HAXY

▄▀▀▀ ▄ ▄▀▀▀▀▀▀▄ ▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▄▀▀▀ ▀▀▀▀▀▄▀▀▀▀ ▀ ▀▀▀▀▀▀▄▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▄ ▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀ ▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▄▄▄▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▄ ▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀ ▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀ ▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀ ▀▀▀▀ ▀▀▀▀▀▀▀▀▀ ▀▀▀▀▄▀▀▀▀▀▀ ▀ ▀▀ ▀▀▀▀▀▀▀▀▀ ▀▀▀▄▀▀▀▀▀▀▀ ▀ ▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▄ ▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀ ▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▄ ▀▀ ▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀ ▀ ▀▀▀ ▀▀▀▀▀▀▄▀ ▀▀▀▀▀▀▀ ▀ ▀▀▀ ▄▀▀▀▀▀▄▄ ▀▀▀▀▄▄▀▀ ▀ ▀▀▀ ▀▀▀▀▀▀▀▀▄ ▀▀▀▄▀▀▀ ▀▀ ▀▀▀ ▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀▀▀▀▀▀▄▀ ▀▀▀▀▀▀▀▀▄ ▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀ ▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀▀▀▀ ▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀ ▀▄ ▄▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▄▀▀▀▄▀▀▀▀ ▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀ ▀▀▀

╭─────────────╮ │scroll to top│ ╰─────────────╯ ╭ User.zig ─────────────────────────────────────────────────────╮ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────╯

╭────╮ ╭ clone ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─╮ │http│ ssh │ │ ╰────╯ ╰ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─╯

.. Assignment.zig Attachment.zig Comment.zig Discussion.zig Fork.zig Grant.zig Issue.zig Notify.zig Patch.zig PatchRev.zig Repo.zig ╭─────────────────────────────────╮ │User.zig │ ╰─────────────────────────────────╯

69 record_maybe: ?Record, 70 arena: *std.heap.ArenaAllocator, 71 _: ?[]const u8, 72 ) !void { 73 const user_key = hash.hashInt(hash_kind, event_id); 74 75 const event_id_to_user_cursor = try haxy_moment.putCursor(hash.hashInt(hash_kind, "event-id->user")); 76 const event_id_to_user = try DB.HashMap(.read_write).init(event_id_to_user_cursor); 77 78 const name_to_user_id_cursor = try haxy_moment.putCursor(hash.hashInt(hash_kind, name_index_key)); 79 const name_to_user_id = try DB.SortedMap(.read_write).init(name_to_user_id_cursor); 80 81 const email_to_user_id_cursor = try haxy_moment.putCursor(hash.hashInt(hash_kind, email_to_user_id_key)); 82 const email_to_user_id = try DB.HashMap(.read_write).init(email_to_user_id_cursor); 83 84 const fingerprint_to_user_id_set_cursor = try haxy_moment.putCursor(hash.hashInt(hash_kind, fingerprint_to_user_id_set_key)); 85 const fingerprint_to_user_id_set = try DB.HashMap(.read_write).init(fingerprint_to_user_id_set_cursor); 86 87 var existing_record_maybe: ?Record = null; 88 const existing_cursor_maybe = try event_id_to_user.getCursor(user_key); 89 if (existing_cursor_maybe) |existing_cursor| { 90 const existing_user = try DB.HashMap(.read_only).init(existing_cursor); 91 existing_record_maybe = try evt.read(Record, DB, hash_kind, arena, existing_user); 92 } 93 94 var record_to_write = record_maybe orelse try evt.removedRecord(Record, DB, hash_kind, haxy_moment.readOnly(), existing_record_maybe); 95 96 if (!record_to_write.removed) try validateName(record_to_write.event.name); 97 98 if (existing_record_maybe) |existing_record| { 99 // updates preserve the original creation metadata 100 record_to_write.created_order = existing_record.created_order; 101 102 // drop the old active indexes; active values are re-added below 103 if (!existing_record.removed) { 104 _ = try name_to_user_id.remove(existing_record.event.name); 105 _ = try email_to_user_id.remove(hash.hashInt(hash_kind, existing_record.event.email)); 106 107 var keys = std.mem.splitScalar(u8, existing_record.event.ssh_keys, '\n'); 108 while (keys.next()) |line| { 109 const fingerprint = fingerprintOfKey(line) orelse continue; 110 const user_id_set = try DB.SortedSet(.read_write).init(try fingerprint_to_user_id_set.putCursor(hash.hashInt(hash_kind, &fingerprint))); 111 _ = try user_id_set.remove(event_id); 112 } 113 } 114 } 115 116 const user_cursor = try event_id_to_user.putCursor(user_key); 117 const user = try DB.HashMap(.read_write).init(user_cursor); 118 try evt.upsert(Record, DB, hash_kind, user, record_to_write); 119 try evt.indexEvent(DB, hash_kind, haxy_moment, event_id, .user, existing_record_maybe, record_to_write); 120 121 const order_key = evt.orderKeyDesc(record_to_write.created_order, event_id); 122 123 // the id set retains removed records so merges can carry removals 124 if (existing_cursor_maybe == null) { 125 const user_id_set_cursor = try haxy_moment.putCursor(hash.hashInt(hash_kind, all_id_set_key)); 126 const user_id_set = try DB.SortedSet(.read_write).init(user_id_set_cursor); 127 try user_id_set.put(&order_key); 128 } 129 130 if (!record_to_write.removed) { 131 try name_to_user_id.put(record_to_write.event.name, .{ .bytes = event_id }); 132 try email_to_user_id.put(hash.hashInt(hash_kind, record_to_write.event.email), .{ .bytes = event_id }); 133 134 var keys = std.mem.splitScalar(u8, record_to_write.event.ssh_keys, '\n'); 135 while (keys.next()) |line| { 136 const fingerprint = fingerprintOfKey(line) orelse continue; 137 const user_id_set = try DB.SortedSet(.read_write).init(try fingerprint_to_user_id_set.putCursor(hash.hashInt(hash_kind, &fingerprint))); 138 try user_id_set.put(event_id); 139 } 140 } 141 } 142 143 // the SHA256 fingerprint of one authorized_keys line, or null if the line is 144 // blank or not a parseable "<type> <base64> [comment]" entry 145 fn fingerprintOfKey(line: []const u8) ?[ssh.fingerprint_len]u8 { 146 var it = std.mem.tokenizeAny(u8, line, " \t\r"); 147 _ = it.next() orelse return null; // key type 148 const blob_b64 = it.next() orelse return null; 149 150 const decoder = std.base64.standard.Decoder; 151 const blob_len = decoder.calcSizeForSlice(blob_b64) catch return null; 152 var blob_buf: [4096]u8 = undefined; 153 if (blob_len > blob_buf.len) return null; 154 decoder.decode(blob_buf[0..blob_len], blob_b64) catch return null; 155 156 return ssh.formatFingerprint(blob_buf[0..blob_len]); 157 } 158 159 pub const password_hash_max_len = bcrypt.hash_length * 2; 160 161 pub fn hashPassword( 162 password: []const u8, 163 out: []u8, 164 io: std.Io, 165 ) ![]const u8 { 166 return bcrypt.strHash(password, .{ 167 .params = bcrypt.Params.owasp, 168 .encoding = .phc, 169 }, out, io); 170 } 171 172 pub const VerifyResult = union(enum) { 173 success: [evt.event_id_size]u8, 174 unknown_user, 175 wrong_password, 176 }; 177 178 // look up a user by name (via the name->user-id index) and verify the 179 // supplied password against the stored bcrypt hash. used by both the TTY 180 // login submit and the server's /login route. 181 pub fn verifyCredentials( 182 comptime DB: type, 183 comptime hash_kind: hash.HashKind, 184 haxy_moment: DB.HashMap(.read_only), 185 arena: *std.heap.ArenaAllocator, 186 name: []const u8, 187 password: []const u8, 188 ) !VerifyResult { 189 const user_id = try readIdByName(DB, hash_kind, haxy_moment, name) orelse return .unknown_user; 190 191 const user_key = hash.hashInt(hash_kind, &user_id); 192 const event_id_to_user_cursor = try haxy_moment.getCursor(hash.hashInt(hash_kind, "event-id->user")) orelse return .unknown_user; 193 const event_id_to_user = try DB.HashMap(.read_only).init(event_id_to_user_cursor); 194 195 const user_cursor = try event_id_to_user.getCursor(user_key) orelse return .unknown_user; 196 const user_map = try DB.HashMap(.read_only).init(user_cursor); 197 const user_event = try evt.read(Record, DB, hash_kind, arena, user_map); 198 199 if (!verifyPassword(user_event.event.password_hash, password)) return .wrong_password; 200 201 return .{ .success = user_id }; 202 } 203 204 pub fn verifyPassword(password_hash: []const u8, password: []const u8) bool { 205 bcrypt.strVerify(password_hash, password, .{ .silently_truncate_password = false }) catch return false; 206 return true; 207 } 208 209 // read a user by event id via the event-id->user index, or null if the id 210 // isn't a known user. field byte slices are allocated in `arena`. 211 pub fn readById( 212 comptime DB: type, 213 comptime hash_kind: hash.HashKind, 214 haxy_moment: DB.HashMap(.read_only), 215 arena: *std.heap.ArenaAllocator, 216 user_id: []const u8, 217 ) !?Record { 218 const user_map = try userMap(DB, hash_kind, haxy_moment, user_id) orelse return null; 219 return try evt.read(Record, DB, hash_kind, arena, user_map); 220 } 221 222 // read just the public part of a user by email via the email->user-id index, or 223 // null when no user has the email. field byte slices are allocated in `arena`. 224 pub fn readByEmail( 225 comptime DB: type, 226 comptime hash_kind: hash.HashKind, 227 haxy_moment: DB.HashMap(.read_only), 228 arena: *std.heap.ArenaAllocator, 229 email: []const u8, 230 ) !?Public { 231 const user_id = (try readIdByEmail(DB, hash_kind, haxy_moment, email)) orelse return null; 232 const user_map = try userMap(DB, hash_kind, haxy_moment, &user_id) orelse return null; 233 const record = try evt.read(struct { event: Public }, DB, hash_kind, arena, user_map); 234 return record.event; 235 } 236 237 // a user's id via the email->user-id index 238 pub fn readIdByEmail( 239 comptime DB: type, 240 comptime hash_kind: hash.HashKind, 241 haxy_moment: DB.HashMap(.read_only), 242 email: []const u8, 243 ) !?[evt.event_id_size]u8 { 244 const email_to_user_id_cursor = (try haxy_moment.getCursor(hash.hashInt(hash_kind, email_to_user_id_key))) orelse return null; 245 const email_to_user_id = try DB.HashMap(.read_only).init(email_to_user_id_cursor); 246 const user_id_cursor = (try email_to_user_id.getCursor(hash.hashInt(hash_kind, email))) orelse return null; 247 var user_id: [evt.event_id_size]u8 = undefined; 248 _ = try user_id_cursor.readBytes(&user_id); 249 return user_id; 250 } 251 252 // a user's id via the name->user-id index 253 pub fn readIdByName( 254 comptime DB: type, 255 comptime hash_kind: hash.HashKind, 256 haxy_moment: DB.HashMap(.read_only), 257 name: []const u8, 258 ) !?[evt.event_id_size]u8 { 259 const index_cursor = (try haxy_moment.getCursor(hash.hashInt(hash_kind, name_index_key))) orelse return null; 260 const index = try DB.SortedMap(.read_only).init(index_cursor); 261 const user_id_cursor = (try index.getCursor(name)) orelse return null; 262 var user_id: [evt.event_id_size]u8 = undefined; 263 _ = try user_id_cursor.readBytes(&user_id); 264 return user_id; 265 } 266 267 // the ids of the active users holding the ssh key with this fingerprint 268 pub fn readIdsByFingerprint( 269 comptime DB: type, 270 comptime hash_kind: hash.HashKind, 271 haxy_moment: DB.HashMap(.read_only), 272 arena: *std.heap.ArenaAllocator, 273 fingerprint: *const [ssh.fingerprint_len]u8, 274 ) ![]const [evt.event_id_size]u8 { 275 var user_ids: std.ArrayList([evt.event_id_size]u8) = .empty; 276 const index_cursor = (try haxy_moment.getCursor(hash.hashInt(hash_kind, fingerprint_to_user_id_set_key))) orelse return user_ids.items; 277 const index = try DB.HashMap(.read_only).init(index_cursor); 278 const user_id_set_cursor = (try index.getCursor(hash.hashInt(hash_kind, fingerprint))) orelse return user_ids.items; 279 const user_id_set = try DB.SortedSet(.read_only).init(user_id_set_cursor); 280 281 var iter = try user_id_set.iterator(); 282 while (try iter.next()) |kv_pair_cursor| { 283 var cursor = kv_pair_cursor; 284 const kv_pair = try cursor.readKeyValuePair(); 285 var user_id: [evt.event_id_size]u8 = undefined; 286 _ = try kv_pair.key_cursor.readBytes(&user_id); 287 try user_ids.append(arena.allocator(), user_id); 288 } 289 return user_ids.items; 290 } 291 292 // whether the user holds the ssh key with this fingerprint 293 pub fn holdsKey( 294 comptime DB: type, 295 comptime hash_kind: hash.HashKind, 296 haxy_moment: DB.HashMap(.read_only), 297 arena: *std.heap.ArenaAllocator, 298 user_id: *const [evt.event_id_size]u8, 299 fingerprint: *const [ssh.fingerprint_len]u8, 300 ) !bool { 301 for (try readIdsByFingerprint(DB, hash_kind, haxy_moment, arena, fingerprint)) |holder_id| { 302 if (std.mem.eql(u8, &holder_id, user_id)) return true; 303 } 304 return false; 305 } 306 307 // a user's record map via the event-id->user index 308 fn userMap( 309 comptime DB: type, 310 comptime hash_kind: hash.HashKind, 311 haxy_moment: DB.HashMap(.read_only), 312 user_id: []const u8, 313 ) !?DB.HashMap(.read_only) { 314 const event_id_to_user_cursor = try haxy_moment.getCursor(hash.hashInt(hash_kind, "event-id->user")) orelse return null; 315 const event_id_to_user = try DB.HashMap(.read_only).init(event_id_to_user_cursor); 316 const user_cursor = try event_id_to_user.getCursor(hash.hashInt(hash_kind, user_id)) orelse return null; 317 return try DB.HashMap(.read_only).init(user_cursor); 318 } 319 320 // read a user by name from the admin event store, or null if the admin repo or 321 // the user doesn't exist. field byte slices are allocated in `arena`. 322 pub fn readByName( 323 io: std.Io, 324 allocator: std.mem.Allocator, 325 admin_repo_path: []const u8, 326 arena: *std.heap.ArenaAllocator, 327 name: []const u8, 328 ) !?Record { 329 var repo = rp.Repo(.xit, evt.admin_repo_opts).open(io, allocator, .{ .path = admin_repo_path }) catch |err| switch (err) { 330 error.RepoNotFound => return null, 331 else => |e| return e, 332 }; 333 defer repo.deinit(io, allocator); 334 335 const moment = try evt.currentMoment(evt.admin_repo_opts, &repo); 336 337 const user_id = try readIdByName(evt.AdminDB, evt.admin_repo_opts.hash, moment, name) orelse return null; 338 339 return try readById(evt.AdminDB, evt.admin_repo_opts.hash, moment, arena, &user_id); 340 } 341