dosh/src/auth.rs

use crate::config::{ServerConfig, expand_tilde};
use crate::crypto;
use anyhow::{Context, Result};
use base64::Engine;
use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use serde::{Deserialize, Serialize};
use std::fs;
use std::io::Write;
use std::os::unix::fs::OpenOptionsExt;
use std::time::{SystemTime, UNIX_EPOCH};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct BootstrapResponse {
    pub protocol_version: u8,
    pub server_id: [u8; 32],
    pub server_key_epoch: u64,
    pub issued_at: u64,
    pub expires_at: u64,
    pub user: String,
    pub session: String,
    pub mode: String,
    pub terminal_size: (u16, u16),
    pub client_nonce: [u8; 12],
    pub attach_token: [u8; 32],
    pub attach_ticket: Vec<u8>,
    pub attach_ticket_psk: [u8; 32],
    pub session_key: [u8; 32],
    pub session_key_id: [u8; 16],
    pub udp_host: String,
    pub udp_port: u16,
    pub aead_algorithm: String,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SealedAttachTicket {
    pub nonce: [u8; 12],
    pub ciphertext: Vec<u8>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AttachTicketPlain {
    pub server_id: [u8; 32],
    pub server_key_epoch: u64,
    pub user: String,
    pub session: String,
    pub mode: String,
    pub issued_at: u64,
    pub expires_at: u64,
    pub psk: [u8; 32],
}

pub fn now_secs() -> Result<u64> {
    Ok(SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .context("system clock before UNIX epoch")?
        .as_secs())
}

pub fn load_or_create_server_secret(config: &ServerConfig) -> Result<[u8; 32]> {
    let path = expand_tilde(&config.secret_path);
    if path.exists() {
        let raw = fs::read(&path).with_context(|| format!("read {}", path.display()))?;
        let decoded = if raw.len() == 32 {
            raw
        } else {
            URL_SAFE_NO_PAD
                .decode(String::from_utf8_lossy(&raw).trim())
                .context("decode server secret")?
        };
        let mut out = [0u8; 32];
        out.copy_from_slice(&decoded[..32]);
        return Ok(out);
    }
    if let Some(parent) = path.parent() {
        fs::create_dir_all(parent).with_context(|| format!("create {}", parent.display()))?;
    }
    let secret = crypto::random_32();
    let mut file = fs::OpenOptions::new()
        .create_new(true)
        .write(true)
        .mode(0o600)
        .open(&path)
        .with_context(|| format!("create {}", path.display()))?;
    file.write_all(URL_SAFE_NO_PAD.encode(secret).as_bytes())?;
    file.write_all(b"\n")?;
    Ok(secret)
}

pub fn build_bootstrap(
    config: &ServerConfig,
    secret: &[u8; 32],
    user: String,
    session: String,
    mode: String,
    terminal_size: (u16, u16),
    client_nonce: [u8; 12],
    udp_host: String,
) -> Result<BootstrapResponse> {
    let issued_at = now_secs()?;
    let expires_at = issued_at + config.auth_ttl_secs;
    let ticket_expires = issued_at + config.attach_ticket_ttl_secs;
    let server_id = crypto::sha256(secret);
    let session_key = crypto::hkdf32(
        secret,
        &client_nonce,
        format!("dosh/session/{user}/{session}/{issued_at}").as_bytes(),
    )?;
    let session_key_id = {
        let digest = crypto::sha256(&session_key);
        let mut out = [0u8; 16];
        out.copy_from_slice(&digest[..16]);
        out
    };
    let attach_token = attach_token(
        secret,
        &user,
        &session,
        &mode,
        terminal_size,
        &client_nonce,
        issued_at,
        expires_at,
        &session_key_id,
    );
    let attach_ticket_psk = crypto::random_32();
    let attach_ticket = build_attach_ticket(
        secret,
        server_id,
        1,
        user.clone(),
        session.clone(),
        mode.clone(),
        issued_at,
        ticket_expires,
        &attach_ticket_psk,
    )?;

    Ok(BootstrapResponse {
        protocol_version: 1,
        server_id,
        server_key_epoch: 1,
        issued_at,
        expires_at,
        user,
        session,
        mode,
        terminal_size,
        client_nonce,
        attach_token,
        attach_ticket,
        attach_ticket_psk,
        session_key,
        session_key_id,
        udp_host,
        udp_port: config.port,
        aead_algorithm: "chacha20poly1305".to_string(),
    })
}

pub fn attach_token(
    secret: &[u8; 32],
    user: &str,
    session: &str,
    mode: &str,
    terminal_size: (u16, u16),
    client_nonce: &[u8; 12],
    issued_at: u64,
    expires_at: u64,
    session_key_id: &[u8; 16],
) -> [u8; 32] {
    crypto::hmac_sha256(
        secret,
        &[
            user.as_bytes(),
            session.as_bytes(),
            mode.as_bytes(),
            &terminal_size.0.to_be_bytes(),
            &terminal_size.1.to_be_bytes(),
            client_nonce,
            &issued_at.to_be_bytes(),
            &expires_at.to_be_bytes(),
            session_key_id,
        ],
    )
}

pub fn verify_bootstrap(resp: &BootstrapResponse, secret: &[u8; 32]) -> Result<bool> {
    if now_secs()? > resp.expires_at {
        return Ok(false);
    }
    let expected = attach_token(
        secret,
        &resp.user,
        &resp.session,
        &resp.mode,
        resp.terminal_size,
        &resp.client_nonce,
        resp.issued_at,
        resp.expires_at,
        &resp.session_key_id,
    );
    Ok(expected == resp.attach_token)
}

fn build_attach_ticket(
    secret: &[u8; 32],
    server_id: [u8; 32],
    server_key_epoch: u64,
    user: String,
    session: String,
    mode: String,
    issued_at: u64,
    expires_at: u64,
    psk: &[u8; 32],
) -> Result<Vec<u8>> {
    let payload = AttachTicketPlain {
        server_id,
        server_key_epoch,
        user,
        session,
        mode,
        issued_at,
        expires_at,
        psk: *psk,
    };
    let key = attach_ticket_key(secret)?;
    let nonce = crypto::random_12();
    let encoded = bincode::serialize(&payload)?;
    let ciphertext = crypto::seal(&key, &nonce, b"dosh-sealed-attach-ticket-v1", &encoded)?;
    Ok(bincode::serialize(&SealedAttachTicket {
        nonce,
        ciphertext,
    })?)
}

pub fn verify_attach_ticket(
    secret: &[u8; 32],
    ticket_bytes: &[u8],
    psk: &[u8; 32],
    session: &str,
    mode: &str,
) -> Result<Option<AttachTicketPlain>> {
    let sealed: SealedAttachTicket = bincode::deserialize(ticket_bytes)?;
    let key = attach_ticket_key(secret)?;
    let plain = crypto::open(
        &key,
        &sealed.nonce,
        b"dosh-sealed-attach-ticket-v1",
        &sealed.ciphertext,
    )?;
    let ticket: AttachTicketPlain = bincode::deserialize(&plain)?;
    if now_secs()? > ticket.expires_at {
        return Ok(None);
    }
    if ticket.session != session || ticket.mode != mode {
        return Ok(None);
    }
    if ticket.psk != *psk {
        return Ok(None);
    }
    Ok(Some(ticket))
}

pub fn open_attach_ticket(secret: &[u8; 32], ticket_bytes: &[u8]) -> Result<AttachTicketPlain> {
    let sealed: SealedAttachTicket = bincode::deserialize(ticket_bytes)?;
    let key = attach_ticket_key(secret)?;
    let plain = crypto::open(
        &key,
        &sealed.nonce,
        b"dosh-sealed-attach-ticket-v1",
        &sealed.ciphertext,
    )?;
    Ok(bincode::deserialize(&plain)?)
}

fn attach_ticket_key(secret: &[u8; 32]) -> Result<[u8; 32]> {
    crypto::hkdf32(secret, b"dosh-ticket-key-salt-v1", b"dosh/attach-ticket/v1")
}

pub fn encode_bootstrap(resp: &BootstrapResponse) -> Result<String> {
    Ok(URL_SAFE_NO_PAD.encode(bincode::serialize(resp)?))
}

pub fn decode_bootstrap(raw: &str) -> Result<BootstrapResponse> {
    let bytes = URL_SAFE_NO_PAD.decode(raw.trim())?;
    Ok(bincode::deserialize(&bytes)?)
}