Compare commits
No commits in common. "main" and "v1.0" have entirely different histories.
6
go.mod
6
go.mod
|
|
@ -4,8 +4,9 @@ go 1.22
|
|||
|
||||
require (
|
||||
github.com/catalinc/hashcash v1.0.0
|
||||
github.com/dgrijalva/jwt-go v3.2.0+incompatible
|
||||
github.com/gin-contrib/sessions v1.0.1
|
||||
github.com/gin-gonic/gin v1.9.1
|
||||
github.com/golang-jwt/jwt v3.2.2+incompatible
|
||||
github.com/mattn/go-sqlite3 v1.14.22
|
||||
github.com/spf13/viper v1.18.2
|
||||
golang.org/x/crypto v0.22.0
|
||||
|
|
@ -22,6 +23,9 @@ require (
|
|||
github.com/go-playground/universal-translator v0.18.1 // indirect
|
||||
github.com/go-playground/validator/v10 v10.19.0 // indirect
|
||||
github.com/goccy/go-json v0.10.2 // indirect
|
||||
github.com/gorilla/context v1.1.2 // indirect
|
||||
github.com/gorilla/securecookie v1.1.2 // indirect
|
||||
github.com/gorilla/sessions v1.2.2 // indirect
|
||||
github.com/hashicorp/hcl v1.0.0 // indirect
|
||||
github.com/json-iterator/go v1.1.12 // indirect
|
||||
github.com/klauspost/cpuid/v2 v2.2.7 // indirect
|
||||
|
|
|
|||
14
go.sum
14
go.sum
|
|
@ -15,12 +15,16 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
|
|||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
|
||||
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
|
||||
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
|
||||
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
|
||||
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
|
||||
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
|
||||
github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
|
||||
github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
|
||||
github.com/gin-contrib/sessions v1.0.1 h1:3hsJyNs7v7N8OtelFmYXFrulAf6zSR7nW/putcPEHxI=
|
||||
github.com/gin-contrib/sessions v1.0.1/go.mod h1:ouxSFM24/OgIud5MJYQJLpy6AwxQ5EYO9yLhbtObGkM=
|
||||
github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
|
||||
github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
|
||||
github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
|
||||
|
|
@ -35,11 +39,17 @@ github.com/go-playground/validator/v10 v10.19.0 h1:ol+5Fu+cSq9JD7SoSqe04GMI92cbn
|
|||
github.com/go-playground/validator/v10 v10.19.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
|
||||
github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
|
||||
github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
|
||||
github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
|
||||
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
|
||||
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
|
||||
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o=
|
||||
github.com/gorilla/context v1.1.2/go.mod h1:KDPwT9i/MeWHiLl90fuTgrt4/wPcv75vFAZLaOOcbxM=
|
||||
github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
|
||||
github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
|
||||
github.com/gorilla/sessions v1.2.2 h1:lqzMYz6bOfvn2WriPUjNByzeXIlVzURcPmgMczkmTjY=
|
||||
github.com/gorilla/sessions v1.2.2/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
|
||||
github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
|
||||
github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
|
||||
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
|
||||
|
|
|
|||
86
main.go
86
main.go
|
|
@ -3,18 +3,20 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"crypto/sha256"
|
||||
"crypto/x509"
|
||||
"database/sql"
|
||||
"encoding/base64"
|
||||
"encoding/binary"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"math/big"
|
||||
"net/http"
|
||||
"os"
|
||||
"path/filepath"
|
||||
|
|
@ -24,8 +26,8 @@ import (
|
|||
"time"
|
||||
|
||||
"github.com/catalinc/hashcash"
|
||||
"github.com/dgrijalva/jwt-go"
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/golang-jwt/jwt"
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
"github.com/spf13/viper"
|
||||
"golang.org/x/crypto/scrypt"
|
||||
|
|
@ -34,8 +36,10 @@ import (
|
|||
var (
|
||||
conn *sql.DB
|
||||
mem *sql.DB
|
||||
privateKey ed25519.PrivateKey
|
||||
publicKey ed25519.PublicKey
|
||||
privateKey *rsa.PrivateKey
|
||||
publicKey *rsa.PublicKey
|
||||
modulus *big.Int
|
||||
exponent int
|
||||
)
|
||||
|
||||
func ensureTrailingSlash(url string) string {
|
||||
|
|
@ -45,6 +49,29 @@ func ensureTrailingSlash(url string) string {
|
|||
return url
|
||||
}
|
||||
|
||||
func Int64ToBase64URL(num int64) (string, error) {
|
||||
numBytes := make([]byte, 8)
|
||||
binary.BigEndian.PutUint64(numBytes, uint64(num))
|
||||
startIndex := 0
|
||||
for startIndex < len(numBytes) && numBytes[startIndex] == 0 {
|
||||
startIndex++
|
||||
}
|
||||
trimmedBytes := numBytes[startIndex:]
|
||||
encoded := base64.URLEncoding.EncodeToString(trimmedBytes)
|
||||
return encoded, nil
|
||||
}
|
||||
|
||||
func BigIntToBase64URL(num *big.Int) (string, error) {
|
||||
numBytes := num.Bytes()
|
||||
startIndex := 0
|
||||
for startIndex < len(numBytes) && numBytes[startIndex] == 0 {
|
||||
startIndex++
|
||||
}
|
||||
trimmedBytes := numBytes[startIndex:]
|
||||
encoded := base64.URLEncoding.EncodeToString(trimmedBytes)
|
||||
return encoded, nil
|
||||
}
|
||||
|
||||
const saltChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
|
||||
|
||||
func randomChars(length int) (string, error) {
|
||||
|
|
@ -375,7 +402,7 @@ func main() {
|
|||
log.Println("[INFO] Key pair not found. Obviously someone hasn't read the README. I guess I'll have to do everything myself :P")
|
||||
}
|
||||
|
||||
tempPublicKey, tempPrivateKey, err := ed25519.GenerateKey(rand.Reader)
|
||||
tempPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
|
||||
if err != nil {
|
||||
log.Fatalln("[ERROR] Cannot generate private key:", err)
|
||||
}
|
||||
|
|
@ -385,16 +412,18 @@ func main() {
|
|||
log.Fatalln("[ERROR] Cannot marshal private key:", err)
|
||||
}
|
||||
privateKeyFile = pem.EncodeToMemory(&pem.Block{
|
||||
Type: "ED25519 PRIVATE KEY",
|
||||
Type: "RSA PRIVATE KEY",
|
||||
Bytes: privateKeyBytes,
|
||||
})
|
||||
|
||||
tempPublicKey := tempPrivateKey.Public()
|
||||
|
||||
publicKeyBytes, err := x509.MarshalPKIXPublicKey(tempPublicKey)
|
||||
if err != nil {
|
||||
log.Fatalln("[ERROR] Cannot marshal public key:", err)
|
||||
}
|
||||
pubKeyFile = pem.EncodeToMemory(&pem.Block{
|
||||
Type: "ED25519 PUBLIC KEY",
|
||||
Type: "RSA PUBLIC KEY",
|
||||
Bytes: publicKeyBytes,
|
||||
})
|
||||
|
||||
|
|
@ -437,15 +466,15 @@ func main() {
|
|||
log.Fatalln("[ERROR] Failed to parse PEM block containing the private key")
|
||||
}
|
||||
|
||||
privateKeyBytes, err := x509.ParsePKCS8PrivateKey(block.Bytes)
|
||||
privateKeyRaw, err := x509.ParsePKCS8PrivateKey(block.Bytes)
|
||||
if err != nil {
|
||||
log.Fatalln("[ERROR] Failed to parse private key:", err)
|
||||
}
|
||||
|
||||
var ok bool
|
||||
privateKey, ok = privateKeyBytes.(ed25519.PrivateKey)
|
||||
privateKey, ok = privateKeyRaw.(*rsa.PrivateKey)
|
||||
if !ok {
|
||||
log.Fatalln("[ERROR] Failed to parse private key")
|
||||
log.Fatalln("[ERROR] Failed to convert private key to RSA private key")
|
||||
}
|
||||
|
||||
pubKeyFile, err = os.ReadFile(publicKeyPath)
|
||||
|
|
@ -458,16 +487,19 @@ func main() {
|
|||
log.Fatalln("[ERROR] Failed to parse PEM block containing the public key")
|
||||
}
|
||||
|
||||
publicKeyBytes, err := x509.ParsePKIXPublicKey(block.Bytes)
|
||||
pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
|
||||
if err != nil {
|
||||
log.Fatalln("[ERROR] Failed to parse public key:", err)
|
||||
}
|
||||
|
||||
publicKey, ok = publicKeyBytes.(ed25519.PublicKey)
|
||||
publicKey, ok = pubKey.(*rsa.PublicKey)
|
||||
if !ok {
|
||||
log.Fatalln("[ERROR] Failed to parse public key")
|
||||
log.Fatalln("[ERROR] Failed to convert public key to RSA public key")
|
||||
}
|
||||
|
||||
modulus = privateKey.N
|
||||
exponent = privateKey.E
|
||||
|
||||
gin.SetMode(gin.ReleaseMode)
|
||||
router := gin.New()
|
||||
|
||||
|
|
@ -530,9 +562,8 @@ func main() {
|
|||
if err != nil {
|
||||
log.Println("[ERROR] Unknown in /testapp createTestApp():", err)
|
||||
c.String(500, "Something went wrong on our end. Please report this bug at https://centrifuge.hectabit.org/hectabit/burgernotes and refer to the documentation for more info. Your error code is: UNKNOWN-TESTAPP-CREATE")
|
||||
} else {
|
||||
c.HTML(200, "refresh.html", gin.H{})
|
||||
}
|
||||
c.HTML(200, "refresh.html", gin.H{})
|
||||
return
|
||||
} else {
|
||||
log.Println("[ERROR] Unknown in /testapp:", err)
|
||||
|
|
@ -1393,7 +1424,7 @@ func main() {
|
|||
"session": sessionKey,
|
||||
"nonce": nonce,
|
||||
}
|
||||
tokenTemp := jwt.NewWithClaims(jwt.SigningMethodEdDSA, dataTemplate)
|
||||
tokenTemp := jwt.NewWithClaims(jwt.SigningMethodRS256, dataTemplate)
|
||||
tokenTemp.Header["kid"] = "burgerauth"
|
||||
jwtToken, err = tokenTemp.SignedString(privateKey)
|
||||
if err != nil {
|
||||
|
|
@ -1412,7 +1443,7 @@ func main() {
|
|||
"aud": appId,
|
||||
}
|
||||
|
||||
secretTemp := jwt.NewWithClaims(jwt.SigningMethodEdDSA, dataTemplateTwo)
|
||||
secretTemp := jwt.NewWithClaims(jwt.SigningMethodRS256, dataTemplateTwo)
|
||||
secretTemp.Header["kid"] = "burgerauth"
|
||||
secretToken, err := secretTemp.SignedString(privateKey)
|
||||
if err != nil {
|
||||
|
|
@ -1975,15 +2006,28 @@ func main() {
|
|||
})
|
||||
|
||||
router.GET("/.well-known/jwks.json", func(c *gin.Context) {
|
||||
mod, err := BigIntToBase64URL(modulus)
|
||||
if err != nil {
|
||||
log.Println("[ERROR] Unknown in /well-known/jwks.json modulus:", err)
|
||||
c.JSON(500, gin.H{"error": "Something went wrong on our end. Please report this bug at https://concord.hectabit.org/hectabit/burgerauth and refer to the docs for more info. Your error code is: UNKNOWN-JWKS-MODULUS"})
|
||||
return
|
||||
}
|
||||
|
||||
exp, err := Int64ToBase64URL(int64(exponent))
|
||||
if err != nil {
|
||||
log.Println("[ERROR] Unknown in /well-known/jwks.json exponent:", err)
|
||||
c.JSON(500, gin.H{"error": "Something went wrong on our end. Please report this bug at https://concord.hectabit.org/hectabit/burgerauth and refer to the docs for more info. Your error code is: UNKNOWN-JWKS-EXPONENT"})
|
||||
return
|
||||
}
|
||||
keys := gin.H{
|
||||
"keys": []gin.H{
|
||||
{
|
||||
"kty": "OKP",
|
||||
"alg": "EdDSA",
|
||||
"kty": "RSA",
|
||||
"alg": "RS256",
|
||||
"use": "sig",
|
||||
"kid": keyIdentifier,
|
||||
"x": base64.RawURLEncoding.EncodeToString(publicKey),
|
||||
"crv": "Ed25519",
|
||||
"n": mod,
|
||||
"e": exp,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
Reference in New Issue