authenticator/utils.osl at main · RoturTW/authenticator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
def getClient(string token) *Client (
    if clients[token] == null (
        clients[token] = NewClient(token)
    )
    return clients[token].assert(*Client)
)

def getCookie(*gin.Context c, string name) string (
    array result = c.Cookie(name).toArray()
    if result[0] != null (
        return ""
    )
    return result[1].toStr()
)

def generateSessionToken() string (
    return crypto.randomBytes(32)
)

def hashSession(string session) string (
    return crypto.sha256(session)
)

def validateSession(string token, string session) boolean (
    string key = token ++ "_" ++ hashSession(session)
    if sessions[key] == null (
        return false
    )

    object sess = sessions[key].assert(object)
    number expiry = sess["expiry"].toNum()
    if expiry < timestamp / 1000 (
        sessions.delete(key)
        return false
    )

    return true
)

def setSession(string token, string session) (
    string key = token ++ "_" ++ hashSession(session)
    number expiry = (timestamp / 1000) + 14400
    sessions[key] = { expiry: expiry }
)

def checkRateLimit(string identifier) object (
    if lockouts[identifier] != null (
        object lockout = lockouts[identifier].assert(object)
        number until = lockout["until"].toNum()
        if (timestamp / 1000) < until (
            return { locked: true, remaining: until - (timestamp / 1000) }
        )
        lockouts.delete(identifier)
    )
    return { locked: false }
)

def recordFailedAttempt(string identifier) (
    if failedAttempts[identifier] == null (
        failedAttempts[identifier] = 0
    )
    failedAttempts[identifier] = failedAttempts[identifier].toNum() + 1

    if failedAttempts[identifier].toNum() >= 5 (
        lockouts[identifier] = { until: (timestamp / 1000) + 30 }
        failedAttempts.delete(identifier)
    )
)

def clearFailedAttempts(string identifier) (
    failedAttempts.delete(identifier)
)

def getRemainingAttempts(string identifier) number (
    if failedAttempts[identifier] == null (
        return 5
    )
    return 5 - failedAttempts[identifier].toNum()
)

def cleanIdentifier(string token) string (
    if token.len > 16 (
        return token[:16] ++ "..."
    )
    return token
)

def isValidPasscode(string passcode) boolean (
    if passcode.len != 6 (
        return false
    )

    for i passcode.len (
        string char = passcode[i].toStr()
        number ord = char.ord()
        if ord < 48 or ord > 57 (
            return false
        )
    )

    return true
)

def deriveKey(string passcode, string salt, number iterations) string (
    return crypto.pbkdf2(passcode, salt, iterations, 32, "sha256")
)