ident

8.0 KB

1. // lib/login.hl — THE LOGIN to ident (piece 1, ticket #24): email → a six-digit code by mail → signed in. The
2. // code tables and every write to them, the limits (per address, per client IP), the check of a code (the first
3. // right one creates the account), and the PENDING sign-in of the code page (ident#20). The code and IP-bucket
4. // helpers: lib/login-helpers.hl. Statics only, the server realm.
5. //
6. // otpTable pk @id index email a pending one-time login code:
7. // { email, hash = sha256(email:code), expires, tries } (one per email)
8. // sendsTable pk @id index email one row per code mailed: { email, at } (rate limit)
9. // ipSendsTable pk @id index ip one row per code mailed: { ip (the client's BUCKET), at }
10. // (the per-IP limit, mission 006 (old 010))
11. //
12. // Codes are never stored in clear, only their sha256.
13. import { MPackDB } from 'hl:mpackdb'
14. import { now } from 'hl:time'
15. import { dir, envNumber, countOf, first, merged, normEmail, validEmail } from './util.hl'
16. import { newOtp, otpHash, ipBucket } from './login-helpers.hl'
17. import { accountByEmail, createAccount, beginSession } from './accounts.hl'
18. import { identityRows } from './identities.hl'
20. static otpTable = new MPackDB(file = dir + '/otp.db', primaryKey = '@id', indexes = ['email'])
21. static sendsTable = new MPackDB(file = dir + '/sends.db', primaryKey = '@id', indexes = ['email'])
22. static ipSendsTable = new MPackDB(file = dir + '/ipsends.db', primaryKey = '@id', indexes = ['ip'])
24. // THE CLOCKS AND LIMITS (ms). The env names exist for the gate's short-clock server.
25. static otpTtl = envNumber('IDENT_OTP_TTL_MS', 600000) // a login code: 10 min
26. static maxTries = 5 // wrong codes before it dies
27. static sendWindow = envNumber('IDENT_SEND_WINDOW_MS', 600000) // rate limit window: 10 min
28. static sendLimit = envNumber('IDENT_SEND_LIMIT', 3) // codes per email per window
29. // THE PER-IP LIMIT (mission 006 (old 010)): codes mailed per client IP BUCKET (login-helpers.hl ipBucket) —
30. // 10 per 10 min and 30 per 24 h, so one client cannot use ident to mail many addresses
31. static ipWindow = envNumber('IDENT_IP_WINDOW_MS', 600000) // short window: 10 min
32. static ipLimit = envNumber('IDENT_IP_LIMIT', 10) // codes per IP per short window
33. static ipDayWindow = envNumber('IDENT_IP_DAY_WINDOW_MS', 86400000) // long window: 24 h
34. static ipDayLimit = envNumber('IDENT_IP_DAY_LIMIT', 30) // codes per IP per long window
36. // how many codes went to this bucket in the short and in the long window (and the rows
37. // older than the long window are removed on the way)
38. static ipCounts = (bucket, t0) => {
39. let inWindow = 0
40. let inDay = 0
41. rows = ipSendsTable.find('ip', bucket)
42. if (countOf(rows) > 0) {
43. for (s of rows) {
44. if (s.at > t0 - ipDayWindow) {
45. inDay = inDay + 1
46. if (s.at > t0 - ipWindow) { inWindow = inWindow + 1 }
47. } else {
48. ipSendsTable.delete(s.id)
49. }
50. }
51. }
52. return { inWindow = inWindow inDay = inDay }
53. }
55. // ---- step 1: ask for a code ---------------------------------------------------------
56. // answers { error, limited } or { email, code } — the caller mails the code. The answer
57. // does not say whether the address has an account (the first login creates it).
58. // `ip` is the client's IP (the X-Client-IP header, or null — see ipBucket). `limited` is
59. // true when a limit refused it (the route answers 429 then).
60. static startLogin = (email, ip) => {
61. e = normEmail(email)
62. if (!validEmail(e)) { return { error = 'that is not an email address' } }
63. t0 = now()
64. // THE PER-IP LIMIT first: one client, many addresses
65. bucket = ipBucket(ip)
66. ipc = ipCounts(bucket, t0)
67. if (ipc.inWindow >= ipLimit || ipc.inDay >= ipDayLimit) {
68. return { error = 'too many codes were requested from your network — wait a while and try again' limited = true }
69. }
70. let recent = 0
71. sends = sendsTable.find('email', e)
72. if (countOf(sends) > 0) {
73. for (s of sends) {
74. if (s.at > t0 - sendWindow) { recent = recent + 1 } else { sendsTable.delete(s.id) }
75. }
76. }
77. if (recent >= sendLimit) {
78. return { error = 'too many codes were sent to this address — wait a few minutes and try again' limited = true }
79. }
80. olds = otpTable.find('email', e)
81. if (countOf(olds) > 0) { for (old of olds) { otpTable.delete(old.id) } }
82. let code = newOtp()
83. otpTable.put({ email = e hash = otpHash(e, code) expires = t0 + otpTtl tries = 0 })
84. sendsTable.put({ email = e at = t0 })
85. ipSendsTable.put({ ip = bucket at = t0 })
86. return { email = e code = code }
87. }
89. // ---- step 2: check it — and on the FIRST login create the account -------------------
90. // answers { error } or { account, created }. `timeZone` is the browser's (first use);
91. // a missing or malformed one is stored as UTC, it can be changed in ident.
92. static checkCode = (email, code, timeZone) => {
93. e = normEmail(email)
94. c = code == null ? '' : ('' + code).trim()
95. p = first(otpTable.find('email', e))
96. if (p == null) { return { error = 'no code is waiting for this address — ask for a new one' } }
97. if (p.expires < now()) {
98. otpTable.delete(p.id)
99. return { error = 'the code expired — ask for a new one' }
100. }
101. if (otpHash(e, c) != p.hash) {
102. if (p.tries + 1 >= maxTries) {
103. otpTable.delete(p.id)
104. return { error = 'too many wrong codes — ask for a new one' }
105. }
106. otpTable.update(p.id, merged(p, { tries = p.tries + 1 }))
107. return { error = 'wrong code (' + (maxTries - p.tries - 1) + ' tries left)' }
108. }
109. otpTable.delete(p.id)
110. known = accountByEmail(e)
111. if (known != null) { return { account = known created = false } }
112. return { account = createAccount(e, timeZone) created = true }
113. }
115. // ---- THE PENDING SIGN-IN (ticket ident#20, mission 008 (old 032)) ------------------------------
116. // After "Send me a code" the browser's SESSION remembers the address, so a reload (a phone
117. // reloading the tab while the user reads the mail, a second tab, a socket re-seed) still
118. // shows the code step. It lives in `session.data.pendingEmail` (the app's hybrid on the
119. // Session — an undeclared member of the instance would not read back, see session.hl).
120. // It is ONLY honoured while a code for that address is really waiting: in otpTable, not
121. // expired, not used, not killed by too many wrong tries — so it never shows a code step
122. // for an address no code was sent to. It holds no secret (the code is only in the mail).
123. // Cleared on: a successful sign-in (signInWithCode), "Other address" (dropPending), and
124. // expiry / a dead code (pendingOf drops it the next time it reads it).
125. static codeWaiting = (email) => {
126. e = normEmail(email)
127. if (e == '') { return false }
128. p = first(otpTable.find('email', e))
129. return p != null && p.expires >= now() && p.tries < maxTries
130. }
132. // the face rememberPending (home.hl): { email } or { error }
133. static recordPending = (&session, email) => {
134. if (session == null) { return { error = 'no session — reload the page' } }
135. if (email == null || hlTypeName(email) != 'String') { return { error = 'field email must be a string' } }
136. e = normEmail(email)
137. if (!codeWaiting(e)) { return { error = 'no code is waiting for this address' } }
138. session.data.pendingEmail = e
139. return { email = e }
140. }
142. // the address whose code step this session shows, or null (and a stale one is dropped)
143. static pendingOf = (&session) => {
144. if (session == null || session.data == null) { return null }
145. e = session.data.pendingEmail
146. if (e == null || e == '') { return null }
147. if (!codeWaiting(e)) {
148. session.data.pendingEmail = null
149. return null
150. }
151. return e
152. }
154. static dropPending = (&session) => {
155. if (session != null && session.data != null) { session.data.pendingEmail = null }
156. return true
157. }
159. // the face verifyCode (components/home.hl): the right code signs the session in and ends its pending sign-in.
160. // Answers { error } or { account, created, identities }.
161. static signInWithCode = (&session, email, code, timeZone) => {
162. r = checkCode(email, code, timeZone)
163. if (r.error != null) { return { error = r.error } }
164. beginSession(session, r.account.id)
165. dropPending(session)
166. return { account = r.account created = r.created identities = identityRows(r.account.id) }
167. }