vw_small

webauthn.rs (6376B)

---

 use crate::{
     api::{EmptyResult, JsonResult, PasswordOrOtpData},
     auth::Headers,
     config,
     db::{
         models::{WebAuthn, WebAuthnAuth, WebAuthnChallenge, WebAuthnInfo, WebAuthnReg},
         DbConn,
     },
     error::Error,
 };
 use rocket::serde::json::Json;
 use rocket::Route;
 use url::Url;
 use webauthn_rs::prelude::{
     PublicKeyCredential, RegisterPublicKeyCredential, Uuid, Webauthn, WebauthnBuilder,
     WebauthnError,
 };
 
 pub fn routes() -> Vec<Route> {
     routes![
         activate_webauthn,
         activate_webauthn_put,
         delete_webauthn,
         generate_webauthn_challenge,
         get_webauthn,
     ]
 }
 fn build_webauthn() -> Result<Webauthn, WebauthnError> {
     WebauthnBuilder::new(
         config::get_config().domain(),
         &Url::parse(&config::get_config().domain_origin()).expect("a valid URL"),
     )?
     .build()
 }
 
 #[post("/two-factor/get-webauthn", data = "<data>")]
 async fn get_webauthn(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
     let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
     data.validate(&user)?;
     let keys = WebAuthnInfo::get_all_by_user(&user.uuid, &conn).await?;
     Ok(Json(json!({
         "enabled": !keys.is_empty(),
         "keys": keys,
         "object": "twoFactorWebAuthn"
     })))
 }
 #[post("/two-factor/get-webauthn-challenge", data = "<data>")]
 async fn generate_webauthn_challenge(
     data: Json<PasswordOrOtpData>,
     headers: Headers,
     conn: DbConn,
 ) -> JsonResult {
     let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
     data.validate(&user)?;
     let (challenge, registration) = build_webauthn()?.start_securitykey_registration(
         Uuid::try_parse(user.uuid.as_str()).expect("unable to create UUID"),
         user.email.as_str(),
         user.name.as_str(),
         Some(WebAuthn::get_all_credentials_by_user(&user.uuid, &conn).await?),
         None,
         None,
     )?;
     WebAuthnChallenge::Reg(WebAuthnReg::new(user.uuid, &registration)?)
         .replace(&conn)
         .await?;
     let mut challenge_value = serde_json::to_value(challenge.public_key)?;
     challenge_value["status"] = "ok".into();
     challenge_value["errorMessage"] = "".into();
     Ok(Json(challenge_value))
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EnableWebauthnData {
     id: i64,
     name: String,
     device_response: RegisterPublicKeyCredential,
     master_password_hash: String,
 }
 
 #[post("/two-factor/webauthn", data = "<data>")]
 async fn activate_webauthn(
     data: Json<EnableWebauthnData>,
     headers: Headers,
     conn: DbConn,
 ) -> JsonResult {
     let data = data.into_inner();
     let user = headers.user;
     PasswordOrOtpData {
         master_password_hash: Some(data.master_password_hash),
         otp: None,
     }
     .validate(&user)?;
     // Retrieve and delete the saved challenge state
     let chall = WebAuthnReg::find_by_user(&user.uuid, &conn)
         .await?
         .ok_or_else(|| Error::from(String::from("no webauthn challenge")))?;
     let registration = chall.security_key_reg()?;
     WebAuthnChallenge::Reg(chall).delete(&conn).await?;
     // Verify the credentials with the saved state
     let security_key =
         build_webauthn()?.finish_securitykey_registration(&data.device_response, &registration)?;
     WebAuthn::new(user.uuid.clone(), data.id, data.name, &security_key)?
         .insert(&conn)
         .await?;
     let keys = WebAuthnInfo::get_all_by_user(user.uuid.as_str(), &conn).await?;
     Ok(Json(json!({
         "enabled": !keys.is_empty(),
         "keys": keys,
         "object": "twoFactorWebAuthn"
     })))
 }
 
 #[put("/two-factor/webauthn", data = "<data>")]
 async fn activate_webauthn_put(
     data: Json<EnableWebauthnData>,
     headers: Headers,
     conn: DbConn,
 ) -> JsonResult {
     activate_webauthn(data, headers, conn).await
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct DeleteU2FData {
     id: i64,
     master_password_hash: String,
 }
 
 #[delete("/two-factor/webauthn", data = "<data>")]
 async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, conn: DbConn) -> JsonResult {
     if !headers
         .user
         .check_valid_password(&data.master_password_hash)
     {
         err!("Invalid password");
     }
     WebAuthn::delete_by_user_uuid_and_id(&headers.user.uuid, data.id, &conn).await?;
     let keys = WebAuthnInfo::get_all_by_user(&headers.user.uuid, &conn).await?;
     Ok(Json(json!({
         "enabled": !keys.is_empty(),
         "keys": keys,
         "object": "twoFactorWebAuthn"
     })))
 }
 
 pub async fn generate_webauthn_login(user_uuid: &str, conn: &DbConn) -> JsonResult {
     let keys = WebAuthn::get_all_security_keys(user_uuid, conn).await?;
     if keys.is_empty() {
         err!("No WebAuthn devices registered")
     }
     let (challenge, auth) = build_webauthn()?.start_securitykey_authentication(keys.as_slice())?;
     WebAuthnChallenge::Auth(WebAuthnAuth::new(user_uuid.to_owned(), &auth)?)
         .replace(conn)
         .await?;
     Ok(Json(serde_json::to_value(challenge.public_key)?))
 }
 
 pub async fn validate_webauthn_login(
     user_uuid: &str,
     response: &str,
     conn: &DbConn,
 ) -> EmptyResult {
     let chall = WebAuthnAuth::find_by_user(user_uuid, conn)
         .await?
         .ok_or_else(|| Error::from(String::from("no webauthn challenge")))?;
     let security_key_authentication = chall.security_key_auth()?;
     WebAuthnChallenge::Auth(chall).delete(conn).await?;
     let resp = serde_json::from_str::<PublicKeyCredential>(response)?;
     let auth =
         build_webauthn()?.finish_securitykey_authentication(&resp, &security_key_authentication)?;
     let mut web = WebAuthn::get_by_cred_id(&resp.id, conn)
         .await?
         .ok_or_else(|| Error::from(String::from("no matching webauthn entry")))?;
     if auth.needs_update() {
         let mut sec_key = web.security_key()?;
         if let Some(update) = sec_key.update_credential(&auth) {
             if update {
                 web.set_security_key(&sec_key)?;
                 web.update(conn).await?;
                 Ok(())
             } else {
                 unreachable!("webauthn credential no longer needs to be updated")
             }
         } else {
             unreachable!("webauthn credential no longer matches challenge")
         }
     } else {
         Ok(())
     }
 }