// Get
$tokens = query('select', 'params', ['name' => 'instance_bucket_tokens'], ['value'])[0];
$bucketLastUpdate = query('select', 'params', ['name' => 'instance_bucket_last_update'], ['value'])[0];
// Compute
$tokens = min(86400, $tokens + (time() - $bucketLastUpdate));
if ($requestedTokens > $tokens)
output(453, _('Global rate limit reached, try again later.'));
$tokens -= $requestedTokens;
// Update
DB->prepare("UPDATE params SET value = :bucket_tokens WHERE name = 'instance_bucket_tokens';")
->execute([':bucket_tokens' => $tokens]);
DB->prepare("UPDATE params SET value = :bucket_last_update WHERE name = 'instance_bucket_last_update';")
->execute([':bucket_last_update' => time()]);
}