collin/anvil · 18e442f7

Replace passkey sign-in with OIDC single sign-on

Collin Richards · 2026-08-18 14:31 UTC · 18e442f7a5fdffb13c441320e35224938e3116d2 · parent 9162f830 · browse files

modified.gitignore+2 −0

modifiedCargo.lock+50 −382

modifiedCargo.toml+5 −4

modifiedREADME.md+1 −1

modifiedTODO.md+4 −3

modifiedanvil.example.toml+20 −0

modifiedcrates/anvil-cli/src/main.rs+0 −5

modifiedcrates/anvil-core/Cargo.toml+0 −1

modifiedcrates/anvil-core/src/config.rs+113 −0

modifiedcrates/anvil-core/src/db.rs+23 −25

modifiedcrates/anvil-core/src/lib.rs+0 −5

modifiedcrates/anvil-core/src/models.rs+9 −35

deletedcrates/anvil-core/src/passkeys.rs+0 −342

modifiedcrates/anvil-core/src/periodic.rs+6 −15

modifiedcrates/anvil-core/src/users.rs+180 −5

modifiedcrates/anvil-web/Cargo.toml+9 −6

modifiedcrates/anvil-web/src/auth.rs+34 −10

modifiedcrates/anvil-web/src/lib.rs+2 −2

addedcrates/anvil-web/src/oidc.rs+834 −0

deletedcrates/anvil-web/src/passkeys.rs+0 −744

modifiedcrates/anvil-web/src/ui.rs+4 −33

addedcrates/anvil-web/tests/oidc_flow.rs+630 −0

deletedcrates/anvil-web/tests/passkey_flow.rs+0 −546

modifieddeploy/anvil.dev.toml+9 −0

modifieddeploy/dev.sh+25 −0

modifieddeploy/run.sh+9 −0

addeddocs/oidc.md+143 −0

deleteddocs/passkeys.md+0 −78

⋯ 4 unchanged lines
5	5		*.db-shm
6	6		anvil.toml
7	7		/deploy/anvild
	8	+	# CA bundle deploy/dev.sh builds so the dev container trusts portless (docs/oidc.md).
	9	+	/deploy/dev-ca.crt
8	10		# Local-only API credentials for fetching attachments (never committed).
9	11		/.anvil-credentials

⋯ 67 unchanged lines
68	68		rusqlite = "0.39"
69	69		# `anvild secret` prompts for an ssh key passphrase / an account password.
70	70		rpassword = "7"
71		-	# WebAuthn/passkey sign-in, relying-party side. Pure Rust on purpose: the
72		-	# better-known webauthn-rs pulls in OpenSSL, which the static-musl deploy build
73		-	# (deploy/build.sh) cannot link.
74		-	webauthn_rp = { version = "0.3", features = ["serde_relaxed"] }
	71	+	# RS256 verification of OIDC id tokens (docs/oidc.md). ring rather than a JWT
	72	+	# crate: it is already in the tree under rustls, cross-compiles to static musl
	73	+	# (aws-lc-rs, which the maintained JWT crates default to, needs cmake and does
	74	+	# not), and one signature check over `header.payload` is all we need.
	75	+	ring = "0.17"
75	76		serde = { version = "1", features = ["derive"] }
76	77		serde_json = "1"
77	78		serde_yaml = "0.9"
⋯ 25 unchanged lines

⋯ 36 unchanged lines
37	37		## Docs
38	38
39	39		- [CI artifacts](docs/ci-artifacts.md)
40		-	- [Passkeys](docs/passkeys.md) — WebAuthn sign-in
	40	+	- [Single sign-on](docs/oidc.md) — OIDC sign-in, alongside passwords
41	41		- [Repository secrets](docs/secrets.md) — encrypted to your ssh keys in the
42	42		browser; anvil stores ciphertext it cannot open
43	43		- [Threat model for untrusted users](docs/untrusted-mode.md)

⋯ 29 unchanged lines
30	30		repo listings for visual browsing
31	31		- [ ] API tokens: a `write` scope (would need CSRF-exempt write paths) and
32	32		`last_used_at` tracking
33		-	- [ ] passkey follow-ups (docs/passkeys.md): conditional UI (autofill-style
34		-	sign-in), and a warning before removing the last passkey on a
35		-	password-less-by-preference account
	33	+	- [ ] single sign-on follow-ups (docs/oidc.md): silent renewal
	34	+	(`prompt=none` on a short local session, which is what makes revoking an SSO
	35	+	session propagate here), an admin view of who is linked to which `sub`, and
	36	+	unlinking an account from the settings page
36	37		- [ ] secrets follow-ups (docs/secrets.md): authenticate `anvild secret` with an
37	38		ssh signature instead of the account password; per-step rather than per-
38	39		pipeline scoping; `ssh-rsa` recipients (needs an RSA-OAEP branch in both the
⋯ 1 unchanged line

⋯ 18 unchanged lines
19	19		# 0 means unlimited.
20	20		attachment_quota_mb = 0
21	21
	22	+	# Single sign-on against an OpenID Connect provider (see docs/oidc.md).
	23	+	# Off unless `issuer` is set; password sign-in keeps working either way.
	24	+	[oidc]
	25	+	# e.g. "https://login.richardscollin.com", or "https://login.localhost" for a
	26	+	# provider running locally. Empty disables single sign-on entirely.
	27	+	issuer = ""
	28	+	# Client id registered at the provider.
	29	+	client_id = "anvil"
	30	+	# Client secret. Prefer the ANVIL_OIDC_CLIENT_SECRET environment variable —
	31	+	# config files get committed, this must not. Empty for a public client.
	32	+	client_secret = ""
	33	+	# Defaults to base_url + "/-/oidc/callback". Must match the URI registered at
	34	+	# the provider exactly; there are no wildcards.
	35	+	redirect_uri = ""
	36	+	# Sign-in button text, after "Sign in with ". Defaults to the issuer's host.
	37	+	label = ""
	38	+	# Whether signing out of anvil also ends the provider's session. Needs a
	39	+	# post-logout URI registered for this client to come back here afterwards.
	40	+	sso_logout = true
	41	+
22	42		[ssh]
23	43		enabled = false
24	44		# Internal bind address. Under Docker, set host = "0.0.0.0" and forward the port.
⋯ 38 unchanged lines

⋯ 185 unchanged lines
186	186		Box::new(anvil_core::periodic::SecretVaultSweepJob)
187	187		as Box<dyn anvil_core::periodic::PeriodicJob>,
188	188		),
189		-	(
190		-	std::time::Duration::from_secs(300),
191		-	Box::new(anvil_core::periodic::PasskeyCeremonySweepJob)
192		-	as Box<dyn anvil_core::periodic::PeriodicJob>,
193		-	),
194	189		];
195	190		anvil_core::periodic::spawn_runner(app.clone(), periodic_jobs).await;
196	191
⋯ 140 unchanged lines

⋯ 18 unchanged lines
19	19		hmac.workspace = true
20	20		sha2.workspace = true
21	21		ssh-key.workspace = true
22		-	webauthn_rp.workspace = true
23	22		serde.workspace = true
24	23		serde_json.workspace = true
25	24		serde_yaml.workspace = true
⋯ 13 unchanged lines

⋯ 30 unchanged lines
31	31		pub ci: CiConfig,
32	32		/// Periodic background job settings.
33	33		pub periodic: PeriodicConfig,
	34	+	/// Single sign-on against an OpenID Connect provider.
	35	+	pub oidc: OidcConfig,
34	36		}
35	37
	38	+	/// Path the provider redirects back to after an authorization. Registered at
	39	+	/// the provider as this app's redirect URI, and matched there character for
	40	+	/// character — see `docs/oidc.md`.
	41	+	pub const OIDC_CALLBACK_PATH: &str = "/-/oidc/callback";
	42	+
	43	+	/// Sign-in delegated to an OpenID Connect provider (authorization code flow
	44	+	/// with PKCE). Off unless [`issuer`](OidcConfig::issuer) is set, so an
	45	+	/// unconfigured instance behaves exactly as it did before: local passwords
	46	+	/// only. When on, it is additional — existing accounts keep their passwords,
	47	+	/// and the two are reconciled on the `sub` claim.
	48	+	#[derive(Clone, Debug, Deserialize, Serialize)]
	49	+	#[serde(default)]
	50	+	pub struct OidcConfig {
	51	+	/// Issuer URL, e.g. `https://login.richardscollin.com`. Empty disables
	52	+	/// single sign-on entirely. Discovery, and the `iss` claim every id token
	53	+	/// is checked against, both come from this.
	54	+	pub issuer: String,
	55	+	/// Client id registered at the provider. Defaults to `anvil`.
	56	+	pub client_id: String,
	57	+	/// Client secret. Empty for a client registered as public — PKCE protects
	58	+	/// the code either way.
	59	+	pub client_secret: String,
	60	+	/// Overrides the redirect URI, which otherwise is
	61	+	/// `base_url` + [`OIDC_CALLBACK_PATH`]. Must match the provider's
	62	+	/// allowlist exactly.
	63	+	pub redirect_uri: String,
	64	+	/// What the sign-in button says, after `Sign in with `. Defaults to the
	65	+	/// issuer's hostname.
	66	+	pub label: String,
	67	+	/// Whether signing out of anvil also ends the provider's session (an
	68	+	/// RP-initiated logout). Needs a post-logout URI registered for this
	69	+	/// client, or the provider drops the user on its own page instead of
	70	+	/// bringing them back. Defaults to `true`.
	71	+	pub sso_logout: bool,
	72	+	}
	73	+
36	74		/// CI configuration: job sandbox limits and the single-repo redeploy webhook.
37	75		///
38	76		/// On a successful CI run of [`deploy_branch`](CiConfig::deploy_branch) in the
⋯ 117 unchanged lines
156	194		ssh: SshConfig::default(),
157	195		ci: CiConfig::default(),
158	196		periodic: PeriodicConfig::default(),
	197	+	oidc: OidcConfig::default(),
	198	+	}
	199	+	}
	200	+	}
	201	+
	202	+	impl Default for OidcConfig {
	203	+	fn default() -> Self {
	204	+	Self {
	205	+	issuer: String::new(),
	206	+	client_id: "anvil".to_string(),
	207	+	client_secret: String::new(),
	208	+	redirect_uri: String::new(),
	209	+	label: String::new(),
	210	+	sso_logout: true,
159	211		}
160	212		}
161	213		}
162	214
	215	+	impl OidcConfig {
	216	+	/// Whether single sign-on is configured at all.
	217	+	pub fn enabled(&self) -> bool {
	218	+	!self.issuer.is_empty()
	219	+	}
	220	+
	221	+	/// The issuer with any trailing slashes removed — the exact string the
	222	+	/// `iss` claim must equal, and the prefix every endpoint is built from.
	223	+	pub fn issuer(&self) -> &str {
	224	+	self.issuer.trim_end_matches('/')
	225	+	}
	226	+
	227	+	/// Text for the sign-in button, after `Sign in with `. The configured
	228	+	/// label wins; otherwise the issuer's host, with a leading `login.` peeled
	229	+	/// off when a domain is left over — `login.richardscollin.com` reads
	230	+	/// better as `richardscollin.com`, while `login.localhost` must keep its
	231	+	/// prefix or it would collapse to a bare `localhost`.
	232	+	pub fn label(&self) -> String {
	233	+	if !self.label.is_empty() {
	234	+	return self.label.clone();
	235	+	}
	236	+	let host = self
	237	+	.issuer()
	238	+	.split_once("://")
	239	+	.map_or(self.issuer(), \|(_, rest)\| rest)
	240	+	.split(['/', ':'])
	241	+	.next()
	242	+	.unwrap_or_default();
	243	+	match host.strip_prefix("login.") {
	244	+	Some(domain) if domain.contains('.') => domain.to_string(),
	245	+	_ => host.to_string(),
	246	+	}
	247	+	}
	248	+	}
	249	+
163	250		impl Default for CiConfig {
164	251		fn default() -> Self {
165	252		Self {
⋯ 122 unchanged lines
288	375		if let Some(dir) = env("ANVIL_DATA_DIR") {
289	376		self.data_dir = dir.into();
290	377		}
	378	+	// Single sign-on. The secret especially wants an env var: config files
	379	+	// get committed, and this one must not be.
	380	+	if let Some(issuer) = env("ANVIL_OIDC_ISSUER") {
	381	+	self.oidc.issuer = issuer.trim().trim_end_matches('/').to_string();
	382	+	}
	383	+	if let Some(id) = env("ANVIL_OIDC_CLIENT_ID") {
	384	+	self.oidc.client_id = id;
	385	+	}
	386	+	if let Some(secret) = env("ANVIL_OIDC_CLIENT_SECRET") {
	387	+	self.oidc.client_secret = secret;
	388	+	}
	389	+	if let Some(uri) = env("ANVIL_OIDC_REDIRECT_URI") {
	390	+	self.oidc.redirect_uri = uri;
	391	+	}
	392	+	}
	393	+
	394	+	/// The redirect URI handed to the provider: the configured override, or
	395	+	/// [`OIDC_CALLBACK_PATH`] on the public base URL.
	396	+	pub fn oidc_redirect_uri(&self) -> String {
	397	+	if !self.oidc.redirect_uri.is_empty() {
	398	+	return self.oidc.redirect_uri.clone();
	399	+	}
	400	+	format!(
	401	+	"{}{OIDC_CALLBACK_PATH}",
	402	+	self.http.base_url.trim_end_matches('/')
	403	+	)
291	404		}
292	405
293	406		/// Filesystem path to the SQLite database file.
⋯ 144 unchanged lines

⋯ 11 unchanged lines
12	12		CiRun,
13	13		Issue,
14	14		IssueComment,
15		-	Passkey,
16	15		RepoSecret,
17	16		Repository,
18	17		Session,
⋯ 29 unchanged lines
48	47		Attachment,
49	48		ApiToken,
50	49		AdminCache,
51		-	RepoSecret,
52		-	Passkey
	50	+	RepoSecret
53	51		))
54	52		.connect(&url)
55	53		.await?;
⋯ 26 unchanged lines
82	80		ADMIN_CACHE_DDL,
83	81		REPO_SECRETS_DDL,
84	82		r#"CREATE INDEX IF NOT EXISTS "index_repo_secrets_by_repo_id" ON "repo_secrets" ("repo_id")"#,
85		-	PASSKEYS_DDL,
86		-	r#"CREATE INDEX IF NOT EXISTS "index_passkeys_by_user_id" ON "passkeys" ("user_id")"#,
87		-	r#"CREATE UNIQUE INDEX IF NOT EXISTS "index_passkeys_by_credential_id" ON "passkeys" ("credential_id")"#,
88	83		];
89	84
90	85		const CI_ARTIFACTS_DDL: &str = r#"CREATE TABLE IF NOT EXISTS "ci_artifacts" (
⋯ 51 unchanged lines
142	137		"recipients" TEXT NOT NULL,
143	138		"created_at" BIGINT NOT NULL,
144	139		"updated_at" BIGINT NOT NULL )"#;
145		-
146		-	const PASSKEYS_DDL: &str = r#"CREATE TABLE IF NOT EXISTS "passkeys" (
147		-	"id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
148		-	"user_id" BIGINT NOT NULL,
149		-	"name" TEXT NOT NULL,
150		-	"credential_id" TEXT NOT NULL,
151		-	"user_handle" TEXT NOT NULL,
152		-	"static_state" TEXT NOT NULL,
153		-	"dynamic_state" TEXT NOT NULL,
154		-	"transports" BIGINT NOT NULL,
155		-	"created_at" BIGINT NOT NULL,
156		-	"last_used_at" BIGINT NOT NULL )"#;
157	140
158	141		const ADMIN_CACHE_DDL: &str = r#"CREATE TABLE IF NOT EXISTS "admin_cache" (
159	142		"id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
⋯ 28 unchanged lines
188	171		"languages_json",
189	172		r#"ALTER TABLE "repositories" ADD COLUMN "languages_json" TEXT NOT NULL DEFAULT ''"#,
190	173		),
	174	+	(
	175	+	"users",
	176	+	"sso_sub",
	177	+	r#"ALTER TABLE "users" ADD COLUMN "sso_sub" TEXT NOT NULL DEFAULT ''"#,
	178	+	),
191	179		];
192	180
193	181		/// Apply [`SCHEMA_SHIMS`] and [`COLUMN_SHIMS`] to an existing database. Uses
⋯ 33 unchanged lines
227	215		"attachments",
228	216		"api_tokens",
229	217		"repo_secrets",
230		-	"passkeys",
231	218		];
232	219
233	220		/// Every schema object (table + indexes) for `table`, normalized.
⋯ 66 unchanged lines
300	287		/// A column shim must converge an old table to the fresh schema's columns
301	288		/// (same names, order, types, nullability — the DDL text itself differs
302	289		/// because of the backfill `DEFAULT`).
	290	+	///
	291	+	/// The shimmed columns are dropped newest-first, which is the only shape a
	292	+	/// real database takes: each was appended by a deployment, so an older one
	293	+	/// is missing that column and every column added after it. Dropping one
	294	+	/// from the middle instead would re-add it at the end and diverge — which
	295	+	/// says nothing about the migration, only about `ALTER TABLE`.
303	296		#[tokio::test]
304	297		async fn column_shim_matches_push_schema() {
305	298		let dir = tempfile::tempdir().unwrap();
⋯ 4 unchanged lines
310	303		let migrated = dir.path().join("migrated.db");
311	304		connect(&migrated).await.unwrap();
312	305		let conn = rusqlite::Connection::open(&migrated).unwrap();
313		-	conn.execute_batch(r#"ALTER TABLE "repositories" DROP COLUMN "mirror_url""#)
314		-	.unwrap();
	306	+	for (table, column, _) in COLUMN_SHIMS.iter().rev() {
	307	+	conn.execute_batch(&format!(r#"ALTER TABLE "{table}" DROP COLUMN "{column}""#))
	308	+	.unwrap();
	309	+	}
315	310		drop(conn);
316	311		connect(&migrated).await.unwrap();
317	312		connect(&migrated).await.unwrap(); // idempotent
318	313
319		-	assert_eq!(
320		-	columns(&fresh, "repositories"),
321		-	columns(&migrated, "repositories")
322		-	);
	314	+	for table in ["repositories", "users"] {
	315	+	assert_eq!(
	316	+	columns(&fresh, table),
	317	+	columns(&migrated, table),
	318	+	"columns diverge for {table}"
	319	+	);
	320	+	}
323	321		}
324	322
325	323		/// Reconnecting to an existing database that predates a table must create
⋯ 26 unchanged lines

⋯ 15 unchanged lines
16	16		pub mod issues;
17	17		pub mod language;
18	18		pub mod models;
19		-	pub mod passkeys;
20	19		pub mod periodic;
21	20		pub mod preview_images;
22	21		pub mod repos;
⋯ 16 unchanged lines
39	38		CiRun,
40	39		Issue,
41	40		IssueComment,
42		-	Passkey,
43	41		RepoSecret,
44	42		Repository,
45	43		Session,
⋯ 23 unchanged lines
69	67		/// Plaintext repo secrets for CI, held in memory only and lost on
70	68		/// restart — see [`secrets::Vault`].
71	69		pub vault: secrets::Vault,
72		-	/// WebAuthn challenges awaiting an answer — see [`passkeys::Ceremonies`].
73		-	pub ceremonies: passkeys::Ceremonies,
74	70		/// Server-wide secret keying CSRF tokens. Persisted in the data dir so
75	71		/// tokens survive restarts. Wrapped in `Arc` to keep `App: Clone` cheap.
76	72		csrf_secret: std::sync::Arc<[u8; 32]>,
⋯ 14 unchanged lines
91	87		db,
92	88		ci_tx: None,
93	89		vault: secrets::Vault::default(),
94		-	ceremonies: passkeys::Ceremonies::default(),
95	90		csrf_secret,
96	91		})
97	92		}
⋯ 52 unchanged lines

⋯ 13 unchanged lines
14	14		#[unique]
15	15		pub username: String,
16	16		pub email: String,
17		-	/// Argon2 PHC-format password hash.
	17	+	/// Argon2 PHC-format password hash. Empty for an account that has only
	18	+	/// ever signed in through the identity provider — no password can hash to
	19	+	/// it, so [`crate::users::verify_password`] refuses every guess.
18	20		pub password_hash: String,
19	21		pub is_admin: bool,
20	22		/// Unix timestamp (seconds) of account creation.
21	23		pub created_at: i64,
	24	+	/// The OIDC `sub` claim this account is linked to, or empty if it isn't.
	25	+	/// Accounts are keyed on `sub` rather than email because `sub` is the one
	26	+	/// claim the provider promises never changes. New columns go last so
	27	+	/// `ALTER TABLE ADD COLUMN` on existing databases agrees with the
	28	+	/// fresh-schema column order.
	29	+	pub sso_sub: String,
22	30		}
23	31
24	32		/// A hosted repository, owned by a [`User`].
⋯ 188 unchanged lines
213	221		/// Normalized OpenSSH public-key line.
214	222		pub content: String,
215	223		pub created_at: i64,
216		-	}
217		-
218		-	/// A registered passkey (WebAuthn credential) used to sign in.
219		-	///
220		-	/// Only public material is here: the credential id, its public key, and the
221		-	/// counters the spec asks a relying party to track. The private key lives in
222		-	/// the authenticator and is never transmitted, so this table is not a
223		-	/// credential store in the way a password hash is — losing it costs users
224		-	/// their registrations, not their secrets. See [`crate::passkeys`].
225		-	#[derive(Clone, Debug, toasty::Model)]
226		-	pub struct Passkey {
227		-	#[key]
228		-	#[auto]
229		-	pub id: i64,
230		-	#[index]
231		-	pub user_id: i64,
232		-	/// User-supplied label, e.g. "MacBook Touch ID".
233		-	pub name: String,
234		-	/// Base64url credential id, as the authenticator reports it.
235		-	#[unique]
236		-	pub credential_id: String,
237		-	/// Base64 WebAuthn user handle: opaque, per account, shared by that
238		-	/// account's passkeys.
239		-	pub user_handle: String,
240		-	/// Base64 of the credential's immutable state (its public key).
241		-	pub static_state: String,
242		-	/// Base64 of the mutable state (signature counter, backup and
243		-	/// user-verification flags), rewritten after every sign-in.
244		-	pub dynamic_state: String,
245		-	/// Encoded transport hints (USB, NFC, internal, …) for re-prompting.
246		-	pub transports: i64,
247		-	pub created_at: i64,
248		-	/// Unix time of the last successful sign-in, or 0 if never used.
249		-	pub last_used_at: i64,
250	224		}
251	225
252	226		/// A per-repository secret, stored only as a sealed envelope.
⋯ 36 unchanged lines

1	-	//! Passkeys: WebAuthn sign-in, as an alternative to the account password.
2	-	//!
3	-	//! anvil is the relying party. A passkey's private half never leaves the
4	-	//! authenticator (Touch ID, Windows Hello, a security key, a phone); all we
5	-	//! store is the credential id and its public key, and all a login proves is a
6	-	//! signature over a challenge we issued. Nothing here can be replayed against
7	-	//! another site: the authenticator binds every signature to our RP id.
8	-	//!
9	-	//! The ceremony protocol runs in two round trips — begin hands the browser a
10	-	//! challenge, finish verifies what the authenticator signed — so the server
11	-	//! has to remember the challenge in between. [`Ceremonies`] holds those, in
12	-	//! memory, briefly. Verification itself lives in `anvil-web`, next to the JSON.
13	-	//!
14	-	//! Only passkeys (discoverable, user-verifying credentials) are supported, so
15	-	//! signing in needs no username: the authenticator tells us which credential it
16	-	//! used, and that identifies the account.
17	-
18	-	use webauthn_rp::{
19	-	DiscoverableAuthenticationServerState,
20	-	RegistrationServerState,
21	-	request::{
22	-	AsciiDomain,
23	-	RpId,
24	-	register::{
25	-	USER_HANDLE_MAX_LEN,
26	-	UserHandle64,
27	-	},
28	-	},
29	-	};
30	-
31	-	use crate::{
32	-	error::{
33	-	Error,
34	-	Result,
35	-	},
36	-	models::Passkey,
37	-	};
38	-
39	-	/// Length of the WebAuthn user handle, in bytes. The crate's maximum, and an
40	-	/// opaque random value — deliberately not the account id, since the handle is
41	-	/// visible to the authenticator and syncs to the user's password manager.
42	-	pub const USER_HANDLE_LEN: usize = USER_HANDLE_MAX_LEN;
43	-
44	-	/// How long a browser has to complete a ceremony before its challenge is
45	-	/// forgotten. Matches the five-minute timeout sent to the authenticator.
46	-	const CEREMONY_TTL_SECS: i64 = 300;
47	-
48	-	/// Cap on outstanding ceremonies, so an unauthenticated endpoint that mints
49	-	/// challenges cannot grow the map without bound.
50	-	const MAX_CEREMONIES: usize = 512;
51	-
52	-	/// The relying-party id for this deployment: the base URL's host.
53	-	///
54	-	/// WebAuthn scopes a credential to exactly this string, so it must be stable —
55	-	/// change the host and existing passkeys stop working (they are not lost, they
56	-	/// simply belong to a different site now).
57	-	pub fn rp_id(base_url: &str) -> Result<RpId> {
58	-	let host = base_url
59	-	.split_once("://")
60	-	.map_or(base_url, \|(_, rest)\| rest)
61	-	.split('/')
62	-	.next()
63	-	.unwrap_or_default()
64	-	.split(':')
65	-	.next()
66	-	.unwrap_or_default()
67	-	.to_ascii_lowercase();
68	-	if host.is_empty() {
69	-	return Err(Error::Config(format!(
70	-	"cannot derive a WebAuthn relying-party id from base_url `{base_url}`"
71	-	)));
72	-	}
73	-	AsciiDomain::try_from(host.clone())
74	-	.map(RpId::Domain)
75	-	.map_err(\|_\| {
76	-	Error::Config(format!(
77	-	"base_url host `{host}` is not a domain WebAuthn accepts"
78	-	))
79	-	})
80	-	}
81	-
82	-	/// The exact origin browsers must report, i.e. scheme + host + any explicit
83	-	/// port. Compared verbatim during verification, which is what stops a
84	-	/// look-alike site from replaying a ceremony.
85	-	pub fn origin(base_url: &str) -> String {
86	-	base_url.trim_end_matches('/').to_string()
87	-	}
88	-
89	-	/// A ceremony in flight, keyed by an opaque id the browser echoes back.
90	-	pub enum Ceremony {
91	-	/// Registering a new passkey for an already signed-in user.
92	-	Register {
93	-	state: Box<RegistrationServerState<USER_HANDLE_LEN>>,
94	-	user_id: i64,
95	-	},
96	-	/// Signing in with an existing passkey. No user is known yet — the
97	-	/// authenticator's response is what identifies the account.
98	-	Authenticate {
99	-	state: Box<DiscoverableAuthenticationServerState>,
100	-	},
101	-	}
102	-
103	-	/// Challenges issued but not yet completed.
104	-	///
105	-	/// In memory only, and deliberately so: a challenge is single-use and expires
106	-	/// in minutes, so persisting it would buy nothing but a table to clean up. A
107	-	/// restart invalidates ceremonies in flight, which costs a user one retry.
108	-	#[derive(Clone, Default)]
109	-	pub struct Ceremonies {
110	-	inner: std::sync::Arc<std::sync::Mutex<std::collections::HashMap<String, Pending>>>,
111	-	}
112	-
113	-	struct Pending {
114	-	ceremony: Ceremony,
115	-	expires_at: i64,
116	-	}
117	-
118	-	impl Ceremonies {
119	-	/// Store `ceremony` and return the id the browser must send back.
120	-	pub fn insert(&self, ceremony: Ceremony) -> String {
121	-	let id = random_id();
122	-	let mut map = self.inner.lock().expect("ceremony mutex");
123	-	let now = crate::now();
124	-	map.retain(\|_, pending\| pending.expires_at > now);
125	-	// Under flood, drop the oldest rather than refuse new sign-ins.
126	-	while map.len() >= MAX_CEREMONIES {
127	-	let oldest = map
128	-	.iter()
129	-	.min_by_key(\|(_, pending)\| pending.expires_at)
130	-	.map(\|(key, _)\| key.clone());
131	-	match oldest {
132	-	Some(key) => {
133	-	map.remove(&key);
134	-	}
135	-	None => break,
136	-	}
137	-	}
138	-	map.insert(
139	-	id.clone(),
140	-	Pending {
141	-	ceremony,
142	-	expires_at: now + CEREMONY_TTL_SECS,
143	-	},
144	-	);
145	-	id
146	-	}
147	-
148	-	/// Consume a ceremony. Single-use: a challenge answered twice is answered
149	-	/// once, which is what makes replaying a captured assertion useless.
150	-	pub fn take(&self, id: &str) -> Option<Ceremony> {
151	-	let mut map = self.inner.lock().expect("ceremony mutex");
152	-	let pending = map.remove(id)?;
153	-	(pending.expires_at > crate::now()).then_some(pending.ceremony)
154	-	}
155	-
156	-	/// Drop expired entries (called from the periodic sweep).
157	-	pub fn sweep(&self) {
158	-	let now = crate::now();
159	-	self.inner
160	-	.lock()
161	-	.expect("ceremony mutex")
162	-	.retain(\|_, pending\| pending.expires_at > now);
163	-	}
164	-	}
165	-
166	-	fn random_id() -> String {
167	-	use argon2::password_hash::rand_core::{
168	-	OsRng,
169	-	RngCore,
170	-	};
171	-	let mut bytes = [0u8; 32];
172	-	OsRng.fill_bytes(&mut bytes);
173	-	bytes.iter().map(\|b\| format!("{b:02x}")).collect()
174	-	}
175	-
176	-	/// Generate a fresh WebAuthn user handle.
177	-	pub fn new_user_handle() -> UserHandle64 {
178	-	UserHandle64::new()
179	-	}
180	-
181	-	// --- persistence -----------------------------------------------------------
182	-
183	-	/// List a user's passkeys, newest first.
184	-	pub async fn list(db: &toasty::Db, user_id: i64) -> Result<Vec<Passkey>> {
185	-	let mut conn = db.clone();
186	-	let mut keys = Passkey::filter(Passkey::fields().user_id().eq(user_id))
187	-	.exec(&mut conn)
188	-	.await?;
189	-	keys.sort_by_key(\|k\| std::cmp::Reverse(k.created_at));
190	-	Ok(keys)
191	-	}
192	-
193	-	/// Look a credential up by its id (base64url), as presented at sign-in.
194	-	pub async fn find_by_credential_id(
195	-	db: &toasty::Db,
196	-	credential_id: &str,
197	-	) -> Result<Option<Passkey>> {
198	-	let mut conn = db.clone();
199	-	Ok(
200	-	Passkey::filter(Passkey::fields().credential_id().eq(credential_id))
201	-	.first()
202	-	.exec(&mut conn)
203	-	.await?,
204	-	)
205	-	}
206	-
207	-	/// Record a newly registered passkey.
208	-	#[allow(clippy::too_many_arguments)]
209	-	pub async fn add(
210	-	db: &toasty::Db,
211	-	user_id: i64,
212	-	name: &str,
213	-	credential_id: &str,
214	-	user_handle: &str,
215	-	static_state: &str,
216	-	dynamic_state: &str,
217	-	transports: i64,
218	-	) -> Result<Passkey> {
219	-	if find_by_credential_id(db, credential_id).await?.is_some() {
220	-	return Err(Error::AlreadyExists("passkey".into()));
221	-	}
222	-	let now = crate::now();
223	-	let mut conn = db.clone();
224	-	Ok(toasty::create!(Passkey {
225	-	user_id: user_id,
226	-	name: display_name(name),
227	-	credential_id: credential_id,
228	-	user_handle: user_handle,
229	-	static_state: static_state,
230	-	dynamic_state: dynamic_state,
231	-	transports: transports,
232	-	created_at: now,
233	-	last_used_at: 0,
234	-	})
235	-	.exec(&mut conn)
236	-	.await?)
237	-	}
238	-
239	-	/// Persist the credential's post-authentication state (the signature counter
240	-	/// and flags) and stamp its last use.
241	-	pub async fn record_use(db: &toasty::Db, passkey: Passkey, dynamic_state: &str) -> Result<()> {
242	-	let mut conn = db.clone();
243	-	let mut passkey = passkey;
244	-	passkey
245	-	.update()
246	-	.dynamic_state(dynamic_state)
247	-	.last_used_at(crate::now())
248	-	.exec(&mut conn)
249	-	.await?;
250	-	Ok(())
251	-	}
252	-
253	-	/// Delete one of `user_id`'s passkeys. No-op if it is missing or someone
254	-	/// else's.
255	-	pub async fn delete(db: &toasty::Db, id: i64, user_id: i64) -> Result<()> {
256	-	let mut conn = db.clone();
257	-	if let Some(passkey) = Passkey::filter(Passkey::fields().id().eq(id))
258	-	.first()
259	-	.exec(&mut conn)
260	-	.await?
261	-	&& passkey.user_id == user_id
262	-	{
263	-	let mut conn = db.clone();
264	-	passkey.delete().exec(&mut conn).await?;
265	-	}
266	-	Ok(())
267	-	}
268	-
269	-	/// A user's stable WebAuthn handle, shared by all of their passkeys: reusing it
270	-	/// lets an authenticator recognize a second registration as the same account
271	-	/// rather than a second one.
272	-	pub async fn handle_for_user(db: &toasty::Db, user_id: i64) -> Result<Option<String>> {
273	-	Ok(list(db, user_id)
274	-	.await?
275	-	.into_iter()
276	-	.next()
277	-	.map(\|k\| k.user_handle))
278	-	}
279	-
280	-	/// Trim and bound a user-supplied label, falling back to something useful.
281	-	fn display_name(name: &str) -> String {
282	-	let name = name.trim();
283	-	if name.is_empty() {
284	-	"passkey".to_string()
285	-	} else {
286	-	name.chars().take(64).collect()
287	-	}
288	-	}
289	-
290	-	#[cfg(test)]
291	-	mod tests {
292	-	use super::*;
293	-
294	-	#[test]
295	-	fn derives_the_rp_id_from_the_base_url() {
296	-	let id = \|url: &str\| rp_id(url).map(\|id\| id.as_ref().to_string());
297	-	assert_eq!(id("https://anvil.localhost").unwrap(), "anvil.localhost");
298	-	assert_eq!(id("http://localhost:3000").unwrap(), "localhost");
299	-	assert_eq!(
300	-	id("https://anvil.richardscollin.com/").unwrap(),
301	-	"anvil.richardscollin.com"
302	-	);
303	-	// Case is normalized: browsers report the host lowercased.
304	-	assert_eq!(id("https://Anvil.LOCALHOST").unwrap(), "anvil.localhost");
305	-	assert!(id("").is_err());
306	-	}
307	-
308	-	#[test]
309	-	fn the_origin_keeps_scheme_and_port() {
310	-	assert_eq!(origin("http://localhost:3000/"), "http://localhost:3000");
311	-	assert_eq!(origin("https://anvil.localhost"), "https://anvil.localhost");
312	-	}
313	-
314	-	#[test]
315	-	fn ceremonies_are_single_use_and_expire() {
316	-	let ceremonies = Ceremonies::default();
317	-	let id = ceremonies.insert(Ceremony::Authenticate {
318	-	state: Box::new(fake_auth_state()),
319	-	});
320	-	assert!(ceremonies.take(&id).is_some());
321	-	assert!(
322	-	ceremonies.take(&id).is_none(),
323	-	"a challenge must not be answerable twice"
324	-	);
325	-	}
326	-
327	-	/// A real ceremony state, built the way the server builds one.
328	-	fn fake_auth_state() -> DiscoverableAuthenticationServerState {
329	-	let rp = rp_id("https://anvil.localhost").unwrap();
330	-	webauthn_rp::DiscoverableCredentialRequestOptions::passkey(&rp)
331	-	.start_ceremony()
332	-	.expect("default passkey options are valid")
333	-	.0
334	-	}
335	-
336	-	#[test]
337	-	fn labels_are_trimmed_and_defaulted() {
338	-	assert_eq!(display_name(" MacBook "), "MacBook");
339	-	assert_eq!(display_name(""), "passkey");
340	-	assert_eq!(display_name(&"x".repeat(100)).len(), 64);
341	-	}
342	-	}

⋯ 22 unchanged lines
23	23		};
24	24
25	25		/// A periodic task to be run on an interval.
	26	+	// `async_trait` marks the boxed future it desugars `run` to as `#[must_use]`,
	27	+	// and the `Result` inside it carries its own — which clippy reads as one
	28	+	// `must_use` too many. Neither is ours to remove, and the trait must stay
	29	+	// `dyn`-compatible (the runner holds `Box<dyn PeriodicJob>`), which a native
	30	+	// `async fn` in a trait is not.
	31	+	#[allow(clippy::double_must_use)]
26	32		#[async_trait]
27	33		pub trait PeriodicJob: Send + Sync {
28	34		/// Run the job once. Errors are logged but do not stop the runner.
⋯ 150 unchanged lines
179	185
180	186		fn name(&self) -> &str {
181	187		"secret_vault_sweep"
182		-	}
183		-	}
184		-
185		-	/// Job that drops WebAuthn challenges nobody answered.
186		-	pub struct PasskeyCeremonySweepJob;
187		-
188		-	#[async_trait::async_trait]
189		-	impl PeriodicJob for PasskeyCeremonySweepJob {
190		-	async fn run(&self, app: &App) -> Result<()> {
191		-	app.ceremonies.sweep();
192		-	Ok(())
193		-	}
194		-
195		-	fn name(&self) -> &str {
196		-	"passkey_ceremony_sweep"
197	188		}
198	189		}
199	190
⋯ 24 unchanged lines

⋯ 47 unchanged lines
48	48		}
49	49
50	50		/// Verify a plaintext password against a stored PHC hash.
	51	+	///
	52	+	/// An empty hash is not a parse failure to report but an account with no
	53	+	/// password at all (one provisioned through single sign-on): every guess is
	54	+	/// simply wrong.
51	55		pub fn verify_password(hash: &str, password: &str) -> Result<bool> {
	56	+	if hash.is_empty() {
	57	+	return Ok(false);
	58	+	}
52	59		let parsed = PasswordHash::new(hash).map_err(\|e\| Error::Password(e.to_string()))?;
53	60		Ok(Argon2::default()
54	61		.verify_password(password.as_bytes(), &parsed)
⋯ 10 unchanged lines
65	72		password: &str,
66	73		is_admin: bool,
67	74		) -> Result<User> {
	75	+	insert(db, username, email, hash_password(password)?, is_admin, "").await
	76	+	}
	77	+
	78	+	/// Reject a username that cannot safely be one.
	79	+	///
	80	+	/// Usernames live in the URL root namespace (e.g. `/<username>`) and on disk
	81	+	/// under `repositories/<username>/`, so path-unsafe characters are out, as are
	82	+	/// names reserved for system routes (the `/-/…` prefix is reserved
	83	+	/// structurally, but we keep a denylist as defense-in-depth).
	84	+	fn validate_username(username: &str) -> Result<()> {
68	85		if username.trim().is_empty() {
69	86		return Err(Error::Invalid("username must not be empty".into()));
70	87		}
71		-	// Usernames live in the URL root namespace (e.g. `/<username>`) and on disk
72		-	// under `repositories/<username>/`. Reject path-unsafe characters and names
73		-	// reserved for system routes (the `/-/…` prefix is reserved structurally,
74		-	// but we keep a denylist as defense-in-depth).
75	88		if username.contains('/') \|\| username.contains('\\') \|\| username.contains("..") {
76	89		return Err(Error::Invalid(format!("invalid username: {username:?}")));
77	90		}
78	91		if RESERVED_USERNAMES.contains(&username.to_ascii_lowercase().as_str()) {
79	92		return Err(Error::Invalid(format!("username '{username}' is reserved")));
80	93		}
	94	+	Ok(())
	95	+	}
	96	+
	97	+	/// Insert a user row from an already-hashed password. The one place a `User`
	98	+	/// is created, so every path shares the name checks.
	99	+	async fn insert(
	100	+	db: &toasty::Db,
	101	+	username: &str,
	102	+	email: &str,
	103	+	password_hash: String,
	104	+	is_admin: bool,
	105	+	sso_sub: &str,
	106	+	) -> Result<User> {
	107	+	validate_username(username)?;
81	108		if find_by_username(db, username).await?.is_some() {
82	109		return Err(Error::AlreadyExists(format!("user {username}")));
83	110		}
⋯ 2 unchanged lines
86	113		let user = toasty::create!(User {
87	114		username: username,
88	115		email: email,
89		-	password_hash: hash_password(password)?,
	116	+	password_hash: password_hash,
90	117		is_admin: is_admin,
91	118		created_at: crate::now(),
	119	+	sso_sub: sso_sub,
92	120		})
93	121		.exec(&mut db)
94	122		.await?;
⋯ 42 unchanged lines
137	165		Ok(user)
138	166		}
139	167
	168	+	/// Look up a user by exact email. Empty matches nothing: plenty of accounts
	169	+	/// have no address, and they are not all the same person.
	170	+	pub async fn find_by_email(db: &toasty::Db, email: &str) -> Result<Option<User>> {
	171	+	if email.is_empty() {
	172	+	return Ok(None);
	173	+	}
	174	+	let mut db = db.clone();
	175	+	let user = User::filter(User::fields().email().eq(email))
	176	+	.first()
	177	+	.exec(&mut db)
	178	+	.await?;
	179	+	Ok(user)
	180	+	}
	181	+
	182	+	/// Look up the account linked to an OIDC `sub`.
	183	+	pub async fn find_by_sso_sub(db: &toasty::Db, sub: &str) -> Result<Option<User>> {
	184	+	if sub.is_empty() {
	185	+	return Ok(None);
	186	+	}
	187	+	let mut db = db.clone();
	188	+	let user = User::filter(User::fields().sso_sub().eq(sub))
	189	+	.first()
	190	+	.exec(&mut db)
	191	+	.await?;
	192	+	Ok(user)
	193	+	}
	194	+
	195	+	/// Link an existing account to an OIDC `sub`, so later sign-ins find it by
	196	+	/// subject rather than by address.
	197	+	///
	198	+	/// Refuses an account already linked to a different subject: that is either
	199	+	/// a provider reissuing subjects or two identities converging on one row, and
	200	+	/// silently repointing it would hand one person another's account.
	201	+	pub async fn link_sso_sub(db: &toasty::Db, user_id: i64, sub: &str) -> Result<User> {
	202	+	let Some(mut user) = find_by_id(db, user_id).await? else {
	203	+	return Err(Error::NotFound(format!("user id {user_id}")));
	204	+	};
	205	+	if user.sso_sub == sub {
	206	+	return Ok(user);
	207	+	}
	208	+	if !user.sso_sub.is_empty() {
	209	+	return Err(Error::Invalid(format!(
	210	+	"{} is already linked to a different sign-in identity",
	211	+	user.username
	212	+	)));
	213	+	}
	214	+	let mut conn = db.clone();
	215	+	user.update().sso_sub(sub).exec(&mut conn).await?;
	216	+	Ok(user)
	217	+	}
	218	+
	219	+	/// Copy the claims the provider owns onto a linked account: the address it
	220	+	/// vouches for, and whether this app considers them an admin.
	221	+	///
	222	+	/// The email is skipped when another account already holds it — the provider
	223	+	/// is authoritative about identity, not about which local row gets the string.
	224	+	/// `is_admin` is `None` when the provider asserted no role, which leaves the
	225	+	/// local flag alone rather than quietly demoting an admin.
	226	+	pub async fn sync_from_sso(
	227	+	db: &toasty::Db,
	228	+	user_id: i64,
	229	+	email: &str,
	230	+	is_admin: Option<bool>,
	231	+	) -> Result<User> {
	232	+	let Some(mut user) = find_by_id(db, user_id).await? else {
	233	+	return Err(Error::NotFound(format!("user id {user_id}")));
	234	+	};
	235	+	let taken = match find_by_email(db, email).await? {
	236	+	Some(other) => other.id != user.id,
	237	+	None => false,
	238	+	};
	239	+	let email = if email.is_empty() \|\| taken {
	240	+	user.email.clone()
	241	+	} else {
	242	+	email.to_string()
	243	+	};
	244	+	let is_admin = is_admin.unwrap_or(user.is_admin);
	245	+	if user.email == email && user.is_admin == is_admin {
	246	+	return Ok(user);
	247	+	}
	248	+	let mut conn = db.clone();
	249	+	user.update()
	250	+	.email(email)
	251	+	.is_admin(is_admin)
	252	+	.exec(&mut conn)
	253	+	.await?;
	254	+	Ok(user)
	255	+	}
	256	+
	257	+	/// Create an account for an identity the provider vouches for. It has no
	258	+	/// password: `password_hash` is empty, which
	259	+	/// [`verify_password`] refuses unconditionally, so the only way in is the
	260	+	/// provider (or an admin setting a password later).
	261	+	pub async fn create_from_sso(
	262	+	db: &toasty::Db,
	263	+	preferred_username: &str,
	264	+	email: &str,
	265	+	is_admin: bool,
	266	+	sub: &str,
	267	+	) -> Result<User> {
	268	+	let username = allocate_username(db, preferred_username, email).await?;
	269	+	insert(db, &username, email, String::new(), is_admin, sub).await
	270	+	}
	271	+
	272	+	/// Pick a free, path-safe username from what the provider suggested.
	273	+	///
	274	+	/// The provider's `preferred_username` is a display preference, not a
	275	+	/// namespace reservation: it can collide, be reserved, or contain characters a
	276	+	/// URL path cannot. Sanitize it, fall back to the email's local part, then
	277	+	/// append `-2`, `-3`, … until one is free.
	278	+	async fn allocate_username(db: &toasty::Db, preferred: &str, email: &str) -> Result<String> {
	279	+	let sanitize = \|raw: &str\| -> String {
	280	+	raw.trim()
	281	+	.to_ascii_lowercase()
	282	+	.chars()
	283	+	.map(\|c\| match c {
	284	+	'a'..='z' \| '0'..='9' \| '-' \| '_' => c,
	285	+	_ => '-',
	286	+	})
	287	+	.collect::<String>()
	288	+	.trim_matches('-')
	289	+	.to_string()
	290	+	};
	291	+
	292	+	let base = [preferred, email.split('@').next().unwrap_or_default()]
	293	+	.into_iter()
	294	+	.map(sanitize)
	295	+	.find(\|s\| !s.is_empty() && validate_username(s).is_ok())
	296	+	.unwrap_or_else(\|\| "user".to_string());
	297	+
	298	+	for suffix in 1..1000 {
	299	+	let candidate = if suffix == 1 {
	300	+	base.clone()
	301	+	} else {
	302	+	format!("{base}-{suffix}")
	303	+	};
	304	+	if validate_username(&candidate).is_ok()
	305	+	&& find_by_username(db, &candidate).await?.is_none()
	306	+	{
	307	+	return Ok(candidate);
	308	+	}
	309	+	}
	310	+	Err(Error::AlreadyExists(format!(
	311	+	"no free username near {base}"
	312	+	)))
	313	+	}
	314	+
140	315		#[cfg(test)]
141	316		mod tests {
142	317		use super::*;
⋯ 32 unchanged lines

⋯ 9 unchanged lines
10	10		[dependencies]
11	11		anvil-core.workspace = true
12	12		anvil-git.workspace = true
13		-	webauthn_rp.workspace = true
14	13		axum.workspace = true
15	14		axum-extra.workspace = true
16	15		tokio.workspace = true
⋯ 3 unchanged lines
20	19		serde.workspace = true
21	20		serde_json.workspace = true
22	21		base64.workspace = true
	22	+	reqwest.workspace = true
	23	+	ring.workspace = true
	24	+	rustls.workspace = true
23	25		lru.workspace = true
24	26		maud.workspace = true
25	27		pulldown-cmark.workspace = true
⋯ 8 unchanged lines
34	36		ssh-key = { workspace = true, features = ["ed25519"] }
35	37		tokio = { workspace = true }
36	38		tower = { workspace = true, features = ["util"] }
37		-	# A software authenticator for the passkey tests: CBOR for attestation
38		-	# objects and COSE keys, P-256 for the signatures a security key would make.
39		-	ciborium = "0.2"
40		-	p256 = "0.13"
41		-	sha2.workspace = true
	39	+	# The stand-in identity provider in tests/oidc_flow.rs generates a key and
	40	+	# signs its own id tokens. ring, which verifies them on anvil's side, can only
	41	+	# verify with an RSA key, not make one.
	42	+	rsa = "0.9"
	43	+	# `oid` for the DigestInfo prefix PKCS#1 v1.5 (and so RS256) signs over.
	44	+	sha2 = { workspace = true, features = ["oid"] }

⋯ 165 unchanged lines
166	166		"argon2 0.5.3",
167	167		"async-trait",
168	168		"base64",
169		-	"curve25519-dalek 5.0.0-rc.0",
	169	+	"curve25519-dalek",
170	170		"gix",
171	171		"hmac 0.12.1",
172	172		"pulldown-cmark",
⋯ 9 unchanged lines
182	182		"tokio",
183	183		"toml",
184	184		"tracing",
185		-	"webauthn_rp",
186	185		]
187	186
188	187		[[package]]
⋯ 34 unchanged lines
223	222		"axum",
224	223		"axum-extra",
225	224		"base64",
226		-	"ciborium",
227	225		"lru",
228	226		"maud",
229		-	"p256 0.13.2",
230	227		"pulldown-cmark",
	228	+	"reqwest",
	229	+	"ring",
	230	+	"rsa 0.9.10",
	231	+	"rustls",
231	232		"serde",
232	233		"serde_json",
233	234		"sha2 0.10.9",
⋯ 7 unchanged lines
241	242		"tower",
242	243		"tower-http",
243	244		"tracing",
244		-	"webauthn_rp",
245	245		]
246	246

1	+	//! Single sign-on against an OpenID Connect provider (authorization code flow
2	+	//! with PKCE) — see `docs/oidc.md`.
3	+	//!
4	+	//! Off unless `[oidc] issuer` is configured, so an unconfigured instance
5	+	//! behaves exactly as it did before: local passwords only. When it is on it is
6	+	//! additional rather than a replacement — existing accounts keep their
7	+	//! passwords, and the two are reconciled on the `sub` claim, which the provider
8	+	//! promises never changes, rather than on email, which does.
9	+	//!
10	+	//! Three routes make up the hand-off:
11	+	//!
12	+	//! \| \| \|
13	+	//! \|---\|---\|
14	+	//! \| `GET /-/oidc/login?next=/path` \| start the flow; stash state/nonce/PKCE in a ten-minute cookie \|
15	+	//! \| `GET /-/oidc/callback` \| exchange the code, provision or link the account, set the session \|
16	+	//! \| `POST /-/logout` \| (in [`crate::auth`]) end the provider's session too, when asked to \|
17	+	//!
18	+	//! Everything the provider hands back is verified here: the `state` against the
19	+	//! cookie, the id token's signature against the published JWKS, and its `iss`,
20	+	//! `aud`, `exp` and `nonce` against what we asked for.
21	+
22	+	use std::{
23	+	collections::HashMap,
24	+	sync::{
25	+	Mutex,
26	+	OnceLock,
27	+	},
28	+	};
29	+
30	+	use anvil_core::{
31	+	App,
32	+	User,
33	+	config::{
34	+	OIDC_CALLBACK_PATH,
35	+	OidcConfig,
36	+	},
37	+	sessions,
38	+	users,
39	+	};
40	+	use axum::{

1	-	//! Passkey sign-in: the two WebAuthn ceremonies, plus the browser glue.
2	-	//!
3	-	//! Registration (signed in) and authentication (signed out) each run as
4	-	//! begin → finish. Begin mints a challenge, stashes the server half in
5	-	//! [`anvil_core::passkeys::Ceremonies`], and returns the client half as JSON.
6	-	//! Finish takes what `navigator.credentials` produced, verifies it against the
7	-	//! stashed challenge, and either stores a credential or starts a session.
8	-	//!
9	-	//! Sign-in is usernameless: passkeys are discoverable credentials, so the
10	-	//! authenticator hands back the credential id it used and we look the account
11	-	//! up from that.
12	-
13	-	use anvil_core::{
14	-	App,
15	-	User,
16	-	passkeys::{
17	-	self,
18	-	Ceremony,
19	-	},
20	-	sessions,
21	-	users,
22	-	};
23	-	use axum::{
24	-	Json,
25	-	Router,
26	-	extract::{
27	-	Path,
28	-	State,
29	-	},
30	-	http::{
31	-	HeaderMap,
32	-	StatusCode,
33	-	},
34	-	response::{
35	-	IntoResponse,
36	-	Redirect,
37	-	Response,
38	-	},
39	-	routing::post,
40	-	};

⋯ 678 unchanged lines
679	679		Err(e) => return server_error(e),
680	680		};
681	681		let tokens = api_tokens::list(&app.db, user.id).await.unwrap_or_default();
682		-	let passkeys = anvil_core::passkeys::list(&app.db, user.id)
683		-	.await
684		-	.unwrap_or_default();
685		-	account_page(&user, &keys, &tokens, &passkeys, None, None, &csrf.0).into_response()
	682	+	account_page(&user, &keys, &tokens, None, None, &csrf.0).into_response()
686	683		}
687	684
688	685		/// `POST /settings/keys` — register an SSH public key for the current user.
⋯ 24 unchanged lines
713	710		.await
714	711		.unwrap_or_default();
715	712		let tokens = api_tokens::list(&app.db, user.id).await.unwrap_or_default();
716		-	let passkeys = anvil_core::passkeys::list(&app.db, user.id)
717		-	.await
718		-	.unwrap_or_default();
719	713		(
720	714		StatusCode::BAD_REQUEST,
721		-	account_page(
722		-	&user,
723		-	&keys,
724		-	&tokens,
725		-	&passkeys,
726		-	None,
727		-	Some(&e.to_string()),
728		-	&csrf.0,
729		-	),
	715	+	account_page(&user, &keys, &tokens, None, Some(&e.to_string()), &csrf.0),
730	716		)
731	717		.into_response()
732	718		}
⋯ 34 unchanged lines
767	753		.await
768	754		.unwrap_or_default();
769	755		let tokens = api_tokens::list(&app.db, user.id).await.unwrap_or_default();
770		-	let passkeys = anvil_core::passkeys::list(&app.db, user.id)
771		-	.await

⋯ 148 unchanged lines
149	149		}
150	150
151	151		/// Length-independent constant-time byte comparison.
152		-	fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
	152	+	pub(crate) fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
153	153		if a.len() != b.len() {
154	154		return false;
155	155		}
⋯ 18 unchanged lines
174	174		pub csrf: String,
175	175		}
176	176
	177	+	/// Query on `GET /login`: where to go once signed in, carried through to the
	178	+	/// identity provider so an interrupted request resumes.
	179	+	#[derive(serde::Deserialize)]
	180	+	pub struct LoginQuery {
	181	+	#[serde(default)]
	182	+	next: Option<String>,
	183	+	}
	184	+
177	185		/// `GET /login` — show the login form (or bounce home if already signed in).
178		-	pub async fn login_form(CurrentUser(user): CurrentUser) -> Response {
	186	+	pub async fn login_form(
	187	+	State(app): State<App>,
	188	+	CurrentUser(user): CurrentUser,
	189	+	axum::extract::Query(query): axum::extract::Query<LoginQuery>,
	190	+	) -> Response {
179	191		if user.is_some() {
180	192		return Redirect::to("/").into_response();
181	193		}
182		-	login_page(None).into_response()
	194	+	login_page(&app, query.next.as_deref(), None).into_response()
183	195		}
184	196
185	197		/// `POST /login` — verify credentials, create a session, set the cookie.
⋯ 12 unchanged lines
198	210		let Some(user) = ok else {
199	211		return (
200	212		axum::http::StatusCode::UNAUTHORIZED,
201		-	login_page(Some("Invalid username or password.")),
	213	+	login_page(&app, None, Some("Invalid username or password.")),
202	214		)
203	215		.into_response();
204	216		};
⋯ 8 unchanged lines
213	225		tracing::error!("session create failed: {e}");
214	226		(
215	227		axum::http::StatusCode::INTERNAL_SERVER_ERROR,
216		-	login_page(Some("Could not start a session.")),
	228	+	login_page(&app, None, Some("Could not start a session.")),
217	229		)
218	230		.into_response()
219	231		}
⋯ 5 unchanged lines
225	237		/// from cross-site POSTs (so a forced logout can't identify the session), and
226	238		/// the impact of a forced logout is trivial. The high-value mutating forms
227	239		/// (SSH keys, repo creation/visibility) do carry tokens via [`verify_csrf`].
228		-	pub async fn logout(State(app): State<App>, jar: CookieJar) -> Response {
	240	+	pub async fn logout(
	241	+	State(app): State<App>,
	242	+	CurrentUser(user): CurrentUser,
	243	+	jar: CookieJar,
	244	+	) -> Response {
229	245		if let Some(cookie) = jar.get(SESSION_COOKIE) {
230	246		let _ = sessions::delete(&app.db, cookie.value()).await;
231	247		}
232		-	(jar.remove(Cookie::from(SESSION_COOKIE)), Redirect::to("/")).into_response()
	248	+	// For an account that came from the identity provider, ending only anvil's
	249	+	// session would leave the provider ready to sign them straight back in.
	250	+	let destination = crate::oidc::end_session_url(&app, user.as_ref())
	251	+	.await
	252	+	.unwrap_or_else(\|\| "/".to_string());
	253	+	(
	254	+	jar.remove(Cookie::from(SESSION_COOKIE)),
	255	+	Redirect::to(&destination),
	256	+	)
	257	+	.into_response()
233	258		}
234	259
235		-	fn login_page(error: Option<&str>) -> Markup {
	260	+	fn login_page(app: &App, next: Option<&str>, error: Option<&str>) -> Markup {
236	261		layout(
237	262		"Sign in",
238	263		None,
⋯ 2 unchanged lines
241	266		@if let Some(error) = error {
242	267		p.error-msg { (error) }
243	268		}
	269	+	(crate::oidc::sign_in_button(&app.config.oidc, next))
244	270		form method="post" action="/-/login" style="max-width:320px" {
245	271		p { label { "Username" br; input name="username" autofocus; } }
246	272		p { label { "Password" br; input name="password" type="password"; } }
247	273		button type="submit" { "Sign in" }
248	274		}
249		-	(crate::passkeys::shared_script())
250		-	(crate::passkeys::login_button())
251	275		},
252	276		)
253	277		}
⋯ 30 unchanged lines

⋯ 24 unchanged lines
25	25		pub mod attachments;
26	26		pub mod auth;
27	27		pub mod git_http;
	28	+	pub mod oidc;
28	29		pub mod pages;
29		-	pub mod passkeys;
30	30		pub mod secrets;
31	31		pub mod todomd;
32	32		pub mod ui;
⋯ 12 unchanged lines
45	45		router,
46	46		app.config.http.attachment_max_mb.saturating_mul(1 << 20),
47	47		); // uploaded image attachments
48		-	router = passkeys::routes(router); // WebAuthn sign-in
	48	+	router = oidc::routes(router); // single sign-on, when configured
49	49		router = secrets::routes(router); // sealed per-repo secrets + unlock API
50	50		router = git_http::routes(router); // smart-HTTP git endpoints
51	51		router
⋯ 23 unchanged lines

1	-	//! End-to-end passkey ceremonies, driven by a software authenticator.
2	-	//!
3	-	//! A real passkey needs hardware and a human fingerprint, which no test can
4	-	//! supply — so this file is the authenticator: it holds a P-256 key, builds
5	-	//! the `authenticatorData` and `clientDataJSON` the spec describes, and signs
6	-	//! exactly what a security key would. Everything on the other side of the wire
7	-	//! is the real thing: the actual router, the actual handlers, the actual
8	-	//! verification.
9	-	//!
10	-	//! That makes it a genuine test of the flow — register a credential, then sign
11	-	//! in with it and get a session — plus the failures that matter: a forged
12	-	//! signature, a replayed challenge, someone else's credential.
13	-
14	-	use anvil_core::{
15	-	App,
16	-	Config,
17	-	sessions,
18	-	users,
19	-	};
20	-	use axum::{
21	-	Router,
22	-	body::Body,
23	-	http::{
24	-	Request,
25	-	StatusCode,
26	-	header,
27	-	},
28	-	};
29	-	use base64::Engine;
30	-	use p256::ecdsa::{
31	-	Signature,
32	-	SigningKey,
33	-	signature::Signer,
34	-	};
35	-	use sha2::{
36	-	Digest,
37	-	Sha256,
38	-	};
39	-	use tower::ServiceExt;
40	-
41	-	const ORIGIN: &str = "https://anvil.localhost";
42	-	const RP_ID: &str = "anvil.localhost";
43	-
44	-	// --- the authenticator -----------------------------------------------------
45	-
46	-	/// A software stand-in for a security key: one credential, one P-256 key.
47	-	struct Authenticator {
48	-	key: SigningKey,
49	-	credential_id: Vec<u8>,
50	-	sign_count: u32,
51	-	}
52	-
53	-	impl Authenticator {
54	-	fn new() -> Self {
55	-	let mut seed = [0u8; 32];
56	-	getrandom(&mut seed);
57	-	let mut credential_id = vec![0u8; 32];
58	-	getrandom(&mut credential_id);
59	-	Self {
60	-	key: SigningKey::from_bytes(&seed.into()).expect("random scalar is a valid key"),
61	-	credential_id,
62	-	sign_count: 0,
63	-	}
64	-	}
65	-
66	-	/// `navigator.credentials.create()`: a `none`-attestation registration
67	-	/// response carrying the new credential's public key.
68	-	fn register(&self, challenge: &str) -> serde_json::Value {
69	-	let client_data = client_data("webauthn.create", challenge);
70	-	let auth_data = self.auth_data(true);
71	-	let attestation = cbor_map(vec![
72	-	(
73	-	ciborium::Value::Text("fmt".into()),
74	-	ciborium::Value::Text("none".into()),
75	-	),
76	-	(
77	-	ciborium::Value::Text("attStmt".into()),
78	-	ciborium::Value::Map(vec![]),
79	-	),
80	-	(
81	-	ciborium::Value::Text("authData".into()),
82	-	ciborium::Value::Bytes(auth_data),
83	-	),
84	-	]);
85	-	serde_json::json!({
86	-	"id": b64url(&self.credential_id),
87	-	"rawId": b64url(&self.credential_id),
88	-	"type": "public-key",
89	-	"clientExtensionResults": {},
90	-	"response": {
91	-	"clientDataJSON": b64url(client_data.as_bytes()),
92	-	"attestationObject": b64url(&attestation),
93	-	"transports": ["internal"],
94	-	},
95	-	})
96	-	}
97	-
98	-	/// `navigator.credentials.get()`: an assertion over this challenge.
99	-	fn assert(&mut self, challenge: &str, user_handle: &[u8]) -> serde_json::Value {
100	-	self.sign_count += 1;
101	-	let client_data = client_data("webauthn.get", challenge);
102	-	let auth_data = self.auth_data(false);
103	-
104	-	// What the authenticator actually signs: its own data, then the hash
105	-	// of what the browser told it about this request.
106	-	let mut signed = auth_data.clone();
107	-	signed.extend_from_slice(&Sha256::digest(client_data.as_bytes()));
108	-	let signature: Signature = self.key.sign(&signed);
109	-
110	-	serde_json::json!({
111	-	"id": b64url(&self.credential_id),
112	-	"rawId": b64url(&self.credential_id),
113	-	"type": "public-key",
114	-	"clientExtensionResults": {},
115	-	"response": {
116	-	"clientDataJSON": b64url(client_data.as_bytes()),
117	-	"authenticatorData": b64url(&auth_data),
118	-	"signature": b64url(signature.to_der().as_bytes()),
119	-	"userHandle": b64url(user_handle),
120	-	},
121	-	})
122	-	}
123	-
124	-	/// `authenticatorData`: rpIdHash ‖ flags ‖ signCount, plus the attested
125	-	/// credential (and the credProtect extension anvil asks for) at
126	-	/// registration time.
127	-	fn auth_data(&self, registering: bool) -> Vec<u8> {
128	-	// UP (touched) \| UV (verified) — anvil requires both.
129	-	let mut flags = 0x01 \| 0x04;
130	-	if registering {
131	-	flags \|= 0x40; // AT: attested credential data present
132	-	flags \|= 0x80; // ED: extension data present
133	-	}
134	-	let mut data = Sha256::digest(RP_ID.as_bytes()).to_vec();
135	-	data.push(flags);
136	-	data.extend_from_slice(&self.sign_count.to_be_bytes());
137	-	if registering {
138	-	data.extend_from_slice(&[0u8; 16]); // AAGUID: zeroes, as privacy-preserving authenticators report
139	-	data.extend_from_slice(&(self.credential_id.len() as u16).to_be_bytes());
140	-	data.extend_from_slice(&self.credential_id);
141	-	data.extend_from_slice(&self.cose_key());
142	-	data.extend_from_slice(&cbor_map(vec![(
143	-	ciborium::Value::Text("credProtect".into()),
144	-	ciborium::Value::Integer(3.into()), // userVerificationRequired
145	-	)]));
146	-	}
147	-	data
148	-	}
149	-
150	-	/// The public key as a COSE_Key: EC2 / P-256 / ES256.
151	-	fn cose_key(&self) -> Vec<u8> {
152	-	let point = self.key.verifying_key().to_encoded_point(false);
153	-	cbor_map(vec![
154	-	(
155	-	ciborium::Value::Integer(1.into()), // kty
156	-	ciborium::Value::Integer(2.into()), // EC2
157	-	),
158	-	(
159	-	ciborium::Value::Integer(3.into()), // alg
160	-	ciborium::Value::Integer((-7).into()), // ES256
161	-	),
162	-	(
163	-	ciborium::Value::Integer((-1).into()), // crv
164	-	ciborium::Value::Integer(1.into()), // P-256
165	-	),
166	-	(
167	-	ciborium::Value::Integer((-2).into()),
168	-	ciborium::Value::Bytes(point.x().expect("uncompressed point has x").to_vec()),
169	-	),
170	-	(
171	-	ciborium::Value::Integer((-3).into()),
172	-	ciborium::Value::Bytes(point.y().expect("uncompressed point has y").to_vec()),
173	-	),
174	-	])
175	-	}
176	-	}
177	-
178	-	fn client_data(ceremony: &str, challenge: &str) -> String {
179	-	serde_json::json!({
180	-	"type": ceremony,
181	-	"challenge": challenge,
182	-	"origin": ORIGIN,
183	-	"crossOrigin": false,
184	-	})
185	-	.to_string()
186	-	}
187	-
188	-	fn cbor_map(entries: Vec<(ciborium::Value, ciborium::Value)>) -> Vec<u8> {
189	-	let mut out = Vec::new();
190	-	ciborium::into_writer(&ciborium::Value::Map(entries), &mut out).expect("CBOR encoding");
191	-	out
192	-	}
193	-
194	-	fn b64url(bytes: &[u8]) -> String {
195	-	base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bytes)
196	-	}
197	-
198	-	fn getrandom(buf: &mut [u8]) {
199	-	use argon2::password_hash::rand_core::{
200	-	OsRng,
201	-	RngCore,
202	-	};
203	-	OsRng.fill_bytes(buf);
204	-	}
205	-
206	-	// --- harness ---------------------------------------------------------------
207	-
208	-	struct Harness {
209	-	router: Router,
210	-	app: App,
211	-	cookie: String,
212	-	csrf: String,
213	-	user_id: i64,
214	-	_dir: tempfile::TempDir,
215	-	}
216	-
217	-	async fn harness() -> Harness {
218	-	let dir = tempfile::tempdir().unwrap();
219	-	let mut config = Config::default();
220	-	config.data_dir = dir.path().to_path_buf();
221	-	config.http.base_url = ORIGIN.to_string();
222	-	let app = App::bootstrap(config).await.unwrap();
223	-	let user = users::create(&app.db, "collin", "", "password", true)
224	-	.await
225	-	.unwrap();
226	-	let session = sessions::create(&app.db, user.id).await.unwrap();
227	-	let csrf = app.csrf_token(&session.token);
228	-	Harness {
229	-	router: anvil_web::router(app.clone()),
230	-	app,
231	-	cookie: format!("anvil_session={}", session.token),
232	-	csrf,
233	-	user_id: user.id,
234	-	_dir: dir,
235	-	}
236	-	}
237	-
238	-	impl Harness {
239	-	/// POST JSON as the signed-in user (cookie + CSRF header).
240	-	async fn post_json(&self, path: &str, body: serde_json::Value) -> (StatusCode, String) {
241	-	self.send(
242	-	Request::post(path)
243	-	.header(header::COOKIE, &self.cookie)
244	-	.header("X-CSRF-Token", &self.csrf)
245	-	.header(header::CONTENT_TYPE, "application/json")
246	-	.body(Body::from(body.to_string()))
247	-	.unwrap(),
248	-	)
249	-	.await
250	-	}
251	-
252	-	/// POST JSON with no session at all, the way the login page does.
253	-	async fn post_anonymous(&self, path: &str, body: serde_json::Value) -> (StatusCode, String) {
254	-	self.send(
255	-	Request::post(path)
256	-	.header(header::CONTENT_TYPE, "application/json")
257	-	.body(Body::from(body.to_string()))
258	-	.unwrap(),
259	-	)
260	-	.await
261	-	}
262	-
263	-	async fn send(&self, request: Request<Body>) -> (StatusCode, String) {
264	-	let response = self.router.clone().oneshot(request).await.unwrap();
265	-	let status = response.status();
266	-	let body = axum::body::to_bytes(response.into_body(), 1 << 20)
267	-	.await
268	-	.unwrap();
269	-	(status, String::from_utf8_lossy(&body).into_owned())
270	-	}
271	-
272	-	/// The login ceremony, returning the raw response so cookies can be read.
273	-	async fn login(&self, body: serde_json::Value) -> axum::response::Response {
274	-	self.router
275	-	.clone()
276	-	.oneshot(
277	-	Request::post("/-/login/passkey/finish")
278	-	.header(header::CONTENT_TYPE, "application/json")
279	-	.body(Body::from(body.to_string()))
280	-	.unwrap(),
281	-	)
282	-	.await
283	-	.unwrap()
284	-	}
285	-
286	-	/// Begin registration, returning (ceremony id, handle, challenge).
287	-	async fn begin_registration(&self) -> (String, String, String) {
288	-	let (status, body) = self
289	-	.post_json("/-/settings/passkeys/begin", serde_json::json!({}))
290	-	.await;
291	-	assert_eq!(status, StatusCode::OK, "begin failed: {body}");
292	-	let json: serde_json::Value = serde_json::from_str(&body).unwrap();
293	-	(
294	-	json["ceremony"].as_str().unwrap().to_string(),
295	-	json["handle"].as_str().unwrap().to_string(),
296	-	json["options"]["challenge"].as_str().unwrap().to_string(),
297	-	)
298	-	}
299	-
300	-	/// Begin sign-in, returning (ceremony id, challenge).
301	-	async fn begin_login(&self) -> (String, String) {
302	-	let (status, body) = self
303	-	.post_anonymous("/-/login/passkey/begin", serde_json::json!({}))
304	-	.await;
305	-	assert_eq!(status, StatusCode::OK, "begin failed: {body}");
306	-	let json: serde_json::Value = serde_json::from_str(&body).unwrap();
307	-	(
308	-	json["ceremony"].as_str().unwrap().to_string(),
309	-	json["options"]["challenge"].as_str().unwrap().to_string(),
310	-	)
311	-	}
312	-
313	-	/// Register `authenticator` and return the account's WebAuthn handle.
314	-	async fn register(&self, authenticator: &Authenticator, name: &str) -> Vec<u8> {
315	-	let (ceremony, handle, challenge) = self.begin_registration().await;
316	-	let (status, body) = self
317	-	.post_json(
318	-	"/-/settings/passkeys/finish",
319	-	serde_json::json!({
320	-	"ceremony": ceremony,
321	-	"handle": handle,
322	-	"name": name,
323	-	"credential": authenticator.register(&challenge),
324	-	}),
325	-	)
326	-	.await;
327	-	assert_eq!(
328	-	status,
329	-	StatusCode::NO_CONTENT,
330	-	"registration failed: {body}"
331	-	);
332	-	base64::engine::general_purpose::STANDARD
333	-	.decode(&handle)
334	-	.unwrap()
335	-	}
336	-	}
337	-
338	-	// --- the tests -------------------------------------------------------------
339	-
340	-	#[tokio::test]
341	-	async fn a_registered_passkey_signs_in() {
342	-	let harness = harness().await;
343	-	let mut authenticator = Authenticator::new();
344	-	let handle = harness.register(&authenticator, "MacBook Touch ID").await;
345	-
346	-	// The credential is stored against the account, with the label we gave it.
347	-	let stored = anvil_core::passkeys::list(&harness.app.db, harness.user_id)
348	-	.await
349	-	.unwrap();
350	-	assert_eq!(stored.len(), 1);
351	-	assert_eq!(stored[0].name, "MacBook Touch ID");
352	-	assert_eq!(stored[0].last_used_at, 0, "not used yet");
353	-
354	-	// Sign in with it: no username anywhere in this exchange.
355	-	let (ceremony, challenge) = harness.begin_login().await;
356	-	let response = harness
357	-	.login(serde_json::json!({
358	-	"ceremony": ceremony,
359	-	"credential": authenticator.assert(&challenge, &handle),
360	-	}))
361	-	.await;
362	-	assert_eq!(response.status(), StatusCode::OK);
363	-
364	-	// A session cookie comes back, and it belongs to the right account.
365	-	let cookie = response
366	-	.headers()
367	-	.get(header::SET_COOKIE)
368	-	.expect("session cookie")
369	-	.to_str()
370	-	.unwrap()
371	-	.to_string();
372	-	let token = cookie
373	-	.split(';')
374	-	.next()
375	-	.unwrap()
376	-	.trim_start_matches("anvil_session=")
377	-	.to_string();
378	-	let signed_in = sessions::lookup_user(&harness.app.db, &token)
379	-	.await
380	-	.unwrap()
381	-	.expect("the cookie names a live session");
382	-	assert_eq!(signed_in.id, harness.user_id);
383	-
384	-	// The sign-in is recorded against the credential.
385	-	let stored = anvil_core::passkeys::list(&harness.app.db, harness.user_id)
386	-	.await
387	-	.unwrap();
388	-	assert!(stored[0].last_used_at > 0, "last use should be stamped");
389	-	}
390	-
391	-	#[tokio::test]
392	-	async fn a_second_passkey_shares_the_account_handle_and_is_excluded() {
393	-	let harness = harness().await;
394	-	let first = Authenticator::new();
395	-	let handle = harness.register(&first, "laptop").await;
396	-
397	-	// Registering another authenticator reuses the same user handle, so the
398	-	// account does not fork into two identities.
399	-	let (_, second_handle, _) = harness.begin_registration().await;
400	-	assert_eq!(
401	-	base64::engine::general_purpose::STANDARD
402	-	.decode(&second_handle)
403	-	.unwrap(),
404	-	handle
405	-	);
406	-
407	-	// …and the browser is told to refuse the already-registered credential.
408	-	let (status, body) = harness
409	-	.post_json("/-/settings/passkeys/begin", serde_json::json!({}))
410	-	.await;
411	-	assert_eq!(status, StatusCode::OK);
412	-	let json: serde_json::Value = serde_json::from_str(&body).unwrap();
413	-	let excluded = json["options"]["excludeCredentials"].as_array().unwrap();
414	-	assert_eq!(excluded.len(), 1);
415	-	assert_eq!(
416	-	excluded[0]["id"].as_str().unwrap(),
417	-	b64url(&first.credential_id)
418	-	);
419	-	}
420	-
421	-	/// Registration options must stay compatible with authenticators that do not
422	-	/// implement credProtect — phones over hybrid, plenty of security keys. With
423	-	/// enforcement on, those fail the whole ceremony inside the browser, before
424	-	/// anything reaches the server. User verification is still required, which is
425	-	/// what actually gates a sign-in.
426	-	#[tokio::test]
427	-	async fn registration_asks_for_credprotect_without_enforcing_it() {
428	-	let harness = harness().await;
429	-	let (status, body) = harness
430	-	.post_json("/-/settings/passkeys/begin", serde_json::json!({}))
431	-	.await;
432	-	assert_eq!(status, StatusCode::OK);
433	-	let options: serde_json::Value = serde_json::from_str(&body).unwrap();
434	-	let options = &options["options"];
435	-
436	-	assert_eq!(
437	-	options["extensions"]["enforceCredentialProtectionPolicy"],
438	-	serde_json::json!(false),
439	-	);
440	-	assert_eq!(
441	-	options["authenticatorSelection"]["userVerification"],
442	-	serde_json::json!("required"),
443	-	);
444	-	assert_eq!(
445	-	options["authenticatorSelection"]["residentKey"],
446	-	serde_json::json!("required"),
447	-	);
448	-	}
449	-
450	-	#[tokio::test]
451	-	async fn a_forged_signature_is_refused() {
452	-	let harness = harness().await;
453	-	let mut authenticator = Authenticator::new();
454	-	let handle = harness.register(&authenticator, "laptop").await;
455	-
456	-	// Same credential id, a different key: what a stolen database plus a
457	-	// home-made authenticator would produce.
458	-	let (ceremony, challenge) = harness.begin_login().await;
459	-	let mut impostor = Authenticator::new();
460	-	impostor.credential_id = authenticator.credential_id.clone();
461	-	let response = harness
462	-	.login(serde_json::json!({
463	-	"ceremony": ceremony,
464	-	"credential": impostor.assert(&challenge, &handle),
465	-	}))
466	-	.await;
467	-	assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
468	-	assert!(
469	-	response.headers().get(header::SET_COOKIE).is_none(),
470	-	"a rejected sign-in must not set a session"
471	-	);
472	-
473	-	// The real authenticator still works afterwards.
474	-	let (ceremony, challenge) = harness.begin_login().await;
475	-	let response = harness
476	-	.login(serde_json::json!({
477	-	"ceremony": ceremony,
478	-	"credential": authenticator.assert(&challenge, &handle),
479	-	}))
480	-	.await;
481	-	assert_eq!(response.status(), StatusCode::OK);
482	-	}
483	-
484	-	#[tokio::test]
485	-	async fn a_captured_assertion_cannot_be_replayed() {
486	-	let harness = harness().await;
487	-	let mut authenticator = Authenticator::new();
488	-	let handle = harness.register(&authenticator, "laptop").await;
489	-
490	-	let (ceremony, challenge) = harness.begin_login().await;
491	-	let assertion = authenticator.assert(&challenge, &handle);
492	-	let first = harness
493	-	.login(serde_json::json!({ "ceremony": ceremony.clone(), "credential": assertion.clone() }))
494	-	.await;
495	-	assert_eq!(first.status(), StatusCode::OK);
496	-
497	-	// Replaying the identical exchange fails: the challenge is spent.
498	-	let second = harness
499	-	.login(serde_json::json!({ "ceremony": ceremony, "credential": assertion }))
500	-	.await;
501	-	assert_eq!(second.status(), StatusCode::BAD_REQUEST);
502	-	}
503	-
504	-	#[tokio::test]
505	-	async fn an_unregistered_passkey_cannot_sign_in() {
506	-	let harness = harness().await;
507	-	let mut stranger = Authenticator::new();
508	-	let (ceremony, challenge) = harness.begin_login().await;
509	-	let response = harness
510	-	.login(serde_json::json!({
511	-	"ceremony": ceremony,
512	-	"credential": stranger.assert(&challenge, &[7u8; 64]),
513	-	}))
514	-	.await;
515	-	assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
516	-	}
517	-
518	-	#[tokio::test]
519	-	async fn removing_a_passkey_revokes_it() {
520	-	let harness = harness().await;
521	-	let mut authenticator = Authenticator::new();
522	-	let handle = harness.register(&authenticator, "laptop").await;
523	-	let stored = anvil_core::passkeys::list(&harness.app.db, harness.user_id)
524	-	.await
525	-	.unwrap();
526	-
527	-	let (status, _) = harness
528	-	.send(
529	-	Request::post(format!("/-/settings/passkeys/{}/delete", stored[0].id))
530	-	.header(header::COOKIE, &harness.cookie)
531	-	.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
532	-	.body(Body::from(format!("csrf={}", harness.csrf)))
533	-	.unwrap(),
534	-	)
535	-	.await;
536	-	assert_eq!(status, StatusCode::SEE_OTHER);
537	-
538	-	let (ceremony, challenge) = harness.begin_login().await;
539	-	let response = harness
540	-	.login(serde_json::json!({
541	-	"ceremony": ceremony,
542	-	"credential": authenticator.assert(&challenge, &handle),
543	-	}))
544	-	.await;
545	-	assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
546	-	}

⋯ 12 unchanged lines
13	13		# differently named instance (ANVIL_DEV_NAME=anvil2) still gets correct links.
14	14		base_url = "https://anvil.localhost"
15	15
	16	+	# Single sign-on against the local instance of login.richardscollin.com
	17	+	# (../login-richardscollin, `portless` → https://login.localhost). Register the
	18	+	# client there first and pass ANVIL_OIDC_CLIENT_SECRET to deploy/dev.sh — see
	19	+	# docs/oidc.md. Until then the sign-in button is there but the provider is not,
	20	+	# so use a password.
	21	+	[oidc]
	22	+	issuer = "https://login.localhost"
	23	+	client_id = "anvil"
	24	+
16	25		[ssh]
17	26		enabled = true
18	27		listen = "0.0.0.0:2222"
⋯ 18 unchanged lines

⋯ 64 unchanged lines
65	65
66	66		echo "==> (re)starting container $NAME"
67	67		docker rm -f "$NAME" >/dev/null 2>&1 \|\| true
	68	+
	69	+	# Single sign-on against a provider on https://login.localhost (docs/oidc.md).
	70	+	# Two things the container does not get for free: the name resolves to its own
	71	+	# loopback rather than the host's portless proxy, and portless's CA — trusted
	72	+	# on the host by `portless trust` — is not in the image's root store. So point
	73	+	# the name at the host gateway, and hand the binary a bundle that is the host's
	74	+	# roots plus that CA (rustls reads SSL_CERT_FILE).
	75	+	SSO_ARGS=()
	76	+	if [[ -f "$HOME/.portless/ca.pem" ]]; then
	77	+	HOST_ROOTS="$(ls /etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt 2>/dev/null \| head -n1)"
	78	+	cat "$HOST_ROOTS" "$HOME/.portless/ca.pem" >deploy/dev-ca.crt 2>/dev/null \|\| true
	79	+	if [[ -s deploy/dev-ca.crt ]]; then
	80	+	SSO_ARGS+=(
	81	+	--add-host "login.localhost:host-gateway"
	82	+	-v "$PWD/deploy/dev-ca.crt:/etc/ssl/certs/anvil-dev-ca.crt:ro,z"
	83	+	-e "SSL_CERT_FILE=/etc/ssl/certs/anvil-dev-ca.crt"
	84	+	)
	85	+	fi
	86	+	fi
	87	+	# The secret for the client registered at that provider, when there is one.
	88	+	if [[ -n "${ANVIL_OIDC_CLIENT_SECRET:-}" ]]; then
	89	+	SSO_ARGS+=(-e "ANVIL_OIDC_CLIENT_SECRET=${ANVIL_OIDC_CLIENT_SECRET}")
	90	+	fi
	91	+
68	92		# The CI runner is a Docker client, so it needs the socket and the group that
69	93		# owns it. `label=disable` rather than a `:z` relabel: :z would rewrite the
70	94		# label on the host's socket, which every other container also uses.
⋯ 5 unchanged lines
76	100		--security-opt label=disable \
77	101		--group-add "$(stat -c '%g' /var/run/docker.sock)" \
78	102		-e "ANVIL_BASE_URL=https://$NAME.localhost" \
	103	+	"${SSO_ARGS[@]}" \
79	104		"$IMAGE" >/dev/null
80	105
81	106		# Wait for the server to answer before handing over a URL that would 502.
⋯ 33 unchanged lines

⋯ 17 unchanged lines
18	18		# pushed. Do not expose this instance to untrusted users.
19	19		SOCK_GID="$(stat -c '%g' "$DOCKER_SOCK")"
20	20
	21	+	# Single sign-on's client secret, if this instance uses one (docs/oidc.md).
	22	+	# Passed only when set: an empty value would override the config file with
	23	+	# "no secret" and turn a confidential client into a public one.
	24	+	OIDC_ENV=()
	25	+	if [[ -n "${ANVIL_OIDC_CLIENT_SECRET:-}" ]]; then
	26	+	OIDC_ENV=(-e "ANVIL_OIDC_CLIENT_SECRET=${ANVIL_OIDC_CLIENT_SECRET}")
	27	+	fi
	28	+
21	29		docker rm -f anvil 2>/dev/null \|\| true
22	30		docker run -d \
23	31		--name anvil \
⋯ 3 unchanged lines
27	35		-v anvil-data:/data \
28	36		-v "${DOCKER_SOCK}:/var/run/docker.sock" \
29	37		--group-add "$SOCK_GID" \
	38	+	"${OIDC_ENV[@]}" \
30	39		"$IMAGE"
31	40
32	41		echo "==> anvil (re)started from $IMAGE (web: anvil:3000 via Caddy, ssh: host :${SSH_PORT}, docker.sock gid ${SOCK_GID})"

1	+	# Single sign-on (OIDC)
2	+
3	+	Sign in to anvil with an account at an OpenID Connect provider —
4	+	[login.richardscollin.com](https://login.richardscollin.com) for this instance,
5	+	where one passkey covers every app on the domain.
6	+
7	+	It is additive. Password sign-in keeps working, remains the way in if the
8	+	provider is down, and is the only way in on an instance with no `[oidc] issuer`
9	+	configured. The two are reconciled on the `sub` claim, which the provider
10	+	promises never changes, rather than on email, which does.
11	+
12	+	## Using it
13	+
14	+	The login page grows a Sign in with … button. Pressing it hands you to the
15	+	provider and back; anvil then finds your account, or makes one.
16	+
17	+	Which account you land on:
18	+
19	+	1. Linked already — the `sub` claim matches an account. Its email and admin
20	+	flag are refreshed from the token, and you are in.
21	+	2. An account that predates single sign-on — same email, not yet linked.
22	+	Adopted, once, and only on an address the provider says it verified.
23	+	Linking on an unverified address is how one account takes over another, so
24	+	anvil refuses and tells you to use your password.
25	+	3. Nobody — a fresh account, named from `preferred_username` (sanitized,
26	+	and suffixed `-2`, `-3`, … if taken; falling back to the email's local part
27	+	when the name is reserved or unusable). It has no password: the stored
28	+	hash is empty, which no password can match. `anvild user password` sets one
29	+	if you ever want a local fallback.
30	+
31	+	The provider decides who may sign in at all — access lives in its
32	+	`client_grants`, not in an invite list here. Its per-app `role` claim decides
33	+	who administers anvil: `admin` grants the flag, anything else removes it, and a
34	+	token carrying no role at all leaves the local flag alone rather than quietly
35	+	demoting somebody.
36	+
37	+	Signing out ends the provider's session too (`[oidc] sso_logout`, on by
38	+	default), so "sign out" means everywhere rather than just here.
39	+
40	+	## Configuring it
41	+
42	+	```toml
43	+	[oidc]
44	+	issuer = "https://login.richardscollin.com" # empty disables SSO entirely
45	+	client_id = "anvil"
46	+	client_secret = "" # prefer ANVIL_OIDC_CLIENT_SECRET; see below
47	+	redirect_uri = "" # default: base_url + /-/oidc/callback
48	+	label = "" # default: the issuer's host
49	+	sso_logout = true
50	+	```
51	+
52	+	`ANVIL_OIDC_ISSUER`, `ANVIL_OIDC_CLIENT_ID`, `ANVIL_OIDC_CLIENT_SECRET` and
53	+	`ANVIL_OIDC_REDIRECT_URI` override the file. **Keep the secret in the
54	+	environment**: config files get committed, and `deploy/run.sh` (production) and
55	+	`deploy/dev.sh` (local) both pass `ANVIL_OIDC_CLIENT_SECRET` through when it is
56	+	set. A client registered as public needs no secret at all — PKCE protects the
57	+	code either way.
58	+
59	+	`redirect_uri` must match what is registered at the provider exactly; there
60	+	are no wildcards. It defaults to `base_url` + `/-/oidc/callback`, so getting
61	+	`http.base_url` right (as `PORTLESS_URL`/`ANVIL_BASE_URL` do behind a proxy) is
62	+	usually all it takes.
63	+
64	+	## Registering anvil at the provider
65	+
66	+	Admin panel → Apps → Register, or from a checkout of the provider
67	+	([../login-richardscollin](https://github.com/richardscollin)):
68	+
69	+	```sh
70	+	npm run register-client -- \
71	+	--id anvil --name anvil \
72	+	--redirect https://anvil.localhost/-/oidc/callback \
73	+	--post-logout https://anvil.localhost/ \
74	+	--grant you@example.com:admin
75	+	```
76	+
77	+	That prints the client secret once. Against the deployed provider the same
78	+	script runs inside the container, which is where production's database lives:
79	+
80	+	```sh
81	+	ssh collin@hagrid 'docker exec login node --experimental-strip-types \
82	+	scripts/register-client.ts --id anvil --name anvil \
83	+	--redirect https://anvil.richardscollin.com/-/oidc/callback \
84	+	--post-logout https://anvil.richardscollin.com/ \
85	+	--grant you@example.com:admin'
86	+	```
87	+
88	+	Redirect URIs are matched exactly, so development and production need separate
89	+	entries (pass `--redirect` twice) or separate clients. Production's client here
90	+	carries production URIs only.
91	+
92	+	## Local development
93	+
94	+	The provider runs on `https://login.localhost` (`portless` in its checkout);
95	+	`deploy/anvil.dev.toml` points at it.
96	+
97	+	Running anvil natively (`cargo run`) needs nothing more, as long as
98	+	`portless trust` has put its CA in the system store — anvil's HTTP client uses
99	+	the system roots, not a bundled set, precisely so a locally-issued
100	+	certificate works.
101	+
102	+	Running it in Docker (`deploy/dev.sh`) needs two things the container does not
103	+	get for free, and the script arranges both: `login.localhost` resolves to the
104	+	container's own loopback rather than the host's proxy (fixed with
105	+	`--add-host login.localhost:host-gateway`), and portless's CA is not in the
106	+	image's root store (fixed by mounting the host's roots plus that CA and
107	+	pointing `SSL_CERT_FILE` at the result).
108	+
109	+	## What is checked, and why
110	+
111	+	The code flow is only as good as its verification, so everything the provider
112	+	sends back is checked before it becomes a session:
113	+
114	+	- PKCE (S256), always. The verifier never leaves this server, so a code
115	+	captured in transit cannot be redeemed. Cheap, and it removes the entire
116	+	stolen-code class.
117	+	- `state`, compared in constant time against a value held in a ten-minute,
118	+	`HttpOnly`, `SameSite=Lax` cookie scoped to `/-/oidc`. Strict would be
119	+	withheld on the redirect back, which is the one hop that matters.
120	+	- The id token's signature, RS256 against the provider's published JWKS. The
121	+	`alg` header is not consulted for which algorithm to use — accepting that is
122	+	how `none` and algorithm-confusion attacks get in. An unknown `kid` triggers
123	+	one refetch, which is how a key rotation propagates.
124	+	- `iss`, `aud`, `exp`, against the configured issuer and client id.
125	+	- `nonce`, against this login's own — what stops a token minted for one
126	+	sign-in being replayed into another.
127	+	- The discovery document's own `issuer`, which must equal the configured
128	+	one. Otherwise a hijacked discovery URL could point anvil at somebody else's
129	+	token endpoint while every later `iss` check still passed.
130	+
131	+	A failure at any of these renders an error page and sets no session.
132	+
133	+	## Implementation
134	+
135	+	`crates/anvil-web/src/oidc.rs` is the whole client: discovery, the two routes,
136	+	the id token verification, and the mapping onto a local account. RS256
137	+	verification uses `ring` (already in the tree under rustls) rather than a JWT
138	+	crate, because the maintained ones default to `aws-lc-rs`, which needs cmake and
139	+	will not cross-compile to the static musl the deploy image is built from.
140	+
141	+	`crates/anvil-web/tests/oidc_flow.rs` drives the whole hand-off against a
142	+	stand-in provider that signs real RS256 tokens, covering the happy path,
143	+	adoption of an existing account, username collisions, and the failures above.

1	-	# Passkeys
2	-
3	-	Sign in with Touch ID, Windows Hello, a phone, or a security key instead of an
4	-	account password. Passkeys are for login only — repository secrets
5	-	([secrets.md](secrets.md)) stay keyed to your ssh keys, because CI needs to
6	-	unlock them from a terminal where no authenticator is present.
7	-
8	-	## Using them
9	-
10	-	Register (account settings → Passkeys): name the device, press *Add
11	-	passkey*, approve the prompt. Registering a second passkey on the same
12	-	authenticator is refused by the browser rather than silently duplicated — anvil
13	-	sends the existing credential ids as `excludeCredentials`.
14	-
15	-	Sign in: the login page's Sign in with a passkey button. No username: a
16	-	passkey is a discoverable credential, so the authenticator tells anvil which
17	-	credential it used and that identifies the account.
18	-
19	-	Password sign-in keeps working, and remains the way in if you lose every
20	-	authenticator. Removing your last passkey is allowed for the same reason.
21	-
22	-	## What anvil stores, and what it means if the database leaks
23	-
24	-	Only public material: the credential id, the credential's public key, and the
25	-	counters WebAuthn asks a relying party to track. The private key stays in the
26	-	authenticator and is never transmitted, so — unlike a password hash — nothing in
27	-	the `passkeys` table can be turned into a login, offline or otherwise. A leak
28	-	costs users their registrations, not their accounts.
29	-
30	-	Two properties come from the protocol rather than from anvil's code:
31	-
32	-	- Phishing resistance. The authenticator binds every signature to anvil's
33	-	relying-party id. A look-alike site cannot get a usable signature, even with a
34	-	perfect replica of this UI.
35	-	- Replay resistance. Every ceremony is a fresh random challenge, held in
36	-	memory, valid for five minutes, and accepted exactly once.
37	-
38	-	## The relying-party id is your `base_url` host
39	-
40	-	WebAuthn scopes a credential to one host, taken here from `http.base_url`:
41	-
42	-	\| `base_url` \| RP id \|
43	-	\|-----------------------------------\|---------------------------\|
44	-	\| `https://anvil.richardscollin.com` \| `anvil.richardscollin.com` \|
45	-	\| `https://anvil.localhost` \| `anvil.localhost` \|
46	-	\| `http://localhost:3000` \| `localhost` \|
47	-
48	-	Consequences worth knowing before you move an instance:
49	-
50	-	- Change the host and existing passkeys stop working. They are not deleted,
51	-	they simply belong to a different site now; users re-register (password login
52	-	is the way back in).
53	-	- Passkeys do not travel between instances. One created against the local
54	-	Docker instance (`deploy/dev.sh`) is not usable on production, by design.
55	-	- WebAuthn requires a secure context: HTTPS, or plain `localhost`. A LAN IP
56	-	over HTTP will not offer passkeys at all. `deploy/dev.sh` + portless gives
57	-	local development real HTTPS, which is why passkeys can be tested there.
58	-
59	-	## Implementation
60	-
61	-	`crates/anvil-core/src/passkeys.rs` holds the credential storage and the
62	-	in-memory challenge registry; `crates/anvil-web/src/passkeys.rs` holds the two
63	-	ceremonies, the JSON, and the browser glue.
64	-
65	-	Verification is [`webauthn_rp`](https://crates.io/crates/webauthn_rp), chosen
66	-	over the better-known `webauthn-rs` for one hard reason: `webauthn-rs` depends
67	-	on OpenSSL, and anvil ships as a statically linked musl binary built by
68	-	`deploy/build.sh` with no C toolchain in the picture. `webauthn_rp` is pure Rust
69	-	and implements the spec's ceremony steps explicitly.
70	-
71	-	Only passkeys are supported — discoverable credentials with user verification
72	-	required. No attestation is requested (`none`), which is the norm for consumer
73	-	authenticators and avoids collecting hardware identifiers we have no use for.
74	-
75	-	The browser side hand-rolls the base64url ↔ ArrayBuffer conversions rather than
76	-	using `PublicKeyCredential.parseCreationOptionsFromJSON()` / `toJSON()`: those
77	-	are recent enough that relying on them would narrow support to new browsers for
78	-	no gain.