Kyle Isom
710fcfcd34
- Real htmx.min.js (v2.0.4, 50KB) replaces stub - WebAuthn registration handlers (begin/finish) for adding security keys - WebAuthn login handlers (begin/finish) for passwordless login - Key management page (list/delete registered keys) - Login page updated with "Login with Security Key" button + JS - Session store for WebAuthn ceremonies (mutex-protected map) - WebAuthn config passed from server command through to webserver - Added LookupUserID helper for username-based WebAuthn login Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
71 lines
2.0 KiB
Go
71 lines
2.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"database/sql"
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
)
|
|
|
|
// dummyHash is a pre-computed Argon2id hash used for constant-time comparison
|
|
// when a user is not found. This prevents timing attacks that reveal whether
|
|
// a username exists.
|
|
var dummyHash = "$argon2id$v=19$m=65536,t=3,p=4$AAAAAAAAAAAAAAAAAAAAAA$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
|
|
|
|
// CreateUser creates a new user with a hashed password.
|
|
func CreateUser(database *sql.DB, username, password string, params Argon2Params) (int64, error) {
|
|
hash, err := HashPassword(password, params)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
|
|
now := time.Now().UnixMilli()
|
|
res, err := database.Exec(
|
|
"INSERT INTO users (username, password_hash, created_at, updated_at) VALUES (?, ?, ?, ?)",
|
|
username, hash, now, now,
|
|
)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("insert user: %w", err)
|
|
}
|
|
|
|
return res.LastInsertId()
|
|
}
|
|
|
|
// LookupUserID returns the user ID for a username, or an error if not found.
|
|
func LookupUserID(database *sql.DB, username string) (int64, error) {
|
|
var userID int64
|
|
err := database.QueryRow("SELECT id FROM users WHERE username = ?", username).Scan(&userID)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("user not found: %w", err)
|
|
}
|
|
return userID, nil
|
|
}
|
|
|
|
// AuthenticateUser verifies username/password and returns the user ID.
|
|
func AuthenticateUser(database *sql.DB, username, password string) (int64, error) {
|
|
var userID int64
|
|
var hash string
|
|
err := database.QueryRow(
|
|
"SELECT id, password_hash FROM users WHERE username = ?", username,
|
|
).Scan(&userID, &hash)
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
// User not found: verify against dummy hash to consume constant time,
|
|
// preventing timing attacks that reveal username existence.
|
|
_, _ = VerifyPassword(password, dummyHash)
|
|
return 0, fmt.Errorf("invalid credentials")
|
|
}
|
|
if err != nil {
|
|
return 0, fmt.Errorf("invalid credentials")
|
|
}
|
|
|
|
ok, err := VerifyPassword(password, hash)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("invalid credentials")
|
|
}
|
|
if !ok {
|
|
return 0, fmt.Errorf("invalid credentials")
|
|
}
|
|
|
|
return userID, nil
|
|
}
|