ident

2.7 KB

1. // lib/login-helpers.hl — what lib/login.hl looks up: making a six-digit code and its hash, and the client's IP
2. // BUCKET of the per-IP limit. No table access. Statics only.
3. import { randomBytes, sha256 } from 'hl:crypto'
5. // ---- codes --------------------------------------------------------------------------
6. // six digits from the kernel CSPRNG (randomBytes answers hex)
7. static newOtp = () => {
8. hex = randomBytes(8)
9. let n = 0
10. let i = 0
11. while (i < 12) {
12. n = (n * 16 + '0123456789abcdef'.indexOf(hex[i])) % 1000000
13. i = i + 1
14. }
15. let s = '' + n
16. while (s.length < 6) { s = '0' + s }
17. return s
18. }
19. static otpHash = (email, code) => { return sha256(email + ':' + code) }
21. // ---- the client's IP bucket (mission 006 (old 010)) -------------------------------------------
22. // `ip` is the X-Client-IP header nginx sets on Byrodin (CF-Connecting-IP when the request
23. // really came through Cloudflare, else the TCP peer; nginx OVERWRITES what a client sent),
24. // or null when there is none (dev without nginx: hl:web's req.remoteAddress would be nginx's; hl:http1 did not expose the
25. // connection's peer address). The bucket:
26. // no header / empty → 'direct' ONE SHARED BUCKET for every header-less request
27. // IPv4 (also ::ffff:a.b.c.d) → the address
28. // IPv6 → its /64 prefix ('2a01:4f9:3080:1126::/64'): one client
29. // usually owns a whole /64, so per-address would not limit it
30. // anything else → the text itself (lowercased, cut to 64 chars)
31. static hexDigits = '0123456789abcdef'
32. static stripZeros = (g) => {
33. let t = g
34. while (t.length > 1 && t[0] == '0') { t = t.slice(1, t.length) }
35. return t
36. }
37. static ipBucket = (ip) => {
38. if (ip == null || hlTypeName(ip) != 'String') { return 'direct' }
39. let t = ip.trim().toLowerCase()
40. if (t == '') { return 'direct' }
41. if (t.length > 64) { t = t.slice(0, 64) }
42. if (!t.includes(':')) { return t }
43. // an IPv4-mapped IPv6 address counts as its IPv4 address
44. if (t.includes('.')) { return t.slice(t.lastIndexOf(':') + 1, t.length) }
45. let head = t
46. let tail = ''
47. gap = t.indexOf('::')
48. if (gap >= 0) {
49. head = t.slice(0, gap)
50. tail = t.slice(gap + 2, t.length)
51. }
52. groups = head == '' ? [] : head.split(':')
53. rest = tail == '' ? [] : tail.split(':')
54. if (gap >= 0) {
55. let fill = 8 - groups.length - rest.length
56. while (fill > 0) {
57. groups.push('0')
58. fill = fill - 1
59. }
60. }
61. for (g of rest) { groups.push(g) }
62. if (groups.length != 8) { return t }
63. out = []
64. let i = 0
65. while (i < 4) {
66. let g = groups[i]
67. if (g == '' || g.length > 4) { return t }
68. let j = 0
69. while (j < g.length) {
70. if (!hexDigits.includes(g[j])) { return t }
71. j = j + 1
72. }
73. out.push(stripZeros(g))
74. i = i + 1
75. }
76. return out.join(':') + '::/64'
77. }