34 строки
1.0 KiB
Go
34 строки
1.0 KiB
Go
package webapp
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"fmt"
|
|
)
|
|
|
|
// GenerateFirstRunPassword returns a fresh random password suitable
|
|
// for the worker's first-run webapp credential. The output is 24
|
|
// bytes of crypto/rand encoded as URL-safe base64 (no padding), which
|
|
// is roughly 32 characters long and safe to print once into the
|
|
// worker log.
|
|
//
|
|
// Phase 1 (MVP) only: a stronger entropy scheme can replace this in
|
|
// later phases if needed.
|
|
func GenerateFirstRunPassword() (string, error) {
|
|
buf := make([]byte, 24)
|
|
if _, err := rand.Read(buf); err != nil {
|
|
return "", fmt.Errorf("webapp: read random bytes: %w", err)
|
|
}
|
|
return base64.RawURLEncoding.EncodeToString(buf), nil
|
|
}
|
|
|
|
// newSessionID is the underlying primitive for both session cookies
|
|
// and CSRF tokens: 32 bytes from crypto/rand, URL-safe base64.
|
|
func newSessionID() (string, error) {
|
|
buf := make([]byte, 32)
|
|
if _, err := rand.Read(buf); err != nil {
|
|
return "", fmt.Errorf("webapp: read random bytes: %w", err)
|
|
}
|
|
return base64.RawURLEncoding.EncodeToString(buf), nil
|
|
}
|