iou1name/Buckler
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

sixth commit

Browse Source
This commit is contained in:
iou1name 2019-09-24 19:34:20 -04:00
parent 325d2af09c
commit 2356c50fba
10 changed files with 835 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -4,7 +4,7 @@ A security shield for protecting a number of small web applications.
## Requirements
Python 3.7+
PostgreSQL 11.5+
Python packages: `wheel gunicorn aiohttp aiohttp_jinja2 asyncpg passlib argon2_cffi uvloop`
Python packages: `wheel gunicorn aiohttp aiohttp_jinja2 asyncpg passlib argon2_cffi uvloop fido2`
## Install
```

217
auth.py Normal file
View File

@ -0,0 +1,217 @@
#!/usr/bin/env python3
"""
Endpoints for registering and authenticating FIDO2 security keys.
"""
import json
import secrets
import functools
from datetime import datetime
from aiohttp import web
from fido2.client import ClientData
from fido2.server import Fido2Server, RelyingParty
from fido2.ctap2 import AttestationObject, AuthenticatorData, \
AttestedCredentialData
from fido2 import cbor
import config
routes = web.RouteTableDef()
rp = RelyingParty(config.server_domain, 'Buckler')
server = Fido2Server(rp)
def auth_required(func):
"""
Wrapper for views with should be protected by authtication.
"""
@functools.wraps(func)
async def wrapper(request, *args, **kwargs):
login_url = request.app.router['login'].url_for()
sid = request.cookies.get('session')
try:
user_id = int(request.cookies.get('userid', '0'))
except (ValueError, TypeError):
user_id = None
if not sid or not user_id:
raise web.HTTPFound(location=login_url)
async with request.app['pool'].acquire() as conn:
session = await conn.fetchrow(
"SELECT user_info.id, user_info.username, user_info.admin, "
"user_session.last_used "
"FROM user_info LEFT JOIN user_session "
"ON (user_info.id = user_session.user_id) "
"WHERE user_info.id = $1 AND user_session.id = $2 "
"AND user_session.expires > NOW()",
user_id, sid)
if session:
request['session'] = dict(session)
resp = await func(request, *args, **kwargs)
tz = session['last_used'].tzinfo
delta = datetime.now(tz) - session['last_used']
if delta.seconds > 600:
async with request.app['pool'].acquire() as conn:
await conn.execute(
"UPDATE user_session SET last_used = NOW(), "
"expires = NOW() + INTERVAL '30 DAYS' "
"WHERE user_id = $1",
user_id)
resp.set_cookie(
'userid',
user_id,
max_age=30*24*60*60,
secure=True,
httponly=True)
resp.set_cookie(
'session',
sid,
max_age=30*24*60*60,
secure=True,
httponly=True)
return resp
else:
raise web.HTTPFound(location=login_url)
return wrapper
@routes.post(config.url_prefix + '/register/begin', name='register_begin')
@auth_required
async def register_begin(request):
user_id = request['session']['id']
username = request['session']['username']
async with request.app['pool'].acquire() as conn:
exist_cred = await conn.fetch(
"SELECT * FROM user_credential WHERE user_id = $1",
user_id)
exist_cred = [AttestedCredentialData(c['credential']) for c in exist_cred]
registration_data, state = server.register_begin({
'id': str(user_id).encode('utf8'),
'name': username,
'displayName': username,
}, exist_cred, user_verification='discouraged')
resp = web.Response(body=cbor.encode(registration_data))
resp.set_cookie('state', json.dumps(state))
return resp
@routes.post(config.url_prefix + '/register/complete',name='register_complete')
@auth_required
async def register_complete(request):
user_id = request['session']['id']
username = request['session']['username']
data = await request.read()
data = cbor.decode(data)
client_data = ClientData(data['clientDataJSON'])
att_obj = AttestationObject(data['attestationObject'])
nick = data['security_key_nick']
try:
assert 64 >= len(nick) >= 1
except AssertionError:
d = {'ok': False,
'status': 400,
'message': "security key nick must be between 1 and 64 chars"
}
return web.json_response(d, status=400)
state = json.loads(request.cookies.get('state'))
auth_data = server.register_complete(
state,
client_data,
att_obj
)
async with request.app['pool'].acquire() as conn:
await conn.execute(
"INSERT INTO user_credential (user_id, nick, credential) "
"VALUES ($1, $2, $3)",
user_id, nick, auth_data.credential_data)
resp = web.json_response({'ok': True})
resp.set_cookie('state', '', max_age=0)
return resp
@routes.post(config.url_prefix + '/authenticate/begin',
name='authenticate_begin')
async def authenticate_begin(request):
user_id = int(request.cookies.get('userid'))
if not user_id:
raise web.HTTPUnauthorized
data = await request.read()
data = cbor.decode(data)
async with request.app['pool'].acquire() as conn:
credentials = await conn.fetch(
"SELECT * FROM user_credential WHERE user_id = $1",
user_id)
credentials =[AttestedCredentialData(c['credential']) for c in credentials]
auth_data, state = server.authenticate_begin(credentials)
resp = web.Response(body=cbor.encode(auth_data))
resp.set_cookie('state', json.dumps(state))
return resp
@routes.post(config.url_prefix + '/authenticate/complete',
name='authenticate_complete')
async def authenticate_complete(request):
user_id = int(request.cookies.get('userid'))
async with request.app['pool'].acquire() as conn:
credentials = await conn.fetch(
"SELECT * FROM user_credential WHERE user_id = $1",
user_id)
credentials =[AttestedCredentialData(c['credential']) for c in credentials]
data = await request.read()
data = cbor.decode(data)
credential_id = data['credentialId']
client_data = ClientData(data['clientDataJSON'])
auth_data = AuthenticatorData(data['authenticatorData'])
signature = data['signature']
state = json.loads(request.cookies.get('state'))
server.authenticate_complete(
state,
credentials,
credential_id,
client_data,
auth_data,
signature
)
# TODO: refactor so code isn't duplicated
url = request.cookies.get('redirect')
if not url:
url = request.app.router['index'].url_for()
resp = web.json_response({'ok': True, 'redirect': str(url)})
resp.set_cookie('state', '', max_age=0)
resp.set_cookie('redirect', '', max_age=0)
resp.set_cookie(
'userid',
user_id,
max_age=30*24*60*60,
secure=True,
httponly=True)
sid = secrets.token_urlsafe(64)
ip_address = request.headers['X-Real-IP']
async with request.app['pool'].acquire() as conn:
await conn.execute(
"INSERT INTO user_session (user_id, id, ip_address)"
"VALUES ($1, $2, $3)",
user_id,
sid,
ip_address)
resp.set_cookie(
'session',
sid,
max_age=30*24*60*60,
secure=True,
httponly=True)
return resp

93
buckler.py
View File

@ -4,7 +4,6 @@ A security shield for protecting a number of small web applications.
"""
import json
import secrets
import functools
from datetime import datetime
from collections import defaultdict
@ -16,6 +15,7 @@ from passlib.hash import argon2
import asyncpg
import uvloop
import auth
import mail
import config
import validation
@ -23,61 +23,8 @@ import validation
uvloop.install()
routes = web.RouteTableDef()
def auth_required(func):
"""
Wrapper for views with should be protected by authtication.
"""
@functools.wraps(func)
async def wrapper(request, *args, **kwargs):
login_url = request.app.router['login'].url_for()
sid = request.cookies.get('session')
try:
user_id = int(request.cookies.get('userid', '0'))
except (ValueError, TypeError):
user_id = None
if not sid or not user_id:
raise web.HTTPFound(location=login_url)
async with request.app['pool'].acquire() as conn:
session = await conn.fetchrow(
"SELECT user_info.id, user_info.username, user_info.admin, "
"user_session.last_used "
"FROM user_info LEFT JOIN user_session "
"ON (user_info.id = user_session.user_id) "
"WHERE user_info.id = $1 AND user_session.id = $2 "
"AND user_session.expires > NOW()",
user_id, sid)
if session:
request['session'] = dict(session)
resp = await func(request, *args, **kwargs)
tz = session['last_used'].tzinfo
delta = datetime.now(tz) - session['last_used']
if delta.seconds > 600:
async with request.app['pool'].acquire() as conn:
await conn.execute(
"UPDATE user_session SET last_used = NOW(), "
"expires = NOW() + INTERVAL '30 DAYS' "
"WHERE user_id = $1",
user_id)
resp.set_cookie(
'userid',
user_id,
max_age=30*24*60*60,
secure=True,
httponly=True)
resp.set_cookie(
'session',
sid,
max_age=30*24*60*60,
secure=True,
httponly=True)
return resp
else:
raise web.HTTPFound(location=login_url)
return wrapper
@routes.get(config.url_prefix + '/', name='index')
@auth_required
@auth.auth_required
async def index(request):
"""The index page."""
async with request.app['pool'].acquire() as conn:
@ -94,6 +41,9 @@ async def index(request):
"SELECT user_info.id, user_info.username, app_user.app_id "
"FROM user_info LEFT JOIN app_user "
"ON (user_info.id = app_user.user_id)")
fido2_keys = await conn.fetch(
"SELECT * FROM user_credential WHERE user_id = $1",
request['session']['id'])
if request['session']['admin']:
apps = [app['name'] for app in apps]
@ -104,6 +54,13 @@ async def index(request):
return render_template("index.html", request, locals())
@routes.get(config.url_prefix + '/change_password', name='change_password')
@auth.auth_required
async def change_password(request):
"""Allows a user to change their password."""
pass
@routes.get(config.url_prefix + '/login', name='login')
@routes.post(config.url_prefix + '/login', name='login')
async def login(request):
@ -120,12 +77,29 @@ async def login(request):
user_info = await conn.fetchrow(
"SELECT * FROM user_info WHERE username = $1",
username)
if user_info:
has_cred = await conn.fetchrow(
"SELECT EXISTS(SELECT id FROM user_credential "
"WHERE user_id = $1)",
user_info['id'])
if not user_info:
login_failed = True
return render_template("login.html", request, locals())
if has_cred['exists'] and user_info['passwordless']:
url_prefix = config.url_prefix
resp = render_template("login_key.html", request, locals())
resp.set_cookie('userid', user_info['id'])
return resp
if argon2.verify(password, user_info['password_hash']):
if has_cred['exists']:
url_prefix = config.url_prefix
resp = render_template("login_key.html", request, locals())
resp.set_cookie('userid', user_info['id'])
return resp
url = request.cookies.get('redirect')
if not url:
url = request.app.router['index'].url_for()
@ -218,6 +192,14 @@ async def register(request):
return render_template("register_result.html", request, locals())
@routes.get(config.url_prefix + '/add_key', name='add_key')
@auth.auth_required
async def add_key(request):
"""Add a new security key."""
url_prefix = config.url_prefix
return render_template("register_key.html", request, locals())
@routes.get(config.url_prefix + '/get_session', name='get_session')
async def get_session(request):
"""Returns a user's application session."""
@ -296,6 +278,7 @@ async def init_app():
await conn.execute(file.read())
app.router.add_routes(routes)
app.router.add_routes(auth.routes)
return app
if __name__ == "__main__":

10
buckler.sql
View File

@ -5,7 +5,8 @@ CREATE TABLE IF NOT EXISTS user_info (
password_hash TEXT,
date_created TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
active BOOLEAN NOT NULL DEFAULT FALSE,
admin BOOLEAN NOT NULL DEFAULT FALSE
admin BOOLEAN NOT NULL DEFAULT FALSE,
passwordless BOOLEAN NOT NULL DEFAULT FALSE
);
CREATE TABLE IF NOT EXISTS user_session (
@ -43,3 +44,10 @@ CREATE TABLE IF NOT EXISTS app_user (
session_data JSON,
PRIMARY KEY (user_id, app_id)
);
CREATE TABLE IF NOT EXISTS user_credential (
id SERIAL PRIMARY KEY,
user_id INTEGER references user_info(id) ON DELETE CASCADE,
nick TEXT NOT NULL,
credential BYTEA NOT NULL
);

59
static/buckler-auth.js Normal file
View File

@ -0,0 +1,59 @@
function register() {
fetch(url_prefix + '/register/begin', {
method: 'POST',
}).then(function(response) {
if(!response.ok) { throw new Error('Error getting registration data!'); }
return response.arrayBuffer();
}).then(CBOR.decode).then(function(options) {
return navigator.credentials.create(options);
}).then(function(attestation) {
return fetch(url_prefix + '/register/complete', {
method: 'POST',
headers: {'Content-Type': 'application/cbor'},
body: CBOR.encode({
"attestationObject": new Uint8Array(attestation.response.attestationObject),
"clientDataJSON": new Uint8Array(attestation.response.clientDataJSON),
"security_key_nick": document.querySelector('#security_key_nick').value,
})
});
}).then(function(response) {
return response.json();
}).then(function(json) {
console.log(json);
if (!json.ok) { throw new Error('HTTP error, status = ' + json.status + ', message = ' + json.message); }
window.location = url_prefix + '/login';
});
}
function login() {
fetch(url_prefix + '/authenticate/begin', {
method: 'POST',
headers: {'Content-Type': 'application/cbor'},
body: CBOR.encode({
})
}).then(function(response) {
if(!response.ok) { throw new Error('Error getting registration data!'); }
return response.arrayBuffer();
}).then(CBOR.decode).then(function(options) {
return navigator.credentials.get(options);
}).then(function(assertion) {
return fetch(url_prefix + '/authenticate/complete', {
method: 'POST',
headers: {'Content-Type': 'application/cbor'},
body: CBOR.encode({
"credentialId": new Uint8Array(assertion.rawId),
"authenticatorData": new Uint8Array(assertion.response.authenticatorData),
"clientDataJSON": new Uint8Array(assertion.response.clientDataJSON),
"signature": new Uint8Array(assertion.response.signature)
})
});
}, function(reason) {
console.log('navigator.credentials.get() failed for the following reason: ' + reason);
}).then(function(response) {
return response.json();
}).then(function(json) {
console.log(json);
if (!json.ok) { throw new Error('HTTP error, status = ' + json.status + ', message = ' + json.message); }
window.location = url_prefix + '/';
});
}

3
static/buckler.css
View File

@ -18,6 +18,9 @@ header {
main {
display: grid;
gap: 2em;
}
main section {
background-color: whitesmoke;
padding: 5%;
border-radius: 0.5em;

406
static/cbor.js Normal file
View File

@ -0,0 +1,406 @@
/*
* The MIT License (MIT)
*
* Copyright (c) 2014-2016 Patrick Gansterer <paroga@paroga.com>
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
(function(global, undefined) { "use strict";
var POW_2_24 = 5.960464477539063e-8,
POW_2_32 = 4294967296,
POW_2_53 = 9007199254740992;
function encode(value) {
var data = new ArrayBuffer(256);
var dataView = new DataView(data);
var lastLength;
var offset = 0;
function prepareWrite(length) {
var newByteLength = data.byteLength;
var requiredLength = offset + length;
while (newByteLength < requiredLength)
newByteLength <<= 1;
if (newByteLength !== data.byteLength) {
var oldDataView = dataView;
data = new ArrayBuffer(newByteLength);
dataView = new DataView(data);
var uint32count = (offset + 3) >> 2;
for (var i = 0; i < uint32count; ++i)
dataView.setUint32(i << 2, oldDataView.getUint32(i << 2));
}
lastLength = length;
return dataView;
}
function commitWrite() {
offset += lastLength;
}
function writeFloat64(value) {
commitWrite(prepareWrite(8).setFloat64(offset, value));
}
function writeUint8(value) {
commitWrite(prepareWrite(1).setUint8(offset, value));
}
function writeUint8Array(value) {
var dataView = prepareWrite(value.length);
for (var i = 0; i < value.length; ++i)
dataView.setUint8(offset + i, value[i]);
commitWrite();
}
function writeUint16(value) {
commitWrite(prepareWrite(2).setUint16(offset, value));
}
function writeUint32(value) {
commitWrite(prepareWrite(4).setUint32(offset, value));
}
function writeUint64(value) {
var low = value % POW_2_32;
var high = (value - low) / POW_2_32;
var dataView = prepareWrite(8);
dataView.setUint32(offset, high);
dataView.setUint32(offset + 4, low);
commitWrite();
}
function writeTypeAndLength(type, length) {
if (length < 24) {
writeUint8(type << 5 | length);
} else if (length < 0x100) {
writeUint8(type << 5 | 24);
writeUint8(length);
} else if (length < 0x10000) {
writeUint8(type << 5 | 25);
writeUint16(length);
} else if (length < 0x100000000) {
writeUint8(type << 5 | 26);
writeUint32(length);
} else {
writeUint8(type << 5 | 27);
writeUint64(length);
}
}
function encodeItem(value) {
var i;
if (value === false)
return writeUint8(0xf4);
if (value === true)
return writeUint8(0xf5);
if (value === null)
return writeUint8(0xf6);
if (value === undefined)
return writeUint8(0xf7);
switch (typeof value) {
case "number":
if (Math.floor(value) === value) {
if (0 <= value && value <= POW_2_53)
return writeTypeAndLength(0, value);
if (-POW_2_53 <= value && value < 0)
return writeTypeAndLength(1, -(value + 1));
}
writeUint8(0xfb);
return writeFloat64(value);
case "string":
var utf8data = [];
for (i = 0; i < value.length; ++i) {
var charCode = value.charCodeAt(i);
if (charCode < 0x80) {
utf8data.push(charCode);
} else if (charCode < 0x800) {
utf8data.push(0xc0 | charCode >> 6);
utf8data.push(0x80 | charCode & 0x3f);
} else if (charCode < 0xd800) {
utf8data.push(0xe0 | charCode >> 12);
utf8data.push(0x80 | (charCode >> 6) & 0x3f);
utf8data.push(0x80 | charCode & 0x3f);
} else {
charCode = (charCode & 0x3ff) << 10;
charCode |= value.charCodeAt(++i) & 0x3ff;
charCode += 0x10000;
utf8data.push(0xf0 | charCode >> 18);
utf8data.push(0x80 | (charCode >> 12) & 0x3f);
utf8data.push(0x80 | (charCode >> 6) & 0x3f);
utf8data.push(0x80 | charCode & 0x3f);
}
}
writeTypeAndLength(3, utf8data.length);
return writeUint8Array(utf8data);
default:
var length;
if (Array.isArray(value)) {
length = value.length;
writeTypeAndLength(4, length);
for (i = 0; i < length; ++i)
encodeItem(value[i]);
} else if (value instanceof Uint8Array) {
writeTypeAndLength(2, value.length);
writeUint8Array(value);
} else {
var keys = Object.keys(value);
length = keys.length;
writeTypeAndLength(5, length);
for (i = 0; i < length; ++i) {
var key = keys[i];
encodeItem(key);
encodeItem(value[key]);
}
}
}
}
encodeItem(value);
if ("slice" in data)
return data.slice(0, offset);
var ret = new ArrayBuffer(offset);
var retView = new DataView(ret);
for (var i = 0; i < offset; ++i)
retView.setUint8(i, dataView.getUint8(i));
return ret;
}
function decode(data, tagger, simpleValue) {
var dataView = new DataView(data);
var offset = 0;
if (typeof tagger !== "function")
tagger = function(value) { return value; };
if (typeof simpleValue !== "function")
simpleValue = function() { return undefined; };
function commitRead(length, value) {
offset += length;
return value;
}
function readArrayBuffer(length) {
return commitRead(length, new Uint8Array(data, offset, length));
}
function readFloat16() {
var tempArrayBuffer = new ArrayBuffer(4);
var tempDataView = new DataView(tempArrayBuffer);
var value = readUint16();
var sign = value & 0x8000;
var exponent = value & 0x7c00;
var fraction = value & 0x03ff;
if (exponent === 0x7c00)
exponent = 0xff << 10;
else if (exponent !== 0)
exponent += (127 - 15) << 10;
else if (fraction !== 0)
return (sign ? -1 : 1) * fraction * POW_2_24;
tempDataView.setUint32(0, sign << 16 | exponent << 13 | fraction << 13);
return tempDataView.getFloat32(0);
}
function readFloat32() {
return commitRead(4, dataView.getFloat32(offset));
}
function readFloat64() {
return commitRead(8, dataView.getFloat64(offset));
}
function readUint8() {
return commitRead(1, dataView.getUint8(offset));
}
function readUint16() {
return commitRead(2, dataView.getUint16(offset));
}
function readUint32() {
return commitRead(4, dataView.getUint32(offset));
}
function readUint64() {
return readUint32() * POW_2_32 + readUint32();
}
function readBreak() {
if (dataView.getUint8(offset) !== 0xff)
return false;
offset += 1;
return true;
}
function readLength(additionalInformation) {
if (additionalInformation < 24)
return additionalInformation;
if (additionalInformation === 24)
return readUint8();
if (additionalInformation === 25)
return readUint16();
if (additionalInformation === 26)
return readUint32();
if (additionalInformation === 27)
return readUint64();
if (additionalInformation === 31)
return -1;
throw "Invalid length encoding";
}
function readIndefiniteStringLength(majorType) {
var initialByte = readUint8();
if (initialByte === 0xff)
return -1;
var length = readLength(initialByte & 0x1f);
if (length < 0 || (initialByte >> 5) !== majorType)
throw "Invalid indefinite length element";
return length;
}
function appendUtf16Data(utf16data, length) {
for (var i = 0; i < length; ++i) {
var value = readUint8();
if (value & 0x80) {
if (value < 0xe0) {
value = (value & 0x1f) << 6
| (readUint8() & 0x3f);
length -= 1;
} else if (value < 0xf0) {
value = (value & 0x0f) << 12
| (readUint8() & 0x3f) << 6
| (readUint8() & 0x3f);
length -= 2;
} else {
value = (value & 0x0f) << 18
| (readUint8() & 0x3f) << 12
| (readUint8() & 0x3f) << 6
| (readUint8() & 0x3f);
length -= 3;
}
}
if (value < 0x10000) {
utf16data.push(value);
} else {
value -= 0x10000;
utf16data.push(0xd800 | (value >> 10));
utf16data.push(0xdc00 | (value & 0x3ff));
}
}
}
function decodeItem() {
var initialByte = readUint8();
var majorType = initialByte >> 5;
var additionalInformation = initialByte & 0x1f;
var i;
var length;
if (majorType === 7) {
switch (additionalInformation) {
case 25:
return readFloat16();
case 26:
return readFloat32();
case 27:
return readFloat64();
}
}
length = readLength(additionalInformation);
if (length < 0 && (majorType < 2 || 6 < majorType))
throw "Invalid length";
switch (majorType) {
case 0:
return length;
case 1:
return -1 - length;
case 2:
if (length < 0) {
var elements = [];
var fullArrayLength = 0;
while ((length = readIndefiniteStringLength(majorType)) >= 0) {
fullArrayLength += length;
elements.push(readArrayBuffer(length));
}
var fullArray = new Uint8Array(fullArrayLength);
var fullArrayOffset = 0;
for (i = 0; i < elements.length; ++i) {
fullArray.set(elements[i], fullArrayOffset);
fullArrayOffset += elements[i].length;
}
return fullArray;
}
return readArrayBuffer(length);
case 3:
var utf16data = [];
if (length < 0) {
while ((length = readIndefiniteStringLength(majorType)) >= 0)
appendUtf16Data(utf16data, length);
} else
appendUtf16Data(utf16data, length);
return String.fromCharCode.apply(null, utf16data);
case 4:
var retArray;
if (length < 0) {
retArray = [];
while (!readBreak())
retArray.push(decodeItem());
} else {
retArray = new Array(length);
for (i = 0; i < length; ++i)
retArray[i] = decodeItem();
}
return retArray;
case 5:
var retObject = {};
for (i = 0; i < length || length < 0 && !readBreak(); ++i) {
var key = decodeItem();
retObject[key] = decodeItem();
}
return retObject;
case 6:
return tagger(decodeItem(), length);
case 7:
switch (length) {
case 20:
return false;
case 21:
return true;
case 22:
return null;
case 23:
return undefined;
default:
return simpleValue(length);
}
}
}
var ret = decodeItem();
if (offset !== data.byteLength)
throw "Remaining bytes";
return ret;
}
var obj = { encode: encode, decode: decode };
if (typeof define === "function" && define.amd)
define("cbor/cbor", obj);
else if (typeof module !== "undefined" && module.exports)
module.exports = obj;
else if (!global.CBOR)
global.CBOR = obj;
})(this);

81
templates/index.html
View File

@ -14,37 +14,74 @@
<h1>Buckler</h1>
</header>
<main>
<div>
<section>
Available sites
<ul id="avail_sites">
{% for site in avail_sites %}
<li><a href="{{ site['url'] }}">{{ site['name'] }}</a></li>
{% endfor %}
</ul>
</div>
</section>
{% if request['session']['admin'] %}
<table id="users">
<thead>
<tr>
<th>User</th>
{% for app in apps %}
<th>{{ app }}</th>
<section>
<table id="users">
<thead>
<tr>
<th>User</th>
{% for app in apps %}
<th>{{ app }}</th>
{% endfor %}
<th></th>
</tr>
</thead>
<tbody>
{% for username, values in users.items() %}
<tr>
<td>{{ username }}</td>
{% for value in values %}
<td><input type="checkbox" onchange="perm_change(this.parentElement.parentElement)"{% if value %} checked{% endif %}></td>
{% endfor %}
<td><input type="submit"></td>
</tr>
{% endfor %}
</tr>
</thead>
<tbody>
{% for username, values in users.items() %}
<tr>
<td>{{ username }}</td>
{% for value in values %}
<td><input type="checkbox" onchange="perm_change(this.parentElement.parentElement)"{% if value %} checked{% endif %}></td>
{% endfor %}
<td><input type="submit"></td>
</tr>
{% endfor %}
</tbody>
</table>
</tbody>
</table>
</section>
{% endif %}
<section>
<form action="{{ request.app.router['change_password'].url_for() }}" method="post" enctype="application/x-www-form-urlencoded">
<label for="current_password">Current password</label>
<input id="current_password" name="current_password" type="password"><br>
<label for="new_password">New password</label>
<input id="new_password" name="new_password" type="password"><br>
<label for="verify_password">Verify password</label>
<input id="verify_password" name="verify_password" type="password"><br>
<input type="submit" value="Submit">
</form>
</section>
<section>
{% if fido2_keys %}
<table id="security_keys">
<thead>
<tr>
<th>Nick</th>
<th>Delete</th>
</tr>
</thead>
<tbody>
{% for key in fido2_keys %}
<tr>
<td>{{ key['nick'] }}</td>
<td><input type="checkbox"></td>
</tr>
{% endfor %}
</tbody>
</table>
{% else %}
<span>No registered keys.</span>
{% endif %}
<br><a href="./add_key">Add key</a>
</section>
</main>
</body>
</html>

21
templates/login_key.html Normal file
View File

@ -0,0 +1,21 @@
<!DOCTYPE html>
<html lang="en">
<head>
<title>Buckler - Login</title>
<link rel="stylesheet" type="text/css" href="/static/buckler.css">
<script type="text/javascript" src="/static/cbor.js"></script>
<script type="text/javascript" src="/static/buckler-auth.js"></script>
<script>const url_prefix = '{{ url_prefix }}';</script>
<script>window.onload = login;</script>
</head>
<body>
<header>
<h1>Buckler Login</h1>
</header>
<main>
<section>
<span>Operate your authenticator device now.</span>
</section>
</main>
</body>
</html>

22
templates/register_key.html Normal file
View File

@ -0,0 +1,22 @@
<!DOCTYPE html>
<html lang="en">
<head>
<title>Buckler - Register Security Key</title>
<link rel="stylesheet" type="text/css" href="/static/buckler.css">
<script type="text/javascript" src="/static/cbor.js"></script>
<script type="text/javascript" src="/static/buckler-auth.js"></script>
<script>const url_prefix = '{{ url_prefix }}';</script>
</head>
<body>
<main>
<div id="devices">
<div class="device">
<h1>Register Security Key</h1>
<p>Upon clicking submit, your security key will begin flashing. Have it ready.
<p><label for="security_key_nick">Security key nick</label> <input id="security_key_nick" type="text" minlength="1" maxlength="64" required>
<p><input type="button" value="Submit" onclick="register()">
</div>
</div>
</main>
</body>
</html>