Moving MFA service into shared libs (#16969)
* Moving MFA service into shared libs * Fixing i18n extraction issue * Fixing tests
Этот коммит содержится в:
Jesús Espino
коммит произвёл
GitHub
GitHub
родитель
0363f19611
Коммит
5f9ab3783a
137
shared/mfa/mfa.go
Обычный файл
137
shared/mfa/mfa.go
Обычный файл
@@ -0,0 +1,137 @@
|
||||
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
||||
// See LICENSE.txt for license information.
|
||||
|
||||
package mfa
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/base32"
|
||||
"fmt"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"github.com/dgryski/dgoogauth"
|
||||
"github.com/mattermost/rsc/qr"
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
// InvalidToken indicates the case where the token validation has failed.
|
||||
var InvalidToken = errors.New("invalid mfa token")
|
||||
|
||||
const (
|
||||
// This will result in 160 bits of entropy (base32 encoded), as recommended by rfc4226.
|
||||
mfaSecretSize = 20
|
||||
)
|
||||
|
||||
type Store interface {
|
||||
UpdateMfaActive(userId string, active bool) error
|
||||
UpdateMfaSecret(userId, secret string) error
|
||||
}
|
||||
|
||||
type MFA struct {
|
||||
store Store
|
||||
}
|
||||
|
||||
func New(store Store) *MFA {
|
||||
return &MFA{store}
|
||||
}
|
||||
|
||||
// newRandomBase32String returns a base32 encoded string of a random slice
|
||||
// of bytes of the given size. The resulting entropy will be (8 * size) bits.
|
||||
func newRandomBase32String(size int) string {
|
||||
data := make([]byte, size)
|
||||
rand.Read(data)
|
||||
return base32.StdEncoding.EncodeToString(data)
|
||||
}
|
||||
|
||||
func getIssuerFromUrl(uri string) string {
|
||||
issuer := "Mattermost"
|
||||
siteUrl := strings.TrimSpace(uri)
|
||||
|
||||
if siteUrl != "" {
|
||||
siteUrl = strings.TrimPrefix(siteUrl, "https://")
|
||||
siteUrl = strings.TrimPrefix(siteUrl, "http://")
|
||||
issuer = strings.TrimPrefix(siteUrl, "www.")
|
||||
}
|
||||
|
||||
return url.QueryEscape(issuer)
|
||||
}
|
||||
|
||||
// GenerateSecret generates a new user mfa secret and store it with the StoreSecret function provided
|
||||
func (m *MFA) GenerateSecret(siteURL, userEmail, userID string) (string, []byte, error) {
|
||||
issuer := getIssuerFromUrl(siteURL)
|
||||
|
||||
secret := newRandomBase32String(mfaSecretSize)
|
||||
|
||||
authLink := fmt.Sprintf("otpauth://totp/%s:%s?secret=%s&issuer=%s", issuer, userEmail, secret, issuer)
|
||||
|
||||
code, err := qr.Encode(authLink, qr.H)
|
||||
|
||||
if err != nil {
|
||||
return "", nil, errors.Wrap(err, "unable to generate qr code")
|
||||
}
|
||||
|
||||
img := code.PNG()
|
||||
|
||||
if err := m.store.UpdateMfaSecret(userID, secret); err != nil {
|
||||
return "", nil, errors.Wrap(err, "unable to store mfa secret")
|
||||
}
|
||||
|
||||
return secret, img, nil
|
||||
}
|
||||
|
||||
// Activate set the mfa as active and store it with the StoreActive function provided
|
||||
func (m *MFA) Activate(userMfaSecret, userID string, token string) error {
|
||||
otpConfig := &dgoogauth.OTPConfig{
|
||||
Secret: userMfaSecret,
|
||||
WindowSize: 3,
|
||||
HotpCounter: 0,
|
||||
}
|
||||
|
||||
trimmedToken := strings.TrimSpace(token)
|
||||
|
||||
ok, err := otpConfig.Authenticate(trimmedToken)
|
||||
if err != nil {
|
||||
return errors.Wrap(err, "unable to parse the token")
|
||||
}
|
||||
|
||||
if !ok {
|
||||
return InvalidToken
|
||||
}
|
||||
|
||||
if err := m.store.UpdateMfaActive(userID, true); err != nil {
|
||||
return errors.Wrap(err, "unable to store mfa active")
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Deactivate set the mfa as deactive, remove the mfa secret, store it with the StoreActive and StoreSecret functions provided
|
||||
func (m *MFA) Deactivate(userId string) error {
|
||||
if err := m.store.UpdateMfaActive(userId, false); err != nil {
|
||||
return errors.Wrap(err, "unable to store mfa active")
|
||||
}
|
||||
|
||||
if err := m.store.UpdateMfaSecret(userId, ""); err != nil {
|
||||
return errors.Wrap(err, "unable to store mfa secret")
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Validate the provide token using the secret provided
|
||||
func (m *MFA) ValidateToken(secret, token string) (bool, error) {
|
||||
otpConfig := &dgoogauth.OTPConfig{
|
||||
Secret: secret,
|
||||
WindowSize: 3,
|
||||
HotpCounter: 0,
|
||||
}
|
||||
|
||||
trimmedToken := strings.TrimSpace(token)
|
||||
ok, err := otpConfig.Authenticate(trimmedToken)
|
||||
if err != nil {
|
||||
return false, errors.Wrap(err, "unable to parse the token")
|
||||
}
|
||||
|
||||
return ok, nil
|
||||
}
|
||||
185
shared/mfa/mfa_test.go
Обычный файл
185
shared/mfa/mfa_test.go
Обычный файл
@@ -0,0 +1,185 @@
|
||||
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
||||
// See LICENSE.txt for license information.
|
||||
|
||||
package mfa
|
||||
|
||||
import (
|
||||
"encoding/base32"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/url"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/dgryski/dgoogauth"
|
||||
"github.com/mattermost/mattermost-server/v5/plugin/plugintest/mock"
|
||||
"github.com/mattermost/mattermost-server/v5/store/storetest/mocks"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestGenerateSecret(t *testing.T) {
|
||||
userID := "user-id"
|
||||
userEmail := "sample@sample.com"
|
||||
siteURL := "http://localhost:8065"
|
||||
|
||||
t.Run("fail on store action fail", func(t *testing.T) {
|
||||
storeMock := mocks.UserStore{}
|
||||
storeMock.On("UpdateMfaSecret", userID, mock.AnythingOfType("string")).Return(func(userId string, secret string) error {
|
||||
return errors.New("failed to update mfa secret")
|
||||
})
|
||||
|
||||
_, _, err := New(&storeMock).GenerateSecret(siteURL, userEmail, userID)
|
||||
require.Error(t, err)
|
||||
require.Contains(t, err.Error(), "unable to store mfa secret")
|
||||
})
|
||||
|
||||
t.Run("Successful generate secret", func(t *testing.T) {
|
||||
storeMock := mocks.UserStore{}
|
||||
storeMock.On("UpdateMfaSecret", userID, mock.AnythingOfType("string")).Return(func(userId string, secret string) error {
|
||||
return nil
|
||||
})
|
||||
|
||||
secret, img, err := New(&storeMock).GenerateSecret(siteURL, userEmail, userID)
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, secret, 32)
|
||||
require.NotEmpty(t, img, "no image set")
|
||||
})
|
||||
}
|
||||
|
||||
func TestGetIssuerFromUrl(t *testing.T) {
|
||||
cases := []struct {
|
||||
Input string
|
||||
Expected string
|
||||
}{
|
||||
{"http://somewebsite.com", url.QueryEscape("somewebsite.com")},
|
||||
{"https://somewebsite.com", url.QueryEscape("somewebsite.com")},
|
||||
{"https://some.website.com", url.QueryEscape("some.website.com")},
|
||||
{" https://www.somewebsite.com", url.QueryEscape("somewebsite.com")},
|
||||
{"http://somewebsite.com/chat", url.QueryEscape("somewebsite.com/chat")},
|
||||
{"somewebsite.com ", url.QueryEscape("somewebsite.com")},
|
||||
{"http://localhost:8065", url.QueryEscape("localhost:8065")},
|
||||
{"", "Mattermost"},
|
||||
{" ", "Mattermost"},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
assert.Equal(t, c.Expected, getIssuerFromUrl(c.Input))
|
||||
}
|
||||
}
|
||||
|
||||
func TestActivate(t *testing.T) {
|
||||
userID := "user-id"
|
||||
userMfaSecret := newRandomBase32String(mfaSecretSize)
|
||||
|
||||
token := dgoogauth.ComputeCode(userMfaSecret, time.Now().UTC().Unix()/30)
|
||||
|
||||
t.Run("fail on wrongly formatted token", func(t *testing.T) {
|
||||
err := New(nil).Activate(userMfaSecret, userID, "invalid-token")
|
||||
require.Error(t, err)
|
||||
require.Contains(t, err.Error(), "unable to parse the token")
|
||||
})
|
||||
|
||||
t.Run("fail on invalid token", func(t *testing.T) {
|
||||
err := New(nil).Activate(userMfaSecret, userID, "000000")
|
||||
require.Error(t, err)
|
||||
require.Contains(t, err.Error(), "invalid mfa token")
|
||||
})
|
||||
|
||||
t.Run("fail on store action fail", func(t *testing.T) {
|
||||
storeMock := mocks.UserStore{}
|
||||
storeMock.On("UpdateMfaActive", userID, true).Return(func(userId string, active bool) error {
|
||||
return errors.New("failed to update mfa active")
|
||||
})
|
||||
|
||||
err := New(&storeMock).Activate(userMfaSecret, userID, fmt.Sprintf("%06d", token))
|
||||
require.Error(t, err)
|
||||
require.Contains(t, err.Error(), "unable to store mfa active")
|
||||
})
|
||||
|
||||
t.Run("Successful activate", func(t *testing.T) {
|
||||
storeMock := mocks.UserStore{}
|
||||
storeMock.On("UpdateMfaActive", userID, true).Return(func(userId string, active bool) error {
|
||||
return nil
|
||||
})
|
||||
|
||||
err := New(&storeMock).Activate(userMfaSecret, userID, fmt.Sprintf("%06d", token))
|
||||
require.NoError(t, err)
|
||||
})
|
||||
}
|
||||
|
||||
func TestDeactivate(t *testing.T) {
|
||||
userID := "user-id"
|
||||
|
||||
t.Run("fail on store UpdateMfaActive action fail", func(t *testing.T) {
|
||||
storeMock := mocks.UserStore{}
|
||||
storeMock.On("UpdateMfaActive", userID, false).Return(func(userId string, active bool) error {
|
||||
return errors.New("failed to update mfa active")
|
||||
})
|
||||
storeMock.On("UpdateMfaSecret", userID, "").Return(func(userId string, secret string) error {
|
||||
return errors.New("failed to update mfa secret")
|
||||
})
|
||||
|
||||
err := New(&storeMock).Deactivate(userID)
|
||||
require.Error(t, err)
|
||||
require.Contains(t, err.Error(), "unable to store mfa active")
|
||||
})
|
||||
|
||||
t.Run("fail on store UpdateMfaSecret action fail", func(t *testing.T) {
|
||||
storeMock := mocks.UserStore{}
|
||||
storeMock.On("UpdateMfaActive", userID, false).Return(func(userId string, active bool) error {
|
||||
return nil
|
||||
})
|
||||
storeMock.On("UpdateMfaSecret", userID, "").Return(func(userId string, secret string) error {
|
||||
return errors.New("failed to update mfa secret")
|
||||
})
|
||||
|
||||
err := New(&storeMock).Deactivate(userID)
|
||||
require.Error(t, err)
|
||||
require.Contains(t, err.Error(), "unable to store mfa secret")
|
||||
})
|
||||
|
||||
t.Run("Successful deactivate", func(t *testing.T) {
|
||||
storeMock := mocks.UserStore{}
|
||||
storeMock.On("UpdateMfaActive", userID, false).Return(func(userId string, active bool) error {
|
||||
return nil
|
||||
})
|
||||
storeMock.On("UpdateMfaSecret", userID, "").Return(func(userId string, secret string) error {
|
||||
return nil
|
||||
})
|
||||
|
||||
err := New(&storeMock).Deactivate(userID)
|
||||
require.NoError(t, err)
|
||||
})
|
||||
}
|
||||
|
||||
func TestValidateToken(t *testing.T) {
|
||||
secret := newRandomBase32String(mfaSecretSize)
|
||||
token := dgoogauth.ComputeCode(secret, time.Now().UTC().Unix()/30)
|
||||
|
||||
t.Run("fail on wrongly formatted token", func(t *testing.T) {
|
||||
ok, err := New(nil).ValidateToken(secret, "invalid-token")
|
||||
require.Error(t, err)
|
||||
require.False(t, ok)
|
||||
require.Contains(t, err.Error(), "unable to parse the token")
|
||||
})
|
||||
|
||||
t.Run("fail on invalid token", func(t *testing.T) {
|
||||
ok, err := New(nil).ValidateToken(secret, "000000")
|
||||
require.NoError(t, err)
|
||||
require.False(t, ok)
|
||||
})
|
||||
|
||||
t.Run("valid token", func(t *testing.T) {
|
||||
ok, err := New(nil).ValidateToken(secret, fmt.Sprintf("%06d", token))
|
||||
require.NoError(t, err)
|
||||
require.True(t, ok)
|
||||
})
|
||||
}
|
||||
|
||||
func TestRandomBase32String(t *testing.T) {
|
||||
for i := 0; i < 1000; i++ {
|
||||
str := newRandomBase32String(i)
|
||||
require.Len(t, str, base32.StdEncoding.EncodedLen(i))
|
||||
}
|
||||
}
|
||||
Ссылка в новой задаче
Block a user