Complete registration flow

8 files changed, 238 insertions, 210 deletions

diff --git a/.gitignore b/.gitignore
index 048c44e..039bf37 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+/clients/
 /ssh-proxy
 /ssh-proxy-client
 /ssl/
diff --git a/Makefile b/Makefile
index 81601bc..cc3fc5f 100644
--- a/Makefile
+++ b/Makefile
@@ -16,7 +16,8 @@ $(CLIENT_BINARY): $(shell find . -name '*.go')
         CGO_ENABLED=0 go build \
                 -tags clientonly \
                 -ldflags "-X main.appVersion=$(shell git describe --long --tags --dirty --always) \
-                                  -X code.crute.us/mcrute/ssh-proxy/cmd/client.clientId=$(CLIENT_ID)"  \
+                                  -X code.crute.us/mcrute/ssh-proxy/cmd/client.clientId=$(CLIENT_ID) \
+                                  -s -w"  \
                 -o $@
 
 .PHONY: vet
diff --git a/app/controllers/register.go b/app/controllers/register.go
index 8698bda..7c1a0f3 100644
--- a/app/controllers/register.go
+++ b/app/controllers/register.go
@@ -1,7 +1,13 @@
 package controllers
 
 import (
+        "bytes"
+        "context"
+        "encoding/json"
+        "fmt"
+        "io"
         "net/http"
+        "time"
 
         "code.crute.us/mcrute/golib/echo/session"
         "code.crute.us/mcrute/ssh-proxy/app"
@@ -19,13 +25,45 @@ type RegisterController[T app.AppSession] struct {
         Webauthn     *webauthn.WebAuthn
 }
 
+func (a *RegisterController[T]) validateRequest(ctx context.Context, u *models.User, code string) (*models.AuthSession, error) {
+        if code == "" {
+                return nil, fmt.Errorf("Code not passed in request")
+        }
+
+        authSession, err := a.AuthSessions.GetByUserCode(ctx, code)
+        if err != nil {
+                return nil, fmt.Errorf("No auth session exists")
+        }
+
+        if time.Now().After(authSession.Expires) {
+                return nil, fmt.Errorf("Session is expired")
+        }
+
+        if !authSession.IsRegistration {
+                return nil, fmt.Errorf("Session is not an invitation to register")
+        }
+
+        if authSession.UserId != u.Username {
+                return nil, fmt.Errorf("Session not valid for this user")
+        }
+
+        return authSession, nil
+}
+
 func (a *RegisterController[T]) HandleStart(c echo.Context) error {
-        user, err := a.Users.Get(c.Request().Context(), c.Param("username"))
+        ctx := c.Request().Context()
+
+        user, err := a.Users.Get(ctx, c.Param("username"))
         if err != nil {
                 a.Logger.Errorf("Error getting user: %s", err)
                 return c.NoContent(http.StatusNotFound)
         }
 
+        if _, err := a.validateRequest(ctx, user, c.QueryParam("code")); err != nil {
+                a.Logger.Errorf("Error creating registration request: %s", err)
+                return c.NoContent(http.StatusNotFound)
+        }
+
         request, sessionData, err := a.Webauthn.BeginRegistration(user)
         if err != nil {
                 a.Logger.Errorf("Error creating webauthn request: %s", err)
@@ -41,13 +79,42 @@ func (a *RegisterController[T]) HandleStart(c echo.Context) error {
 }
 
 func (a *RegisterController[T]) HandleFinish(c echo.Context) error {
-        user, err := a.Users.Get(c.Request().Context(), c.Param("username"))
+        ctx := c.Request().Context()
+
+        body, err := io.ReadAll(c.Request().Body)
+        if err != nil {
+                a.Logger.Errorf("Error reading request body:", err)
+                return c.NoContent(http.StatusInternalServerError)
+        }
+
+        user, err := a.Users.Get(ctx, c.Param("username"))
         if err != nil {
                 a.Logger.Errorf("Error getting user: %s", err)
                 return c.NoContent(http.StatusNotFound)
         }
 
-        response, err := protocol.ParseCredentialCreationResponseBody(c.Request().Body)
+        var code struct {
+                Code string `json:"code"`
+        }
+        if err := json.Unmarshal(body, &code); err != nil {
+                a.Logger.Errorf("Error decoding json body")
+                return c.NoContent(http.StatusBadRequest)
+        }
+
+        authSession, err := a.validateRequest(ctx, user, code.Code)
+        if err != nil {
+                a.Logger.Errorf("Error finishing register request: %s", err)
+                return c.NoContent(http.StatusNotFound)
+        }
+
+        // Delete before anything else to avoid allowing double use of an auth
+        // session in case of other errors
+        if err := a.AuthSessions.Delete(ctx, authSession); err != nil {
+                a.Logger.Errorf("Error deleting auth session: %s", err)
+                return c.NoContent(http.StatusInternalServerError)
+        }
+
+        response, err := protocol.ParseCredentialCreationResponseBody(bytes.NewBuffer(body))
         if err != nil {
                 a.Logger.Errorf("Error parsing credential response: %s", err)
                 return c.NoContent(http.StatusBadRequest)
@@ -69,7 +136,7 @@ func (a *RegisterController[T]) HandleFinish(c echo.Context) error {
 
         user.Fido2Credentials = append(user.Fido2Credentials, *credential)
 
-        if err := a.Users.Upsert(c.Request().Context(), user); err != nil {
+        if err := a.Users.Upsert(ctx, user); err != nil {
                 a.Logger.Errorf("Error saving user: %s", err)
                 return c.NoContent(http.StatusInternalServerError)
         }
diff --git a/cmd/web/server.go b/cmd/web/server.go
index 6eb585a..62624e2 100644
--- a/cmd/web/server.go
+++ b/cmd/web/server.go
@@ -32,14 +32,14 @@ import (
         "github.com/spf13/cobra"
 )
 
-func Register(root *cobra.Command, embeddedTemplates fs.FS, appVersion string) {
+func Register(root *cobra.Command, embeddedTemplates, embeddedClients fs.FS, appVersion string) {
         webCmd := &cobra.Command{
                 Use:   "web [options]",
                 Short: "Run web server",
                 Run: func(c *cobra.Command, args []string) {
                         cfg := app.Config{}
                         cli.MustGetConfig(c, &cfg)
-                        webMain(cfg, embeddedTemplates, appVersion)
+                        webMain(cfg, embeddedTemplates, embeddedClients, appVersion)
                 },
         }
         cli.AddFlags(webCmd, &app.Config{}, app.DefaultConfig, "web")
@@ -62,7 +62,7 @@ func PopulateTemplateContext(c echo.Context) (interface{}, error) {
         }, nil
 }
 
-func webMain(cfg app.Config, embeddedTemplates fs.FS, appVersion string) {
+func webMain(cfg app.Config, embeddedTemplates, embeddedClients fs.FS, appVersion string) {
         ctx, cancel := context.WithCancel(context.Background())
         defer cancel()
 
@@ -221,6 +221,10 @@ func webMain(cfg app.Config, embeddedTemplates fs.FS, appVersion string) {
 
         csm := glmiddleware.CSRFProtect(ss)
 
+        glecho.StaticFS(s.GET, embeddedClients, "/clients", "./clients/")
+
+        s.NeverCacheStaticRoute("/js", "js")
+
         s.GET("/login", gt.Handle, csm)
         s.GET("/register", gt.Handle, csm)
 
diff --git a/main.go b/main.go
index 70d0f48..7cc3e90 100644
--- a/main.go
+++ b/main.go
@@ -23,6 +23,9 @@ import (
 //go:embed templates
 var embeddedTemplates embed.FS
 
+//go:embed clients
+var embeddedClients embed.FS
+
 var appVersion string
 
 func main() {
@@ -32,7 +35,7 @@ func main() {
         }
         cli.AddFlags(rootCmd, &app.Config{}, app.DefaultConfig, "")
 
-        web.Register(rootCmd, embeddedTemplates, appVersion)
+        web.Register(rootCmd, embeddedTemplates, embeddedClients, appVersion)
         client.Register(rootCmd)
         register.Register(rootCmd)
 
diff --git a/templates/js/base64.js b/templates/js/base64.js
new file mode 100644
index 0000000..52df92b
--- /dev/null
+++ b/templates/js/base64.js
@@ -0,0 +1,66 @@
+/*
+ * Base64URL-ArrayBuffer
+ * https://github.com/herrjemand/Base64URL-ArrayBuffer
+ *
+ * Copyright (c) 2017 Yuriy Ackermann <ackermann.yuriy@gmail.com>
+ * Copyright (c) 2012 Niklas von Hertzen
+ * Licensed under the MIT license.
+ *
+ */
+(function(){
+    'use strict';
+
+    let chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+
+    // Use a lookup table to find the index.
+    let lookup = new Uint8Array(256);
+    for (let i = 0; i < chars.length; i++) {
+        lookup[chars.charCodeAt(i)] = i;
+    }
+
+    let encode = function(arraybuffer) {
+        let bytes = new Uint8Array(arraybuffer),
+        i, len = bytes.length, base64url = '';
+
+        for (i = 0; i < len; i+=3) {
+            base64url += chars[bytes[i] >> 2];
+            base64url += chars[((bytes[i] & 3) << 4) | (bytes[i + 1] >> 4)];
+            base64url += chars[((bytes[i + 1] & 15) << 2) | (bytes[i + 2] >> 6)];
+            base64url += chars[bytes[i + 2] & 63];
+        }
+
+        if ((len % 3) === 2) {
+            base64url = base64url.substring(0, base64url.length - 1);
+        } else if (len % 3 === 1) {
+            base64url = base64url.substring(0, base64url.length - 2);
+        }
+
+        return base64url;
+    };
+
+    let decode = function(base64string) {
+        let bufferLength = base64string.length * 0.75,
+        len = base64string.length, i, p = 0,
+        encoded1, encoded2, encoded3, encoded4;
+
+        let bytes = new Uint8Array(bufferLength);
+
+        for (i = 0; i < len; i+=4) {
+            encoded1 = lookup[base64string.charCodeAt(i)];
+            encoded2 = lookup[base64string.charCodeAt(i+1)];
+            encoded3 = lookup[base64string.charCodeAt(i+2)];
+            encoded4 = lookup[base64string.charCodeAt(i+3)];
+
+            bytes[p++] = (encoded1 << 2) | (encoded2 >> 4);
+            bytes[p++] = ((encoded2 & 15) << 4) | (encoded3 >> 2);
+            bytes[p++] = ((encoded3 & 3) << 6) | (encoded4 & 63);
+        }
+
+        return bytes.buffer
+    };
+
+    window.base64url = {
+        'decode': decode,
+        'encode': encode
+    };
+})();
diff --git a/templates/login.tpl b/templates/login.tpl
index 0323409..7ee357d 100644
--- a/templates/login.tpl
+++ b/templates/login.tpl
@@ -4,76 +4,10 @@
         <meta charset="utf-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1">
         <meta name="render-time" content="{{ .RenderTime }}">
+        <meta name="csrf-token" content="{{ .CSRFToken }}" />
         {{ if .Context.HasKey "title" }}<title>{{ .Context.Get "title" }}</title>{{ else }}<title>SSH Proxy</title>{{ end }}
 
-        <script type="text/javascript">
-            /*
-             * Base64URL-ArrayBuffer
-             * https://github.com/herrjemand/Base64URL-ArrayBuffer
-             *
-             * Copyright (c) 2017 Yuriy Ackermann <ackermann.yuriy@gmail.com>
-             * Copyright (c) 2012 Niklas von Hertzen
-             * Licensed under the MIT license.
-             * 
-             */
-            (function(){
-                'use strict';
-
-                let chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
-
-                // Use a lookup table to find the index.
-                let lookup = new Uint8Array(256);
-                for (let i = 0; i < chars.length; i++) {
-                    lookup[chars.charCodeAt(i)] = i;
-                }
-
-                let encode = function(arraybuffer) {
-                    let bytes = new Uint8Array(arraybuffer),
-                    i, len = bytes.length, base64url = '';
-
-                    for (i = 0; i < len; i+=3) {
-                        base64url += chars[bytes[i] >> 2];
-                        base64url += chars[((bytes[i] & 3) << 4) | (bytes[i + 1] >> 4)];
-                        base64url += chars[((bytes[i + 1] & 15) << 2) | (bytes[i + 2] >> 6)];
-                        base64url += chars[bytes[i + 2] & 63];
-                    }
-
-                    if ((len % 3) === 2) {
-                        base64url = base64url.substring(0, base64url.length - 1);
-                    } else if (len % 3 === 1) {
-                        base64url = base64url.substring(0, base64url.length - 2);
-                    }
-
-                    return base64url;
-                };
-
-                let decode = function(base64string) {
-                    let bufferLength = base64string.length * 0.75,
-                    len = base64string.length, i, p = 0,
-                    encoded1, encoded2, encoded3, encoded4;
-
-                    let bytes = new Uint8Array(bufferLength);
-
-                    for (i = 0; i < len; i+=4) {
-                        encoded1 = lookup[base64string.charCodeAt(i)];
-                        encoded2 = lookup[base64string.charCodeAt(i+1)];
-                        encoded3 = lookup[base64string.charCodeAt(i+2)];
-                        encoded4 = lookup[base64string.charCodeAt(i+3)];
-
-                        bytes[p++] = (encoded1 << 2) | (encoded2 >> 4);
-                        bytes[p++] = ((encoded2 & 15) << 4) | (encoded3 >> 2);
-                        bytes[p++] = ((encoded3 & 3) << 6) | (encoded4 & 63);
-                    }
-
-                    return bytes.buffer
-                };
-
-                window.base64url = {
-                    'decode': decode,
-                    'encode': encode
-                };
-            })();
-        </script>
+        <script type="text/javascript" src="/js/base64.js"></script>
 
         <script type="text/javascript">
             window.addEventListener("load", _ => {
@@ -83,24 +17,35 @@
                     document.getElementById("code").value = code;
                 }
 
+                const usernameCookie = document.cookie
+                    .split("; ")
+                    .find((row) => row.startsWith("username="))
+                    ?.split("=")[1];
+
+                if (usernameCookie != undefined && usernameCookie !== "") {
+                    document.getElementById("username").value = usernameCookie;
+                }
+
                 document.getElementById("login").addEventListener("click", evt => {
                     evt.preventDefault();
 
-                    var username = document.getElementById("username");
-                    fetch("/auth/login/" + username.value)
-                        .then((result) => result.json())
+                    const username = document.getElementById("username").value;
+                    document.cookie = `username=${username}; expires=Fri, 31 Dec 9999 23:59:59 GMT; Secure`;
+
+                    fetch("/auth/login/" + username)
+                        .then((response) => response.json())
                         .then((data) => {
                             data.publicKey.challenge = base64url.decode(data.publicKey.challenge);
                             data.publicKey.allowCredentials.forEach(e => e.id = base64url.decode(e.id));
 
                             navigator.credentials.get(data)
                                 .then((credential) => {
-                                    fetch("/auth/login/" + username.value, {
+                                    fetch("/auth/login/" + username, {
                                         method: "POST",
                                         mode: "same-origin",
                                         headers: {
                                             "Content-Type": "application/json",
-                                            "X-CSRF-Token": "{{ .CSRFToken }}"
+                                            "X-CSRF-Token": document.querySelector("meta[name=csrf-token]").content,
                                         },
                                         body: JSON.stringify({
                                             code: document.getElementById("code").value,
@@ -130,7 +75,6 @@
         <form>
             <label for="code">Code: <input type="text" name="code" id="code" /></label><br/>
             <label for="username">Username: <input type="text" name="username" id="username" autocorrect="off" autocapitalize="none" autocomplete="username" /></label><br/>
-            <input type="hidden" value="{{ .CSRFToken }}" name="csrf-token" />
             <input type="submit" id="login" value="Login" />
         </form>
     </body>
diff --git a/templates/register.tpl b/templates/register.tpl
index 794ddaa..37252a0 100644
--- a/templates/register.tpl
+++ b/templates/register.tpl
@@ -4,143 +4,85 @@
         <meta charset="utf-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1">
         <meta name="render-time" content="{{ .RenderTime }}">
+        <meta name="csrf-token" content="{{ .CSRFToken }}" />
         {{ if .Context.HasKey "title" }}<title>{{ .Context.Get "title" }}</title>{{ else }}<title>SSH Proxy</title>{{ end }}
-    </head>
-
-    <body>
-        <script type="text/javascript">
-            /*
-             * Base64URL-ArrayBuffer
-             * https://github.com/herrjemand/Base64URL-ArrayBuffer
-             *
-             * Copyright (c) 2017 Yuriy Ackermann <ackermann.yuriy@gmail.com>
-             * Copyright (c) 2012 Niklas von Hertzen
-             * Licensed under the MIT license.
-             * 
-             */
-            (function(){
-                'use strict';
-
-                let chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
-
-                // Use a lookup table to find the index.
-                let lookup = new Uint8Array(256);
-                for (let i = 0; i < chars.length; i++) {
-                    lookup[chars.charCodeAt(i)] = i;
-                }
 
-                let encode = function(arraybuffer) {
-                    let bytes = new Uint8Array(arraybuffer),
-                    i, len = bytes.length, base64url = '';
+        <script type="text/javascript" src="/js/base64.js"></script>
 
-                    for (i = 0; i < len; i+=3) {
-                        base64url += chars[bytes[i] >> 2];
-                        base64url += chars[((bytes[i] & 3) << 4) | (bytes[i + 1] >> 4)];
-                        base64url += chars[((bytes[i + 1] & 15) << 2) | (bytes[i + 2] >> 6)];
-                        base64url += chars[bytes[i + 2] & 63];
-                    }
-
-                    if ((len % 3) === 2) {
-                        base64url = base64url.substring(0, base64url.length - 1);
-                    } else if (len % 3 === 1) {
-                        base64url = base64url.substring(0, base64url.length - 2);
-                    }
-
-                    return base64url;
-                };
-
-                let decode = function(base64string) {
-                    let bufferLength = base64string.length * 0.75,
-                    len = base64string.length, i, p = 0,
-                    encoded1, encoded2, encoded3, encoded4;
-
-                    let bytes = new Uint8Array(bufferLength);
-
-                    for (i = 0; i < len; i+=4) {
-                        encoded1 = lookup[base64string.charCodeAt(i)];
-                        encoded2 = lookup[base64string.charCodeAt(i+1)];
-                        encoded3 = lookup[base64string.charCodeAt(i+2)];
-                        encoded4 = lookup[base64string.charCodeAt(i+3)];
+        <script type="text/javascript">
+            function doRegister(evt) {
+                evt.preventDefault();
 
-                        bytes[p++] = (encoded1 << 2) | (encoded2 >> 4);
-                        bytes[p++] = ((encoded2 & 15) << 4) | (encoded3 >> 2);
-                        bytes[p++] = ((encoded3 & 3) << 6) | (encoded4 & 63);
-                    }
+                const code = document.getElementById("code").value;
 
-                    return bytes.buffer
-                };
+                const username = document.getElementById("username").value;
+                document.cookie = `username=${username}; expires=Fri, 31 Dec 9999 23:59:59 GMT; Secure`;
 
-                window.base64url = {
-                    'decode': decode,
-                    'encode': encode
-                };
-            })();
+                fetch(`/auth/register/${username}?code=${code}`)
+                    .then((response) => {
+                        if (!response.ok) {
+                            document.body.innerHTML = "<h1>Error Fetching Registration Request</h1>";
+                            throw new Error("Error fetching registration request");
+                        }
+                        return response.json();
+                    })
+                    .then((data) => {
+                        data.publicKey.challenge = base64url.decode(data.publicKey.challenge);
+                        data.publicKey.user.id = base64url.decode(data.publicKey.user.id);
+
+                        navigator.credentials.create(data)
+                            .then((credential) => {
+                                fetch(`/auth/register/${username}`, {
+                                    method: "POST",
+                                    mode: "same-origin",
+                                    headers: {
+                                        "Content-Type": "application/json",
+                                        "X-CSRF-Token": document.querySelector("meta[name=csrf-token]").content,
+                                    },
+                                    body: JSON.stringify({
+                                        code: code,
+                                        type: credential.type,
+                                        id: credential.id,
+                                        rawId: base64url.encode(credential.rawId),
+                                        response: {
+                                            clientDataJSON: base64url.encode(credential.response.clientDataJSON),
+                                            attestationObject: base64url.encode(credential.response.attestationObject)
+                                        }
+                                    })
+                                })
+                                .then((response) => {
+                                    if (response.ok) { document.body.innerHTML = "<h1>Success</h1>"; }
+                                    else {  document.body.innerHTML = "<h1>Failure</h1>"; }
+                                });
+                            });
+                    });
+            }
 
-            var request = {{ .Model.WebautnRequest }};
-            request.publicKey.challenge = base64url.decode(request.publicKey.challenge);
-            {{ if .Model.LoginMode }}
-            request.publicKey.allowCredentials.forEach(e => e.id = base64url.decode(e.id));
-            {{ else }}
-            request.publicKey.user.id = base64url.decode(request.publicKey.user.id);
-            {{ end }}
+            window.addEventListener("load", _ => {
+                const urlParams = new URLSearchParams(window.location.search);
+                const code = urlParams.get("code");
+                if (code !== "") {
+                    document.getElementById("code").value = code;
+                }
 
-            {{ if .Model.LoginMode }}
-            navigator.credentials.get(request)
-                .then((credential) => {
-                    console.log(credential);
+                const usernameCookie = document.cookie.split("; ")
+                    .find((row) => row.startsWith("username="))
+                    .split("=")[1];
 
-                    fetch(document.URL, {
-                        method: "POST",
-                        mode: "same-origin",
-                        headers: {
-                            "Content-Type": "application/json",
-                            "X-CSRF-Token": "{{ .CSRFToken }}"
-                        },
-                        body: JSON.stringify({
-                            type: credential.type,
-                            id: credential.id,
-                            rawId: base64url.encode(credential.rawId),
-                            response: {
-                                authenticatorData: base64url.encode(credential.response.authenticatorData),
-                                clientDataJSON: base64url.encode(credential.response.clientDataJSON),
-                                signature: base64url.encode(credential.response.signature),
-                                userHandle: base64url.encode(credential.response.userHandle)
-                            }
-                        })
-                    })
-                    .then((response) => {
-                        if (response.ok) { document.body.innerHTML = "<h1>Success</h1>"; }
-                        else {  document.body.innerHTML = "<h1>Failure</h1>"; }
-                    });
-                });
-            {{ else }}
-            navigator.credentials.create(request)
-                .then((credential) => {
-                    console.log(credential);
+                if (usernameCookie != undefined && usernameCookie !== "") {
+                    document.getElementById("username").value = usernameCookie;
+                }
 
-                    fetch(document.URL, {
-                        method: "POST",
-                        mode: "same-origin",
-                        headers: {
-                            "Content-Type": "application/json",
-                            "X-CSRF-Token": "{{ .CSRFToken }}"
-                        },
-                        body: JSON.stringify({
-                            type: credential.type,
-                            id: credential.id,
-                            rawId: base64url.encode(credential.rawId),
-                            response: {
-                                clientDataJSON: base64url.encode(credential.response.clientDataJSON),
-                                attestationObject: base64url.encode(credential.response.attestationObject)
-                            }
-                        })
-                    })
-                    .then((response) => {
-                        if (response.ok) { document.body.innerHTML = "<h1>Success</h1>"; }
-                        else {  document.body.innerHTML = "<h1>Failure</h1>"; }
-                    });
-                });
-            {{ end }}
+                document.getElementById("login").addEventListener("click", doRegister);
+            });
         </script>
+    </head>
+
+    <body>
+        <form>
+            <label for="code">Code: <input type="text" name="code" id="code" /></label><br/>
+            <label for="username">Username: <input type="text" name="username" id="username" autocorrect="off" autocapitalize="none" autocomplete="username" /></label><br/>
+            <input type="submit" id="login" value="Login" />
+        </form>
     </body>
 </html>