gitoria

6.1 KB

1. // sshkeys.hl — SSH KEYS for git over SSH (ticket gitoria#7; docs/git-backend.md "Credentials"). A logged-in user pastes a
2. // PUBLIC key; the sshd container (docker/sshd) asks this app which user a key belongs to (`/__git/keys`, sshgate.hl), so a new
3. // key works at once and no authorized_keys file is edited. Only the public key is stored — nothing secret.
4. // sshKeysTable pk @id index !key, user { user (users @id), name, type, key (base64), fingerprint, created } storage/mpackdb/sshkeys.db
5. // The key is checked by `ssh-keygen -l -f` (the real parser): one line, an allowed type, a real key, RSA at least 2048 bits.
6. import { MPackDB } from 'hl:mpackdb'
7. import { run, env } from 'hl:proc'
8. import { now } from 'hl:time'
9. import { writeFile, remove, exists } from 'hl:fs'
10. import { randomBytes } from 'hl:crypto'
11. import { storageDir, countOfList, firstOf, plainError, userRecord, envOr } from './users.hl'
12. import { localStamp } from './localtime.hl'
13. import { tmpDir } from './transport.hl'
15. static sshKeysTable = new MPackDB(file = storageDir + '/sshkeys.db', primaryKey = '@id', indexes = ['!key', 'user'])
16. static NL = "
17. "
18. static maxKeys = 20
19. // SSH is offered only when the sshd container is set up: the shared secret it uses to ask this app is in the environment
20. static sshSecret = envOr('GITORIA_SSH_SECRET', '')
21. static sshPort = envOr('GITORIA_SSH_PORT', '2222')
22. // the host name in SSH clone addresses: repo addresses go through Cloudflare's proxy, which does not pass SSH, so
23. // production sets a DNS-only name (GITORIA_SSH_HOST=ssh.gitoria.worldapi.org); empty = the page's own host (dev, gates)
24. static sshHost = envOr('GITORIA_SSH_HOST', '')
25. static sshEnabled = sshSecret != ''
26. static allowedTypes = ['ssh-ed25519', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'ssh-rsa', '[email protected]', '[email protected]']
28. // the address to clone from over SSH: `git@host:slug.git` on port 22, else the ssh:// form with the port
29. static sshUrl = (host, slug) => {
30. let h = sshHost != '' ? sshHost : host
31. if (sshPort == '22') { return 'git@' + h + ':' + slug + '.git' }
32. return 'ssh://git@' + h + ':' + sshPort + '/' + slug + '.git'
33. }
35. static isKeyBase64 = (s) => {
36. if (s.length < 20 || s.length > 1200) { return false }
37. let i = 0
38. while (i < s.length) {
39. let c = s.charCodeAt(i)
40. if (!((c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c == 43 || c == 47 || c == 61)) { return false }
41. i = i + 1
42. }
43. return true
44. }
46. static rowOfKey = (k) => { return { id = k.id name = k.name fingerprint = k.fingerprint created = localStamp(k.created) createdMs = k.created } }
48. // a user's keys, newest first (no sort(): hybriel #1)
49. static keyRows = (userId) => {
50. let out = []
51. let all = sshKeysTable.find('user', userId)
52. if (countOfList(all) == 0) { return out }
53. for (k of all) { out.push(rowOfKey(k)) }
54. let i = 1
55. while (i < out.length) {
56. let cur = out[i]
57. let j = i - 1
58. while (j >= 0 && out[j].createdMs < cur.createdMs) {
59. out[j + 1] = out[j]
60. j = j - 1
61. }
62. out[j + 1] = cur
63. i = i + 1
64. }
65. return out
66. }
68. // `ssh-keygen -l` on the key: → { bits, fingerprint } or null when it is not a key
69. static inspectKey = (type, key) => {
70. let file = tmpDir() + '/' + randomBytes(12, 'hex') + '.pub'
71. writeFile(file, type + ' ' + key + NL, 384)
72. let r = run(['ssh-keygen', '-l', '-f', file], { timeout = 10 })
73. if (exists(file)) { remove(file) }
74. if (r == null || r.exit != 0 || r.lines.length == 0) { return null }
75. let parts = r.lines[0].split(' ')
76. if (parts.length < 2 || !parts[1].startsWith('SHA256:')) { return null }
77. return { bits = toNumber(parts[0]) fingerprint = parts[1] }
78. }
80. // a new key: { row } or { error }. `text` is the line from the .pub file: `<type> <base64> [comment]`
81. static addKey = (userId, name, text) => {
82. let u = userRecord(userId)
83. if (u == null) { return { error = 'log in with ident (top right) first' } }
84. let n = name == null ? '' : ('' + name).trim()
85. let bad = plainError(n, 60, 'the key name')
86. if (bad != null) { return { error = bad } }
87. if (n == '') { return { error = 'give the key a name (for example the computer it is for)' } }
88. if (text == null || hlTypeName(text) != 'String' || text.length > 2000) { return { error = 'paste the public key (the .pub file)' } }
89. let t = text.trim()
90. if (t.startsWith('-----')) { return { error = 'that is a PRIVATE key — never paste it. Paste the .pub file: ssh-keygen -y -f ~/.ssh/id_ed25519' } }
91. if (t.includes(NL)) { return { error = 'paste one public key, on one line' } }
92. let parts = t.split(' ')
93. let type = parts[0]
94. if (parts.length < 2 || !allowedTypes.includes(type)) { return { error = 'not a public key of a supported type (ssh-ed25519, ssh-rsa, ecdsa, sk-…)' } }
95. let key = parts[1]
96. if (!isKeyBase64(key)) { return { error = 'the key text is not valid' } }
97. let info = inspectKey(type, key)
98. if (info == null) { return { error = 'the key text is not valid' } }
99. if (type == 'ssh-rsa' && info.bits < 2048) { return { error = 'RSA keys need at least 2048 bits' } }
100. if (countOfList(sshKeysTable.find('key', key)) > 0) { return { error = 'that key is already added' } }
101. if (countOfList(sshKeysTable.find('user', u.id)) >= maxKeys) { return { error = 'you have ' + maxKeys + ' keys already — remove one first' } }
102. let id = sshKeysTable.put({ user = u.id name = n type = type key = key fingerprint = info.fingerprint created = now() })
103. if (id == null) { return { error = 'could not store the key: ' + sshKeysTable.lastError() } }
104. return { row = rowOfKey(sshKeysTable.fetch(id)) }
105. }
107. // remove one of the user's own keys (works at once: the sshd container asks again on every login)
108. static revokeKey = (userId, keyId) => {
109. if (userId == null || keyId == null || hlTypeName(keyId) != 'String') { return { error = 'no such key' } }
110. let k = sshKeysTable.fetch(keyId)
111. if (k == null || k.user != userId) { return { error = 'no such key' } }
112. sshKeysTable.delete(keyId)
113. return { ok = true }
114. }
116. // the user a key belongs to (users @id) or null
117. static userOfKey = (type, key) => {
118. if (type == null || key == null || hlTypeName(type) != 'String' || hlTypeName(key) != 'String' || !isKeyBase64(key)) { return null }
119. let k = firstOf(sshKeysTable.find('key', key))
120. if (k == null || k.type != type) { return null }
121. return k.user
122. }