plumber/internal/web/auth.go

package web

import (
	"crypto/subtle"
	"net/http"
	"net/url"
	"regexp"
	"strings"
	"unicode/utf8"

	"golang.org/x/crypto/bcrypt"

	"plumber/internal/store"
)

var usernameRe = regexp.MustCompile(`^[a-zA-Z0-9_]{3,20}$`)

const (
	minPasswordRunes = 8
	maxPasswordBytes = 72 // bcrypt truncation limit
)

// loginDummyHash is compared when the username is unknown so login timing
// does not reveal whether an account exists (same bcrypt cost as real hashes).
var loginDummyHash = mustBcrypt("timing-dummy-not-a-real-password")

func mustBcrypt(s string) []byte {
	h, err := bcrypt.GenerateFromPassword([]byte(s), bcrypt.DefaultCost)
	if err != nil {
		panic(err)
	}
	return h
}

func safeNext(raw string) string {
	if raw == "" {
		return "/"
	}
	u, err := url.Parse(raw)
	if err != nil || u.IsAbs() || !strings.HasPrefix(u.Path, "/") || strings.HasPrefix(u.Path, "//") {
		return "/"
	}
	return u.RequestURI()
}

func passwordValid(password string) (ok bool, msg string) {
	if utf8.RuneCountInString(password) < minPasswordRunes {
		return false, "Password must be at least 8 characters."
	}
	if len(password) > maxPasswordBytes {
		return false, "Password must be at most 72 bytes."
	}
	return true, ""
}

func (s *Server) handleLoginForm(w http.ResponseWriter, r *http.Request) {
	if currentUser(r) != nil {
		http.Redirect(w, r, safeNext(r.URL.Query().Get("next")), http.StatusSeeOther)
		return
	}
	s.exec(w, "login", authPage{
		page: s.basePage(r, "Sign in"),
		Next: r.URL.Query().Get("next"),
	})
}

func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
	if !s.requireCSRF(w, r) {
		return
	}
	username := strings.TrimSpace(r.PostFormValue("username"))
	password := r.PostFormValue("password")
	next := safeNext(r.PostFormValue("next"))
	if !s.allowLoginAttempt(w, r, store.NormalizeUsername(username)) {
		return
	}

	u, err := s.store.UserByUsername(r.Context(), username)
	hash := loginDummyHash
	if err == nil {
		hash = []byte(u.PasswordHash)
	}
	if err != nil || bcrypt.CompareHashAndPassword(hash, []byte(password)) != nil {
		w.WriteHeader(http.StatusUnauthorized)
		s.exec(w, "login", authPage{
			page:     s.basePage(r, "Sign in"),
			Username: username,
			Next:     next,
			Error:    "Wrong username or password.",
		})
		return
	}
	if err := s.sessions.RenewToken(r.Context()); err != nil {
		http.Error(w, "could not start session", http.StatusInternalServerError)
		return
	}
	s.sessions.Put(r.Context(), "user_id", u.ID)
	http.Redirect(w, r, next, http.StatusSeeOther)
}

func (s *Server) handleRegisterForm(w http.ResponseWriter, r *http.Request) {
	if currentUser(r) != nil {
		http.Redirect(w, r, "/", http.StatusSeeOther)
		return
	}
	s.exec(w, "register", authPage{page: s.basePage(r, "Create account")})
}

func (s *Server) handleRegister(w http.ResponseWriter, r *http.Request) {
	if !s.requireCSRF(w, r) {
		return
	}
	if !s.allowRegisterAttempt(w, r) {
		return
	}
	username := strings.TrimSpace(r.PostFormValue("username"))
	password := r.PostFormValue("password")
	setupSecret := r.PostFormValue("setup_secret")
	p := authPage{page: s.basePage(r, "Create account"), Username: username}
	if !usernameRe.MatchString(username) {
		p.Error = "Username must be 3–20 letters, numbers, or underscores."
		s.exec(w, "register", p)
		return
	}
	if ok, msg := passwordValid(password); !ok {
		p.Error = msg
		s.exec(w, "register", p)
		return
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		http.Error(w, "could not save password", http.StatusInternalServerError)
		return
	}
	role := store.RoleUser
	if s.consumeAdminSetup(r, setupSecret) {
		role = store.RoleAdmin
	}
	u := &store.User{
		Username:     username,
		PasswordHash: string(hash),
		Role:         role,
	}
	if err := s.store.CreateUser(r.Context(), u); err != nil {
		p.Error = "That username is taken."
		s.exec(w, "register", p)
		return
	}
	if err := s.sessions.RenewToken(r.Context()); err != nil {
		http.Error(w, "could not start session", http.StatusInternalServerError)
		return
	}
	s.sessions.Put(r.Context(), "user_id", u.ID)
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// consumeAdminSetup grants first-admin when a strong one-time setup secret matches
// and no admin exists yet. Username alone is never enough.
func (s *Server) consumeAdminSetup(r *http.Request, provided string) bool {
	want := s.cfg.AdminSetupSecret
	if want == "" || provided == "" {
		return false
	}
	if subtle.ConstantTimeCompare([]byte(provided), []byte(want)) != 1 {
		return false
	}
	n, err := s.store.CountAdmins(r.Context())
	if err != nil || n > 0 {
		return false
	}
	return true
}

func (s *Server) handleAuthPrompt(w http.ResponseWriter, r *http.Request) {
	s.exec(w, "signin-prompt", s.basePage(r, ""))
}