use crate::decide::{page, param};
use crate::file_root;
use base64::Engine;
use ikigai_core::{
ActionSpec, Description, Endpoint, Error, Invocation, ReprType, Representation, Result, Verb,
};
use serde_json::json;
use std::collections::HashMap;
use std::sync::{Mutex, MutexGuard, OnceLock};
use std::time::{Duration, Instant};
pub const CAP_PASSKEY_ENROLL: &str = "urn:cap:passkey:enroll";
pub const CAP_PASSKEY_CHALLENGE: &str = "urn:cap:passkey:challenge";
pub const CAP_PASSKEY_REGISTER: &str = "urn:cap:passkey:register";
const CHALLENGE_TTL: Duration = Duration::from_secs(120);
const ENROLL_WINDOW_SECONDS: i64 = 300;
fn now_secs() -> i64 {
chrono::Utc::now().timestamp()
}
fn b64() -> base64::engine::general_purpose::GeneralPurpose {
base64::engine::general_purpose::URL_SAFE_NO_PAD
}
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct RelyingParty {
rp_id: String,
origin: String,
}
impl RelyingParty {
pub fn new(rp_id: &str, origin: Option<&str>) -> std::result::Result<Self, String> {
let rp_id = rp_id.trim();
if rp_id.is_empty()
|| rp_id
.chars()
.any(|c| matches!(c, '/' | ':' | '?' | '#' | '@') || c.is_whitespace())
{
return Err(format!(
"a passkey RP id is a bare domain such as `ikigai-rs.dev`, not `{rp_id}`"
));
}
let origin = match origin {
Some(o) => o.trim().trim_end_matches('/').to_string(),
None => format!("https://{rp_id}"),
};
let host = origin
.strip_prefix("https://")
.or_else(|| origin.strip_prefix("http://"))
.ok_or_else(|| format!("a passkey origin is `https://host[:port]`, not `{origin}`"))?;
if host.is_empty() || host.contains(['/', '?', '#', '@']) {
return Err(format!(
"a passkey origin is `https://host[:port]` with no path, not `{origin}`"
));
}
Ok(Self {
rp_id: rp_id.to_string(),
origin,
})
}
pub fn rp_id(&self) -> &str {
&self.rp_id
}
pub fn origin(&self) -> &str {
&self.origin
}
}
static RELYING_PARTY: Mutex<Option<RelyingParty>> = Mutex::new(None);
pub fn set_relying_party(rp: RelyingParty) {
*RELYING_PARTY.lock().unwrap_or_else(|e| e.into_inner()) = Some(rp);
}
#[cfg(not(test))]
fn relying_party() -> Option<RelyingParty> {
RELYING_PARTY
.lock()
.unwrap_or_else(|e| e.into_inner())
.clone()
}
#[cfg(test)]
fn relying_party() -> Option<RelyingParty> {
tests::test_rp()
}
fn store_root() -> std::path::PathBuf {
#[cfg(test)]
if let Some(p) = tests::test_root() {
return p;
}
file_root()
}
fn credentials_path() -> std::path::PathBuf {
store_root().join("passkey-credentials.json")
}
fn enroll_window_path() -> std::path::PathBuf {
store_root().join("passkey-enroll.open")
}
pub const DEFAULT_MAX_CHALLENGES: usize = 4096;
pub const MAX_CHALLENGES_KEY: &str = "passkey.max_challenges";
#[derive(Default)]
struct Challenges {
live: HashMap<String, Instant>,
}
impl Challenges {
fn issue(&mut self, challenge: String, now: Instant, max: usize) -> Result<()> {
self.live.retain(|_, exp| *exp > now);
if self.live.len() >= max {
let wait = self
.live
.values()
.min()
.map_or(CHALLENGE_TTL, |exp| exp.saturating_duration_since(now));
return Err(Error::Unavailable(format!(
"too many passkey challenges are outstanding ({max}); none is replaced, so a \
sign-in already under way still completes. Try again in {}s",
wait.as_secs() + 1
)));
}
self.live.insert(challenge, now + CHALLENGE_TTL);
Ok(())
}
fn consume(&mut self, challenge: &str, now: Instant) -> bool {
match self.live.remove(challenge) {
Some(exp) => exp > now,
None => false,
}
}
}
#[cfg(not(test))]
fn challenges() -> &'static Mutex<Challenges> {
static STORE: OnceLock<Mutex<Challenges>> = OnceLock::new();
STORE.get_or_init(|| Mutex::new(Challenges::default()))
}
#[cfg(test)]
fn challenges() -> &'static Mutex<Challenges> {
tests::test_challenges()
}
pub fn max_challenges_from(value: Option<&str>) -> std::result::Result<usize, String> {
let Some(value) = value else {
return Ok(DEFAULT_MAX_CHALLENGES);
};
let digits: String = value.chars().filter(|c| *c != '_').collect();
match digits.parse::<usize>() {
Ok(0) => Err(format!(
"`{MAX_CHALLENGES_KEY} = {value}`: the least it can be is 1"
)),
Ok(n) if digits.chars().all(|c| c.is_ascii_digit()) => Ok(n),
_ => Err(format!(
"`{MAX_CHALLENGES_KEY} = {value}` is not a whole number (a count of challenges)"
)),
}
}
pub fn check_config() -> std::result::Result<(), String> {
max_challenges_from(crate::config::get(MAX_CHALLENGES_KEY).as_deref())
.map(|_| ())
.map_err(|e| format!("{e} (in {})", crate::config::config_path().display()))
}
fn max_challenges() -> usize {
#[cfg(test)]
if let Some(max) = tests::test_max_challenges() {
return max;
}
static MAX: OnceLock<usize> = OnceLock::new();
*MAX.get_or_init(|| {
match max_challenges_from(crate::config::get(MAX_CHALLENGES_KEY).as_deref()) {
Ok(max) => max,
Err(e) => {
eprintln!("ikigai passkey: {e}; the default {DEFAULT_MAX_CHALLENGES} stands");
DEFAULT_MAX_CHALLENGES
}
}
})
}
#[allow(clippy::disallowed_methods)]
fn monotonic_now() -> Instant {
Instant::now()
}
fn issue_challenge() -> Result<String> {
issue_challenge_at(monotonic_now())
}
fn issue_challenge_at(now: Instant) -> Result<String> {
let mut raw = [0u8; 32];
getrandom::getrandom(&mut raw)
.map_err(|e| Error::Endpoint(format!("no OS randomness for a challenge: {e}")))?;
let challenge = b64().encode(raw);
let max = max_challenges();
let mut store = challenges().lock().expect("challenge store poisoned");
store.issue(challenge.clone(), now, max)?;
Ok(challenge)
}
fn consume_challenge(challenge: &str) -> bool {
consume_challenge_at(challenge, monotonic_now())
}
fn consume_challenge_at(challenge: &str, now: Instant) -> bool {
let mut store = challenges().lock().expect("challenge store poisoned");
store.consume(challenge, now)
}
#[derive(serde::Serialize, serde::Deserialize, Clone)]
struct StoredCredential {
id: String,
spki: String,
#[serde(default)]
sign_count: u32,
}
fn credential_lock() -> MutexGuard<'static, ()> {
static LOCK: Mutex<()> = Mutex::new(());
LOCK.lock().unwrap_or_else(|e| e.into_inner())
}
fn load_credentials(
_held: &MutexGuard<'static, ()>,
) -> std::result::Result<Vec<StoredCredential>, String> {
use std::io::Read;
guard_directory(&store_root())?;
let path = credentials_path();
let unreadable =
|e: std::io::Error| format!("{} is present but unreadable: {e}", path.display());
let mut file = match std::fs::File::open(&path) {
Ok(file) => file,
Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
Err(e) => return Err(unreadable(e)),
};
guard_permissions(&path, &file, Remedy::CheckThenChmod)?;
let mut bytes = Vec::new();
file.read_to_end(&mut bytes).map_err(unreadable)?;
serde_json::from_slice(&bytes).map_err(|e| {
format!(
"{} is present but not a credential list: {e}",
path.display()
)
})
}
#[derive(Debug, PartialEq, Eq)]
enum Permission {
Private,
Tighten,
Refuse(String),
}
fn judge_permissions(mode: u32, owner: u32, me: u32) -> Permission {
if owner != me {
return Permission::Refuse(format!(
"is owned by uid {owner}, not by this process's uid {me}, so its owner could have \
enrolled a credential"
));
}
if mode & 0o022 != 0 {
return Permission::Refuse(format!(
"is writable by its group or by everyone (mode {:04o}), so anyone who can write it \
could have enrolled a credential",
mode & 0o7777
));
}
if mode & 0o044 != 0 {
return Permission::Tighten;
}
Permission::Private
}
#[derive(Clone, Copy)]
enum Remedy {
CheckThenChmod,
Remove,
}
#[cfg(unix)]
fn guard_permissions(
path: &std::path::Path,
file: &std::fs::File,
remedy: Remedy,
) -> std::result::Result<(), String> {
use std::os::unix::fs::{MetadataExt, PermissionsExt};
let meta = file
.metadata()
.map_err(|e| format!("{} is present but cannot be inspected: {e}", path.display()))?;
let me = unsafe { libc::geteuid() };
match judge_permissions(meta.mode(), meta.uid(), me) {
Permission::Private => Ok(()),
Permission::Tighten => {
file.set_permissions(std::fs::Permissions::from_mode(0o600))
.map_err(|e| {
format!(
"{} is readable by others (mode {:04o}) and could not be tightened: {e}; \
fix it at the box with `chmod 600 {}`",
path.display(),
meta.mode() & 0o7777,
path.display()
)
})?;
eprintln!(
"ikigai passkey: {} was readable by others (mode {:04o}); tightened it to 0600.",
path.display(),
meta.mode() & 0o7777
);
Ok(())
}
Permission::Refuse(why) => {
let p = path.display();
if let Remedy::Remove = remedy {
let who = if meta.uid() == me { "" } else { " (as root)" };
return Err(format!(
"{p} {why}, so the window it describes is not trusted; remove it at the box \
with `rm {p}`{who} and open a new one with `sink urn:passkey:enroll-open`"
));
}
let fix = if meta.uid() == me {
format!("`chmod 600 {p}`")
} else {
format!("`chown {me} {p}` (as root), then `chmod 600 {p}`")
};
Err(format!(
"{p} {why}; check that every entry in it is yours, then fix it at the box with \
{fix}"
))
}
}
}
#[cfg(not(unix))]
fn guard_permissions(
_path: &std::path::Path,
_file: &std::fs::File,
_remedy: Remedy,
) -> std::result::Result<(), String> {
Ok(())
}
fn judge_directory(mode: u32, owner: u32, me: u32) -> Option<String> {
if owner != me {
return Some(format!(
"is owned by uid {owner}, not by this process's uid {me}"
));
}
if mode & 0o022 != 0 {
return Some(format!(
"is writable by its group or by everyone (mode {:04o})",
mode & 0o7777
));
}
None
}
#[cfg(unix)]
fn guard_directory(dir: &std::path::Path) -> std::result::Result<(), String> {
use std::os::unix::fs::MetadataExt;
let d = dir.display();
let meta = std::fs::metadata(dir)
.map_err(|e| format!("the passkey workspace {d} cannot be inspected: {e}"))?;
let me = unsafe { libc::geteuid() };
let Some(why) = judge_directory(meta.mode(), meta.uid(), me) else {
return Ok(());
};
let fix = if meta.uid() == me {
format!("`chmod go-w {d}`")
} else {
format!("`chown {me} {d}` (as root), then `chmod go-w {d}`")
};
Err(format!(
"the passkey workspace {d} {why}, so anyone who can write it could have enrolled a \
credential, opened enrollment or removed the credential store, and nothing in it is \
trusted; check that the passkey files in it are yours, then fix it at the box with {fix}"
))
}
#[cfg(not(unix))]
fn guard_directory(_dir: &std::path::Path) -> std::result::Result<(), String> {
Ok(())
}
pub fn preflight() -> std::result::Result<(), String> {
let held = credential_lock();
load_credentials(&held).map(|_| ())
}
fn store_unreadable(detail: &str) {
eprintln!(
"ikigai passkey: REFUSING every passkey-gated decision: {detail}. Repair or remove the \
file at the box (removing it un-enrolls; enroll again with `sink urn:passkey:enroll-open`)."
);
}
fn save_credentials(creds: &[StoredCredential]) -> Result<()> {
let json = serde_json::to_vec_pretty(creds)
.map_err(|e| Error::Endpoint(format!("cannot serialize credentials: {e}")))?;
write_atomic(&credentials_path(), &json)
.map_err(|e| Error::Endpoint(format!("cannot write credentials: {e}")))
}
fn write_atomic(path: &std::path::Path, bytes: &[u8]) -> std::io::Result<()> {
use std::io::Write;
let dir = path.parent().ok_or_else(|| {
std::io::Error::new(std::io::ErrorKind::InvalidInput, "path has no parent")
})?;
let name = path
.file_name()
.map(|n| n.to_string_lossy().into_owned())
.unwrap_or_default();
let tmp = dir.join(format!(".{name}.tmp-{}", std::process::id()));
let _ = std::fs::remove_file(&tmp); let mut opts = std::fs::OpenOptions::new();
opts.write(true).create_new(true);
#[cfg(unix)]
std::os::unix::fs::OpenOptionsExt::mode(&mut opts, 0o600);
let write_then_rename = |opts: &std::fs::OpenOptions| -> std::io::Result<()> {
let mut f = opts.open(&tmp)?;
f.write_all(bytes)?;
f.sync_all()?;
std::fs::rename(&tmp, path)
};
let written = write_then_rename(&opts);
if written.is_err() {
let _ = std::fs::remove_file(&tmp);
return written;
}
if let Ok(d) = std::fs::File::open(dir) {
let _ = d.sync_all();
}
Ok(())
}
pub fn is_enrolled() -> bool {
let held = credential_lock();
load_credentials(&held).map_or(true, |c| !c.is_empty())
}
pub(crate) const DECISION_PASSKEY_JS: &str = "<p id=pkstatus role=status aria-live=polite \
style=\"color:#666\"></p><script src=\"/passkey/app.js\"></script>";
const REGISTER_PAGE_BODY: &str = r#"<p>Create a passkey for this site — your device will ask you to confirm with Face/Touch ID.</p>
<p><label for=code>One-time code (shown at the box when the window was opened)</label><br>
<input id=code name=code autocomplete=one-time-code autocapitalize=characters spellcheck=false required style="font:inherit;padding:.4rem;width:100%;max-width:20rem"></p>
<button id=reg style="font:inherit;padding:.6rem 1.2rem">Create passkey</button>
<p id=status role=status aria-live=polite style="color:#666"></p>
<script src="/passkey/app.js"></script>"#;
const NOT_CONFIGURED_BODY: &str = "<p>This edge has no passkey relying party configured, so a \
passkey registered here would be bound to nothing. Restart it with <code>--passkey-rp-id \
<domain></code> (and <code>--passkey-origin</code> if the origin is not \
<code>https://<domain></code>), then open an enrollment window.</p>";
const PASSKEY_APP_JS: &str = r#"(function(){
var form=document.getElementById('act');
var reg=document.getElementById('reg');
if(form) decision(form);
if(reg) register(reg);
function decision(form){
var status=document.getElementById('pkstatus');
form.addEventListener('submit', function(ev){ ev.preventDefault();
status.textContent='';
fetch('/passkey/challenge',{headers:{accept:'application/json'}})
.then(function(r){return r.json();})
.then(function(opt){
if(!opt.enrolled){ form.submit(); return; }
status.textContent='Confirm with your passkey…';
return navigator.credentials.get({publicKey:{
challenge:u(opt.challenge), rpId:opt.rpId,
allowCredentials:(opt.allowCredentials||[]).map(function(c){return {type:'public-key',id:u(c.id)};}),
userVerification:opt.userVerification||'preferred', timeout:60000
}}).then(function(a){
add(form,'pk_id',b(a.rawId)); add(form,'pk_auth',b(a.response.authenticatorData));
add(form,'pk_client',b(a.response.clientDataJSON)); add(form,'pk_sig',b(a.response.signature));
form.submit();
});
})
.catch(function(e){ status.textContent='Passkey step failed ('+((e&&e.message)||e)+'). Reopen the link to retry.'; });
});
}
function register(btn){
var status=document.getElementById('status');
btn.addEventListener('click', function(){
var code=document.getElementById('code');
if(!code||!code.value.trim()){ status.textContent='Enter the one-time code shown at the box first.'; if(code) code.focus(); return; }
status.textContent='Creating…';
fetch('/passkey/challenge').then(function(r){return r.json();}).then(function(opt){
return navigator.credentials.create({publicKey:{
rp:{id:opt.rpId, name:'ikigai'},
user:{id:new TextEncoder().encode('ikigai-owner'), name:'owner', displayName:'ikigai owner'},
challenge:u(opt.challenge),
pubKeyCredParams:[{type:'public-key',alg:-7}],
authenticatorSelection:{userVerification:'preferred',residentKey:'preferred'},
timeout:60000, attestation:'none'
}});
}).then(function(cred){
var spki=cred.response.getPublicKey && cred.response.getPublicKey();
if(!spki){ throw new Error('this browser did not expose the public key (needs WebAuthn L2)'); }
var body='code='+encodeURIComponent(code.value.trim())+'&id='+encodeURIComponent(b(cred.rawId))+'&spki='+encodeURIComponent(b(spki));
return fetch('/passkey/register',{method:'POST',headers:{'content-type':'application/x-www-form-urlencoded'},body:body});
}).then(function(res){ return res.text(); }).then(function(html){ document.open(); document.write(html); document.close(); })
.catch(function(e){ status.textContent='Registration failed: '+((e&&e.message)||e); });
});
}
function add(f,n,v){ var i=document.createElement('input'); i.type='hidden'; i.name=n; i.value=v; f.appendChild(i); }
function u(s){ s=s.replace(/-/g,'+').replace(/_/g,'/'); while(s.length%4)s+='='; var x=atob(s),y=new Uint8Array(x.length); for(var i=0;i<x.length;i++)y[i]=x.charCodeAt(i); return y.buffer; }
function b(buf){ var y=new Uint8Array(buf),s=''; for(var i=0;i<y.length;i++)s+=String.fromCharCode(y[i]); return btoa(s).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,''); }
})();
"#;
pub struct PasskeyJs;
#[async_trait::async_trait]
impl Endpoint for PasskeyJs {
async fn invoke(&self, _inv: &Invocation<'_>) -> Result<Representation> {
Ok(Representation::new(
ReprType::new("application/javascript").with_param("charset", "utf-8"),
PASSKEY_APP_JS.as_bytes().to_vec(),
))
}
fn name(&self) -> &str {
"passkey-js"
}
fn describe(&self) -> Description {
Description::new("passkey-js")
.title("The passkey ceremony script")
.summary("The same-origin script the decision and register pages load to run the WebAuthn ceremony.")
.action(
ActionSpec::new(Verb::Source)
.summary("the script")
.output("application/javascript; charset=utf-8"),
)
.output("application/javascript; charset=utf-8")
}
}
pub fn require_passkey(inv: &Invocation<'_>) -> Result<()> {
let denied = || Error::Denied("this action needs your passkey".to_string());
let held = credential_lock();
let creds = match load_credentials(&held) {
Ok(creds) => creds,
Err(detail) => {
store_unreadable(&detail);
return Err(denied());
}
};
if creds.is_empty() {
return Ok(()); }
let Some(rp) = relying_party() else {
eprintln!(
"ikigai passkey: REFUSING every passkey-gated decision: a credential is enrolled but \
this edge has no relying party configured (start it with `--passkey-rp-id <domain>`)."
);
return Err(denied());
};
let (id_b64, auth_b64, client_b64, sig_b64) = (
param(inv, "pk_id"),
param(inv, "pk_auth"),
param(inv, "pk_client"),
param(inv, "pk_sig"),
);
if id_b64.is_empty() || auth_b64.is_empty() || client_b64.is_empty() || sig_b64.is_empty() {
return Err(denied());
}
let decode = |s: &str| b64().decode(s).map_err(|_| denied());
let (cred_id, auth_data, client_data, signature) = (
decode(&id_b64)?,
decode(&auth_b64)?,
decode(&client_b64)?,
decode(&sig_b64)?,
);
let client_json: serde_json::Value =
serde_json::from_slice(&client_data).map_err(|_| denied())?;
let challenge = client_json
.get("challenge")
.and_then(|v| v.as_str())
.ok_or_else(denied)?
.to_string();
if !consume_challenge(&challenge) {
return Err(denied()); }
let stored = creds
.iter()
.find(|c| c.id == id_b64)
.ok_or_else(denied)?
.clone();
let spki = b64().decode(&stored.spki).map_err(|_| denied())?;
let registered =
ikigai_passkey::RegisteredCredential::from_spki_der(cred_id, &spki, stored.sign_count)
.map_err(|_| denied())?;
let policy = ikigai_passkey::Policy {
rp_id: rp.rp_id(),
origin: rp.origin(),
challenge_b64url: &challenge,
require_user_verified: true,
};
let assertion = ikigai_passkey::Assertion {
credential_id: ®istered.id,
authenticator_data: &auth_data,
client_data_json: &client_data,
signature: &signature,
};
let new_count =
ikigai_passkey::verify(®istered, &assertion, &policy).map_err(|_| denied())?;
#[cfg(test)]
tests::after_verify();
if new_count > stored.sign_count {
let mut all = creds;
if let Some(c) = all.iter_mut().find(|c| c.id == id_b64) {
c.sign_count = new_count;
}
if let Err(e) = save_credentials(&all) {
eprintln!("ikigai passkey: could not persist the advanced signature counter: {e}");
}
}
Ok(())
}
pub struct PasskeyChallenge;
#[async_trait::async_trait]
impl Endpoint for PasskeyChallenge {
async fn invoke(&self, _inv: &Invocation<'_>) -> Result<Representation> {
let unavailable = || Error::Endpoint("passkey sign-in is unavailable on this edge".into());
let loaded = {
let held = credential_lock();
load_credentials(&held)
};
let creds = loaded.map_err(|detail| {
store_unreadable(&detail);
unavailable()
})?;
let rp = relying_party();
if rp.is_none() && !creds.is_empty() {
eprintln!(
"ikigai passkey: a credential is enrolled but this edge has no relying party \
configured (start it with `--passkey-rp-id <domain>`)."
);
return Err(unavailable());
}
let challenge = issue_challenge()?;
let allow: Vec<_> = creds
.into_iter()
.map(|c| json!({ "type": "public-key", "id": c.id }))
.collect();
let body = json!({
"challenge": challenge,
"rpId": rp.as_ref().map(RelyingParty::rp_id),
"allowCredentials": allow,
"userVerification": "preferred",
"enrolled": !allow.is_empty(),
});
Ok(Representation::new(
ReprType::new("application/json").with_param("charset", "utf-8"),
serde_json::to_vec(&body).expect("serializable").to_vec(),
))
}
fn name(&self) -> &str {
"passkey-challenge"
}
fn describe(&self) -> Description {
Description::new("passkey-challenge")
.title("Issue a WebAuthn challenge")
.summary("A fresh single-use challenge plus the registered credential ids, for a login ceremony.")
.action(
ActionSpec::new(Verb::Source)
.summary("mint a challenge")
.output("application/json; charset=utf-8")
.requires(CAP_PASSKEY_CHALLENGE),
)
.output("application/json; charset=utf-8")
}
}
pub struct PasskeyEnrollOpen;
#[async_trait::async_trait]
impl Endpoint for PasskeyEnrollOpen {
async fn invoke(&self, inv: &Invocation<'_>) -> Result<Representation> {
if !inv.capability.allows(CAP_PASSKEY_ENROLL) {
return Err(Error::Denied(format!(
"opening enrollment requires `{CAP_PASSKEY_ENROLL}`"
)));
}
let code = enrollment_code()?;
let window = EnrollWindow {
until: now_secs() + ENROLL_WINDOW_SECONDS,
code_sha256: code_digest(&code),
spent: false,
};
write_window(&window)
.map_err(|e| Error::Endpoint(format!("cannot open the enrollment window: {e}")))?;
eprintln!(
"ikigai passkey: enrollment window opened for {ENROLL_WINDOW_SECONDS}s (one \
registration, by one-time code)"
);
Ok(Representation::new(
ReprType::new("text/plain").with_param("charset", "utf-8"),
format!(
"enrollment open for {ENROLL_WINDOW_SECONDS}s, for ONE passkey\n\
one-time code: {code}\n\
enter it on the register page (/passkey/register) before you create the \
passkey; it is shown only here\n"
)
.into_bytes(),
))
}
fn name(&self) -> &str {
"passkey-enroll-open"
}
fn describe(&self) -> Description {
Description::new("passkey-enroll-open")
.title("Open a passkey enrollment window")
.summary("Opens a short window during which one passkey may be registered, and answers with the one-time code the registration must carry. Run from the box.")
.action(
ActionSpec::new(Verb::Sink)
.summary("open the window")
.output("text/plain; charset=utf-8")
.requires(CAP_PASSKEY_ENROLL),
)
.output("text/plain; charset=utf-8")
}
}
#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
struct EnrollWindow {
until: i64,
code_sha256: String,
#[serde(default)]
spent: bool,
}
#[derive(Debug, PartialEq, Eq)]
enum WindowState {
Closed,
Spent,
Open(EnrollWindow),
}
fn window_state() -> WindowState {
match enroll_window() {
Ok(Some(w)) if w.until > now_secs() => {
if w.spent {
WindowState::Spent
} else {
WindowState::Open(w)
}
}
Ok(_) => WindowState::Closed,
Err(detail) => {
eprintln!("ikigai passkey: enrollment stays CLOSED: {detail}");
WindowState::Closed
}
}
}
#[cfg(test)]
fn enrollment_open() -> bool {
matches!(window_state(), WindowState::Open(_))
}
fn enroll_window() -> std::result::Result<Option<EnrollWindow>, String> {
use std::io::Read;
let path = enroll_window_path();
let p = path.display();
let mut file = match std::fs::File::open(&path) {
Ok(file) => file,
Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
Err(e) => return Err(format!("{p} is present but unreadable: {e}")),
};
guard_directory(&store_root())?;
guard_permissions(&path, &file, Remedy::Remove)?;
let mut text = String::new();
file.read_to_string(&mut text)
.map_err(|e| format!("{p} is present but unreadable: {e}"))?;
match serde_json::from_str::<EnrollWindow>(text.trim()) {
Ok(w) => Ok(Some(w)),
Err(_) => {
eprintln!(
"ikigai passkey: {p} is not an enrollment window this version opened (it has no \
one-time code), so enrollment stays closed; open a new one with \
`sink urn:passkey:enroll-open`"
);
Ok(None)
}
}
}
fn write_window(window: &EnrollWindow) -> std::io::Result<()> {
let json = serde_json::to_vec(window).map_err(std::io::Error::other)?;
write_atomic(&enroll_window_path(), &json)
}
const CODE_ALPHABET: &[u8; 32] = b"0123456789ABCDEFGHJKMNPQRSTVWXYZ";
const CODE_SYMBOLS: usize = 16;
fn enrollment_code() -> Result<String> {
let mut raw = [0u8; CODE_SYMBOLS];
getrandom::getrandom(&mut raw)
.map_err(|e| Error::Endpoint(format!("no OS randomness for an enrollment code: {e}")))?;
let mut code = String::with_capacity(CODE_SYMBOLS + CODE_SYMBOLS / 4);
for (i, byte) in raw.iter().enumerate() {
if i > 0 && i % 4 == 0 {
code.push('-');
}
code.push(CODE_ALPHABET[usize::from(byte & 31)] as char);
}
Ok(code)
}
fn normalize_code(typed: &str) -> String {
typed
.chars()
.filter(|c| !c.is_whitespace() && *c != '-')
.map(|c| match c.to_ascii_uppercase() {
'O' => '0',
'I' | 'L' => '1',
other => other,
})
.collect()
}
fn code_digest(code: &str) -> String {
use sha2::{Digest, Sha256};
Sha256::digest(normalize_code(code).as_bytes())
.iter()
.map(|b| format!("{b:02x}"))
.collect()
}
fn id_for_log(id_b64: &str) -> String {
let head: String = id_b64.chars().take(12).collect();
if head.len() < id_b64.len() {
format!("{head}…")
} else {
head
}
}
pub struct PasskeyRegister;
#[async_trait::async_trait]
impl Endpoint for PasskeyRegister {
async fn invoke(&self, inv: &Invocation<'_>) -> Result<Representation> {
match inv.request.verb {
Verb::Source => {
if relying_party().is_none() {
return Ok(page("Passkeys are not configured", NOT_CONFIGURED_BODY));
}
match window_state() {
WindowState::Open(_) => Ok(page("Register a passkey", REGISTER_PAGE_BODY)),
WindowState::Spent => Ok(page(
"Enrollment window used",
"<p>This window's one registration has happened. To register another \
passkey, open a new window at the box: <code>ikigai -c 'sink \
urn:passkey:enroll-open'</code>, then reload.</p>",
)),
WindowState::Closed => Ok(page(
"Enrollment closed",
"<p>Open a window at the box first: <code>ikigai -c 'sink \
urn:passkey:enroll-open'</code>, then reload.</p>",
)),
}
}
Verb::Sink => {
if relying_party().is_none() {
return Err(Error::Denied(
"this edge has no passkey relying party configured".to_string(),
));
}
let held = credential_lock();
let window = match window_state() {
WindowState::Open(window) => window,
WindowState::Spent => {
eprintln!(
"ikigai passkey: REFUSED a registration: this enrollment window's \
one registration has already happened"
);
return Err(Error::Denied(
"this enrollment window has already been used — open a new one at \
the box"
.to_string(),
));
}
WindowState::Closed => {
return Err(Error::Denied(
"no enrollment window is open — open one at the box first".to_string(),
));
}
};
let code = param(inv, "code");
if code.is_empty() || code_digest(&code) != window.code_sha256 {
eprintln!(
"ikigai passkey: REFUSED a registration: {} enrollment code",
if code.is_empty() { "no" } else { "a wrong" }
);
return Err(Error::Denied(
"a registration needs the one-time code shown at the box when the \
window was opened"
.to_string(),
));
}
let (id_b64, spki_b64) = (param(inv, "id"), param(inv, "spki"));
if id_b64.is_empty() || spki_b64.is_empty() {
return Err(Error::InvalidArgument {
name: "id/spki".to_string(),
detail: "both the credential id and the SPKI public key are required"
.to_string(),
});
}
let spki = b64()
.decode(&spki_b64)
.map_err(|_| Error::InvalidArgument {
name: "spki".to_string(),
detail: "not base64url".to_string(),
})?;
ikigai_passkey::RegisteredCredential::from_spki_der(b"probe".to_vec(), &spki, 0)
.map_err(|e| Error::InvalidArgument {
name: "spki".to_string(),
detail: format!("not a usable public key: {e}"),
})?;
let mut creds = load_credentials(&held).map_err(|detail| {
store_unreadable(&detail);
Error::Endpoint(
"the passkey store on this edge is unreadable; repair or remove it at \
the box, then enroll again"
.to_string(),
)
})?;
write_window(&EnrollWindow {
spent: true,
..window
})
.map_err(|e| Error::Endpoint(format!("cannot close the enrollment window: {e}")))?;
let logged = id_for_log(&id_b64);
creds.retain(|c| c.id != id_b64);
creds.push(StoredCredential {
id: id_b64,
spki: spki_b64,
sign_count: 0,
});
save_credentials(&creds)?;
eprintln!(
"ikigai passkey: ENROLLED credential {logged} with the window's one-time \
code; the window is spent"
);
Ok(page(
"Passkey registered",
"<p>Done. Decision links now ask for your passkey before they act.</p>",
))
}
other => Err(Error::Endpoint(format!(
"register is GET to show or POST to store, not {other:?}"
))),
}
}
fn name(&self) -> &str {
"passkey-register"
}
fn describe(&self) -> Description {
Description::new("passkey-register")
.title("Register a passkey")
.summary("GET shows the enrolment page; POST stores a credential while an enrollment window is open, given the window's one-time code.")
.action(
ActionSpec::new(Verb::Source)
.summary("show the enrolment page")
.output("text/html; charset=utf-8")
.requires(CAP_PASSKEY_REGISTER),
)
.action(
ActionSpec::new(Verb::Sink)
.summary("store a credential (needs an open window and its one-time code)")
.output("text/html; charset=utf-8")
.requires(CAP_PASSKEY_REGISTER),
)
.output("text/html; charset=utf-8")
}
}
#[cfg(test)]
mod tests {
use super::*;
use ikigai_core::{ArgRef, Capability, Iri, Kernel, Request};
use p256::ecdsa::{signature::Signer, Signature, SigningKey, VerifyingKey};
use p256::pkcs8::EncodePublicKey;
use sha2::{Digest, Sha256};
thread_local! {
static TEST_ROOT: std::cell::RefCell<Option<std::path::PathBuf>> =
const { std::cell::RefCell::new(None) };
static TEST_RP: std::cell::RefCell<Option<RelyingParty>> =
const { std::cell::RefCell::new(None) };
static TEST_CHALLENGES: std::cell::Cell<&'static Mutex<Challenges>> =
std::cell::Cell::new(Box::leak(Box::new(Mutex::new(Challenges::default()))));
static TEST_MAX_CHALLENGES: std::cell::Cell<Option<usize>> =
const { std::cell::Cell::new(None) };
}
pub(super) fn test_challenges() -> &'static Mutex<Challenges> {
TEST_CHALLENGES.with(std::cell::Cell::get)
}
pub(super) fn test_max_challenges() -> Option<usize> {
TEST_MAX_CHALLENGES.with(std::cell::Cell::get)
}
pub(super) fn test_root() -> Option<std::path::PathBuf> {
TEST_ROOT.with(|r| r.borrow().clone())
}
pub(super) fn test_rp() -> Option<RelyingParty> {
TEST_RP.with(|r| r.borrow().clone())
}
#[test]
fn the_passkey_status_lines_are_live_regions_present_before_the_script() {
for (id, html) in [
("pkstatus", DECISION_PASSKEY_JS),
("status", REGISTER_PAGE_BODY),
] {
let open = format!("<p id={id} role=status aria-live=polite");
let at = html
.find(&open)
.unwrap_or_else(|| panic!("#{id} is a live region: {html}"));
let script = html.find("<script").expect("the ceremony script");
assert!(at < script, "#{id} precedes the script: {html}");
assert!(
PASSKEY_APP_JS.contains(&format!("document.getElementById('{id}')")),
"the script writes #{id}"
);
}
}
const RP_ID: &str = "edge.test";
const ORIGIN: &str = "https://edge.test";
fn test_relying_party() -> RelyingParty {
RelyingParty::new(RP_ID, None).unwrap()
}
fn unconfigure() {
TEST_RP.with(|r| *r.borrow_mut() = None);
}
fn isolate(name: &str) {
let dir =
std::env::temp_dir().join(format!("ikigai-passkey-ep-{}-{name}", std::process::id()));
let _ = std::fs::remove_dir_all(&dir);
std::fs::create_dir_all(&dir).unwrap();
#[cfg(unix)]
std::fs::set_permissions(&dir, std::os::unix::fs::PermissionsExt::from_mode(0o700))
.unwrap();
TEST_ROOT.with(|r| *r.borrow_mut() = Some(dir));
TEST_RP.with(|r| *r.borrow_mut() = Some(test_relying_party()));
}
struct Device {
key: SigningKey,
}
impl Device {
fn new() -> Self {
Self {
key: SigningKey::from_slice(&[0x33u8; 32]).unwrap(),
}
}
fn spki_b64(&self) -> String {
let der = VerifyingKey::from(&self.key).to_public_key_der().unwrap();
b64().encode(der.as_bytes())
}
fn register(&self) {
let creds = vec![StoredCredential {
id: b64().encode(b"cred-1"),
spki: self.spki_b64(),
sign_count: 0,
}];
save_credentials(&creds).unwrap();
}
fn assert_fields(&self, challenge: &str, flags: u8, count: u32) -> String {
let client = format!(
r#"{{"type":"webauthn.get","challenge":"{challenge}","origin":"{ORIGIN}"}}"#
)
.into_bytes();
let mut auth = Sha256::digest(RP_ID.as_bytes()).to_vec();
auth.push(flags);
auth.extend_from_slice(&count.to_be_bytes());
let mut msg = auth.clone();
msg.extend_from_slice(&Sha256::digest(&client));
let sig: Signature = self.key.sign(&msg);
format!(
"pk_id={}&pk_auth={}&pk_client={}&pk_sig={}",
b64().encode(b"cred-1"),
b64().encode(&auth),
b64().encode(&client),
b64().encode(sig.to_der().as_bytes()),
)
}
}
fn post_inv(body: &str) -> (Kernel, Request) {
let kernel = Kernel::new(std::sync::Arc::new(ikigai_core::EndpointSpace::new()));
let req = Request::new(Verb::Sink, Iri::parse("urn:x").unwrap())
.with_arg("content", ArgRef::Inline(body.as_bytes().to_vec()));
(kernel, req)
}
fn run_gate(body: &str) -> Result<()> {
struct Gate;
#[async_trait::async_trait]
impl Endpoint for Gate {
async fn invoke(&self, inv: &Invocation<'_>) -> Result<Representation> {
require_passkey(inv)?;
Ok(Representation::new(
ReprType::new("text/plain"),
b"ok".to_vec(),
))
}
fn name(&self) -> &str {
"gate"
}
fn describe(&self) -> Description {
Description::new("gate").verb(Verb::Sink)
}
}
let kernel = Kernel::new(std::sync::Arc::new(
ikigai_core::EndpointSpace::new().bind(ikigai_core::Exact::new("urn:x"), Gate),
));
let (_k, req) = post_inv(body);
futures::executor::block_on(kernel.issue(req, &Capability::root())).map(|_| ())
}
#[test]
fn the_gate_is_inert_until_a_credential_is_enrolled() {
isolate("inert");
assert!(run_gate("id=abc&exp=1").is_ok());
}
#[test]
fn a_valid_assertion_passes_the_gate_and_a_forged_one_does_not() {
isolate("valid");
let d = Device::new();
d.register();
let challenge = issue_challenge().unwrap();
let body = d.assert_fields(&challenge, 0x05, 1); assert!(run_gate(&body).is_ok(), "a valid assertion should pass");
let challenge2 = issue_challenge().unwrap();
let good = d.assert_fields(&challenge2, 0x05, 2);
assert!(run_gate(&good).is_ok());
assert!(run_gate(&good).is_err(), "the challenge is single-use");
}
#[test]
fn an_enrolled_gate_refuses_a_post_with_no_assertion() {
isolate("missing");
Device::new().register();
assert!(
run_gate("id=abc&exp=1").is_err(),
"enrolled + no passkey = refused"
);
}
#[test]
fn a_forged_signature_is_refused() {
isolate("forged");
let real = Device::new();
real.register();
let imposter = Device {
key: SigningKey::from_slice(&[0x44u8; 32]).unwrap(),
};
let challenge = issue_challenge().unwrap();
let body = imposter.assert_fields(&challenge, 0x05, 1);
assert!(
run_gate(&body).is_err(),
"a foreign signature must be refused"
);
}
#[test]
fn a_never_issued_challenge_is_refused() {
isolate("nochallenge");
let d = Device::new();
d.register();
let body = d.assert_fields("bmV2ZXItaXNzdWVk", 0x05, 1);
assert!(
run_gate(&body).is_err(),
"an unissued challenge must be refused"
);
}
#[test]
fn challenges_are_single_use_and_expire() {
isolate("challenge");
let c = issue_challenge().unwrap();
assert!(consume_challenge(&c), "a fresh challenge consumes once");
assert!(!consume_challenge(&c), "and not twice");
assert!(
!consume_challenge("never-issued"),
"unknown challenge is refused"
);
}
thread_local! {
static AFTER_VERIFY: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
const { std::cell::RefCell::new(None) };
}
pub(super) fn after_verify() {
if let Some(hook) = AFTER_VERIFY.with(|h| h.borrow_mut().take()) {
hook();
}
}
fn stored_count() -> u32 {
let bytes = std::fs::read(credentials_path()).unwrap();
let creds: Vec<StoredCredential> = serde_json::from_slice(&bytes).unwrap();
creds[0].sign_count
}
#[test]
fn a_corrupt_credential_file_fails_closed() {
isolate("corrupt");
Device::new().register();
let full = std::fs::read(credentials_path()).unwrap();
std::fs::write(credentials_path(), &full[..full.len() / 2]).unwrap();
assert!(
run_gate("id=abc&exp=1").is_err(),
"a present but unparsable credential store must refuse, not read as `not enrolled`"
);
std::fs::write(credentials_path(), b"").unwrap();
assert!(
run_gate("id=abc&exp=1").is_err(),
"a zero-byte store refuses"
);
}
#[cfg(unix)]
#[test]
fn the_credential_write_replaces_the_file_rather_than_rewriting_it_in_place() {
use std::os::unix::fs::{MetadataExt, PermissionsExt};
isolate("atomic");
let d = Device::new();
d.register();
let before = std::fs::metadata(credentials_path()).unwrap().ino();
d.register();
let meta = std::fs::metadata(credentials_path()).unwrap();
assert_ne!(
before,
meta.ino(),
"the store must be replaced by rename, not truncated and rewritten in place"
);
assert_eq!(meta.permissions().mode() & 0o777, 0o600, "owner-only");
let leftovers: Vec<_> = std::fs::read_dir(store_root())
.unwrap()
.filter_map(|e| e.ok())
.map(|e| e.file_name().to_string_lossy().into_owned())
.filter(|n| n != "passkey-credentials.json")
.collect();
assert!(leftovers.is_empty(), "stray files: {leftovers:?}");
}
#[cfg(unix)]
fn set_mode(mode: u32) {
use std::os::unix::fs::PermissionsExt;
std::fs::set_permissions(credentials_path(), std::fs::Permissions::from_mode(mode))
.unwrap();
}
#[cfg(unix)]
fn mode() -> u32 {
use std::os::unix::fs::PermissionsExt;
std::fs::metadata(credentials_path())
.unwrap()
.permissions()
.mode()
& 0o777
}
#[cfg(unix)]
#[test]
fn a_group_writable_store_refuses_every_face_and_is_left_for_a_person_to_check() {
isolate("loose-writable");
let d = Device::new();
d.register();
set_mode(0o664);
let challenge = issue_challenge().unwrap();
let body = d.assert_fields(&challenge, 0x05, 0); assert!(
run_gate(&body).is_err(),
"a store others could have written is not trusted, even with a valid assertion"
);
assert!(
call(
"urn:passkey:challenge",
PasskeyChallenge,
Verb::Source,
None
)
.is_err(),
"the challenge refuses too"
);
open_window();
let reg = format!(
"id={}&spki={}",
b64().encode(b"cred-2"),
Device::new().spki_b64()
);
assert!(
call(
"urn:passkey:register",
PasskeyRegister,
Verb::Sink,
Some(®)
)
.is_err(),
"registration does not launder a store someone else could have written"
);
assert!(is_enrolled(), "an untrusted store counts as armed");
assert!(preflight().is_err(), "and a serving door refuses to start");
assert_eq!(mode(), 0o664);
let detail = {
let held = credential_lock();
load_credentials(&held).err().unwrap()
};
let path = credentials_path();
assert!(
detail.contains(&format!("`chmod 600 {}`", path.display())),
"the refusal names the exact fix: {detail}"
);
assert!(detail.contains("0664"), "and the mode it found: {detail}");
set_mode(0o602);
assert!(preflight().is_err());
set_mode(0o600);
let challenge = issue_challenge().unwrap();
assert!(run_gate(&d.assert_fields(&challenge, 0x05, 0)).is_ok());
assert!(preflight().is_ok());
}
#[cfg(unix)]
#[test]
fn a_store_others_can_only_read_is_tightened_on_load() {
isolate("loose-readable");
let d = Device::new();
d.register();
set_mode(0o644);
let challenge = issue_challenge().unwrap();
assert!(
run_gate(&d.assert_fields(&challenge, 0x05, 0)).is_ok(),
"readable-only discloses public keys and nothing else: the gate keeps working"
);
assert_eq!(mode(), 0o600, "a counter-0 sign-in tightened it");
set_mode(0o640);
assert!(call(
"urn:passkey:challenge",
PasskeyChallenge,
Verb::Source,
None
)
.is_ok());
assert_eq!(mode(), 0o600, "the challenge tightened it");
set_mode(0o604);
assert!(preflight().is_ok());
assert_eq!(mode(), 0o600, "startup tightened it");
set_mode(0o644);
assert!(is_enrolled());
assert_eq!(mode(), 0o600, "is_enrolled tightened it");
}
#[test]
fn permissions_are_judged_on_writers_first_then_readers() {
let me = 501;
assert_eq!(judge_permissions(0o100600, me, me), Permission::Private);
assert_eq!(judge_permissions(0o100400, me, me), Permission::Private);
assert_eq!(judge_permissions(0o100700, me, me), Permission::Private);
for readable in [0o100640, 0o100604, 0o100644, 0o100440] {
assert_eq!(
judge_permissions(readable, me, me),
Permission::Tighten,
"{readable:o}"
);
}
for writable in [0o100620, 0o100602, 0o100664, 0o100666, 0o100622] {
assert!(
matches!(judge_permissions(writable, me, me), Permission::Refuse(_)),
"{writable:o}"
);
}
match judge_permissions(0o100600, 0, me) {
Permission::Refuse(why) => assert!(why.contains("uid 0"), "{why}"),
other => panic!("a foreign owner must refuse, got {other:?}"),
}
}
#[test]
fn an_absent_store_passes_preflight() {
isolate("preflight-absent");
assert!(
preflight().is_ok(),
"not enrolled is not a reason to refuse to start"
);
assert!(
!credentials_path().exists(),
"and preflight creates nothing"
);
}
#[test]
fn interleaved_assertions_never_lower_the_stored_counter() {
isolate("race");
let root = test_root().unwrap();
let store = test_challenges();
let d = Device::new();
d.register();
let c_low = issue_challenge().unwrap();
let c_high = issue_challenge().unwrap();
let low = d.assert_fields(&c_low, 0x05, 2);
let high = d.assert_fields(&c_high, 0x05, 3);
let (done_tx, done_rx) = std::sync::mpsc::channel();
let b = std::sync::Arc::new(std::sync::Mutex::new(None));
let b_slot = b.clone();
AFTER_VERIFY.with(|h| {
*h.borrow_mut() = Some(Box::new(move || {
let handle = std::thread::spawn(move || {
TEST_ROOT.with(|r| *r.borrow_mut() = Some(root));
TEST_RP.with(|r| *r.borrow_mut() = Some(test_relying_party()));
TEST_CHALLENGES.with(|c| c.set(store));
let r = run_gate(&high);
let _ = done_tx.send(());
r
});
let _ = done_rx.recv_timeout(std::time::Duration::from_millis(300));
*b_slot.lock().unwrap() = Some(handle);
}))
});
assert!(run_gate(&low).is_ok(), "A's assertion is valid");
let handle = b.lock().unwrap().take().expect("the hook ran");
assert!(handle.join().unwrap().is_ok(), "B's assertion is valid");
assert_eq!(
stored_count(),
3,
"the stored counter must be the highest seen, never a stale write-back"
);
}
fn call(
iri: &str,
endpoint: impl Endpoint + 'static,
verb: Verb,
body: Option<&str>,
) -> Result<Representation> {
let kernel = Kernel::new(std::sync::Arc::new(
ikigai_core::EndpointSpace::new().bind(ikigai_core::Exact::new(iri), endpoint),
));
let mut req = Request::new(verb, Iri::parse(iri).unwrap());
if let Some(body) = body {
req = req.with_arg("content", ArgRef::Inline(body.as_bytes().to_vec()));
}
futures::executor::block_on(kernel.issue(req, &Capability::root()))
}
const TEST_CODE: &str = "TEST-C0DE-AAAA-BBBB";
fn open_window() {
write_window(&EnrollWindow {
until: now_secs() + 60,
code_sha256: code_digest(TEST_CODE),
spent: false,
})
.unwrap();
}
fn registration(id: &[u8], code: Option<&str>) -> String {
let code = code.map(|c| format!("code={c}&")).unwrap_or_default();
format!(
"{code}id={}&spki={}",
b64().encode(id),
Device::new().spki_b64()
)
}
#[test]
fn a_corrupt_store_errors_the_challenge_and_is_not_overwritten_by_registration() {
isolate("corrupt-faces");
std::fs::write(credentials_path(), b"[{\"id\":").unwrap();
assert!(
call(
"urn:passkey:challenge",
PasskeyChallenge,
Verb::Source,
None
)
.is_err(),
"the page must not be told `not enrolled` and submit token-only"
);
open_window();
let body = registration(b"cred-2", Some(TEST_CODE));
assert!(
call(
"urn:passkey:register",
PasskeyRegister,
Verb::Sink,
Some(&body)
)
.is_err(),
"registration does not paper over a broken store from the public face"
);
assert_eq!(std::fs::read(credentials_path()).unwrap(), b"[{\"id\":");
assert!(is_enrolled(), "a broken store counts as armed");
}
#[test]
fn an_enrolled_gate_with_no_relying_party_refuses_everything() {
isolate("no-rp-enrolled");
let d = Device::new();
d.register();
let challenge = issue_challenge().unwrap();
let body = d.assert_fields(&challenge, 0x05, 1);
unconfigure();
assert!(run_gate(&body).is_err(), "no RP to check against = refuse");
assert!(
call(
"urn:passkey:challenge",
PasskeyChallenge,
Verb::Source,
None
)
.is_err(),
"and the challenge says so rather than naming no RP"
);
}
#[test]
fn an_unconfigured_edge_with_nothing_enrolled_stays_inert() {
isolate("no-rp-inert");
unconfigure();
assert!(
run_gate("id=abc&exp=1").is_ok(),
"deploying cannot brick the links"
);
let rep = call(
"urn:passkey:challenge",
PasskeyChallenge,
Verb::Source,
None,
)
.unwrap();
let v: serde_json::Value = serde_json::from_slice(&rep.bytes).unwrap();
assert_eq!(v["enrolled"], false);
assert!(
v["rpId"].is_null(),
"no RP is reported as none, never a default"
);
}
#[test]
fn registration_needs_a_relying_party() {
isolate("no-rp-register");
open_window();
let body = registration(b"cred-1", Some(TEST_CODE));
unconfigure();
assert!(
call(
"urn:passkey:register",
PasskeyRegister,
Verb::Sink,
Some(&body)
)
.is_err(),
"nothing to bind a credential to"
);
assert!(!credentials_path().exists());
let page = call("urn:passkey:register", PasskeyRegister, Verb::Source, None).unwrap();
assert!(String::from_utf8_lossy(&page.bytes).contains("--passkey-rp-id"));
TEST_RP.with(|r| *r.borrow_mut() = Some(test_relying_party()));
assert!(call(
"urn:passkey:register",
PasskeyRegister,
Verb::Sink,
Some(&body)
)
.is_ok());
assert!(is_enrolled());
}
#[test]
fn past_the_bound_a_new_challenge_is_refused_and_none_is_evicted() {
let mut store = Challenges::default();
let t0 = monotonic_now();
for n in 0..3 {
store
.issue(format!("c{n}"), t0 + Duration::from_secs(n), 3)
.expect("under the bound");
}
let refused = store
.issue("c3".into(), t0 + Duration::from_secs(10), 3)
.expect_err("the fourth outstanding challenge is refused");
assert!(refused.is_transient(), "a retry can succeed: {refused}");
assert!(matches!(refused, Error::Unavailable(_)), "{refused:?}");
let wait = CHALLENGE_TTL.as_secs() - 10 + 1;
assert!(
refused
.to_string()
.contains(&format!("Try again in {wait}s")),
"{refused}"
);
assert_eq!(store.live.len(), 3, "the refusal stored nothing");
for n in 0..3 {
assert!(
store.consume(&format!("c{n}"), t0 + Duration::from_secs(11)),
"c{n} was not evicted: an honest ceremony holding it still completes"
);
}
}
#[test]
fn expired_challenges_are_reclaimed_before_the_bound_is_judged() {
let mut store = Challenges::default();
let t0 = monotonic_now();
store.issue("a".into(), t0, 2).unwrap();
store
.issue("b".into(), t0 + Duration::from_secs(60), 2)
.unwrap();
assert!(store
.issue("c".into(), t0 + Duration::from_secs(61), 2)
.is_err());
store.issue("c".into(), t0 + CHALLENGE_TTL, 2).unwrap();
assert_eq!(store.live.len(), 2);
assert!(
!store.live.contains_key("a"),
"the expired one was reclaimed"
);
assert!(store.issue("d".into(), t0 + CHALLENGE_TTL, 2).is_err());
}
#[test]
fn an_honest_ceremony_completes_on_a_full_store_and_the_endpoint_refuses_past_it() {
isolate("bounded");
TEST_MAX_CHALLENGES.with(|m| m.set(Some(8)));
let d = Device::new();
d.register();
let read = || {
call(
"urn:passkey:challenge",
PasskeyChallenge,
Verb::Source,
None,
)
};
let challenge_of = |repr: Representation| -> String {
let v: serde_json::Value = serde_json::from_slice(&repr.bytes).unwrap();
v["challenge"].as_str().unwrap().to_string()
};
let honest = challenge_of(read().expect("an empty store issues"));
for _ in 0..7 {
read().expect("under the bound");
}
let refused = read().expect_err("the bound refuses the ninth");
assert!(refused.is_transient(), "{refused}");
assert!(
run_gate(&d.assert_fields(&honest, 0x05, 1)).is_ok(),
"an honest ceremony under way is not broken by the bound"
);
let next = challenge_of(read().expect("a spent challenge frees its place"));
assert!(run_gate(&d.assert_fields(&next, 0x05, 2)).is_ok());
read().expect("the place the second sign-in spent");
assert!(read().is_err(), "full again");
let later = monotonic_now() + CHALLENGE_TTL;
let after = issue_challenge_at(later).expect("expired entries are reclaimed");
assert!(consume_challenge_at(&after, later));
TEST_MAX_CHALLENGES.with(|m| m.set(None));
}
#[test]
fn a_challenge_expires_on_the_monotonic_clock() {
isolate("ttl");
let t0 = monotonic_now();
let fresh = issue_challenge_at(t0).unwrap();
assert!(consume_challenge_at(
&fresh,
t0 + CHALLENGE_TTL - Duration::from_secs(1)
));
let stale = issue_challenge_at(t0).unwrap();
assert!(
!consume_challenge_at(&stale, t0 + CHALLENGE_TTL),
"a challenge is dead at its TTL"
);
}
#[test]
fn enrollment_window_gates_registration() {
isolate("enroll");
assert!(!enrollment_open(), "closed by default");
let kernel = Kernel::new(std::sync::Arc::new(ikigai_core::EndpointSpace::new().bind(
ikigai_core::Exact::new("urn:passkey:enroll-open"),
PasskeyEnrollOpen,
)));
let open = |cap: &Capability| {
futures::executor::block_on(kernel.issue(
Request::new(Verb::Sink, Iri::parse("urn:passkey:enroll-open").unwrap()),
cap,
))
};
assert!(
open(&Capability::scoped(Vec::<String>::new())).is_err(),
"no cap, no open"
);
assert!(open(&Capability::root()).is_ok(), "root opens it");
assert!(enrollment_open(), "now open");
}
#[test]
fn the_challenge_and_registration_declare_and_enforce_their_capabilities() {
isolate("caps");
TEST_RP.with(|r| *r.borrow_mut() = Some(test_relying_party()));
open_window();
let kernel = Kernel::new(std::sync::Arc::new(
ikigai_core::EndpointSpace::new()
.bind(
ikigai_core::Exact::new("urn:passkey:challenge"),
PasskeyChallenge,
)
.bind(
ikigai_core::Exact::new("urn:passkey:register"),
PasskeyRegister,
),
));
let ask = |iri: &str, verb: Verb, cap: &Capability| {
let mut req = Request::new(verb, Iri::parse(iri).unwrap());
if verb == Verb::Sink {
req = req.with_arg(
"content",
ArgRef::Inline(registration(b"cred-caps", Some(TEST_CODE)).into_bytes()),
);
}
futures::executor::block_on(kernel.issue(req, cap))
};
let none = Capability::scoped(Vec::<String>::new());
let wrong = Capability::scoped(["urn:cap:layer:say:talk"]);
for (iri, verb, cap) in [
("urn:passkey:challenge", Verb::Source, CAP_PASSKEY_CHALLENGE),
("urn:passkey:register", Verb::Source, CAP_PASSKEY_REGISTER),
("urn:passkey:register", Verb::Sink, CAP_PASSKEY_REGISTER),
] {
for held in [&none, &wrong] {
match ask(iri, verb, held) {
Err(Error::Denied(why)) => {
assert!(why.contains(cap), "{iri} {verb:?} names `{cap}`: {why}")
}
other => panic!("{iri} {verb:?} without `{cap}` is denied, got {other:?}"),
}
}
}
assert!(!is_enrolled(), "nothing enrolled without the grant");
let challenge = ask(
"urn:passkey:challenge",
Verb::Source,
&Capability::scoped([CAP_PASSKEY_CHALLENGE]),
)
.expect("granted, a challenge");
assert!(String::from_utf8_lossy(&challenge.bytes).contains("\"challenge\""));
let register = Capability::scoped([CAP_PASSKEY_REGISTER]);
ask("urn:passkey:register", Verb::Source, ®ister).expect("granted, the page");
ask("urn:passkey:register", Verb::Sink, ®ister).expect("granted, it enrolls");
assert!(is_enrolled());
}
#[cfg(unix)]
fn chmod(path: &std::path::Path, mode: u32) {
use std::os::unix::fs::PermissionsExt;
std::fs::set_permissions(path, std::fs::Permissions::from_mode(mode)).unwrap();
}
#[cfg(unix)]
fn mode_of(path: &std::path::Path) -> u32 {
use std::os::unix::fs::PermissionsExt;
std::fs::metadata(path).unwrap().permissions().mode() & 0o777
}
fn public_registration_succeeds() -> bool {
let reg = registration(b"intruder", Some(TEST_CODE));
call(
"urn:passkey:register",
PasskeyRegister,
Verb::Sink,
Some(®),
)
.is_ok()
}
#[cfg(unix)]
#[test]
fn an_enroll_file_others_could_have_written_keeps_enrollment_closed() {
isolate("enroll-writable");
for loose in [0o664, 0o602, 0o620] {
open_window();
chmod(&enroll_window_path(), loose);
assert!(
!enrollment_open(),
"a window file others could have written is not a window ({loose:o})"
);
assert!(
!public_registration_succeeds(),
"nothing registers through it ({loose:o})"
);
assert!(!is_enrolled(), "and nothing was stored ({loose:o})");
assert_eq!(mode_of(&enroll_window_path()), loose);
}
let refusal = enroll_window().expect_err("an untrusted window is an error, not absence");
assert!(
refusal.contains(&format!("`rm {}`", enroll_window_path().display())),
"the refusal says to remove it, never to chmod a planted timestamp: {refusal}"
);
chmod(&enroll_window_path(), 0o600);
assert!(enrollment_open());
}
#[test]
fn the_workspace_directory_is_judged_on_writers_and_its_owner() {
let me = 501;
for private in [0o40700, 0o40755, 0o40750, 0o40711] {
assert_eq!(judge_directory(private, me, me), None, "{private:o}");
}
for writable in [0o40775, 0o40770, 0o40757, 0o41777, 0o40730] {
assert!(judge_directory(writable, me, me).is_some(), "{writable:o}");
}
let why = judge_directory(0o40700, 0, me).expect("a foreign owner refuses");
assert!(why.contains("uid 0"), "{why}");
}
#[cfg(unix)]
#[test]
fn a_workspace_others_can_write_trusts_nothing_in_it() {
isolate("workspace-writable");
let root = test_root().unwrap();
let d = Device::new();
d.register();
open_window();
chmod(&root, 0o775);
assert!(!enrollment_open(), "the window is not trusted");
assert!(!public_registration_succeeds(), "so nothing registers");
let challenge = issue_challenge().unwrap();
assert!(
run_gate(&d.assert_fields(&challenge, 0x05, 0)).is_err(),
"the store in it is not trusted either, even with a valid assertion"
);
assert!(is_enrolled(), "an untrusted store counts as armed");
let refusal = preflight().expect_err("a serving door refuses to start");
assert!(
refusal.contains(&root.display().to_string()) && refusal.contains("0775"),
"the refusal names the directory and its mode: {refusal}"
);
assert!(
refusal.contains(&format!("`chmod go-w {}`", root.display())),
"and the exact fix: {refusal}"
);
chmod(&root, 0o1777);
assert!(preflight().is_err());
assert!(!enrollment_open());
chmod(&root, 0o755);
assert!(preflight().is_ok());
assert!(enrollment_open());
let challenge = issue_challenge().unwrap();
assert!(run_gate(&d.assert_fields(&challenge, 0x05, 0)).is_ok());
}
#[cfg(unix)]
#[test]
fn an_enroll_file_others_can_only_read_is_tightened() {
isolate("enroll-readable");
open_window();
chmod(&enroll_window_path(), 0o644);
assert!(enrollment_open());
assert_eq!(mode_of(&enroll_window_path()), 0o600);
}
#[cfg(unix)]
#[test]
fn opening_a_window_writes_it_owner_only() {
isolate("enroll-mode");
let kernel = Kernel::new(std::sync::Arc::new(ikigai_core::EndpointSpace::new().bind(
ikigai_core::Exact::new("urn:passkey:enroll-open"),
PasskeyEnrollOpen,
)));
futures::executor::block_on(kernel.issue(
Request::new(Verb::Sink, Iri::parse("urn:passkey:enroll-open").unwrap()),
&Capability::root(),
))
.unwrap();
assert_eq!(mode_of(&enroll_window_path()), 0o600);
assert!(enrollment_open());
}
fn stored_ids() -> Vec<String> {
match std::fs::read(credentials_path()) {
Ok(bytes) => serde_json::from_slice::<Vec<StoredCredential>>(&bytes)
.unwrap()
.into_iter()
.map(|c| c.id)
.collect(),
Err(_) => Vec::new(),
}
}
fn register_with(body: &str) -> Result<Representation> {
call(
"urn:passkey:register",
PasskeyRegister,
Verb::Sink,
Some(body),
)
}
fn denied_with(outcome: Result<Representation>, needle: &str) {
match outcome {
Err(Error::Denied(message)) => assert!(
message.contains(needle),
"refused, naming `{needle}`: {message}"
),
other => panic!("expected a Denied naming `{needle}`, got {other:?}"),
}
}
#[test]
fn a_registration_without_the_code_is_refused() {
isolate("code-missing");
open_window();
denied_with(
register_with(®istration(b"stranger", None)),
"one-time code",
);
denied_with(
register_with(®istration(b"stranger", Some(""))),
"one-time code",
);
assert!(stored_ids().is_empty(), "nothing stored");
assert!(!is_enrolled());
assert!(enrollment_open(), "the window is still the operator's");
}
#[test]
fn a_registration_with_a_wrong_code_is_refused_and_does_not_spend_the_window() {
isolate("code-wrong");
open_window();
for wrong in [
"TEST-C0DE-AAAA-BBBC",
"AAAA-AAAA-AAAA-AAAA",
"TEST-C0DE-AAAA",
] {
denied_with(
register_with(®istration(b"stranger", Some(wrong))),
"one-time code",
);
}
assert!(stored_ids().is_empty(), "nothing stored");
assert!(
enrollment_open(),
"a wrong guess cannot close the window on the person at the box"
);
assert!(register_with(®istration(b"mine", Some(TEST_CODE))).is_ok());
assert_eq!(stored_ids(), vec![b64().encode(b"mine")]);
}
#[test]
fn the_right_code_enrolls_once_and_a_second_registration_is_refused() {
isolate("code-once");
open_window();
assert!(register_with(®istration(b"first", Some(TEST_CODE))).is_ok());
assert_eq!(stored_ids(), vec![b64().encode(b"first")]);
assert_eq!(window_state(), WindowState::Spent);
denied_with(
register_with(®istration(b"second", Some(TEST_CODE))),
"already been used",
);
assert_eq!(
stored_ids(),
vec![b64().encode(b"first")],
"the second was not stored and did not replace the first"
);
let page = call("urn:passkey:register", PasskeyRegister, Verb::Source, None).unwrap();
assert!(
String::from_utf8_lossy(&page.bytes).contains("one registration has happened"),
"the page says the window is used, not that none is open"
);
}
#[test]
fn concurrent_registrations_in_one_window_store_exactly_one() {
isolate("code-race");
open_window();
let root = test_root().unwrap();
let start = std::sync::Arc::new(std::sync::Barrier::new(8));
let threads: Vec<_> = (0..8u8)
.map(|i| {
let (root, start) = (root.clone(), start.clone());
std::thread::spawn(move || {
TEST_ROOT.with(|r| *r.borrow_mut() = Some(root));
TEST_RP.with(|r| *r.borrow_mut() = Some(test_relying_party()));
start.wait();
register_with(®istration(&[b'c', i], Some(TEST_CODE))).is_ok()
})
})
.collect();
let stored = threads
.into_iter()
.map(|t| t.join().unwrap())
.filter(|ok| *ok)
.count();
assert_eq!(stored, 1, "one window, one registration");
assert_eq!(stored_ids().len(), 1);
}
#[test]
fn an_expired_window_refuses_even_the_right_code() {
isolate("code-expired");
write_window(&EnrollWindow {
until: now_secs() - 1,
code_sha256: code_digest(TEST_CODE),
spent: false,
})
.unwrap();
assert_eq!(window_state(), WindowState::Closed);
denied_with(
register_with(®istration(b"late", Some(TEST_CODE))),
"no enrollment window is open",
);
assert!(stored_ids().is_empty());
}
#[test]
fn a_window_without_a_code_is_closed() {
isolate("code-legacy");
write_atomic(
&enroll_window_path(),
(now_secs() + 60).to_string().as_bytes(),
)
.unwrap();
assert_eq!(window_state(), WindowState::Closed);
denied_with(
register_with(®istration(b"old", None)),
"no enrollment window is open",
);
assert!(stored_ids().is_empty());
}
#[test]
fn opening_a_window_answers_with_a_code_the_file_holds_only_the_digest_of() {
isolate("code-open");
let kernel = Kernel::new(std::sync::Arc::new(ikigai_core::EndpointSpace::new().bind(
ikigai_core::Exact::new("urn:passkey:enroll-open"),
PasskeyEnrollOpen,
)));
let open = || {
futures::executor::block_on(kernel.issue(
Request::new(Verb::Sink, Iri::parse("urn:passkey:enroll-open").unwrap()),
&Capability::root(),
))
.unwrap()
};
let text = String::from_utf8(open().bytes.to_vec()).unwrap();
let code = text
.lines()
.find_map(|l| l.strip_prefix("one-time code: "))
.unwrap_or_else(|| panic!("the answer carries the code: {text}"))
.to_string();
assert_eq!(code.len(), 19, "XXXX-XXXX-XXXX-XXXX: {code}");
assert!(code
.split('-')
.all(|g| g.len() == 4 && g.bytes().all(|b| CODE_ALPHABET.contains(&b))));
let on_disk = std::fs::read_to_string(enroll_window_path()).unwrap();
assert!(
!on_disk.contains(&code) && !on_disk.contains(&normalize_code(&code)),
"the code is never written down: {on_disk}"
);
assert!(on_disk.contains(&code_digest(&code)));
let typed = code.to_lowercase().replace('-', " ");
assert!(register_with(®istration(b"mine", Some(&typed))).is_ok());
assert_eq!(stored_ids(), vec![b64().encode(b"mine")]);
let again = open();
assert!(!String::from_utf8_lossy(&again.bytes).contains(&code));
assert!(enrollment_open(), "a new window is open and unused");
}
#[test]
fn a_code_is_normalized_before_it_is_hashed() {
assert_eq!(normalize_code("abcd-efgh ijkm-np0q"), "ABCDEFGH1JKMNP0Q");
assert_eq!(normalize_code("o0Il-1"), "00111");
assert_eq!(code_digest("abcd-efgh"), code_digest("ABCDEFGH"));
assert_ne!(code_digest("ABCDEFGH"), code_digest("ABCDEFGJ"));
}
#[test]
fn the_register_page_has_a_labeled_code_field_the_script_sends() {
assert!(REGISTER_PAGE_BODY.contains("<label for=code>"));
assert!(REGISTER_PAGE_BODY.contains("<input id=code name=code"));
assert!(
REGISTER_PAGE_BODY.find("id=code") < REGISTER_PAGE_BODY.find("id=reg"),
"the field comes before the button"
);
assert!(PASSKEY_APP_JS.contains("'code='+encodeURIComponent(code.value.trim())"));
}
}